From 3dc5d5a9c31a61cbf1d86123b73c6596507bdf10 Mon Sep 17 00:00:00 2001 From: azelcs Date: Wed, 8 May 2024 12:09:31 +0300 Subject: [PATCH 1/4] Use ppid instead of nameid for unique identifier --- lib/omniauth/strategies/latvija.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/omniauth/strategies/latvija.rb b/lib/omniauth/strategies/latvija.rb index 3ec1dfe..2d191f1 100644 --- a/lib/omniauth/strategies/latvija.rb +++ b/lib/omniauth/strategies/latvija.rb @@ -88,7 +88,7 @@ def raw_info end def uid - @response.name_identifier + "PK:#{raw_info['privatepersonalidentifier']}" end def full_name From b46f942e2419ecbd77148941bb2f360838c3f135 Mon Sep 17 00:00:00 2001 From: azelcs Date: Wed, 8 May 2024 12:48:28 +0300 Subject: [PATCH 2/4] Add test --- ...e_personal_code_uid_mismatch_decrypted.xml | 63 +++++++++++++++++++ spec/omniauth/strategies/latvija_spec.rb | 34 +++++++++- 2 files changed, 95 insertions(+), 2 deletions(-) create mode 100644 spec/fixtures/wresult_single_personal_code_uid_mismatch_decrypted.xml diff --git a/spec/fixtures/wresult_single_personal_code_uid_mismatch_decrypted.xml b/spec/fixtures/wresult_single_personal_code_uid_mismatch_decrypted.xml new file mode 100644 index 0000000..8fe80ab --- /dev/null +++ b/spec/fixtures/wresult_single_personal_code_uid_mismatch_decrypted.xml @@ -0,0 +1,63 @@ + + + + + 2019-11-05T13:57:02.777Z + 2019-11-05T17:57:02.777Z + + + + https://example.com + + + + + + + https://ivis.eps.gov.lv/LVP.Sitecore + + + + + PK:32345678901 + + urn:oasis:names:tc:SAML:1.0:cm:bearer + + + + ODS + + + KNISLIS + + + 01018012345 + + + 4 + + + https://epakvisstv.vraa.gov.lv/STS/VISS.LVP.STS/Image.ashx?id=am-test + + + + + PK:32345678901 + + urn:oasis:names:tc:SAML:1.0:cm:bearer + + + + + + + urn:oasis:names:tc:SAML:1.0:assertion + http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue + http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer + + diff --git a/spec/omniauth/strategies/latvija_spec.rb b/spec/omniauth/strategies/latvija_spec.rb index b888cc9..69b3c2f 100644 --- a/spec/omniauth/strategies/latvija_spec.rb +++ b/spec/omniauth/strategies/latvija_spec.rb @@ -198,7 +198,7 @@ def strategy expect(response.dig('extra', 'raw_info', 'historical_privatepersonalidentifier')).to match_array(['12345678901']) end - it 'should return NameIdentifier property as the auth UID' do + it 'should return PK:privatepersonalidentifier as the auth UID' do expect(response.dig('uid')).to eq('PK:32345678901') end @@ -237,9 +237,39 @@ def strategy expect(response.dig('extra', 'raw_info', 'historical_privatepersonalidentifier')).to be_empty end - it 'should return NameIdentifier property as the auth UID' do + it 'should return PK:privatepersonalidentifier as the auth UID' do expect(response.dig('uid')).to eq('PK:32345678901') end end + + context 'when response NameIdentifier code does not match real private personal identifier' do + let(:wresult_decrypted) { File.read('spec/fixtures/wresult_single_personal_code_uid_mismatch_decrypted.xml') } + + before(:each) do + allow_any_instance_of(OmniAuth::Strategies::Latvija::SignedDocument).to receive(:validate!).and_return(true) + end + + let(:response) do + post '/auth/latvija/callback', { + :wa => "wsignin1.0", + :wctx => "http://example.org/auth/latvija/callback", + :wresult => wresult_decrypted + } + + last_request.env['omniauth.auth'] + end + + it 'should return primary personal code' do + expect(response.dig('info', 'private_personal_identifier')).to eq('01018012345') + end + + it 'should not return historical personal codes in extra info' do + expect(response.dig('extra', 'raw_info', 'historical_privatepersonalidentifier')).to be_empty + end + + it 'should return PK:privatepersonalidentifier as the auth UID' do + expect(response.dig('uid')).to eq('PK:01018012345') + end + end end end From 558e12cb63dd58f59c74081c4ab72dd61dba352f Mon Sep 17 00:00:00 2001 From: azelcs Date: Wed, 8 May 2024 12:50:19 +0300 Subject: [PATCH 3/4] Rename fixture --- ..._single_personal_code_nameidentifier_mismatch_decrypted.xml} | 0 spec/omniauth/strategies/latvija_spec.rb | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename spec/fixtures/{wresult_single_personal_code_uid_mismatch_decrypted.xml => wresult_single_personal_code_nameidentifier_mismatch_decrypted.xml} (100%) diff --git a/spec/fixtures/wresult_single_personal_code_uid_mismatch_decrypted.xml b/spec/fixtures/wresult_single_personal_code_nameidentifier_mismatch_decrypted.xml similarity index 100% rename from spec/fixtures/wresult_single_personal_code_uid_mismatch_decrypted.xml rename to spec/fixtures/wresult_single_personal_code_nameidentifier_mismatch_decrypted.xml diff --git a/spec/omniauth/strategies/latvija_spec.rb b/spec/omniauth/strategies/latvija_spec.rb index 69b3c2f..450a009 100644 --- a/spec/omniauth/strategies/latvija_spec.rb +++ b/spec/omniauth/strategies/latvija_spec.rb @@ -243,7 +243,7 @@ def strategy end context 'when response NameIdentifier code does not match real private personal identifier' do - let(:wresult_decrypted) { File.read('spec/fixtures/wresult_single_personal_code_uid_mismatch_decrypted.xml') } + let(:wresult_decrypted) { File.read('spec/fixtures/wresult_single_personal_code_nameidentifier_mismatch_decrypted.xml') } before(:each) do allow_any_instance_of(OmniAuth::Strategies::Latvija::SignedDocument).to receive(:validate!).and_return(true) From 30e6086eee97c79b7c0f699c74a511d964a9b972 Mon Sep 17 00:00:00 2001 From: azelcs Date: Wed, 8 May 2024 16:58:23 +0300 Subject: [PATCH 4/4] Keep VPM internal ID in legacy UIDs as fallback --- lib/omniauth/strategies/latvija.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/omniauth/strategies/latvija.rb b/lib/omniauth/strategies/latvija.rb index 2d191f1..f5ffcd0 100644 --- a/lib/omniauth/strategies/latvija.rb +++ b/lib/omniauth/strategies/latvija.rb @@ -99,7 +99,8 @@ def legacy_uids # UIDs that could have been assigned to this identity by previous versions of the gem, or due to peronal identifier change legacy_uids = [ - "#{full_name}, #{raw_info["privatepersonalidentifier"]}" # generated by gem version <= 4.0 + "#{full_name}, #{raw_info["privatepersonalidentifier"]}", # generated by gem version <= 4.0 + @response.name_identifier # VPM internal UID fallback, generated by gem version <= 6.3.0 ] raw_info.fetch('historical_privatepersonalidentifier', []).each do |historical_identifier|