spid 0.1.1 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.rubocop.yml +15 -2
- data/CHANGELOG.md +18 -0
- data/README.md +94 -1
- data/lib/spid/authn_request.rb +67 -0
- data/lib/spid/onelogin_extension.rb +23 -0
- data/lib/spid/version.rb +1 -1
- data/lib/spid.rb +25 -0
- data/spid.gemspec +5 -0
- metadata +61 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 8bfca421b316c9cb55e172e5eefc1c1acff12376dbb74716c5c3dbee76d316cd
|
|
4
|
+
data.tar.gz: 7ec28aa7150994bdc8d7e8e2f49161707d55de55a7099b4e910feaca9a700513
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: fad0ca14fa9fb3c7de38439dce599dd736fc654537e2503c326ec73611bb7779e451a2ea90c51c3dd24938f638940bdc14a7bf67a970031184cfff072a3ec930
|
|
7
|
+
data.tar.gz: 86e1822001f127add77c36b3feb27656ab3899b10db2a3a074f6891cc1d257e665d33c02635be31525d90b58922e8af4cd3d5ad3d68e44cafb8475970d503535
|
data/.rubocop.yml
CHANGED
|
@@ -1,5 +1,18 @@
|
|
|
1
|
+
require: rubocop-rspec
|
|
2
|
+
|
|
1
3
|
AllCops:
|
|
2
|
-
|
|
4
|
+
Exclude:
|
|
5
|
+
- bin/stubs/*
|
|
6
|
+
TargetRubyVersion: 2.3
|
|
3
7
|
|
|
8
|
+
Layout/DotPosition:
|
|
9
|
+
EnforcedStyle: trailing
|
|
10
|
+
Metrics/BlockLength:
|
|
11
|
+
Exclude:
|
|
12
|
+
- spec/**/*.rb
|
|
13
|
+
RSpec/NestedGroups:
|
|
14
|
+
Enabled: false
|
|
15
|
+
Style/EmptyMethod:
|
|
16
|
+
EnforcedStyle: expanded
|
|
4
17
|
Style/StringLiterals:
|
|
5
|
-
EnforcedStyle:
|
|
18
|
+
EnforcedStyle: double_quotes
|
data/CHANGELOG.md
ADDED
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
## [Unreleased]
|
|
4
|
+
|
|
5
|
+
## [0.2.0] - 2018-07-02
|
|
6
|
+
### Added
|
|
7
|
+
- Feature table in README
|
|
8
|
+
- Spid::AuthnRequest create a SAML AuthnRequest specific for SPID
|
|
9
|
+
- Added CHANGELOG.md
|
|
10
|
+
|
|
11
|
+
## 0.1.1 - 2018-06-27
|
|
12
|
+
### Added
|
|
13
|
+
- TravisCI Integration
|
|
14
|
+
- Coveralls Integration
|
|
15
|
+
- Rubygems version badge in README
|
|
16
|
+
|
|
17
|
+
[Unreleased]: https://github.com/italia/spid-ruby/compare/v0.0.2...HEAD
|
|
18
|
+
[0.2.0]: https://github.com/italia/spid-ruby/compare/v0.1.1...v0.2.0
|
data/README.md
CHANGED
|
@@ -1,2 +1,95 @@
|
|
|
1
|
-
# spid-ruby
|
|
1
|
+
# spid-ruby
|
|
2
|
+
|
|
2
3
|
Ruby library for SPID authentication
|
|
4
|
+
|
|
5
|
+
| Project | Spid Ruby |
|
|
6
|
+
| ---------------------- | ------------ |
|
|
7
|
+
| Gem name | spid |
|
|
8
|
+
| License | [MIT](https://github.com/italia/spid-ruby/blob/master/LICENSE) |
|
|
9
|
+
| Version | [](http://badge.fury.io/rb/spid) |
|
|
10
|
+
| Continuous integration | [](https://travis-ci.org/italia/spid-ruby) |
|
|
11
|
+
| Test coverage | [](https://coveralls.io/r/italia/spid-ruby) |
|
|
12
|
+
| Credits | [Contributors](https://github.com/italia/spid-ruby/graphs/contributors) |
|
|
13
|
+
|
|
14
|
+
## Features
|
|
15
|
+
|
|
16
|
+
|<img src="https://github.com/italia/spid-graphics/blob/master/spid-logos/spid-logo-c-lb.png?raw=true" width="100" /><br />_Compliance with [SPID regulations](http://www.agid.gov.it/sites/default/files/circolari/spid-regole_tecniche_v1.pdf) (for Service Providers)_||
|
|
17
|
+
|:---|:---|
|
|
18
|
+
|**Metadata:**||
|
|
19
|
+
|parsing of IdP XML metadata (1.2.2.4)||
|
|
20
|
+
|parsing of AA XML metadata (2.2.4)||
|
|
21
|
+
|SP XML metadata generation (1.3.2)||
|
|
22
|
+
|**AuthnRequest generation (1.2.2.1):**||
|
|
23
|
+
|generation of AuthnRequest XML|✓|
|
|
24
|
+
|HTTP-Redirect binding||
|
|
25
|
+
|HTTP-POST binding|✓|
|
|
26
|
+
|`AssertionConsumerServiceURL` customization||
|
|
27
|
+
|`AssertionConsumerServiceIndex` customization||
|
|
28
|
+
|`AttributeConsumingServiceIndex` customization||
|
|
29
|
+
|`AuthnContextClassRef` (SPID level) customization||
|
|
30
|
+
|`RequestedAuthnContext/@Comparison` customization||
|
|
31
|
+
|`RelayState` customization (1.2.2)||
|
|
32
|
+
|**Response/Assertion parsing**||
|
|
33
|
+
|verification of `Response/Signature` value (if any)||
|
|
34
|
+
|verification of `Response/Signature` certificate (if any) against IdP/AA metadata||
|
|
35
|
+
|verification of `Assertion/Signature` value||
|
|
36
|
+
|verification of `Assertion/Signature` certificate against IdP/AA metadata||
|
|
37
|
+
|verification of `SubjectConfirmationData/@Recipient`||
|
|
38
|
+
|verification of `SubjectConfirmationData/@NotOnOrAfter`||
|
|
39
|
+
|verification of `SubjectConfirmationData/@InResponseTo`||
|
|
40
|
+
|verification of `Issuer`||
|
|
41
|
+
|verification of `Destination`||
|
|
42
|
+
|verification of `Conditions/@NotBefore`||
|
|
43
|
+
|verification of `Conditions/@NotOnOrAfter`||
|
|
44
|
+
|verification of `Audience`||
|
|
45
|
+
|parsing of Response with no `Assertion` (authentication/query failure)||
|
|
46
|
+
|parsing of failure `StatusCode` (Requester/Responder)||
|
|
47
|
+
|**Response/Assertion parsing for SSO (1.2.1, 1.2.2.2, 1.3.1):**||
|
|
48
|
+
|parsing of `NameID`||
|
|
49
|
+
|parsing of `AuthnContextClassRef` (SPID level)||
|
|
50
|
+
|parsing of attributes||
|
|
51
|
+
|**Response/Assertion parsing for attribute query (2.2.2.2, 2.3.1):**||
|
|
52
|
+
|parsing of attributes||
|
|
53
|
+
|**LogoutRequest generation (for SP-initiated logout):**||
|
|
54
|
+
|generation of LogoutRequest XML||
|
|
55
|
+
|HTTP-Redirect binding||
|
|
56
|
+
|HTTP-POST binding||
|
|
57
|
+
|**LogoutResponse parsing (for SP-initiated logout):**||
|
|
58
|
+
|parsing of LogoutResponse XML||
|
|
59
|
+
|verification of `Response/Signature` value (if any)||
|
|
60
|
+
|verification of `Response/Signature` certificate (if any) against IdP metadata||
|
|
61
|
+
|verification of `Issuer`||
|
|
62
|
+
|verification of `Destination`||
|
|
63
|
+
|PartialLogout detection||
|
|
64
|
+
|**LogoutRequest parsing (for third-party-initiated logout):**||
|
|
65
|
+
|parsing of LogoutRequest XML||
|
|
66
|
+
|verification of `Response/Signature` value (if any)||
|
|
67
|
+
|verification of `Response/Signature` certificate (if any) against IdP metadata||
|
|
68
|
+
|verification of `Issuer`||
|
|
69
|
+
|verification of `Destination`||
|
|
70
|
+
|parsing of `NameID`||
|
|
71
|
+
|**LogoutResponse generation (for third-party-initiated logout):**||
|
|
72
|
+
|generation of LogoutResponse XML||
|
|
73
|
+
|HTTP-Redirect binding||
|
|
74
|
+
|HTTP-POST binding||
|
|
75
|
+
|PartialLogout customization||
|
|
76
|
+
|**AttributeQuery generation (2.2.2.1):**||
|
|
77
|
+
|generation of AttributeQuery XML||
|
|
78
|
+
|SOAP binding (client)||
|
|
79
|
+
|
|
80
|
+
|<img src="https://github.com/italia/spid-graphics/blob/master/spid-logos/spid-logo-c-lb.png?raw=true" width="100" /><br />_Compliance with [SPID regulations](http://www.agid.gov.it/sites/default/files/circolari/spid-regole_tecniche_v1.pdf) (for Attribute Authorities)_||
|
|
81
|
+
|:---|:---|
|
|
82
|
+
|**Metadata:**||
|
|
83
|
+
|parsing of SP XML metadata (1.3.2)||
|
|
84
|
+
|AA XML metadata generation (2.2.4)||
|
|
85
|
+
|**AttributeQuery parsing (2.2.2.1):**||
|
|
86
|
+
|parsing of AttributeQuery XML||
|
|
87
|
+
|verification of `Signature` value||
|
|
88
|
+
|verification of `Signature` certificate against SP metadata||
|
|
89
|
+
|verification of `Issuer`||
|
|
90
|
+
|verification of `Destination`||
|
|
91
|
+
|parsing of `Subject/NameID`||
|
|
92
|
+
|parsing of requested attributes||
|
|
93
|
+
|**Response/Assertion generation (2.2.2.2):**||
|
|
94
|
+
|generation of `Response/Assertion` XML||
|
|
95
|
+
|Signature||
|
|
@@ -0,0 +1,67 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
require "onelogin/ruby-saml/authrequest"
|
|
4
|
+
require "spid/onelogin_extension"
|
|
5
|
+
require "onelogin/ruby-saml/settings"
|
|
6
|
+
|
|
7
|
+
module Spid
|
|
8
|
+
class AuthnRequest # :nodoc:
|
|
9
|
+
using OneLoginExtension
|
|
10
|
+
|
|
11
|
+
attr_reader :authn_request_attributes
|
|
12
|
+
|
|
13
|
+
# rubocop:disable Metrics/MethodLength
|
|
14
|
+
def initialize(
|
|
15
|
+
idp_sso_target_url:,
|
|
16
|
+
assertion_consumer_service_url:,
|
|
17
|
+
issuer:,
|
|
18
|
+
authn_context: Spid::L1,
|
|
19
|
+
authn_context_comparison: Spid::EXACT_COMPARISON
|
|
20
|
+
)
|
|
21
|
+
|
|
22
|
+
unless AUTHN_CONTEXTS.include?(authn_context)
|
|
23
|
+
raise Spid::UnknownAuthnContextError,
|
|
24
|
+
"Provided authn_context is not valid:" \
|
|
25
|
+
" use one of #{AUTHN_CONTEXTS.join(', ')}"
|
|
26
|
+
end
|
|
27
|
+
|
|
28
|
+
unless COMPARISON_METHODS.include?(authn_context_comparison)
|
|
29
|
+
raise Spid::UnknownAuthnComparisonMethodError,
|
|
30
|
+
"Provided authn_context_comparison_method is not valid:" \
|
|
31
|
+
" use one of #{COMPARISON_METHODS.join(', ')}"
|
|
32
|
+
end
|
|
33
|
+
|
|
34
|
+
@authn_request_attributes = {
|
|
35
|
+
idp_sso_target_url: idp_sso_target_url,
|
|
36
|
+
assertion_consumer_service_url: assertion_consumer_service_url,
|
|
37
|
+
protocol_binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
|
|
38
|
+
issuer: issuer,
|
|
39
|
+
name_identifier_format: name_identifier_format,
|
|
40
|
+
authn_context: authn_context,
|
|
41
|
+
authn_context_comparison: authn_context_comparison
|
|
42
|
+
}
|
|
43
|
+
|
|
44
|
+
return if authn_context <= Spid::L1
|
|
45
|
+
@authn_request_attributes[:force_authn] = true
|
|
46
|
+
end
|
|
47
|
+
# rubocop:enable Metrics/MethodLength
|
|
48
|
+
|
|
49
|
+
def to_xml
|
|
50
|
+
authn_request.create_xml_document(saml_settings)
|
|
51
|
+
end
|
|
52
|
+
|
|
53
|
+
private
|
|
54
|
+
|
|
55
|
+
def name_identifier_format
|
|
56
|
+
"urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
|
|
57
|
+
end
|
|
58
|
+
|
|
59
|
+
def authn_request
|
|
60
|
+
::OneLogin::RubySaml::Authrequest.new
|
|
61
|
+
end
|
|
62
|
+
|
|
63
|
+
def saml_settings
|
|
64
|
+
::OneLogin::RubySaml::Settings.new authn_request_attributes
|
|
65
|
+
end
|
|
66
|
+
end
|
|
67
|
+
end
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
require "onelogin/ruby-saml/authrequest"
|
|
4
|
+
|
|
5
|
+
module Spid
|
|
6
|
+
module OneLoginExtension # :nodoc:
|
|
7
|
+
refine ::OneLogin::RubySaml::Authrequest do
|
|
8
|
+
def create_xml_document(settings)
|
|
9
|
+
original_document = super(settings)
|
|
10
|
+
issuer_element = original_document.elements["//saml:Issuer"]
|
|
11
|
+
issuer_element.attributes["Format"] = format_entity
|
|
12
|
+
issuer_element.attributes["NameQualifier"] = settings.issuer
|
|
13
|
+
original_document
|
|
14
|
+
end
|
|
15
|
+
|
|
16
|
+
private
|
|
17
|
+
|
|
18
|
+
def format_entity
|
|
19
|
+
"urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
|
|
20
|
+
end
|
|
21
|
+
end
|
|
22
|
+
end
|
|
23
|
+
end
|
data/lib/spid/version.rb
CHANGED
data/lib/spid.rb
CHANGED
|
@@ -1,6 +1,31 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
2
|
|
|
3
|
+
require "spid/authn_request"
|
|
3
4
|
require "spid/version"
|
|
4
5
|
|
|
5
6
|
module Spid # :nodoc:
|
|
7
|
+
class UnknownAuthnComparisonMethodError < StandardError; end
|
|
8
|
+
class UnknownAuthnContextError < StandardError; end
|
|
9
|
+
|
|
10
|
+
EXACT_COMPARISON = :exact
|
|
11
|
+
MININUM_COMPARISON = :minumum
|
|
12
|
+
BETTER_COMPARISON = :better
|
|
13
|
+
MAXIMUM_COMPARISON = :maximum
|
|
14
|
+
|
|
15
|
+
COMPARISON_METHODS = [
|
|
16
|
+
EXACT_COMPARISON,
|
|
17
|
+
MININUM_COMPARISON,
|
|
18
|
+
BETTER_COMPARISON,
|
|
19
|
+
MAXIMUM_COMPARISON
|
|
20
|
+
].freeze
|
|
21
|
+
|
|
22
|
+
L1 = "urn:oasis:names:tc:SAML:2.0:ac:classes:SpidL1"
|
|
23
|
+
L2 = "urn:oasis:names:tc:SAML:2.0:ac:classes:SpidL2"
|
|
24
|
+
L3 = "urn:oasis:names:tc:SAML:2.0:ac:classes:SpidL3"
|
|
25
|
+
|
|
26
|
+
AUTHN_CONTEXTS = [
|
|
27
|
+
L1,
|
|
28
|
+
L2,
|
|
29
|
+
L3
|
|
30
|
+
].freeze
|
|
6
31
|
end
|
data/spid.gemspec
CHANGED
|
@@ -18,10 +18,15 @@ Gem::Specification.new do |spec|
|
|
|
18
18
|
|
|
19
19
|
spec.required_ruby_version = ">= 2.3.0"
|
|
20
20
|
|
|
21
|
+
spec.add_runtime_dependency "ruby-saml", "~> 1.8.0"
|
|
22
|
+
|
|
21
23
|
spec.add_development_dependency "bundler", "~> 1.16"
|
|
22
24
|
spec.add_development_dependency "bundler-audit"
|
|
23
25
|
spec.add_development_dependency "coveralls"
|
|
26
|
+
spec.add_development_dependency "nokogiri"
|
|
27
|
+
spec.add_development_dependency "pry"
|
|
24
28
|
spec.add_development_dependency "rake", "~> 10.0"
|
|
25
29
|
spec.add_development_dependency "rspec", "~> 3.0"
|
|
26
30
|
spec.add_development_dependency "rubocop"
|
|
31
|
+
spec.add_development_dependency "rubocop-rspec"
|
|
27
32
|
end
|
metadata
CHANGED
|
@@ -1,15 +1,29 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: spid
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 0.2.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- David Librera
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2018-
|
|
11
|
+
date: 2018-07-02 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
|
+
- !ruby/object:Gem::Dependency
|
|
14
|
+
name: ruby-saml
|
|
15
|
+
requirement: !ruby/object:Gem::Requirement
|
|
16
|
+
requirements:
|
|
17
|
+
- - "~>"
|
|
18
|
+
- !ruby/object:Gem::Version
|
|
19
|
+
version: 1.8.0
|
|
20
|
+
type: :runtime
|
|
21
|
+
prerelease: false
|
|
22
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
23
|
+
requirements:
|
|
24
|
+
- - "~>"
|
|
25
|
+
- !ruby/object:Gem::Version
|
|
26
|
+
version: 1.8.0
|
|
13
27
|
- !ruby/object:Gem::Dependency
|
|
14
28
|
name: bundler
|
|
15
29
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -52,6 +66,34 @@ dependencies:
|
|
|
52
66
|
- - ">="
|
|
53
67
|
- !ruby/object:Gem::Version
|
|
54
68
|
version: '0'
|
|
69
|
+
- !ruby/object:Gem::Dependency
|
|
70
|
+
name: nokogiri
|
|
71
|
+
requirement: !ruby/object:Gem::Requirement
|
|
72
|
+
requirements:
|
|
73
|
+
- - ">="
|
|
74
|
+
- !ruby/object:Gem::Version
|
|
75
|
+
version: '0'
|
|
76
|
+
type: :development
|
|
77
|
+
prerelease: false
|
|
78
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
79
|
+
requirements:
|
|
80
|
+
- - ">="
|
|
81
|
+
- !ruby/object:Gem::Version
|
|
82
|
+
version: '0'
|
|
83
|
+
- !ruby/object:Gem::Dependency
|
|
84
|
+
name: pry
|
|
85
|
+
requirement: !ruby/object:Gem::Requirement
|
|
86
|
+
requirements:
|
|
87
|
+
- - ">="
|
|
88
|
+
- !ruby/object:Gem::Version
|
|
89
|
+
version: '0'
|
|
90
|
+
type: :development
|
|
91
|
+
prerelease: false
|
|
92
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
93
|
+
requirements:
|
|
94
|
+
- - ">="
|
|
95
|
+
- !ruby/object:Gem::Version
|
|
96
|
+
version: '0'
|
|
55
97
|
- !ruby/object:Gem::Dependency
|
|
56
98
|
name: rake
|
|
57
99
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -94,6 +136,20 @@ dependencies:
|
|
|
94
136
|
- - ">="
|
|
95
137
|
- !ruby/object:Gem::Version
|
|
96
138
|
version: '0'
|
|
139
|
+
- !ruby/object:Gem::Dependency
|
|
140
|
+
name: rubocop-rspec
|
|
141
|
+
requirement: !ruby/object:Gem::Requirement
|
|
142
|
+
requirements:
|
|
143
|
+
- - ">="
|
|
144
|
+
- !ruby/object:Gem::Version
|
|
145
|
+
version: '0'
|
|
146
|
+
type: :development
|
|
147
|
+
prerelease: false
|
|
148
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
149
|
+
requirements:
|
|
150
|
+
- - ">="
|
|
151
|
+
- !ruby/object:Gem::Version
|
|
152
|
+
version: '0'
|
|
97
153
|
description:
|
|
98
154
|
email:
|
|
99
155
|
- davidlibrera@gmail.com
|
|
@@ -105,12 +161,15 @@ files:
|
|
|
105
161
|
- ".rspec"
|
|
106
162
|
- ".rubocop.yml"
|
|
107
163
|
- ".travis.yml"
|
|
164
|
+
- CHANGELOG.md
|
|
108
165
|
- CODE_OF_CONDUCT.md
|
|
109
166
|
- Gemfile
|
|
110
167
|
- LICENSE
|
|
111
168
|
- README.md
|
|
112
169
|
- Rakefile
|
|
113
170
|
- lib/spid.rb
|
|
171
|
+
- lib/spid/authn_request.rb
|
|
172
|
+
- lib/spid/onelogin_extension.rb
|
|
114
173
|
- lib/spid/version.rb
|
|
115
174
|
- spid.gemspec
|
|
116
175
|
homepage: https://github.com/italia/spid-ruby
|