Class: XMLSecurity::SignedDocument

Inherits:

BaseDocument

• Object
• REXML::Document
• BaseDocument
• XMLSecurity::SignedDocument

Defined in:

lib/xml_security.rb

Constant Summary

Constants inherited from BaseDocument

BaseDocument::C14N, BaseDocument::DSIG, BaseDocument::NOKOGIRI_OPTIONS

Instance Attribute Summary

• #signed_element_id ⇒ Object

Instance Method Summary

• #validate_document(idp_cert_fingerprint, soft = true, options = {}) ⇒ Object
• #validate_document_with_cert(idp_cert, soft = true) ⇒ Object
• #validate_signature(base64_cert, soft = true) ⇒ Object

Methods inherited from BaseDocument

#algorithm, #canon_algorithm

Instance Attribute Details

#signed_element_id ⇒ Object

# File 'lib/xml_security.rb', line 191

def signed_element_id
  @signed_element_id ||= extract_signed_element_id
end

Instance Method Details

#validate_document(idp_cert_fingerprint, soft = true, options = {}) ⇒ Object

# File 'lib/xml_security.rb', line 195

def validate_document(idp_cert_fingerprint, soft = true, options = {})
  # get cert from response
  cert_element = REXML::XPath.first(
    self,
    "//ds:X509Certificate",
    { "ds"=>DSIG }
  )

  if cert_element
    base64_cert = OneLogin::RubySaml::Utils.element_text(cert_element)
    cert_text = Base64.decode64(base64_cert)
    begin
      cert = OpenSSL::X509::Certificate.new(cert_text)
    rescue OpenSSL::X509::CertificateError => _e
      return soft ? false : (raise OneLogin::RubySaml::ValidationError.new("Certificate Error"))
    end

    if options[:fingerprint_alg]
      fingerprint_alg = XMLSecurity::BaseDocument.new.algorithm(options[:fingerprint_alg]).new
    else
      fingerprint_alg = OpenSSL::Digest::SHA1.new
    end
    fingerprint = fingerprint_alg.hexdigest(cert.to_der)

    # check cert matches registered idp cert
    if fingerprint != idp_cert_fingerprint.gsub(/[^a-zA-Z0-9]/,"").downcase
      return soft ? false : (raise OneLogin::RubySaml::ValidationError.new("Fingerprint mismatch"))
    end
  else
    if options[:cert]
      base64_cert = Base64.encode64(options[:cert].to_pem)
    else
      return soft ? false : (raise OneLogin::RubySaml::ValidationError.new("Certificate element missing in response (ds:X509Certificate) and not cert provided at settings"))
    end
  end
  validate_signature(base64_cert, soft)
end

#validate_document_with_cert(idp_cert, soft = true) ⇒ Object

# File 'lib/xml_security.rb', line 233

def validate_document_with_cert(idp_cert, soft = true)
  # get cert from response
  cert_element = REXML::XPath.first(
    self,
    "//ds:X509Certificate",
    { "ds"=>DSIG }
  )

  if cert_element
    base64_cert = OneLogin::RubySaml::Utils.element_text(cert_element)
    cert_text = Base64.decode64(base64_cert)
    begin
      cert = OpenSSL::X509::Certificate.new(cert_text)
    rescue OpenSSL::X509::CertificateError => _e
      return soft ? false : (raise OneLogin::RubySaml::ValidationError.new("Certificate Error"))
    end

    # check saml response cert matches provided idp cert
    if idp_cert.to_pem != cert.to_pem
      return false
    end
  else
    base64_cert = Base64.encode64(idp_cert.to_pem)
  end
  validate_signature(base64_cert, true)
end

#validate_signature(base64_cert, soft = true) ⇒ Object

# File 'lib/xml_security.rb', line 260

def validate_signature(base64_cert, soft = true)

  document = Nokogiri::XML(self.to_s) do |config|
    config.options = XMLSecurity::BaseDocument::NOKOGIRI_OPTIONS
  end

  # create a rexml document
  @working_copy ||= REXML::Document.new(self.to_s).root

  # get signature node
  sig_element = REXML::XPath.first(
      @working_copy,
      "//ds:Signature",
      {"ds"=>DSIG}
  )

  if sig_element.nil?
    return soft ? false : (raise OneLogin::RubySaml::ValidationError.new("No Signature Node"))
  end

  # signature method
  sig_alg_value = REXML::XPath.first(
    sig_element,
    "./ds:SignedInfo/ds:SignatureMethod",
    {"ds"=>DSIG}
  )
  signature_algorithm = algorithm(sig_alg_value)

  # get signature
  base64_signature = REXML::XPath.first(
    sig_element,
    "./ds:SignatureValue",
    {"ds" => DSIG}
  )

  if base64_signature.nil?
    return soft ? false : (raise OneLogin::RubySaml::ValidationError.new("SignatureValue not found"))
  end

  signature = Base64.decode64(OneLogin::RubySaml::Utils.element_text(base64_signature))

  # canonicalization method
  canon_algorithm = canon_algorithm REXML::XPath.first(
    sig_element,
    './ds:SignedInfo/ds:CanonicalizationMethod',
    'ds' => DSIG
  )

  noko_sig_element = document.at_xpath('//ds:Signature', 'ds' => DSIG)
  noko_signed_info_element = noko_sig_element.at_xpath('./ds:SignedInfo', 'ds' => DSIG)

  canon_string = noko_signed_info_element.canonicalize(canon_algorithm)
  noko_sig_element.remove

  # get inclusive namespaces
  inclusive_namespaces = extract_inclusive_namespaces

  # check digests
  ref = REXML::XPath.first(sig_element, "//ds:Reference", {"ds"=>DSIG})

  hashed_element = document.at_xpath("//*[@ID=$id]", nil, { 'id' => extract_signed_element_id })

  canon_algorithm = canon_algorithm REXML::XPath.first(
    ref,
    '//ds:CanonicalizationMethod',
    { "ds" => DSIG }
  )

  canon_algorithm = process_transforms(ref, canon_algorithm)

  canon_hashed_element = hashed_element.canonicalize(canon_algorithm, inclusive_namespaces)

  digest_algorithm = algorithm(REXML::XPath.first(
    ref,
    "//ds:DigestMethod",
    { "ds" => DSIG }
  ))
  hash = digest_algorithm.digest(canon_hashed_element)
  encoded_digest_value = REXML::XPath.first(
    ref,
    "//ds:DigestValue",
    { "ds" => DSIG }
  )
  digest_value = Base64.decode64(OneLogin::RubySaml::Utils.element_text(encoded_digest_value))

  unless digests_match?(hash, digest_value)
    return soft ? false : (raise OneLogin::RubySaml::ValidationError.new("Digest mismatch"))
  end

  # get certificate object
  cert_text = Base64.decode64(base64_cert)
  cert = OpenSSL::X509::Certificate.new(cert_text)

  # verify signature
  unless cert.public_key.verify(signature_algorithm.new, signature, canon_string)
    return soft ? false : (raise OneLogin::RubySaml::ValidationError.new("Key validation error"))
  end

  return true
end