diff --git a/lib/onelogin/ruby-saml/response.rb b/lib/onelogin/ruby-saml/response.rb index 663a89ac9..f61d0dc93 100644 --- a/lib/onelogin/ruby-saml/response.rb +++ b/lib/onelogin/ruby-saml/response.rb @@ -524,12 +524,14 @@ def validate_session_expiration(soft = true) end # Validates if exists valid SubjectConfirmation (If the response was initialized with the :allowed_clock_drift option, - # timimg validation are relaxed by the allowed_clock_drift value) + # timimg validation are relaxed by the allowed_clock_drift value. If the response was initialized with the + # :skip_subject_confirmation option, this validation is skipped) # If fails, the error is added to the errors array # @return [Boolean] True if exists a valid SubjectConfirmation, otherwise False if soft=True # @raise [ValidationError] if soft == false and validation fails # def validate_subject_confirmation + return true if options[:skip_subject_confirmation] valid_subject_confirmation = false subject_confirmation_nodes = xpath_from_signed_assertion('/a:Subject/a:SubjectConfirmation') diff --git a/test/response_test.rb b/test/response_test.rb index cab435e57..c96591598 100644 --- a/test/response_test.rb +++ b/test/response_test.rb @@ -616,6 +616,27 @@ class RubySamlTest < Minitest::Test assert !response_invalid_subjectconfirmation_noa.send(:validate_subject_confirmation) assert_includes response_invalid_subjectconfirmation_noa.errors, "A valid SubjectConfirmation was not found on this Response" end + + it "return true when the skip_subject_confirmation option is passed and the subject confirmation is valid" do + opts = {} + opts[:skip_subject_confirmation] = true + response_with_skip = OneLogin::RubySaml::Response.new(response_document_valid_signed, opts) + response_with_skip.settings = settings + response_with_skip.settings.assertion_consumer_service_url = 'recipient' + Time.expects(:now).times(0) # ensures the test isn't run and thus Time.now.utc is never called within the test + assert response_with_skip.send(:validate_subject_confirmation) + assert_empty response_with_skip.errors + end + + it "return true when the skip_subject_confirmation option is passed and the response has an invalid subject confirmation" do + opts = {} + opts[:skip_subject_confirmation] = true + response_with_skip = OneLogin::RubySaml::Response.new(read_invalid_response("invalid_subjectconfirmation_noa.xml.base64"), opts) + response_with_skip.settings = settings + Time.expects(:now).times(0) # ensures the test isn't run and thus Time.now.utc is never called within the test + assert response_with_skip.send(:validate_subject_confirmation) + assert_empty response_with_skip.errors + end end describe "#validate_session_expiration" do