Class: Saml::Kit::Signature

Inherits:
Object
  • Object
show all
Includes:
Translatable, Validatable
Defined in:
lib/saml/kit/signature.rb

Overview

This class is responsible for validating an xml digital signature in an xml document.

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from Validatable

#each_error

Constructor Details

#initialize(node) ⇒ Signature

Returns a new instance of Signature.



18
19
20
21
 
# File 'lib/saml/kit/signature.rb', line 18

def initialize(node)
  @name = 'Signature'
  @node = node
end

Instance Attribute Details

#name ⇒ Object (readonly)

Returns the value of attribute name.



16
17
18
 
# File 'lib/saml/kit/signature.rb', line 16

def name
  @name
end

Instance Method Details

#canonicalization_method ⇒ Object 



70
71
72
73
 
# File 'lib/saml/kit/signature.rb', line 70

def canonicalization_method
  xpath = './ds:SignedInfo/ds:CanonicalizationMethod/@Algorithm'
  at_xpath(xpath).try(:value)
end

#certificate ⇒ Object

Returns the embedded X509 Certificate

Memoized with a defined? guard rather than ||= because a signature without KeyInfo legitimately has no certificate, and callers depend on the nil.



28
29
30
31
32
33
34
 
# File 'lib/saml/kit/signature.rb', line 28

def certificate
  return @certificate if defined?(@certificate)

  value = at_xpath('./ds:KeyInfo/ds:X509Data/ds:X509Certificate').try(:text)
  @certificate =
    value.nil? ? nil : ::Xml::Kit::Certificate.new(value, use: :signing)
end

#digest_method ⇒ Object 



57
58
59
60
 
# File 'lib/saml/kit/signature.rb', line 57

def digest_method
  xpath = './ds:SignedInfo/ds:Reference/ds:DigestMethod/@Algorithm'
  at_xpath(xpath).try(:value)
end

#digest_value ⇒ Object 



46
47
48
 
# File 'lib/saml/kit/signature.rb', line 46

def digest_value
  at_xpath('./ds:SignedInfo/ds:Reference/ds:DigestValue').try(:text)
end

#expected_digest_value ⇒ Object 



50
51
52
53
54
55
 
# File 'lib/saml/kit/signature.rb', line 50

def expected_digest_value
  digests = dsignature.references.map do |xxx|
    Base64.encode64(xxx.calculate_digest_value).chomp
  end
  digests.count > 1 ? digests : digests[0]
end

#present? ⇒ Boolean

Returns:

  • (Boolean) 


86
87
88
 
# File 'lib/saml/kit/signature.rb', line 86

def present?
  node.present?
end

#signature_method ⇒ Object 



66
67
68
 
# File 'lib/saml/kit/signature.rb', line 66

def signature_method
  at_xpath('./ds:SignedInfo/ds:SignatureMethod/@Algorithm').try(:value)
end

#signature_value ⇒ Object 



62
63
64
 
# File 'lib/saml/kit/signature.rb', line 62

def signature_value
  at_xpath('./ds:SignatureValue').try(:text)
end

#to_h ⇒ Object

Returns the XML Hash.



82
83
84
 
# File 'lib/saml/kit/signature.rb', line 82

def to_h
  @to_h ||= present? ? Hash.from_xml(to_xml)['Signature'] : {}
end

#to_s ⇒ Object 



94
95
96
 
# File 'lib/saml/kit/signature.rb', line 94

def to_s
  node.to_s
end

#to_xml(pretty: nil) ⇒ Object 



90
91
92
 
# File 'lib/saml/kit/signature.rb', line 90

def to_xml(pretty: nil)
  pretty ? node.to_xml(indent: 2) : to_s
end

#transforms ⇒ Object 



75
76
77
78
79
 
# File 'lib/saml/kit/signature.rb', line 75

def transforms
  xpath = './ds:SignedInfo/ds:Reference/ds:Transforms/ds:Transform'
  node.search("#{xpath}/@Algorithm", Saml::Kit::Document::NAMESPACES)
    .try(:map, &:value)
end

#trusted?(metadata) ⇒ Boolean

Returns true when the fingerprint of the certificate matches one of the certificates registered in the metadata.

Returns:

  • (Boolean) 


38
39
40
41
42
43
44
 
# File 'lib/saml/kit/signature.rb', line 38

def trusted?(metadata)
  return false if metadata.nil?
  return false if certificate.nil?
  return false unless reference.bound?

  metadata.matches?(certificate.fingerprint, use: :signing).present?
end