Skip to content

Commit e92177f

Browse files
johnnyshieldsjohnnyshields
committed
Metadata spec
1 parent 1d89633 commit e92177f

1 file changed

Lines changed: 63 additions & 60 deletions

File tree

‎test/metadata_test.rb‎

Lines changed: 63 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -328,82 +328,85 @@ class MetadataTest < Minitest::Test
328328
end
329329
end
330330

331-
describe "when the settings indicate to sign (embedded) metadata" do
332-
before do
333-
settings.security[:metadata_signed] = true
334-
settings.certificate = ruby_saml_cert_text
335-
settings.private_key = ruby_saml_key_text
336-
end
337-
338-
it "creates a signed metadata" do
339-
assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>]m, xml_text
340-
assert_match %r[<ds:SignatureMethod Algorithm='http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'/>], xml_text
341-
assert_match %r[<ds:DigestMethod Algorithm='http://www.w3.org/2001/04/xmlenc#sha256'/>], xml_text
342-
343-
signed_metadata = RubySaml::XML::SignedDocument.new(xml_text)
344-
assert signed_metadata.validate_document(ruby_saml_cert_fingerprint, false)
345-
346-
assert validate_xml!(xml_text, "saml-schema-metadata-2.0.xsd")
347-
end
348-
349-
describe "when digest and signature methods are specified" do
331+
with_each_key_algorithm do |algorithm|
332+
describe "when the settings indicate to sign (embedded) metadata" do
350333
before do
351-
settings.security[:signature_method] = RubySaml::XML::Document::RSA_SHA256
352-
settings.security[:digest_method] = RubySaml::XML::Document::SHA512
334+
settings.security[:metadata_signed] = true
335+
cert, pkey = CertificateHelper.generate_pair(algorithm)
336+
@fingerprint = OpenSSL::Digest.new('SHA256', cert.to_der).to_s
337+
settings.certificate, settings.private_key = [cert, pkey].map(&:to_pem)
353338
end
354339

355-
it "creates a signed metadata with specified digest and signature methods" do
340+
it "creates a signed metadata" do
356341
assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>]m, xml_text
357-
assert_match %r[<ds:SignatureMethod Algorithm='http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'/>], xml_text
358-
assert_match %r[<ds:DigestMethod Algorithm='http://www.w3.org/2001/04/xmlenc#sha512'/>], xml_text
342+
assert_match signature_method_matcher(algorithm), xml_text
343+
assert_match %r[<ds:DigestMethod Algorithm='http://www\.w3\.org/2001/04/xmlenc#sha256'/>], xml_text
359344

360345
signed_metadata = RubySaml::XML::SignedDocument.new(xml_text)
361-
assert signed_metadata.validate_document(ruby_saml_cert_fingerprint, false)
346+
assert signed_metadata.validate_document(@fingerprint, false)
362347

363348
assert validate_xml!(xml_text, "saml-schema-metadata-2.0.xsd")
364349
end
365-
end
366350

367-
describe "when custom metadata elements have been inserted" do
368-
let(:xml_text) { subclass.new.generate(settings, false) }
369-
let(:subclass) do
370-
Class.new(RubySaml::Metadata) do
371-
def add_extras(root, _settings)
372-
idp = REXML::Element.new("md:IDPSSODescriptor")
373-
idp.attributes['protocolSupportEnumeration'] = 'urn:oasis:names:tc:SAML:2.0:protocol'
374-
375-
nid = REXML::Element.new("md:NameIDFormat")
376-
nid.text = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
377-
idp.add_element(nid)
378-
379-
sso = REXML::Element.new("md:SingleSignOnService")
380-
sso.attributes['Binding'] = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
381-
sso.attributes['Location'] = 'https://foobar.com/sso'
382-
idp.add_element(sso)
383-
root.insert_before(root.children[0], idp)
384-
385-
org = REXML::Element.new("md:Organization")
386-
org.add_element("md:OrganizationName", 'xml:lang' => "en-US").text = 'ACME Inc.'
387-
org.add_element("md:OrganizationDisplayName", 'xml:lang' => "en-US").text = 'ACME'
388-
org.add_element("md:OrganizationURL", 'xml:lang' => "en-US").text = 'https://www.acme.com'
389-
root.insert_after(root.children[3], org)
390-
end
351+
describe "when digest and signature methods are specified" do
352+
before do
353+
settings.security[:signature_method] = RubySaml::XML::Document::RSA_SHA256
354+
settings.security[:digest_method] = RubySaml::XML::Document::SHA512
355+
end
356+
357+
it "creates a signed metadata with specified digest and signature methods" do
358+
assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>]m, xml_text
359+
assert_match signature_method_matcher(algorithm), xml_text
360+
assert_match %r[<ds:DigestMethod Algorithm='http://www\.w3\.org/2001/04/xmlenc#sha512'/>], xml_text
361+
362+
signed_metadata = RubySaml::XML::SignedDocument.new(xml_text)
363+
assert signed_metadata.validate_document(@fingerprint, false)
364+
365+
assert validate_xml!(xml_text, "saml-schema-metadata-2.0.xsd")
391366
end
392367
end
393368

394-
it "inserts signature as the first child of root element" do
395-
first_child = xml_doc.root.children[0]
396-
assert_equal first_child.prefix, 'ds'
397-
assert_equal first_child.name, 'Signature'
369+
describe "when custom metadata elements have been inserted" do
370+
let(:xml_text) { subclass.new.generate(settings, false) }
371+
let(:subclass) do
372+
Class.new(RubySaml::Metadata) do
373+
def add_extras(root, _settings)
374+
idp = REXML::Element.new("md:IDPSSODescriptor")
375+
idp.attributes['protocolSupportEnumeration'] = 'urn:oasis:names:tc:SAML:2.0:protocol'
376+
377+
nid = REXML::Element.new("md:NameIDFormat")
378+
nid.text = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
379+
idp.add_element(nid)
380+
381+
sso = REXML::Element.new("md:SingleSignOnService")
382+
sso.attributes['Binding'] = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
383+
sso.attributes['Location'] = 'https://foobar.com/sso'
384+
idp.add_element(sso)
385+
root.insert_before(root.children[0], idp)
386+
387+
org = REXML::Element.new("md:Organization")
388+
org.add_element("md:OrganizationName", 'xml:lang' => "en-US").text = 'ACME Inc.'
389+
org.add_element("md:OrganizationDisplayName", 'xml:lang' => "en-US").text = 'ACME'
390+
org.add_element("md:OrganizationURL", 'xml:lang' => "en-US").text = 'https://www.acme.com'
391+
root.insert_after(root.children[3], org)
392+
end
393+
end
394+
end
398395

399-
assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>]m, xml_text
400-
assert_match %r[<ds:SignatureMethod Algorithm='http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'/>], xml_text
401-
assert_match %r[<ds:DigestMethod Algorithm='http://www.w3.org/2001/04/xmlenc#sha256'/>], xml_text
396+
it "inserts signature as the first child of root element" do
397+
first_child = xml_doc.root.children[0]
398+
assert_equal first_child.prefix, 'ds'
399+
assert_equal first_child.name, 'Signature'
402400

403-
signed_metadata = RubySaml::XML::SignedDocument.new(xml_text)
404-
assert signed_metadata.validate_document(ruby_saml_cert_fingerprint, false)
401+
assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>]m, xml_text
402+
assert_match signature_method_matcher(algorithm), xml_text
403+
assert_match %r[<ds:DigestMethod Algorithm='http://www\.w3\.org/2001/04/xmlenc#sha256'/>], xml_text
405404

406-
assert validate_xml!(xml_text, "saml-schema-metadata-2.0.xsd")
405+
signed_metadata = RubySaml::XML::SignedDocument.new(xml_text)
406+
assert signed_metadata.validate_document(@fingerprint, false)
407+
408+
assert validate_xml!(xml_text, "saml-schema-metadata-2.0.xsd")
409+
end
407410
end
408411
end
409412
end

0 commit comments

Comments
 (0)