Ruby SAML Identity Provider (IdP)

Installation and Usage

gem 'saml_idp'

Not using rails?

Using rails?

get'/saml/auth'=>'saml_idp#new'get'/saml/metadata'=>'saml_idp#show'post'/saml/auth'=>'saml_idp#create'match'/saml/logout'=>'saml_idp#logout',via:[:get,:post,:delete]

classSamlIdpControllerincludeSamlIdp::IdpControllerdefidp_authenticate(email,password)# not using params intentionallyuser=User.by_email(email).firstuser &&user.valid_password?(password) ?user :nilendprivate:idp_authenticatedefidp_make_saml_response(found_user)# not using params intentionally# NOTE encryption is optionalencode_responsefound_user,encryption:{cert:saml_request.service_provider.cert,block_encryption:'aes256-cbc',key_transport:'rsa-oaep-mgf1p'}endprivate:idp_make_saml_responsedefidp_logoutuser=User.by_email(saml_request.name_id)user.logoutendprivate:idp_logoutend

Configuration

SamlIdp.configuredo |config|base="http://example.com"config.x509_certificate=<<-CERT-----BEGIN CERTIFICATE-----CERTIFICATE DATA-----END CERTIFICATE-----CERTconfig.secret_key=<<-CERT-----BEGIN RSA PRIVATE KEY-----KEY DATA-----END RSA PRIVATE KEY-----CERT# config.password = "secret_key_password"# config.algorithm = :sha256# config.organization_name = "Your Organization"# config.organization_url = "http://example.com"# config.base_saml_location = "#{base}/saml"# config.reference_id_generator                   # Default: -> { UUID.generate }# config.attribute_service_location = "#{base}/saml/attributes"# config.single_service_post_location = "#{base}/saml/auth"# Principal (e.g. User) is passed in when you `encode_response`## config.name_id.formats # =>#   {                         # All 2.0#     email_address: -> (principal) { principal.email_address },#     transient: -> (principal) { principal.id },#     persistent: -> (p) { p.id },#   }#   OR##   {#     "1.1" => {#       email_address: -> (principal) { principal.email_address },#     },#     "2.0" => {#       transient: -> (principal) { principal.email_address },#       persistent: -> (p) { p.id },#     },#   }# If Principal responds to a method called `asserted_attributes`# the return value of that method will be used in lieu of the# attributes defined here in the global space. This allows for# per-user attribute definitions.### EXAMPLE **# class User#   def asserted_attributes#     {#       phone: { getter: :phone },#       email: {#         getter: :email,#         name_format: Saml::XML::Namespaces::Formats::NameId::EMAIL_ADDRESS,#         name_id_format: Saml::XML::Namespaces::Formats::NameId::EMAIL_ADDRESS#       }#     }#   end# end## If you have a method called `asserted_attributes` in your Principal class,# there is no need to define it here in the config.# config.attributes # =>#   {#     <friendly_name> => {                                                  # required (ex "eduPersonAffiliation")#       "name" => <attrname>                                                # required (ex "urn:oid:1.3.6.1.4.1.5923.1.1.1.1")#       "name_format" => "urn:oasis:names:tc:SAML:2.0:attrname-format:uri", # not required#       "getter" => ->(principal) {                                         # not required#         principal.get_eduPersonAffiliation                                # If no "getter" defined, will try#       }                                                                   # `principal.eduPersonAffiliation`, or no values will#    }                                                                      # be output### EXAMPLE ### config.attributes = {#   GivenName: {#     getter: :first_name,#   },#   SurName: {#     getter: :last_name,#   },# }## EXAMPLE ### config.technical_contact.company = "Example"# config.technical_contact.given_name = "Jonny"# config.technical_contact.sur_name = "Support"# config.technical_contact.telephone = "55555555555"# config.technical_contact.email_address = "example@example.com"service_providers={"some-issuer-url.com/saml"=>{fingerprint:"9E:65:2E:03:06:8D:80:F2:86:C7:6C:77:A1:D9:14:97:0A:4D:F4:4D",metadata_url:"http://some-issuer-url.com/saml/metadata"},}# `identifier` is the entity_id or issuer of the Service Provider,# settings is an IncomingMetadata object which has a to_h method that needs to be persistedconfig.service_provider.metadata_persister=->(identifier,settings){fname=identifier.to_s.gsub(/\/|:/,"_")`mkdir -p#{Rails.root.join("cache/saml/metadata")}`File.openRails.root.join("cache/saml/metadata/#{fname}"),"r+b"do |f|Marshal.dumpsettings.to_h,fend}# `identifier` is the entity_id or issuer of the Service Provider,# `service_provider` is a ServiceProvider object. Based on the `identifier` or the# `service_provider` you should return the settings.to_h from aboveconfig.service_provider.persisted_metadata_getter=->(identifier,service_provider){fname=identifier.to_s.gsub(/\/|:/,"_")`mkdir -p#{Rails.root.join("cache/saml/metadata")}`full_filename=Rails.root.join("cache/saml/metadata/#{fname}")ifFile.file?(full_filename)File.openfull_filename,"rb"do |f|Marshal.loadfendend}# Find ServiceProvider metadata_url and fingerprint based on our settingsconfig.service_provider.finder=->(issuer_or_entity_id)doservice_providers[issuer_or_entity_id]endend

Keys and Secrets

9E:65:2E:03:06:8D:80:F2:86:C7:6C:77:A1:D9:14:97:0A:4D:F4:4D

Service Providers

Author

Copyright