Validate the SAML response

* now requires ruby 1.9.2+ * use xmlcanonicalizer gem
skahlert · Mar 29, 2012 · 0f5ec78 · 0f5ec78
1 parent 0ef28b1
commit 0f5ec78
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/lib/omniauth/strategies/saml.rb b/lib/omniauth/strategies/saml.rb
@@ -20,8 +20,11 @@ def callback_phase
         begin
           response = OmniAuth::Strategies::SAML::AuthResponse.new(request.params['SAMLResponse'])
           response.settings = options
+          response.validate!
+
           @name_id  = response.name_id
           @attributes = response.attributes
+
           return fail!(:invalid_ticket, 'Invalid SAML Ticket') if @name_id.nil? || @name_id.empty?
           super
         rescue ArgumentError => e

diff --git a/omniauth-saml.gemspec b/omniauth-saml.gemspec
@@ -11,7 +11,7 @@ Gem::Specification.new do |gem|
   gem.homepage      = "https://github.com/PracticallyGreen/omniauth-saml"
 
   gem.add_runtime_dependency 'omniauth', '~> 1.0'
-  gem.add_runtime_dependency 'XMLCanonicalizer', '~> 1.0.1'
+  gem.add_runtime_dependency 'xmlcanonicalizer'
   gem.add_runtime_dependency 'uuid', '~> 2.3'
 
   gem.files         = ['README.md'] + Dir['lib/**/*.rb']