class XMLSecurity::SignedDocument

Overview

A received document whose signatures get verified.

Included Modules

Defined in:

saml/xml_security.cr

Constant Summary

ASSERTION_NS = {"ds" => DSIG, "saml" => "urn:oasis:names:tc:SAML:2.0:assertion"}
NAMESPACES = {"ds" => DSIG, "ec" => C14N}

Constructors

Instance Method Summary

Instance methods inherited from module Saml::ErrorHandling

append_error(error_msg : String, soft_override : Bool | Nil = nil) : Bool append_error, errors : Array(String) errors, reset_errors! reset_errors!

Instance methods inherited from class XMLSecurity::BaseDocument

pem_to_der(pem : String) pem_to_der, to_s(io : IO) : Nil
to_s : String to_s, to_xml : String to_xml, xml_document : XML::Node xml_document

Constructor methods inherited from class XMLSecurity::BaseDocument

new(xml_document : XML::Node) new

Class methods inherited from class XMLSecurity::BaseDocument

algorithm(element : XML::Node | String | Nil) : OpenSSL::Digest algorithm, canon_algorithm(element) canon_algorithm, pem_to_der(pem : String) pem_to_der, safe_load_xml(document) : XML::Node safe_load_xml, strict_digest(uri : String | Nil, table) : OpenSSL::Digest | Nil strict_digest

Macros inherited from class XMLSecurity::BaseDocument

method_missing(call) method_missing

Constructor Detail

def self.new(response, errors : Array(String) = [] of String) #

[View source]

Instance Method Detail

def extract_inclusive_namespaces_for_test #

[View source]
def format_certificate(cert_text : String | Nil) : String | Nil #

[View source]
def load_cert(cert_text : String | Nil) : OpenSSL::X509::Certificate | Nil #

[View source]
def load_error : String | Nil #

[View source]
def loaded? : Bool #

[View source]
def primary_signature : XML::Node | Nil #

The message signature: the only ds:Signature that is a child of the root, else the only one in a direct Assertion child of the root.


[View source]
def reference_for(sig : XML::Node) : SignedReference | String #

Like resolve_reference, but returns the problem instead of recording it.


[View source]
def resolve_reference(sig : XML::Node, soft = true) : SignedReference | Bool #

Checks the structure of one signature and canonicalizes what it covers. Every lookup is relative to this signature (CVE-2024-45409), and the signed element must be its parent with an ID unique in the document.


[View source]
def signed_element_id : String | Nil #

The ID the primary signature references.


[View source]
def signed_element_id=(signed_element_id : String | Nil) #

[View source]
def validate_document(idp_cert_fingerprint, soft = true, options = {} of Symbol => String | OpenSSL::X509::Certificate) #

Fingerprint mode: trusts the certificate in the signature's own KeyInfo when its fingerprint matches, else falls back to options[:cert].


[View source]
def validate_document_with_cert(idp_cert : OpenSSL::X509::Certificate, soft = true) #

Certificate mode: only the given certificate is trusted. A certificate in the signature's KeyInfo must be that same certificate.


[View source]
def validate_signature(base64_cert, soft = true) #

Verifies the primary signature with a base64 (DER or PEM) certificate.


[View source]
def verify_reference(ref : SignedReference, certificates : Array(OpenSSL::X509::Certificate), soft = true) : Bool #

[View source]
def verify_signature(signature : XML::Node, certificates : Array(OpenSSL::X509::Certificate), soft = true) : SignedReference | Nil #

Verifies one specific signature against the given certificates only.


[View source]