Skip to content

Commit aba5bf4

Browse files
waterkipwaterkip
authored
Merge pull request #164 from waterkip/GL-zs-tweaks-digid-testing
Fix artifact response status codes from assertions
2 parents 52870d2 + 8e993b2 commit aba5bf4

File tree

6 files changed

+100
-15
lines changed

6 files changed

+100
-15
lines changed

‎Makefile.PL‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ my %WriteMakefileArgs = (
7777
"URI::URL" => 0,
7878
"XML::LibXML::XPathContext" => 0
7979
},
80-
"VERSION" => "0.67",
80+
"VERSION" => "0.68",
8181
"test" => {
8282
"TESTS" => "t/*.t t/author/*.t"
8383
}

‎README‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ NAME
22
Net::SAML2 - SAML2 bindings and protocol implementation
33

44
VERSION
5-
version 0.67
5+
version 0.68
66

77
SYNOPSIS
88
See TUTORIAL.md for implementation documentation and

‎lib/Net/SAML2/Protocol/Assertion.pm‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ use XML::Enc;
1414
use XML::LibXML;
1515
use List::Util qw(first);
1616
use URN::OASIS::SAML2 qw(STATUS_SUCCESS);
17+
use Carp qw(croak);
1718

1819
with 'Net::SAML2::Role::ProtocolMessage';
1920

@@ -177,8 +178,9 @@ sub new_from_xml {
177178
$nameid = $global->get_node(1);
178179
}
179180

180-
my $nodeset = $xpath->findnodes('/samlp:Response/samlp:Status/samlp:StatusCode');
181-
croak("Unable to parse status from assertion") unless ($nodeset->size);
181+
my $nodeset = $xpath->findnodes('/samlp:Response/samlp:Status/samlp:StatusCode|/samlp:ArtifactResponse/samlp:Status/samlp:StatusCode');
182+
183+
croak("Unable to parse status from assertion") unless $nodeset->size;
182184

183185
my $status_node = $nodeset->get_node(1);
184186
my $status = $status_node->getAttribute('Value');

‎lib/Net/SAML2/SP.pm‎

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -630,22 +630,15 @@ sub _generate_key_descriptors {
630630
&& !$self->want_assertions_signed
631631
&& !$self->sign_metadata;
632632

633+
my $key = $use eq 'signing' ? $self->_cert_text : $self->_encryption_key_text;
634+
633635
return $x->KeyDescriptor(
634636
$md,
635637
{ use => $use },
636638
$x->KeyInfo(
637639
$ds,
638-
$x->X509Data(
639-
$ds,
640-
$x->X509Certificate(
641-
$ds,
642-
$use eq 'signing' ? $self->_cert_text : $self->_encryption_key_text,
643-
)
644-
),
645-
$x->KeyName(
646-
$ds,
647-
Digest::MD5::md5_hex($use eq 'signing' ? $self->_cert_text : $self->_encryption_key_text)
648-
),
640+
$x->X509Data($ds, $x->X509Certificate($ds, $key)),
641+
$x->KeyName($ds, Digest::MD5::md5_hex($key)),
649642
),
650643
);
651644
}

‎t/03-assertions.t‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,4 +179,11 @@ is(
179179
"... and the sub status yay"
180180
);
181181

182+
183+
{
184+
my $xml = path('t/data/digid-live.xml')->slurp;
185+
my $assertion = Net::SAML2::Protocol::Assertion->new_from_xml(xml => $xml);
186+
isa_ok($assertion, 'Net::SAML2::Protocol::Assertion');
187+
}
188+
182189
done_testing;

‎t/data/digid-live.xml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
<?xml version="1.0"?>
2+
<samlp:ArtifactResponse xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" ID="_7667e303c2457eae23023e10a9f8d22c47eed001" Version="2.0" IssueInstant="2023-03-29T14:45:41Z" InResponseTo="NETSAML2_76120c74b8b337c66bf34382392f85563099f5415e9638ffa6703d475dc49c35">
3+
<saml:Issuer>https://some.idp.tld/saml/idp/metadata</saml:Issuer>
4+
<ds:Signature>
5+
<ds:SignedInfo>
6+
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
7+
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
8+
<ds:Reference URI="#_7667e303c2457eae23023e10a9f8d22c47eed001">
9+
<ds:Transforms>
10+
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
11+
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
12+
<ec:InclusiveNamespaces PrefixList="ds saml samlp xs"/>
13+
</ds:Transform>
14+
</ds:Transforms>
15+
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
16+
<ds:DigestValue></ds:DigestValue>
17+
</ds:Reference>
18+
</ds:SignedInfo>
19+
<ds:SignatureValue>
20+
</ds:SignatureValue>
21+
<ds:KeyInfo>
22+
<ds:KeyName></ds:KeyName>
23+
<ds:X509Data>
24+
<ds:X509Certificate>
25+
</ds:X509Certificate>
26+
</ds:X509Data>
27+
</ds:KeyInfo>
28+
</ds:Signature>
29+
<samlp:Status>
30+
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
31+
</samlp:Status>
32+
<samlp:Response ID="_824e2af075f407300cc16718bef3cff2af56860e" Version="2.0" IssueInstant="2023-03-29T14:45:41Z" InResponseTo="NETSAML2_d30c7b67c92a1aa880ddd72696fc2a69d8b04899bdcefb55d01ffd4a1495f2d2">
33+
<saml:Issuer>https://some.idp.tld/saml/idp/metadata</saml:Issuer>
34+
<samlp:Status>
35+
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
36+
</samlp:Status>
37+
<saml:Assertion ID="_be45c8d0431bc0b79600b48e6b21cb4f4d3b39a3" Version="2.0" IssueInstant="2023-03-29T14:45:41Z">
38+
<saml:Issuer>https://some.idp.tld/saml/idp/metadata</saml:Issuer>
39+
<ds:Signature>
40+
<ds:SignedInfo>
41+
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
42+
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
43+
<ds:Reference URI="#_be45c8d0431bc0b79600b48e6b21cb4f4d3b39a3">
44+
<ds:Transforms>
45+
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
46+
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
47+
<ec:InclusiveNamespaces PrefixList="ds saml samlp xs"/>
48+
</ds:Transform>
49+
</ds:Transforms>
50+
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
51+
<ds:DigestValue></ds:DigestValue>
52+
</ds:Reference>
53+
</ds:SignedInfo>
54+
<ds:SignatureValue>
55+
</ds:SignatureValue>
56+
<ds:KeyInfo>
57+
<ds:KeyName></ds:KeyName>
58+
<ds:X509Data>
59+
<ds:X509Certificate>
60+
</ds:X509Certificate>
61+
</ds:X509Data>
62+
</ds:KeyInfo>
63+
</ds:Signature>
64+
<saml:Subject>
65+
<saml:NameID>s00000000:900060025</saml:NameID>
66+
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
67+
<saml:SubjectConfirmationData NotOnOrAfter="2023-03-29T14:47:41Z" Recipient="https://some.sp.tld/auth/saml/consumer-post" InResponseTo="NETSAML2_d30c7b67c92a1aa880ddd72696fc2a69d8b04899bdcefb55d01ffd4a1495f2d2"/>
68+
</saml:SubjectConfirmation>
69+
</saml:Subject>
70+
<saml:Conditions NotBefore="2023-03-29T14:43:41Z" NotOnOrAfter="2023-03-29T14:47:41Z">
71+
<saml:AudienceRestriction>
72+
<saml:Audience>https://some.sp.tld/auth/saml</saml:Audience>
73+
</saml:AudienceRestriction>
74+
</saml:Conditions>
75+
<saml:AuthnStatement AuthnInstant="2023-03-29T14:45:41Z" SessionIndex="12a5de5dbc2eed357dd31d2ab321dcb823442157">
76+
<saml:SubjectLocality Address="186.189.151.69"/>
77+
<saml:AuthnContext>
78+
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
79+
</saml:AuthnContext>
80+
</saml:AuthnStatement>
81+
</saml:Assertion>
82+
</samlp:Response>
83+
</samlp:ArtifactResponse>

0 commit comments

Comments
 (0)