Class: OmniAuth::Strategies::Latvija::SignedDocument
- Inherits:
-
REXML::Document
- Object
- REXML::Document
- OmniAuth::Strategies::Latvija::SignedDocument
- Defined in:
- lib/omniauth/strategies/latvija/signed_document.rb
Constant Summary collapse
- DSIG =
"http://www.w3.org/2000/09/xmldsig#"
Instance Attribute Summary collapse
-
#signed_element_id ⇒ Object
Returns the value of attribute signed_element_id.
Instance Method Summary collapse
- #extract_signed_element_id ⇒ Object
-
#initialize(response) ⇒ SignedDocument
constructor
A new instance of SignedDocument.
- #validate!(idp_cert_fingerprint) ⇒ Object
Constructor Details
#initialize(response) ⇒ SignedDocument
Returns a new instance of SignedDocument.
33 34 35 36 |
# File 'lib/omniauth/strategies/latvija/signed_document.rb', line 33 def initialize(response) super(response) extract_signed_element_id end |
Instance Attribute Details
#signed_element_id ⇒ Object
Returns the value of attribute signed_element_id.
31 32 33 |
# File 'lib/omniauth/strategies/latvija/signed_document.rb', line 31 def signed_element_id @signed_element_id end |
Instance Method Details
#extract_signed_element_id ⇒ Object
88 89 90 91 |
# File 'lib/omniauth/strategies/latvija/signed_document.rb', line 88 def extract_signed_element_id reference_element = REXML::XPath.first(self, "//ds:Signature/ds:SignedInfo/ds:Reference", { "ds" => DSIG }) self.signed_element_id = reference_element.attribute("URI").value unless reference_element.nil? end |
#validate!(idp_cert_fingerprint) ⇒ Object
38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 |
# File 'lib/omniauth/strategies/latvija/signed_document.rb', line 38 def validate!(idp_cert_fingerprint) # get cert from response base64_cert = self.elements["//ds:X509Certificate"].text cert_text = Base64.decode64(base64_cert) cert = OpenSSL::X509::Certificate.new(cert_text) # check cert matches registered idp cert fingerprint = Digest::SHA1.hexdigest(cert.to_der) if fingerprint != idp_cert_fingerprint.gsub(/[^a-zA-Z0-9]/,"").downcase raise ValidationError.new("Fingerprint mismatch") end # remove signature node sig_element = REXML::XPath.first(self, "//ds:Signature", { "ds" => DSIG }) sig_element.remove # check digests REXML::XPath.each(sig_element, "//ds:Reference", {"ds"=>"http://www.w3.org/2000/09/xmldsig#"}) do |ref| uri = ref.attributes.get_attribute("URI").value hashed_element = REXML::XPath.first(self, "//[@AssertionID='#{uri[1,uri.size]}']") canoner = XML::Util::XmlCanonicalizer.new(false, true) canon_hashed_element = canoner.canonicalize(hashed_element) hash = Base64.encode64(Digest::SHA1.digest(canon_hashed_element)).chomp digest_value = REXML::XPath.first(ref, "//ds:DigestValue", { "ds" => DSIG }).text if hash != digest_value raise ValidationError.new("Digest mismatch") end end # verify signature canoner = XML::Util::XmlCanonicalizer.new(false, true) signed_info_element = REXML::XPath.first(sig_element, "//ds:SignedInfo", { "ds" => DSIG }) canon_string = canoner.canonicalize(signed_info_element) base64_signature = REXML::XPath.first(sig_element, "//ds:SignatureValue", { "ds" => DSIG }).text signature = Base64.decode64(base64_signature) # get certificate object cert_text = Base64.decode64(base64_cert) cert = OpenSSL::X509::Certificate.new(cert_text) if !cert.public_key.verify(OpenSSL::Digest::SHA1.new, signature, canon_string) raise ValidationError.new("Key validation error") end true end |