Class: Akami::WSSE::VerifySignature

Inherits:
Object
  • Object
show all
Includes:
C14nHelper
Defined in:
lib/akami/wsse/verify_signature.rb

Overview

Validating WSSE signed messages.

Defined Under Namespace

Classes: InvalidDigest, InvalidSignedValue, MissingDecryptedAttachment

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from C14nHelper

#canonicalize

Constructor Details

#initialize(xml, decrypted_attachments: {}) ⇒ VerifySignature

For example: the decrypted_attachments of a gzipped xml is the gzipped base64 string, the result of the decryption { 'phase4-att-1f34-4d68a..' => 'kZ\xB4\xCD}\xCB..' }

Parameters:

  • xml (String) —

    The XML document to verify

  • decrypted_attachments (Hash) (defaults to: {}) —

    A hash of decrypted attachments: { 'id' => 'decrypted_string' }



22
23
24
25
 
# File 'lib/akami/wsse/verify_signature.rb', line 22

def initialize(xml, decrypted_attachments: {})
  @document = Nokogiri::XML(xml.to_s, &:noblanks)
  @decrypted_attachments = decrypted_attachments
end

Instance Attribute Details

#digesters ⇒ Object (readonly)

Returns a hash with currently initialized digesters.

Will be empty after initialization, and will contain used algorithms after verification.

May be used to insert additional digesters, not supported out of the box, for example:

digesters['http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'] = OpenSSL::Digest::SHA512.new


79
80
81
 
# File 'lib/akami/wsse/verify_signature.rb', line 79

def digesters
  @digesters
end

#document ⇒ Object (readonly)

Returns the value of attribute document.



16
17
18
 
# File 'lib/akami/wsse/verify_signature.rb', line 16

def document
  @document
end

#namespaces ⇒ Object

Returns XML namespaces that are used internally for document querying.



28
29
30
31
32
33
34
35
36
 
# File 'lib/akami/wsse/verify_signature.rb', line 28

def namespaces
  @namespaces ||= {
    wse: Akami::WSSE::WSE_NAMESPACE,
    wsse: Akami::WSSE::WSE_NAMESPACE,
    ds: "http://www.w3.org/2000/09/xmldsig#",
    wsu: Akami::WSSE::WSU_NAMESPACE,
    ec: Akami::WSSE::Signature::ExclusiveXMLCanonicalizationAlgorithm
  }
end

Instance Method Details

#certificate ⇒ Object

Returns signer's certificate, bundled in signed document



42
43
44
45
46
47
48
49
50
51
52
53
54
55
 
# File 'lib/akami/wsse/verify_signature.rb', line 42

def certificate
  binary_security_tokens = document.xpath("//wse:Security/wse:BinarySecurityToken", namespaces)
  if binary_security_tokens.size > 1
    signature_certificate_id = document.at_xpath(
      "//wse:Security/ds:Signature/ds:KeyInfo/wsse:SecurityTokenReference/wsse:Reference",
      namespaces
    )["URI"][1..] # strip leading '#'
    certificate_value = document.at_xpath("//wse:Security/wse:BinarySecurityToken[@wsu:Id=\"#{signature_certificate_id}\"]", namespaces)
  else
    certificate_value = binary_security_tokens.first
  end

  OpenSSL::X509::Certificate.new Base64.decode64(certificate_value.text.strip)
end

#valid? ⇒ Boolean

Validates document signature, returns true on success, false otherwise.

Returns:

  • (Boolean) 


58
59
60
61
62
 
# File 'lib/akami/wsse/verify_signature.rb', line 58

def valid?
  verify
rescue InvalidDigest, InvalidSignedValue, MissingDecryptedAttachment
  false
end

#verify! ⇒ Object

Validates document signature and digests and raises if anything mismatches.



65
66
67
68
69
 
# File 'lib/akami/wsse/verify_signature.rb', line 65

def verify!
  verify
rescue InvalidDigest, InvalidSignedValue, MissingDecryptedAttachment => e
  raise InvalidSignature, e.message
end