Skip to content

Commit 9d9ac1a

Browse files
timleggetimlegge
authored
Merge pull request #120 from waterkip/unsigned-authnrequest
Add support to SP for SSO redirect binding without signed auth request
2 parents 17772d7 + 1a5796b commit 9d9ac1a

File tree

3 files changed

+123
-49
lines changed

3 files changed

+123
-49
lines changed

‎lib/Net/SAML2/Binding/Redirect.pm‎

Lines changed: 73 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -154,78 +154,84 @@ around BUILDARGS => sub {
154154
return $self->$orig(%params);
155155
};
156156

157-
=head2 sign( $request, $relaystate )
157+
=head2 get_redirect_uri($authn_request, $relaystate)
158158
159-
Signs the given request, and returns the URL to which the user's
160-
browser should be redirected.
159+
Get the redirect URI for a given request, and returns the URL to which the
160+
user's browser should be redirected.
161161
162162
Accepts an optional RelayState parameter, a string which will be
163163
returned to the requestor when the user returns from the
164164
authentication process with the IdP.
165165
166+
The request is signed unless the the object has been instantiated with
167+
C<<insecure => 1>>.
168+
166169
=cut
167170

168-
sub sign {
169-
my ($self, $request, $relaystate) = @_;
171+
sub get_redirect_uri {
172+
my $self = shift;
173+
my $request = shift;
170174

171-
my $input = "$request";
175+
if (!defined $request) {
176+
croak("Unable to create redirect URI without a request");
177+
}
178+
179+
my $relaystate = shift;
180+
181+
my $input = "$request";
172182
my $output = '';
173183

174184
rawdeflate \$input => \$output;
175185
my $req = encode_base64($output, '');
176186

177-
my $u = URI->new($self->url);
178-
$u->query_param($self->param, $req);
179-
$u->query_param('RelayState', $relaystate) if defined $relaystate;
187+
my $uri = URI->new($self->url);
188+
$uri->query_param($self->param, $req);
189+
$uri->query_param('RelayState', $relaystate) if defined $relaystate;
180190

181-
return $u->as_string if $self->insecure;
191+
return $uri->as_string if $self->insecure;
192+
return $self->_sign_redirect_uri($uri);
193+
}
194+
195+
sub _sign_redirect_uri {
196+
my $self = shift;
197+
my $uri = shift;
182198

183199
my $key_string = read_text($self->key);
184200
my $rsa_priv = Crypt::OpenSSL::RSA->new_private_key($key_string);
185201

186202
my $method = "use_" . $self->sig_hash . "_hash";
187203
$rsa_priv->$method;
188204

189-
$u->query_param('SigAlg',
205+
$uri->query_param('SigAlg',
190206
$self->sig_hash eq 'sha1'
191207
? 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'
192208
: 'http://www.w3.org/2001/04/xmldsig-more#rsa-' . $self->sig_hash);
193209

194-
my $to_sign = $u->query;
210+
my $to_sign = $uri->query;
195211
my $sig = encode_base64($rsa_priv->sign($to_sign), '');
196-
$u->query_param('Signature', $sig);
197-
198-
return $u->as_string;
212+
$uri->query_param('Signature', $sig);
213+
return $uri->as_string;
199214
}
200215

201-
sub _verify {
202-
my ($self, $sigalg, $signed, $sig) = @_;
216+
=head2 sign( $request, $relaystate )
203217
204-
foreach my $crt (@{$self->cert}) {
205-
my $cert = Crypt::OpenSSL::X509->new_from_string($crt);
206-
my $rsa_pub = Crypt::OpenSSL::RSA->new_public_key($cert->pubkey);
218+
Signs the given request, and returns the URL to which the user's
219+
browser should be redirected.
207220
208-
if ($sigalg eq 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256') {
209-
$rsa_pub->use_sha256_hash;
210-
} elsif ($sigalg eq 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha224') {
211-
$rsa_pub->use_sha224_hash;
212-
} elsif ($sigalg eq 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384') {
213-
$rsa_pub->use_sha384_hash;
214-
} elsif ($sigalg eq 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512') {
215-
$rsa_pub->use_sha512_hash;
216-
} elsif ($sigalg eq 'http://www.w3.org/2000/09/xmldsig#rsa-sha1') {
217-
$rsa_pub->use_sha1_hash;
218-
}
219-
else {
220-
warn "Unsupported Signature Algorithim: $sigalg, defaulting to sha256" if $self->debug;
221-
}
221+
Accepts an optional RelayState parameter, a string which will be
222+
returned to the requestor when the user returns from the
223+
authentication process with the IdP.
222224
223-
return 1 if $rsa_pub->verify($signed, $sig);
225+
=cut
224226

225-
warn "Unable to verify with " . $cert->subject if $self->debug;
227+
sub sign {
228+
my $self = shift;
229+
230+
if ($self->insecure) {
231+
croak("Cannot sign an insecure request!");
226232
}
227233

228-
croak("Unable to verify the XML signature");
234+
return $self->get_redirect_uri(@_);
229235
}
230236

231237
=head2 verify( $query_string )
@@ -272,4 +278,34 @@ sub verify {
272278
return ($request, $relaystate);
273279
}
274280

281+
sub _verify {
282+
my ($self, $sigalg, $signed, $sig) = @_;
283+
284+
foreach my $crt (@{$self->cert}) {
285+
my $cert = Crypt::OpenSSL::X509->new_from_string($crt);
286+
my $rsa_pub = Crypt::OpenSSL::RSA->new_public_key($cert->pubkey);
287+
288+
if ($sigalg eq 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256') {
289+
$rsa_pub->use_sha256_hash;
290+
} elsif ($sigalg eq 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha224') {
291+
$rsa_pub->use_sha224_hash;
292+
} elsif ($sigalg eq 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384') {
293+
$rsa_pub->use_sha384_hash;
294+
} elsif ($sigalg eq 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512') {
295+
$rsa_pub->use_sha512_hash;
296+
} elsif ($sigalg eq 'http://www.w3.org/2000/09/xmldsig#rsa-sha1') {
297+
$rsa_pub->use_sha1_hash;
298+
}
299+
else {
300+
warn "Unsupported Signature Algorithim: $sigalg, defaulting to sha256" if $self->debug;
301+
}
302+
303+
return 1 if $rsa_pub->verify($signed, $sig);
304+
305+
warn "Unable to verify with " . $cert->subject if $self->debug;
306+
}
307+
308+
croak("Unable to verify the XML signature");
309+
}
310+
275311
__PACKAGE__->meta->make_immutable;

‎lib/Net/SAML2/SP.pm‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -376,10 +376,20 @@ parameter involved - typically C<SAMLRequest>.
376376
sub sso_redirect_binding {
377377
my ($self, $idp, $param) = @_;
378378

379+
unless ($idp) {
380+
croak("Unable to create a redirect binding without an IDP");
381+
}
382+
383+
$param = 'SAMLRequest' unless $param;
384+
379385
my $redirect = Net::SAML2::Binding::Redirect->new(
380386
url => $idp->sso_url('urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'),
381387
cert => $idp->cert('signing'),
382-
key => $self->key,
388+
$self->authnreq_signed ? (
389+
key => $self->key,
390+
) : (
391+
insecure => 1,
392+
),
383393
param => $param,
384394
);
385395

‎t/06-redirect-binding.t‎

Lines changed: 39 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ use strict;
22
use warnings;
33
use Test::Lib;
44
use Test::Net::SAML2;
5+
use URI;
56

67
use Net::SAML2::IdP;
78
use Net::SAML2::Binding::Redirect;
@@ -44,6 +45,11 @@ like(
4445
"location checks out"
4546
);
4647

48+
my $uri = URI->new($location);
49+
is($uri->host, 'sso.dev.venda.com', "Correct hostname on the location");
50+
my %query = $uri->query_form;
51+
cmp_deeply([sort qw(SAMLRequest RelayState SigAlg Signature)], [sort keys %query], "Signed redirect URI");
52+
4753
my ($request, $relaystate) = $redirect->verify($location);
4854

4955
test_xml_attribute_ok($xp, '/saml2p:AuthnRequest/@ID', qr/^NETSAML2_/,
@@ -95,16 +101,38 @@ throws_ok(
95101
"Need a key for SAMLRequest"
96102
);
97103

98-
lives_ok(
99-
sub {
100-
Net::SAML2::Binding::Redirect->new(
101-
url => 'https://foo.example.com',
102-
insecure => 1,
103-
);
104-
},
105-
"We don't need a key for an insecure SAMLRequest"
106-
);
107-
108-
104+
{
105+
my $binding;
106+
lives_ok(
107+
sub {
108+
$binding = Net::SAML2::Binding::Redirect->new(
109+
url => 'https://foo.example.com',
110+
insecure => 1,
111+
);
112+
},
113+
"We don't need a key for an insecure SAMLRequest"
114+
);
115+
116+
my $uri = $binding->get_redirect_uri($authnreq, 'https://foo.bar.example.com') ;
117+
$uri = URI->new($uri);
118+
my %query = $uri->query_form;
119+
cmp_deeply([sort qw(SAMLRequest RelayState)], [sort keys %query], "Unsigned redirect URI");
120+
121+
my $sp = net_saml2_sp(authnreq_signed => 0);
122+
$binding = $sp->sso_redirect_binding($idp, 'SAMLRequest');
123+
124+
throws_ok(
125+
sub {
126+
$binding->sign($authnreq, 'https://foo.bar.example.com') ;
127+
},
128+
qr#Cannot sign an insecure request#,
129+
"Unable to sign insecure requests"
130+
);
131+
132+
$uri = $binding->get_redirect_uri($authnreq, 'https://foo.bar.example.com') ;
133+
$uri = URI->new($uri);
134+
%query = $uri->query_form;
135+
cmp_deeply([sort qw(SAMLRequest RelayState)], [sort keys %query], "Unsigned redirect URI via SP");
136+
}
109137

110138
done_testing;

0 commit comments

Comments
 (0)