Class: Onelogin::Saml::Response

Inherits:
Object
  • Object
show all
Defined in:
lib/onelogin/saml/response.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(response, settings = nil, as_of: Time.now) ⇒ Response

Returns a new instance of Response.



11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
 
# File 'lib/onelogin/saml/response.rb', line 11

def initialize(response, settings=nil, as_of: Time.now)
  @response = response

  begin
    @xml = Base64.decode64(@response)
    @document = Nokogiri::XML(@xml)
    @document.extend(XMLSecurity::SignedDocument)
  rescue
    # could not parse document, everything is invalid
    @response = nil
    return
  end

  @issuer = document.at_xpath("/samlp:Response/saml:Issuer", Onelogin::NAMESPACES).content.strip rescue nil
  @issuer ||= document.at_xpath("/samlp:Response/saml:Assertion/saml:Issuer", Onelogin::NAMESPACES).content.strip rescue nil
  @status_code = document.at_xpath("/samlp:Response/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES)["Value"] rescue nil

  process(settings, as_of: as_of) if settings
end

Instance Attribute Details

#destination ⇒ Object (readonly)

Returns the value of attribute destination.



8
9
10
 
# File 'lib/onelogin/saml/response.rb', line 8

def destination
  @destination
end

#document ⇒ Object (readonly)

Returns the value of attribute document.



5
6
7
 
# File 'lib/onelogin/saml/response.rb', line 5

def document
  @document
end

#in_response_to ⇒ Object (readonly)

Returns the value of attribute in_response_to.



8
9
10
 
# File 'lib/onelogin/saml/response.rb', line 8

def in_response_to
  @in_response_to
end

#issuer ⇒ Object (readonly)

Returns the value of attribute issuer.



8
9
10
 
# File 'lib/onelogin/saml/response.rb', line 8

def issuer
  @issuer
end

#name_id ⇒ Object (readonly)

Returns the value of attribute name_id.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def name_id
  @name_id
end

#name_identifier_format ⇒ Object (readonly)

Returns the value of attribute name_identifier_format.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def name_identifier_format
  @name_identifier_format
end

#name_qualifier ⇒ Object (readonly)

Returns the value of attribute name_qualifier.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def name_qualifier
  @name_qualifier
end

#response ⇒ Object (readonly)

Returns the value of attribute response.



5
6
7
 
# File 'lib/onelogin/saml/response.rb', line 5

def response
  @response
end

#saml_attributes ⇒ Object (readonly)

Returns the value of attribute saml_attributes.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def saml_attributes
  @saml_attributes
end

#session_index ⇒ Object (readonly)

Returns the value of attribute session_index.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def session_index
  @session_index
end

#settings ⇒ Object

Returns the value of attribute settings.



4
5
6
 
# File 'lib/onelogin/saml/response.rb', line 4

def settings
  @settings
end

#sp_name_qualifier ⇒ Object (readonly)

Returns the value of attribute sp_name_qualifier.



6
7
8
 
# File 'lib/onelogin/saml/response.rb', line 6

def sp_name_qualifier
  @sp_name_qualifier
end

#status_code ⇒ Object (readonly)

Returns the value of attribute status_code.



7
8
9
 
# File 'lib/onelogin/saml/response.rb', line 7

def status_code
  @status_code
end

#status_message ⇒ Object (readonly)

Returns the value of attribute status_message.



7
8
9
 
# File 'lib/onelogin/saml/response.rb', line 7

def status_message
  @status_message
end

#used_key ⇒ Object (readonly)

Returns the value of attribute used_key.



9
10
11
 
# File 'lib/onelogin/saml/response.rb', line 9

def used_key
  @used_key
end

#validation_error ⇒ Object (readonly)

Returns the value of attribute validation_error.



9
10
11
 
# File 'lib/onelogin/saml/response.rb', line 9

def validation_error
  @validation_error
end

#xml ⇒ Object (readonly)

Returns the value of attribute xml.



5
6
7
 
# File 'lib/onelogin/saml/response.rb', line 5

def xml
  @xml
end

Instance Method Details

#auth_failure? ⇒ Boolean

Returns:

  • (Boolean) 


156
157
158
 
# File 'lib/onelogin/saml/response.rb', line 156

def auth_failure?
  @status_code == Onelogin::Saml::StatusCodes::AUTHN_FAILED_URI
end

#decrypted_document ⇒ Object 



74
75
76
77
78
79
80
 
# File 'lib/onelogin/saml/response.rb', line 74

def decrypted_document
  @decrypted_document ||= document.clone.tap do |doc|
    doc.extend(XMLSecurity::SignedDocument)
    doc.decrypt!(settings)
    @used_key = doc.used_key
  end
end

#disable_signature_validation!(settings) ⇒ Object 



68
69
70
71
72
 
# File 'lib/onelogin/saml/response.rb', line 68

def disable_signature_validation!(settings)
  @settings      = settings
  @is_valid      = true
  @trusted_roots = [decrypted_document.root]
end

#fingerprint_from_idp ⇒ Object 



164
165
166
167
168
169
170
171
172
 
# File 'lib/onelogin/saml/response.rb', line 164

def fingerprint_from_idp
  if base64_cert = decrypted_document.at_xpath("//ds:X509Certificate", Onelogin::NAMESPACES)
    cert_text = Base64.decode64(base64_cert.content)
    cert = OpenSSL::X509::Certificate.new(cert_text)
    Digest::SHA1.hexdigest(cert.to_der)
  else
    nil
  end
end

#is_valid? ⇒ Boolean

Returns:

  • (Boolean) 


96
97
98
99
100
101
 
# File 'lib/onelogin/saml/response.rb', line 96

def is_valid?
  if !instance_variable_defined?(:@is_valid)
    @is_valid = validate
  end
  @is_valid
end

#no_authn_context? ⇒ Boolean

Returns:

  • (Boolean) 


160
161
162
 
# File 'lib/onelogin/saml/response.rb', line 160

def no_authn_context?
  @status_code == Onelogin::Saml::StatusCodes::NO_AUTHN_CONTEXT_URI
end

#process(settings, as_of: Time.now) ⇒ Object 



31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
 
# File 'lib/onelogin/saml/response.rb', line 31

def process(settings, as_of: Time.now)
  @settings = settings
  @logger = settings.logger
  return unless @response

  @in_response_to = untrusted_find_first("/samlp:Response")['InResponseTo'] rescue nil
  @destination    = untrusted_find_first("/samlp:Response")['Destination'] rescue nil
  @status_message = untrusted_find_first("/samlp:Response/samlp:Status/samlp:StatusCode").content rescue nil

  @name_id        = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID").content rescue nil
  @name_identifier_format = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID")["Format"] rescue nil
  @name_qualifier = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID")["NameQualifier"] rescue nil
  @sp_name_qualifier = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID")["SPNameQualifier"] rescue nil
  @session_index  = trusted_find_first("saml:Assertion/saml:AuthnStatement")["SessionIndex"] rescue nil
  @issue_instant  = trusted_find_first("saml:Assertion")["IssueInstant"] rescue nil

  @saml_attributes = {}
  trusted_find("saml:Attribute").each do |attr|
    attrname = attr['FriendlyName'] || Onelogin::ATTRIBUTES[attr['Name']] || attr['Name']
    @saml_attributes[attrname] = attr.content.strip rescue nil
  end

  if @is_valid
    @issue_instant = Time.parse(@issue_instant) if @issue_instant
    if !@issue_instant
      @is_valid = false
      @validation_error = "No timestamp in message"
    elsif @issue_instant + 5 * 60 < as_of
      @is_valid = false
      @validation_error = "Assertion expired"
    elsif @issue_instant - 5 * 60 > as_of
      @is_valid = false
      @validation_error = "Assertion not yet valid"
    end
  end
end

#success_status? ⇒ Boolean

Returns:

  • (Boolean) 


152
153
154
 
# File 'lib/onelogin/saml/response.rb', line 152

def success_status?
  @status_code == Onelogin::Saml::StatusCodes::SUCCESS_URI
end

#trusted_find(xpath) ⇒ Object 



90
91
92
93
94
 
# File 'lib/onelogin/saml/response.rb', line 90

def trusted_find(xpath)
  trusted_roots.map do |trusted_root|
    trusted_root.xpath("descendant-or-self::#{xpath}", Onelogin::NAMESPACES).to_a
  end.flatten.compact
end

#trusted_find_first(xpath) ⇒ Object 



86
87
88
 
# File 'lib/onelogin/saml/response.rb', line 86

def trusted_find_first(xpath)
  trusted_find(xpath).first
end

#trusted_roots ⇒ Object

triggers validation



148
149
150
 
# File 'lib/onelogin/saml/response.rb', line 148

def trusted_roots
  is_valid? ? @trusted_roots : []
end

#untrusted_find_first(xpath) ⇒ Object 



82
83
84
 
# File 'lib/onelogin/saml/response.rb', line 82

def untrusted_find_first(xpath)
  decrypted_document.at_xpath(xpath, Onelogin::NAMESPACES)
end

#validate ⇒ Object 



103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
 
# File 'lib/onelogin/saml/response.rb', line 103

def validate
  if response.nil? || response == ""
    @validation_error = "No response to validate"
    return false
  end

  if !settings.idp_cert_fingerprint
    @validation_error = "No fingerprint configured in SAML settings"
    return false
  end

  # Verify the original document if it has a signature, otherwise verify the signature
  # in the encrypted portion. If there is no signature, then we can't verify.
  verified = false

  if document.has_signature?
    verified = document.validate(settings.idp_cert_fingerprint, @logger)
    if !verified
      @validation_error = document.validation_error
      return false
    end
  end

  if !verified && decrypted_document.has_signature?
    verified = decrypted_document.validate(settings.idp_cert_fingerprint, @logger)
    if !verified
      @validation_error = decrypted_document.validation_error
      return false
    end
  end

  if !verified
    @validation_error = "No signature found in the response"
    return false
  end

  # If we get here, validation has succeeded, and we can trust all
  # <ds:Signature> elements. Each of those has a <ds:Reference> which
  # points to the root of the root of the NodeSet it signs.
  @trusted_roots = decrypted_document.signed_roots

  true
end