spid 0.17.2 → 0.17.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a7a11b70c24ab1e6d40359dd05c34cf4e5bfa0c785bdf988fb02f9c6c992c0b
-  data.tar.gz: e3864055608e4cba6a1f43d79e4ab02cf1caad03e29c5b978811d1b192740279
+  metadata.gz: 373a471d3c7b5987767769a28f606c719a9470f82347e3f337e49a6391bb0a38
+  data.tar.gz: 596d1cde1ad8283d5b2fb1ab50d3d969be1072b096497aea9d14dec5ce22c052
 SHA512:
-  metadata.gz: 60ed65ef4c9d0c1eb8b295feb39b3113bf40042397da55b2e63d47772b6dec6be7bf46bc78f6064a36511d75cf935766258333f3989e3f144e5c24290a978c50
-  data.tar.gz: c569e171dfe3b1f4da07c3d4e8a0d5a4b1794cd31f3b449727b27f3221c566ed761a14fdc5cd22d0c930539a122fb527751fb2b3a13a381133828a04251ce69b
+  metadata.gz: 8a23bd7418801a537ba5714da4dbf67808b978819780bf9592ca32db148b9ebd14734c65a76730fe4c7ca93f902312acd3c00d908254322ea7a0e9a8670671f6
+  data.tar.gz: 99eee38fe1d01a30e26e9efa2a59a8537955e7c2ca623f74c92368bb20eb83bd12b4c80fb926b00f847ba818af72ca7f0b9ca13cbb6d9d615d6a3015e5c3d89e

data/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+## [0.17.3] - 2018-09-12
+### Fixed
+- Metadata embed now signature
+- Now it's possible to use attributes in attribute services in string format
+
 ## [0.17.2] - 2018-09-11
 ### Fixed
 - `Spid::Rack::Login` now use authn_context value
@@ -142,7 +147,8 @@
 - Coveralls Integration
 - Rubygems version badge in README
 
-[Unreleased]: https://github.com/italia/spid-ruby/compare/v0.17.2...HEAD
+[Unreleased]: https://github.com/italia/spid-ruby/compare/v0.17.3...HEAD
+[0.17.3]: https://github.com/italia/spid-ruby/compare/v0.17.2...v0.17.3
 [0.17.2]: https://github.com/italia/spid-ruby/compare/v0.17.1...v0.17.2
 [0.17.1]: https://github.com/italia/spid-ruby/compare/v0.17.0...v0.17.1
 [0.17.0]: https://github.com/italia/spid-ruby/compare/v0.16.1...v0.17.0

data/lib/spid/saml2.rb

@@ -10,6 +10,7 @@ require "spid/saml2/logout_request"
 require "spid/saml2/idp_logout_request"
 require "spid/saml2/logout_response"
 require "spid/saml2/idp_logout_response"
+require "spid/saml2/xml_signature"
 require "spid/saml2/sp_metadata"
 require "spid/saml2/utils"
 require "spid/saml2/idp_metadata_parser"

data/lib/spid/saml2/service_provider.rb

@@ -79,7 +79,7 @@ module Spid
       def validate_attribute_service(attribute_service)
         return false unless attribute_service.key?(:name)
         return false unless attribute_service.key?(:fields)
-        not_valid_fields = attribute_service[:fields] - ATTRIBUTES
+        not_valid_fields = attribute_service[:fields].map(&:to_sym) - ATTRIBUTES
         not_valid_fields.empty?
       end
 

data/lib/spid/saml2/settings.rb

@@ -80,6 +80,10 @@ module Spid
         service_provider.signature_method
       end
 
+      def digest_method
+        service_provider.digest_method
+      end
+
       def acs_index
         "0"
       end

data/lib/spid/saml2/sp_metadata.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "xmldsig"
+
 module Spid
   module Saml2
     # rubocop:disable Metrics/ClassLength
@@ -12,17 +14,27 @@ module Spid
         @settings = settings
       end
 
-      def to_saml
+      def unsigned_document
         document.add_element(entity_descriptor)
         document.to_s
       end
 
+      def signed_document
+        doc = Xmldsig::SignedDocument.new(unsigned_document)
+        doc.sign(settings.private_key)
+      end
+
+      def to_saml
+        signed_document
+      end
+
       def entity_descriptor
         @entity_descriptor ||=
           begin
             element = REXML::Element.new("md:EntityDescriptor")
             element.add_attributes(entity_descriptor_attributes)
             element.add_element sp_sso_descriptor
+            element.add_element signature
             element
           end
       end
@@ -32,7 +44,7 @@ module Spid
           "xmlns:ds" => "http://www.w3.org/2000/09/xmldsig#",
           "xmlns:md" => "urn:oasis:names:tc:SAML:2.0:metadata",
           "entityID" => settings.sp_entity_id,
-          "ID" => settings.sp_entity_id
+          "ID" => entity_descriptor_id
         }
       end
 
@@ -59,6 +71,13 @@ module Spid
       # rubocop:enable Metrics/AbcSize
       # rubocop:enable Metrics/MethodLength
 
+      def signature
+        @signature ||= ::Spid::Saml2::XmlSignature.new(
+          settings: settings,
+          sign_reference: entity_descriptor_id
+        ).signature
+      end
+
       def attribute_consuming_service(index, name, fields)
         element = REXML::Element.new("md:AttributeConsumingService")
         element.add_attributes("index" => index)
@@ -132,6 +151,15 @@ module Spid
             kd
           end
       end
+
+      private
+
+      def entity_descriptor_id
+        @entity_descriptor_id ||=
+          begin
+            "_#{Digest::MD5.hexdigest(settings.sp_entity_id)}"
+          end
+      end
     end
     # rubocop:enable Metrics/ClassLength
   end

data/lib/spid/saml2/xml_signature.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+module Spid
+  module Saml2
+    class XmlSignature # :nodoc:
+      attr_reader :settings
+      attr_reader :sign_reference
+
+      def initialize(settings:, sign_reference:)
+        @settings = settings
+        @sign_reference = sign_reference
+      end
+
+      def signature
+        @signature ||=
+          begin
+            element = REXML::Element.new("ds:Signature")
+            element.add_element(signed_info)
+            element.add_element(signature_value)
+            element
+          end
+      end
+
+      def signed_info
+        @signed_info ||=
+          begin
+            element = REXML::Element.new("ds:SignedInfo")
+            element.add_element(canonicalization_method)
+            element.add_element(signature_method)
+            element.add_element(reference)
+            element
+          end
+      end
+
+      def canonicalization_method
+        @canonicalization_method ||=
+          begin
+            element = REXML::Element.new("ds:CanonicalizationMethod")
+            element.add_attributes(
+              "Algorithm" => "http://www.w3.org/2001/10/xml-exc-c14n#"
+            )
+            element
+          end
+      end
+
+      def signature_method
+        @signature_method ||=
+          begin
+            element = REXML::Element.new("ds:SignatureMethod")
+            element.add_attributes("Algorithm" => settings.signature_method)
+            element
+          end
+      end
+
+      def reference
+        @reference ||=
+          begin
+            element = REXML::Element.new("ds:Reference")
+            element.add_attributes("URI" => "##{sign_reference}")
+            element.add_element(transforms)
+            element.add_element(digest_method)
+            element.add_element(digest_value)
+            element
+          end
+      end
+
+      def transforms
+        @transforms ||=
+          begin
+            element = REXML::Element.new("ds:Transforms")
+            element.add_element(transform_enveloped)
+            element.add_element(transform_xml)
+            element
+          end
+      end
+
+      def transform_enveloped
+        @transform_enveloped ||=
+          begin
+            element = REXML::Element.new("ds:Transform")
+            element.add_attributes(
+              "Algorithm" =>
+                "http://www.w3.org/2000/09/xmldsig#enveloped-signature"
+            )
+            element
+          end
+      end
+
+      def transform_xml
+        @transform_xml ||=
+          begin
+            element = REXML::Element.new("ds:Transform")
+            element.add_attributes(
+              "Algorithm" => "http://www.w3.org/2001/10/xml-exc-c14n#"
+            )
+            element
+          end
+      end
+
+      def digest_method
+        @digest_method ||=
+          begin
+            element = REXML::Element.new("ds:DigestMethod")
+            element.add_attributes("Algorithm" => settings.digest_method)
+            element
+          end
+      end
+
+      def digest_value
+        @digest_value ||= REXML::Element.new("ds:DigestValue")
+      end
+
+      def signature_value
+        @signature_value ||= REXML::Element.new("ds:SignatureValue")
+      end
+    end
+  end
+end

data/lib/spid/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Spid
-  VERSION = "0.17.2"
+  VERSION = "0.17.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spid
 version: !ruby/object:Gem::Version
-  version: 0.17.2
+  version: 0.17.3
 platform: ruby
 authors:
 - David Librera
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-09-11 00:00:00.000000000 Z
+date: 2018-09-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -349,6 +349,7 @@ files:
 - lib/spid/saml2/sp_metadata.rb
 - lib/spid/saml2/utils.rb
 - lib/spid/saml2/utils/query_params_signer.rb
+- lib/spid/saml2/xml_signature.rb
 - lib/spid/slo.rb
 - lib/spid/slo/idp_request.rb
 - lib/spid/slo/request.rb