saml_idp 0.7.2 → 0.8.0

data/spec/lib/saml_idp/controller_spec.rb

@@ -7,6 +7,9 @@ describe SamlIdp::Controller do
   def render(*)
   end
 
+  def head(*)
+  end
+
   def params
     @params ||= {}
   end
@@ -14,8 +17,8 @@ describe SamlIdp::Controller do
   it "should find the SAML ACS URL" do
     requested_saml_acs_url = "https://example.com/saml/consume"
     params[:SAMLRequest] = make_saml_request(requested_saml_acs_url)
-    validate_saml_request
-    saml_acs_url.should == requested_saml_acs_url
+    expect(validate_saml_request).to eq(true)
+    expect(saml_acs_url).to eq(requested_saml_acs_url)
   end
 
   context "SAML Responses" do
@@ -32,36 +35,36 @@ describe SamlIdp::Controller do
       it "should create a SAML Response" do
         saml_response = encode_response(principal, { audience_uri: 'http://example.com/issuer', issuer_uri: 'http://example.com', acs_url: 'https://foo.example.com/saml/consume' })
         response = OneLogin::RubySaml::Response.new(saml_response)
-        response.name_id.should == "foo@example.com"
-        response.issuers.first.should == "http://example.com"
+        expect(response.name_id).to eq("foo@example.com")
+        expect(response.issuers.first).to eq("http://example.com")
         response.settings = saml_settings
-        response.is_valid?.should be_truthy
+        expect(response.is_valid?).to be_truthy
       end
     end
 
     context "solicited Response" do
       before(:each) do
         params[:SAMLRequest] = make_saml_request
-        validate_saml_request
+        expect(validate_saml_request).to eq(true)
       end
 
       it "should create a SAML Response" do
         saml_response = encode_response(principal)
         response = OneLogin::RubySaml::Response.new(saml_response)
-        response.name_id.should == "foo@example.com"
-        response.issuers.first.should == "http://example.com"
+        expect(response.name_id).to eq("foo@example.com")
+        expect(response.issuers.first).to eq("http://example.com")
         response.settings = saml_settings
-        response.is_valid?.should be_truthy
+        expect(response.is_valid?).to be_truthy
       end
 
       it "should create a SAML Logout Response" do
         params[:SAMLRequest] = make_saml_logout_request
-        validate_saml_request
+        expect(validate_saml_request).to eq(true)
         expect(saml_request.logout_request?).to eq true
         saml_response = encode_response(principal)
         response = OneLogin::RubySaml::Logoutresponse.new(saml_response, saml_settings)
-        response.validate.should == true
-        response.issuer.should == "http://example.com"
+        expect(response.validate).to eq(true)
+        expect(response.issuer).to eq("http://example.com")
       end
 
 
@@ -70,10 +73,10 @@ describe SamlIdp::Controller do
           self.algorithm = algorithm_name
           saml_response = encode_response(principal)
           response = OneLogin::RubySaml::Response.new(saml_response)
-          response.name_id.should == "foo@example.com"
-          response.issuers.first.should == "http://example.com"
+          expect(response.name_id).to eq("foo@example.com")
+          expect(response.issuers.first).to eq("http://example.com")
           response.settings = saml_settings
-          response.is_valid?.should be_truthy
+          expect(response.is_valid?).to be_truthy
         end
 
         it "should encrypt SAML Response assertion" do
@@ -82,11 +85,11 @@ describe SamlIdp::Controller do
           resp_settings = saml_settings
           resp_settings.private_key = SamlIdp::Default::SECRET_KEY
           response = OneLogin::RubySaml::Response.new(saml_response, settings: resp_settings)
-          response.document.to_s.should_not match("foo@example.com")
-          response.decrypted_document.to_s.should match("foo@example.com")
-          response.name_id.should == "foo@example.com"
-          response.issuers.first.should == "http://example.com"
-          response.is_valid?.should be_truthy
+          expect(response.document.to_s).to_not match("foo@example.com")
+          expect(response.decrypted_document.to_s).to match("foo@example.com")
+          expect(response.name_id).to eq("foo@example.com")
+          expect(response.issuers.first).to eq("http://example.com")
+          expect(response.is_valid?).to be_truthy
         end
       end
     end

data/spec/lib/saml_idp/encryptor_spec.rb

@@ -5,11 +5,11 @@ require 'saml_idp/encryptor'
 module SamlIdp
   describe Encryptor do
     let (:encryption_opts) do
-      {   
+      {
         cert: Default::X509_CERTIFICATE,
         block_encryption: 'aes256-cbc',
         key_transport: 'rsa-oaep-mgf1p',
-      }   
+      }
     end
 
     subject { described_class.new encryption_opts }
@@ -17,11 +17,11 @@ module SamlIdp
     it "encrypts XML" do
       raw_xml = '<foo>bar</foo>'
       encrypted_xml = subject.encrypt(raw_xml)
-      encrypted_xml.should_not match 'bar'
+      expect(encrypted_xml).to_not match raw_xml
       encrypted_doc = Nokogiri::XML::Document.parse(encrypted_xml)
       encrypted_data = Xmlenc::EncryptedData.new(encrypted_doc.at_xpath('//xenc:EncryptedData', Xmlenc::NAMESPACES))
       decrypted_xml = encrypted_data.decrypt(subject.encryption_key)
-      decrypted_xml.should == raw_xml
+      expect(decrypted_xml).to eq(raw_xml)
     end
   end
 end

data/spec/lib/saml_idp/incoming_metadata_spec.rb

@@ -0,0 +1,41 @@
+require 'spec_helper'
+module SamlIdp
+
+  metadata_1 = <<-eos
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="test" entityID="https://test-saml.com/saml">
+  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="false">
+  </md:SPSSODescriptor>
+</md:EntityDescriptor>
+  eos
+
+  metadata_2 = <<-eos
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="test" entityID="https://test-saml.com/saml">
+  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="true">
+  </md:SPSSODescriptor>
+</md:EntityDescriptor>
+  eos
+
+  metadata_3 = <<-eos
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="test" entityID="https://test-saml.com/saml">
+  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true">
+  </md:SPSSODescriptor>
+</md:EntityDescriptor>
+  eos
+
+  describe IncomingMetadata do
+    it 'should properly set sign_assertions to false' do
+      metadata = SamlIdp::IncomingMetadata.new(metadata_1)
+      expect(metadata.sign_assertions).to eq(false)
+    end
+
+    it 'should properly set sign_assertions to true' do
+      metadata = SamlIdp::IncomingMetadata.new(metadata_2)
+      expect(metadata.sign_assertions).to eq(true)
+    end
+
+    it 'should properly set sign_assertions to false when WantAssertionsSigned is not included' do
+      metadata = SamlIdp::IncomingMetadata.new(metadata_3)
+      expect(metadata.sign_assertions).to eq(false)
+    end
+  end
+end

data/spec/lib/saml_idp/metadata_builder_spec.rb

@@ -2,18 +2,16 @@ require 'spec_helper'
 module SamlIdp
   describe MetadataBuilder do
     it "has a valid fresh" do
-      subject.fresh.should_not be_empty
+      expect(subject.fresh).to_not be_empty
     end
 
     it "signs valid xml" do
-      Saml::XML::Document.parse(subject.signed).valid_signature?(Default::FINGERPRINT).should be_truthy
+      expect(Saml::XML::Document.parse(subject.signed).valid_signature?(Default::FINGERPRINT)).to be_truthy
     end
 
     it "includes logout element" do
       subject.configurator.single_logout_service_post_location = 'https://example.com/saml/logout'
-      subject.fresh.should match(
-        '<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://example.com/saml/logout"/>'
-      )
+      expect(subject.fresh).to match('<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://example.com/saml/logout"/>')
     end
 
     context "technical contact" do
@@ -32,31 +30,23 @@ module SamlIdp
         subject.configurator.technical_contact.telephone     = "1-800-555-5555"
         subject.configurator.technical_contact.email_address = "acme@example.com"
 
-        subject.fresh.should match(
-          '<ContactPerson contactType="technical"><Company>ACME Corporation</Company><GivenName>Road</GivenName><SurName>Runner</SurName><EmailAddress>mailto:acme@example.com</EmailAddress><TelephoneNumber>1-800-555-5555</TelephoneNumber></ContactPerson>'
-        )
+        expect(subject.fresh).to match('<ContactPerson contactType="technical"><Company>ACME Corporation</Company><GivenName>Road</GivenName><SurName>Runner</SurName><EmailAddress>mailto:acme@example.com</EmailAddress><TelephoneNumber>1-800-555-5555</TelephoneNumber></ContactPerson>')
       end
 
       it "no fields" do
-        subject.fresh.should match(
-          '<ContactPerson contactType="technical"></ContactPerson>'
-        )
+        expect(subject.fresh).to match('<ContactPerson contactType="technical"></ContactPerson>')
       end
 
       it "just email" do
         subject.configurator.technical_contact.email_address = "acme@example.com"
-        subject.fresh.should match(
-          '<ContactPerson contactType="technical"><EmailAddress>mailto:acme@example.com</EmailAddress></ContactPerson>'
-        )
+        expect(subject.fresh).to match('<ContactPerson contactType="technical"><EmailAddress>mailto:acme@example.com</EmailAddress></ContactPerson>')
       end
 
     end
 
     it "includes logout element as HTTP Redirect" do
       subject.configurator.single_logout_service_redirect_location = 'https://example.com/saml/logout'
-      subject.fresh.should match(
-        '<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://example.com/saml/logout"/>'
-      )
+      expect(subject.fresh).to match('<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://example.com/saml/logout"/>')
     end
   end
 end

data/spec/lib/saml_idp/name_id_formatter_spec.rb

@@ -7,7 +7,7 @@ module SamlIdp
       let(:list) { { email_address: ->() { "foo@example.com" } } }
 
       it "has a valid all" do
-        subject.all.should == ["urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"]
+        expect(subject.all).to eq ["urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"]
       end
 
     end
@@ -21,7 +21,7 @@ module SamlIdp
       }
 
       it "has a valid all" do
-        subject.all.should == [
+        expect(subject.all).to eq [
           "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
           "urn:oasis:names:tc:SAML:2.0:nameid-format:undefined",
         ]
@@ -32,7 +32,7 @@ module SamlIdp
       let(:list) { [:email_address, :undefined] }
 
       it "has a valid all" do
-        subject.all.should == [
+        expect(subject.all).to eq [
           "urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress",
           "urn:oasis:names:tc:SAML:2.0:nameid-format:undefined",
         ]

data/spec/lib/saml_idp/request_spec.rb

@@ -9,12 +9,12 @@ module SamlIdp
       subject { described_class.from_deflated_request deflated_request }
 
       it "inflates" do
-        subject.request_id.should == "_af43d1a0-e111-0130-661a-3c0754403fdb"
+        expect(subject.request_id).to eq("_af43d1a0-e111-0130-661a-3c0754403fdb")
       end
 
       it "handles invalid SAML" do
         req = described_class.from_deflated_request "bang!"
-        req.valid?.should == false
+        expect(req.valid?).to eq(false)
       end
     end
 
@@ -22,51 +22,51 @@ module SamlIdp
       subject { described_class.new raw_authn_request }
 
       it "has a valid request_id" do
-        subject.request_id.should == "_af43d1a0-e111-0130-661a-3c0754403fdb"
+        expect(subject.request_id).to eq("_af43d1a0-e111-0130-661a-3c0754403fdb")
       end
 
       it "has a valid acs_url" do
-        subject.acs_url.should == "http://localhost:3000/saml/consume"
+        expect(subject.acs_url).to eq("http://localhost:3000/saml/consume")
       end
 
       it "has a valid service_provider" do
-        subject.service_provider.should be_a ServiceProvider
+        expect(subject.service_provider).to be_a ServiceProvider
       end
 
       it "has a valid service_provider" do
-        subject.service_provider.should be_truthy
+        expect(subject.service_provider).to be_truthy
       end
 
       it "has a valid issuer" do
-        subject.issuer.should == "localhost:3000"
+        expect(subject.issuer).to eq("localhost:3000")
       end
 
       it "has a valid valid_signature" do
-        subject.valid_signature?.should be_truthy
+        expect(subject.valid_signature?).to be_truthy
       end
 
       it "should return acs_url for response_url" do
-        subject.response_url.should == subject.acs_url
+        expect(subject.response_url).to eq(subject.acs_url)
       end
 
       it "is a authn request" do
-        subject.authn_request?.should == true
+        expect(subject.authn_request?).to eq(true)
       end
 
       it "fetches internal request" do
-        subject.request['ID'].should == subject.request_id
+        expect(subject.request['ID']).to eq(subject.request_id)
       end
 
       it "has a valid authn context" do
-        subject.requested_authn_context.should == "urn:oasis:names:tc:SAML:2.0:ac:classes:Password"
+        expect(subject.requested_authn_context).to eq("urn:oasis:names:tc:SAML:2.0:ac:classes:Password")
       end
 
       it "does not permit empty issuer" do
         raw_req = raw_authn_request.gsub('localhost:3000', '')
         authn_request = described_class.new raw_req
-        authn_request.issuer.should_not == ''
-        authn_request.issuer.should == nil
-        authn_request.valid?.should == false
+        expect(authn_request.issuer).to_not eq('')
+        expect(authn_request.issuer).to be_nil
+        expect(authn_request.valid?).to eq(false)
       end
     end
 
@@ -76,31 +76,31 @@ module SamlIdp
       subject { described_class.new raw_logout_request }
 
       it "has a valid request_id" do
-        subject.request_id.should == '_some_response_id'
+        expect(subject.request_id).to eq('_some_response_id')
       end
 
       it "should be flagged as a logout_request" do
-        subject.logout_request?.should == true
+        expect(subject.logout_request?).to eq(true)
       end
 
       it "should have a valid name_id" do
-        subject.name_id.should == 'some_name_id'
+        expect(subject.name_id).to eq('some_name_id')
       end
 
       it "should have a session index" do
-        subject.session_index.should == 'abc123index'
+        expect(subject.session_index).to eq('abc123index')
       end
 
       it "should have a valid issuer" do
-        subject.issuer.should == 'http://example.com'
+        expect(subject.issuer).to eq('http://example.com')
       end
 
       it "fetches internal request" do
-        subject.request['ID'].should == subject.request_id
+        expect(subject.request['ID']).to eq(subject.request_id)
       end
 
       it "should return logout_url for response_url" do
-        subject.response_url.should == subject.logout_url
+        expect(subject.response_url).to eq(subject.logout_url)
       end
     end
   end

data/spec/lib/saml_idp/response_builder_spec.rb

@@ -25,7 +25,7 @@ module SamlIdp
 
     it "builds a legit raw XML file" do
       Timecop.travel(Time.zone.local(2010, 6, 1, 13, 0, 0)) do
-        subject.raw.should == "<samlp:Response ID=\"_abc\" Version=\"2.0\" IssueInstant=\"2010-06-01T13:00:00Z\" Destination=\"http://sportngin.com\" Consent=\"urn:oasis:names:tc:SAML:2.0:consent:unspecified\" InResponseTo=\"134\" xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\"><Issuer xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://example.com</Issuer><samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status><Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2013-07-31T05:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><signature>stuff</signature><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">jon.phenow@sportngin.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData InResponseTo=\"123\" NotOnOrAfter=\"2013-07-31T05:03:00Z\" Recipient=\"http://saml.acs.url\"/></SubjectConfirmation></Subject><Conditions NotBefore=\"2013-07-31T04:59:55Z\" NotOnOrAfter=\"2013-07-31T06:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\"><AttributeValue>jon.phenow@sportngin.com</AttributeValue></Attribute></AttributeStatement><AuthnStatment AuthnInstant=\"2013-07-31T05:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:federation:authentication:windows</AuthnContextClassRef></AuthnContext></AuthnStatment></Assertion></samlp:Response>"
+        expect(subject.raw).to eq("<samlp:Response ID=\"_abc\" Version=\"2.0\" IssueInstant=\"2010-06-01T13:00:00Z\" Destination=\"http://sportngin.com\" Consent=\"urn:oasis:names:tc:SAML:2.0:consent:unspecified\" InResponseTo=\"134\" xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\"><Issuer xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://example.com</Issuer><samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status><Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2013-07-31T05:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><signature>stuff</signature><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">jon.phenow@sportngin.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData InResponseTo=\"123\" NotOnOrAfter=\"2013-07-31T05:03:00Z\" Recipient=\"http://saml.acs.url\"/></SubjectConfirmation></Subject><Conditions NotBefore=\"2013-07-31T04:59:55Z\" NotOnOrAfter=\"2013-07-31T06:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\"><AttributeValue>jon.phenow@sportngin.com</AttributeValue></Attribute></AttributeStatement><AuthnStatment AuthnInstant=\"2013-07-31T05:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:federation:authentication:windows</AuthnContextClassRef></AuthnContext></AuthnStatment></Assertion></samlp:Response>")
       end
     end
 
@@ -34,7 +34,7 @@ module SamlIdp
 
       it "builds a legit raw XML file without a request ID" do
         Timecop.travel(Time.zone.local(2010, 6, 1, 13, 0, 0)) do
-          subject.raw.should == "<samlp:Response ID=\"_abc\" Version=\"2.0\" IssueInstant=\"2010-06-01T13:00:00Z\" Destination=\"http://sportngin.com\" Consent=\"urn:oasis:names:tc:SAML:2.0:consent:unspecified\" xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\"><Issuer xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://example.com</Issuer><samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status><Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2013-07-31T05:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><signature>stuff</signature><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">jon.phenow@sportngin.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData InResponseTo=\"123\" NotOnOrAfter=\"2013-07-31T05:03:00Z\" Recipient=\"http://saml.acs.url\"/></SubjectConfirmation></Subject><Conditions NotBefore=\"2013-07-31T04:59:55Z\" NotOnOrAfter=\"2013-07-31T06:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\"><AttributeValue>jon.phenow@sportngin.com</AttributeValue></Attribute></AttributeStatement><AuthnStatment AuthnInstant=\"2013-07-31T05:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:federation:authentication:windows</AuthnContextClassRef></AuthnContext></AuthnStatment></Assertion></samlp:Response>"
+          expect(subject.raw).to eq("<samlp:Response ID=\"_abc\" Version=\"2.0\" IssueInstant=\"2010-06-01T13:00:00Z\" Destination=\"http://sportngin.com\" Consent=\"urn:oasis:names:tc:SAML:2.0:consent:unspecified\" xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\"><Issuer xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://example.com</Issuer><samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status><Assertion xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\" ID=\"_abc\" IssueInstant=\"2013-07-31T05:00:00Z\" Version=\"2.0\"><Issuer>http://sportngin.com</Issuer><signature>stuff</signature><Subject><NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">jon.phenow@sportngin.com</NameID><SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"><SubjectConfirmationData InResponseTo=\"123\" NotOnOrAfter=\"2013-07-31T05:03:00Z\" Recipient=\"http://saml.acs.url\"/></SubjectConfirmation></Subject><Conditions NotBefore=\"2013-07-31T04:59:55Z\" NotOnOrAfter=\"2013-07-31T06:00:00Z\"><AudienceRestriction><Audience>http://example.com</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\"><AttributeValue>jon.phenow@sportngin.com</AttributeValue></Attribute></AttributeStatement><AuthnStatment AuthnInstant=\"2013-07-31T05:00:00Z\" SessionIndex=\"_abc\"><AuthnContext><AuthnContextClassRef>urn:federation:authentication:windows</AuthnContextClassRef></AuthnContext></AuthnStatment></Assertion></samlp:Response>")
         end
       end
     end

data/spec/lib/saml_idp/saml_response_spec.rb

@@ -63,23 +63,23 @@ module SamlIdp
     end
 
     it "has a valid build" do
-      subject.build.should be_present
+      expect(subject.build).to be_present
     end
 
     it "builds encrypted" do
-      subject_encrypted.build.should_not match(audience_uri)
+      expect(subject_encrypted.build).to_not match(audience_uri)
       encoded_xml = subject_encrypted.build
       resp_settings = saml_settings(saml_acs_url)
       resp_settings.private_key = Default::SECRET_KEY
       resp_settings.issuer = audience_uri
       saml_resp = OneLogin::RubySaml::Response.new(encoded_xml, settings: resp_settings)
       saml_resp.soft = false
-      saml_resp.is_valid?.should == true
+      expect(saml_resp.is_valid?).to eq(true)
     end
 
     it "sets session expiration" do
       saml_resp = OneLogin::RubySaml::Response.new(subject.build)
-      saml_resp.session_expires_at.should == Time.local(1990, "jan", 2).iso8601
+      expect(saml_resp.session_expires_at).to eq Time.local(1990, "jan", 2).iso8601
     end
 
     context "session expiration is set to 0" do
@@ -89,14 +89,14 @@ module SamlIdp
         resp_settings = saml_settings(saml_acs_url)
         resp_settings.issuer = audience_uri
         saml_resp = OneLogin::RubySaml::Response.new(subject.build, settings: resp_settings)
-        saml_resp.is_valid?.should == true
+        expect(saml_resp.is_valid?).to eq(true)
       end
 
       it "doesn't set a session expiration" do
         resp_settings = saml_settings(saml_acs_url)
         resp_settings.issuer = audience_uri
         saml_resp = OneLogin::RubySaml::Response.new(subject.build, settings: resp_settings)
-        saml_resp.session_expires_at.should be_nil
+        expect(saml_resp.session_expires_at).to be_nil
       end
     end
   end

data/spec/lib/saml_idp/service_provider_spec.rb

@@ -14,11 +14,11 @@ module SamlIdp
       let(:metadata_url) { "http://localhost:3000/metadata" }
 
       it "has a valid fingerprint" do
-        subject.fingerprint.should == fingerprint
+        expect(subject.fingerprint).to eq(fingerprint)
       end
 
       it "has a valid metadata_url" do
-        subject.metadata_url.should == metadata_url
+        expect(subject.metadata_url).to eq(metadata_url)
       end
 
       it { should be_valid }

data/spec/lib/saml_idp/signable_spec.rb

@@ -70,7 +70,7 @@ module SamlIdp
     end
 
     it "has a valid signed" do
-      subject.signed.should match all_regex
+      expect(subject.signed).to match all_regex
     end
 
   end