See SAML-Toolkits#460.Fix bug on idp_metadata_parser: When a XML with multiple descriptos, the first entityDescriptor contained a SPSSODescriptor, the parser returned no element instead the first entityDescriptor with a IDPSSODescriptor

Author: pitbulk

lib/onelogin/ruby-saml/idp_metadata_parser.rb

@@ -164,34 +164,32 @@ def entity_descriptor
       end
 
       def entity_descriptor_path
-        path = "//md:EntityDescriptor"
-        entity_id = options[:entity_id]
-        return path unless entity_id
+        path = "//md:EntityDescriptor"  
+        entity_id = options[:entity_id] 
+        return path unless entity_id    
         path << "[@entityID=\"#{entity_id}\"]"
       end
 
       def idpsso_descriptor
-        unless entity_descriptor.nil?
-          return REXML::XPath.first(
-            entity_descriptor,
-            "md:IDPSSODescriptor",
-            namespace
-          )
-        end
+        REXML::XPath.first(
+          document,
+          entity_descriptor_path << "/md:IDPSSODescriptor",
+          namespace
+        )
       end 
 
       # @return [String|nil] IdP Entity ID value if exists
       #
       def idp_entity_id
-        entity_descriptor.attributes["entityID"]
+        idpsso_descriptor.parent.attributes["entityID"]
       end
 
       # @return [String|nil] IdP Name ID Format value if exists
       #
       def idp_name_id_format
         node = REXML::XPath.first(
-          entity_descriptor,
-          "md:IDPSSODescriptor/md:NameIDFormat",
+          idpsso_descriptor,
+          "md:NameIDFormat",
           namespace
         )
         Utils.element_text(node)
@@ -202,8 +200,8 @@ def idp_name_id_format
       #
       def single_signon_service_binding(binding_priority = nil)
         nodes = REXML::XPath.match(
-          entity_descriptor,
-          "md:IDPSSODescriptor/md:SingleSignOnService/@Binding",
+          idpsso_descriptor,
+          "md:SingleSignOnService/@Binding",
           namespace
         )
         if binding_priority
@@ -221,8 +219,8 @@ def single_signon_service_url(options = {})
         binding = single_signon_service_binding(options[:sso_binding])
         unless binding.nil?
           node = REXML::XPath.first(
-            entity_descriptor,
-            "md:IDPSSODescriptor/md:SingleSignOnService[@Binding=\"#{binding}\"]/@Location",
+            idpsso_descriptor,
+            "md:SingleSignOnService[@Binding=\"#{binding}\"]/@Location",
             namespace
           )
           return node.value if node
@@ -234,8 +232,8 @@ def single_signon_service_url(options = {})
       #
       def single_logout_service_binding(binding_priority = nil)
         nodes = REXML::XPath.match(
-          entity_descriptor,
-          "md:IDPSSODescriptor/md:SingleLogoutService/@Binding",
+          idpsso_descriptor,
+          "md:SingleLogoutService/@Binding",
           namespace
         )
         if binding_priority
@@ -253,8 +251,8 @@ def single_logout_service_url(options = {})
         binding = single_logout_service_binding(options[:slo_binding])
         unless binding.nil?
           node = REXML::XPath.first(
-            entity_descriptor,
-            "md:IDPSSODescriptor/md:SingleLogoutService[@Binding=\"#{binding}\"]/@Location",
+            idpsso_descriptor,
+            "md:SingleLogoutService[@Binding=\"#{binding}\"]/@Location",
             namespace
           )
           return node.value if node
@@ -266,14 +264,14 @@ def single_logout_service_url(options = {})
       def certificates
         @certificates ||= begin
           signing_nodes = REXML::XPath.match(
-            entity_descriptor,
-            "md:IDPSSODescriptor/md:KeyDescriptor[not(contains(@use, 'encryption'))]/ds:KeyInfo/ds:X509Data/ds:X509Certificate",
+            idpsso_descriptor,
+            "md:KeyDescriptor[not(contains(@use, 'encryption'))]/ds:KeyInfo/ds:X509Data/ds:X509Certificate",
             namespace
           )
 
           encryption_nodes = REXML::XPath.match(
-            entity_descriptor,
-            "md:IDPSSODescriptor/md:KeyDescriptor[not(contains(@use, 'signing'))]/ds:KeyInfo/ds:X509Data/ds:X509Certificate",
+            idpsso_descriptor,
+            "md:KeyDescriptor[not(contains(@use, 'signing'))]/ds:KeyInfo/ds:X509Data/ds:X509Certificate",
             namespace
           )
 
@@ -315,8 +313,8 @@ def fingerprint(certificate, fingerprint_algorithm = XMLSecurity::Document::SHA1
       #
       def attribute_names
         nodes = REXML::XPath.match(
-          entity_descriptor,
-          "md:IDPSSODescriptor/saml:Attribute/@Name",
+          idpsso_descriptor,
+          "saml:Attribute/@Name",
           namespace
         )
         nodes.map(&:value)

test/metadata/idp_multiple_descriptors.xml

@@ -1,5 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <md:EntitiesDescriptor validUntil="2014-04-17T18:02:33.910Z" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
+  <md:EntityDescriptor entityID="https://biz.example.com/app" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="md:EntityDescriptorType">
+    <md:SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+      <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
+      <md:AssertionConsumerService isDefault="true" index="1" binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" location="https://biz.example.com/app/sso"></md:AssertionConsumerService>
+    </md:SPSSODescriptor>
+  </md:EntityDescriptor>
   <md:EntityDescriptor entityID="https://foo.example.com/access/saml/idp.xml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="md:EntityDescriptorType">
     <md:IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
       <md:KeyDescriptor use="signing">