1
1
"""
2
- SATOSA microservice that uses an identifier asserted by
2
+ SATOSA microservice that uses an identifier asserted by
3
3
the home organization SAML IdP as a key to search an LDAP
4
4
directory for a record and then consume attributes from
5
5
the record and assert them to the receiving SP.
@@ -121,9 +121,9 @@ def _construct_filter_value(self, candidate, data):
121
121
Construct and return a LDAP directory search filter value from the
122
122
candidate identifier.
123
123
124
- Argument 'canidate' is a dictionary with one required key and
124
+ Argument 'canidate' is a dictionary with one required key and
125
125
two optional keys:
126
-
126
+
127
127
key required value
128
128
--------------- -------- ---------------------------------
129
129
attribute_names Y list of identifier names
@@ -138,7 +138,7 @@ def _construct_filter_value(self, candidate, data):
138
138
If the attribute_names list consists of more than one identifier
139
139
name then the values of the identifiers will be concatenated together
140
140
to create the filter value.
141
-
141
+
142
142
If one of the identifier names in the attribute_names is the string
143
143
'name_id' then the NameID value with format name_id_format
144
144
will be concatenated to the filter value.
@@ -174,9 +174,9 @@ def _construct_filter_value(self, candidate, data):
174
174
if candidate ['name_id_format' ] in name_id :
175
175
nameid_value = name_id [candidate ['name_id_format' ]]
176
176
177
- # Only add the NameID value asserted by the IdP if it is not already
177
+ # Only add the NameID value asserted by the IdP if it is not already
178
178
# in the list of values. This is necessary because some non-compliant IdPs
179
- # have been known, for example, to assert the value of eduPersonPrincipalName
179
+ # have been known, for example, to assert the value of eduPersonPrincipalName
180
180
# in the value for SAML2 persistent NameID as well as asserting
181
181
# eduPersonPrincipalName.
182
182
if nameid_value not in values :
@@ -196,7 +196,7 @@ def _construct_filter_value(self, candidate, data):
196
196
# to do so.
197
197
if 'add_scope' in candidate :
198
198
if candidate ['add_scope' ] == 'issuer_entityid' :
199
- scope = data .to_dict ()[ ' auth_info' ][ ' issuer' ]
199
+ scope = data .auth_info . issuer
200
200
else :
201
201
scope = candidate ['add_scope' ]
202
202
satosa_logging (logger , logging .DEBUG , "Added scope {} to values" .format (scope ), context .state )
@@ -256,9 +256,9 @@ def _ldap_connection_factory(self, config):
256
256
257
257
try :
258
258
connection = ldap3 .Connection (
259
- server ,
260
- bind_dn ,
261
- bind_password ,
259
+ server ,
260
+ bind_dn ,
261
+ bind_password ,
262
262
auto_bind = True ,
263
263
client_strategy = ldap3 .REUSABLE ,
264
264
pool_size = pool_size ,
@@ -284,28 +284,28 @@ def _populate_attributes(self, config, record, context, data):
284
284
if record ["attributes" ][attr ]:
285
285
data .attributes [search_return_attributes [attr ]] = record ["attributes" ][attr ]
286
286
satosa_logging (
287
- logger ,
288
- logging .DEBUG ,
287
+ logger ,
288
+ logging .DEBUG ,
289
289
"Setting internal attribute {} with values {}" .format (
290
- search_return_attributes [attr ],
290
+ search_return_attributes [attr ],
291
291
record ["attributes" ][attr ]
292
- ),
292
+ ),
293
293
context .state
294
294
)
295
295
else :
296
296
satosa_logging (
297
- logger ,
298
- logging .DEBUG ,
297
+ logger ,
298
+ logging .DEBUG ,
299
299
"Not setting internal attribute {} because value {} is null or empty" .format (
300
- search_return_attributes [attr ],
300
+ search_return_attributes [attr ],
301
301
record ["attributes" ][attr ]
302
- ),
302
+ ),
303
303
context .state
304
304
)
305
305
306
306
def _populate_input_for_name_id (self , config , record , context , data ):
307
307
"""
308
- Use a record found in LDAP to populate input for
308
+ Use a record found in LDAP to populate input for
309
309
NameID generation.
310
310
"""
311
311
user_id = ""
@@ -320,32 +320,32 @@ def _populate_input_for_name_id(self, config, record, context, data):
320
320
value .sort ()
321
321
user_id += "" .join (value )
322
322
satosa_logging (
323
- logger ,
324
- logging .DEBUG ,
325
- "Added attribute {} with values {} to input for NameID" .format (attr , v ),
323
+ logger ,
324
+ logging .DEBUG ,
325
+ "Added attribute {} with values {} to input for NameID" .format (attr , value ),
326
326
context .state
327
327
)
328
328
else :
329
329
user_id += value
330
330
satosa_logging (
331
- logger ,
332
- logging .DEBUG ,
333
- "Added attribute {} with value {} to input for NameID" .format (attr , value ),
331
+ logger ,
332
+ logging .DEBUG ,
333
+ "Added attribute {} with value {} to input for NameID" .format (attr , value ),
334
334
context .state
335
335
)
336
336
if not user_id :
337
337
satosa_logging (
338
- logger ,
339
- logging .WARNING ,
340
- "Input for NameID is empty so not overriding default" ,
338
+ logger ,
339
+ logging .WARNING ,
340
+ "Input for NameID is empty so not overriding default" ,
341
341
context .state
342
342
)
343
343
else :
344
344
data .user_id = user_id
345
345
satosa_logging (
346
- logger ,
347
- logging .DEBUG ,
348
- "Input for NameID is {}" .format (data .user_id ),
346
+ logger ,
347
+ logging .DEBUG ,
348
+ "Input for NameID is {}" .format (data .user_id ),
349
349
context .state
350
350
)
351
351
@@ -457,7 +457,7 @@ def process(self, context, data):
457
457
# the entityIDs for the target SP and IdP used by the user
458
458
# as query string parameters (URL encoded).
459
459
encoded_sp_entity_id = urllib .parse .quote_plus (sp_entity_id )
460
- encoded_idp_entity_id = urllib .parse .quote_plus (data .to_dict ()[ ' auth_info' ][ ' issuer' ] )
460
+ encoded_idp_entity_id = urllib .parse .quote_plus (data .auth_info . issuer )
461
461
url = "{}?sp={}&idp={}" .format (on_ldap_search_result_empty , encoded_sp_entity_id , encoded_idp_entity_id )
462
462
satosa_logging (logger , logging .INFO , "Redirecting to {}" .format (url ), context .state )
463
463
return Redirect (url )
0 commit comments