Comparing changes

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+# script/cibuild: Setup environment for CI to run tests. This is primarily
+#                 designed to run on the continuous integration server.
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+echo "Started at…"
+date "+%H:%M:%S"
+
+# GC customizations
+export RUBY_GC_MALLOC_LIMIT=79000000
+export RUBY_GC_HEAP_INIT_SLOTS=800000
+export RUBY_HEAP_FREE_MIN=100000
+export RUBY_HEAP_SLOTS_INCREMENT=400000
+export RUBY_HEAP_SLOTS_GROWTH_FACTOR=1
+
+gem install bundler --no-ri --no-rdoc --conservative
+# run tests
+ruby -v
+bin/test

@@ -1,7 +1,7 @@
 #!/usr/bin/env ruby
 
-require "bundler/setup"
-require "saml/kit"
+require 'bundler/setup'
+require 'saml/kit'
 
 # You can add fixtures and/or initialization code here to make experimenting
 # with your gem easier. You can also use a different console, if you like.
@@ -10,5 +10,5 @@ require "saml/kit"
 # require "pry"
 # Pry.start
 
-require "irb"
+require 'irb'
 IRB.start(__FILE__)

@@ -0,0 +1,13 @@
+#!/bin/sh
+
+set -e
+
+[ -z "$DEBUG" ] || set -x
+
+echo "==> Running setup…"
+date "+%H:%M:%S"
+bin/setup
+
+echo "==> Running linters…"
+date "+%H:%M:%S"
+bundle exec rake rubocop

@@ -3,6 +3,6 @@ set -euo pipefail
 IFS=$'\n\t'
 set -vx
 
-bundle install
+bundle check || bundle install --jobs $(nproc)
 
 # Do any other automated setup that you need to do here

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# script/test: Run test suite for application. Optionally pass in a path to an
+#              individual test file to run a single test.
+
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+[ -z "$DEBUG" ] || set -x
+
+echo "==> Running setup…"
+date "+%H:%M:%S"
+bin/setup
+
+echo "==> Running tests…"
+date "+%H:%M:%S"
+bundle exec rake spec

@@ -3,22 +3,22 @@ require 'saml/kit'
 
 Saml::Kit.deprecate("Use the 'saml-kit-cli' gem instead. saml-kit-create-self-signed-certificate")
 
-puts "Enter Passphrase:"
+puts 'Enter Passphrase:'
 passphrase = STDIN.read.strip
 certificate, private_key = ::Xml::Kit::SelfSignedCertificate.new.create(passphrase: passphrase)
 
-puts "** BEGIN File Format **"
+puts '** BEGIN File Format **'
 print certificate
 puts private_key
-puts "***********************"
+puts '***********************'
 
 puts
 
-puts "*** BEGIN ENV Format **"
+puts '*** BEGIN ENV Format **'
 puts certificate.inspect
 puts private_key.inspect
-puts "***********************"
+puts '***********************'
 
 puts
-puts "Private Key Passphrase:"
+puts 'Private Key Passphrase:'
 puts passphrase.inspect

@@ -6,9 +6,13 @@ Saml::Kit.deprecate("Use the 'saml-kit-cli' gem instead. saml-kit-decode-http-re
 input = STDIN.read
 binding = Saml::Kit::Bindings::HttpRedirect.new(location: '')
 
-uri = URI.parse(input) rescue nil
+uri = begin
+        URI.parse(input)
+      rescue StandardError
+        nil
+      end
 if uri
-  query_params =  Hash[uri.query.split('&').map { |x| x.split('=', 2) }]
+  query_params = Hash[uri.query.split('&').map { |x| x.split('=', 2) }]
   puts binding.deserialize(query_params).to_xml(pretty: true)
 else
   puts binding.deserialize('SAMLRequest' => input).to_xml(pretty: true)

@@ -14,12 +14,12 @@ module Saml
           binding == other
         end
 
-        def serialize(builder, relay_state: nil)
+        def serialize(*)
           []
         end
 
-        def deserialize(params)
-          raise ArgumentError.new("Unsupported binding")
+        def deserialize(_params)
+          raise ArgumentError, 'Unsupported binding'
         end
 
         def to_h
@@ -27,7 +27,7 @@ module Saml
         end
 
         def ==(other)
-          self.to_s == other.to_s
+          to_s == other.to_s
         end
 
         def eql?(other)
@@ -58,7 +58,7 @@ module Saml
           elsif parameters[:SAMLResponse].present?
             parameters[:SAMLResponse]
           else
-            raise ArgumentError.new("SAMLRequest or SAMLResponse parameter is required.")
+            raise ArgumentError, 'SAMLRequest or SAMLResponse parameter is required.'
           end
         end
       end

@@ -17,7 +17,7 @@ module Saml
         end
 
         def deserialize(params, configuration: Saml::Kit.configuration)
-          parameters = normalize(params)
+          parameters = normalize(params_to_hash(params))
           document = deserialize_document_from!(parameters, configuration)
           ensure_valid_signature!(parameters, document)
           document
@@ -35,25 +35,25 @@ module Saml
           return if document.provider.nil?
 
           if document.provider.verify(
-              algorithm_for(params[:SigAlg]),
-              decode(params[:Signature]),
-              canonicalize(params)
+            algorithm_for(params[:SigAlg]),
+            decode(params[:Signature]),
+            canonicalize(params)
           )
             document.signature_verified!
           else
-            raise ArgumentError.new("Invalid Signature")
+            raise ArgumentError, 'Invalid Signature'
           end
         end
 
         def canonicalize(params)
-          [:SAMLRequest, :SAMLResponse, :RelayState, :SigAlg].map do |key|
+          %i[SAMLRequest SAMLResponse RelayState SigAlg].map do |key|
             value = params[key]
             value.present? ? "#{key}=#{value}" : nil
           end.compact.join('&')
         end
 
         def algorithm_for(algorithm)
-          case algorithm =~ /(rsa-)?sha(.*?)$/i && $2.to_i
+          case algorithm =~ /(rsa-)?sha(.*?)$/i && Regexp.last_match(2).to_i
           when 256
             OpenSSL::Digest::SHA256.new
           when 384
@@ -74,6 +74,11 @@ module Saml
             SigAlg: params['SigAlg'] || params[:SigAlg],
           }
         end
+
+        def params_to_hash(value)
+          return value unless value.is_a?(String)
+          Hash[URI.parse(value).query.split('&').map { |x| x.split('=', 2) }]
+        end
       end
     end
   end

@@ -17,7 +17,7 @@ module Saml
           else
             payload = to_query_string(
               saml_document.query_string_parameter => serialize(saml_document.to_xml),
-              'RelayState' => relay_state,
+              'RelayState' => relay_state
             )
             "#{saml_document.destination}?#{payload}"
           end
@@ -34,7 +34,7 @@ module Saml
           to_query_string(
             saml_document.query_string_parameter => serialize(saml_document.to_xml),
             'RelayState' => relay_state,
-            'SigAlg' => ::Xml::Kit::Namespaces::SHA256,
+            'SigAlg' => ::Xml::Kit::Namespaces::SHA256
           )
         end
 

@@ -4,7 +4,7 @@ xml.Assertion(assertion_options) do
   xml.Subject do
     xml.NameID name_id, Format: name_id_format
     xml.SubjectConfirmation Method: Saml::Kit::Namespaces::BEARER do
-      xml.SubjectConfirmationData "", subject_confirmation_data_options
+      xml.SubjectConfirmationData '', subject_confirmation_data_options
     end
   end
   xml.Conditions conditions_options do

@@ -4,11 +4,11 @@ xml.EntityDescriptor entity_descriptor_options do
   render identity_provider, xml: xml
   render service_provider, xml: xml
   xml.Organization do
-    xml.OrganizationName organization_name, 'xml:lang': "en"
-    xml.OrganizationDisplayName organization_name, 'xml:lang': "en"
-    xml.OrganizationURL organization_url, 'xml:lang': "en"
+    xml.OrganizationName organization_name, 'xml:lang': 'en'
+    xml.OrganizationDisplayName organization_name, 'xml:lang': 'en'
+    xml.OrganizationURL organization_url, 'xml:lang': 'en'
   end
-  xml.ContactPerson contactType: "technical" do
+  xml.ContactPerson contactType: 'technical' do
     xml.Company "mailto:#{contact_email}"
   end
 end

@@ -12,6 +12,6 @@ xml.SPSSODescriptor descriptor_options do
     xml.NameIDFormat format
   end
   acs_urls.each_with_index do |item, index|
-    xml.AssertionConsumerService Binding: item[:binding], Location: item[:location], index: index, isDefault: index == 0 ? true : false
+    xml.AssertionConsumerService Binding: item[:binding], Location: item[:location], index: index, isDefault: index.zero?
   end
 end

@@ -25,6 +25,10 @@ module Saml
           user.assertion_attributes_for(request)
         end
 
+        def signing_key_pair
+          super || @response_builder.signing_key_pair
+        end
+
         private
 
         def assertion_options

@@ -15,7 +15,7 @@ module Saml
           @issuer = configuration.entity_id
           @name_id_format = Namespaces::PERSISTENT
           @now = Time.now.utc
-          @version = "2.0"
+          @version = '2.0'
         end
 
         def build
@@ -26,8 +26,8 @@ module Saml
 
         def request_options
           options = {
-            "xmlns:samlp" => Namespaces::PROTOCOL,
-            "xmlns:saml" => Namespaces::ASSERTION,
+            'xmlns:samlp' => Namespaces::PROTOCOL,
+            'xmlns:saml' => Namespaces::ASSERTION,
             ID: id,
             Version: version,
             IssueInstant: now.utc.iso8601,

@@ -16,7 +16,7 @@ module Saml
           @issuer = configuration.entity_id
           @name_id_format = Saml::Kit::Namespaces::PERSISTENT
           @now = Time.now.utc
-          @version = "2.0"
+          @version = '2.0'
         end
 
         def build

@@ -16,7 +16,7 @@ module Saml
           @now = Time.now.utc
           @request = request
           @status_code = Namespaces::SUCCESS
-          @version = "2.0"
+          @version = '2.0'
         end
 
         def build

@@ -17,9 +17,10 @@ module Saml
           @id = ::Xml::Kit::Id.generate
           @reference_id = ::Xml::Kit::Id.generate
           @now = Time.now.utc
-          @version = "2.0"
+          @version = '2.0'
           @status_code = Namespaces::SUCCESS
           @issuer = configuration.entity_id
+          @encryption_certificate = request.try(:provider).try(:encryption_certificates).try(:last)
           @encrypt = encryption_certificate.present?
           @configuration = configuration
         end
@@ -28,13 +29,6 @@ module Saml
           Saml::Kit::Response.new(to_xml, request_id: request.id, configuration: configuration)
         end
 
-        def encryption_certificate
-          request.provider.encryption_certificates.first
-        rescue => error
-          Saml::Kit.logger.error(error)
-          nil
-        end
-
         def assertion
           @assertion ||=
             begin

@@ -3,12 +3,13 @@ en:
   saml/kit:
     errors:
       Assertion:
+        cannot_decrypt: "cannot be decrypted."
         expired: "must not be expired."
         must_match_issuer: "must match entityId."
         must_contain_single_assertion: "must contain single Assertion."
       AuthnRequest:
         invalid: "must contain AuthnRequest."
-        invalid_fingerprint: "does not match."
+        invalid_fingerprint: "is not registered."
         unregistered: "is unregistered."
       IDPSSODescriptor:
         invalid: "must contain IDPSSODescriptor."
@@ -16,16 +17,24 @@ en:
       InvalidDocument:
         invalid: "must contain valid SAMLRequest"
       LogoutRequest:
-        invalid_fingerprint: "does not match."
+        invalid_fingerprint: "is not registered."
         unregistered: "is unregistered."
       LogoutResponse:
         unregistered: "is unregistered."
+      NullAssertion:
+        invalid: "is missing."
       Response:
         invalid: "must contain Response."
-        invalid_fingerprint: "does not match."
+        invalid_fingerprint: "is not registered."
         invalid_response_to: "must match request id."
         invalid_version: "must be 2.0."
         unregistered: "must originate from registered identity provider."
+        must_contain_single_assertion: "must contain a single Assertion."
+      Signature:
+        certificate: "Not valid before %{not_before}. Not valid after %{not_after}."
+        digest_value: "is invalid."
+        empty: "is missing."
+        signature: "is invalid."
       SPSSODescriptor:
         invalid: "must contain SPSSODescriptor."
         invalid_signature: "invalid signature."

@@ -6,7 +6,7 @@ RSpec::Matchers.define :have_query_param do |key|
   end
 
   def query_params_from(url)
-    Hash[query_for(url).split("&").map { |x| x.split('=', 2) }]
+    Hash[query_for(url).split('&').map { |x| x.split('=', 2) }]
   end
 
   def uri_for(url)

@@ -3,17 +3,29 @@ module Saml
     class Assertion
       include ActiveModel::Validations
       include Translatable
-
-      validate :must_match_issuer
-      validate :must_be_active_session
+      XPATH = [
+        '/samlp:Response/saml:Assertion',
+        '/samlp:Response/saml:EncryptedAssertion'
+      ].join('|')
+
+      validate :must_be_decryptable
+      validate :must_match_issuer, if: :decryptable?
+      validate :must_be_active_session, if: :decryptable?
+      validate :must_have_valid_signature, if: :decryptable?
       attr_reader :name
       attr_accessor :occurred_at
 
-      def initialize(xml_hash, configuration: Saml::Kit.configuration)
-        @name = "Assertion"
-        @xml_hash = xml_hash
+      def initialize(node, configuration: Saml::Kit.configuration, private_keys: [])
+        @name = 'Assertion'
+        @node = node
+        @xml_hash = hash_from(node)['Response'] || {}
         @configuration = configuration
         @occurred_at = Time.current
+        decrypt!(::Xml::Kit::Decryption.new(
+                   private_keys: (
+                     configuration.private_keys(use: :encryption) + private_keys
+                   ).uniq
+        ))
       end
 
       def issuer
@@ -29,8 +41,7 @@ module Saml
       end
 
       def signature
-        xml_hash = assertion.fetch('Signature', nil)
-        xml_hash ? Signature.new(xml_hash) : nil
+        @signature ||= Signature.new(at_xpath('./ds:Signature'))
       end
 
       def expired?(now = occurred_at)
@@ -47,7 +58,7 @@ module Saml
           begin
             attrs = assertion.fetch('AttributeStatement', {}).fetch('Attribute', [])
             items = if attrs.is_a? Hash
-                      [[attrs["Name"], attrs["AttributeValue"]]]
+                      [[attrs['Name'], attrs['AttributeValue']]]
                     else
                       attrs.map { |item| [item['Name'], item['AttributeValue']] }
                     end
@@ -65,57 +76,88 @@ module Saml
 
       def audiences
         Array(assertion['Conditions']['AudienceRestriction']['Audience'])
-      rescue => error
+      rescue StandardError => error
         Saml::Kit.logger.error(error)
         []
       end
 
       def encrypted?
-        @xml_hash.fetch('Response', {}).fetch('EncryptedAssertion', nil).present?
+        @xml_hash.fetch('EncryptedAssertion', nil).present?
+      end
+
+      def decryptable?
+        return true unless encrypted?
+        !@cannot_decrypt
       end
 
       def present?
         assertion.present?
       end
 
+      def to_xml(pretty: false)
+        pretty ? @node.to_xml(indent: 2) : @node.to_s
+      end
+
       private
 
       attr_reader :configuration
 
       def assertion
         @assertion ||=
-          if encrypted?
-            private_keys = configuration.private_keys(use: :encryption)
-            decryptor = ::Xml::Kit::Decryption.new(private_keys: private_keys)
-            decrypted = decryptor.decrypt_hash(@xml_hash['Response']['EncryptedAssertion'])
-            Saml::Kit.logger.debug(decrypted)
-            Hash.from_xml(decrypted)['Assertion']
-          else
-            result = @xml_hash.fetch('Response', {}).fetch('Assertion', {})
+          begin
+            result = (hash_from(@node)['Response'] || {})['Assertion']
             return result if result.is_a?(Hash)
-
-            errors[:assertion] << error_message(:must_contain_single_assertion)
             {}
           end
       end
 
+      def decrypt!(decryptor)
+        return unless encrypted?
+
+        encrypted_assertion = @node.at_xpath('./xmlenc:EncryptedData', Saml::Kit::Document::NAMESPACES)
+        @node = decryptor.decrypt_node(encrypted_assertion)
+      rescue Xml::Kit::DecryptionError => error
+        @cannot_decrypt = true
+        Saml::Kit.logger.error(error)
+      end
+
       def parse_date(value)
         DateTime.parse(value)
-      rescue => error
+      rescue StandardError => error
         Saml::Kit.logger.error(error)
         Time.at(0).to_datetime
       end
 
       def must_match_issuer
-        unless audiences.include?(configuration.entity_id)
-          errors[:audience] << error_message(:must_match_issuer)
-        end
+        return if audiences.include?(configuration.entity_id)
+        errors[:audience] << error_message(:must_match_issuer)
       end
 
       def must_be_active_session
         return if active?
         errors[:base] << error_message(:expired)
       end
+
+      def must_have_valid_signature
+        return if !signed? || signature.valid?
+
+        signature.errors.each do |attribute, message|
+          errors.add(attribute, message)
+        end
+      end
+
+      def must_be_decryptable
+        errors.add(:base, error_message(:cannot_decrypt)) unless decryptable?
+      end
+
+      def at_xpath(xpath)
+        @node.at_xpath(xpath, Saml::Kit::Document::NAMESPACES)
+      end
+
+      def hash_from(node)
+        return {} if node.nil?
+        Hash.from_xml(node.document.root.to_s) || {}
+      end
     end
   end
 end

@@ -25,7 +25,7 @@ module Saml
       # @param xml [String] the raw xml.
       # @param configuration [Saml::Kit::Configuration] defaults to the global configuration.
       def initialize(xml, configuration: Saml::Kit.configuration)
-        super(xml, name: "AuthnRequest", configuration: configuration)
+        super(xml, name: 'AuthnRequest', configuration: configuration)
       end
 
       # Extract the AssertionConsumerServiceURL from the AuthnRequest

@@ -1,19 +1,19 @@
-require "saml/kit/bindings/binding"
-require "saml/kit/bindings/http_post"
-require "saml/kit/bindings/http_redirect"
-require "saml/kit/bindings/url_builder"
+require 'saml/kit/bindings/binding'
+require 'saml/kit/bindings/http_post'
+require 'saml/kit/bindings/http_redirect'
+require 'saml/kit/bindings/url_builder'
 
 module Saml
   module Kit
     module Bindings
-      HTTP_ARTIFACT = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact'
-      HTTP_POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
-      HTTP_REDIRECT = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+      HTTP_ARTIFACT = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact'.freeze
+      HTTP_POST = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'.freeze
+      HTTP_REDIRECT = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'.freeze
       ALL = {
         http_post: HTTP_POST,
         http_redirect: HTTP_REDIRECT,
         http_artifact: HTTP_ARTIFACT,
-      }
+      }.freeze
 
       def self.binding_for(binding)
         ALL[binding]

@@ -4,19 +4,19 @@ module Saml
       extend ActiveSupport::Concern
 
       class_methods do
-        def build(*args) # :yields builder
+        def build(*args)
           builder(*args) do |builder|
             yield builder if block_given?
           end.build
         end
 
-        def build_xml(*args) # :yields builder
+        def build_xml(*args)
           builder(*args) do |builder|
             yield builder if block_given?
           end.to_xml
         end
 
-        def builder(*args) # :yields builder
+        def builder(*args)
           builder_class.new(*args).tap do |builder|
             yield builder if block_given?
           end

@@ -5,7 +5,7 @@ module Saml
       attr_reader :service_provider, :identity_provider
 
       def initialize(xml)
-        super("IDPSSODescriptor", xml)
+        super('IDPSSODescriptor', xml)
         @metadatum = [
           Saml::Kit::ServiceProviderMetadata.new(xml),
           Saml::Kit::IdentityProviderMetadata.new(xml),
@@ -13,10 +13,10 @@ module Saml
       end
 
       def services(type)
-        xpath = map { |x| "//md:EntityDescriptor/md:#{x.name}/md:#{type}" }.join("|")
+        xpath = map { |x| "//md:EntityDescriptor/md:#{x.name}/md:#{type}" }.join('|')
         document.find_all(xpath).map do |item|
-          binding = item.attribute("Binding").value
-          location = item.attribute("Location").value
+          binding = item.attribute('Binding').value
+          location = item.attribute('Location').value
           Saml::Kit::Bindings.create_for(binding, location)
         end
       end
@@ -30,12 +30,16 @@ module Saml
       end
 
       def method_missing(name, *args)
-        if target = find { |x| x.respond_to?(name) }
+        if (target = find { |x| x.respond_to?(name) })
           target.public_send(name, *args)
         else
           super
         end
       end
+
+      def respond_to_missing?(method, *)
+        find { |x| x.respond_to?(method) }
+      end
     end
   end
 end

@@ -20,7 +20,7 @@ module Saml
     #     configuration.add_key_pair(ENV["X509_CERTIFICATE"], ENV["PRIVATE_KEY"], passphrase: ENV['PRIVATE_KEY_PASSPHRASE'], use: :encryption)
     #   end
     class Configuration
-      USES = [:signing, :encryption]
+      USES = %i[signing encryption].freeze
       # The issuer to use in requests or responses from this entity to use.
       attr_accessor :entity_id
       # The signature method to use when generating signatures (See {Saml::Kit::Builders::XmlSignature::SIGNATURE_METHODS})
@@ -36,7 +36,7 @@ module Saml
       # The total allowable clock drift for session timeout validation.
       attr_accessor :clock_drift
 
-      def initialize # :yields configuration
+      def initialize
         @clock_drift = 30.seconds
         @digest_method = :SHA256
         @key_pairs = []
@@ -85,7 +85,7 @@ module Saml
       # Return each private for a specific use.
       #
       # @param use [Symbol] the type of key pair to return `nil`, `:signing` or `:encryption`
-      def private_keys(use: :signing)
+      def private_keys(use: nil)
         key_pairs(use: use).flat_map(&:private_key)
       end
 
@@ -97,10 +97,10 @@ module Saml
       private
 
       def ensure_proper_use!(use)
-        unless USES.include?(use)
-          error_message = "Use must be either :signing or :encryption"
-          raise ArgumentError.new(error_message)
-        end
+        return if USES.include?(use)
+
+        error_message = 'Use must be either :signing or :encryption'
+        raise ArgumentError, error_message
       end
     end
   end

@@ -62,7 +62,7 @@ module Saml
 
       # Yields each registered [Saml::Kit::Metadata] to the block.
       def each
-        @items.each do |key, value|
+        @items.each_value do |value|
           yield value
         end
       end

@@ -1,19 +1,20 @@
 module Saml
   module Kit
     class Document
-      PROTOCOL_XSD = File.expand_path("./xsd/saml-schema-protocol-2.0.xsd", File.dirname(__FILE__)).freeze
+      include ActiveModel::Validations
+      include XsdValidatable
+      include Translatable
+      include Trustable
+      include Buildable
+      PROTOCOL_XSD = File.expand_path('./xsd/saml-schema-protocol-2.0.xsd', File.dirname(__FILE__)).freeze
       NAMESPACES = {
         "NameFormat": ::Saml::Kit::Namespaces::ATTR_SPLAT,
         "ds": ::Xml::Kit::Namespaces::XMLDSIG,
         "md": ::Saml::Kit::Namespaces::METADATA,
         "saml": ::Saml::Kit::Namespaces::ASSERTION,
         "samlp": ::Saml::Kit::Namespaces::PROTOCOL,
+        'xmlenc' => ::Xml::Kit::Namespaces::XMLENC,
       }.freeze
-      include ActiveModel::Validations
-      include XsdValidatable
-      include Translatable
-      include Trustable
-      include Buildable
       validates_presence_of :content
       validates_presence_of :id
       validate :must_match_xsd
@@ -60,13 +61,28 @@ module Saml
       #
       # @param pretty [Boolean] formats the xml or returns the raw xml.
       def to_xml(pretty: false)
-        pretty ? Nokogiri::XML(content).to_xml(indent: 2) : content
+        pretty ? to_nokogiri.to_xml(indent: 2) : content
       end
 
-      # Returns the SAML document as an XHTML string. 
+      # Returns the SAML document as an XHTML string.
       # This is useful for rendering in a web page.
       def to_xhtml
-        Nokogiri::XML(content, &:noblanks).to_xhtml
+        Nokogiri::XML(to_xml, &:noblanks).to_xhtml
+      end
+
+      # @!visibility private
+      def to_nokogiri
+        @nokogiri ||= Nokogiri::XML(content)
+      end
+
+      # @!visibility private
+      def at_xpath(xpath)
+        to_nokogiri.at_xpath(xpath, NAMESPACES)
+      end
+
+      # @!visibility private
+      def search(xpath)
+        to_nokogiri.search(xpath, NAMESPACES)
       end
 
       def to_s
@@ -75,11 +91,11 @@ module Saml
 
       class << self
         XPATH = [
-          "/samlp:AuthnRequest",
-          "/samlp:LogoutRequest",
-          "/samlp:LogoutResponse",
-          "/samlp:Response",
-        ].join("|")
+          '/samlp:AuthnRequest',
+          '/samlp:LogoutRequest',
+          '/samlp:LogoutResponse',
+          '/samlp:Response',
+        ].join('|')
 
         # Returns the raw xml as a Saml::Kit SAML document.
         #
@@ -87,16 +103,16 @@ module Saml
         # @param configuration [Saml::Kit::Configuration] the configuration to use for unpacking the document.
         def to_saml_document(xml, configuration: Saml::Kit.configuration)
           xml_document = ::Xml::Kit::Document.new(xml, namespaces: {
-            "samlp": ::Saml::Kit::Namespaces::PROTOCOL
-          })
+                                                    "samlp": ::Saml::Kit::Namespaces::PROTOCOL
+                                                  })
           constructor = {
-            "AuthnRequest" => Saml::Kit::AuthenticationRequest,
-            "LogoutRequest" => Saml::Kit::LogoutRequest,
-            "LogoutResponse" => Saml::Kit::LogoutResponse,
-            "Response" => Saml::Kit::Response,
+            'AuthnRequest' => Saml::Kit::AuthenticationRequest,
+            'LogoutRequest' => Saml::Kit::LogoutRequest,
+            'LogoutResponse' => Saml::Kit::LogoutResponse,
+            'Response' => Saml::Kit::Response,
           }[xml_document.find_by(XPATH).name] || InvalidDocument
           constructor.new(xml, configuration: configuration)
-        rescue => error
+        rescue StandardError => error
           Saml::Kit.logger.error(error)
           InvalidDocument.new(xml, configuration: configuration)
         end
@@ -113,7 +129,7 @@ module Saml
           when Saml::Kit::LogoutRequest.to_s
             Saml::Kit::Builders::LogoutRequest
           else
-            raise ArgumentError.new("Unknown SAML Document #{name}")
+            raise ArgumentError, "Unknown SAML Document #{name}"
           end
         end
       end
@@ -140,7 +156,7 @@ module Saml
 
       def must_be_valid_version
         return unless expected_type?
-        return if "2.0" == version
+        return if version == '2.0'
         errors[:version] << error_message(:invalid_version)
       end
     end

@@ -32,15 +32,15 @@ module Saml
     # {include:file:spec/examples/identity_provider_metadata_spec.rb}
     class IdentityProviderMetadata < Metadata
       def initialize(xml)
-        super("IDPSSODescriptor", xml)
+        super('IDPSSODescriptor', xml)
       end
 
       # Returns the IDPSSODescriptor/@WantAuthnRequestsSigned attribute.
       def want_authn_requests_signed
         xpath = "/md:EntityDescriptor/md:#{name}"
-        attribute = document.find_by(xpath).attribute("WantAuthnRequestsSigned")
+        attribute = document.find_by(xpath).attribute('WantAuthnRequestsSigned')
         return true if attribute.nil?
-        attribute.text.downcase == "true"
+        attribute.text.casecmp('true').zero?
       end
 
       # Returns each of the SingleSignOnService elements.
@@ -59,8 +59,8 @@ module Saml
       def attributes
         document.find_all("/md:EntityDescriptor/md:#{name}/saml:Attribute").map do |item|
           {
-            format: item.attribute("NameFormat").try(:value),
-            name: item.attribute("Name").value,
+            format: item.attribute('NameFormat').try(:value),
+            name: item.attribute('Name').value,
           }
         end
       end
@@ -71,7 +71,7 @@ module Saml
       # @param relay_state [Object] The RelayState to include the returned SAML params.
       # @param configuration [Saml::Kit::Configuration] the configuration to use for generating the request.
       # @return [Array] The url and saml params encoded using the rules for the specified binding.
-      def login_request_for(binding:, relay_state: nil, configuration: Saml::Kit.configuration) # :yields builder
+      def login_request_for(binding:, relay_state: nil, configuration: Saml::Kit.configuration)
         builder = Saml::Kit::AuthenticationRequest.builder(configuration: configuration) do |x|
           x.embed_signature = want_authn_requests_signed
           yield x if block_given?

@@ -7,12 +7,12 @@ module Saml
       end
 
       def initialize(xml, configuration: nil)
-        super(xml, name: "InvalidDocument")
+        super(xml, name: 'InvalidDocument')
       end
 
       def to_h
         super
-      rescue
+      rescue StandardError
         {}
       end
     end

@@ -31,7 +31,7 @@ module Saml
       # @param xml [String] The raw xml string.
       # @param configuration [Saml::Kit::Configuration] the configuration to use.
       def initialize(xml, configuration: Saml::Kit.configuration)
-        super(xml, name: "LogoutRequest", configuration: configuration)
+        super(xml, name: 'LogoutRequest', configuration: configuration)
       end
 
       # Returns the NameID value.

@@ -10,7 +10,7 @@ module Saml
 
       def initialize(xml, request_id: nil, configuration: Saml::Kit.configuration)
         @request_id = request_id
-        super(xml, name: "LogoutResponse", configuration: configuration)
+        super(xml, name: 'LogoutResponse', configuration: configuration)
       end
     end
   end

@@ -23,7 +23,11 @@ module Saml
     # for a list of options that can be specified.
     # {include:file:spec/examples/metadata_spec.rb}
     class Metadata
-      METADATA_XSD = File.expand_path("./xsd/saml-schema-metadata-2.0.xsd", File.dirname(__FILE__)).freeze
+      include ActiveModel::Validations
+      include XsdValidatable
+      include Translatable
+      include Buildable
+      METADATA_XSD = File.expand_path('./xsd/saml-schema-metadata-2.0.xsd', File.dirname(__FILE__)).freeze
       NAMESPACES = {
         "NameFormat": Namespaces::ATTR_SPLAT,
         "ds": ::Xml::Kit::Namespaces::XMLDSIG,
@@ -31,10 +35,6 @@ module Saml
         "saml": Namespaces::ASSERTION,
         "samlp": Namespaces::PROTOCOL,
       }.freeze
-      include ActiveModel::Validations
-      include XsdValidatable
-      include Translatable
-      include Buildable
 
       validates_presence_of :metadata
       validate :must_contain_descriptor
@@ -50,7 +50,7 @@ module Saml
 
       # Returns the /EntityDescriptor/@entityID
       def entity_id
-        document.find_by("/md:EntityDescriptor/@entityID").value
+        document.find_by('/md:EntityDescriptor/@entityID').value
       end
 
       # Returns the supported NameIDFormats.
@@ -60,23 +60,23 @@ module Saml
 
       # Returns the Organization Name
       def organization_name
-        document.find_by("/md:EntityDescriptor/md:Organization/md:OrganizationName").try(:text)
+        document.find_by('/md:EntityDescriptor/md:Organization/md:OrganizationName').try(:text)
       end
 
       # Returns the Organization URL
       def organization_url
-        document.find_by("/md:EntityDescriptor/md:Organization/md:OrganizationURL").try(:text)
+        document.find_by('/md:EntityDescriptor/md:Organization/md:OrganizationURL').try(:text)
       end
 
       # Returns the Company
       def contact_person_company
-        document.find_by("/md:EntityDescriptor/md:ContactPerson/md:Company").try(:text)
+        document.find_by('/md:EntityDescriptor/md:ContactPerson/md:Company').try(:text)
       end
 
       # Returns each of the X509 certificates.
       def certificates
         @certificates ||= document.find_all("/md:EntityDescriptor/md:#{name}/md:KeyDescriptor").map do |item|
-          cert = item.at_xpath("./ds:KeyInfo/ds:X509Data/ds:X509Certificate", NAMESPACES).text
+          cert = item.at_xpath('./ds:KeyInfo/ds:X509Data/ds:X509Certificate', NAMESPACES).text
           attribute = item.attribute('use')
           use = attribute.nil? ? nil : item.attribute('use').value
           ::Xml::Kit::Certificate.new(cert, use: use)
@@ -98,8 +98,8 @@ module Saml
       # @param type [String] the type of service. .E.g. `AssertionConsumerServiceURL`
       def services(type)
         document.find_all("/md:EntityDescriptor/md:#{name}/md:#{type}").map do |item|
-          binding = item.attribute("Binding").value
-          location = item.attribute("Location").value
+          binding = item.attribute('Binding').value
+          location = item.attribute('Location').value
           Saml::Kit::Bindings.create_for(binding, location)
         end
       end
@@ -179,25 +179,31 @@ module Saml
         end
       end
 
-      # Creates a `{Saml::Kit::Metadata}` object from a raw XML [String].
-      #
-      # @param content [String] the raw metadata XML.
-      # @return [Saml::Kit::Metadata] the metadata document or subclass.
-      def self.from(content)
-        hash = Hash.from_xml(content)
-        entity_descriptor = hash["EntityDescriptor"]
-        if entity_descriptor.key?("SPSSODescriptor") && entity_descriptor.key?("IDPSSODescriptor")
-          Saml::Kit::CompositeMetadata.new(content)
-        elsif entity_descriptor.keys.include?("SPSSODescriptor")
-          Saml::Kit::ServiceProviderMetadata.new(content)
-        elsif entity_descriptor.keys.include?("IDPSSODescriptor")
-          Saml::Kit::IdentityProviderMetadata.new(content)
+      def signature
+        @signature ||= Signature.new(at_xpath('/md:EntityDescriptor/ds:Signature'))
+      end
+
+      class << self
+        # Creates a `{Saml::Kit::Metadata}` object from a raw XML [String].
+        #
+        # @param content [String] the raw metadata XML.
+        # @return [Saml::Kit::Metadata] the metadata document or subclass.
+        def from(content)
+          hash = Hash.from_xml(content)
+          entity_descriptor = hash['EntityDescriptor']
+          if entity_descriptor.key?('SPSSODescriptor') && entity_descriptor.key?('IDPSSODescriptor')
+            Saml::Kit::CompositeMetadata.new(content)
+          elsif entity_descriptor.keys.include?('SPSSODescriptor')
+            Saml::Kit::ServiceProviderMetadata.new(content)
+          elsif entity_descriptor.keys.include?('IDPSSODescriptor')
+            Saml::Kit::IdentityProviderMetadata.new(content)
+          end
         end
-      end
 
-      # @!visibility private
-      def self.builder_class
-        Saml::Kit::Builders::Metadata
+        # @!visibility private
+        def builder_class
+          Saml::Kit::Builders::Metadata
+        end
       end
 
       private
@@ -208,6 +214,10 @@ module Saml
         @document ||= ::Xml::Kit::Document.new(xml, namespaces: NAMESPACES)
       end
 
+      def at_xpath(xpath)
+        document.find_by(xpath)
+      end
+
       def metadata
         document.find_by("/md:EntityDescriptor/md:#{name}").present?
       end
@@ -221,20 +231,12 @@ module Saml
       end
 
       def must_have_valid_signature
-        return if to_xml.blank?
-
-        unless valid_signature?
-          errors[:base] << error_message(:invalid_signature)
-        end
-      end
+        return unless signature.present?
 
-      def valid_signature?
-        xml = document
-        result = xml.valid?
-        xml.errors.each do |error|
-          errors[:base] << error
+        signature.valid?
+        signature.errors.each do |attribute, error|
+          errors[attribute] << error
         end
-        result
       end
     end
   end

@@ -1,32 +1,32 @@
 module Saml
   module Kit
     module Namespaces
-      SAML_2_0 = "urn:oasis:names:tc:SAML:2.0"
-      SAML_1_1 = "urn:oasis:names:tc:SAML:1.1"
-      ATTR_NAME_FORMAT = "#{SAML_2_0}:attrname-format"
-      NAME_ID_FORMAT_1_1 = "#{SAML_1_1}:nameid-format"
-      NAME_ID_FORMAT_2_0 = "#{SAML_2_0}:nameid-format"
-      STATUS = "#{SAML_2_0}:status"
+      SAML_2_0 = 'urn:oasis:names:tc:SAML:2.0'.freeze
+      SAML_1_1 = 'urn:oasis:names:tc:SAML:1.1'.freeze
+      ATTR_NAME_FORMAT = "#{SAML_2_0}:attrname-format".freeze
+      NAME_ID_FORMAT_1_1 = "#{SAML_1_1}:nameid-format".freeze
+      NAME_ID_FORMAT_2_0 = "#{SAML_2_0}:nameid-format".freeze
+      STATUS = "#{SAML_2_0}:status".freeze
 
-      ASSERTION = "#{SAML_2_0}:assertion"
-      ATTR_SPLAT = "#{ATTR_NAME_FORMAT}:*"
-      BASIC = "#{ATTR_NAME_FORMAT}:basic"
-      BEARER = "#{SAML_2_0}:cm:bearer"
-      EMAIL_ADDRESS = "#{NAME_ID_FORMAT_1_1}:emailAddress"
-      INVALID_NAME_ID_POLICY = "#{STATUS}:InvalidNameIDPolicy"
-      METADATA = "#{SAML_2_0}:metadata"
-      PASSWORD = "#{SAML_2_0}:ac:classes:Password"
-      PASSWORD_PROTECTED = "#{SAML_2_0}:ac:classes:PasswordProtectedTransport"
-      PERSISTENT = "#{NAME_ID_FORMAT_2_0}:persistent"
-      PROTOCOL = "#{SAML_2_0}:protocol"
-      REQUESTER_ERROR = "#{STATUS}:Requester"
-      RESPONDER_ERROR = "#{STATUS}:Responder"
-      SUCCESS = "#{STATUS}:Success"
-      TRANSIENT = "#{NAME_ID_FORMAT_2_0}:transient"
-      UNSPECIFIED = "#{SAML_2_0}:consent:unspecified"
-      UNSPECIFIED_NAMEID = "#{NAME_ID_FORMAT_1_1}:unspecified"
-      URI = "#{ATTR_NAME_FORMAT}:uri"
-      VERSION_MISMATCH_ERROR = "#{STATUS}:VersionMismatch"
+      ASSERTION = "#{SAML_2_0}:assertion".freeze
+      ATTR_SPLAT = "#{ATTR_NAME_FORMAT}:*".freeze
+      BASIC = "#{ATTR_NAME_FORMAT}:basic".freeze
+      BEARER = "#{SAML_2_0}:cm:bearer".freeze
+      EMAIL_ADDRESS = "#{NAME_ID_FORMAT_1_1}:emailAddress".freeze
+      INVALID_NAME_ID_POLICY = "#{STATUS}:InvalidNameIDPolicy".freeze
+      METADATA = "#{SAML_2_0}:metadata".freeze
+      PASSWORD = "#{SAML_2_0}:ac:classes:Password".freeze
+      PASSWORD_PROTECTED = "#{SAML_2_0}:ac:classes:PasswordProtectedTransport".freeze
+      PERSISTENT = "#{NAME_ID_FORMAT_2_0}:persistent".freeze
+      PROTOCOL = "#{SAML_2_0}:protocol".freeze
+      REQUESTER_ERROR = "#{STATUS}:Requester".freeze
+      RESPONDER_ERROR = "#{STATUS}:Responder".freeze
+      SUCCESS = "#{STATUS}:Success".freeze
+      TRANSIENT = "#{NAME_ID_FORMAT_2_0}:transient".freeze
+      UNSPECIFIED = "#{SAML_2_0}:consent:unspecified".freeze
+      UNSPECIFIED_NAMEID = "#{NAME_ID_FORMAT_1_1}:unspecified".freeze
+      URI = "#{ATTR_NAME_FORMAT}:uri".freeze
+      VERSION_MISMATCH_ERROR = "#{STATUS}:VersionMismatch".freeze
     end
   end
 end

@@ -0,0 +1,17 @@
+module Saml
+  module Kit
+    class NullAssertion
+      include ActiveModel::Validations
+      include Translatable
+      validate :invalid
+
+      def invalid
+        errors[:assertion].push(error_message(:invalid))
+      end
+
+      def name
+        'NullAssertion'
+      end
+    end
+  end
+end

@@ -33,10 +33,9 @@ module Saml
 
       def must_match_request_id
         return if request_id.nil?
+        return if in_response_to == request_id
 
-        if in_response_to != request_id
-          errors[:in_response_to] << error_message(:invalid_response_to)
-        end
+        errors[:in_response_to] << error_message(:invalid_response_to)
       end
     end
   end

@@ -8,14 +8,23 @@ module Saml
       def_delegators :assertion, :name_id, :[], :attributes
 
       validate :must_be_valid_assertion
+      validate :must_contain_single_assertion
 
       def initialize(xml, request_id: nil, configuration: Saml::Kit.configuration)
         @request_id = request_id
-        super(xml, name: "Response", configuration: configuration)
+        super(xml, name: 'Response', configuration: configuration)
       end
 
-      def assertion
-        @assertion ||= Saml::Kit::Assertion.new(to_h, configuration: @configuration)
+      def assertion(private_keys = configuration.private_keys(use: :encryption))
+        @assertion ||=
+          begin
+            node = assertion_nodes.last
+            if node.nil?
+              Saml::Kit::NullAssertion.new
+            else
+              Saml::Kit::Assertion.new(node, configuration: @configuration, private_keys: private_keys)
+            end
+          end
       end
 
       private
@@ -23,9 +32,19 @@ module Saml
       def must_be_valid_assertion
         assertion.valid?
         assertion.errors.each do |attribute, error|
-          self.errors[attribute] << error
+          attribute = :assertion if attribute == :base
+          errors[attribute] << error
         end
       end
+
+      def must_contain_single_assertion
+        return if assertion_nodes.count <= 1
+        errors[:base] << error_message(:must_contain_single_assertion)
+      end
+
+      def assertion_nodes
+        search(Saml::Kit::Assertion::XPATH)
+      end
     end
   end
 end

@@ -3,7 +3,7 @@ module Saml
     # {include:file:spec/examples/service_provider_metadata_spec.rb}
     class ServiceProviderMetadata < Metadata
       def initialize(xml)
-        super("SPSSODescriptor", xml)
+        super('SPSSODescriptor', xml)
       end
 
       # Returns each of the AssertionConsumerService bindings.
@@ -20,9 +20,9 @@ module Saml
 
       # Returns true when the metadata demands that Assertions must be signed.
       def want_assertions_signed
-        attribute = document.find_by("/md:EntityDescriptor/md:#{name}").attribute("WantAssertionsSigned")
+        attribute = document.find_by("/md:EntityDescriptor/md:#{name}").attribute('WantAssertionsSigned')
         return true if attribute.nil?
-        attribute.text.downcase == "true"
+        attribute.text.casecmp('true').zero?
       end
 
       # @!visibility private

@@ -2,14 +2,21 @@ module Saml
   module Kit
     class Signature
       include ActiveModel::Validations
+      include Translatable
 
-      def initialize(xml_hash)
-        @xml_hash = xml_hash
+      validate :validate_signature
+      validate :validate_certificate
+
+      attr_reader :name
+
+      def initialize(node)
+        @name = 'Signature'
+        @node = node
       end
 
       # Returns the embedded X509 Certificate
       def certificate
-        value = to_h.fetch('KeyInfo', {}).fetch('X509Data', {}).fetch('X509Certificate', nil)
+        value = at_xpath('./ds:KeyInfo/ds:X509Data/ds:X509Certificate').try(:text)
         return if value.nil?
         ::Xml::Kit::Certificate.new(value, use: :signing)
       end
@@ -20,9 +27,72 @@ module Saml
         metadata.matches?(certificate.fingerprint, use: :signing)
       end
 
+      def digest_value
+        at_xpath('./ds:SignedInfo/ds:Reference/ds:DigestValue').try(:text)
+      end
+
+      def digest_method
+        at_xpath('./ds:SignedInfo/ds:Reference/ds:DigestMethod/@Algorithm').try(:value)
+      end
+
+      def signature_value
+        at_xpath('./ds:SignatureValue').try(:text)
+      end
+
+      def signature_method
+        at_xpath('./ds:SignedInfo/ds:SignatureMethod/@Algorithm').try(:value)
+      end
+
+      def canonicalization_method
+        at_xpath('./ds:SignedInfo/ds:CanonicalizationMethod/@Algorithm').try(:value)
+      end
+
+      def transforms
+        node.search('./ds:SignedInfo/ds:Reference/ds:Transforms/ds:Transform/@Algorithm', Saml::Kit::Document::NAMESPACES).try(:map, &:value)
+      end
+
       # Returns the XML Hash.
       def to_h
-        @xml_hash
+        @xml_hash ||= present? ? Hash.from_xml(to_xml)['Signature'] : {}
+      end
+
+      def present?
+        node
+      end
+
+      def to_xml
+        node.to_s
+      end
+
+      private
+
+      attr_reader :node
+
+      def validate_signature
+        return errors[:base].push(error_message(:empty)) if certificate.nil?
+
+        signature = Xmldsig::Signature.new(@node, 'ID=$uri or @Id')
+        return if signature.valid?(certificate.x509)
+        signature.errors.each do |attribute|
+          errors.add(attribute, error_message(attribute))
+        end
+      end
+
+      def validate_certificate(now = Time.now.utc)
+        return unless certificate.present?
+        return if certificate.active?(now)
+
+        message = error_message(
+          :certificate,
+          not_before: certificate.not_before,
+          not_after: certificate.not_after
+        )
+        errors.add(:certificate, message)
+      end
+
+      def at_xpath(xpath)
+        return nil unless node
+        node.at_xpath(xpath, Saml::Kit::Document::NAMESPACES)
       end
     end
   end

@@ -2,8 +2,9 @@ module Saml
   module Kit
     module Translatable
       # @!visibility private
-      def error_message(attribute, type: :invalid)
-        I18n.translate(attribute, scope: "saml/kit.errors.#{name}")
+      def error_message(attribute, options = {})
+        default_options = { scope: "saml/kit.errors.#{name}" }
+        I18n.translate(attribute, default_options.merge(options))
       end
     end
   end

@@ -16,8 +16,7 @@ module Saml
 
       # @!visibility private
       def signature
-        xml_hash = to_h.fetch(name, {}).fetch('Signature', nil)
-        xml_hash ? Signature.new(xml_hash) : nil
+        @signature ||= Signature.new(at_xpath("/samlp:#{name}/ds:Signature"))
       end
 
       # Returns true when documents is signed and the signing certificate belongs to a known service entity.
@@ -43,16 +42,10 @@ module Saml
 
       def must_have_valid_signature
         return if to_xml.blank?
+        return unless signature.present?
 
-        xml = ::Xml::Kit::Document.new(to_xml, namespaces: {
-          "NameFormat": Namespaces::ATTR_SPLAT,
-          "ds": ::Xml::Kit::Namespaces::XMLDSIG,
-          "md": Namespaces::METADATA,
-          "saml": Namespaces::ASSERTION,
-          "samlp": Namespaces::PROTOCOL,
-        })
-        xml.valid?
-        xml.errors.each do |attribute, error|
+        signature.valid?
+        signature.errors.each do |attribute, error|
           errors[attribute] << error
         end
       end

@@ -1,5 +1,5 @@
 module Saml
   module Kit
-    VERSION = "1.0.6"
+    VERSION = '1.0.7'.freeze
   end
 end

@@ -4,16 +4,21 @@ module Saml
       include ::Xml::Kit::Templatable
 
       def template_path
-        root_path = File.expand_path(File.dirname(__FILE__))
-        template_name = "#{self.class.name.split("::").last.underscore}.builder"
-        File.join(root_path, "builders/templates/", template_name)
+        root_path = __dir__
+        template_name = "#{self.class.name.split('::').last.underscore}.builder"
+        File.join(root_path, 'builders/templates/', template_name)
       end
 
       # Returns true if an embedded signature is requested and at least one signing certificate is available via the configuration.
       def sign?
         return configuration.sign? if embed_signature.nil?
         (embed_signature && configuration.sign?) ||
-          (embed_signature && @signing_key_pair.present?)
+          (embed_signature && signing_key_pair.present?)
+      end
+
+      def encrypt_with(key_pair)
+        self.encrypt = true
+        self.encryption_certificate = key_pair.certificate
       end
 
       def digest_method
@@ -25,7 +30,7 @@ module Saml
       end
 
       def signing_key_pair
-        configuration.key_pairs(use: :signing).last
+        @signing_key_pair || configuration.key_pairs(use: :signing).last
       end
     end
   end

@@ -1,46 +1,49 @@
-require "saml/kit/version"
+require 'saml/kit/version'
 
-require "active_model"
-require "active_support/core_ext/date/calculations"
-require "active_support/core_ext/hash/conversions"
-require "active_support/core_ext/hash/indifferent_access"
-require "active_support/core_ext/numeric/time"
-require "active_support/deprecation"
-require "active_support/duration"
-require "forwardable"
-require "logger"
-require "net/http"
-require "nokogiri"
-require "securerandom"
-require "xml/kit"
+require 'active_model'
+require 'active_support/core_ext/date/calculations'
+require 'active_support/core_ext/hash/conversions'
+require 'active_support/core_ext/hash/indifferent_access'
+require 'active_support/core_ext/numeric/time'
+require 'active_support/deprecation'
+require 'active_support/duration'
+require 'forwardable'
+require 'logger'
+require 'net/http'
+require 'nokogiri'
+require 'securerandom'
+require 'uri'
+require 'xml/kit'
 
-require "saml/kit/buildable"
-require "saml/kit/builders"
-require "saml/kit/namespaces"
-require "saml/kit/serializable"
-require "saml/kit/xsd_validatable"
-require "saml/kit/respondable"
-require "saml/kit/requestable"
-require "saml/kit/trustable"
-require "saml/kit/translatable"
-require "saml/kit/document"
+require 'saml/kit/buildable'
+require 'saml/kit/builders'
+require 'saml/kit/namespaces'
+require 'saml/kit/serializable'
+require 'saml/kit/xsd_validatable'
+require 'saml/kit/respondable'
+require 'saml/kit/requestable'
+require 'saml/kit/trustable'
+require 'saml/kit/translatable'
+require 'saml/kit/document'
 
-require "saml/kit/assertion"
-require "saml/kit/authentication_request"
-require "saml/kit/bindings"
-require "saml/kit/configuration"
-require "saml/kit/default_registry"
-require "saml/kit/logout_response"
-require "saml/kit/logout_request"
-require "saml/kit/metadata"
-require "saml/kit/composite_metadata"
-require "saml/kit/response"
-require "saml/kit/identity_provider_metadata"
-require "saml/kit/invalid_document"
-require "saml/kit/service_provider_metadata"
-require "saml/kit/signature"
+require 'saml/kit/assertion'
+require 'saml/kit/authentication_request'
+require 'saml/kit/bindings'
+require 'saml/kit/configuration'
+require 'saml/kit/default_registry'
+require 'saml/kit/logout_response'
+require 'saml/kit/logout_request'
+require 'saml/kit/metadata'
+require 'saml/kit/null_assertion'
+require 'saml/kit/composite_metadata'
+require 'saml/kit/response'
+require 'saml/kit/identity_provider_metadata'
+require 'saml/kit/invalid_document'
+require 'saml/kit/service_provider_metadata'
+require 'saml/kit/signature'
 
-I18n.load_path += Dir[File.expand_path("kit/locales/*.yml", File.dirname(__FILE__))]
+I18n.load_path +=
+  Dir[File.expand_path('kit/locales/*.yml', File.dirname(__FILE__))]
 
 module Saml
   module Kit

@@ -1,7 +1,7 @@
-require_relative './user'
+require_relative './principal'
 
 RSpec.describe "Logout Request" do
-  let(:user) { User.new(id: SecureRandom.uuid, email: "hello@example.com") }
+  let(:user) { Principal.new(id: SecureRandom.uuid, email: "hello@example.com") }
 
   it 'produces a SAMLRequest' do
     xml = Saml::Kit::Metadata.build_xml do |builder|

@@ -1,7 +1,7 @@
-require_relative './user'
+require_relative './principal'
 
 RSpec.describe "Logout Response" do
-  let(:user) { User.new(id: SecureRandom.uuid, email: "hello@example.com") }
+  let(:user) { Principal.new(id: SecureRandom.uuid, email: "hello@example.com") }
 
   it 'generates a logout response' do
     xml = Saml::Kit::Metadata.build_xml do |builder|

@@ -1,4 +1,4 @@
-class User
+class Principal
   attr_reader :id, :email
 
   def initialize(id:, email:)

@@ -1,7 +1,7 @@
-require_relative './user'
+require_relative './principal'
 
 RSpec.describe "Response" do
-  let(:user) { User.new(id: SecureRandom.uuid, email: "hello@example.com") }
+  let(:user) { Principal.new(id: SecureRandom.uuid, email: "hello@example.com") }
   let(:request) { Saml::Kit::AuthenticationRequest.build }
 
   it 'consumes a Response' do

@@ -1,17 +1,18 @@
 RSpec.describe Saml::Kit::Bindings::Binding do
-  let(:location) { FFaker::Internet.http_url }
   subject { described_class.new(binding: Saml::Kit::Bindings::HTTP_ARTIFACT, location: location) }
 
-  describe "#serialize" do
+  let(:location) { FFaker::Internet.http_url }
+
+  describe '#serialize' do
     it 'ignores other bindings' do
       expect(subject.serialize(Saml::Kit::AuthenticationRequest)).to be_empty
     end
   end
 
-  describe "#deserialize" do
+  describe '#deserialize' do
     it 'raises an error' do
       expect do
-        subject.deserialize('SAMLRequest' => "CORRUPT")
+        subject.deserialize('SAMLRequest' => 'CORRUPT')
       end.to raise_error(/Unsupported binding/)
     end
   end

@@ -1,27 +1,28 @@
 RSpec.describe Saml::Kit::Bindings::HttpPost do
-  let(:location) { FFaker::Internet.uri("https") }
   subject { described_class.new(location: location) }
 
-  describe "equality" do
+  let(:location) { FFaker::Internet.uri('https') }
+
+  describe 'equality' do
     it 'is referentially equal' do
       expect(subject).to eql(subject)
     end
 
     it 'is equal by value' do
       expect(subject).to eql(
-        Saml::Kit::Bindings::HttpPost.new(location: location)
+        described_class.new(location: location)
       )
     end
 
     it 'is not equal' do
-      expect(subject).to_not eql(
-        described_class.new(location: FFaker::Internet.uri("https"))
+      expect(subject).not_to eql(
+        described_class.new(location: FFaker::Internet.uri('https'))
       )
     end
   end
 
-  describe "#serialize" do
-    let(:relay_state) { "ECHO" }
+  describe '#serialize' do
+    let(:relay_state) { 'ECHO' }
     let(:configuration) do
       Saml::Kit::Configuration.new do |config|
         config.generate_key_pair_for(use: :signing)
@@ -42,7 +43,7 @@ RSpec.describe Saml::Kit::Bindings::HttpPost do
     end
 
     it 'returns a SAMLRequest for a LogoutRequest' do
-      user = double(:user, name_id_for: SecureRandom.uuid)
+      user = User.new
       builder = Saml::Kit::LogoutRequest.builder_class.new(user, configuration: configuration)
       url, saml_params = subject.serialize(builder, relay_state: relay_state)
 
@@ -74,11 +75,11 @@ RSpec.describe Saml::Kit::Bindings::HttpPost do
       url, saml_params = subject.serialize(builder)
 
       expect(url).to eql(location)
-      expect(saml_params.keys).to_not include('RelayState')
+      expect(saml_params.keys).not_to include('RelayState')
     end
   end
 
-  describe "#deserialize" do
+  describe '#deserialize' do
     it 'deserializes to an AuthnRequest' do
       builder = Saml::Kit::AuthenticationRequest.builder_class.new
       _, params = subject.serialize(builder)
@@ -87,7 +88,7 @@ RSpec.describe Saml::Kit::Bindings::HttpPost do
     end
 
     it 'deserializes to a LogoutRequest' do
-      user = double(:user, name_id_for: SecureRandom.uuid)
+      user = User.new
       builder = Saml::Kit::LogoutRequest.builder_class.new(user)
       _, params = subject.serialize(builder)
       result = subject.deserialize(params)
@@ -95,8 +96,8 @@ RSpec.describe Saml::Kit::Bindings::HttpPost do
     end
 
     it 'deserializes to a Response' do
-      user = double(:user, name_id_for: SecureRandom.uuid, assertion_attributes_for: [])
-      request = double(:request, id: SecureRandom.uuid, provider: nil, assertion_consumer_service_url: FFaker::Internet.http_url, name_id_format: Saml::Kit::Namespaces::PERSISTENT, issuer: FFaker::Internet.http_url, signed?: true, trusted?: true)
+      user = User.new
+      request = instance_double(Saml::Kit::AuthenticationRequest, id: SecureRandom.uuid, provider: nil, assertion_consumer_service_url: FFaker::Internet.http_url, name_id_format: Saml::Kit::Namespaces::PERSISTENT, issuer: FFaker::Internet.http_url, signed?: true, trusted?: true)
       builder = Saml::Kit::Response.builder_class.new(user, request)
       _, params = subject.serialize(builder)
       result = subject.deserialize(params)

@@ -1,9 +1,10 @@
 RSpec.describe Saml::Kit::Bindings::HttpRedirect do
-  let(:location) { FFaker::Internet.http_url }
   subject { described_class.new(location: location) }
 
-  describe "#serialize" do
-    let(:relay_state) { "ECHO" }
+  let(:location) { FFaker::Internet.http_url }
+
+  describe '#serialize' do
+    let(:relay_state) { 'ECHO' }
     let(:configuration) do
       Saml::Kit::Configuration.new do |config|
         config.generate_key_pair_for(use: :signing)
@@ -12,7 +13,7 @@ RSpec.describe Saml::Kit::Bindings::HttpRedirect do
 
     it 'encodes the request using the HTTP-Redirect encoding' do
       builder = Saml::Kit::AuthenticationRequest.builder(configuration: configuration)
-      url, _ = subject.serialize(builder, relay_state: relay_state)
+      url, = subject.serialize(builder, relay_state: relay_state)
       expect(url).to start_with(location)
       expect(url).to have_query_param('SAMLRequest')
       expect(url).to have_query_param('SigAlg')
@@ -20,28 +21,34 @@ RSpec.describe Saml::Kit::Bindings::HttpRedirect do
     end
   end
 
-  describe "#deserialize" do
+  describe '#deserialize' do
     let(:entity_id) { FFaker::Internet.http_url }
     let(:provider) { Saml::Kit::IdentityProviderMetadata.build }
 
-    before :each do
+    before do
       allow(Saml::Kit.configuration.registry).to receive(:metadata_for).with(entity_id).and_return(provider)
       allow(Saml::Kit.configuration).to receive(:entity_id).and_return(entity_id)
     end
 
     it 'deserializes the SAMLRequest to an AuthnRequest' do
-      url, _ = subject.serialize(Saml::Kit::AuthenticationRequest.builder)
+      url, = subject.serialize(Saml::Kit::AuthenticationRequest.builder)
       result = subject.deserialize(query_params_from(url))
       expect(result).to be_instance_of(Saml::Kit::AuthenticationRequest)
     end
 
+    it 'deserializes the raw query_string to an AuthnRequest' do
+      url, = subject.serialize(Saml::Kit::AuthenticationRequest.builder, relay_state: 'HELLO')
+      result = subject.deserialize(url)
+      expect(result).to be_instance_of(Saml::Kit::AuthenticationRequest)
+    end
+
     it 'deserializes the SAMLRequest to an AuthnRequest with symbols for keys' do
       configuration = Saml::Kit::Configuration.new do |config|
         config.entity_id = entity_id
         config.generate_key_pair_for(use: :signing)
       end
       provider = Saml::Kit::IdentityProviderMetadata.build(configuration: configuration)
-      url, _ = subject.serialize(Saml::Kit::AuthenticationRequest.builder(configuration: configuration))
+      url, = subject.serialize(Saml::Kit::AuthenticationRequest.builder(configuration: configuration))
       allow(configuration.registry).to receive(:metadata_for).with(entity_id).and_return(provider)
 
       result = subject.deserialize(query_params_from(url).symbolize_keys, configuration: configuration)
@@ -50,64 +57,66 @@ RSpec.describe Saml::Kit::Bindings::HttpRedirect do
       expect(result).to be_trusted
     end
 
-    it 'deserializes the SAMLRequest to an AuthnRequest with symbols for keys' do
-      url, _ = subject.serialize(Saml::Kit::AuthenticationRequest.builder)
+    it 'deserializes the SAMLRequest to an AuthnRequest with symbolized keys' do
+      url, = subject.serialize(Saml::Kit::AuthenticationRequest.builder)
       result = subject.deserialize(query_params_from(url).symbolize_keys)
       expect(result).to be_instance_of(Saml::Kit::AuthenticationRequest)
     end
 
     it 'deserializes the SAMLRequest to an AuthnRequest when given a custom params object' do
       class Parameters
+        attr_reader :params
+
         def initialize(params)
           @params = params
         end
 
         def [](key)
-          @params[key]
+          params[key]
         end
       end
-      url, _ = subject.serialize(Saml::Kit::AuthenticationRequest.builder)
+      url, = subject.serialize(Saml::Kit::AuthenticationRequest.builder)
       result = subject.deserialize(Parameters.new(query_params_from(url)))
       expect(result).to be_instance_of(Saml::Kit::AuthenticationRequest)
     end
 
     it 'deserializes the SAMLRequest to a LogoutRequest' do
-      user = double(:user, name_id_for: SecureRandom.uuid)
-      url, _ = subject.serialize(Saml::Kit::LogoutRequest.builder(user))
+      user = User.new
+      url, = subject.serialize(Saml::Kit::LogoutRequest.builder(user))
       result = subject.deserialize(query_params_from(url))
       expect(result).to be_instance_of(Saml::Kit::LogoutRequest)
     end
 
     it 'returns an invalid request when the SAMLRequest is invalid' do
       expect do
-        subject.deserialize({ 'SAMLRequest' => "nonsense" })
+        subject.deserialize('SAMLRequest' => 'nonsense')
       end.to raise_error(Zlib::DataError)
     end
 
     it 'deserializes the SAMLResponse to a Response' do
-      user = double(:user, name_id_for: SecureRandom.uuid, assertion_attributes_for: [])
-      request = double(:request, id: SecureRandom.uuid, provider: nil, assertion_consumer_service_url: FFaker::Internet.http_url, name_id_format: Saml::Kit::Namespaces::PERSISTENT, issuer: entity_id, signed?: true, trusted?: true)
-      url, _ = subject.serialize(Saml::Kit::Response.builder(user, request))
+      user = User.new
+      request = instance_double(Saml::Kit::AuthenticationRequest, id: SecureRandom.uuid, provider: nil, assertion_consumer_service_url: FFaker::Internet.http_url, name_id_format: Saml::Kit::Namespaces::PERSISTENT, issuer: entity_id, signed?: true, trusted?: true)
+      url, = subject.serialize(Saml::Kit::Response.builder(user, request))
       result = subject.deserialize(query_params_from(url))
       expect(result).to be_instance_of(Saml::Kit::Response)
     end
 
     it 'deserializes the SAMLResponse to a LogoutResponse' do
-      request = double(:request, id: SecureRandom.uuid, provider: provider, assertion_consumer_service_url: FFaker::Internet.http_url, name_id_format: Saml::Kit::Namespaces::PERSISTENT, issuer: FFaker::Internet.http_url)
-      url, _ = subject.serialize(Saml::Kit::LogoutResponse.builder(request))
+      request = instance_double(Saml::Kit::LogoutRequest, id: SecureRandom.uuid, provider: provider, issuer: FFaker::Internet.http_url)
+      url, = subject.serialize(Saml::Kit::LogoutResponse.builder(request))
       result = subject.deserialize(query_params_from(url))
       expect(result).to be_instance_of(Saml::Kit::LogoutResponse)
     end
 
     it 'raises an error when the content is invalid' do
       expect do
-        subject.deserialize('SAMLResponse' => "nonsense")
+        subject.deserialize('SAMLResponse' => 'nonsense')
       end.to raise_error(Zlib::DataError)
     end
 
     it 'raises an error when a saml parameter is not specified' do
       expect do
-        subject.deserialize({ })
+        subject.deserialize({})
       end.to raise_error(ArgumentError)
     end
 
@@ -116,7 +125,7 @@ RSpec.describe Saml::Kit::Bindings::HttpRedirect do
         config.entity_id = entity_id
         config.generate_key_pair_for(use: :signing)
       end
-      url, _ = subject.serialize(
+      url, = subject.serialize(
         Saml::Kit::AuthenticationRequest.builder(configuration: configuration) do |x|
           x.embed_signature = true
         end
@@ -134,7 +143,7 @@ RSpec.describe Saml::Kit::Bindings::HttpRedirect do
       end
       allow(Saml::Kit.configuration.registry).to receive(:metadata_for).with(entity_id).and_return(provider)
 
-      url, _ = subject.serialize(Saml::Kit::AuthenticationRequest.builder)
+      url, = subject.serialize(Saml::Kit::AuthenticationRequest.builder)
       result = subject.deserialize(query_params_from(url))
       expect(result).to be_instance_of(Saml::Kit::AuthenticationRequest)
       expect(result).to be_valid
@@ -144,14 +153,14 @@ RSpec.describe Saml::Kit::Bindings::HttpRedirect do
       configuration = Saml::Kit::Configuration.new do |config|
         config.generate_key_pair_for(use: :signing)
       end
-      url, _ = subject.serialize(Saml::Kit::AuthenticationRequest.builder(configuration: configuration))
+      url, = subject.serialize(Saml::Kit::AuthenticationRequest.builder(configuration: configuration))
 
       other_configuration = Saml::Kit::Configuration.new
       allow(other_configuration.registry).to receive(:metadata_for).and_return(nil)
 
       result = subject.deserialize(query_params_from(url), configuration: other_configuration)
-      expect(result).to_not be_signed
-      expect(result).to_not be_trusted
+      expect(result).not_to be_signed
+      expect(result).not_to be_trusted
     end
   end
 end

@@ -1,6 +1,6 @@
 RSpec.describe Saml::Kit::Bindings::UrlBuilder do
-  describe "#build" do
-    let(:xml) { "<xml></xml>" }
+  describe '#build' do
+    let(:xml) { '<xml></xml>' }
     let(:destination) { FFaker::Internet.http_url }
     let(:relay_state) { FFaker::Movie.title }
 
@@ -12,6 +12,7 @@ RSpec.describe Saml::Kit::Bindings::UrlBuilder do
     ].each do |(response_type, query_string_parameter)|
       describe response_type.to_s do
         subject { described_class.new(configuration: configuration) }
+
         let(:configuration) do
           Saml::Kit::Configuration.new do |config|
             config.generate_key_pair_for(use: :signing)
@@ -21,12 +22,12 @@ RSpec.describe Saml::Kit::Bindings::UrlBuilder do
         let(:response) { instance_double(response_type, destination: destination, to_xml: xml, query_string_parameter: query_string_parameter) }
 
         def to_query_params(url)
-          Hash[URI.parse(url).query.split("&").map { |x| x.split('=', 2) }]
+          Hash[URI.parse(url).query.split('&').map { |x| x.split('=', 2) }]
         end
 
         it 'returns a url containing the target location' do
           result_uri = URI.parse(subject.build(response))
-          expect(result_uri.scheme).to eql("http")
+          expect(result_uri.scheme).to eql('http')
           expect(result_uri.host).to eql(URI.parse(destination).host)
         end
 
@@ -34,7 +35,7 @@ RSpec.describe Saml::Kit::Bindings::UrlBuilder do
           result = subject.build(response, relay_state: relay_state)
           query_params = to_query_params(result)
           level = Zlib::BEST_COMPRESSION
-          expected = CGI.escape(Base64.encode64(Zlib::Deflate.deflate(xml, level)[2..-5]).gsub(/\n/, ''))
+          expected = CGI.escape(Base64.encode64(Zlib::Deflate.deflate(xml, level)[2..-5]).delete("\n"))
           expect(result).to include("#{query_string_parameter}=#{expected}")
           expect(query_params[query_string_parameter]).to eql(expected)
         end

@@ -1,14 +1,15 @@
 RSpec.describe Saml::Kit::Builders::AuthenticationRequest do
   subject { described_class.new(configuration: configuration) }
+
   let(:configuration) do
     config = Saml::Kit::Configuration.new
     config.entity_id = issuer
     config
   end
 
-  describe "#to_xml" do
+  describe '#to_xml' do
     let(:issuer) { FFaker::Movie.title }
-    let(:assertion_consumer_service_url) { "https://airport.dev/session/acs" }
+    let(:assertion_consumer_service_url) { 'https://airport.dev/session/acs' }
 
     it 'returns a valid authentication request' do
       travel_to 1.second.from_now

@@ -1,5 +1,6 @@
 RSpec.describe Saml::Kit::Builders::IdentityProviderMetadata do
   subject { described_class.new(configuration: configuration) }
+
   let(:configuration) do
     Saml::Kit::Configuration.new do |config|
       config.generate_key_pair_for(use: :signing)
@@ -8,7 +9,7 @@ RSpec.describe Saml::Kit::Builders::IdentityProviderMetadata do
   end
   let(:email) { FFaker::Internet.email }
   let(:org_name) { FFaker::Movie.title }
-  let(:url) { FFaker::Internet.uri("https") }
+  let(:url) { FFaker::Internet.uri('https') }
   let(:entity_id) { FFaker::Movie.title }
 
   it 'builds a proper metadata' do
@@ -21,9 +22,9 @@ RSpec.describe Saml::Kit::Builders::IdentityProviderMetadata do
       Saml::Kit::Namespaces::TRANSIENT,
       Saml::Kit::Namespaces::EMAIL_ADDRESS,
     ]
-    subject.add_single_sign_on_service("https://www.example.com/login", binding: :http_redirect)
-    subject.add_single_logout_service("https://www.example.com/logout", binding: :http_post)
-    subject.attributes << "id"
+    subject.add_single_sign_on_service('https://www.example.com/login', binding: :http_redirect)
+    subject.add_single_logout_service('https://www.example.com/logout', binding: :http_post)
+    subject.attributes << 'id'
 
     result = Hash.from_xml(subject.build.to_xml)
 
@@ -37,17 +38,17 @@ RSpec.describe Saml::Kit::Builders::IdentityProviderMetadata do
       Saml::Kit::Namespaces::EMAIL_ADDRESS,
     ])
     expect(result['EntityDescriptor']['IDPSSODescriptor']['SingleSignOnService']['Binding']).to eql(Saml::Kit::Bindings::HTTP_REDIRECT)
-    expect(result['EntityDescriptor']['IDPSSODescriptor']['SingleSignOnService']['Location']).to eql("https://www.example.com/login")
+    expect(result['EntityDescriptor']['IDPSSODescriptor']['SingleSignOnService']['Location']).to eql('https://www.example.com/login')
     expect(result['EntityDescriptor']['IDPSSODescriptor']['SingleLogoutService']['Binding']).to eql(Saml::Kit::Bindings::HTTP_POST)
-    expect(result['EntityDescriptor']['IDPSSODescriptor']['SingleLogoutService']['Location']).to eql("https://www.example.com/logout")
-    expect(result['EntityDescriptor']['IDPSSODescriptor']['Attribute']['Name']).to eql("id")
+    expect(result['EntityDescriptor']['IDPSSODescriptor']['SingleLogoutService']['Location']).to eql('https://www.example.com/logout')
+    expect(result['EntityDescriptor']['IDPSSODescriptor']['Attribute']['Name']).to eql('id')
     certificates = result['EntityDescriptor']['IDPSSODescriptor']['KeyDescriptor'].map { |x| x['KeyInfo']['X509Data']['X509Certificate'] }
     expected_certificates = configuration.certificates.map(&:stripped)
     expect(certificates).to match_array(expected_certificates)
     expect(result['EntityDescriptor']['Organization']['OrganizationName']).to eql(org_name)
     expect(result['EntityDescriptor']['Organization']['OrganizationDisplayName']).to eql(org_name)
     expect(result['EntityDescriptor']['Organization']['OrganizationURL']).to eql(url)
-    expect(result['EntityDescriptor']['ContactPerson']['contactType']).to eql("technical")
+    expect(result['EntityDescriptor']['ContactPerson']['contactType']).to eql('technical')
     expect(result['EntityDescriptor']['ContactPerson']['Company']).to eql("mailto:#{email}")
   end
 end

@@ -1,6 +1,7 @@
 RSpec.describe Saml::Kit::Builders::LogoutRequest do
   subject { described_class.new(user, configuration: configuration) }
-  let(:user) { double(:user, name_id_for: name_id) }
+
+  let(:user) { User.new(name_id: name_id) }
   let(:name_id) { SecureRandom.uuid }
   let(:configuration) do
     Saml::Kit::Configuration.new do |config|
@@ -19,7 +20,7 @@ RSpec.describe Saml::Kit::Builders::LogoutRequest do
     xml_hash = Hash.from_xml(result)
 
     expect(xml_hash['LogoutRequest']['ID']).to eql(subject.id)
-    expect(xml_hash['LogoutRequest']['Version']).to eql("2.0")
+    expect(xml_hash['LogoutRequest']['Version']).to eql('2.0')
     expect(xml_hash['LogoutRequest']['IssueInstant']).to eql(Time.now.utc.iso8601)
     expect(xml_hash['LogoutRequest']['Destination']).to eql(subject.destination)
 

@@ -1,11 +1,12 @@
 RSpec.describe Saml::Kit::Builders::LogoutResponse do
   subject { described_class.new(request) }
-  let(:user) { double(:user, name_id_for: SecureRandom.uuid) }
+
+  let(:user) { User.new }
   let(:request) { Saml::Kit::Builders::LogoutRequest.new(user).build }
   let(:issuer) { FFaker::Internet.http_url }
   let(:destination) { FFaker::Internet.http_url }
 
-  describe "#build" do
+  describe '#build' do
     it 'builds a logout response' do
       travel_to 1.second.from_now
 
@@ -14,7 +15,7 @@ RSpec.describe Saml::Kit::Builders::LogoutResponse do
       result = subject.build
       expect(result.id).to be_present
       expect(result.issue_instant).to eql(Time.now.utc)
-      expect(result.version).to eql("2.0")
+      expect(result.version).to eql('2.0')
       expect(result.issuer).to eql(issuer)
       expect(result.status_code).to eql(Saml::Kit::Namespaces::SUCCESS)
       expect(result.in_response_to).to eql(request.id)

@@ -1,7 +1,8 @@
 RSpec.describe Saml::Kit::Builders::Metadata do
-  describe ".build" do
+  describe '.build' do
     subject { Saml::Kit::Metadata }
-    let(:url) { FFaker::Internet.uri("https") }
+
+    let(:url) { FFaker::Internet.uri('https') }
 
     it 'builds metadata for a service provider' do
       result = subject.build do |builder|
@@ -57,7 +58,7 @@ RSpec.describe Saml::Kit::Builders::Metadata do
         3.times { config.generate_key_pair_for(use: :signing) }
       end
       metadata = Saml::Kit::Metadata.build(configuration: configuration) do |builder|
-        builder.entity_id = FFaker::Internet.uri("https")
+        builder.entity_id = FFaker::Internet.uri('https')
         builder.build_identity_provider do |x|
           x.embed_signature = true
           x.add_single_sign_on_service(url, binding: :http_post)

@@ -1,5 +1,6 @@
 RSpec.describe Saml::Kit::Builders::Response do
   subject { described_class.new(user, request, configuration: configuration) }
+
   let(:configuration) do
     Saml::Kit::Configuration.new do |config|
       config.entity_id = issuer
@@ -8,13 +9,13 @@ RSpec.describe Saml::Kit::Builders::Response do
     end
   end
   let(:email) { FFaker::Internet.email }
-  let(:assertion_consumer_service_url) { FFaker::Internet.uri("https") }
-  let(:user) { double(:user, name_id_for: SecureRandom.uuid, assertion_attributes_for: { email: email, created_at: Time.now.utc.iso8601 }) }
-  let(:request) { double(:request, id: Xml::Kit::Id.generate, assertion_consumer_service_url: assertion_consumer_service_url, issuer: issuer, name_id_format: Saml::Kit::Namespaces::EMAIL_ADDRESS, provider: provider, trusted?: true, signed?: true) }
-  let(:provider) { double(:provider, want_assertions_signed: false, encryption_certificates: [configuration.certificates(use: :encryption).last] ) }
-  let(:issuer) { FFaker::Internet.uri("https") }
+  let(:assertion_consumer_service_url) { FFaker::Internet.uri('https') }
+  let(:user) { User.new(attributes: { email: email, created_at: Time.now.utc.iso8601 }) }
+  let(:request) { instance_double(Saml::Kit::AuthenticationRequest, id: Xml::Kit::Id.generate, assertion_consumer_service_url: assertion_consumer_service_url, issuer: issuer, name_id_format: Saml::Kit::Namespaces::EMAIL_ADDRESS, provider: provider, trusted?: true, signed?: true) }
+  let(:provider) { instance_double(Saml::Kit::ServiceProviderMetadata, want_assertions_signed: false, encryption_certificates: [configuration.certificates(use: :encryption).last]) }
+  let(:issuer) { FFaker::Internet.uri('https') }
 
-  describe "#build" do
+  describe '#build' do
     it 'builds a response with the request_id' do
       expect(subject.build.request_id).to eql(request.id)
     end
@@ -37,7 +38,7 @@ RSpec.describe Saml::Kit::Builders::Response do
     end
   end
 
-  describe "#to_xml" do
+  describe '#to_xml' do
     it 'returns a proper response for the user' do
       travel_to 1.second.from_now
       allow(Saml::Kit.configuration).to receive(:entity_id).and_return(issuer)
@@ -51,15 +52,15 @@ RSpec.describe Saml::Kit::Builders::Response do
       expect(hash['Response']['Destination']).to eql(assertion_consumer_service_url)
       expect(hash['Response']['InResponseTo']).to eql(request.id)
       expect(hash['Response']['Issuer']).to eql(issuer)
-      expect(hash['Response']['Status']['StatusCode']['Value']).to eql("urn:oasis:names:tc:SAML:2.0:status:Success")
+      expect(hash['Response']['Status']['StatusCode']['Value']).to eql('urn:oasis:names:tc:SAML:2.0:status:Success')
 
       expect(hash['Response']['Assertion']['ID']).to be_present
       expect(hash['Response']['Assertion']['IssueInstant']).to eql(Time.now.utc.iso8601)
-      expect(hash['Response']['Assertion']['Version']).to eql("2.0")
+      expect(hash['Response']['Assertion']['Version']).to eql('2.0')
       expect(hash['Response']['Assertion']['Issuer']).to eql(issuer)
 
-      expect(hash['Response']['Assertion']['Subject']['NameID']).to eql(user.name_id_for)
-      expect(hash['Response']['Assertion']['Subject']['SubjectConfirmation']['Method']).to eql("urn:oasis:names:tc:SAML:2.0:cm:bearer")
+      expect(hash['Response']['Assertion']['Subject']['NameID']).to eql(user.name_id)
+      expect(hash['Response']['Assertion']['Subject']['SubjectConfirmation']['Method']).to eql('urn:oasis:names:tc:SAML:2.0:cm:bearer')
       expect(hash['Response']['Assertion']['Subject']['SubjectConfirmation']['SubjectConfirmationData']['NotOnOrAfter']).to eql(3.hours.from_now.utc.iso8601)
       expect(hash['Response']['Assertion']['Subject']['SubjectConfirmation']['SubjectConfirmationData']['Recipient']).to eql(assertion_consumer_service_url)
       expect(hash['Response']['Assertion']['Subject']['SubjectConfirmation']['SubjectConfirmationData']['InResponseTo']).to eql(request.id)
@@ -145,13 +146,13 @@ RSpec.describe Saml::Kit::Builders::Response do
       subject.embed_signature = false
 
       result = Saml::Kit::Response.new(subject.to_xml, configuration: configuration)
-      expect(result).to_not be_signed
-      expect(result.assertion).to_not be_signed
+      expect(result).not_to be_signed
+      expect(result.assertion).not_to be_signed
       expect(result.assertion).to be_encrypted
     end
   end
 
-  describe ".build" do
+  describe '.build' do
     let(:configuration) do
       Saml::Kit::Configuration.new do |config|
         config.entity_id = issuer

@@ -1,5 +1,6 @@
 RSpec.describe Saml::Kit::Builders::ServiceProviderMetadata do
   subject { described_class.new(configuration: configuration) }
+
   let(:configuration) do
     Saml::Kit::Configuration.new do |config|
       config.generate_key_pair_for(use: :signing)
@@ -9,8 +10,8 @@ RSpec.describe Saml::Kit::Builders::ServiceProviderMetadata do
   let(:assertion_consumer_service_url) { FFaker::Internet.http_url }
   let(:email) { FFaker::Internet.email }
   let(:org_name) { FFaker::Movie.title }
-  let(:url) { FFaker::Internet.uri("https") }
-  let(:entity_id) { FFaker::Internet.uri("https") }
+  let(:url) { FFaker::Internet.uri('https') }
+  let(:entity_id) { FFaker::Internet.uri('https') }
 
   it 'builds the service provider metadata' do
     subject.contact_email = email
@@ -25,7 +26,7 @@ RSpec.describe Saml::Kit::Builders::ServiceProviderMetadata do
     ]
     result = Hash.from_xml(subject.build.to_xml)
 
-    expect(result['EntityDescriptor']['xmlns']).to eql("urn:oasis:names:tc:SAML:2.0:metadata")
+    expect(result['EntityDescriptor']['xmlns']).to eql('urn:oasis:names:tc:SAML:2.0:metadata')
     expect(result['EntityDescriptor']['ID']).to be_present
     expect(result['EntityDescriptor']['entityID']).to eql(entity_id)
     expect(result['EntityDescriptor']['SPSSODescriptor']['AuthnRequestsSigned']).to eql('true')
@@ -36,18 +37,18 @@ RSpec.describe Saml::Kit::Builders::ServiceProviderMetadata do
       Saml::Kit::Namespaces::TRANSIENT,
       Saml::Kit::Namespaces::EMAIL_ADDRESS,
     ])
-    expect(result['EntityDescriptor']['SPSSODescriptor']['AssertionConsumerService']['Binding']).to eql("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST")
+    expect(result['EntityDescriptor']['SPSSODescriptor']['AssertionConsumerService']['Binding']).to eql('urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST')
     expect(result['EntityDescriptor']['SPSSODescriptor']['AssertionConsumerService']['Location']).to eql(assertion_consumer_service_url)
     expect(result['EntityDescriptor']['SPSSODescriptor']['AssertionConsumerService']['isDefault']).to eql('true')
     expect(result['EntityDescriptor']['SPSSODescriptor']['AssertionConsumerService']['index']).to eql('0')
     expect(result['EntityDescriptor']['Signature']).to be_present
-    expect(result['EntityDescriptor']['SPSSODescriptor']['KeyDescriptor'].map { |x| x['use'] }).to match_array(['signing', 'encryption'])
+    expect(result['EntityDescriptor']['SPSSODescriptor']['KeyDescriptor'].map { |x| x['use'] }).to match_array(%w[signing encryption])
     expected_certificates = configuration.certificates.map(&:stripped)
     expect(result['EntityDescriptor']['SPSSODescriptor']['KeyDescriptor'].map { |x| x['KeyInfo']['X509Data']['X509Certificate'] }).to match_array(expected_certificates)
     expect(result['EntityDescriptor']['Organization']['OrganizationName']).to eql(org_name)
     expect(result['EntityDescriptor']['Organization']['OrganizationDisplayName']).to eql(org_name)
     expect(result['EntityDescriptor']['Organization']['OrganizationURL']).to eql(url)
-    expect(result['EntityDescriptor']['ContactPerson']['contactType']).to eql("technical")
+    expect(result['EntityDescriptor']['ContactPerson']['contactType']).to eql('technical')
     expect(result['EntityDescriptor']['ContactPerson']['Company']).to eql("mailto:#{email}")
   end
 end

@@ -0,0 +1,204 @@
+RSpec.describe Saml::Kit::Assertion do
+  describe '#active?' do
+    let(:configuration) do
+      Saml::Kit::Configuration.new do |config|
+        config.session_timeout = 30.minutes
+        config.clock_drift = 30.seconds
+      end
+    end
+
+    it 'is valid after a valid session window + drift' do
+      now = Time.current
+      travel_to now
+      not_on_or_after = configuration.session_timeout.since(now).iso8601
+      xml = <<-XML.strip_heredoc
+        <Response>
+        <Assertion xmlns="#{Saml::Kit::Namespaces::ASSERTION}" ID="#{Xml::Kit::Id.generate}" IssueInstant="#{now.iso8601}" Version="2.0">
+         <Issuer>#{FFaker::Internet.uri('https')}</Issuer>
+         <Subject>
+           <NameID Format="#{Saml::Kit::Namespaces::PERSISTENT}">#{SecureRandom.uuid}</NameID>
+           <SubjectConfirmation Method="#{Saml::Kit::Namespaces::BEARER}">
+             <SubjectConfirmationData InResponseTo="#{SecureRandom.uuid}" NotOnOrAfter="#{not_on_or_after}" Recipient="#{FFaker::Internet.uri('https')}"/>
+           </SubjectConfirmation>
+         </Subject>
+         <Conditions NotBefore="#{now.utc.iso8601}" NotOnOrAfter="#{not_on_or_after}">
+           <AudienceRestriction>
+             <Audience>#{FFaker::Internet.uri('https')}</Audience>
+           </AudienceRestriction>
+         </Conditions>
+         <AuthnStatement AuthnInstant="#{now.utc.iso8601}" SessionIndex="#{Xml::Kit::Id.generate}" SessionNotOnOrAfter="#{not_on_or_after}">
+           <AuthnContext>
+             <AuthnContextClassRef>#{Saml::Kit::Namespaces::PASSWORD}</AuthnContextClassRef>
+           </AuthnContext>
+         </AuthnStatement>
+        </Assertion>
+        </Response>
+XML
+      subject = described_class.new(Nokogiri::XML(xml), configuration: configuration)
+      travel_to((configuration.clock_drift - 1.second).before(now))
+      expect(subject).to be_active
+      expect(subject).not_to be_expired
+    end
+
+    it 'interprets integers correctly' do
+      configuration.clock_drift = 30
+      now = Time.current
+      travel_to now
+      not_before = now.utc.iso8601
+      not_after = configuration.session_timeout.since(now).iso8601
+      xml = <<-XML.strip_heredoc
+        <Response>
+        <Assertion xmlns="#{Saml::Kit::Namespaces::ASSERTION}" ID="#{Xml::Kit::Id.generate}" IssueInstant="#{now.iso8601}" Version="2.0">
+         <Issuer>#{FFaker::Internet.uri('https')}</Issuer>
+         <Subject>
+           <NameID Format="#{Saml::Kit::Namespaces::PERSISTENT}">#{SecureRandom.uuid}</NameID>
+           <SubjectConfirmation Method="#{Saml::Kit::Namespaces::BEARER}">
+             <SubjectConfirmationData InResponseTo="#{SecureRandom.uuid}" NotOnOrAfter="#{not_after}" Recipient="#{FFaker::Internet.uri('https')}"/>
+           </SubjectConfirmation>
+         </Subject>
+         <Conditions NotBefore="#{not_before}" NotOnOrAfter="#{not_after}">
+           <AudienceRestriction>
+             <Audience>#{FFaker::Internet.uri('https')}</Audience>
+           </AudienceRestriction>
+         </Conditions>
+         <AuthnStatement AuthnInstant="#{now.utc.iso8601}" SessionIndex="#{Xml::Kit::Id.generate}" SessionNotOnOrAfter="#{not_after}">
+           <AuthnContext>
+             <AuthnContextClassRef>#{Saml::Kit::Namespaces::PASSWORD}</AuthnContextClassRef>
+           </AuthnContext>
+         </AuthnStatement>
+        </Assertion>
+        </Response>
+XML
+      subject = described_class.new(Nokogiri::XML(xml), configuration: configuration)
+      expect(subject).to be_active
+      expect(subject).not_to be_expired
+    end
+  end
+
+  describe '#present?' do
+    it 'returns false when the assertion is empty' do
+      subject = described_class.new(nil)
+      expect(subject).not_to be_present
+    end
+
+    it 'returns true when the assertion is present' do
+      not_before = Time.now.utc.iso8601
+      not_after = 10.minutes.from_now.iso8601
+      xml = <<-XML.strip_heredoc
+        <Response>
+        <Assertion xmlns="#{Saml::Kit::Namespaces::ASSERTION}" ID="#{Xml::Kit::Id.generate}" IssueInstant="#{Time.now.iso8601}" Version="2.0">
+         <Issuer>#{FFaker::Internet.uri('https')}</Issuer>
+         <Subject>
+           <NameID Format="#{Saml::Kit::Namespaces::PERSISTENT}">#{SecureRandom.uuid}</NameID>
+           <SubjectConfirmation Method="#{Saml::Kit::Namespaces::BEARER}">
+             <SubjectConfirmationData InResponseTo="#{SecureRandom.uuid}" NotOnOrAfter="#{not_after}" Recipient="#{FFaker::Internet.uri('https')}"/>
+           </SubjectConfirmation>
+         </Subject>
+         <Conditions NotBefore="#{not_before}" NotOnOrAfter="#{not_after}">
+           <AudienceRestriction>
+             <Audience>#{FFaker::Internet.uri('https')}</Audience>
+           </AudienceRestriction>
+         </Conditions>
+         <AuthnStatement AuthnInstant="#{Time.now.utc.iso8601}" SessionIndex="#{Xml::Kit::Id.generate}" SessionNotOnOrAfter="#{not_after}">
+           <AuthnContext>
+             <AuthnContextClassRef>#{Saml::Kit::Namespaces::PASSWORD}</AuthnContextClassRef>
+           </AuthnContext>
+         </AuthnStatement>
+        </Assertion>
+        </Response>
+XML
+      subject = described_class.new(Nokogiri::XML(xml))
+      expect(subject).to be_present
+    end
+  end
+
+  describe '#signed?' do
+    let(:request) { instance_double(Saml::Kit::AuthenticationRequest, id: ::Xml::Kit::Id.generate, issuer: FFaker::Internet.http_url, assertion_consumer_service_url: FFaker::Internet.http_url, name_id_format: Saml::Kit::Namespaces::PERSISTENT, provider: nil, signed?: true, trusted?: true) }
+    let(:user) { User.new(attributes: { id: SecureRandom.uuid }) }
+
+    it 'detects a signature in an encrypted assertion' do
+      encryption_key_pair = Xml::Kit::KeyPair.generate(use: :encryption)
+      response = Saml::Kit::Response.build(user, request) do |x|
+        x.sign_with(Xml::Kit::KeyPair.generate(use: :signing))
+        x.encrypt_with(encryption_key_pair)
+      end
+      assertion = response.assertion([encryption_key_pair.private_key])
+      expect(response).to be_signed
+      expect(assertion).to be_signed
+    end
+  end
+
+  describe '#to_xml' do
+    let(:request) { instance_double(Saml::Kit::AuthenticationRequest, id: ::Xml::Kit::Id.generate, issuer: FFaker::Internet.http_url, assertion_consumer_service_url: FFaker::Internet.http_url, name_id_format: Saml::Kit::Namespaces::PERSISTENT, provider: nil, signed?: true, trusted?: true) }
+    let(:user) { User.new(attributes: { id: SecureRandom.uuid }) }
+
+    it 'returns the decrypted xml' do
+      encryption_key_pair = Xml::Kit::KeyPair.generate(use: :encryption)
+      response = Saml::Kit::Response.build(user, request) do |x|
+        x.sign_with(Xml::Kit::KeyPair.generate(use: :signing))
+        x.encrypt_with(encryption_key_pair)
+      end
+      assertion = response.assertion([encryption_key_pair.private_key])
+      expect(assertion.to_xml).not_to include('EncryptedAssertion')
+      expect(assertion.to_xml).to include('Assertion')
+    end
+  end
+
+  describe '#valid?' do
+    let(:entity_id) { FFaker::Internet.uri('https') }
+    let(:request) { instance_double(Saml::Kit::AuthenticationRequest, id: ::Xml::Kit::Id.generate, issuer: entity_id, assertion_consumer_service_url: FFaker::Internet.http_url, name_id_format: Saml::Kit::Namespaces::PERSISTENT, provider: nil, signed?: true, trusted?: true) }
+    let(:name_id) { SecureRandom.uuid }
+    let(:user) { User.new(name_id: name_id, attributes: { id: SecureRandom.uuid }) }
+    let(:registry) { instance_double(Saml::Kit::DefaultRegistry, metadata_for: idp) }
+    let(:idp) { Saml::Kit::IdentityProviderMetadata.build(configuration: configuration) }
+    let(:configuration) do
+      Saml::Kit::Configuration.new do |x|
+        x.entity_id = entity_id
+        x.generate_key_pair_for(use: :signing)
+      end
+    end
+
+    before do
+      allow(configuration.registry).to receive(:metadata_for).with(entity_id).and_return(idp)
+    end
+
+    it 'is invalid when the encrypted signature is invalid' do
+      xml = Saml::Kit::Response.build_xml(user, request, configuration: configuration)
+      altered = xml.gsub(name_id, 'altered')
+      document = Nokogiri::XML(altered)
+      assertion = document.at_xpath('/samlp:Response/saml:Assertion', Saml::Kit::Document::NAMESPACES)
+      key_pair = Xml::Kit::KeyPair.generate(use: :encryption)
+      encrypted = Xml::Kit::Encryption.new(assertion.to_xml, key_pair.public_key).to_xml
+      response = Saml::Kit::Response.new(encrypted, configuration: configuration)
+      expect(response.assertion([key_pair.private_key])).to be_invalid
+    end
+
+    it 'is valid when the encrypted signature is valid' do
+      key_pair = Xml::Kit::KeyPair.generate(use: :encryption)
+      response = Saml::Kit::Response.build(user, request, configuration: configuration) do |x|
+        x.encrypt_with(key_pair)
+      end
+      expect(response.assertion([key_pair.private_key])).to be_valid
+    end
+
+    it 'is invalid when the assertion signature is invalid' do
+      xml = Saml::Kit::Response.build_xml(user, request, configuration: configuration)
+      altered = xml.gsub(name_id, 'altered')
+      response = Saml::Kit::Response.new(altered, configuration: configuration)
+      expect(response.assertion).to be_invalid
+      expect(response.assertion.errors[:digest_value]).to match_array(['is invalid.'])
+    end
+
+    it 'is invalid when the response signature is invalid' do
+      xml = Saml::Kit::Response.build_xml(user, request, configuration: configuration)
+      altered = xml.gsub('StatusCode', 'ALTERED')
+      response = Saml::Kit::Response.new(altered, configuration: configuration)
+      expect(response).to be_invalid
+    end
+
+    it 'is valid' do
+      response = Saml::Kit::Response.build(user, request, configuration: configuration)
+      expect(response.assertion).to be_valid
+    end
+  end
+end

@@ -1,5 +1,6 @@
 RSpec.describe Saml::Kit::AuthenticationRequest do
   subject { described_class.new(raw_xml, configuration: configuration) }
+
   let(:id) { Xml::Kit::Id.generate }
   let(:assertion_consumer_service_url) { "https://#{FFaker::Internet.domain_name}/acs" }
   let(:issuer) { FFaker::Movie.title }
@@ -27,11 +28,11 @@ RSpec.describe Saml::Kit::AuthenticationRequest do
   it { expect(subject.name_id_format).to eql(name_id_format) }
   it { expect(subject.destination).to eql(destination) }
 
-  describe "#valid?" do
+  describe '#valid?' do
     let(:registry) { instance_double(Saml::Kit::DefaultRegistry) }
     let(:metadata) { Saml::Kit::ServiceProviderMetadata.build(configuration: configuration) }
 
-    before :each do
+    before do
       allow(configuration).to receive(:registry).and_return(registry)
       allow(registry).to receive(:metadata_for).and_return(metadata)
     end
@@ -82,10 +83,10 @@ RSpec.describe Saml::Kit::AuthenticationRequest do
       id = Xml::Kit::Id.generate
       key_pair = ::Xml::Kit::KeyPair.generate(use: :signing)
       signed_xml = ::Xml::Kit::Signatures.sign(key_pair: key_pair) do |xml, signature|
-        xml.tag!('samlp:AuthnRequest', "xmlns:samlp" => Saml::Kit::Namespaces::PROTOCOL, AssertionConsumerServiceURL: assertion_consumer_service_url, ID: id) do
+        xml.tag!('samlp:AuthnRequest', 'xmlns:samlp' => Saml::Kit::Namespaces::PROTOCOL, AssertionConsumerServiceURL: assertion_consumer_service_url, ID: id) do
           signature.template(id)
           xml.Fake do
-            xml.NotAllowed "Huh?"
+            xml.NotAllowed 'Huh?'
           end
         end
       end
@@ -94,11 +95,11 @@ RSpec.describe Saml::Kit::AuthenticationRequest do
 
     it 'validates a request without a signature' do
       now = Time.now.utc
-      raw_xml = <<-XML
-<samlp:AuthnRequest AssertionConsumerServiceURL='#{assertion_consumer_service_url}' ID='#{Xml::Kit::Id.generate}' IssueInstant='#{now.iso8601}' Version='2.0' xmlns:saml='#{Saml::Kit::Namespaces::ASSERTION}' xmlns:samlp='#{Saml::Kit::Namespaces::PROTOCOL}'>
-  <saml:Issuer>#{issuer}</saml:Issuer>
-  <samlp:NameIDPolicy AllowCreate='true' Format='#{Saml::Kit::Namespaces::EMAIL_ADDRESS}'/>
-</samlp:AuthnRequest>
+      raw_xml = <<-XML.strip_heredoc
+        <samlp:AuthnRequest AssertionConsumerServiceURL='#{assertion_consumer_service_url}' ID='#{Xml::Kit::Id.generate}' IssueInstant='#{now.iso8601}' Version='2.0' xmlns:saml='#{Saml::Kit::Namespaces::ASSERTION}' xmlns:samlp='#{Saml::Kit::Namespaces::PROTOCOL}'>
+          <saml:Issuer>#{issuer}</saml:Issuer>
+          <samlp:NameIDPolicy AllowCreate='true' Format='#{Saml::Kit::Namespaces::EMAIL_ADDRESS}'/>
+        </samlp:AuthnRequest>
       XML
 
       subject = described_class.new(raw_xml, configuration: configuration)
@@ -108,11 +109,11 @@ RSpec.describe Saml::Kit::AuthenticationRequest do
 
     it 'is valid when there is no signature, and the issuer is registered' do
       now = Time.now.utc
-      raw_xml = <<-XML
-<samlp:AuthnRequest AssertionConsumerServiceURL='#{assertion_consumer_service_url}' ID='#{Xml::Kit::Id.generate}' IssueInstant='#{now.iso8601}' Version='2.0' xmlns:saml='#{Saml::Kit::Namespaces::ASSERTION}' xmlns:samlp='#{Saml::Kit::Namespaces::PROTOCOL}'>
-  <saml:Issuer>#{issuer}</saml:Issuer>
-  <samlp:NameIDPolicy AllowCreate='true' Format='#{Saml::Kit::Namespaces::PERSISTENT}'/>
-</samlp:AuthnRequest>
+      raw_xml = <<-XML.strip_heredoc
+        <samlp:AuthnRequest AssertionConsumerServiceURL='#{assertion_consumer_service_url}' ID='#{Xml::Kit::Id.generate}' IssueInstant='#{now.iso8601}' Version='2.0' xmlns:saml='#{Saml::Kit::Namespaces::ASSERTION}' xmlns:samlp='#{Saml::Kit::Namespaces::PROTOCOL}'>
+          <saml:Issuer>#{issuer}</saml:Issuer>
+          <samlp:NameIDPolicy AllowCreate='true' Format='#{Saml::Kit::Namespaces::PERSISTENT}'/>
+        </samlp:AuthnRequest>
       XML
 
       allow(registry).to receive(:metadata_for).with(issuer).and_return(metadata)
@@ -122,11 +123,11 @@ RSpec.describe Saml::Kit::AuthenticationRequest do
 
     it 'is invalid when there is no signature, and the issuer is not registered' do
       now = Time.now.utc
-      raw_xml = <<-XML
-<samlp:AuthnRequest AssertionConsumerServiceURL='#{assertion_consumer_service_url}' ID='#{Xml::Kit::Id.generate}' IssueInstant='#{now.iso8601}' Version='2.0' xmlns:saml='#{Saml::Kit::Namespaces::ASSERTION}' xmlns:samlp='#{Saml::Kit::Namespaces::PROTOCOL}'>
-  <saml:Issuer>#{issuer}</saml:Issuer>
-  <samlp:NameIDPolicy AllowCreate='true' Format='#{Saml::Kit::Namespaces::PERSISTENT}'/>
-</samlp:AuthnRequest>
+      raw_xml = <<-XML.strip_heredoc
+        <samlp:AuthnRequest AssertionConsumerServiceURL='#{assertion_consumer_service_url}' ID='#{Xml::Kit::Id.generate}' IssueInstant='#{now.iso8601}' Version='2.0' xmlns:saml='#{Saml::Kit::Namespaces::ASSERTION}' xmlns:samlp='#{Saml::Kit::Namespaces::PROTOCOL}'>
+          <saml:Issuer>#{issuer}</saml:Issuer>
+          <samlp:NameIDPolicy AllowCreate='true' Format='#{Saml::Kit::Namespaces::PERSISTENT}'/>
+        </samlp:AuthnRequest>
       XML
 
       allow(registry).to receive(:metadata_for).with(issuer).and_return(nil)
@@ -134,7 +135,7 @@ RSpec.describe Saml::Kit::AuthenticationRequest do
       expect(subject).to be_invalid
     end
 
-    context "when the certificate is expired" do
+    context 'when the certificate is expired' do
       let(:expired_certificate) do
         certificate = OpenSSL::X509::Certificate.new
         certificate.public_key = private_key.public_key
@@ -145,7 +146,7 @@ RSpec.describe Saml::Kit::AuthenticationRequest do
       let(:private_key) { OpenSSL::PKey::RSA.new(2048) }
       let(:digest_algorithm) { OpenSSL::Digest::SHA256.new }
 
-      before :each do
+      before do
         expired_certificate.sign(private_key, digest_algorithm)
       end
 
@@ -162,7 +163,7 @@ RSpec.describe Saml::Kit::AuthenticationRequest do
     end
   end
 
-  describe "#assertion_consumer_service_url" do
+  describe '#assertion_consumer_service_url' do
     let(:registry) { instance_double(Saml::Kit::DefaultRegistry) }
     let(:metadata) { instance_double(Saml::Kit::ServiceProviderMetadata) }
 
@@ -182,9 +183,9 @@ RSpec.describe Saml::Kit::AuthenticationRequest do
     end
   end
 
-  describe ".build" do
-    let(:url) { FFaker::Internet.uri("https") }
-    let(:entity_id) { FFaker::Internet.uri("https") }
+  describe '.build' do
+    let(:url) { FFaker::Internet.uri('https') }
+    let(:entity_id) { FFaker::Internet.uri('https') }
 
     it 'provides a nice API for building metadata' do
       result = described_class.build do |builder|
@@ -198,17 +199,17 @@ RSpec.describe Saml::Kit::AuthenticationRequest do
     end
   end
 
-  describe "#response_for" do
-    let(:user) { double(:user, name_id_for: SecureRandom.uuid, assertion_attributes_for: []) }
+  describe '#response_for' do
+    let(:user) { User.new }
     let(:provider) do
       Saml::Kit::ServiceProviderMetadata.build do |x|
-        x.add_assertion_consumer_service(FFaker::Internet.uri("https"), binding: :http_post)
+        x.add_assertion_consumer_service(FFaker::Internet.uri('https'), binding: :http_post)
       end
     end
 
     it 'serializes a response' do
       allow(subject).to receive(:provider).and_return(provider)
-      url, saml_params = subject.response_for(user, binding: :http_post, relay_state: FFaker::Movie.title)
+      _url, saml_params = subject.response_for(user, binding: :http_post, relay_state: FFaker::Movie.title)
 
       response = provider.assertion_consumer_service_for(binding: :http_post).deserialize(saml_params)
       expect(response).to be_instance_of(Saml::Kit::Response)
@@ -220,7 +221,7 @@ RSpec.describe Saml::Kit::AuthenticationRequest do
         config.generate_key_pair_for(use: :signing)
       end
       key_pair = configuration.key_pairs(use: :signing).first
-      url, saml_params = subject.response_for(user, binding: :http_post, configuration: configuration) do |builder|
+      _url, saml_params = subject.response_for(user, binding: :http_post, configuration: configuration) do |builder|
         builder.sign_with(key_pair)
       end
 
@@ -228,4 +229,16 @@ RSpec.describe Saml::Kit::AuthenticationRequest do
       expect(response).to be_instance_of(Saml::Kit::Response)
     end
   end
+
+  describe '#signature.valid?' do
+    it 'returns true when the signature is valid' do
+      expect(subject.signature).to be_valid
+    end
+
+    it 'returns false when the signature does not match' do
+      raw_xml.gsub!(issuer, 'corrupt')
+      subject = described_class.new(raw_xml, configuration: configuration)
+      expect(subject.signature).not_to be_valid
+    end
+  end
 end

@@ -1,15 +1,16 @@
 RSpec.describe Saml::Kit::Bindings do
-  describe ".to_symbol" do
+  describe '.to_symbol' do
     subject { described_class }
 
-    it { expect(subject.to_symbol(Saml::Kit::Bindings::HTTP_POST)).to eql(:http_post) }
-    it { expect(subject.to_symbol(Saml::Kit::Bindings::HTTP_REDIRECT)).to eql(:http_redirect) }
+    it { expect(subject.to_symbol(Saml::Kit::Bindings::HTTP_POST)).to be(:http_post) }
+    it { expect(subject.to_symbol(Saml::Kit::Bindings::HTTP_REDIRECT)).to be(:http_redirect) }
     it { expect(subject.to_symbol('unknown')).to eql('unknown') }
   end
 
-  describe ".create_for" do
+  describe '.create_for' do
     subject { described_class }
-    let(:location) { FFaker::Internet.uri("https") }
+
+    let(:location) { FFaker::Internet.uri('https') }
 
     it 'returns an HTTP redirect binding' do
       expect(

@@ -1,72 +1,73 @@
 RSpec.describe Saml::Kit::CompositeMetadata do
   subject { described_class.new(xml) }
-  let(:post_binding) { Saml::Kit::Bindings::HTTP_POST  }
+
+  let(:post_binding) { Saml::Kit::Bindings::HTTP_POST }
   let(:redirect_binding) { Saml::Kit::Bindings::HTTP_REDIRECT }
-  let(:sign_on_service) { FFaker::Internet.uri("https") }
-  let(:assertion_consumer_service) { FFaker::Internet.uri("https") }
-  let(:sp_logout_service) { FFaker::Internet.uri("https") }
-  let(:idp_logout_service) { FFaker::Internet.uri("https") }
-  let(:entity_id) { FFaker::Internet.uri("https") }
+  let(:sign_on_service) { FFaker::Internet.uri('https') }
+  let(:assertion_consumer_service) { FFaker::Internet.uri('https') }
+  let(:sp_logout_service) { FFaker::Internet.uri('https') }
+  let(:idp_logout_service) { FFaker::Internet.uri('https') }
+  let(:entity_id) { FFaker::Internet.uri('https') }
   let(:sp_signing_certificate) { ::Xml::Kit::KeyPair.generate(use: :signing).certificate }
   let(:sp_encryption_certificate) { ::Xml::Kit::KeyPair.generate(use: :encryption).certificate }
   let(:idp_signing_certificate) { ::Xml::Kit::KeyPair.generate(use: :signing).certificate }
   let(:idp_encryption_certificate) { ::Xml::Kit::KeyPair.generate(use: :encryption).certificate }
   let(:xml) do
-    <<-XML
-<EntityDescriptor xmlns="#{Saml::Kit::Namespaces::METADATA}" ID="#{::Xml::Kit::Id.generate}" entityID="#{entity_id}">
-  <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="#{Saml::Kit::Namespaces::PROTOCOL}">
-    <KeyDescriptor use="signing">
-      <KeyInfo xmlns="#{::Xml::Kit::Namespaces::XMLDSIG}">
-        <X509Data>
-          <X509Certificate>#{sp_signing_certificate.stripped}</X509Certificate>
-        </X509Data>
-      </KeyInfo>
-    </KeyDescriptor>
-    <KeyDescriptor use="encryption">
-      <KeyInfo xmlns="#{::Xml::Kit::Namespaces::XMLDSIG}">
-        <X509Data>
-          <X509Certificate>#{sp_encryption_certificate.stripped}</X509Certificate>
-        </X509Data>
-      </KeyInfo>
-    </KeyDescriptor>
-    <SingleLogoutService Binding="#{post_binding}" Location="#{sp_logout_service}"/>
-    <NameIDFormat>#{Saml::Kit::Namespaces::PERSISTENT}</NameIDFormat>
-    <AssertionConsumerService Binding="#{post_binding}" Location="#{assertion_consumer_service}" index="0" isDefault="true"/>
-  </SPSSODescriptor>
-  <IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="#{Saml::Kit::Namespaces::PROTOCOL}">
-    <KeyDescriptor use="signing">
-      <KeyInfo xmlns="#{::Xml::Kit::Namespaces::XMLDSIG}">
-        <X509Data>
-          <X509Certificate>#{idp_signing_certificate.stripped}</X509Certificate>
-        </X509Data>
-      </KeyInfo>
-    </KeyDescriptor>
-    <KeyDescriptor use="encryption">
-      <KeyInfo xmlns="#{::Xml::Kit::Namespaces::XMLDSIG}">
-        <X509Data>
-          <X509Certificate>#{idp_encryption_certificate.stripped}</X509Certificate>
-        </X509Data>
-      </KeyInfo>
-    </KeyDescriptor>
-    <SingleLogoutService Binding="#{post_binding}" Location="#{idp_logout_service}"/>
-    <NameIDFormat>#{Saml::Kit::Namespaces::PERSISTENT}</NameIDFormat>
-    <SingleSignOnService Binding="#{post_binding}" Location="#{sign_on_service}"/>
-    <SingleSignOnService Binding="#{redirect_binding}" Location="#{sign_on_service}"/>
-    <Attribute xmlns="#{Saml::Kit::Namespaces::ASSERTION}" Name="id" ></Attribute>
-  </IDPSSODescriptor>
-  <Organization>
-    <OrganizationName xml:lang="en">Acme, Inc</OrganizationName>
-    <OrganizationDisplayName xml:lang="en">Acme, Inc</OrganizationDisplayName>
-    <OrganizationURL xml:lang="en">http://localhost:5000/</OrganizationURL>
-  </Organization>
-  <ContactPerson contactType="technical">
-    <Company>mailto:hi@example.com</Company>
-  </ContactPerson>
-</EntityDescriptor>
+    <<-XML.strip_heredoc
+      <EntityDescriptor xmlns="#{Saml::Kit::Namespaces::METADATA}" ID="#{::Xml::Kit::Id.generate}" entityID="#{entity_id}">
+        <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="#{Saml::Kit::Namespaces::PROTOCOL}">
+          <KeyDescriptor use="signing">
+            <KeyInfo xmlns="#{::Xml::Kit::Namespaces::XMLDSIG}">
+              <X509Data>
+                <X509Certificate>#{sp_signing_certificate.stripped}</X509Certificate>
+              </X509Data>
+            </KeyInfo>
+          </KeyDescriptor>
+          <KeyDescriptor use="encryption">
+            <KeyInfo xmlns="#{::Xml::Kit::Namespaces::XMLDSIG}">
+              <X509Data>
+                <X509Certificate>#{sp_encryption_certificate.stripped}</X509Certificate>
+              </X509Data>
+            </KeyInfo>
+          </KeyDescriptor>
+          <SingleLogoutService Binding="#{post_binding}" Location="#{sp_logout_service}"/>
+          <NameIDFormat>#{Saml::Kit::Namespaces::PERSISTENT}</NameIDFormat>
+          <AssertionConsumerService Binding="#{post_binding}" Location="#{assertion_consumer_service}" index="0" isDefault="true"/>
+        </SPSSODescriptor>
+        <IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="#{Saml::Kit::Namespaces::PROTOCOL}">
+          <KeyDescriptor use="signing">
+            <KeyInfo xmlns="#{::Xml::Kit::Namespaces::XMLDSIG}">
+              <X509Data>
+                <X509Certificate>#{idp_signing_certificate.stripped}</X509Certificate>
+              </X509Data>
+            </KeyInfo>
+          </KeyDescriptor>
+          <KeyDescriptor use="encryption">
+            <KeyInfo xmlns="#{::Xml::Kit::Namespaces::XMLDSIG}">
+              <X509Data>
+                <X509Certificate>#{idp_encryption_certificate.stripped}</X509Certificate>
+              </X509Data>
+            </KeyInfo>
+          </KeyDescriptor>
+          <SingleLogoutService Binding="#{post_binding}" Location="#{idp_logout_service}"/>
+          <NameIDFormat>#{Saml::Kit::Namespaces::PERSISTENT}</NameIDFormat>
+          <SingleSignOnService Binding="#{post_binding}" Location="#{sign_on_service}"/>
+          <SingleSignOnService Binding="#{redirect_binding}" Location="#{sign_on_service}"/>
+          <Attribute xmlns="#{Saml::Kit::Namespaces::ASSERTION}" Name="id" ></Attribute>
+        </IDPSSODescriptor>
+        <Organization>
+          <OrganizationName xml:lang="en">Acme, Inc</OrganizationName>
+          <OrganizationDisplayName xml:lang="en">Acme, Inc</OrganizationDisplayName>
+          <OrganizationURL xml:lang="en">http://localhost:5000/</OrganizationURL>
+        </Organization>
+        <ContactPerson contactType="technical">
+          <Company>mailto:hi@example.com</Company>
+        </ContactPerson>
+      </EntityDescriptor>
     XML
   end
 
-  describe "#single_sign_on_services" do
+  describe '#single_sign_on_services' do
     it 'returns the single sign on services from the idp' do
       expect(subject.single_sign_on_services).to match_array([
         Saml::Kit::Bindings::HttpPost.new(location: sign_on_service),
@@ -75,7 +76,7 @@ RSpec.describe Saml::Kit::CompositeMetadata do
     end
   end
 
-  describe "#single_sign_on_service_for" do
+  describe '#single_sign_on_service_for' do
     it 'returns the post binding' do
       expect(subject.single_sign_on_service_for(binding: :http_post)).to eql(
         Saml::Kit::Bindings::HttpPost.new(location: sign_on_service)
@@ -138,7 +139,7 @@ RSpec.describe Saml::Kit::CompositeMetadata do
   end
   it do
     expect(subject.service_for(type: 'AssertionConsumerService', binding: :http_post)).to eql(
-      Saml::Kit::Bindings::HttpPost.new(location: assertion_consumer_service),
+      Saml::Kit::Bindings::HttpPost.new(location: assertion_consumer_service)
     )
   end
   it do
@@ -149,7 +150,7 @@ RSpec.describe Saml::Kit::CompositeMetadata do
   end
   it do
     expect(subject.service_for(type: 'SingleSignOnService', binding: :http_post)).to eql(
-      Saml::Kit::Bindings::HttpPost.new(location: sign_on_service),
+      Saml::Kit::Bindings::HttpPost.new(location: sign_on_service)
     )
   end
 
@@ -166,8 +167,5 @@ RSpec.describe Saml::Kit::CompositeMetadata do
     )
   end
 
-  it do
-    user = double(:user, name_id_for: SecureRandom.uuid)
-    expect(subject.logout_request_for(user)).to be_present
-  end
+  specify { expect(subject.logout_request_for(User.new)).to be_present }
 end