saml_idp 0.5.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (23) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +2 -4
  3. data/app/controllers/saml_idp/idp_controller.rb +7 -1
  4. data/lib/saml_idp/assertion_builder.rb +11 -8
  5. data/lib/saml_idp/controller.rb +19 -3
  6. data/lib/saml_idp/incoming_metadata.rb +1 -1
  7. data/lib/saml_idp/logout_builder.rb +18 -10
  8. data/lib/saml_idp/logout_request_builder.rb +1 -8
  9. data/lib/saml_idp/logout_response_builder.rb +5 -12
  10. data/lib/saml_idp/metadata_builder.rb +6 -5
  11. data/lib/saml_idp/request.rb +2 -1
  12. data/lib/saml_idp/response_builder.rb +10 -8
  13. data/lib/saml_idp/version.rb +1 -1
  14. data/spec/acceptance/idp_controller_spec.rb +0 -2
  15. data/spec/lib/saml_idp/assertion_builder_spec.rb +12 -2
  16. data/spec/lib/saml_idp/controller_spec.rb +49 -36
  17. data/spec/lib/saml_idp/metadata_builder_spec.rb +37 -0
  18. data/spec/lib/saml_idp/request_spec.rb +1 -0
  19. data/spec/lib/saml_idp/response_builder_spec.rb +10 -0
  20. data/spec/rails_app/app/controllers/saml_idp_controller.rb +0 -2
  21. data/spec/spec_helper.rb +0 -1
  22. data/spec/support/saml_request_macros.rb +0 -1
  23. metadata +2 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 93be89334cf44650af8cc55f114a3d873af44cf5
4
- data.tar.gz: 0802b704af21d4403221a1aa5087bde77592e104
3
+ metadata.gz: 33d61d6767a79ea9158672fd6ef93c08c70bf4e6
4
+ data.tar.gz: a2160be6f4da871e04811e6568695328c2e226e9
5
5
  SHA512:
6
- metadata.gz: d62633f5d8e338639b7dfa346ebbbcf5ed280382addb9e3db170effe19a87c5df797f5284268cd8b52d77c1b1f8408ed6ff40fc1c09225f83bb19f212095f3ea
7
- data.tar.gz: 21354ec9146654b28138a44dc92db871331c95f38d41e383edc945ded85530af7719456b55a0ca205250618ab1b8a8854c0310d6baf119b76a53be5bd1b6e350
6
+ metadata.gz: 3675637b4e2c170f3d2c14a9920e61584b95cdfbaf32d8e93492a45c59bd3df32d2c546e6b819b6712c8c039906f527facad0ecff511a7379b4167a2d28e1104
7
+ data.tar.gz: ba1f8db3b4f1e994b8b07ceb455c9bfc76de28b476ef727d6eecf59418d7df3c089a328fdac0c42dfbe94fcdeea27022a2999dad7341e25ad08cda60faf8cf88
data/README.md CHANGED
@@ -42,9 +42,7 @@ match '/saml/logout' => 'saml_idp#logout', via: [:get, :post, :delete]
42
42
  Create a controller that looks like this, customize to your own situation:
43
43
 
44
44
  ``` ruby
45
- class SamlIdpController
46
- include SamlIdp::IdpController
47
-
45
+ class SamlIdpController < SamlIdp::IdpController
48
46
  def idp_authenticate(email, password) # not using params intentionally
49
47
  user = User.by_email(email).first
50
48
  user && user.valid_password?(password) ? user : nil
@@ -209,7 +207,7 @@ end
209
207
  To generate the SAML Response it uses a default X.509 certificate and secret key... which isn't so secret.
210
208
  You can find them in `SamlIdp::Default`. The X.509 certificate is valid until year 2032.
211
209
  Obviously you shouldn't use these if you intend to use this in production environments. In that case,
212
- within the controller set the properties `x509_certificate` and `secret_key` using a `prepend_before_filter`
210
+ within the controller set the properties `x509_certificate` and `secret_key` using a `prepend_before_action`
213
211
  callback within the current request context or set them globally via the `SamlIdp.config.x509_certificate`
214
212
  and `SamlIdp.config.secret_key` properties.
215
213
 
data/app/controllers/saml_idp/idp_controller.rb CHANGED
@@ -1,11 +1,17 @@
1
1
  # encoding: utf-8
2
+
2
3
  module SamlIdp
3
4
  class IdpController < ActionController::Base
4
5
  include SamlIdp::Controller
5
6
 
6
7
  unloadable unless Rails::VERSION::MAJOR >= 4
7
8
  protect_from_forgery
8
- before_filter :validate_saml_request, only: [:new, :create]
9
+
10
+ if Rails::VERSION::MAJOR >= 4
11
+ before_action :validate_saml_request, only: [:new, :create]
12
+ else
13
+ before_filter :validate_saml_request, only: [:new, :create]
14
+ end
9
15
 
10
16
  def new
11
17
  render template: "saml_idp/idp/new"
data/lib/saml_idp/assertion_builder.rb CHANGED
@@ -42,9 +42,12 @@ module SamlIdp
42
42
  assertion.Subject do |subject|
43
43
  subject.NameID name_id, Format: name_id_format[:name]
44
44
  subject.SubjectConfirmation Method: Saml::XML::Namespaces::Methods::BEARER do |confirmation|
45
- confirmation.SubjectConfirmationData "", InResponseTo: saml_request_id,
46
- NotOnOrAfter: not_on_or_after_subject,
47
- Recipient: saml_acs_url
45
+ confirmation_hash = {}
46
+ confirmation_hash[:InResponseTo] = saml_request_id unless saml_request_id.nil?
47
+ confirmation_hash[:NotOnOrAfter] = not_on_or_after_subject
48
+ confirmation_hash[:Recipient] = saml_acs_url
49
+
50
+ confirmation.SubjectConfirmationData "", confirmation_hash
48
51
  end
49
52
  end
50
53
  assertion.Conditions NotBefore: not_before, NotOnOrAfter: not_on_or_after_condition do |conditions|
@@ -52,6 +55,11 @@ module SamlIdp
52
55
  restriction.Audience audience_uri
53
56
  end
54
57
  end
58
+ assertion.AuthnStatement AuthnInstant: now_iso, SessionIndex: reference_string do |statement|
59
+ statement.AuthnContext do |context|
60
+ context.AuthnContextClassRef authn_context_classref
61
+ end
62
+ end
55
63
  if asserted_attributes
56
64
  assertion.AttributeStatement do |attr_statement|
57
65
  asserted_attributes.each do |friendly_name, attrs|
@@ -67,11 +75,6 @@ module SamlIdp
67
75
  end
68
76
  end
69
77
  end
70
- assertion.AuthnStatement AuthnInstant: now_iso, SessionIndex: reference_string do |statement|
71
- statement.AuthnContext do |context|
72
- context.AuthnContextClassRef authn_context_classref
73
- end
74
- end
75
78
  end
76
79
  end
77
80
  alias_method :raw, :fresh
data/lib/saml_idp/controller.rb CHANGED
@@ -14,17 +14,32 @@ module SamlIdp
14
14
  end
15
15
 
16
16
  attr_accessor :algorithm
17
- attr_accessor :saml_request
18
17
 
19
18
  protected
20
19
 
20
+ def saml_request
21
+ @saml_request ||= Struct.new(:request_id) do
22
+ def authn_request?
23
+ true
24
+ end
25
+
26
+ def issuer
27
+ nil
28
+ end
29
+
30
+ def acs_url
31
+ nil
32
+ end
33
+ end.new(nil)
34
+ end
35
+
21
36
  def validate_saml_request(raw_saml_request = params[:SAMLRequest])
22
37
  decode_request(raw_saml_request)
23
38
  render nothing: true, status: :forbidden unless valid_saml_request?
24
39
  end
25
40
 
26
41
  def decode_request(raw_saml_request)
27
- self.saml_request = Request.from_deflated_request(raw_saml_request)
42
+ @saml_request = Request.from_deflated_request(raw_saml_request)
28
43
  end
29
44
 
30
45
  def authn_context_classref
@@ -37,6 +52,7 @@ module SamlIdp
37
52
  audience_uri = opts[:audience_uri] || saml_request.issuer || saml_acs_url[/^(.*?\/\/.*?\/)/, 1]
38
53
  opt_issuer_uri = opts[:issuer_uri] || issuer_uri
39
54
  my_authn_context_classref = opts[:authn_context_classref] || authn_context_classref
55
+ acs_url = opts[:acs_url] || saml_acs_url
40
56
  expiry = opts[:expiry] || 60*60
41
57
  encryption_opts = opts[:encryption] || nil
42
58
 
@@ -47,7 +63,7 @@ module SamlIdp
47
63
  principal,
48
64
  audience_uri,
49
65
  saml_request_id,
50
- saml_acs_url,
66
+ acs_url,
51
67
  (opts[:algorithm] || algorithm || default_algorithm),
52
68
  my_authn_context_classref,
53
69
  expiry,
data/lib/saml_idp/incoming_metadata.rb CHANGED
@@ -128,7 +128,7 @@ module SamlIdp
128
128
  end
129
129
 
130
130
  def contact_person_document
131
- @contact_person_document ||= xpath("//md:ContactPerson", md: metadata_namespace).first
131
+ @contact_person_document ||= (xpath("//md:ContactPerson", md: metadata_namespace).first || Saml::XML::Document.new)
132
132
  end
133
133
 
134
134
  def metadata_namespace
data/lib/saml_idp/logout_builder.rb CHANGED
@@ -3,35 +3,43 @@ module SamlIdp
3
3
  class LogoutBuilder
4
4
  include Signable
5
5
 
6
+ attr_accessor :response_id
7
+ attr_accessor :issuer_uri
8
+ attr_accessor :saml_slo_url
9
+ attr_accessor :algorithm
10
+
11
+ def initialize(response_id, issuer_uri, saml_slo_url, algorithm)
12
+ self.response_id = response_id
13
+ self.issuer_uri = issuer_uri
14
+ self.saml_slo_url = saml_slo_url
15
+ self.algorithm = algorithm
16
+ end
17
+
6
18
  # this is an abstract base class.
7
19
  def build
8
20
  raise "#{self.class} must implement build method"
9
21
  end
10
22
 
11
23
  def reference_id
12
- UUID.generate
13
- end
14
-
15
- def digest
16
- algorithm.hexdigest raw
24
+ self.response_id
17
25
  end
18
26
 
19
27
  def encoded
20
28
  @encoded ||= encode
21
- end
29
+ end
22
30
 
23
- def raw
31
+ def raw
24
32
  build
25
- end
33
+ end
26
34
 
27
35
  def encode
28
36
  Base64.strict_encode64(raw)
29
- end
37
+ end
30
38
  private :encode
31
39
 
32
40
  def response_id_string
33
41
  "_#{response_id}"
34
- end
42
+ end
35
43
  private :response_id_string
36
44
 
37
45
  def now_iso
data/lib/saml_idp/logout_request_builder.rb CHANGED
@@ -1,18 +1,11 @@
1
1
  require 'saml_idp/logout_builder'
2
2
  module SamlIdp
3
3
  class LogoutRequestBuilder < LogoutBuilder
4
- attr_accessor :response_id
5
- attr_accessor :issuer_uri
6
- attr_accessor :saml_slo_url
7
4
  attr_accessor :name_id
8
- attr_accessor :algorithm
9
5
 
10
6
  def initialize(response_id, issuer_uri, saml_slo_url, name_id, algorithm)
11
- self.response_id = response_id
12
- self.issuer_uri = issuer_uri
13
- self.saml_slo_url = saml_slo_url
7
+ super(response_id, issuer_uri, saml_slo_url, algorithm)
14
8
  self.name_id = name_id
15
- self.algorithm = algorithm
16
9
  end
17
10
 
18
11
  def build
data/lib/saml_idp/logout_response_builder.rb CHANGED
@@ -1,19 +1,12 @@
1
1
  require 'saml_idp/logout_builder'
2
2
  module SamlIdp
3
3
  class LogoutResponseBuilder < LogoutBuilder
4
- attr_accessor :response_id
5
- attr_accessor :issuer_uri
6
- attr_accessor :saml_slo_url
7
4
  attr_accessor :saml_request_id
8
- attr_accessor :algorithm
9
5
 
10
6
  def initialize(response_id, issuer_uri, saml_slo_url, saml_request_id, algorithm)
11
- self.response_id = response_id
12
- self.issuer_uri = issuer_uri
13
- self.saml_slo_url = saml_slo_url
7
+ super(response_id, issuer_uri, saml_slo_url, algorithm)
14
8
  self.saml_request_id = saml_request_id
15
- self.algorithm = algorithm
16
- end
9
+ end
17
10
 
18
11
  def build
19
12
  builder = Builder::XmlMarkup.new
@@ -26,9 +19,9 @@ module SamlIdp
26
19
  response.Issuer issuer_uri, xmlns: Saml::XML::Namespaces::ASSERTION
27
20
  sign response
28
21
  response.Status xmlns: Saml::XML::Namespaces::PROTOCOL do |status|
29
- status.StatusCode Value: Saml::XML::Namespaces::Statuses::SUCCESS
30
- end
31
- end
22
+ status.StatusCode Value: Saml::XML::Namespaces::Statuses::SUCCESS
23
+ end
24
+ end
32
25
  end
33
26
  private :build
34
27
  end
data/lib/saml_idp/metadata_builder.rb CHANGED
@@ -24,11 +24,11 @@ module SamlIdp
24
24
 
25
25
  entity.IDPSSODescriptor protocolSupportEnumeration: protocol_enumeration do |descriptor|
26
26
  build_key_descriptor descriptor
27
- build_name_id_formats descriptor
28
27
  descriptor.SingleLogoutService Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
29
28
  Location: single_logout_service_post_location
30
29
  descriptor.SingleLogoutService Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
31
30
  Location: single_logout_service_redirect_location
31
+ build_name_id_formats descriptor
32
32
  descriptor.SingleSignOnService Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
33
33
  Location: single_service_post_location
34
34
  build_attribute descriptor
@@ -94,10 +94,11 @@ module SamlIdp
94
94
 
95
95
  def build_contact(el)
96
96
  el.ContactPerson contactType: "technical" do |contact|
97
- %w[company given_name sur_name telephone mail_to_string].each do |section|
98
- section_value = technical_contact.public_send(section)
99
- contact.Company section_value if section_value.present?
100
- end
97
+ contact.Company technical_contact.company if technical_contact.company
98
+ contact.GivenName technical_contact.given_name if technical_contact.given_name
99
+ contact.SurName technical_contact.sur_name if technical_contact.sur_name
100
+ contact.EmailAddress technical_contact.mail_to_string if technical_contact.mail_to_string
101
+ contact.TelephoneNumber technical_contact.telephone if technical_contact.telephone
101
102
  end
102
103
  end
103
104
  private :build_contact
data/lib/saml_idp/request.rb CHANGED
@@ -115,10 +115,11 @@ module SamlIdp
115
115
  end
116
116
 
117
117
  def service_provider?
118
- service_provider.valid?
118
+ service_provider && service_provider.valid?
119
119
  end
120
120
 
121
121
  def service_provider
122
+ return unless issuer.present?
122
123
  @_service_provider ||= ServiceProvider.new((service_provider_finder[issuer] || {}).merge(identifier: issuer))
123
124
  end
124
125
 
data/lib/saml_idp/response_builder.rb CHANGED
@@ -29,15 +29,17 @@ module SamlIdp
29
29
  private :encode
30
30
 
31
31
  def build
32
+ resp_options = {}
33
+ resp_options[:ID] = response_id_string
34
+ resp_options[:Version] = "2.0"
35
+ resp_options[:IssueInstant] = now_iso
36
+ resp_options[:Destination] = saml_acs_url
37
+ resp_options[:Consent] = Saml::XML::Namespaces::Consents::UNSPECIFIED
38
+ resp_options[:InResponseTo] = saml_request_id unless saml_request_id.nil?
39
+ resp_options["xmlns:samlp"] = Saml::XML::Namespaces::PROTOCOL
40
+
32
41
  builder = Builder::XmlMarkup.new
33
- builder.tag! "samlp:Response",
34
- ID: response_id_string,
35
- Version: "2.0",
36
- IssueInstant: now_iso,
37
- Destination: saml_acs_url,
38
- Consent: Saml::XML::Namespaces::Consents::UNSPECIFIED,
39
- InResponseTo: saml_request_id,
40
- "xmlns:samlp" => Saml::XML::Namespaces::PROTOCOL do |response|
42
+ builder.tag! "samlp:Response", resp_options do |response|
41
43
  response.Issuer issuer_uri, xmlns: Saml::XML::Namespaces::ASSERTION
42
44
  response.tag! "samlp:Status" do |status|
43
45
  status.tag! "samlp:StatusCode", Value: Saml::XML::Namespaces::Statuses::SUCCESS
data/lib/saml_idp/version.rb CHANGED
@@ -1,4 +1,4 @@
1
1
  # encoding: utf-8
2
2
  module SamlIdp
3
- VERSION = '0.5.0'
3
+ VERSION = '0.6.0'
4
4
  end
data/spec/acceptance/idp_controller_spec.rb CHANGED
@@ -1,7 +1,6 @@
1
1
  require File.expand_path(File.dirname(__FILE__) + '/acceptance_helper')
2
2
 
3
3
  feature 'IdpController' do
4
-
5
4
  scenario 'Login via default signup page' do
6
5
  saml_request = make_saml_request("http://foo.example.com/saml/consume")
7
6
  visit "/saml/auth?SAMLRequest=#{CGI.escape(saml_request)}"
@@ -12,5 +11,4 @@ feature 'IdpController' do
12
11
  current_url.should == 'http://foo.example.com/saml/consume'
13
12
  page.should have_content "foo@example.com"
14
13
  end
15
-
16
14
  end
data/spec/lib/saml_idp/assertion_builder_spec.rb CHANGED
@@ -31,9 +31,19 @@ module SamlIdp
31
31
  expiry
32
32
  ) }
33
33
 
34
+ context "No Request ID" do
35
+ let(:saml_request_id) { nil }
36
+
37
+ it "builds a legit raw XML file" do
38
+ Timecop.travel(Time.zone.local(2010, 6, 1, 13, 0, 0)) do
39
+ subject.raw.should == "<Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2010-06-01T13:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">foo@example.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData NotOnOrAfter=\"2010-06-01T13:03:00Z\" Recipient=\"http://saml.acs.url\"></SubjectConfirmationData></SubjectConfirmation></Subject><Conditions NotBefore=\"2010-06-01T12:59:55Z\" NotOnOrAfter=\"2010-06-01T16:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AuthnStatement AuthnInstant=\"2010-06-01T13:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef></AuthnContext></AuthnStatement><AttributeStatement><Attribute Name=\"email-address\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" FriendlyName=\"emailAddress\"><AttributeValue>foo@example.com</AttributeValue></Attribute></AttributeStatement></Assertion>"
40
+ end
41
+ end
42
+ end
43
+
34
44
  it "builds a legit raw XML file" do
35
45
  Timecop.travel(Time.zone.local(2010, 6, 1, 13, 0, 0)) do
36
- subject.raw.should == "<Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2010-06-01T13:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">foo@example.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData InResponseTo=\"123\" NotOnOrAfter=\"2010-06-01T13:03:00Z\" Recipient=\"http://saml.acs.url\"></SubjectConfirmationData></SubjectConfirmation></Subject><Conditions NotBefore=\"2010-06-01T12:59:55Z\" NotOnOrAfter=\"2010-06-01T16:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name=\"email-address\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" FriendlyName=\"emailAddress\"><AttributeValue>foo@example.com</AttributeValue></Attribute></AttributeStatement><AuthnStatement AuthnInstant=\"2010-06-01T13:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef></AuthnContext></AuthnStatement></Assertion>"
46
+ subject.raw.should == "<Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2010-06-01T13:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">foo@example.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData InResponseTo=\"123\" NotOnOrAfter=\"2010-06-01T13:03:00Z\" Recipient=\"http://saml.acs.url\"></SubjectConfirmationData></SubjectConfirmation></Subject><Conditions NotBefore=\"2010-06-01T12:59:55Z\" NotOnOrAfter=\"2010-06-01T16:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AuthnStatement AuthnInstant=\"2010-06-01T13:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef></AuthnContext></AuthnStatement><AttributeStatement><Attribute Name=\"email-address\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" FriendlyName=\"emailAddress\"><AttributeValue>foo@example.com</AttributeValue></Attribute></AttributeStatement></Assertion>"
37
47
  end
38
48
  end
39
49
 
@@ -71,7 +81,7 @@ module SamlIdp
71
81
  expiry
72
82
  )
73
83
  Timecop.travel(Time.zone.local(2010, 6, 1, 13, 0, 0)) do
74
- builder.raw.should == "<Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2010-06-01T13:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">foo@example.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData InResponseTo=\"123\" NotOnOrAfter=\"2010-06-01T13:03:00Z\" Recipient=\"http://saml.acs.url\"></SubjectConfirmationData></SubjectConfirmation></Subject><Conditions NotBefore=\"2010-06-01T12:59:55Z\" NotOnOrAfter=\"2010-06-01T16:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name=\"emailAddress\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" FriendlyName=\"emailAddress\"><AttributeValue>foo@example.com</AttributeValue></Attribute></AttributeStatement><AuthnStatement AuthnInstant=\"2010-06-01T13:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef></AuthnContext></AuthnStatement></Assertion>"
84
+ builder.raw.should == "<Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2010-06-01T13:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">foo@example.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData InResponseTo=\"123\" NotOnOrAfter=\"2010-06-01T13:03:00Z\" Recipient=\"http://saml.acs.url\"></SubjectConfirmationData></SubjectConfirmation></Subject><Conditions NotBefore=\"2010-06-01T12:59:55Z\" NotOnOrAfter=\"2010-06-01T16:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AuthnStatement AuthnInstant=\"2010-06-01T13:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef></AuthnContext></AuthnStatement><AttributeStatement><Attribute Name=\"emailAddress\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" FriendlyName=\"emailAddress\"><AttributeValue>foo@example.com</AttributeValue></Attribute></AttributeStatement></Assertion>"
75
85
  end
76
86
  end
77
87
  end
data/spec/lib/saml_idp/controller_spec.rb CHANGED
@@ -19,11 +19,6 @@ describe SamlIdp::Controller do
19
19
  end
20
20
 
21
21
  context "SAML Responses" do
22
- before(:each) do
23
- params[:SAMLRequest] = make_saml_request
24
- validate_saml_request
25
- end
26
-
27
22
  let(:principal) { double email_address: "foo@example.com" }
28
23
  let (:encryption_opts) do
29
24
  {
@@ -33,28 +28,24 @@ describe SamlIdp::Controller do
33
28
  }
34
29
  end
35
30
 
36
- it "should create a SAML Response" do
37
- saml_response = encode_response(principal)
38
- response = OneLogin::RubySaml::Response.new(saml_response)
39
- response.name_id.should == "foo@example.com"
40
- response.issuers.first.should == "http://example.com"
41
- response.settings = saml_settings
42
- response.is_valid?.should be_truthy
31
+ context "unsolicited Response" do
32
+ it "should create a SAML Response" do
33
+ saml_response = encode_response(principal, { audience_uri: 'http://example.com/issuer', issuer_uri: 'http://example.com', acs_url: 'https://foo.example.com/saml/consume' })
34
+ response = OneLogin::RubySaml::Response.new(saml_response)
35
+ response.name_id.should == "foo@example.com"
36
+ response.issuers.first.should == "http://example.com"
37
+ response.settings = saml_settings
38
+ response.is_valid?.should be_truthy
39
+ end
43
40
  end
44
41
 
45
- it "should create a SAML Logout Response" do
46
- params[:SAMLRequest] = make_saml_logout_request
47
- validate_saml_request
48
- expect(saml_request.logout_request?).to eq true
49
- saml_response = encode_response(principal)
50
- response = OneLogin::RubySaml::Logoutresponse.new(saml_response, saml_settings)
51
- response.validate.should == true
52
- response.issuer.should == "http://example.com"
53
- end
42
+ context "solicited Response" do
43
+ before(:each) do
44
+ params[:SAMLRequest] = make_saml_request
45
+ validate_saml_request
46
+ end
54
47
 
55
- [:sha1, :sha256, :sha384, :sha512].each do |algorithm_name|
56
- it "should create a SAML Response using the #{algorithm_name} algorithm" do
57
- self.algorithm = algorithm_name
48
+ it "should create a SAML Response" do
58
49
  saml_response = encode_response(principal)
59
50
  response = OneLogin::RubySaml::Response.new(saml_response)
60
51
  response.name_id.should == "foo@example.com"
@@ -63,19 +54,41 @@ describe SamlIdp::Controller do
63
54
  response.is_valid?.should be_truthy
64
55
  end
65
56
 
66
- it "should encrypt SAML Response assertion" do
67
- self.algorithm = algorithm_name
68
- saml_response = encode_response(principal, encryption: encryption_opts)
69
- resp_settings = saml_settings
70
- resp_settings.private_key = SamlIdp::Default::SECRET_KEY
71
- response = OneLogin::RubySaml::Response.new(saml_response, settings: resp_settings)
72
- response.document.to_s.should_not match("foo@example.com")
73
- response.decrypted_document.to_s.should match("foo@example.com")
74
- response.name_id.should == "foo@example.com"
75
- response.issuers.first.should == "http://example.com"
76
- response.is_valid?.should be_truthy
57
+ it "should create a SAML Logout Response" do
58
+ params[:SAMLRequest] = make_saml_logout_request
59
+ validate_saml_request
60
+ expect(saml_request.logout_request?).to eq true
61
+ saml_response = encode_response(principal)
62
+ response = OneLogin::RubySaml::Logoutresponse.new(saml_response, saml_settings)
63
+ response.validate.should == true
64
+ response.issuer.should == "http://example.com"
65
+ end
66
+
67
+
68
+ [:sha1, :sha256, :sha384, :sha512].each do |algorithm_name|
69
+ it "should create a SAML Response using the #{algorithm_name} algorithm" do
70
+ self.algorithm = algorithm_name
71
+ saml_response = encode_response(principal)
72
+ response = OneLogin::RubySaml::Response.new(saml_response)
73
+ response.name_id.should == "foo@example.com"
74
+ response.issuers.first.should == "http://example.com"
75
+ response.settings = saml_settings
76
+ response.is_valid?.should be_truthy
77
+ end
78
+
79
+ it "should encrypt SAML Response assertion" do
80
+ self.algorithm = algorithm_name
81
+ saml_response = encode_response(principal, encryption: encryption_opts)
82
+ resp_settings = saml_settings
83
+ resp_settings.private_key = SamlIdp::Default::SECRET_KEY
84
+ response = OneLogin::RubySaml::Response.new(saml_response, settings: resp_settings)
85
+ response.document.to_s.should_not match("foo@example.com")
86
+ response.decrypted_document.to_s.should match("foo@example.com")
87
+ response.name_id.should == "foo@example.com"
88
+ response.issuers.first.should == "http://example.com"
89
+ response.is_valid?.should be_truthy
90
+ end
77
91
  end
78
92
  end
79
93
  end
80
-
81
94
  end
data/spec/lib/saml_idp/metadata_builder_spec.rb CHANGED
@@ -15,6 +15,43 @@ module SamlIdp
15
15
  '<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://example.com/saml/logout"/>'
16
16
  )
17
17
  end
18
+
19
+ context "technical contact" do
20
+ before do
21
+ subject.configurator.technical_contact.company = nil
22
+ subject.configurator.technical_contact.given_name = nil
23
+ subject.configurator.technical_contact.sur_name = nil
24
+ subject.configurator.technical_contact.telephone = nil
25
+ subject.configurator.technical_contact.email_address = nil
26
+ end
27
+
28
+ it "all fields" do
29
+ subject.configurator.technical_contact.company = "ACME Corporation"
30
+ subject.configurator.technical_contact.given_name = "Road"
31
+ subject.configurator.technical_contact.sur_name = "Runner"
32
+ subject.configurator.technical_contact.telephone = "1-800-555-5555"
33
+ subject.configurator.technical_contact.email_address = "acme@example.com"
34
+
35
+ subject.fresh.should match(
36
+ '<ContactPerson contactType="technical"><Company>ACME Corporation</Company><GivenName>Road</GivenName><SurName>Runner</SurName><EmailAddress>mailto:acme@example.com</EmailAddress><TelephoneNumber>1-800-555-5555</TelephoneNumber></ContactPerson>'
37
+ )
38
+ end
39
+
40
+ it "no fields" do
41
+ subject.fresh.should match(
42
+ '<ContactPerson contactType="technical"></ContactPerson>'
43
+ )
44
+ end
45
+
46
+ it "just email" do
47
+ subject.configurator.technical_contact.email_address = "acme@example.com"
48
+ subject.fresh.should match(
49
+ '<ContactPerson contactType="technical"><EmailAddress>mailto:acme@example.com</EmailAddress></ContactPerson>'
50
+ )
51
+ end
52
+
53
+ end
54
+
18
55
  it "includes logout element as HTTP Redirect" do
19
56
  subject.configurator.single_logout_service_redirect_location = 'https://example.com/saml/logout'
20
57
  subject.fresh.should match(
data/spec/lib/saml_idp/request_spec.rb CHANGED
@@ -66,6 +66,7 @@ module SamlIdp
66
66
  authn_request = described_class.new raw_req
67
67
  authn_request.issuer.should_not == ''
68
68
  authn_request.issuer.should == nil
69
+ authn_request.valid?.should == false
69
70
  end
70
71
  end
71
72
 
data/spec/lib/saml_idp/response_builder_spec.rb CHANGED
@@ -28,5 +28,15 @@ module SamlIdp
28
28
  subject.raw.should == "<samlp:Response ID=\"_abc\" Version=\"2.0\" IssueInstant=\"2010-06-01T13:00:00Z\" Destination=\"http://sportngin.com\" Consent=\"urn:oasis:names:tc:SAML:2.0:consent:unspecified\" InResponseTo=\"134\" xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\"><Issuer xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://example.com</Issuer><samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status><Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2013-07-31T05:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><signature>stuff</signature><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">jon.phenow@sportngin.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData InResponseTo=\"123\" NotOnOrAfter=\"2013-07-31T05:03:00Z\" Recipient=\"http://saml.acs.url\"/></SubjectConfirmation></Subject><Conditions NotBefore=\"2013-07-31T04:59:55Z\" NotOnOrAfter=\"2013-07-31T06:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\"><AttributeValue>jon.phenow@sportngin.com</AttributeValue></Attribute></AttributeStatement><AuthnStatment AuthnInstant=\"2013-07-31T05:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:federation:authentication:windows</AuthnContextClassRef></AuthnContext></AuthnStatment></Assertion></samlp:Response>"
29
29
  end
30
30
  end
31
+
32
+ context "No request ID" do
33
+ let(:saml_request_id) { nil }
34
+
35
+ it "builds a legit raw XML file without a request ID" do
36
+ Timecop.travel(Time.zone.local(2010, 6, 1, 13, 0, 0)) do
37
+ subject.raw.should == "<samlp:Response ID=\"_abc\" Version=\"2.0\" IssueInstant=\"2010-06-01T13:00:00Z\" Destination=\"http://sportngin.com\" Consent=\"urn:oasis:names:tc:SAML:2.0:consent:unspecified\" xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\"><Issuer xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://example.com</Issuer><samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status><Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2013-07-31T05:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><signature>stuff</signature><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">jon.phenow@sportngin.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData InResponseTo=\"123\" NotOnOrAfter=\"2013-07-31T05:03:00Z\" Recipient=\"http://saml.acs.url\"/></SubjectConfirmation></Subject><Conditions NotBefore=\"2013-07-31T04:59:55Z\" NotOnOrAfter=\"2013-07-31T06:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\"><AttributeValue>jon.phenow@sportngin.com</AttributeValue></Attribute></AttributeStatement><AuthnStatment AuthnInstant=\"2013-07-31T05:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:federation:authentication:windows</AuthnContextClassRef></AuthnContext></AuthnStatment></Assertion></samlp:Response>"
38
+ end
39
+ end
40
+ end
31
41
  end
32
42
  end
data/spec/rails_app/app/controllers/saml_idp_controller.rb CHANGED
@@ -1,5 +1,4 @@
1
1
  class SamlIdpController < SamlIdp::IdpController
2
-
3
2
  def idp_authenticate(email, password)
4
3
  { :email => email }
5
4
  end
@@ -7,5 +6,4 @@ class SamlIdpController < SamlIdp::IdpController
7
6
  def idp_make_saml_response(user)
8
7
  encode_response(user[:email])
9
8
  end
10
-
11
9
  end
data/spec/spec_helper.rb CHANGED
@@ -46,4 +46,3 @@ RSpec.configure do |config|
46
46
  end
47
47
 
48
48
  Capybara.default_host = "https://app.example.com"
49
-
data/spec/support/saml_request_macros.rb CHANGED
@@ -1,7 +1,6 @@
1
1
  require 'saml_idp/logout_request_builder'
2
2
 
3
3
  module SamlRequestMacros
4
-
5
4
  def make_saml_request(requested_saml_acs_url = "https://foo.example.com/saml/consume")
6
5
  auth_request = OneLogin::RubySaml::Authrequest.new
7
6
  auth_url = auth_request.create(saml_settings(requested_saml_acs_url))
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: saml_idp
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.5.0
4
+ version: 0.6.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Jon Phenow
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2017-06-21 00:00:00.000000000 Z
11
+ date: 2017-06-22 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: activesupport