Corrado Masciullo masciugo

It's hard to find a good example of how to verify SAML signatures online. There are plenty magic that "just calls a Java method" -- but few clear step-by-step guide.

This gist covers the signature check of a SAML response in Ruby, and as such it's also an example of how to verify an XML Secure.

The code here is lifted entirely from Morten Primdahls and Zendesks awesome SAMLR library.

// default exports
export default 42;
export default {};
export default [];
export default (1 + 2);
export default foo;
export default function () {}
export default class {}
export default function foo () {}

	# Use Python 3 for easy unicode
	$ virtualenv -p python3 .env
	$ source .env/bin/activate
	$ pip install django
	$ deactivate

	# Start new django project and app
	$ django-admin.py startproject mysite
	$ ./manage.py migrate
	$ ./manage.py createsuperuser

	import { createCipheriv, createDecipheriv, randomBytes } from "crypto";

	const ENCRYPTION_KEY: string = process.env.ENCRYPTION_KEY \|\| ""; // Must be 256 bits (32 characters)
	const IV_LENGTH: number = 16; // For AES, this is always 16

	/**
	* Will generate valid encryption keys for use
	* Not used in the code below, but generate one and store it in ENV for your own purposes
	*/
	export function keyGen() {