Skip to content
This repository has been archived by the owner on Feb 28, 2021. It is now read-only.

Latest commit

 

History

History
153 lines (132 loc) · 11.6 KB

changelog.md

File metadata and controls

153 lines (132 loc) · 11.6 KB
Raw

RubySaml Changelog

1.4.2 (January 11, 2017)

  • Improve tests format
  • Fix nokogiri requirements based on ruby version
  • Only publish KeyDescriptor[use="encryption"] at SP metadata if security[:want_assertions_encrypted] is true
  • Be able to skip destination validation
  • Improved inResponse validation on SAMLResponses and LogoutResponses
  • #354 Allow scheme and domain to match ignoring case
  • #363 Add support for multiple requested attributes

1.4.1 (October 19, 2016)

  • #357 Add EncryptedAttribute support. Improve decrypt method
  • Allow multiple authn_context_decl_ref in settings
  • Allow options[:settings] to be an hash for Settings overrides in IdpMetadataParser#parse
  • Recover issuers method

1.4.0 (October 13, 2016)

  • Several security improvements:

    • Conditions element required and unique.
    • AuthnStatement element required and unique.
    • SPNameQualifier must math the SP EntityID
    • Reject saml:Attribute element with same “Name” attribute
    • Reject empty nameID
    • Require Issuer element. (Must match IdP EntityID).
    • Destination value can't be blank (if present must match ACS URL).
    • Check that the EncryptedAssertion element only contains 1 Assertion element.

  • #335 Explicitly parse as XML and fix setting of Nokogiri options.

  • #345Support multiple settings.auth_context

  • More tests to prevent XML Signature Wrapping

  • #342 Correct the usage of Mutex

  • 352 Support multiple AttributeStatement tags

1.3.1 (July 10, 2016)

  • Fix response_test.rb of gem 1.3.0
  • Add reference to Security Guidelines
  • Update License
  • #334 Keep API backward-compatibility on IdpMetadataParser fingerprint method.

1.3.0 (June 24, 2016)

  • Security Fix Add extra validations to prevent Signature wrapping attacks
  • Fix XMLSecurity SHA256 and SHA512 uris
  • #326 Fix Destination validation

1.2.0 (April 29, 2016)

  • #269 Refactor error handling; allow collect error messages when soft=true (normal validation stop after find first error)
  • #289 Remove uuid gem in favor of SecureRandom
  • #297 Implement EncryptedKey RetrievalMethod support
  • #298 IDP metadata parsing improved: binding parsing, fingerprint_algorithm support)
  • #299 Make 'signing' at KeyDescriptor optional
  • #308 Support name_id_format on SAMLResponse
  • #315 Support for canonicalization with comments
  • #316 Fix Misspelling of transation_id to transaction_id
  • #321 Support Attribute Names on IDPSSODescriptor parser
  • Changes on empty URI of Signature reference management
  • #320 Dont mutate document to fix lack of reference URI
  • #306 Support WantAssertionsSigned

1.1.2 (February 15, 2016)

  • Improve signature validation. Add tests. #302 Add Destination validation.
  • #292 Improve the error message when validating the audience.
  • #287 Keep the extracted certificate when parsing IdP metadata.

1.1.1 (November 10, 2015)

  • #275 Fix a bug on signature validations that invalidates valid SAML messages.

1.1.0 (October 27, 2015)

  • #273 Support SAMLResponse without ds:x509certificate
  • #270 Allow SAML elements to come from any namespace (at decryption process)
  • #261 Allow validate_subject_confirmation Response validation to be skipped
  • #258 Fix allowed_clock_drift on the validate_session_expiration test
  • #256 Separate the create_authentication_xml_doc in two methods.
  • #255 Refactor validate signature.
  • #254 Handle empty URI references
  • #251 Support qualified and unqualified NameID in attributes
  • #234 Add explicit support for JRuby

1.0.0 (June 30, 2015)

  • #247 Avoid entity expansion (XEE attacks)
  • #246 Fix bug generating Logout Response (issuer was at wrong order)
  • #243 and #244 Fix metadata builder errors. Fix metadata xsd.
  • #241 Add decrypt support (EncryptID and EncryptedAssertion). Improve compatibility with namespaces.
  • #240 and #238 Improve test coverage and refactor.
  • #239 Improve security: Add more validations to SAMLResponse, LogoutRequest and LogoutResponse. Refactor code and improve tests coverage.
  • #237 Don't pretty print metadata by default.
  • #235 Remove the soft parameter from validation methods. Now can be configured on the settings and each class read it and store as an attribute of the class. Adding some validations and refactor old ones.
  • #232 Improve validations: Store the causes in the errors array, code refactor
  • #231 Refactor HTTP-Redirect Sign method, Move test data to right folder
  • #226 Ensure IdP certificate is formatted properly
  • #225 Add documentation to several methods. Fix xpath injection on xml_security.rb
  • #223 Allow logging to be delegated to an arbitrary Logger
  • #222 No more silent failure fetching idp metadata (OneLogin::RubySaml::HttpError raised).

0.9.2 (Apr 28, 2015)

  • #216 Add fingerprint algorithm support
  • #218 Update README.md
  • #214 Cleanup SamlMessage class
  • #213 Add ability to sign metadata. (Improved)
  • #212 Rename library entry point
  • #210 Call assert in tests
  • #208 Update tests and CI for Ruby 2.2.0
  • #205 Allow requirement of single files
  • #204 Require ‘net/http’ library
  • #201 Freeze and duplicate default security settings hash so that it doesn't get modified.
  • #200 Set default SSL certificate store in Ruby 1.8.
  • #199 Change Nokogiri's runtime dependency to fix support for Ruby 1.8.7.
  • #179 Add support for setting the entity ID and name ID format when parsing metadata
  • #175 Introduce thread safety to SAML schema validation
  • #171 Fix inconsistent results with using regex matches in decode_raw_saml

0.9.1 (Feb 10, 2015)

  • #194 Relax nokogiri gem requirements
  • #191 Use Minitest instead of Test::Unit

0.9 (Jan 26, 2015)

  • #169 WantAssertionSigned should be either true or false
  • #167 (doc update) make unit of clock drift obvious
  • #160 Extended solution for Attributes method [] can raise NoMethodError
  • #158 Added ability to specify attribute services in metadata
  • #154 Fix incorrect gem declaration statement
  • #152 Fix the PR #99
  • #150 Nokogiri already in gemspec
  • #147 Fix LogoutResponse issuer validation and implement SAML Response issuer validation.
  • #144 Fix DigestMethod lookup bug
  • #139 Fixes handling of some soft and hard validation failures
  • #138 Change logoutrequest.rb to UTC time
  • #136 Remote idp metadata
  • #135 Restored support for NIL as well as empty AttributeValues
  • #134 explicitly require "onelogin/ruby-saml/logging"
  • #133 Added license to gemspec
  • #132 Support AttributeConsumingServiceIndex in AuthnRequest
  • #131 Add ruby 2.1.1 to .travis.yml
  • #122 Fixes #112 and #117 in a backwards compatible manner
  • #119 Add support for extracting IdP details from metadata xml

0.8.2 (Jan 26, 2015)

  • #183 Resolved a security vulnerability where string interpolation in a REXML::XPath.first() method call allowed for arbitrary code execution.

0.8.0 (Feb 21, 2014)

IMPORTANT: This release changed namespace of the gem from OneLogin::Saml to OneLogin::RubySaml. Please update your implementations of the gem accordingly.

  • #111 Onelogin:: is OneLogin::
  • #108 Change namespacing from Onelogin::Saml to Onelogin::Rubysaml

0.7.3 (Feb 20, 2014)

Updated gem dependencies to be compatible with Ruby 1.8.7-p374 and 1.9.3-p448. Removed unnecessary canonix gem dependency.

  • #107 Relax nokogiri version requirement to >= 1.5.0
  • #105 Lock Gem versions, fix to resolve possible namespace collision