robdimarco/omniauth_crowd — pull request #9 by combhua (2012-10-31 22:42:22+00:00)
Title: Passwords with invalid xml characters

We had a number of people who could not log via omniauth_crowd, but could via other methods. We identified the issue as not properly escaped passwords with characters that break xml.

https://github.com/robdimarco/omniauth_crowd/blob/master/lib/omniauth/strategies/crowd/crowd_validator.rb#L69

I added a method to use Nokogiri (since it's already being used) to ensure proper creation and encoding of the password string. I'm also a terrible person (and am under some serious time constraints) so I didn't get a chance to write any tests for this scenario.

I've also started adding more logging and more robust handling of various responses from Crowd, but it required refactoring a few different pieces and also due to time, I haven't cleaned it up for others to use. As a compromise, I have it logging the response code and body when it's not a success.