main

Version 1.5.1

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

1.5.1 - 2026-08-18

Fixed

  • Compile the SAML XSDs without Dir.chdir. Schema compilation ran inside a Dir.chdir block, which mutates process global state, so two threads validating a document at the same time could raise conflicting chdir during another chdir block. Each schema is now parsed as a document carrying its own path, so its relative imports resolve without changing the working directory.
  • Compile each XSD once instead of on every valid? call.

1.5.0 - 2026-08-17

Security

  • Reject a Response or Assertion that carries no signature. A registered issuer was previously enough to make an unsigned document valid, so anyone who could reach the assertion consumer service could forge an assertion for any user. (GHSA-hx7c-98jm-7r55)
  • Require an xml signature to reference the element it is attached to. A signature was verified without checking which element it covered, so a valid signature could be copied onto a forged element with the element it really covered hidden in saml:Advice or ds:Object. (GHSA-q726-45rx-qvrw)

Changed

This release rejects documents that 1.4.1 accepted. Each case below was exploitable or is a side effect of closing one that was.

  • An unsigned Response or Assertion is now invalid, even when its issuer is registered. Set configuration.signature_required = false to restore the old behaviour while an identity provider is being fixed; doing so accepts forged assertions. Signing only the Assertion is still accepted, as is an unsigned AuthnRequest, LogoutRequest or LogoutResponse.
  • Response.build on a Configuration with no signing key pair emits an unsigned document, which now fails valid?. Call generate_key_pair_for(use: :signing) or add_key_pair.
  • Assertion.new with an unsigned assertion as a String is now invalid, because a bare assertion is the whole document and nothing else vouches for it. Passing the same assertion as a node nested in a Response is unchanged.
  • A signature whose ds:Reference does not resolve to the element it hangs off, or resolves to more than one element, adds an error on :reference.

Added

  • Saml::Kit::Configuration#signature_required, defaulting to true.

1.4.1 - 2026-08-14

Changed

  • fix: decode encoded signature

1.4.0 - 2025-03-26

Added

  • Add support for converting Assertion xml to Saml::Document

Removed

  • Drop support for ruby 2.7
  • Drop support for ruby 3.0

1.3.0 - 2022-03-30

Removed

  • Drop support for ruby 2.6
  • Drop support for ruby 2.5

Changed

  • fix: upgrade to Ruby 2.7+ *args syntax.
  • fix: resolve deprecation warnings

1.2.0 - 2021-02-04

Changed

1.1.0 - 2019-04-30

Added

  • Add support for ForceAuthn attribute on AuthnRequest

Removed

  • Drop support for ruby 2.2
  • Drop support for ruby 2.3

Changed

  • Rescue from invalid signature validation
  • Change minimum ruby version to 2.4
  • Change minimum bundler to 2.0

1.0.31 - 2019-04-17

Changed

  • Rescue from all decryption errors

1.0.30 - 2019-04-07

Changed

  • change xml-kit dependency to minimum 0.3.0
  • use encrypt_data_for instead of encryption_for.

1.0.29 - 2018-12-04

Changed

  • change xml-kit dependency to ~> 0.2.

1.0.28 - 2018-12-04

Changed

  • Parse attribute arrays from SAML assertion.

1.0.27 - 2018-11-08

Changed

  • Evict expired key pairs from configuration.

1.0.26 - 2018-10-22

Changed

  • Forward destination, issuer, now, embed_signature to assertion.

1.0.25 - 2018-10-17

Changed

  • Allow multi valued attributes in response assertion.

1.0.24 - 2018-09-18

Added

  • Parse ID from assertion.
  • Parse version from assertion.
  • Parse version from assertion.
  • Add missing English translations.

Changed

  • Moved backing fields from response builder to assertion.

1.0.23 - 2018-08-23

Added

  • Add NotOnOrAfter attribute to SubjectConfirmationData.

1.0.22 - 2018-08-13

Added

  • Allow using a custom NameID Format in Assertion.

1.0.21 - 2018-08-13

Changed

  • Use net/hippie instead of net/http.

Removed

  • remove optional NotOnOrAfter attribute from SubjectConfirmationData.

1.0.20 - 2018-08-11

Changed

  • Synchronize NotOnOrAfter between AuthnStatement and SubjectConfirmationData.

Removed

  • Removed optional SessionNotOnOrAfter attribute from AuthnStatement.