Added support for SP ACS metadata publishing.

Fixed broken tests.

Author: Rudolf Vriend

Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    omniauth-saml (0.9.1)
+    omniauth-saml (0.9.3.dev)
       omniauth (~> 1.0)
       uuid (~> 2.3)
       xmlcanonicalizer (= 0.1.1)
@@ -18,11 +18,11 @@ GEM
     guard-rspec (0.6.0)
       guard (>= 0.10.0)
     hashie (1.2.0)
-    macaddr (1.5.0)
-      systemu (>= 2.4.0)
+    macaddr (1.6.0)
+      systemu (~> 2.2.0)
     method_source (0.7.1)
     multi_json (1.1.0)
-    omniauth (1.0.3)
+    omniauth (1.1.0)
       hashie (~> 1.2)
       rack
     pry (0.9.8.4)
@@ -45,7 +45,7 @@ GEM
       simplecov-html (~> 0.5.3)
     simplecov-html (0.5.3)
     slop (2.4.4)
-    systemu (2.4.2)
+    systemu (2.2.0)
     thor (0.14.6)
     uuid (2.3.5)
       macaddr (~> 1.0)

README.md

@@ -46,10 +46,16 @@ Rails.application.config.middleware.use OmniAuth::Builder do
 end
 ```
 
+## Metadata
+
+To ease the configuration of the SAML SP on IdP side, the required SAML ACS metadata that is needed for
+the IdP configuration can be retrieved from 'http://yourhost.com/auth/saml/metdata'.
+Just give this URL to your IdP administrator and he'll be happy..
+
 ## Options
 
 * `:assertion_consumer_service_url` - The URL at which the SAML assertion should be
-  received. With OmniAuth this is typically `http://example.com/auth/callback`.
+  received. With OmniAuth this is typically `http://example.com/auth/saml/callback`.
   **Required**.
 
 * `:issuer` - The name of your application. Some identity providers might need this

lib/omniauth-saml/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module SAML
-    VERSION = "0.9.2"
+    VERSION = "0.9.3.dev"
   end
 end

lib/omniauth/strategies/saml.rb

@@ -8,6 +8,7 @@ class SAML
       autoload :AuthResponse,     'omniauth/strategies/saml/auth_response'
       autoload :ValidationError,  'omniauth/strategies/saml/validation_error'
       autoload :XMLSecurity,      'omniauth/strategies/saml/xml_security'
+      autoload :MetadataResponse, 'omniauth/strategies/saml/metadata_response'
 
       option :name_identifier_format, "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
 
@@ -24,10 +25,19 @@ def callback_phase
           @name_id  = response.name_id
           @attributes = response.attributes
 
-          return fail!(:invalid_ticket, 'Invalid SAML Ticket') if @name_id.nil? || @name_id.empty? || !response.valid?
+          return fail!(:invalid_ticket) if @name_id.nil? || @name_id.empty? || !response.valid?
           super
         rescue ArgumentError => e
-          fail!(:invalid_ticket, 'Invalid SAML Response')
+          fail!(:invalid_ticket, e)
+        end
+      end
+
+      def other_phase
+        if on_path?("#{request_path}/metadata")
+          response = OmniAuth::Strategies::SAML::MetadataResponse.new
+          Rack::Response.new(response.create(options), 200, { "Content-Type" => "application/xml" })
+        else
+          call_app!
         end
       end
 

lib/omniauth/strategies/saml/metadata_response.rb

@@ -0,0 +1,22 @@
+module OmniAuth
+  module Strategies
+    class SAML
+      class MetadataResponse
+        def create(settings, params = { })
+          response =
+              "<?xml version='1.0'?>\n" +
+                  "<md:EntityDescriptor xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"#{settings[:issuer]}\">\n" +
+                  "<md:SPSSODescriptor protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\">\n"
+          unless settings[:name_identifier_format].nil?
+            response << "<md:NameIDFormat>#{settings[:name_identifier_format]}</md:NameIDFormat>\n"
+          end
+          response <<
+              "<md:AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"#{settings[:assertion_consumer_service_url]}\"/>\n" +
+              "</md:SPSSODescriptor>\n" +
+              "</md:EntityDescriptor>"
+        end
+      end
+    end
+  end
+end
+

spec/omniauth/strategies/saml/metadata_response_spec.rb

@@ -0,0 +1,39 @@
+require 'spec_helper'
+
+describe OmniAuth::Strategies::SAML::MetadataResponse do
+  describe :create do
+    let(:metadata) do
+      described_class.new.create(
+          {
+              :idp_sso_target_url             => 'example.com',
+              :assertion_consumer_service_url => 'http://example.com/auth/saml/callback',
+              :issuer                         => 'This is an issuer',
+              :name_identifier_format         => 'Some Policy'
+          },
+          {
+              :some_param => 'foo',
+              :some_other => 'bar'
+          }
+      )
+    end
+
+    describe "the saml SP metadata" do
+      subject { metadata }
+
+      let(:xml) { REXML::Document.new(metadata) }
+
+      it "should contain the issuer" do
+        REXML::XPath.first(xml, '//md:EntityDescriptor').attributes['entityID'].should == 'This is an issuer'
+      end
+
+      it "should contain the callback url in the settings" do
+        REXML::XPath.first(xml, '//md:AssertionConsumerService').attributes['Location'].should == 'http://example.com/auth/saml/callback'
+      end
+
+      it "should contain the name identifier format" do
+        REXML::XPath.first(xml, '//md:NameIDFormat').text.should == 'Some Policy'
+      end
+
+    end
+  end
+end

spec/omniauth/strategies/saml_spec.rb

@@ -2,7 +2,7 @@
 
 RSpec::Matchers.define :fail_with do |message|
   match do |actual|
-    actual.redirect? && actual.location == "/auth/failure?message=#{message}"
+    actual.redirect? && actual.location == "/auth/failure?message=#{message}&strategy=saml"
   end
 end
 
@@ -130,4 +130,15 @@ def post_xml(xml=:example_response)
       it { should fail_with(:invalid_ticket) }
     end
   end
+
+  describe 'GET /auth/saml/metadata' do
+    before do
+      get '/auth/saml/metadata'
+    end
+
+    it 'should get SP metadata page' do
+      last_response.status.should == 200
+      last_response.header["Content-Type"].should == "application/xml"
+    end
+  end
 end