onelogin/ruby-saml — pull request #103 by kwugirl (2013-11-26 23:29:30+00:00)
Title: Add validation hooks for assertion ID, time range, recipient, and destination

This ruby-saml gem has been really invaluable for implementing SAML in New Relic. Thanks so much for maintaining this. Along the way we've accumulated a few improvements to ruby-saml and it would be great if you could merge them in so that we can get back to tracking the master branch.

This pull request contains four additions:

1. A validation hook for the assertion ID. We found that we needed to ensure that we rejected reused assertion IDs so as to prevent replay attacks.
2. A validation hook for the time range conditions. We wanted to enforce sensible time range choices so that our customers wouldn't be unnecessarily weakening their security by making their assertions valid for long periods of time.
3. A validation hook for the recipient attribute. We wanted to protect our customers from attacks where an unauthorized user gains access by using a valid assertion for a different third-party Service Provider.
4. A validation hook for the destination attribute. Similar to #3, we wanted to protect our customers from attacks where an unauthorized user gains access by using a valid assertion for a different third-party Service Provider.

Sorry for putting this all in one pull request. If you need it broken out, just let me know.