@@ -653,7 +653,7 @@ class RubySamlTest < Minitest::Test
653653 assert !response . send ( :validate_session_expiration )
654654 assert_includes response . errors , "The attributes have expired, based on the SessionNotOnOrAfter of the AttributeStatement of this Response"
655655 end
656-
656+
657657 it "returns true when the session has expired, but is still within the allowed_clock_drift" do
658658 drift = ( Time . now - Time . parse ( "2010-11-19T21:57:37Z" ) ) * 60 # seconds ago that this assertion expired
659659 drift += 10 # add a buffer of 10 seconds to make sure the test passes
@@ -719,7 +719,7 @@ class RubySamlTest < Minitest::Test
719719 settings . idp_cert = signature_1
720720 response_valid_signed_without_x509certificate . settings = settings
721721 assert !response_valid_signed_without_x509certificate . send ( :validate_signature )
722- assert_includes response_valid_signed_without_x509certificate . errors , "Invalid Signature on SAML Response"
722+ assert_includes response_valid_signed_without_x509certificate . errors , "Invalid Signature on SAML Response"
723723 end
724724
725725 it "return true when no X509Certificate and the cert provided at settings matches" do
@@ -1126,6 +1126,28 @@ class RubySamlTest < Minitest::Test
11261126 assert decrypted . name , "Assertion"
11271127 end
11281128
1129+ it "is possible to decrypt the assertion if private key provided and EncryptedKey RetrievalMethod presents in response" do
1130+ settings . private_key = ruby_saml_key_text
1131+ resp = read_response ( 'response_with_retrieval_method.xml' )
1132+ response = OneLogin ::RubySaml ::Response . new ( resp , :settings => settings )
1133+
1134+ encrypted_assertion_node = REXML ::XPath . first (
1135+ response . document ,
1136+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)" ,
1137+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol" , "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1138+ )
1139+ decrypted = response . send ( :decrypt_assertion , encrypted_assertion_node )
1140+
1141+ encrypted_assertion_node2 = REXML ::XPath . first (
1142+ decrypted ,
1143+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)" ,
1144+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol" , "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1145+ )
1146+
1147+ assert_nil encrypted_assertion_node2
1148+ assert decrypted . name , "Assertion"
1149+ end
1150+
11291151 it "is possible to decrypt the assertion if private key but no saml namespace on the Assertion Element that is inside the EncryptedAssertion" do
11301152 unsigned_message_encrypted_assertion_without_saml_namespace = read_response ( 'unsigned_message_encrypted_assertion_without_saml_namespace.xml.base64' )
11311153 response = OneLogin ::RubySaml ::Response . new ( unsigned_message_encrypted_assertion_without_saml_namespace , :settings => settings )
0 commit comments