$ show SAML-Toolkits/ruby-saml
ruby-saml is a mature, production-grade Ruby library for integrating SAML 2.0 Single Sign-On (SSO) and Single Logout (SL_O) functionality into web applications. It implements the Service Provider role, generating AuthnRequests, parsing and validating SAML Responses, handling IdP-initiated and SP-initiated logouts, and parsing IdP metadata. The library focuses heavily on security, with robust XML signature validation (supporting multiple algorithms), certificate management (rotation, separate signing/encryption keys), encryption/decryption of assertions and attributes, and protection against known attacks such as signature wrapping, XEE, and decompression bombs. The architecture is a classic Ruby gem pattern: a set of independent classes under the OneLogin::RubySml namespace, with a central Settings configuration object. The library does no include any web server or data storage; it is designed to be used within Rails or other Rack-based frameworks. The test suite is exceptionally comprehensive, covering hundreds of edge cases including malformed responses, encryption variants, and attack payloads. The code is actively maintained with frequent security patches and deprecation of outdated APIs. While the library is well-crafted, it carries some technical debt from supporting ancient Ruby versions and from a long history of security fixes that have added complexity. The configuration surface is large and can be error-prone for new users. However, for projects requiring SAML SP support in Ruby, this is the de facto standard with proven production use.
The LLM identified 3 files worth highlighting for reuse:
A self-contained module for creating and validating XML digital signatures using XMLDSig and Nokogiri. It implements the full verification pipeline: canonicalization, reference validation, key retrieval, and signature computation. This is a non-trivial security component that could be extracted into a standalone gem for any Ruby application needing XML signature handling.
Base class for SAML messages providing encode/decode methods (base64, deflate) with protection against decompression bombs (Zlib::DataErrors). Also includes XML schema validation via XSDs. The encoding with bomb protection is a reusable pattern for any system dealing with user-supplied compressed payloads.
Collection of utility functions for certificate formatting (PEM wrapping), building OpenSSL objects, decryption using multiple private keys, UUID generation, duration parsing, and URI matching. These are well-tested, isolated helpers that can be reused in any Ruby project dealing with cryptography or certificate manipulation.