Canonicalizing XML in Ruby

Question

I'm working on a SAML gateway using Ruby/Rails and I'm attempting to write some code that validates the xml digital signature of the incoming SAML response against the x509 cert of the originating service.

My problem: the signature depends on a canonicalized version of the XML that is hashed and then signed and I'm having trouble finding a ruby lib/gem that will canonicalize XML per the spec. I found a super old gem on rubyforge that is a mess but I'd be more interested if something like nokogiri supported this kind of functionality (from the nokogiri docs, it doesn't).

I've googled extensively but thought I'd ask around here to see if anyone has any good insights before I go and try to write my own version or rework the existing c14n-r library.

Answer 1

I have a ruby/rails Service Provider and a .NET (ComponentSoft) IDP

this worked for me ( I had no issues with the canonicalized version of the XML):

received_certificate = XPath.first(response_document,"//samlp:Response//Signature//KeyInfo//X509Data//X509Certificate").text

def self.verify_signature(received_certificate, idp_certificate_path)
  certificate ||= OpenSSL::X509::Certificate.new(File.read(idp_certificate_path))
  cert_decoded = Base64.decode64(received_certificate)
  cert = OpenSSL::X509::Certificate.new(cert_decoded)
  certificate.verify(cert.public_key)
end

Answer 2

After looking around some more I've found that nokogiri has put c14n support on the todo list for the next release. Don't know more than that-- but it appears that no widely used XML library supports c14n as of June 2010. I'll close this out since nothing really popped up.