search

dlindahl / omniauth-cas

A CAS OmniAuth Strategy
MIT License
88 stars 79 forks source link

Allow for namespaces not defined or outside root element in single sign out requests #39

Open draffensperger opened 9 years ago

draffensperger commented 9 years ago

@chuckbjones and @njfranck: our CAS server had a very similar issue to yours that you fix in https://github.com/dlindahl/omniauth-cas/pull/33

Our server's specific problem was that it didn't define the xmlns:saml namespace at all and so its request XML looked something like this:

<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="abcd" Version="2.0" IssueInstant="2015-09-17T15:12:20Z">
 <saml:NameID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">@NOT_USED@</saml:NameID>
 <samlp:SessionIndex>ST-foo-bar</samlp:SessionIndex>
</samlp:LogoutRequest>

This pull request integrates the fix for namespaces not defined on the root node as well as those not defined at all. I kept the inject_params method mostly similar (though slightly tidied) so that the specs would pass, and it seems that update_param actually has slightly different semantics as it leaves env unchanged.

The approach in add_namespaces of adding namespaces then re-parsing the XML seems to be what's needed, as per this Stack Overflow thread.

@dlindahl could you take a look at this?

dlindahl commented 8 years ago

I no longer have access to a CAS server and therefore am no longer fit to maintain this project.

If you would like to volunteer to be a maintainer of this project, please let me know by opening an Issue.

jgribonvald commented 3 years ago

This PR can't be merged ? Else wich project to use ? Thanks