samlr 2.0.0 → 2.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a2074e685eb574ec5c1c6577ff9bf640057e9ec5
-  data.tar.gz: e3237358e321f2a8d7719b4217a30e53788c5395
+  metadata.gz: ebafb5a38e98da6ac77fe1aef9f75fe152260465
+  data.tar.gz: 4b5f0a93da346dcab298769f5d58e9b3b3672cc8
 SHA512:
-  metadata.gz: 00ccf48f9a7c23d83ec70a00580149064b57ec1893e7b026ac7fa6a8bfa31e2ae3a3610542cc0b4fd2872029d5141c881fdc4c88be8dbe6bfaeb188dfafe404d
-  data.tar.gz: 1f4759e04686aa452d6de7c47a0205e18fe31be6a2dde8fc8e265ec4510d7bda2c43b821287f69a6c5f1b460261b29bc49444892e95c835d2534629e362393fd
+  metadata.gz: ea4b4676ccd2a16afc7b4748ecdd9a4ce0cc7f09ca7d452221256ad4f00d3eae39751c57c48e225f8a219c0ee7b390a1cc7a278c049df24a5f0eaf78622ffd86
+  data.tar.gz: f6f9f274dd8cef36ab5b7058dfe0f60eaa0a3453397f03ed5392002b13e789e759a60bdb2cf9489c5d37b3832f5ae65e6b9188ad551615ef4ca955364a83d569

data/lib/samlr/assertion.rb

@@ -51,6 +51,10 @@ module Samlr
       @name_id ||= assertion.at("./saml:Subject/saml:NameID", NS_MAP).text
     end
 
+    def conditions
+      @conditions ||= Condition.new(assertion.at("./saml:Conditions", NS_MAP), options)
+    end
+
     private
 
     def assertion
@@ -68,10 +72,6 @@ module Samlr
       !!options[:skip_conditions]
     end
 
-    def conditions
-      @conditions ||= Condition.new(assertion.at("./saml:Conditions", NS_MAP))
-    end
-
     def verify_conditions!
       conditions.verify!
     end

data/lib/samlr/condition.rb

@@ -1,10 +1,12 @@
 module Samlr
   class Condition
-    attr_reader :not_before, :not_on_or_after
+    attr_reader :audience, :not_before, :not_on_or_after, :options
 
-    def initialize(condition)
+    def initialize(condition, options)
+      @options         = options
       @not_before      = (condition || {})["NotBefore"]
       @not_on_or_after = (condition || {})["NotOnOrAfter"]
+      @audience        = extract_audience(condition)
     end
 
     def verify!
@@ -16,6 +18,10 @@ module Samlr
         raise Samlr::ConditionsError.new("Not on or after violation, now #{Samlr::Tools::Timestamp.stamp} vs. at latest #{not_on_or_after}")
       end
 
+      unless audience_satisfied?
+        raise Samlr::ConditionsError.new("Audience violation, expected #{options[:audience]} vs. #{audience}")
+      end
+
       true
     end
 
@@ -26,6 +32,22 @@ module Samlr
     def not_on_or_after_satisfied?
       not_on_or_after.nil? || Samlr::Tools::Timestamp.not_on_or_after?(Samlr::Tools::Timestamp.parse(not_on_or_after))
     end
-  end
 
+    def audience_satisfied?
+      audience.nil? || options[:audience].nil? ||
+        audience == options[:audience]
+    end
+
+    private
+
+    def extract_audience(condition)
+      return unless condition
+
+      audience_node = condition.at("./saml:AudienceRestriction/saml:Audience", NS_MAP)
+
+      return unless audience_node
+
+      audience_node.text
+    end
+  end
 end

data/samlr.gemspec

@@ -1,4 +1,4 @@
-Gem::Specification.new "samlr", "2.0.0" do |s|
+Gem::Specification.new "samlr", "2.0.1" do |s|
   s.summary     = "Ruby tools for SAML"
   s.description = "Helps you implement a SAML SP"
   s.authors     = ["Morten Primdahl"]

data/test/unit/test_assertion.rb

@@ -29,8 +29,16 @@ describe Samlr::Assertion do
   end
 
   describe "#verify!" do
+    let(:condition) do
+      Class.new do
+        def verify!
+          raise Samlr::ConditionsError, 'error'
+        end
+      end
+    end
+
     before do
-      @unsatisfied_condition = Samlr::Condition.new("NotBefore" => Samlr::Tools::Timestamp.stamp(Time.now + 60))
+      @unsatisfied_condition = condition.new
     end
 
     describe "when conditions are not met" do

data/test/unit/test_condition.rb

@@ -1,10 +1,11 @@
 require File.expand_path("test/test_helper")
 
 def condition(before, after)
-  Samlr::Condition.new(
-    "NotBefore"    => before ? before.utc.iso8601 : nil,
-    "NotOnOrAfter" => after  ? after.utc.iso8601  : nil
-  )
+  element = Nokogiri::XML::Element.new('saml:Condition', Nokogiri::XML(''))
+  element["NotBefore"] = before.utc.iso8601 if before
+  element["NotOnOrAfter"] = after.utc.iso8601 if after
+
+  Samlr::Condition.new(element, {})
 end
 
 describe Samlr::Condition do
@@ -14,6 +15,44 @@ describe Samlr::Condition do
   end
 
   describe "verify!" do
+    describe "audience verification" do
+      let(:response) { fixed_saml_response }
+      subject { response.assertion.conditions }
+
+      describe "when it is wrong" do
+        before do
+          response.options[:audience] = 'example.com'
+        end
+
+        it "raises an exception" do
+          Time.stub(:now, Time.at(1344379365)) do
+            assert subject.not_on_or_after_satisfied?
+            assert subject.not_before_satisfied?
+            refute subject.audience_satisfied?
+
+            begin
+              subject.verify!
+              flunk "Expected exception"
+            rescue Samlr::ConditionsError => e
+              assert_match /Audience/, e.message
+            end
+          end
+        end
+      end
+
+      describe "when it is right" do
+        before do
+          response.options[:audience] = 'example.org'
+        end
+
+        it "does not raise an exception" do
+          Time.stub(:now, Time.at(1344379365)) do
+            assert subject.verify!
+          end
+        end
+      end
+    end
+
     describe "when the lower time has not been met" do
       before  { @not_before = (Time.now + 5*60) }
       subject { condition(@not_before, @not_after) }
@@ -57,15 +96,30 @@ describe Samlr::Condition do
     end
   end
 
+  describe "#audience_satisfied?" do
+    it "returns true when audience is a nil value" do
+      element = Nokogiri::XML::Node.new('saml:Condition', Nokogiri::XML(''))
+      assert Samlr::Condition.new(element, {}).audience_satisfied?
+    end
+
+    it "returns true when passed a nil audience" do
+      condition = fixed_saml_response.assertion.conditions
+      assert_equal 'example.org', condition.audience
+      assert condition.audience_satisfied?
+    end
+  end
+
   describe "#not_before_satisfied?" do
     it "returns true when passed a nil value" do
-      assert Samlr::Condition.new({}).not_before_satisfied?
+      element = Nokogiri::XML::Node.new('saml:Condition', Nokogiri::XML(''))
+      assert Samlr::Condition.new(element, {}).not_before_satisfied?
     end
   end
 
   describe "#not_on_or_after_satisfied?" do
     it "returns true when passed a nil value" do
-      assert Samlr::Condition.new({}).not_on_or_after_satisfied?
+      element = Nokogiri::XML::Node.new('saml:Condition', Nokogiri::XML(''))
+      assert Samlr::Condition.new(element, {}).not_on_or_after_satisfied?
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: samlr
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.0.1
 platform: ruby
 authors:
 - Morten Primdahl
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-03-26 00:00:00.000000000 Z
+date: 2014-05-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri