spid-es 0.0.46 → 0.0.50

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ff0046e4d703051a6f29f47cc7d46190f2801fe99c5f72b00fadb30ae6747ed5
-  data.tar.gz: 2a648d0f993c42fb084c136713aec8fd10e19f567320ac7ff2775ecde965f320
+  metadata.gz: 1da690cbc5b4e743cd4d5f536f1b4ed7e39c9d712fc95d6f162374c4a9271996
+  data.tar.gz: c842a2b8db198ab83242cce59afab8c98b80ed27c477baa9595add473bef937f
 SHA512:
-  metadata.gz: 5e3fdfc9a76277b2e3bf125531019821d5db0d6a627c6e382a724fd0d380c34f35f942eccead8391e37aa51a51e08315379885e906e06ea1c82f197b9130798f
-  data.tar.gz: 761028854b3bea2c4b4ac164f0d39844b41bbd151184a1699ac9b23198efce2eafc7f450e26c1ab5d1cc5f0b90ea3036d36c427ebd92948491e338dc2ee91697
+  metadata.gz: b2abf35831376b348a6ea317987d90423a7d503f75becdf3325df12a4306c7ea7b9154310215f95e7a57c91e3a58f035953b7b390dcc977bc7eec11536b8a121
+  data.tar.gz: 62c15cf73a3f0838586e96eae0ac44c06eb9a86a27685b72e0cd25aafbd1c7fa439f07a719d64b735c787013b2c7b739f1c2a6b34cba946b505b2fe45d0cc100

data/lib/spid/ruby-saml/authrequest.rb

@@ -29,9 +29,8 @@ module Spid::Saml
       # Create AuthnRequest root element using REXML 
       request_doc = Spid::XMLSecurityNew::Document.new
       request_doc.context[:attribute_quote] = :quote
-      root = request_doc.add_element "saml2p:AuthnRequest", { "xmlns:saml2p" => "urn:oasis:names:tc:SAML:2.0:protocol", 
-                                                              "xmlns:saml2" => "urn:oasis:names:tc:SAML:2.0:assertion"
-                                                             }
+      root = request_doc.add_element "saml2p:AuthnRequest", { "xmlns:saml2p"  => "urn:oasis:names:tc:SAML:2.0:protocol", 
+                                                              "xmlns:saml2"   => "urn:oasis:names:tc:SAML:2.0:assertion" }
       root.attributes['ID'] = uuid
       root.attributes['IssueInstant'] = time
       root.attributes['Version'] = "2.0"
@@ -60,6 +59,15 @@ module Spid::Saml
         issuer.text = @settings.issuer #questo valore deve essere uguale al #entityID dei metadata che usa @settings.issuer
       end
 
+      #aggiunta tag purpose (DOPO ISSUER!) per persona giuridica o uso professionale
+      if @settings.tipo_accesso != nil
+        extension_context = root.add_element "saml2p:Extensions", { 
+          "xmlns:spid" => "https://spid.gov.it/saml-extensions"
+        }
+        spid_purpose_element = extension_context.add_element "spid:Purpose"
+        spid_purpose_element.text = @settings.tipo_accesso
+      end
+
       # #opzionale
       # unless @settings.sp_name_qualifier.blank?
       #   subject = root.add_element "saml:Subject"

data/lib/spid/ruby-saml/metadata.rb

@@ -155,13 +155,11 @@ module Spid
         end
 
         if settings.assertion_consumer_service_url
-          
             #ciclo e creo i vari tag AssertionConsumerService
             settings.hash_assertion_consumer.each_pair{ |index, hash_service|
-
                 sp_sso.add_element "md:AssertionConsumerService", {
                   "Binding" => settings.assertion_consumer_service_binding,
-                  "Location" => (hash_service['external'] ? hash_service['url_consumer'] : settings.assertion_consumer_service_url ),
+                  "Location" => hash_service['url_consumer'],
                   "isDefault" => hash_service['default'],
                   "index" => index
                 }
@@ -511,18 +509,20 @@ module Spid
         #ricerco il certificato con nokogiri
         # pull out the x509 tag
         x509 = meta_doc.xpath("//EntityDescriptor//IDPSSODescriptor//KeyDescriptor//KeyInfo//X509Data//X509Certificate")
-
-        #x509 = REXML::XPath.first(meta_doc, "/md:EntityDescriptor/md:IDPSSODescriptor"+"/md:KeyDescriptor"+"/ds:KeyInfo/ds:X509Data/ds:X509Certificate")
-        # If the IdP didn't specify the use attribute
-        if x509.nil?
-          x509 = meta_doc.xpath("//EntityDescriptor//IDPSSODescriptor//KeyDescriptor//KeyInfo//X509Data//X509Certificate")
-          # x509 = REXML::XPath.first(meta_doc, 
-          #       "/EntityDescriptor/IDPSSODescriptor" +
-          #     "/KeyDescriptor" +
-          #     "/ds:KeyInfo/ds:X509Data/ds:X509Certificate"
-          #   )
+        if !x509.nil? 
+          if x509.length > 1
+            @settings.idp_cert = []
+            x509.children.each{|child_cert|
+              @settings.idp_cert << child_cert.to_s.gsub(/\n/, "").gsub(/\t/, "")
+            }
+          else #un array con un campo
+            @settings.idp_cert = [x509.children[0].to_s.gsub(/\n/, "").gsub(/\t/, "")]
+          end
+        else #se nil uso il certificato in keyinfo, non dovrebbe mai accadere
+          x509 = meta_doc.xpath("//EntityDescriptor//Signature//KeyInfo//X509Data//X509Certificate") 
         end
-        @settings.idp_cert = x509.children.to_s.gsub(/\n/, "").gsub(/\t/, "")
+        #se ci sono n certificati ritorno array
+        @settings.idp_cert
       end
 
       # construct the parameter list on the URL and return

data/lib/spid/ruby-saml/response.rb

@@ -616,15 +616,25 @@ module Spid
 
         def get_fingerprint
             idp_metadata = Spid::Saml::Metadata.new(settings).get_idp_metadata
-            
             if settings.idp_cert
-              cert_text = Base64.decode64(settings.idp_cert)
-              cert = OpenSSL::X509::Certificate.new(cert_text)
-              Digest::SHA2.hexdigest(cert.to_der).upcase.scan(/../).join(":")
+              #controllo se ho n certificati
+              if settings.idp_cert.length > 1
+                array_fingerprint = []
+                settings.idp_cert.each{|cert_metadata_ipd|
+                  cert_text = Base64.decode64(cert_metadata_ipd)
+                  cert = OpenSSL::X509::Certificate.new(cert_text)
+                  array_fingerprint << Digest::SHA2.hexdigest(cert.to_der).upcase.scan(/../).join(":")
+                }
+                return array_fingerprint
+              else
+                cert_text = Base64.decode64(settings.idp_cert[0])
+                cert = OpenSSL::X509::Certificate.new(cert_text)
+                return [Digest::SHA2.hexdigest(cert.to_der).upcase.scan(/../).join(":")]
+              end
+              
             else
-              settings.idp_cert_fingerprint
+              return [settings.idp_cert_fingerprint]
             end
-            
         end
 
         def validate_conditions(soft = true)

data/lib/spid/ruby-saml/settings.rb

@@ -10,7 +10,7 @@ module Spid
       attr_accessor :name_identifier_value, :name_identifier_format
       attr_accessor :sessionindex, :issuer, :destination_service_url, :authn_context, :requester_identificator
       attr_accessor :single_logout_service_url, :single_logout_service_binding, :single_logout_destination
-      attr_accessor :skip_validation, :aggregato, :hash_aggregatore
+      attr_accessor :skip_validation, :aggregato, :hash_aggregatore, :tipo_accesso
     
       def initialize(config = {})
         config.each do |k,v|

data/lib/spid/xml_security_new.rb

@@ -200,7 +200,7 @@ module Spid
       def signed_element_id
         @signed_element_id ||= extract_signed_element_id
       end
-
+      #idp_cert_fingerprint e' un array di fingerprint
       def validate_document(idp_cert_fingerprint, soft = true, options = {})
         # get cert from response
         cert_element = REXML::XPath.first(
@@ -226,7 +226,11 @@ module Spid
           fingerprint = fingerprint_alg.hexdigest(cert.to_der)
 
           # check cert matches registered idp cert
-          if fingerprint != idp_cert_fingerprint.gsub(/[^a-zA-Z0-9]/,"").downcase
+          trovato = false
+          idp_cert_fingerprint.each{|fingerprint_from_idp|
+            trovato = true if fingerprint_from_idp.gsub(/[^a-zA-Z0-9]/,"").downcase == fingerprint
+          }
+          if !trovato
             @errors << "Fingerprint mismatch"
             return append_error("Fingerprint mismatch", soft)
           end

data/spid-es.gemspec

@@ -2,7 +2,7 @@ $LOAD_PATH.push File.expand_path('../lib', __FILE__)
 
 Gem::Specification.new do |s|
   s.name = 'spid-es'
-  s.version = '0.0.46'
+  s.version = '0.0.50'
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Fabiano Pavan"]

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spid-es
 version: !ruby/object:Gem::Version
-  version: 0.0.46
+  version: 0.0.50
 platform: ruby
 authors:
 - Fabiano Pavan
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-01-26 00:00:00.000000000 Z
+date: 2021-09-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: canonix