Merge pull request #402 from graaff/idp_cert_multi-response-check

Allow responses to work with only an idp_cert_multi setting

Author: pitbulk

lib/onelogin/ruby-saml/logoutresponse.rb

@@ -168,7 +168,7 @@ def valid_state?
 
         return append_error("No issuer in settings of the logout response") if settings.issuer.nil?
 
-        if settings.idp_cert_fingerprint.nil? && settings.idp_cert.nil?
+        if settings.idp_cert_fingerprint.nil? && settings.idp_cert.nil? && settings.idp_cert_multi.nil?
           return append_error("No fingerprint or certificate on settings of the logout response")
         end
 

lib/onelogin/ruby-saml/response.rb

@@ -412,7 +412,7 @@ def validate_response_state
 
         return append_error("No settings on response") if settings.nil?
 
-        if settings.idp_cert_fingerprint.nil? && settings.idp_cert.nil?
+        if settings.idp_cert_fingerprint.nil? && settings.idp_cert.nil? && settings.idp_cert_multi.nil?
           return append_error("No fingerprint or certificate on settings")
         end
 

test/logoutresponse_test.rb

@@ -90,6 +90,7 @@ class RubySamlTest < Minitest::Test
         it "invalidate logout response when initiated with no idp cert or fingerprint" do
           settings.idp_cert_fingerprint = nil
           settings.idp_cert = nil
+          settings.idp_cert_multi = nil
           logoutresponse = OneLogin::RubySaml::Logoutresponse.new(valid_logout_response_document, settings)
           assert !logoutresponse.validate
           assert_includes logoutresponse.errors, "No fingerprint or certificate on settings of the logout response"

test/response_test.rb

@@ -138,6 +138,7 @@ class RubySamlTest < Minitest::Test
         it "raise when No fingerprint or certificate on settings" do
           settings.idp_cert_fingerprint = nil
           settings.idp_cert = nil
+          settings.idp_cert_multi = nil
           response.settings = settings
           error_msg = "No fingerprint or certificate on settings"
           assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do