Class: RackEntraIdAuth::EntraIdRequest

Inherits:
Object
  • Object
show all
Defined in:
lib/rack_entra_id_auth/entra_id_request.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(request, saml_setting_overrides = {}) ⇒ EntraIdRequest

Returns a new instance of EntraIdRequest.



7
8
9
10
11
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 7

def initialize(request, saml_setting_overrides = {})
  @request = request

  @saml_settings = OneLogin::RubySaml::Settings.new(RackEntraIdAuth.config.ruby_saml_settings.merge(saml_setting_overrides))
end

Instance Attribute Details

#request ⇒ Object (readonly)

Returns the value of attribute request.



5
6
7
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 5

def request
  @request
end

Instance Method Details

#base_url ⇒ String

Returns the request's base URL and path without the path_info at the end.

Returns:

  • (String) 


17
18
19
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 17

def base_url
  "#{request.base_url}#{request.path}".sub(Regexp.new("#{request.path_info}$"), '')
end

#excluded_path? ⇒ Bool

Returns whether the request should be ignored by the middleware. Returns true if the request's path matches any of the strings or regular expressions in the exclude_paths config, otherwise returns false.

Returns:

  • (Bool) 


27
28
29
30
31
32
33
34
35
36
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 27

def excluded_path?
  RackEntraIdAuth.config.exclude_paths.any? do |regexp_or_string|
    case regexp_or_string
      when Regexp
        regexp_or_string.match?(request.path_info)
      when String
        regexp_or_string.eql?(request.path_info)
    end
  end
end

#login? ⇒ Bool

Returns whether the request is a Service Provider initiated sign-on request. Returns true if the request's path info equals the login path configuration (login_path), otherwise returns false.

Returns:

  • (Bool) 


44
45
46
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 44

def login?
  request.path_info.eql?(RackEntraIdAuth.config.)
end

#login_response? ⇒ Bool

Returns whether the request contains a single sign-on response (for Service Provider initiated single sign-on requests). Returns true if the request's header contains a SAMLResponse and if the request's base_url and path match the ACS service url setting (assertion_consumer_service_url), otherwise returns false.

Returns:

  • (Bool) 


56
57
58
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 56

def 
  saml_response.present? and "#{request.base_url}#{request.path}".eql?(@saml_settings.assertion_consumer_service_url)
end

#logout? ⇒ Bool

Returns whether the request is a Service Provider initiated logout request. Returns true if the request's path info equals the logout path configuration (logout_path), otherwise returns false.

Returns:

  • (Bool) 


66
67
68
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 66

def logout?
  request.path_info.eql?(RackEntraIdAuth.config.logout_path)
end

#logout_request? ⇒ Bool

Returns whether the request contains a single logout request (for ID Provider initiated single logout requests). Returns true if the request contains a SAMLRequest query parameter and if the request's base_url and path match the single logout service url setting (single_logout_service_url), otherwise returns false.

Returns:

  • (Bool) 


78
79
80
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 78

def logout_request?
  request.params['SAMLRequest'].present? and "#{request.base_url}#{request.path}".eql?(@saml_settings.single_logout_service_url)
end

#logout_response? ⇒ Bool

Returns whether the request contains a single logout response for Service Provider initiated logout request. Returns true if the request contains a SAMLResponse query parameter and if the request's base_url and path match the single logout service url setting (single_logout_service_url), otherwise returns false.

Returns:

  • (Bool) 


90
91
92
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 90

def logout_response?
  request.params['SAMLResponse'].present? and "#{request.base_url}#{request.path}".eql?(@saml_settings.single_logout_service_url)
end

#relay_state_url ⇒ String

Returns the RelayState in the header of the request or its query parameters.

Returns:

  • (String) 


99
100
101
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 99

def relay_state_url
  request.get_header('rack.request.form_hash')['RelayState'] rescue request.params['RelayState'] || base_url
end

#saml_auth_response(auth_request_id: request.session[:auth_request_id], skip_conditions: false, allowed_clock_drift: nil, skip_subject_confirmation: false, skip_recipient_check: false, skip_audience: false) ⇒ OneLogin::RubySaml::Response

A single sign-on response for the SAMLResponse in the request's header. This is the response sent by the ID Provider for Service Provider initiated single sign-on requests.

Parameters:

  • auth_request_id (String) (defaults to: request.session[:auth_request_id]) —

    If provided, check that the inResponseTo in the response matches the uuid of the sign-on request that initiated the response.

  • skip_conditions (Bool) (defaults to: false) —

    Skip the conditions validation.

  • allowed_clock_drift (Float) (defaults to: nil) —

    The allowed clock drift when checking time stamps.

  • skip_subject_confirmation (Bool) (defaults to: false) —

    Skip the subject confirmation validation.

  • skip_recipient_check (Bool) (defaults to: false) —

    Skip the recipient validation of the subject confirmation element.

  • skip_audience (Bool) (defaults to: false) —

    Skip the audience validation.

Returns:

  • (OneLogin::RubySaml::Response) —

    A single sign-on response for a Service Provideer initiated single sign-on request.



122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 122

def saml_auth_response (auth_request_id: request.session[:auth_request_id], skip_conditions: false, allowed_clock_drift: nil, skip_subject_confirmation: false, skip_recipient_check: false, skip_audience: false)
  response = OneLogin::RubySaml::Response.new(
    saml_response,
    { :settings => @saml_settings,
      :matches_request_id => auth_request_id,
      :skip_conditions => skip_conditions,
      :allowed_clock_drift => allowed_clock_drift,
      :skip_subject_confirmation => skip_subject_confirmation,
      :skip_recipient_check => skip_recipient_check,
      :skip_audience => skip_audience })

  # the auth request's ID is no longer needed
  request.session.delete(:auth_request_id)

  response
end

#saml_logout_request(allowed_clock_drift: nil, relax_signature_validation: false) ⇒ OneLogin::RubySaml::Logoutresponse

A single logout request for the SAMLRequest in the request's query parameters. This is the request sent by the ID Provider for ID Provider initiated single logout requests.

Parameters:

  • allowed_clock_drift (Float) (defaults to: nil) —

    The allowed clock drift when checking time stamps.

  • relax_signature_validation (Bool) (defaults to: false) —

    If true and there's no ID Provider certs in the settings then ignore the signature validation on the request.

Returns:

  • (OneLogin::RubySaml::Logoutresponse) —

    A single logout response for a Service Provideer initiated single logout request.



152
153
154
155
156
157
158
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 152

def saml_logout_request (allowed_clock_drift: nil, relax_signature_validation: false)
  OneLogin::RubySaml::SloLogoutrequest.new(
    request.params['SAMLRequest'],
    { :settings => @saml_settings,
      :allowed_clock_drift => allowed_clock_drift,
      :relax_signature_validation => relax_signature_validation })
end

#saml_logout_response(logout_request_id: request.session[:logout_request_id], relax_signature_validation: false) ⇒ OneLogin::RubySaml::Logoutresponse

A single logout response for the SAMLResponse in the request's query parameters. This is the response sent by the ID Provider for Service Provider initiated single logout requests.

Parameters:

  • logout_request_id (String) (defaults to: request.session[:logout_request_id]) —

    If provided, check that the inResponseTo in the response matches the uuid of the logout request that initiated the response.

  • relax_signature_validation (Bool) (defaults to: false) —

    If true and there's no ID Provider certs in the settings then ignore the signature validation on the response.

Returns:

  • (OneLogin::RubySaml::Logoutresponse) —

    A single logout response for a Service Provideer initiated single logout request.



174
175
176
177
178
179
180
181
182
183
184
185
186
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 174

def saml_logout_response (logout_request_id: request.session[:logout_request_id], relax_signature_validation: false)
  logout_response = OneLogin::RubySaml::Logoutresponse.new(
    request.params['SAMLResponse'],
    @saml_settings,
    { :get_params => request.params,
      :matches_request_id => logout_request_id,
      :relax_signature_validation => relax_signature_validation })

  # the logout request's ID is no longer needed
  request.session.delete(:logout_request_id)

  logout_response
end

#slo_response_url(request_id: nil, logout_message: nil, params: {}, logout_status_code: nil) ⇒ String

Returns a single logout reponse URL for the settings provided. Used for ID Provider initiated log outs.

Parameters:

  • request_id (String) (defaults to: nil) —

    The ID of the LogoutRequest sent by this SP to the IdP. That ID will be placed as the InResponseTo in the logout response.

  • logout_message (String) (defaults to: nil) —

    The message to be placed as StatusMessage in the logout response.

  • params (Hash) (defaults to: {}) —

    Extra query parameters to be added to the URL (e.g. RelayState).

  • logout_status_code (String) (defaults to: nil) —

    The StatusCode to be placed as StatusMessage in the logout response.

Returns:

  • (String) 


203
204
205
206
207
208
209
210
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 203

def slo_response_url (request_id: nil, logout_message: nil, params: {}, logout_status_code: nil)
  OneLogin::RubySaml::SloLogoutresponse.new.create(
    @saml_settings,
    request_id,
    logout_message,
    params,
    logout_status_code)
end

#slo_url(params = {}) ⇒ String|nil

Returns a single logout request URL for the settings provided if an ID Provider single logout target URL is present in the settings (idp_slo_service_url), otherwise returns nil. Used for Service Provider initiated log outs.

Parameters:

  • params (Hash) (defaults to: {}) —

    Extra query parameters to be added to the URL (e.g. RelayState).

Returns:

  • (String|nil) 


222
223
224
225
226
227
228
229
230
231
232
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 222

def slo_url (params = {})
  logout_request = OneLogin::RubySaml::Logoutrequest.new

  if @saml_settings.idp_slo_service_url.present?
    # store the logout request's uuid to validate it in the response
    request.session[:logout_request_id] = logout_request.uuid

    # return nil if no single logout url is set
    logout_request.create(@saml_settings, params)
  end
end

#sso_url(params = {}) ⇒ String

Returns a single sign-on authentication request URL for the settings provided. Used for Service Provider initiated sign-ins.

Parameters:

  • params (Hash) (defaults to: {}) —

    Extra query parameters to be added to the URL (e.g. RelayState).

Returns:

  • (String) 


242
243
244
245
246
247
248
249
 
# File 'lib/rack_entra_id_auth/entra_id_request.rb', line 242

def sso_url (params = {})
  auth_request = OneLogin::RubySaml::Authrequest.new

  # store the auth request's uuid to validate it in the response
  request.session[:auth_request_id] = auth_request.uuid

  auth_request.create(@saml_settings, params)
end