Skip to content

[NEW] Validate NotBefore and NotOnOrAfter SAML assertions #15226

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sampaiodiego merged 7 commits into from
Sep 19, 2019
Merged

[NEW] Validate NotBefore and NotOnOrAfter SAML assertions #15226

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
bbbc2c1
[NEW] Validate NotBefore and NotOnOrAfter SAML assertions
pierre-lehnen-rc Aug 21, 2019
41a317c
Apply suggestions from code review
pierre-lehnen-rc Sep 19, 2019
387ae1a
Merge branch 'develop' into saml-validate-assertions
pierre-lehnen-rc Sep 19, 2019
c4f0c5c
Merge branch 'saml-validate-assertions' of github.com:RocketChat/Rock…
pierre-lehnen-rc Sep 19, 2019
fe6208f
Improved Code Quality
pierre-lehnen-rc Sep 19, 2019
e33d3b8
Undoing array deconstruction (the method result is a fake array).
pierre-lehnen-rc Sep 19, 2019
18db8af
Apply suggestions from code review
sampaiodiego Sep 19, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions app/meteor-accounts-saml/server/saml_utils.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -461,6 +461,30 @@ SAML.prototype.mapAttributes = function(attributeStatement, profile) {
}
};

SAML.prototype.validateNotBeforeNotOnOrAfterAssertions = function(element) {
const now = new Date();

if (element.hasAttribute('NotBefore')) {
const notBefore = element.getAttribute('NotBefore');

const date = new Date(notBefore);
if (now < date) {
return false;
}
}

if (element.hasAttribute('NotOnOrAfter')) {
const notOnOrAfter = element.getAttribute('NotOnOrAfter');
const date = new Date(notOnOrAfter);

if (now >= date) {
return false;
}
}

return true;
};

SAML.prototype.validateResponse = function(samlResponse, relayState, callback) {
const self = this;
const xml = new Buffer(samlResponse, 'base64').toString('utf8');
Expand Down Expand Up @@ -543,6 +567,19 @@ SAML.prototype.validateResponse = function(samlResponse, relayState, callback) {
profile.nameIDFormat = nameID.getAttribute('Format');
}
}

const subjectConfirmation = subject.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:assertion', 'SubjectConfirmation')[0];
if (subjectConfirmation) {
const subjectConfirmationData = subjectConfirmation.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:assertion', 'SubjectConfirmationData')[0];
Comment thread
pierre-lehnen-rc marked this conversation as resolved.
if (subjectConfirmationData && !this.validateNotBeforeNotOnOrAfterAssertions(subjectConfirmationData)) {
return callback(new Error('NotBefore / NotOnOrAfter assertion failed'), null, false);
}
}
}

const conditions = assertion.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:assertion', 'Conditions')[0];
Comment thread
pierre-lehnen-rc marked this conversation as resolved.
if (conditions && !this.validateNotBeforeNotOnOrAfterAssertions(conditions)) {
return callback(new Error('NotBefore / NotOnOrAfter assertion failed'), null, false);
}

const authnStatement = assertion.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:assertion', 'AuthnStatement')[0];
Expand Down