Skip to content

Commit 83a02bc

Browse files
pitbulkpitbulk
committed
Add test to the signature process (signature validations)
1 parent 0d13840 commit 83a02bc

File tree

6 files changed

+133
-57
lines changed

6 files changed

+133
-57
lines changed

‎lib/onelogin/ruby-saml/authrequest.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,8 @@ def create_params(settings, params={})
4646
if settings.security[:authn_requests_signed] && !settings.security[:embed_sign] && settings.private_key
4747
params['SigAlg'] = settings.security[:signature_method]
4848
url_string = "SAMLRequest=#{CGI.escape(base64_request)}"
49-
url_string += "&RelayState=#{CGI.escape(relay_state)}" if relay_state
50-
url_string += "&SigAlg=#{CGI.escape(params['SigAlg'])}"
49+
url_string << "&RelayState=#{CGI.escape(relay_state)}" if relay_state
50+
url_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
5151
private_key = settings.get_sp_key()
5252
signature = private_key.sign(XMLSecurity::BaseDocument.new.algorithm(settings.security[:signature_method]).new, url_string)
5353
params['Signature'] = encode(signature)

‎lib/onelogin/ruby-saml/logoutrequest.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,8 @@ def create_params(settings, params={})
4444
if settings.security[:logout_requests_signed] && !settings.security[:embed_sign] && settings.private_key
4545
params['SigAlg'] = settings.security[:signature_method]
4646
url_string = "SAMLRequest=#{CGI.escape(base64_request)}"
47-
url_string += "&RelayState=#{CGI.escape(relay_state)}" if relay_state
48-
url_string += "&SigAlg=#{CGI.escape(params['SigAlg'])}"
47+
url_string << "&RelayState=#{CGI.escape(relay_state)}" if relay_state
48+
url_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
4949
private_key = settings.get_sp_key()
5050
signature = private_key.sign(XMLSecurity::BaseDocument.new.algorithm(settings.security[:signature_method]).new, url_string)
5151
params['Signature'] = encode(signature)

‎lib/onelogin/ruby-saml/slo_logoutresponse.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,8 @@ def create_params(settings, request_id = nil, logout_message = nil, params = {})
4545
if settings.security[:logout_responses_signed] && !settings.security[:embed_sign] && settings.private_key
4646
params['SigAlg'] = settings.security[:signature_method]
4747
url_string = "SAMLResponse=#{CGI.escape(base64_response)}"
48-
url_string += "&RelayState=#{CGI.escape(relay_state)}" if relay_state
49-
url_string += "&SigAlg=#{CGI.escape(params['SigAlg'])}"
48+
url_string << "&RelayState=#{CGI.escape(relay_state)}" if relay_state
49+
url_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
5050
private_key = settings.get_sp_key()
5151
signature = private_key.sign(XMLSecurity::BaseDocument.new.algorithm(settings.security[:signature_method]).new, url_string)
5252
params['Signature'] = encode(signature)

‎test/logoutrequest_test.rb‎

Lines changed: 41 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -132,28 +132,53 @@ class RequestTest < Minitest::Test
132132
end
133133
end
134134

135-
describe "when the settings indicate to sign the logout request" do
136-
it "create a signature parameter" do
137-
settings = OneLogin::RubySaml::Settings.new
138-
settings.compress_request = false
139-
settings.idp_slo_target_url = "http://example.com?field=value"
140-
settings.name_identifier_value = "f00f00"
141-
settings.security[:logout_requests_signed] = true
142-
settings.security[:embed_sign] = false
135+
describe "#create_params when the settings indicate to sign the logout request" do
136+
def setup
137+
@settings = OneLogin::RubySaml::Settings.new
138+
@settings.compress_request = false
139+
@settings.idp_sso_target_url = "http://example.com?field=value"
140+
@settings.name_identifier_value = "f00f00"
141+
@settings.security[:logout_requests_signed] = true
142+
@settings.security[:embed_sign] = false
143+
@settings.certificate = ruby_saml_cert_text
144+
@settings.private_key = ruby_saml_key_text
145+
@cert = OpenSSL::X509::Certificate.new(ruby_saml_cert_text)
146+
end
147+
148+
it "create a signature parameter with RSA_SHA1 and validate it" do
143149
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
144-
settings.certificate = ruby_saml_cert_text
145-
settings.private_key = ruby_saml_key_text
146150

147-
params = OneLogin::RubySaml::Logoutrequest.new.create_params(settings)
151+
params = OneLogin::RubySaml::Logoutrequest.new.create_params(@settings, :RelayState => 'http://example.com')
152+
assert params['SAMLRequest']
153+
assert params[:RelayState]
148154
assert params['Signature']
149-
assert params['SigAlg'] == XMLSecurity::Document::RSA_SHA1
155+
assert_equal params['SigAlg'], XMLSecurity::Document::RSA_SHA1
150156

151-
# if signature_method changes, the SigAlg also changes
152-
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
153-
params = OneLogin::RubySaml::Logoutrequest.new.create_params(settings)
157+
query_string = "SAMLRequest=#{CGI.escape(params['SAMLRequest'])}"
158+
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
159+
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
160+
161+
signature_algorithm = XMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
162+
assert_equal signature_algorithm, OpenSSL::Digest::SHA1
163+
assert @cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
164+
end
165+
166+
it "create a signature parameter with RSA_SHA256 and validate it" do
167+
@settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
168+
169+
params = OneLogin::RubySaml::Logoutrequest.new.create_params(@settings, :RelayState => 'http://example.com')
154170
assert params['Signature']
155-
assert params['SigAlg'] == XMLSecurity::Document::RSA_SHA256
171+
assert_equal params['SigAlg'], XMLSecurity::Document::RSA_SHA256
172+
173+
query_string = "SAMLRequest=#{CGI.escape(params['SAMLRequest'])}"
174+
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
175+
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
176+
177+
signature_algorithm = XMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
178+
assert_equal signature_algorithm, OpenSSL::Digest::SHA256
179+
assert @cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
156180
end
181+
157182
end
158183

159184
end

‎test/request_test.rb‎

Lines changed: 42 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,7 @@ class RequestTest < Minitest::Test
145145
end
146146
end
147147

148-
describe "when the settings indicate to sign (embebed) the request" do
148+
describe "#create_params when the settings indicate to sign (embebed) the request" do
149149
it "create a signed request" do
150150
settings = OneLogin::RubySaml::Settings.new
151151
settings.compress_request = false
@@ -181,27 +181,51 @@ class RequestTest < Minitest::Test
181181
end
182182
end
183183

184-
describe "when the settings indicate to sign the request" do
185-
it "create a signature parameter" do
186-
settings = OneLogin::RubySaml::Settings.new
187-
settings.compress_request = false
188-
settings.idp_sso_target_url = "http://example.com?field=value"
189-
settings.assertion_consumer_service_binding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
190-
settings.security[:authn_requests_signed] = true
191-
settings.security[:embed_sign] = false
192-
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
193-
settings.certificate = ruby_saml_cert_text
194-
settings.private_key = ruby_saml_key_text
184+
describe "#create_params when the settings indicate to sign the request" do
185+
def setup
186+
@settings = OneLogin::RubySaml::Settings.new
187+
@settings.compress_request = false
188+
@settings.idp_sso_target_url = "http://example.com?field=value"
189+
@settings.assertion_consumer_service_binding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
190+
@settings.security[:authn_requests_signed] = true
191+
@settings.security[:embed_sign] = false
192+
@settings.certificate = ruby_saml_cert_text
193+
@settings.private_key = ruby_saml_key_text
194+
@cert = OpenSSL::X509::Certificate.new(ruby_saml_cert_text)
195+
end
196+
197+
it "create a signature parameter with RSA_SHA1 and validate it" do
198+
@settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
195199

196-
params = OneLogin::RubySaml::Authrequest.new.create_params(settings)
200+
params = OneLogin::RubySaml::Authrequest.new.create_params(@settings, :RelayState => 'http://example.com')
201+
assert params['SAMLRequest']
202+
assert params[:RelayState]
197203
assert params['Signature']
198-
assert params['SigAlg'] == XMLSecurity::Document::RSA_SHA1
204+
assert_equal params['SigAlg'], XMLSecurity::Document::RSA_SHA1
199205

200-
# if signature_method changes, the SigAlg also changes
201-
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
202-
params = OneLogin::RubySaml::Authrequest.new.create_params(settings)
206+
query_string = "SAMLRequest=#{CGI.escape(params['SAMLRequest'])}"
207+
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
208+
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
209+
210+
signature_algorithm = XMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
211+
assert_equal signature_algorithm, OpenSSL::Digest::SHA1
212+
assert @cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
213+
end
214+
215+
it "create a signature parameter with RSA_SHA256 and validate it" do
216+
@settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
217+
218+
params = OneLogin::RubySaml::Authrequest.new.create_params(@settings, :RelayState => 'http://example.com')
203219
assert params['Signature']
204-
assert params['SigAlg'] == XMLSecurity::Document::RSA_SHA256
220+
assert_equal params['SigAlg'], XMLSecurity::Document::RSA_SHA256
221+
222+
query_string = "SAMLRequest=#{CGI.escape(params['SAMLRequest'])}"
223+
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
224+
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
225+
226+
signature_algorithm = XMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
227+
assert_equal signature_algorithm, OpenSSL::Digest::SHA256
228+
assert @cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
205229
end
206230
end
207231

‎test/slo_logoutresponse_test.rb‎

Lines changed: 44 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -107,29 +107,56 @@ class SloLogoutresponseTest < Minitest::Test
107107
end
108108
end
109109

110-
describe "when the settings indicate to sign the logout response" do
111-
it "create a signature parameter" do
112-
settings = OneLogin::RubySaml::Settings.new
113-
settings.compress_response = false
114-
settings.idp_slo_target_url = "http://example.com?field=value"
115-
settings.assertion_consumer_service_binding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
116-
settings.security[:logout_responses_signed] = true
117-
settings.security[:embed_sign] = false
110+
describe "#create_params when the settings indicate to sign the logout response" do
111+
def setup
112+
@settings = OneLogin::RubySaml::Settings.new
113+
@settings.compress_response = false
114+
@settings.idp_slo_target_url = "http://example.com?field=value"
115+
@settings.assertion_consumer_service_binding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
116+
@settings.security[:logout_responses_signed] = true
117+
@settings.security[:embed_sign] = false
118+
@settings.certificate = ruby_saml_cert_text
119+
@settings.private_key = ruby_saml_key_text
120+
@cert = OpenSSL::X509::Certificate.new(ruby_saml_cert_text)
121+
@request = OneLogin::RubySaml::SloLogoutrequest.new(logout_request_document)
122+
end
123+
124+
it "create a signature parameter with RSA_SHA1 and validate it" do
118125
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
119-
settings.certificate = ruby_saml_cert_text
120-
settings.private_key = ruby_saml_key_text
121126

122-
request = OneLogin::RubySaml::SloLogoutrequest.new(logout_request_document)
123-
params = OneLogin::RubySaml::SloLogoutresponse.new.create_params(settings, request.id, "Custom Logout Message")
127+
params = OneLogin::RubySaml::SloLogoutresponse.new.create_params(@settings, @request.id, "Custom Logout Message", :RelayState => 'http://example.com')
128+
assert params['SAMLResponse']
129+
assert params[:RelayState]
124130
assert params['Signature']
125-
assert params['SigAlg'] == XMLSecurity::Document::RSA_SHA1
131+
assert_equal params['SigAlg'], XMLSecurity::Document::RSA_SHA1
126132

127-
# if signature_method changes, the SigAlg also changes
128-
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
129-
params = OneLogin::RubySaml::SloLogoutresponse.new.create_params(settings, request.id, "Custom Logout Message")
133+
query_string = "SAMLResponse=#{CGI.escape(params['SAMLResponse'])}"
134+
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
135+
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
136+
137+
signature_algorithm = XMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
138+
assert_equal signature_algorithm, OpenSSL::Digest::SHA1
139+
assert @cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
140+
end
141+
142+
it "create a signature parameter with RSA_SHA256 and validate it" do
143+
@settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
144+
145+
params = OneLogin::RubySaml::SloLogoutresponse.new.create_params(@settings, @request.id, "Custom Logout Message", :RelayState => 'http://example.com')
146+
assert params['SAMLResponse']
147+
assert params[:RelayState]
130148
assert params['Signature']
131-
assert params['SigAlg'] == XMLSecurity::Document::RSA_SHA256
149+
assert_equal params['SigAlg'], XMLSecurity::Document::RSA_SHA256
150+
151+
query_string = "SAMLResponse=#{CGI.escape(params['SAMLResponse'])}"
152+
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
153+
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
154+
155+
signature_algorithm = XMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
156+
assert_equal signature_algorithm, OpenSSL::Digest::SHA256
157+
assert @cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
132158
end
159+
133160
end
134161
end
135162
end

0 commit comments

Comments
 (0)