From 6f9ef961bbfb04ac3ae7abc57b535df90386f128 Mon Sep 17 00:00:00 2001 From: Phu Kieu Date: Wed, 22 Mar 2017 16:56:25 -0700 Subject: [PATCH] Use etreeutils.NSSelectOne to select Assertion element --- connector/saml/saml.go | 6 ++++-- connector/saml/saml_test.go | 4 ++++ connector/saml/testdata/oam-ca.pem | 13 +++++++++++++ connector/saml/testdata/oam-resp.xml | 1 + 4 files changed, 22 insertions(+), 2 deletions(-) create mode 100644 connector/saml/testdata/oam-ca.pem create mode 100644 connector/saml/testdata/oam-resp.xml diff --git a/connector/saml/saml.go b/connector/saml/saml.go index 7fad1cc3..8b55252a 100644 --- a/connector/saml/saml.go +++ b/connector/saml/saml.go @@ -17,6 +17,7 @@ import ( "github.com/Sirupsen/logrus" "github.com/beevik/etree" dsig "github.com/russellhaering/goxmldsig" + "github.com/russellhaering/goxmldsig/etreeutils" "github.com/coreos/dex/connector" ) @@ -500,8 +501,9 @@ func verify(validator *dsig.ValidationContext, data []byte) (signed []byte, err verified = true doc.SetRoot(transformedResponse) } - assertion := response.SelectElement("Assertion") - if assertion == nil { + // Ensures xmlns are copied down to the assertion element when they are defined in the root + assertion, err := etreeutils.NSSelectOne(response, "urn:oasis:names:tc:SAML:2.0:assertion", "Assertion") + if err != nil { return nil, fmt.Errorf("response does not contain an Assertion element") } transformedAssertion, err := validator.Validate(assertion) diff --git a/connector/saml/saml_test.go b/connector/saml/saml_test.go index a2bc49b2..cba0fe12 100644 --- a/connector/saml/saml_test.go +++ b/connector/saml/saml_test.go @@ -86,6 +86,10 @@ func TestVerify(t *testing.T) { runVerify(t, "testdata/okta-ca.pem", "testdata/okta-resp.xml", true) } +func TestVerifyUnsignedMessageAndSignedAssertionWithRootXmlNs(t *testing.T) { + runVerify(t, "testdata/oam-ca.pem", "testdata/oam-resp.xml", true) +} + func TestVerifySignedMessageAndUnsignedAssertion(t *testing.T) { runVerify(t, "testdata/idp-cert.pem", "testdata/idp-resp-signed-message.xml", true) } diff --git a/connector/saml/testdata/oam-ca.pem b/connector/saml/testdata/oam-ca.pem new file mode 100644 index 00000000..41645dda --- /dev/null +++ b/connector/saml/testdata/oam-ca.pem @@ -0,0 +1,13 @@ +-----BEGIN CERTIFICATE----- +MIIB/jCCAWegAwIBAgIBCjANBgkqhkiG9w0BAQQFADAkMSIwIAYDVQQDExlkZWFv +YW0tZGV2MDIuanBsLm5hc2EuZ292MB4XDTE2MDYzMDA0NTQxNloXDTI2MDYyODA0 +NTQxNlowJDEiMCAGA1UEAxMZZGVhb2FtLWRldjAyLmpwbC5uYXNhLmdvdjCBnzAN +BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAht1N4lGdwUbl7YRyHwSCrnep6/e2I3+V +eue0pSA/DGn8OuR/udM8UCja5utqlqJdq200ox4b4Mpz0Jg9kMckALtKe+1DgeES +EIx9FpeuBdHlitYQNSbEr30HIG2nmeTOy4Vi5unBO54um3tNazcUTMA0/LJ6KQL8 +LeZSlB/IxwUCAwEAAaNAMD4wDAYDVR0TAQH/BAIwADAPBgNVHQ8BAf8EBQMDB9gA +MB0GA1UdDgQWBBRYo1YjfrNonauLzj6/AsueWFGSszANBgkqhkiG9w0BAQQFAAOB +gQACq7GHK/Zsg0+qC0WWa2ZjmOXE6Dqk/xuooG49QT7ihABs7k9U27Fw3xKF6MkC +7pca1FwT82eZK1N3XKKpZe7Flu1fMKt2o/XSiBkDjWwUcChVnwGsUBe8hJFwFqg7 +olNJn1kaVBJUqZIiXF9kS0d+1H55rStOd0CNXAzp9utr2A== +-----END CERTIFICATE----- diff --git a/connector/saml/testdata/oam-resp.xml b/connector/saml/testdata/oam-resp.xml new file mode 100644 index 00000000..99d14877 --- /dev/null +++ b/connector/saml/testdata/oam-resp.xml @@ -0,0 +1 @@ +https://deaoam-dev02.jpl.nasa.gov:14101/oam/fedhttps://deaoam-dev02.jpl.nasa.gov:14101/oam/fedz1HD/59hv6UOd5+jeG+ihaFWLgI=I99oG5kiOfIgbXYa21z/TOmzftTkFnXe9ObhBNSKit9kAhT93apYROqqXv4Ax96P144Ld7ERX1hgJsytK8LC2874Pk7QrSNm4zvW3x0D4GR4lM06CvJK/EhIur3TrCUJDPigvyP7TJitheCyBejwt0x0lqNP/OzR3tMbAIMRoho=pkieuJSAuthurn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport