samlr 2.4.1 → 2.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0f3f8a1071f3f774c3a9d624731c7e6aab77ce61
-  data.tar.gz: c4c25e98aa62abfaa17733a41fe1732003148bb5
+  metadata.gz: e8cdc251b3fddf94ba10cfc58f73e92992433b7f
+  data.tar.gz: 9f3d8faf8246aee7e277fb594243e814dcddf5f7
 SHA512:
-  metadata.gz: f7b190788159255d83cef081bdae91f344865168926f2e63dc083e4ef4bf7e12780a6154af4ce398c7726260bf92df0eec38237b5e6197e2fc2b70e1d7ad72fa
-  data.tar.gz: 8c8f29c3e09782ed5f870ed9a73763a78f24fa6f28f158d8e06b91e2d81f7d2d7781600d9e25b692d4f1102e3dd24443fc444ee7114f6c259f9818979f07644e
+  metadata.gz: 4ab81e921e414ef961a943226d4b048f80a0f9f1f9c0233052a25821ed7c0448e89e5c184506b12c61c91f17273f17cb2a53bf4c506a17f83ad94ddd906242c5
+  data.tar.gz: 8a7101fda53f16d3c67602d48a1461b033a153c996a04c655612ec3e36aa6791d31ea9098dc90d7d721f49696604e2ceaa6a7261beb34bf18431ebcbcea6271e

data/README.md

@@ -7,13 +7,14 @@ Samlr leverages Nokogiri for the heavy lifting and keeps things simple. Samlr al
 ### Initiating an authentication request
 
 ```ruby
-saml_request = Samlr::Request.new(
-  :issuer               => request.host,
-  :name_identity_format => Samlr::EMAIL_FORMAT,
-  :consumer_service_url => "https://#{request.host}/auth/saml"
-)
+saml_request = Samlr::Request.new(nil, {
+    :issuer               => request.host,
+    :name_identity_format => Samlr::EMAIL_FORMAT,
+    :consumer_service_url => "https://#{request.host}/auth/saml"
+  })
 ```
 
+
 At this point you can access `request.param` if all you want is the encoded params, or you can get a fully valid request URL with an appropriate `RelayState` value:
 
 ```ruby
@@ -58,6 +59,28 @@ end
 
 When the verification suceeds,the resulting response object will surface `saml_response.name_id` (String) and `saml_response.attributes` (Hash).
 
+### Handling a LogoutRequest from the IdP
+
+i.e. (https://example.com/logout?SAMLRequest=encoded_saml_logout_request)
+
+**Decode the request**
+
+```ruby
+idp_logout_request = Samlr::LogoutRequest.new(params["SAMLRequest"])
+```
+
+Then after logging out the user out you can get a fully valid response URL by:
+
+```ruby
+logout_response_options = {
+  :destination => remote_logout_url,
+  :in_response_to => idp_logout_request.id
+}
+logout_response = Samlr::LogoutResponse.new(nil, logout_response_options)
+
+logout_response.url(authentication.remote_logout_url)
+```
+
 ### Metadata
 
 Currently no support for signing, but that should be fairly easy to extract from the `Samlr::Tools::ResponseBuilder`. Get a metadata XML document like this:

data/lib/samlr.rb

@@ -51,3 +51,4 @@ require "samlr/signature"
 require "samlr/response"
 require "samlr/request"
 require "samlr/logout_request"
+require "samlr/logout_response"

data/lib/samlr/errors.rb

@@ -19,4 +19,7 @@ module Samlr
 
   class ConditionsError < SamlrError
   end
+
+  class NoDataError < SamlrError
+  end
 end

data/lib/samlr/logout_request.rb

@@ -3,5 +3,9 @@ module Samlr
     def body
       @body ||= Samlr::Tools::LogoutRequestBuilder.build(options)
     end
+
+    def id
+      @id ||= get_attribute_or_element("//samlp:LogoutRequest", "ID")
+    end
   end
 end

data/lib/samlr/logout_response.rb

@@ -0,0 +1,11 @@
+module Samlr
+  class LogoutResponse < Request
+    def body
+      @body ||= Samlr::Tools::LogoutResponseBuilder.build(options)
+    end
+
+    def type
+      "SAMLResponse"
+    end
+  end
+end

data/lib/samlr/request.rb

@@ -2,10 +2,11 @@ require "cgi"
 
 module Samlr
   class Request
-    attr_reader :options
+    attr_reader :options, :document
 
-    def initialize(options = {})
+    def initialize(data = nil, options = {})
       @options = options
+      @document = Request.parse(data)
     end
 
     # The encoded SAML request
@@ -18,14 +19,16 @@ module Samlr
       @body ||= Samlr::Tools::RequestBuilder.build(options)
     end
 
+    def type
+      "SAMLRequest"
+    end
+
     # Utility method to get the full redirect destination, Request#url("https://idp.example.com/saml", { :RelayState => "https://sp.example.com/saml" })
     def url(root, params = {})
       dest = root.dup
-      if dest.include?("?")
-        dest << "&SAMLRequest=#{param}"
-      else
-        dest << "?SAMLRequest=#{param}"
-      end
+
+      dest << (dest.include?("?") ? "&" : "?")
+      dest << "#{type}=#{param}"
 
       params.each_pair do |key, value|
         dest << "&#{key}=#{CGI.escape(value.to_s)}"
@@ -33,5 +36,25 @@ module Samlr
 
       dest
     end
+
+    def self.parse(data)
+      Samlr::Tools.parse(data, compressed: true)
+    end
+
+    def get_attribute_or_element(x_path,attribute=nil)
+      if document
+        element = document.xpath(x_path)
+        if element.length == 0
+          nil
+        elsif attribute
+          value = element.attr(attribute)
+          value.to_s if value
+        else
+          element
+        end
+      else
+        raise Samlr::NoDataError.new("Attempting to get attributes of a Request that has no data")
+      end
+    end
   end
 end

data/lib/samlr/response.rb

@@ -41,28 +41,8 @@ module Samlr
       @assertion ||= Samlr::Assertion.new(document, options)
     end
 
-    # Tries to parse the SAML response. First, it assumes it to be Base64 encoded
-    # If this fails, it subsequently attempts to parse the raw input as select IdP's
-    # send that rather than a Base64 encoded value
     def self.parse(data)
-      begin
-        document = Nokogiri::XML(Base64.decode64(data)) { |config| config.strict }
-      rescue Nokogiri::XML::SyntaxError => e
-        begin
-          document = Nokogiri::XML(data) { |config| config.strict }
-        rescue
-          raise Samlr::FormatError.new(e.message)
-        end
-      end
-
-      begin
-        Samlr::Tools.validate!(:document => document)
-      rescue Samlr::SamlrError => e
-        Samlr.logger.warn("Accepting non schema conforming response: #{e.message}, #{e.details}")
-        raise e unless Samlr.validation_mode == :log
-      end
-
-      document
+      Samlr::Tools.parse(data)
     end
   end
 end

data/lib/samlr/tools.rb

@@ -10,6 +10,7 @@ require "samlr/tools/request_builder"
 require "samlr/tools/response_builder"
 require "samlr/tools/metadata_builder"
 require "samlr/tools/logout_request_builder"
+require "samlr/tools/logout_response_builder"
 
 module Samlr
   module Tools
@@ -104,5 +105,41 @@ module Samlr
         end
       end
     end
+
+    # Tries to parse the SAML request, returns nil if no data passed.
+    # First, it assumes it to be Base64 encoded.
+    # If this fails, it subsequently attempts to parse the raw input as select IdP's
+    # send that rather than a Base64 encoded value
+    def self.parse(data, compressed: false)
+      return unless data
+      decoded = Base64.decode64(data)
+      decoded = self.inflate(decoded) if compressed
+      begin
+        doc = Nokogiri::XML(decoded) { |config| config.strict }
+      rescue Nokogiri::XML::SyntaxError => e
+        begin
+          doc = Nokogiri::XML(data) { |config| config.strict }
+        rescue
+          raise Samlr::FormatError.new(e.message)
+        end
+      end
+
+      begin
+        Samlr::Tools.validate!(:document => doc)
+      rescue Samlr::SamlrError => e
+        Samlr.logger.warn("Accepting non schema conforming response: #{e.message}, #{e.details}")
+        raise e unless Samlr.validation_mode == :log
+      end
+      doc
+    end
+
+    def self.inflate(data)
+      inflater  = Zlib::Inflate.new(-Zlib::MAX_WBITS)
+      decoded = inflater.inflate(data)
+
+      inflater.finish
+      inflater.close
+      decoded
+    end
   end
 end

data/lib/samlr/tools/logout_response_builder.rb

@@ -0,0 +1,33 @@
+require "nokogiri"
+
+module Samlr
+  module Tools
+    # Use this for building the SAML logout response XML
+    module LogoutResponseBuilder
+      def self.build(options = {})
+        status_code = options[:status_code] || "urn:oasis:names:tc:SAML:2.0:status:Success"
+        builder = Nokogiri::XML::Builder.new do |xml|
+          xml.LogoutResponse(logout_response_options(options)) do
+            xml.doc.root.namespace = xml.doc.root.namespace_definitions.find { |ns| ns.prefix == "samlp" }
+            xml["saml"].Issuer(options[:issuer]) if options[:issuer]
+            xml["samlp"].Status { |xml| xml["samlp"].StatusCode("Value" => status_code) }
+          end
+        end
+        builder.to_xml(COMPACT)
+      end
+
+      def self.logout_response_options(options)
+        result = {
+          "xmlns:samlp" => NS_MAP["samlp"],
+          "xmlns:saml" => NS_MAP["saml"],
+          "ID" => Samlr::Tools.uuid,
+          "IssueInstant" => Samlr::Tools::Timestamp.stamp,
+          "Version" => "2.0"
+        }
+        result["InResponseTo"] = options[:in_response_to] if options[:in_response_to]
+        result["Destination"] = options[:destination]     if options[:destination]
+        result
+      end
+    end
+  end
+end

data/lib/samlr/version.rb

@@ -1,3 +1,3 @@
 module Samlr
-  VERSION = "2.4.1"
+  VERSION = "2.5.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: samlr
 version: !ruby/object:Gem::Version
-  version: 2.4.1
+  version: 2.5.0
 platform: ruby
 authors:
 - Morten Primdahl
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-08-18 00:00:00.000000000 Z
+date: 2016-11-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
@@ -121,6 +121,7 @@ files:
 - lib/samlr/fingerprint_sha1.rb
 - lib/samlr/fingerprint_sha256.rb
 - lib/samlr/logout_request.rb
+- lib/samlr/logout_response.rb
 - lib/samlr/reference.rb
 - lib/samlr/request.rb
 - lib/samlr/response.rb
@@ -128,6 +129,7 @@ files:
 - lib/samlr/tools.rb
 - lib/samlr/tools/certificate_builder.rb
 - lib/samlr/tools/logout_request_builder.rb
+- lib/samlr/tools/logout_response_builder.rb
 - lib/samlr/tools/metadata_builder.rb
 - lib/samlr/tools/request_builder.rb
 - lib/samlr/tools/response_builder.rb
@@ -145,7 +147,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 1.9.3
+      version: 2.1.10
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
@@ -153,7 +155,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5.1
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: Ruby tools for SAML