search

SAML-Toolkits / ruby-saml

SAML SSO for Ruby
https://developers.onelogin.com/v1.0/page/saml-toolkit-for-ruby-on-rails
MIT License
898 stars 561 forks source link

Improve check_idp_cert_expiration behavior #674

Open johnnyshields opened 7 months ago

johnnyshields commented 7 months ago

The check_idp_cert_expiry should improved as follows:

  1. If true and there are multiple IdP certs, we should skip expired IdP certs and use the first one which is not expired. We should only raise the "IdP cert expired" error if there are no non-expired certs.
  2. If true, we should check the e not_before condition (not yet ready). Currently we only check the not_after condition (expired).

The corresponding changes for SP certs are done here: https://github.com/SAML-Toolkits/ruby-saml/pull/673