Commit 80c21a9

mo <mo@mokhan.ca>
2017-11-20 16:46:33
specify content type for metadata.
Entities MAY publish their metadata documents at a well known location by placing the document at the location denoted by its unique identifier, which MUST be in the form of a URL (rather than a URN). See Section 8.3.6 of [SAMLCore] for more information about such identifiers. It is STRONGLY RECOMMENDED that https URLs be used for this purpose. An indirection mechanism supported by the URL scheme (such as an HTTP 1.1 302 redirect) MAY be used if the document is not placed directly at the location. If the publishing protocol permits MIME-based identification of content types, the content type of the metadata instance MUST be application/samlmetadata+xml. https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf
main
1 parent 7b1abe4
Changed files (2)
app
controllers
metadata_controller.rb
Gemfile.lock
app/controllers/metadata_controller.rb
@@ -1,6 +1,8 @@
 class MetadataController < ApplicationController
+  force_ssl if: :ssl_configured?
+
   def show
-    render xml: to_xml
+    render xml: to_xml, content_type: "application/samlmetadata+xml"
   end
 
   private
@@ -10,4 +12,8 @@ class MetadataController < ApplicationController
       Idp.default(request).to_xml
     end
   end
+
+  def ssl_configured?
+    !Rails.env.development?
+  end
 end
Gemfile.lock
@@ -2,8 +2,8 @@ PATH
   remote: ../saml-kit
   specs:
     saml-kit (0.1.0)
-      activemodel (~> 5.1)
-      activesupport (~> 5.1)
+      activemodel (>= 4.2.0)
+      activesupport (>= 4.2.0)
       builder (~> 3.2)
       nokogiri (~> 1.8)
       xmldsig (~> 0.6)
@@ -265,4 +265,4 @@ DEPENDENCIES
   webmock
 
 BUNDLED WITH
-   1.15.4
+   1.16.0