Verify VSP Client

Ruby client for sending and receiving requests to a Verify Service Provider allowing you to connect to GOV.UK Verify

Add this line to your application's Gemfile:

gem 'verify_vsp_client'

And then execute:

$ bundle

Create a new verify_vsp_client.rb initialiser in config/initializers:

VerifyVspClient.configure do |config|
  config.vsp_host = YOUR_VSP_HOST
end

For a more detailed explanation of how to send and receive requests to the VSP, read the GOV.UK Verify docs

An authentication request with contain a samlRequest, requestId and ssoLocation. You will need to store the requestId and access it later as part of translating the response:

def new
  @verify_authentication_request = VerifyVspClient::AuthenticationRequest.generate
  session[:verify_request_id] = @verify_authentication_request.request_id
end

Create a form that makes a POST to ssoLocation containing a SAMLRequest hidden field. The form should look something like this:

<%= form_tag @verify_authentication_request.sso_location, authenticity_token: false do %>
  <h1>Continue to next step</h1>
  <%= hidden_field_tag "relayState" %>
  <%= hidden_field_tag "SAMLRequest", @verify_authentication_request.saml_request %>
  <p>If your browser does not redirect in a few seconds, please press the "Continue" button.</p>
  <%= submit_tag "Continue" %>
<% end %>

<!-- JavaScript to automatically submit the form and POST to `ssoLocation` -->
<script>
  var form = document.forms[0];
  form.setAttribute('style', 'display: none;');
  window.setTimeout(function () { form.removeAttribute('style') }, 5000);
  form.submit()
</script>

Your application will receive a POST containing a SAMLResponse. Because the POST is being sent from an external source we'll need to skip verifying CSRF token for this action:

skip_before_action :verify_authenticity_token, only: [:create]
  
def create
  @response = VerifyVspClient::Response.translate(
    saml_response: params["SAMLResponse"],
    request_id: session[:verify_request_id],
    level_of_assurance: "LEVEL_2"
  )
  if @response.verified?
    # The user has successfully verified their identity, you can access
    # the information about the user's identity using: 
    @response.parameters
  else
    # It's important for your app to also handle the failure scenarios:
    # @response.scenario == VerifyVspClient::AUTHENTICATION_FAILED_SCENARIO
    # @response.scenario == VerifyVspClient::NO_AUTHENTICATION_SCENARIO
  end
end

After checking out the repo, run bin/setup to install dependencies. Then, run rake spec to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run bundle exec rake install. To release a new version, update the version number in version.rb, and then run bundle exec rake release, which will create a git tag for the version, push git commits and tags, and push the .gem file to rubygems.org.

Bug reports and pull requests are welcome on GitHub at https://github.com/dxw/verify_vsp_client. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.

The gem is available as open source under the terms of the MIT License.

Everyone interacting in the VerifyVspClient project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct.