Skip to content

Commit 660fc10

Browse files
pitbulkpitbulk
committed
Deprecate the use of settings.issuer. Use instead settings.sp_entity_id
1 parent beee9b6 commit 660fc10

12 files changed

+67
-42
lines changed

‎README.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -238,7 +238,7 @@ def saml_settings
238238
settings = OneLogin::RubySaml::Settings.new
239239
240240
settings.assertion_consumer_service_url = "http://#{request.host}/saml/consume"
241-
settings.issuer = "http://#{request.host}/saml/metadata"
241+
settings.sp_entity_id = "http://#{request.host}/saml/metadata"
242242
settings.idp_entity_id = "https://app.onelogin.com/saml/metadata/#{OneLoginAppId}"
243243
settings.idp_sso_target_url = "https://app.onelogin.com/trust/saml2/http-post/sso/#{OneLoginAppId}"
244244
settings.idp_slo_target_url = "https://app.onelogin.com/trust/saml2/http-redirect/slo/#{OneLoginAppId}"
@@ -262,6 +262,8 @@ def saml_settings
262262
end
263263
```
264264
265+
The use of settings.issuer is deprecated in favour of settings.sp_entity_id
266+
265267
Some assertion validations can be skipped by passing parameters to `OneLogin::RubySaml::Response.new()`. For example, you can skip the `AuthnStatement`, `Conditions`, `Recipient`, or the `SubjectConfirmation` validations by initializing the response with different options:
266268
267269
```ruby
@@ -301,7 +303,7 @@ class SamlController < ApplicationController
301303
settings = OneLogin::RubySaml::Settings.new
302304
303305
settings.assertion_consumer_service_url = "http://#{request.host}/saml/consume"
304-
settings.issuer = "http://#{request.host}/saml/metadata"
306+
settings.sp_entity_id = "http://#{request.host}/saml/metadata"
305307
settings.idp_sso_target_url = "https://app.onelogin.com/saml/signon/#{OneLoginAppId}"
306308
settings.idp_cert_fingerprint = OneLoginAppCertFingerPrint
307309
settings.name_identifier_format = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
@@ -364,7 +366,7 @@ def saml_settings
364366
settings = idp_metadata_parser.parse_remote("https://example.com/auth/saml2/idp/metadata")
365367
366368
settings.assertion_consumer_service_url = "http://#{request.host}/saml/consume"
367-
settings.issuer = "http://#{request.host}/saml/metadata"
369+
settings.sp_entity_id = "http://#{request.host}/saml/metadata"
368370
settings.name_identifier_format = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
369371
# Optional for most SAML IdPs
370372
settings.authn_context = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"

‎lib/onelogin/ruby-saml/authrequest.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -117,9 +117,9 @@ def create_xml_document(settings)
117117
if settings.assertion_consumer_service_url != nil
118118
root.attributes["AssertionConsumerServiceURL"] = settings.assertion_consumer_service_url
119119
end
120-
if settings.issuer != nil
120+
if settings.sp_entity_id != nil
121121
issuer = root.add_element "saml:Issuer"
122-
issuer.text = settings.issuer
122+
issuer.text = settings.sp_entity_id
123123
end
124124

125125
if settings.name_identifier_value_requested != nil

‎lib/onelogin/ruby-saml/logoutrequest.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,9 +105,9 @@ def create_xml_document(settings)
105105
root.attributes['Version'] = "2.0"
106106
root.attributes['Destination'] = settings.idp_slo_target_url unless settings.idp_slo_target_url.nil?
107107

108-
if settings.issuer
108+
if settings.sp_entity_id
109109
issuer = root.add_element "saml:Issuer"
110-
issuer.text = settings.issuer
110+
issuer.text = settings.sp_entity_id
111111
end
112112

113113
nameid = root.add_element "saml:NameID"

‎lib/onelogin/ruby-saml/logoutresponse.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,7 @@ def valid_state?
163163

164164
return append_error("No settings on logout response") if settings.nil?
165165

166-
return append_error("No issuer in settings of the logout response") if settings.issuer.nil?
166+
return append_error("No sp_entity_id in settings of the logout response") if settings.sp_entity_id.nil?
167167

168168
if settings.idp_cert_fingerprint.nil? && settings.idp_cert.nil? && settings.idp_cert_multi.nil?
169169
return append_error("No fingerprint or certificate on settings of the logout response")

‎lib/onelogin/ruby-saml/metadata.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,8 @@ def generate(settings, pretty_print=false)
5757
end
5858

5959
root.attributes["ID"] = OneLogin::RubySaml::Utils.uuid
60-
if settings.issuer
61-
root.attributes["entityID"] = settings.issuer
60+
if settings.sp_entity_id
61+
root.attributes["entityID"] = settings.sp_entity_id
6262
end
6363
if settings.single_logout_service_url
6464
sp_sso.add_element "md:SingleLogoutService", {

‎lib/onelogin/ruby-saml/response.rb‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -589,11 +589,11 @@ def validate_in_response_to
589589
# @raise [ValidationError] if soft == false and validation fails
590590
#
591591
def validate_audience
592-
return true if audiences.empty? || settings.issuer.nil? || settings.issuer.empty?
592+
return true if audiences.empty? || settings.sp_entity_id.nil? || settings.sp_entity_id.empty?
593593

594-
unless audiences.include? settings.issuer
594+
unless audiences.include? settings.sp_entity_id
595595
s = audiences.count > 1 ? 's' : '';
596-
error_msg = "Invalid Audience#{s}. The audience#{s} #{audiences.join(',')}, did not match the expected audience #{settings.issuer}"
596+
error_msg = "Invalid Audience#{s}. The audience#{s} #{audiences.join(',')}, did not match the expected audience #{settings.sp_entity_id}"
597597
return append_error(error_msg)
598598
end
599599

@@ -781,8 +781,8 @@ def validate_name_id
781781
return append_error("An empty NameID value found")
782782
end
783783

784-
unless settings.issuer.nil? || settings.issuer.empty? || name_id_spnamequalifier.nil? || name_id_spnamequalifier.empty?
785-
if name_id_spnamequalifier != settings.issuer
784+
unless settings.sp_entity_id.nil? || settings.sp_entity_id.empty? || name_id_spnamequalifier.nil? || name_id_spnamequalifier.empty?
785+
if name_id_spnamequalifier != settings.sp_entity_id
786786
return append_error("The SPNameQualifier value mistmatch the SP entityID value.")
787787
end
788788
end

‎lib/onelogin/ruby-saml/settings.rb‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,6 @@ def initialize(overrides = {}, keep_security_attributes = false)
4040
attr_accessor :idp_name_qualifier
4141
attr_accessor :valid_until
4242
# SP Data
43-
attr_accessor :issuer
4443
attr_accessor :assertion_consumer_service_url
4544
attr_accessor :assertion_consumer_service_binding
4645
attr_accessor :sp_name_qualifier
@@ -68,6 +67,28 @@ def initialize(overrides = {}, keep_security_attributes = false)
6867
# Compability
6968
attr_accessor :assertion_consumer_logout_service_url
7069
attr_accessor :assertion_consumer_logout_service_binding
70+
attr_accessor :issuer
71+
72+
# @return [String] SP Entity ID
73+
#
74+
def sp_entity_id
75+
val = nil
76+
if @sp_entity_id.nil?
77+
if @issuer
78+
val = @issuer
79+
end
80+
else
81+
val = @sp_entity_id
82+
end
83+
val
84+
end
85+
86+
# Setter for SP Entity ID.
87+
# @param val [String].
88+
#
89+
def sp_entity_id=(val)
90+
@sp_entity_id = val
91+
end
7192

7293
# @return [String] Single Logout Service URL.
7394
#

‎lib/onelogin/ruby-saml/slo_logoutresponse.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,9 +114,9 @@ def create_xml_document(settings, request_id = nil, logout_message = nil)
114114
root.attributes['InResponseTo'] = request_id unless request_id.nil?
115115
root.attributes['Destination'] = settings.idp_slo_target_url unless settings.idp_slo_target_url.nil?
116116

117-
if settings.issuer != nil
117+
if settings.sp_entity_id != nil
118118
issuer = root.add_element "saml:Issuer"
119-
issuer.text = settings.issuer
119+
issuer.text = settings.sp_entity_id
120120
end
121121

122122
# add success message

‎test/logoutresponse_test.rb‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ class RubySamlTest < Minitest::Test
6262

6363
assert logoutresponse.validate
6464

65-
assert_equal settings.issuer, logoutresponse.issuer
65+
assert_equal settings.sp_entity_id, logoutresponse.issuer
6666
assert_equal in_relation_to_request_id, logoutresponse.in_response_to
6767

6868
assert logoutresponse.success?
@@ -123,12 +123,13 @@ class RubySamlTest < Minitest::Test
123123
assert_includes logoutresponse.errors, "The status code of the Logout Response was not Success, was Requester -> Logoutrequest expired"
124124
end
125125

126-
it "invalidate logout response when in lack of issuer setting" do
126+
it "invalidate logout response when in lack of sp_entity_id setting" do
127127
bad_settings = settings
128128
bad_settings.issuer = nil
129+
bad_settings.sp_entity_id = nil
129130
logoutresponse = OneLogin::RubySaml::Logoutresponse.new(unsuccessful_logout_response_document, bad_settings)
130131
assert !logoutresponse.validate
131-
assert_includes logoutresponse.errors, "No issuer in settings of the logout response"
132+
assert_includes logoutresponse.errors, "No sp_entity_id in settings of the logout response"
132133
end
133134

134135
it "invalidate logout response with wrong issuer" do
@@ -202,11 +203,12 @@ class RubySamlTest < Minitest::Test
202203
assert_includes logoutresponse.errors, "The status code of the Logout Response was not Success, was Requester"
203204
end
204205

205-
it "raise validation error when in lack of issuer setting" do
206+
it "raise validation error when in lack of sp_entity_id setting" do
206207
settings.issuer = nil
208+
settings.sp_entity_id = nil
207209
logoutresponse = OneLogin::RubySaml::Logoutresponse.new(unsuccessful_logout_response_document, settings)
208210
assert_raises(OneLogin::RubySaml::ValidationError) { logoutresponse.validate }
209-
assert_includes logoutresponse.errors, "No issuer in settings of the logout response"
211+
assert_includes logoutresponse.errors, "No sp_entity_id in settings of the logout response"
210212
end
211213

212214
it "raise validation error when logout response with wrong issuer" do

‎test/metadata_test.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ class MetadataTest < Minitest::Test
1212
let(:acs) { REXML::XPath.first(xml_doc, "//md:AssertionConsumerService") }
1313

1414
before do
15-
settings.issuer = "https://example.com"
15+
settings.sp_entity_id = "https://example.com"
1616
settings.name_identifier_format = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
1717
settings.assertion_consumer_service_url = "https://foo.example/saml/consume"
1818
end

0 commit comments

Comments
 (0)