Allows scheme and domain to match ignoring case#354
Allows scheme and domain to match ignoring case#354tdphillipsjr wants to merge 4 commits intoSAML-Toolkits:masterfrom grnhse:case_insensitive_domain_match
Conversation
tdphillipsjr
commented
Sep 23, 2016
- Per RFC4343, the domain name portion of a URI should be considered case-insensitive.
- Per RFC3986, the scheme portion of a URI should be considered case-insenstive.
- Some SSO providers allow users to enter their own subdomain, which many may do with capital letters (such as in the case of an acronym).
- The destination match should take this in to consideration when matching the destination URI to the ACS URI, if these are proper URIs.
- The match should default to the original case when either of the values are not proper URIs.
|
Hi @pitbulk -- I was hoping you guys could take a look at this PR and decide if it can be incorporated. The domain case-insensitivity issue is blocking us from upgrading this Gem and resolving a CVE. We're going to have to switch to a local fork if this or something similar can't be done in this gem, which is something we'd really like to avoid. Thanks. |
|
@tdphillipsjr Sorry for the delay. May we use that solution to check also the issuers? https://github.com/onelogin/ruby-saml/blob/master/lib/onelogin/ruby-saml/response.rb#L568 Then maybe move the uri_match? and original_uri_match? to the utils.py? |
|
@pitbulk Sure, that sounds good. Is this something you'd like me to add to the PR? |
|
If you can yes, please!. |
- Per RFC4343, the domain name portion of a URI should be considered case-insensitive. - Per RFC3986, the scheme portion of a URI should be considered case-insenstive. - Some SSO providers allow users to enter their own subdomain, which many may do with capital letters (such as in the case of an acronym). - The destination match should take this in to consideration when matching the destination URI to the ACS URI, if these are proper URIs. - The match should default to the original case when either of the values are not proper URIs.
|
Hi @pitbulk -- this is done, as requested. |
|
Hi @pitbulk -- just checking in here. |