Class: Onelogin::Saml::Response

Inherits:
Object
  • Object
show all
Defined in:
lib/onelogin/saml/response.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(response, settings = nil) ⇒ Response

Returns a new instance of Response.



11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
 
# File 'lib/onelogin/saml/response.rb', line 11

def initialize(response, settings=nil)
  @response = response

  begin
    @xml = Base64.decode64(@response)
    @document = Nokogiri::XML(@xml)
    @document.extend(XMLSecurity::SignedDocument)
  rescue
    # could not parse document, everything is invalid
    @response = nil
    return
  end

  @issuer = document.at_xpath("/samlp:Response/saml:Issuer", Onelogin::NAMESPACES).content.strip rescue nil
  @issuer ||= document.at_xpath("/samlp:Response/saml:Assertion/saml:Issuer", Onelogin::NAMESPACES).content.strip rescue nil
  @status_code = document.at_xpath("/samlp:Response/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES)["Value"] rescue nil

  process(settings) if settings
end

Instance Attribute Details

#destination ⇒ Object (readonly)

Returns the value of attribute destination.



8
9
10
 
# File 'lib/onelogin/saml/response.rb', line 8

def destination
  @destination
end

#document ⇒ Object (readonly)

Returns the value of attribute document.



5
6
7
 
# File 'lib/onelogin/saml/response.rb', line 5

def document
  @document
end

#in_response_to ⇒ Object (readonly)

Returns the value of attribute in_response_to.



8
9
10
 
# File 'lib/onelogin/saml/response.rb', line 8

def in_response_to
  @in_response_to
end

#issuer ⇒ Object (readonly)

Returns the value of attribute issuer.



8
9
10
 
# File 'lib/onelogin/saml/response.rb', line 8

def issuer
  @issuer
end

#name_id ⇒ Object (readonly)

Returns the value of attribute name_id.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def name_id
  @name_id
end

#name_identifier_format ⇒ Object (readonly)

Returns the value of attribute name_identifier_format.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def name_identifier_format
  @name_identifier_format
end

#name_qualifier ⇒ Object (readonly)

Returns the value of attribute name_qualifier.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def name_qualifier
  @name_qualifier
end

#response ⇒ Object (readonly)

Returns the value of attribute response.



5
6
7
 
# File 'lib/onelogin/saml/response.rb', line 5

def response
  @response
end

#saml_attributes ⇒ Object (readonly)

Returns the value of attribute saml_attributes.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def saml_attributes
  @saml_attributes
end

#session_index ⇒ Object (readonly)

Returns the value of attribute session_index.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def session_index
  @session_index
end

#settings ⇒ Object

Returns the value of attribute settings.



4
5
6
 
# File 'lib/onelogin/saml/response.rb', line 4

def settings
  @settings
end

#sp_name_qualifier ⇒ Object (readonly)

Returns the value of attribute sp_name_qualifier.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def sp_name_qualifier
  @sp_name_qualifier
end

#status_code ⇒ Object (readonly)

Returns the value of attribute status_code.



7
8
9
 
# File 'lib/onelogin/saml/response.rb', line 7

def status_code
  @status_code
end

#status_message ⇒ Object (readonly)

Returns the value of attribute status_message.



7
8
9
 
# File 'lib/onelogin/saml/response.rb', line 7

def status_message
  @status_message
end

#used_key ⇒ Object (readonly)

Returns the value of attribute used_key.



9
10
11
 
# File 'lib/onelogin/saml/response.rb', line 9

def used_key
  @used_key
end

#validation_error ⇒ Object (readonly)

Returns the value of attribute validation_error.



9
10
11
 
# File 'lib/onelogin/saml/response.rb', line 9

def validation_error
  @validation_error
end

#xml ⇒ Object (readonly)

Returns the value of attribute xml.



5
6
7
 
# File 'lib/onelogin/saml/response.rb', line 5

def xml
  @xml
end

Instance Method Details

#auth_failure? ⇒ Boolean

Returns:

  • (Boolean) 


138
139
140
 
# File 'lib/onelogin/saml/response.rb', line 138

def auth_failure?
  @status_code == Onelogin::Saml::StatusCodes::AUTHN_FAILED_URI
end

#decrypted_document ⇒ Object 



59
60
61
62
63
64
65
 
# File 'lib/onelogin/saml/response.rb', line 59

def decrypted_document
  @decrypted_document ||= document.clone.tap do |doc|
    doc.extend(XMLSecurity::SignedDocument)
    doc.decrypt!(settings)
    @used_key = doc.used_key
  end
end

#disable_signature_validation!(settings) ⇒ Object 



53
54
55
56
57
 
# File 'lib/onelogin/saml/response.rb', line 53

def disable_signature_validation!(settings)
  @settings      = settings
  @is_valid      = true
  @trusted_roots = [decrypted_document.root]
end

#fingerprint_from_idp ⇒ Object 



146
147
148
149
150
151
152
153
154
 
# File 'lib/onelogin/saml/response.rb', line 146

def fingerprint_from_idp
  if base64_cert = decrypted_document.at_xpath("//ds:X509Certificate", Onelogin::NAMESPACES)
    cert_text = Base64.decode64(base64_cert.content)
    cert = OpenSSL::X509::Certificate.new(cert_text)
    Digest::SHA1.hexdigest(cert.to_der)
  else
    nil
  end
end

#is_valid? ⇒ Boolean

Returns:

  • (Boolean) 


81
82
83
 
# File 'lib/onelogin/saml/response.rb', line 81

def is_valid?
  @is_valid ||= validate
end

#no_authn_context? ⇒ Boolean

Returns:

  • (Boolean) 


142
143
144
 
# File 'lib/onelogin/saml/response.rb', line 142

def no_authn_context?
  @status_code == Onelogin::Saml::StatusCodes::NO_AUTHN_CONTEXT_URI
end

#process(settings) ⇒ Object 



31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
 
# File 'lib/onelogin/saml/response.rb', line 31

def process(settings)
  @settings = settings
  @logger = settings.logger
  return unless @response

  @in_response_to = untrusted_find_first("/samlp:Response")['InResponseTo'] rescue nil
  @destination    = untrusted_find_first("/samlp:Response")['Destination'] rescue nil
  @status_message = untrusted_find_first("/samlp:Response/samlp:Status/samlp:StatusCode").content rescue nil

  @name_id        = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID").content rescue nil
  @name_identifier_format = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID")["Format"] rescue nil
  @name_qualifier = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID")["NameQualifier"] rescue nil
  @sp_name_qualifier = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID")["SPNameQualifier"] rescue nil
  @session_index  = trusted_find_first("saml:Assertion/saml:AuthnStatement")["SessionIndex"] rescue nil

  @saml_attributes = {}
  trusted_find("saml:Attribute").each do |attr|
    attrname = attr['FriendlyName'] || Onelogin::ATTRIBUTES[attr['Name']] || attr['Name']
    @saml_attributes[attrname] = attr.content.strip rescue nil
  end
end

#success_status? ⇒ Boolean

Returns:

  • (Boolean) 


134
135
136
 
# File 'lib/onelogin/saml/response.rb', line 134

def success_status?
  @status_code == Onelogin::Saml::StatusCodes::SUCCESS_URI
end

#trusted_find(xpath) ⇒ Object 



75
76
77
78
79
 
# File 'lib/onelogin/saml/response.rb', line 75

def trusted_find(xpath)
  trusted_roots.map do |trusted_root|
    trusted_root.xpath("descendant-or-self::#{xpath}", Onelogin::NAMESPACES).to_a
  end.flatten.compact
end

#trusted_find_first(xpath) ⇒ Object 



71
72
73
 
# File 'lib/onelogin/saml/response.rb', line 71

def trusted_find_first(xpath)
  trusted_find(xpath).first
end

#trusted_roots ⇒ Object

triggers validation



130
131
132
 
# File 'lib/onelogin/saml/response.rb', line 130

def trusted_roots
  is_valid? ? @trusted_roots : []
end

#untrusted_find_first(xpath) ⇒ Object 



67
68
69
 
# File 'lib/onelogin/saml/response.rb', line 67

def untrusted_find_first(xpath)
  decrypted_document.at_xpath(xpath, Onelogin::NAMESPACES)
end

#validate ⇒ Object 



85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
 
# File 'lib/onelogin/saml/response.rb', line 85

def validate
  if response.nil? || response == ""
    @validation_error = "No response to validate"
    return false
  end

  if !settings.idp_cert_fingerprint
    @validation_error = "No fingerprint configured in SAML settings"
    return false
  end

  # Verify the original document if it has a signature, otherwise verify the signature
  # in the encrypted portion. If there is no signature, then we can't verify.
  verified = false

  if document.has_signature?
    verified = document.validate(settings.idp_cert_fingerprint, @logger)
    if !verified
      @validation_error = document.validation_error
      return false
    end
  end

  if !verified && decrypted_document.has_signature?
    verified = decrypted_document.validate(settings.idp_cert_fingerprint, @logger)
    if !verified
      @validation_error = decrypted_document.validation_error
      return false
    end
  end

  if !verified
    @validation_error = "No signature found in the response"
    return false
  end

  # If we get here, validation has succeeded, and we can trust all
  # <ds:Signature> elements. Each of those has a <ds:Reference> which
  # points to the root of the root of the NodeSet it signs.
  @trusted_roots = decrypted_document.signed_roots

  true
end