Honor saml assurance level to allow 2FA bypassing

1 files changed, 22 insertions, 0 deletions

diff --git a/spec/dependencies/omniauth_saml_spec.rb b/spec/dependencies/omniauth_saml_spec.rb
new file mode 100644
index 00000000000..ccc604dc230
--- /dev/null
+++ b/spec/dependencies/omniauth_saml_spec.rb
@@ -0,0 +1,22 @@
+require 'spec_helper'
+require 'omniauth/strategies/saml'
+
+describe 'processing of SAMLResponse in dependencies' do
+  let(:mock_saml_response) { File.read('spec/fixtures/authentication/saml_response.xml') }
+  let(:saml_strategy) { OmniAuth::Strategies::SAML.new({}) }
+  let(:session_mock) { {} }
+  let(:settings) { OpenStruct.new({ soft: false, idp_cert_fingerprint: 'something' }) }
+  let(:auth_hash) { Gitlab::Auth::Saml::AuthHash.new(saml_strategy) }
+
+  subject { auth_hash.authn_context }
+
+  before do
+    allow(saml_strategy).to receive(:session).and_return(session_mock)
+    allow_any_instance_of(OneLogin::RubySaml::Response).to receive(:is_valid?).and_return(true)
+    saml_strategy.send(:handle_response, mock_saml_response, {}, settings ) { }
+  end
+
+  it 'can extract AuthnContextClassRef from SAMLResponse param' do
+    is_expected.to eq 'urn:oasis:names:tc:SAML:2.0:ac:classes:Password'
+  end
+end