@@ -668,7 +668,7 @@ class RubySamlTest < Minitest::Test
668668 assert !response . send ( :validate_session_expiration )
669669 assert_includes response . errors , "The attributes have expired, based on the SessionNotOnOrAfter of the AttributeStatement of this Response"
670670 end
671-
671+
672672 it "returns true when the session has expired, but is still within the allowed_clock_drift" do
673673 drift = ( Time . now - Time . parse ( "2010-11-19T21:57:37Z" ) ) * 60 # seconds ago that this assertion expired
674674 drift += 10 # add a buffer of 10 seconds to make sure the test passes
@@ -734,7 +734,7 @@ class RubySamlTest < Minitest::Test
734734 settings . idp_cert = signature_1
735735 response_valid_signed_without_x509certificate . settings = settings
736736 assert !response_valid_signed_without_x509certificate . send ( :validate_signature )
737- assert_includes response_valid_signed_without_x509certificate . errors , "Invalid Signature on SAML Response"
737+ assert_includes response_valid_signed_without_x509certificate . errors , "Invalid Signature on SAML Response"
738738 end
739739
740740 it "return true when no X509Certificate and the cert provided at settings matches" do
@@ -1152,6 +1152,28 @@ class RubySamlTest < Minitest::Test
11521152 assert decrypted . name , "Assertion"
11531153 end
11541154
1155+ it "is possible to decrypt the assertion if private key provided and EncryptedKey RetrievalMethod presents in response" do
1156+ settings . private_key = ruby_saml_key_text
1157+ resp = read_response ( 'response_with_retrieval_method.xml' )
1158+ response = OneLogin ::RubySaml ::Response . new ( resp , :settings => settings )
1159+
1160+ encrypted_assertion_node = REXML ::XPath . first (
1161+ response . document ,
1162+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)" ,
1163+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol" , "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1164+ )
1165+ decrypted = response . send ( :decrypt_assertion , encrypted_assertion_node )
1166+
1167+ encrypted_assertion_node2 = REXML ::XPath . first (
1168+ decrypted ,
1169+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)" ,
1170+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol" , "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1171+ )
1172+
1173+ assert_nil encrypted_assertion_node2
1174+ assert decrypted . name , "Assertion"
1175+ end
1176+
11551177 it "is possible to decrypt the assertion if private key but no saml namespace on the Assertion Element that is inside the EncryptedAssertion" do
11561178 unsigned_message_encrypted_assertion_without_saml_namespace = read_response ( 'unsigned_message_encrypted_assertion_without_saml_namespace.xml.base64' )
11571179 response = OneLogin ::RubySaml ::Response . new ( unsigned_message_encrypted_assertion_without_saml_namespace , :settings => settings )
0 commit comments