specify namespace while using xpath

[nicolasfranck]

Some cas servers send this XML file:

<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="LR-3-JVgp7bbMHiwILUsnQHunXED3vrfEl57pbpZ" Version="2.0" IssueInstant="2017-06-29T10:56:17Z">
  <saml:NameID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">@NOT_USED@</saml:NameID>
  <samlp:SessionIndex>ST-3-2ORKCpJ9HsnAT0v9df5U-cas01.example.org</samlp:SessionIndex>
</samlp:LogoutRequest>

As you can see, the namespace "saml" is not defined in the root, so Nokogiri does not register it automatically, leading to this error on single sign out request:

Started POST "/users/auth/cas/callback?url=http%3A%2F%2Flocalhost%3A3000%2Fusers%2Fsign_in" for 127.0.0.1 at 2017-06-29 10:56:17 +0200
I, [2017-06-29T10:56:17.300172 #92436]  INFO -- omniauth: (cas) Callback phase initiated.
E, [2017-06-29T10:56:17.308365 #92436] ERROR -- omniauth: (cas) Authentication failure! logout_request: Nokogiri::XML::XPath::SyntaxError, Undefined namespace prefix: //saml:NameID
Processing by Users::OmniauthCallbacksController#failure as HTML
  Parameters: {"logoutRequest"=>"<samlp:LogoutRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" ID=\"LR-3-JVgp7bbMHiwILUsnQHunXED3vrfEl57pbpZ\" Version=\"2.0\" IssueInstant=\"2017-06-29T10:56:17Z\"><saml:NameID xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">@NOT_USED@</saml:NameID><samlp:SessionIndex>ST-3-2ORKCpJ9HsnAT0v9df5U-cas01.example.org</samlp:SessionIndex></samlp:LogoutRequest>", "url"=>"http://localhost:3000/users/sign_in"}
Can't verify CSRF token authenticity
Completed 422 Unprocessable Entity in 2ms (ActiveRecord: 0.0ms)

I added the namespace mapping to every xpath query

[jgribonvald]

@dlindahl This Pull Request fix the error on logout request, this can be merged

@nicolasfranck how are you managing session to be able to apply the SLO ? Do you have an example somewhere ? Are you overreding the sessionID with the CAS ST, or linking it with the CAS ST ? on other way ? Sorry I'm not really familiar of RoR framework practice