Class: Onelogin::Saml::Response

Inherits:
Object
  • Object
show all
Defined in:
lib/onelogin/saml/response.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(response, settings = nil) ⇒ Response

Returns a new instance of Response.



11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
 
# File 'lib/onelogin/saml/response.rb', line 11

def initialize(response, settings=nil)
  @response = response

  begin
    @xml = Base64.decode64(@response)
    @document = LibXML::XML::Document.string(@xml)
    @document.extend(XMLSecurity::SignedDocument)
  rescue
    # could not parse document, everything is invalid
    @response = nil
    return
  end

  @issuer = document.find_first("/samlp:Response/saml:Issuer", Onelogin::NAMESPACES).content rescue nil
  @status_code = document.find_first("/samlp:Response/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES)["Value"] rescue nil

  process(settings) if settings
end

Instance Attribute Details

#destination ⇒ Object (readonly)

Returns the value of attribute destination.



8
9
10
 
# File 'lib/onelogin/saml/response.rb', line 8

def destination
  @destination
end

#document ⇒ Object (readonly)

Returns the value of attribute document.



5
6
7
 
# File 'lib/onelogin/saml/response.rb', line 5

def document
  @document
end

#in_response_to ⇒ Object (readonly)

Returns the value of attribute in_response_to.



8
9
10
 
# File 'lib/onelogin/saml/response.rb', line 8

def in_response_to
  @in_response_to
end

#issuer ⇒ Object (readonly)

Returns the value of attribute issuer.



8
9
10
 
# File 'lib/onelogin/saml/response.rb', line 8

def issuer
  @issuer
end

#name_id ⇒ Object (readonly)

Returns the value of attribute name_id.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def name_id
  @name_id
end

#name_qualifier ⇒ Object (readonly)

Returns the value of attribute name_qualifier.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def name_qualifier
  @name_qualifier
end

#response ⇒ Object (readonly)

Returns the value of attribute response.



5
6
7
 
# File 'lib/onelogin/saml/response.rb', line 5

def response
  @response
end

#saml_attributes ⇒ Object (readonly)

Returns the value of attribute saml_attributes.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def saml_attributes
  @saml_attributes
end

#session_index ⇒ Object (readonly)

Returns the value of attribute session_index.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def session_index
  @session_index
end

#settings ⇒ Object

Returns the value of attribute settings.



4
5
6
 
# File 'lib/onelogin/saml/response.rb', line 4

def settings
  @settings
end

#status_code ⇒ Object (readonly)

Returns the value of attribute status_code.



7
8
9
 
# File 'lib/onelogin/saml/response.rb', line 7

def status_code
  @status_code
end

#status_message ⇒ Object (readonly)

Returns the value of attribute status_message.



7
8
9
 
# File 'lib/onelogin/saml/response.rb', line 7

def status_message
  @status_message
end

#validation_error ⇒ Object (readonly)

Returns the value of attribute validation_error.



9
10
11
 
# File 'lib/onelogin/saml/response.rb', line 9

def validation_error
  @validation_error
end

#xml ⇒ Object (readonly)

Returns the value of attribute xml.



5
6
7
 
# File 'lib/onelogin/saml/response.rb', line 5

def xml
  @xml
end

Instance Method Details

#auth_failure? ⇒ Boolean

Returns:

  • (Boolean) 


134
135
136
 
# File 'lib/onelogin/saml/response.rb', line 134

def auth_failure?
  @status_code == Onelogin::Saml::StatusCodes::AUTHN_FAILED_URI
end

#decrypted_document ⇒ Object 



56
57
58
59
60
61
 
# File 'lib/onelogin/saml/response.rb', line 56

def decrypted_document
  @decrypted_document ||= LibXML::XML::Document.document(document).tap do |doc|
    doc.extend(XMLSecurity::SignedDocument)
    doc.decrypt!(settings)
  end
end

#disable_signature_validation!(settings) ⇒ Object 



50
51
52
53
54
 
# File 'lib/onelogin/saml/response.rb', line 50

def disable_signature_validation!(settings)
  @settings      = settings
  @is_valid      = true
  @trusted_roots = [decrypted_document.root]
end

#fingerprint_from_idp ⇒ Object 



142
143
144
145
146
147
148
149
150
 
# File 'lib/onelogin/saml/response.rb', line 142

def fingerprint_from_idp
  if base64_cert = decrypted_document.find_first("//ds:X509Certificate", Onelogin::NAMESPACES)
    cert_text = Base64.decode64(base64_cert.content)
    cert = OpenSSL::X509::Certificate.new(cert_text)
    Digest::SHA1.hexdigest(cert.to_der)
  else
    nil
  end
end

#is_valid? ⇒ Boolean

Returns:

  • (Boolean) 


77
78
79
 
# File 'lib/onelogin/saml/response.rb', line 77

def is_valid?
  @is_valid ||= validate
end

#no_authn_context? ⇒ Boolean

Returns:

  • (Boolean) 


138
139
140
 
# File 'lib/onelogin/saml/response.rb', line 138

def no_authn_context?
  @status_code == Onelogin::Saml::StatusCodes::NO_AUTHN_CONTEXT_URI
end

#process(settings) ⇒ Object 



30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
 
# File 'lib/onelogin/saml/response.rb', line 30

def process(settings)
  @settings = settings
  @logger = settings.logger
  return unless @response

  @in_response_to = untrusted_find_first("/samlp:Response")['InResponseTo'] rescue nil
  @destination    = untrusted_find_first("/samlp:Response")['Destination'] rescue nil
  @status_message = untrusted_find_first("/samlp:Response/samlp:Status/samlp:StatusCode").content rescue nil

  @name_id        = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID").content rescue nil
  @name_qualifier = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID")["NameQualifier"] rescue nil
  @session_index  = trusted_find_first("saml:Assertion/saml:AuthnStatement")["SessionIndex"] rescue nil

  @saml_attributes = {}
  trusted_find("saml:Attribute").each do |attr|
    attrname = attr['FriendlyName'] || Onelogin::ATTRIBUTES[attr['Name']] || attr['Name']
    @saml_attributes[attrname] = attr.content.strip rescue nil
  end
end

#success_status? ⇒ Boolean

Returns:

  • (Boolean) 


130
131
132
 
# File 'lib/onelogin/saml/response.rb', line 130

def success_status?
  @status_code == Onelogin::Saml::StatusCodes::SUCCESS_URI
end

#trusted_find(xpath) ⇒ Object 



71
72
73
74
75
 
# File 'lib/onelogin/saml/response.rb', line 71

def trusted_find(xpath)
  trusted_roots.map do |trusted_root|
    trusted_root.find("descendant-or-self::#{xpath}", Onelogin::NAMESPACES).to_a
  end.flatten.compact
end

#trusted_find_first(xpath) ⇒ Object 



67
68
69
 
# File 'lib/onelogin/saml/response.rb', line 67

def trusted_find_first(xpath)
  trusted_find(xpath).first
end

#trusted_roots ⇒ Object

triggers validation



126
127
128
 
# File 'lib/onelogin/saml/response.rb', line 126

def trusted_roots
  is_valid? ? @trusted_roots : []
end

#untrusted_find_first(xpath) ⇒ Object 



63
64
65
 
# File 'lib/onelogin/saml/response.rb', line 63

def untrusted_find_first(xpath)
  decrypted_document.find(xpath, Onelogin::NAMESPACES).first
end

#validate ⇒ Object 



81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
 
# File 'lib/onelogin/saml/response.rb', line 81

def validate
  if response.nil? || response == ""
    @validation_error = "No response to validate"
    return false
  end

  if !settings.idp_cert_fingerprint
    @validation_error = "No fingerprint configured in SAML settings"
    return false
  end

  # Verify the original document if it has a signature, otherwise verify the signature
  # in the encrypted portion. If there is no signature, then we can't verify.
  verified = false

  if document.has_signature?
    verified = document.validate(settings.idp_cert_fingerprint, @logger)
    if !verified
      @validation_error = document.validation_error
      return false
    end
  end

  if !verified && decrypted_document.has_signature?
    verified = decrypted_document.validate(settings.idp_cert_fingerprint, @logger)
    if !verified
      @validation_error = decrypted_document.validation_error
      return false
    end
  end

  if !verified
    @validation_error = "No signature found in the response"
    return false
  end

  # If we get here, validation has succeeded, and we can trust all
  # <ds:Signature> elements. Each of those has a <ds:Reference> which
  # points to the root of the root of the NodeSet it signs.
  @trusted_roots = decrypted_document.signed_roots

  true
end