Class: Spid::Saml2::ResponseValidator

Inherits:
Object
  • Object
show all
Defined in:
lib/spid/saml2/response_validator.rb

Overview

rubocop:disable Metrics/ClassLength

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(response:, settings:, request_uuid:) ⇒ ResponseValidator

Returns a new instance of ResponseValidator.



14
15
16
17
18
19
 
# File 'lib/spid/saml2/response_validator.rb', line 14

def initialize(response:, settings:, request_uuid:)
  @response = response
  @settings = settings
  @request_uuid = request_uuid
  @errors = {}
end

Instance Attribute Details

#errors ⇒ Object (readonly)

Returns the value of attribute errors.



11
12
13
 
# File 'lib/spid/saml2/response_validator.rb', line 11

def errors
  @errors
end

#request_uuid ⇒ Object (readonly)

Returns the value of attribute request_uuid.



12
13
14
 
# File 'lib/spid/saml2/response_validator.rb', line 12

def request_uuid
  @request_uuid
end

#response ⇒ Object (readonly)

:nodoc:



9
10
11
 
# File 'lib/spid/saml2/response_validator.rb', line 9

def response
  @response
end

#settings ⇒ Object (readonly)

Returns the value of attribute settings.



10
11
12
 
# File 'lib/spid/saml2/response_validator.rb', line 10

def settings
  @settings
end

Instance Method Details

#assertion_issuer ⇒ Object 



59
60
61
62
63
64
65
66
67
68
 
# File 'lib/spid/saml2/response_validator.rb', line 59

def assertion_issuer
  return true if response.assertion_issuer == settings.idp_entity_id

  @errors["assertion_issuer"] =
    begin
      "Response Assertion Issuer is '#{response.assertion_issuer}'" \
      " but was expected '#{settings.idp_entity_id}'"
    end
  false
end

#audience ⇒ Object 



104
105
106
107
108
109
110
111
112
 
# File 'lib/spid/saml2/response_validator.rb', line 104

def audience
  return true if response.audience == settings.sp_entity_id
  @errors["audience"] =
    begin
      "Response Audience is '#{response.audience}'" \
      " but was expected '#{settings.sp_entity_id}'"
    end
  false
end

#call ⇒ Object 



21
22
23
24
25
26
27
 
# File 'lib/spid/saml2/response_validator.rb', line 21

def call
  return false unless success?
  [
    matches_request_uuid, issuer, assertion_issuer, certificate,
    destination, conditions, audience, signature
  ].all?
end

#certificate ⇒ Object 



70
71
72
73
74
75
76
77
 
# File 'lib/spid/saml2/response_validator.rb', line 70

def certificate
  if response.certificate.to_der == settings.idp_certificate.to_der
    return true
  end

  @errors["certificate"] = "Certificates mismatch"
  false
end

#conditions ⇒ Object 



91
92
93
94
95
96
97
98
99
100
101
102
 
# File 'lib/spid/saml2/response_validator.rb', line 91

def conditions
  time = Time.now.utc.iso8601

  if response.conditions_not_before <= time &&
     response.conditions_not_on_or_after > time

    return true
  end

  @errors["conditions"] = "Response was out of time"
  false
end

#destination ⇒ Object 



79
80
81
82
83
84
85
86
87
88
89
 
# File 'lib/spid/saml2/response_validator.rb', line 79

def destination
  return true if response.destination == settings.sp_acs_url
  return true if response.destination == settings.sp_entity_id

  @errors["destination"] =
    begin
      "Response Destination is '#{response.destination}'" \
      " but was expected '#{settings.sp_acs_url}'"
    end
  false
end

#issuer ⇒ Object 



48
49
50
51
52
53
54
55
56
57
 
# File 'lib/spid/saml2/response_validator.rb', line 48

def issuer
  return true if response.issuer == settings.idp_entity_id

  @errors["issuer"] =
    begin
      "Response Issuer is '#{response.issuer}'" \
      " but was expected '#{settings.idp_entity_id}'"
    end
  false
end

#matches_request_uuid ⇒ Object 



29
30
31
32
33
34
35
 
# File 'lib/spid/saml2/response_validator.rb', line 29

def matches_request_uuid
  return true if response.in_response_to == request_uuid

  @errors["request_uuid_mismatch"] =
    "Request uuid not belongs to current session"
  false
end

#signature ⇒ Object 



114
115
116
117
118
119
120
 
# File 'lib/spid/saml2/response_validator.rb', line 114

def signature
  signed_document = Xmldsig::SignedDocument.new(response.saml_message)
  return true if signed_document.validate(response.certificate)

  @errors["signature"] = "Signature mismatch"
  false
end

#subject_in_response_to ⇒ Object 



126
127
128
 
# File 'lib/spid/saml2/response_validator.rb', line 126

def subject_in_response_to
  return true if response.subject_in_response_to == request_uuid
end

#subject_not_on_or_after ⇒ Object 



130
131
132
133
134
 
# File 'lib/spid/saml2/response_validator.rb', line 130

def subject_not_on_or_after
  time = Time.now.utc.iso8601

  return true if response.subject_not_on_or_after > time
end

#subject_recipient ⇒ Object 



122
123
124
 
# File 'lib/spid/saml2/response_validator.rb', line 122

def subject_recipient
  return true if response.subject_recipient == settings.sp_acs_url
end

#success? ⇒ Boolean

Returns:

  • (Boolean) 


37
38
39
40
41
42
43
44
45
46
 
# File 'lib/spid/saml2/response_validator.rb', line 37

def success?
  return true if response.status_code == Spid::SUCCESS_CODE

  @errors["authentication"] = {
    "status_code" => response.status_code,
    "status_message" => response.status_message,
    "status_detail" => response.status_detail
  }
  false
end