search

saml-idp / saml_idp

Ruby SAML Identity Provider, best used with Rails (though not required)
MIT License
259 stars 180 forks source link

Validate Signature for the SP by default #171

Closed cody2094 closed 3 years ago

cody2094 commented 3 years ago

It seems to me as though the SP's fingerprint is not validated by default although the documentation implies that the fingerprint configuration should be required. I discovered this only because I realized I forgot to change a fingerprint for one of my use cases but yet the connection still worked.

Based on the following line of code, it seems as though the fingerprint won't be checked against the SP unless the SP is configured with an attribute of validate_signature that is set to something truthy. Am I right here or am I missing something? Line of code in question: https://github.com/saml-idp/saml_idp/blob/b34adcb4edbc25eecdf4cffe71fb6b852889824f/lib/saml_idp/service_provider.rb#L25

Is this an intended design or something that was missed?

Zogoo commented 3 years ago

Validation of metadata signature is optional. Recently most of web service requires that download SP metadata (when peoples trusting that SP service) and uploading manually to the IdP. Also, most of the scenarios that the metadata doesn't have any certificate in this case if we check it by default it would break those IdP applications.

About your scenario, it might be good if you generate a fingerprint of the public key with following function, then you don't need to change it by manually. This function might help you. lib/saml_idp/fingerprint.rb

Zogoo commented 3 years ago

@cody2094 we haven't heard anything from you. If you have more questions ,please feel free to open this issue.