saml_idp 0.7.2 → 0.11.0

data/spec/lib/saml_idp/encryptor_spec.rb

@@ -5,11 +5,11 @@ require 'saml_idp/encryptor'
 module SamlIdp
   describe Encryptor do
     let (:encryption_opts) do
-      {   
+      {
         cert: Default::X509_CERTIFICATE,
         block_encryption: 'aes256-cbc',
         key_transport: 'rsa-oaep-mgf1p',
-      }   
+      }
     end
 
     subject { described_class.new encryption_opts }
@@ -17,11 +17,11 @@ module SamlIdp
     it "encrypts XML" do
       raw_xml = '<foo>bar</foo>'
       encrypted_xml = subject.encrypt(raw_xml)
-      encrypted_xml.should_not match 'bar'
+      expect(encrypted_xml).to_not match raw_xml
       encrypted_doc = Nokogiri::XML::Document.parse(encrypted_xml)
       encrypted_data = Xmlenc::EncryptedData.new(encrypted_doc.at_xpath('//xenc:EncryptedData', Xmlenc::NAMESPACES))
       decrypted_xml = encrypted_data.decrypt(subject.encryption_key)
-      decrypted_xml.should == raw_xml
+      expect(decrypted_xml).to eq(raw_xml)
     end
   end
 end

data/spec/lib/saml_idp/incoming_metadata_spec.rb

@@ -0,0 +1,60 @@
+require 'spec_helper'
+module SamlIdp
+
+  metadata_1 = <<-eos
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="test" entityID="https://test-saml.com/saml">
+  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="false" WantAssertionsSigned="false">
+  </md:SPSSODescriptor>
+</md:EntityDescriptor>
+  eos
+
+  metadata_2 = <<-eos
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="test" entityID="https://test-saml.com/saml">
+  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="true">
+  </md:SPSSODescriptor>
+</md:EntityDescriptor>
+  eos
+
+  metadata_3 = <<-eos
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="test" entityID="https://test-saml.com/saml">
+  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true">
+  </md:SPSSODescriptor>
+</md:EntityDescriptor>
+  eos
+
+  metadata_4 = <<-eos
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="test" entityID="https://test-saml.com/saml">
+  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+  </md:SPSSODescriptor>
+</md:EntityDescriptor>
+  eos
+
+  describe IncomingMetadata do
+    it 'should properly set sign_assertions to false' do
+      metadata = SamlIdp::IncomingMetadata.new(metadata_1)
+      expect(metadata.sign_assertions).to eq(false)
+      expect(metadata.sign_authn_request).to eq(false)
+    end
+
+    it 'should properly set entity_id as https://test-saml.com/saml' do
+      metadata = SamlIdp::IncomingMetadata.new(metadata_1)
+      expect(metadata.entity_id).to eq('https://test-saml.com/saml')
+    end
+
+    it 'should properly set sign_assertions to true' do
+      metadata = SamlIdp::IncomingMetadata.new(metadata_2)
+      expect(metadata.sign_assertions).to eq(true)
+      expect(metadata.sign_authn_request).to eq(true)
+    end
+
+    it 'should properly set sign_assertions to false when WantAssertionsSigned is not included' do
+      metadata = SamlIdp::IncomingMetadata.new(metadata_3)
+      expect(metadata.sign_assertions).to eq(false)
+    end
+
+    it 'should properly set sign_authn_request to false when AuthnRequestsSigned is not included' do
+      metadata = SamlIdp::IncomingMetadata.new(metadata_4)
+      expect(metadata.sign_authn_request).to eq(false)
+    end
+  end
+end

data/spec/lib/saml_idp/metadata_builder_spec.rb

@@ -2,18 +2,39 @@ require 'spec_helper'
 module SamlIdp
   describe MetadataBuilder do
     it "has a valid fresh" do
-      subject.fresh.should_not be_empty
+      expect(subject.fresh).to_not be_empty
     end
 
     it "signs valid xml" do
-      Saml::XML::Document.parse(subject.signed).valid_signature?(Default::FINGERPRINT).should be_truthy
+      expect(Saml::XML::Document.parse(subject.signed).valid_signature?(Default::FINGERPRINT)).to be_truthy
     end
 
     it "includes logout element" do
       subject.configurator.single_logout_service_post_location = 'https://example.com/saml/logout'
-      subject.fresh.should match(
-        '<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://example.com/saml/logout"/>'
-      )
+      subject.configurator.single_logout_service_redirect_location = 'https://example.com/saml/logout'
+      expect(subject.fresh).to match('<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://example.com/saml/logout"/>')
+      expect(subject.fresh).to match('<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://example.com/saml/logout"/>')
+    end
+
+    it 'will not includes empty logout endpoint' do
+      subject.configurator.single_logout_service_post_location = ''
+      subject.configurator.single_logout_service_redirect_location = nil
+      expect(subject.fresh).not_to match('<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"')
+      expect(subject.fresh).not_to match('<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"')
+    end
+
+    it 'will includes sso element' do
+      subject.configurator.single_service_post_location = 'https://example.com/saml/sso'
+      subject.configurator.single_service_redirect_location = 'https://example.com/saml/sso'
+      expect(subject.fresh).to match('<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://example.com/saml/sso"/>')
+      expect(subject.fresh).to match('<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://example.com/saml/sso"/>')
+    end
+
+    it 'will not includes empty sso element' do
+      subject.configurator.single_service_post_location = ''
+      subject.configurator.single_service_redirect_location = nil
+      expect(subject.fresh).not_to match('<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"')
+      expect(subject.fresh).not_to match('<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"')
     end
 
     context "technical contact" do
@@ -32,31 +53,23 @@ module SamlIdp
         subject.configurator.technical_contact.telephone     = "1-800-555-5555"
         subject.configurator.technical_contact.email_address = "acme@example.com"
 
-        subject.fresh.should match(
-          '<ContactPerson contactType="technical"><Company>ACME Corporation</Company><GivenName>Road</GivenName><SurName>Runner</SurName><EmailAddress>mailto:acme@example.com</EmailAddress><TelephoneNumber>1-800-555-5555</TelephoneNumber></ContactPerson>'
-        )
+        expect(subject.fresh).to match('<ContactPerson contactType="technical"><Company>ACME Corporation</Company><GivenName>Road</GivenName><SurName>Runner</SurName><EmailAddress>mailto:acme@example.com</EmailAddress><TelephoneNumber>1-800-555-5555</TelephoneNumber></ContactPerson>')
       end
 
       it "no fields" do
-        subject.fresh.should match(
-          '<ContactPerson contactType="technical"></ContactPerson>'
-        )
+        expect(subject.fresh).to match('<ContactPerson contactType="technical"></ContactPerson>')
       end
 
       it "just email" do
         subject.configurator.technical_contact.email_address = "acme@example.com"
-        subject.fresh.should match(
-          '<ContactPerson contactType="technical"><EmailAddress>mailto:acme@example.com</EmailAddress></ContactPerson>'
-        )
+        expect(subject.fresh).to match('<ContactPerson contactType="technical"><EmailAddress>mailto:acme@example.com</EmailAddress></ContactPerson>')
       end
 
     end
 
     it "includes logout element as HTTP Redirect" do
       subject.configurator.single_logout_service_redirect_location = 'https://example.com/saml/logout'
-      subject.fresh.should match(
-        '<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://example.com/saml/logout"/>'
-      )
+      expect(subject.fresh).to match('<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://example.com/saml/logout"/>')
     end
   end
 end

data/spec/lib/saml_idp/name_id_formatter_spec.rb

@@ -7,7 +7,7 @@ module SamlIdp
       let(:list) { { email_address: ->() { "foo@example.com" } } }
 
       it "has a valid all" do
-        subject.all.should == ["urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"]
+        expect(subject.all).to eq ["urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"]
       end
 
     end
@@ -21,7 +21,7 @@ module SamlIdp
       }
 
       it "has a valid all" do
-        subject.all.should == [
+        expect(subject.all).to eq [
           "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
           "urn:oasis:names:tc:SAML:2.0:nameid-format:undefined",
         ]
@@ -32,7 +32,7 @@ module SamlIdp
       let(:list) { [:email_address, :undefined] }
 
       it "has a valid all" do
-        subject.all.should == [
+        expect(subject.all).to eq [
           "urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress",
           "urn:oasis:names:tc:SAML:2.0:nameid-format:undefined",
         ]

data/spec/lib/saml_idp/request_spec.rb

@@ -9,12 +9,12 @@ module SamlIdp
       subject { described_class.from_deflated_request deflated_request }
 
       it "inflates" do
-        subject.request_id.should == "_af43d1a0-e111-0130-661a-3c0754403fdb"
+        expect(subject.request_id).to eq("_af43d1a0-e111-0130-661a-3c0754403fdb")
       end
 
       it "handles invalid SAML" do
         req = described_class.from_deflated_request "bang!"
-        req.valid?.should == false
+        expect(req.valid?).to eq(false)
       end
     end
 
@@ -22,51 +22,51 @@ module SamlIdp
       subject { described_class.new raw_authn_request }
 
       it "has a valid request_id" do
-        subject.request_id.should == "_af43d1a0-e111-0130-661a-3c0754403fdb"
+        expect(subject.request_id).to eq("_af43d1a0-e111-0130-661a-3c0754403fdb")
       end
 
       it "has a valid acs_url" do
-        subject.acs_url.should == "http://localhost:3000/saml/consume"
+        expect(subject.acs_url).to eq("http://localhost:3000/saml/consume")
       end
 
       it "has a valid service_provider" do
-        subject.service_provider.should be_a ServiceProvider
+        expect(subject.service_provider).to be_a ServiceProvider
       end
 
       it "has a valid service_provider" do
-        subject.service_provider.should be_truthy
+        expect(subject.service_provider).to be_truthy
       end
 
       it "has a valid issuer" do
-        subject.issuer.should == "localhost:3000"
+        expect(subject.issuer).to eq("localhost:3000")
       end
 
       it "has a valid valid_signature" do
-        subject.valid_signature?.should be_truthy
+        expect(subject.valid_signature?).to be_truthy
       end
 
       it "should return acs_url for response_url" do
-        subject.response_url.should == subject.acs_url
+        expect(subject.response_url).to eq(subject.acs_url)
       end
 
       it "is a authn request" do
-        subject.authn_request?.should == true
+        expect(subject.authn_request?).to eq(true)
       end
 
       it "fetches internal request" do
-        subject.request['ID'].should == subject.request_id
+        expect(subject.request['ID']).to eq(subject.request_id)
       end
 
       it "has a valid authn context" do
-        subject.requested_authn_context.should == "urn:oasis:names:tc:SAML:2.0:ac:classes:Password"
+        expect(subject.requested_authn_context).to eq("urn:oasis:names:tc:SAML:2.0:ac:classes:Password")
       end
 
       it "does not permit empty issuer" do
         raw_req = raw_authn_request.gsub('localhost:3000', '')
         authn_request = described_class.new raw_req
-        authn_request.issuer.should_not == ''
-        authn_request.issuer.should == nil
-        authn_request.valid?.should == false
+        expect(authn_request.issuer).to_not eq('')
+        expect(authn_request.issuer).to be_nil
+        expect(authn_request.valid?).to eq(false)
       end
     end
 
@@ -76,31 +76,31 @@ module SamlIdp
       subject { described_class.new raw_logout_request }
 
       it "has a valid request_id" do
-        subject.request_id.should == '_some_response_id'
+        expect(subject.request_id).to eq('_some_response_id')
       end
 
       it "should be flagged as a logout_request" do
-        subject.logout_request?.should == true
+        expect(subject.logout_request?).to eq(true)
       end
 
       it "should have a valid name_id" do
-        subject.name_id.should == 'some_name_id'
+        expect(subject.name_id).to eq('some_name_id')
       end
 
       it "should have a session index" do
-        subject.session_index.should == 'abc123index'
+        expect(subject.session_index).to eq('abc123index')
       end
 
       it "should have a valid issuer" do
-        subject.issuer.should == 'http://example.com'
+        expect(subject.issuer).to eq('http://example.com')
       end
 
       it "fetches internal request" do
-        subject.request['ID'].should == subject.request_id
+        expect(subject.request['ID']).to eq(subject.request_id)
       end
 
       it "should return logout_url for response_url" do
-        subject.response_url.should == subject.logout_url
+        expect(subject.response_url).to eq(subject.logout_url)
       end
     end
   end

data/spec/lib/saml_idp/response_builder_spec.rb

@@ -6,12 +6,14 @@ module SamlIdp
     let(:saml_acs_url) { "http://sportngin.com" }
     let(:saml_request_id) { "134" }
     let(:assertion_and_signature) { "<Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2013-07-31T05:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><signature>stuff</signature><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">jon.phenow@sportngin.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData InResponseTo=\"123\" NotOnOrAfter=\"2013-07-31T05:03:00Z\" Recipient=\"http://saml.acs.url\"/></SubjectConfirmation></Subject><Conditions NotBefore=\"2013-07-31T04:59:55Z\" NotOnOrAfter=\"2013-07-31T06:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\"><AttributeValue>jon.phenow@sportngin.com</AttributeValue></Attribute></AttributeStatement><AuthnStatment AuthnInstant=\"2013-07-31T05:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:federation:authentication:windows</AuthnContextClassRef></AuthnContext></AuthnStatment></Assertion>" }
+    let(:algorithm) { :sha256 }
     subject { described_class.new(
       response_id,
       issuer_uri,
       saml_acs_url,
       saml_request_id,
-      assertion_and_signature
+      assertion_and_signature,
+      algorithm
     ) }
 
     before do
@@ -25,7 +27,7 @@ module SamlIdp
 
     it "builds a legit raw XML file" do
       Timecop.travel(Time.zone.local(2010, 6, 1, 13, 0, 0)) do
-        subject.raw.should == "<samlp:Response ID=\"_abc\" Version=\"2.0\" IssueInstant=\"2010-06-01T13:00:00Z\" Destination=\"http://sportngin.com\" Consent=\"urn:oasis:names:tc:SAML:2.0:consent:unspecified\" InResponseTo=\"134\" xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\"><Issuer xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://example.com</Issuer><samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status><Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2013-07-31T05:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><signature>stuff</signature><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">jon.phenow@sportngin.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData InResponseTo=\"123\" NotOnOrAfter=\"2013-07-31T05:03:00Z\" Recipient=\"http://saml.acs.url\"/></SubjectConfirmation></Subject><Conditions NotBefore=\"2013-07-31T04:59:55Z\" NotOnOrAfter=\"2013-07-31T06:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\"><AttributeValue>jon.phenow@sportngin.com</AttributeValue></Attribute></AttributeStatement><AuthnStatment AuthnInstant=\"2013-07-31T05:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:federation:authentication:windows</AuthnContextClassRef></AuthnContext></AuthnStatment></Assertion></samlp:Response>"
+        expect(subject.raw).to eq("<samlp:Response ID=\"_abc\" Version=\"2.0\" IssueInstant=\"2010-06-01T13:00:00Z\" Destination=\"http://sportngin.com\" Consent=\"urn:oasis:names:tc:SAML:2.0:consent:unspecified\" InResponseTo=\"134\" xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\"><Issuer xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://example.com</Issuer><samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status><Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2013-07-31T05:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><signature>stuff</signature><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">jon.phenow@sportngin.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData InResponseTo=\"123\" NotOnOrAfter=\"2013-07-31T05:03:00Z\" Recipient=\"http://saml.acs.url\"/></SubjectConfirmation></Subject><Conditions NotBefore=\"2013-07-31T04:59:55Z\" NotOnOrAfter=\"2013-07-31T06:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\"><AttributeValue>jon.phenow@sportngin.com</AttributeValue></Attribute></AttributeStatement><AuthnStatment AuthnInstant=\"2013-07-31T05:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:federation:authentication:windows</AuthnContextClassRef></AuthnContext></AuthnStatment></Assertion></samlp:Response>")
       end
     end
 
@@ -34,7 +36,7 @@ module SamlIdp
 
       it "builds a legit raw XML file without a request ID" do
         Timecop.travel(Time.zone.local(2010, 6, 1, 13, 0, 0)) do
-          subject.raw.should == "<samlp:Response ID=\"_abc\" Version=\"2.0\" IssueInstant=\"2010-06-01T13:00:00Z\" Destination=\"http://sportngin.com\" Consent=\"urn:oasis:names:tc:SAML:2.0:consent:unspecified\" xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\"><Issuer xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://example.com</Issuer><samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status><Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2013-07-31T05:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><signature>stuff</signature><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">jon.phenow@sportngin.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData InResponseTo=\"123\" NotOnOrAfter=\"2013-07-31T05:03:00Z\" Recipient=\"http://saml.acs.url\"/></SubjectConfirmation></Subject><Conditions NotBefore=\"2013-07-31T04:59:55Z\" NotOnOrAfter=\"2013-07-31T06:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\"><AttributeValue>jon.phenow@sportngin.com</AttributeValue></Attribute></AttributeStatement><AuthnStatment AuthnInstant=\"2013-07-31T05:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:federation:authentication:windows</AuthnContextClassRef></AuthnContext></AuthnStatment></Assertion></samlp:Response>"
+          expect(subject.raw).to eq("<samlp:Response ID=\"_abc\" Version=\"2.0\" IssueInstant=\"2010-06-01T13:00:00Z\" Destination=\"http://sportngin.com\" Consent=\"urn:oasis:names:tc:SAML:2.0:consent:unspecified\" xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\"><Issuer xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://example.com</Issuer><samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status><Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2013-07-31T05:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><signature>stuff</signature><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">jon.phenow@sportngin.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData InResponseTo=\"123\" NotOnOrAfter=\"2013-07-31T05:03:00Z\" Recipient=\"http://saml.acs.url\"/></SubjectConfirmation></Subject><Conditions NotBefore=\"2013-07-31T04:59:55Z\" NotOnOrAfter=\"2013-07-31T06:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\"><AttributeValue>jon.phenow@sportngin.com</AttributeValue></Attribute></AttributeStatement><AuthnStatment AuthnInstant=\"2013-07-31T05:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:federation:authentication:windows</AuthnContextClassRef></AuthnContext></AuthnStatment></Assertion></samlp:Response>")
         end
       end
     end

data/spec/lib/saml_idp/saml_response_spec.rb

@@ -24,6 +24,8 @@ module SamlIdp
         key_transport: 'rsa-oaep-mgf1p',
       }
     end
+    let(:signed_response_opts) { true }
+    let(:unsigned_response_opts) { false }
     let(:subject_encrypted) { described_class.new(reference_id,
                                   response_id,
                                   issuer_uri,
@@ -35,7 +37,8 @@ module SamlIdp
                                   authn_context_classref,
                                   expiry,
                                   encryption_opts,
-                                  session_expiry
+                                  session_expiry,
+                                  unsigned_response_opts
                                  )
     }
 
@@ -50,7 +53,8 @@ module SamlIdp
                                   authn_context_classref,
                                   expiry,
                                   nil,
-                                  session_expiry
+                                  session_expiry,
+                                  signed_response_opts
                                  )
     }
 
@@ -63,23 +67,42 @@ module SamlIdp
     end
 
     it "has a valid build" do
-      subject.build.should be_present
+      expect(subject.build).to be_present
     end
 
     it "builds encrypted" do
-      subject_encrypted.build.should_not match(audience_uri)
+      expect(subject_encrypted.build).to_not match(audience_uri)
       encoded_xml = subject_encrypted.build
       resp_settings = saml_settings(saml_acs_url)
       resp_settings.private_key = Default::SECRET_KEY
       resp_settings.issuer = audience_uri
       saml_resp = OneLogin::RubySaml::Response.new(encoded_xml, settings: resp_settings)
       saml_resp.soft = false
-      saml_resp.is_valid?.should == true
+      expect(saml_resp.is_valid?).to eq(true)
+    end
+
+    it "will build signed valid response" do
+      expect { subject.build }.not_to raise_error
+      signed_encoded_xml = subject.build
+      resp_settings = saml_settings(saml_acs_url)
+      resp_settings.private_key = Default::SECRET_KEY
+      resp_settings.issuer = audience_uri
+      saml_resp = OneLogin::RubySaml::Response.new(signed_encoded_xml, settings: resp_settings)
+      expect(
+        Nokogiri::XML(saml_resp.response).at_xpath(
+        "//p:Response//ds:Signature",
+        {
+          "p" => "urn:oasis:names:tc:SAML:2.0:protocol",
+          "ds" => "http://www.w3.org/2000/09/xmldsig#"
+        }
+      )).to be_present
+      expect(saml_resp.send(:validate_signature)).to eq(true)
+      expect(saml_resp.is_valid?).to eq(true)
     end
 
     it "sets session expiration" do
       saml_resp = OneLogin::RubySaml::Response.new(subject.build)
-      saml_resp.session_expires_at.should == Time.local(1990, "jan", 2).iso8601
+      expect(saml_resp.session_expires_at).to eq Time.local(1990, "jan", 2).iso8601
     end
 
     context "session expiration is set to 0" do
@@ -89,14 +112,14 @@ module SamlIdp
         resp_settings = saml_settings(saml_acs_url)
         resp_settings.issuer = audience_uri
         saml_resp = OneLogin::RubySaml::Response.new(subject.build, settings: resp_settings)
-        saml_resp.is_valid?.should == true
+        expect(saml_resp.is_valid?).to eq(true)
       end
 
       it "doesn't set a session expiration" do
         resp_settings = saml_settings(saml_acs_url)
         resp_settings.issuer = audience_uri
         saml_resp = OneLogin::RubySaml::Response.new(subject.build, settings: resp_settings)
-        saml_resp.session_expires_at.should be_nil
+        expect(saml_resp.session_expires_at).to be_nil
       end
     end
   end

data/spec/lib/saml_idp/service_provider_spec.rb

@@ -14,11 +14,11 @@ module SamlIdp
       let(:metadata_url) { "http://localhost:3000/metadata" }
 
       it "has a valid fingerprint" do
-        subject.fingerprint.should == fingerprint
+        expect(subject.fingerprint).to eq(fingerprint)
       end
 
       it "has a valid metadata_url" do
-        subject.metadata_url.should == metadata_url
+        expect(subject.metadata_url).to eq(metadata_url)
       end
 
       it { should be_valid }