Skip to content

Commit 25c9a8f

Browse files
roherohe
committed
Merge branch 'master' of github.com:rohe/pysaml2
2 parents a926165 + b90815f commit 25c9a8f

File tree

15 files changed

+134
-77
lines changed

15 files changed

+134
-77
lines changed

‎.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ tmp*
3131
*.tmpl
3232
*.iml
3333
_build/
34+
.cache
35+
*.swp
3436

3537
example/idp3/htdocs/login.mako
3638

‎doc/howto/config.rst

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -270,6 +270,19 @@ idp/aa
270270

271271
Directives that are specific to an IdP or AA service instance
272272

273+
sign_assertion
274+
""""""""""""""
275+
276+
Specifies if the IdP should sign the assertion in an authentication response
277+
or not. Can be True or False. Default is False.
278+
279+
sign_response
280+
"""""""""""""
281+
282+
Specifies if the IdP should sign the authentication response or not. Can be
283+
True or False. Default is False.
284+
285+
273286
policy
274287
""""""
275288

@@ -419,7 +432,7 @@ Indicates if this SP wants the IdP to send the assertions signed. This
419432
sets the WantAssertionsSigned attribute of the SPSSODescriptor node
420433
of the metadata so the IdP will know this SP preference.
421434

422-
Valid values are True or False. Default value is True.
435+
Valid values are True or False. Default value is False.
423436

424437
Example::
425438

‎src/saml2/algsupport.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ def get_algorithm_support(xmlsec):
4242
pof.wait()
4343

4444
if not p_err:
45-
p = p_out.split('\n')
45+
p = p_out.splitlines()
4646
algs = [x.strip('"') for x in p[1].split(',')]
4747
digest = []
4848
signing = []

‎src/saml2/assertion.py

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -615,7 +615,7 @@ def _authn_context_decl_ref(decl_ref, authn_auth=None):
615615

616616
def authn_statement(authn_class=None, authn_auth=None,
617617
authn_decl=None, authn_decl_ref=None, authn_instant="",
618-
subject_locality=""):
618+
subject_locality="", session_not_on_or_after=None):
619619
"""
620620
Construct the AuthnStatement
621621
:param authn_class: Authentication Context Class reference
@@ -639,26 +639,30 @@ def authn_statement(authn_class=None, authn_auth=None,
639639
saml.AuthnStatement,
640640
authn_instant=_instant,
641641
session_index=sid(),
642+
session_not_on_or_after=session_not_on_or_after,
642643
authn_context=_authn_context_class_ref(
643644
authn_class, authn_auth))
644645
elif authn_decl:
645646
res = factory(
646647
saml.AuthnStatement,
647648
authn_instant=_instant,
648649
session_index=sid(),
650+
session_not_on_or_after=session_not_on_or_after,
649651
authn_context=_authn_context_decl(authn_decl, authn_auth))
650652
elif authn_decl_ref:
651653
res = factory(
652654
saml.AuthnStatement,
653655
authn_instant=_instant,
654656
session_index=sid(),
657+
session_not_on_or_after=session_not_on_or_after,
655658
authn_context=_authn_context_decl_ref(authn_decl_ref,
656659
authn_auth))
657660
else:
658661
res = factory(
659662
saml.AuthnStatement,
660663
authn_instant=_instant,
661-
session_index=sid())
664+
session_index=sid(),
665+
session_not_on_or_after=session_not_on_or_after)
662666

663667
if subject_locality:
664668
res.subject_locality = saml.SubjectLocality(text=subject_locality)
@@ -719,7 +723,7 @@ def construct(self, sp_entity_id, attrconvs, policy, issuer, farg,
719723
authn_class=None, authn_auth=None, authn_decl=None,
720724
encrypt=None, sec_context=None, authn_decl_ref=None,
721725
authn_instant="", subject_locality="", authn_statem=None,
722-
name_id=None):
726+
name_id=None, session_not_on_or_after=None):
723727
""" Construct the Assertion
724728
725729
:param sp_entity_id: The entityid of the SP
@@ -770,7 +774,8 @@ def construct(self, sp_entity_id, attrconvs, policy, issuer, farg,
770774
_authn_statement = authn_statement(authn_class, authn_auth,
771775
authn_decl, authn_decl_ref,
772776
authn_instant,
773-
subject_locality)
777+
subject_locality,
778+
session_not_on_or_after=session_not_on_or_after)
774779
else:
775780
_authn_statement = None
776781

‎src/saml2/attributemaps/basic.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@
6161
DEF+'eduPersonScopedAffiliation': 'eduPersonScopedAffiliation',
6262
DEF+'eduPersonTargetedID': 'eduPersonTargetedID',
6363
DEF+'eduPersonAssurance': 'eduPersonAssurance',
64-
DEF+'eduPersonUniqueID': 'eduPersonUniqueID',
64+
DEF+'eduPersonUniqueId': 'eduPersonUniqueId',
6565
DEF+'eduPersonOrcid': 'eduPersonOrcid',
6666
DEF+'email': 'email',
6767
DEF+'emailAddress': 'emailAddress',
@@ -228,7 +228,7 @@
228228
'eduPersonScopedAffiliation': DEF+'eduPersonScopedAffiliation',
229229
'eduPersonTargetedID': DEF+'eduPersonTargetedID',
230230
'eduPersonAssurance': DEF+'eduPersonAssurance',
231-
'eduPersonUniqueID': DEF+'eduPersonUniqueID',
231+
'eduPersonUniqueId': DEF+'eduPersonUniqueId',
232232
'eduPersonOrcid': DEF+'eduPersonOrcid',
233233
'email': DEF+'email',
234234
'emailAddress': DEF+'emailAddress',

‎src/saml2/attributemaps/saml_uri.py

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -19,19 +19,19 @@
1919
EDUCOURSE_OID+'1': 'eduCourseOffering',
2020
EDUCOURSE_OID+'2': 'eduCourseMember',
2121
EDUPERSON_OID+'1': 'eduPersonAffiliation',
22-
EDUPERSON_OID+'2': 'eduPersonEntitlement',
23-
EDUPERSON_OID+'3': 'eduPersonNickname',
24-
EDUPERSON_OID+'4': 'eduPersonOrgDN',
25-
EDUPERSON_OID+'5': 'eduPersonOrgUnitDN',
26-
EDUPERSON_OID+'6': 'eduPersonPrimaryAffiliation',
27-
EDUPERSON_OID+'7': 'eduPersonPrimaryOrgUnitDN',
28-
EDUPERSON_OID+'8': 'eduPersonPrincipalName',
29-
EDUPERSON_OID+'9': 'eduPersonPrincipalName',
30-
EDUPERSON_OID+'10': 'eduPersonScopedAffiliation',
31-
EDUPERSON_OID+'11': 'eduPersonTargetedID',
32-
EDUPERSON_OID+'12': 'eduPersonAssurance',
33-
EDUPERSON_OID+'13': 'eduPersonUniqueID',
34-
EDUPERSON_OID+'14': 'eduPersonOrcid',
22+
EDUPERSON_OID+'2': 'eduPersonNickname',
23+
EDUPERSON_OID+'3': 'eduPersonOrgDN',
24+
EDUPERSON_OID+'4': 'eduPersonOrgUnitDN',
25+
EDUPERSON_OID+'5': 'eduPersonPrimaryAffiliation',
26+
EDUPERSON_OID+'6': 'eduPersonPrincipalName',
27+
EDUPERSON_OID+'7': 'eduPersonEntitlement',
28+
EDUPERSON_OID+'8': 'eduPersonPrimaryOrgUnitDN',
29+
EDUPERSON_OID+'9': 'eduPersonScopedAffiliation',
30+
EDUPERSON_OID+'10': 'eduPersonTargetedID',
31+
EDUPERSON_OID+'11': 'eduPersonAssurance',
32+
EDUPERSON_OID+'12': 'eduPersonPrincipalNamePrior',
33+
EDUPERSON_OID+'13': 'eduPersonUniqueId',
34+
EDUPERSON_OID+'16': 'eduPersonOrcid',
3535
LDAPGVAT_OID+'1': 'PVP-GID',
3636
LDAPGVAT_OID+'149': 'PVP-BPK',
3737
LDAPGVAT_OID+'153': 'PVP-OU-OKZ',
@@ -179,19 +179,19 @@
179179
'eduCourseMember': EDUCOURSE_OID+'2',
180180
'eduCourseOffering': EDUCOURSE_OID+'1',
181181
'eduPersonAffiliation': EDUPERSON_OID+'1',
182-
'eduPersonEntitlement': EDUPERSON_OID+'2',
183-
'eduPersonNickname': EDUPERSON_OID+'3',
184-
'eduPersonOrgDN': EDUPERSON_OID+'4',
185-
'eduPersonOrgUnitDN': EDUPERSON_OID+'5',
186-
'eduPersonPrimaryAffiliation': EDUPERSON_OID+'6',
187-
'eduPersonPrimaryOrgUnitDN': EDUPERSON_OID+'7',
188-
'eduPersonPrincipalName': EDUPERSON_OID+'8',
189-
'eduPersonPrincipalNamePrior': EDUPERSON_OID+'9',
190-
'eduPersonScopedAffiliation': EDUPERSON_OID+'10',
191-
'eduPersonTargetedID': EDUPERSON_OID+'11',
192-
'eduPersonAssurance': EDUPERSON_OID+'12',
193-
'eduPersonUniqueID': EDUPERSON_OID+'13',
194-
'eduPersonOrcid': EDUPERSON_OID+'14',
182+
'eduPersonEntitlement': EDUPERSON_OID+'7',
183+
'eduPersonNickname': EDUPERSON_OID+'2',
184+
'eduPersonOrgDN': EDUPERSON_OID+'3',
185+
'eduPersonOrgUnitDN': EDUPERSON_OID+'4',
186+
'eduPersonPrimaryAffiliation': EDUPERSON_OID+'5',
187+
'eduPersonPrimaryOrgUnitDN': EDUPERSON_OID+'8',
188+
'eduPersonPrincipalName': EDUPERSON_OID+'6',
189+
'eduPersonPrincipalNamePrior': EDUPERSON_OID+'12',
190+
'eduPersonScopedAffiliation': EDUPERSON_OID+'9',
191+
'eduPersonTargetedID': EDUPERSON_OID+'10',
192+
'eduPersonAssurance': EDUPERSON_OID+'11',
193+
'eduPersonUniqueId': EDUPERSON_OID+'13',
194+
'eduPersonOrcid': EDUPERSON_OID+'16',
195195
'email': PKCS_9+'1',
196196
'employeeNumber': NETSCAPE_LDAP+'3',
197197
'employeeType': NETSCAPE_LDAP+'4',

‎src/saml2/attributemaps/shibboleth_uri.py

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -11,19 +11,19 @@
1111
"identifier": "urn:mace:shibboleth:1.0:attributeNamespace:uri",
1212
'fro': {
1313
EDUPERSON_OID+'1': 'eduPersonAffiliation',
14-
EDUPERSON_OID+'2': 'eduPersonEntitlement',
15-
EDUPERSON_OID+'3': 'eduPersonNickname',
16-
EDUPERSON_OID+'4': 'eduPersonOrgDN',
17-
EDUPERSON_OID+'5': 'eduPersonOrgUnitDN',
18-
EDUPERSON_OID+'6': 'eduPersonPrimaryAffiliation',
19-
EDUPERSON_OID+'7': 'eduPersonPrimaryOrgUnitDN',
20-
EDUPERSON_OID+'8': 'eduPersonPrincipalName',
21-
EDUPERSON_OID+'9': 'eduPersonPrincipalNamePrior',
22-
EDUPERSON_OID+'10': 'eduPersonScopedAffiliation',
23-
EDUPERSON_OID+'11': 'eduPersonTargetedID',
24-
EDUPERSON_OID+'12': 'eduPersonAssurance',
25-
EDUPERSON_OID+'13': 'eduPersonUniqueID',
26-
EDUPERSON_OID+'14': 'eduPersonOrcid',
14+
EDUPERSON_OID+'2': 'eduPersonNickname',
15+
EDUPERSON_OID+'3': 'eduPersonOrgDN',
16+
EDUPERSON_OID+'4': 'eduPersonOrgUnitDN',
17+
EDUPERSON_OID+'5': 'eduPersonPrimaryAffiliation',
18+
EDUPERSON_OID+'6': 'eduPersonPrincipalName',
19+
EDUPERSON_OID+'7': 'eduPersonEntitlement',
20+
EDUPERSON_OID+'8': 'eduPersonPrimaryOrgUnitDN',
21+
EDUPERSON_OID+'9': 'eduPersonScopedAffiliation',
22+
EDUPERSON_OID+'10': 'eduPersonTargetedID',
23+
EDUPERSON_OID+'11': 'eduPersonAssurance',
24+
EDUPERSON_OID+'12': 'eduPersonPrincipalNamePrior',
25+
EDUPERSON_OID+'13': 'eduPersonUniqueId',
26+
EDUPERSON_OID+'16': 'eduPersonOrcid',
2727
NETSCAPE_LDAP+'1': 'carLicense',
2828
NETSCAPE_LDAP+'2': 'departmentNumber',
2929
NETSCAPE_LDAP+'3': 'employeeNumber',
@@ -114,19 +114,19 @@
114114
'dnQualifier': X500ATTR+'46',
115115
'domainComponent': UCL_DIR_PILOT+'25',
116116
'eduPersonAffiliation': EDUPERSON_OID+'1',
117-
'eduPersonEntitlement': EDUPERSON_OID+'2',
118-
'eduPersonNickname': EDUPERSON_OID+'3',
119-
'eduPersonOrgDN': EDUPERSON_OID+'4',
120-
'eduPersonOrgUnitDN': EDUPERSON_OID+'5',
121-
'eduPersonPrimaryAffiliation': EDUPERSON_OID+'6',
122-
'eduPersonPrimaryOrgUnitDN': EDUPERSON_OID+'7',
123-
'eduPersonPrincipalName': EDUPERSON_OID+'8',
124-
'eduPersonPrincipalNamePrior': EDUPERSON_OID+'9',
125-
'eduPersonScopedAffiliation': EDUPERSON_OID+'10',
126-
'eduPersonTargetedID': EDUPERSON_OID+'11',
127-
'eduPersonAssurance': EDUPERSON_OID+'12',
128-
'eduPersonUniqueID': EDUPERSON_OID+'13',
129-
'eduPersonOrcid': EDUPERSON_OID+'14',
117+
'eduPersonEntitlement': EDUPERSON_OID+'7',
118+
'eduPersonNickname': EDUPERSON_OID+'2',
119+
'eduPersonOrgDN': EDUPERSON_OID+'3',
120+
'eduPersonOrgUnitDN': EDUPERSON_OID+'4',
121+
'eduPersonPrimaryAffiliation': EDUPERSON_OID+'5',
122+
'eduPersonPrimaryOrgUnitDN': EDUPERSON_OID+'8',
123+
'eduPersonPrincipalName': EDUPERSON_OID+'6',
124+
'eduPersonPrincipalNamePrior': EDUPERSON_OID+'12',
125+
'eduPersonScopedAffiliation': EDUPERSON_OID+'9',
126+
'eduPersonTargetedID': EDUPERSON_OID+'10',
127+
'eduPersonAssurance': EDUPERSON_OID+'11',
128+
'eduPersonUniqueId': EDUPERSON_OID+'13',
129+
'eduPersonOrcid': EDUPERSON_OID+'16',
130130
'email': PKCS_9+'1',
131131
'emailAddress': PKCS_9+'1',
132132
'employeeNumber': NETSCAPE_LDAP+'3',

‎src/saml2/mdstore.py

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -902,6 +902,9 @@ def load(self, *args, **kwargs):
902902
elif typ == "loader":
903903
key = args[1]
904904
_md = MetaDataLoader(self.attrc, args[1], **_args)
905+
elif typ == "mdq":
906+
key = args[1]
907+
_md = MetaDataMDX(args[1])
905908
else:
906909
raise SAMLError("Unknown metadata type '%s'" % typ)
907910
_md.load()
@@ -992,10 +995,7 @@ def extension(self, entity_id, typ, service):
992995
try:
993996
srvs = _md[entity_id][typ]
994997
except KeyError:
995-
return None
996-
997-
if not srvs:
998-
return srvs
998+
continue
999999

10001000
res = []
10011001
for srv in srvs:
@@ -1005,6 +1005,8 @@ def extension(self, entity_id, typ, service):
10051005
res.append(elem)
10061006
return res
10071007

1008+
return None
1009+
10081010
def ext_service(self, entity_id, typ, service, binding=None):
10091011
known_entity = False
10101012
for key, _md in self.metadata.items():

‎src/saml2/server.py

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -326,7 +326,8 @@ def update_farg(in_response_to, consumer_url, farg=None):
326326

327327
def setup_assertion(self, authn, sp_entity_id, in_response_to, consumer_url,
328328
name_id, policy, _issuer, authn_statement, identity,
329-
best_effort, sign_response, farg=None, **kwargs):
329+
best_effort, sign_response, farg=None,
330+
session_not_on_or_after=None, **kwargs):
330331
"""
331332
Construct and return the Assertion
332333
@@ -370,17 +371,20 @@ def setup_assertion(self, authn, sp_entity_id, in_response_to, consumer_url,
370371
assertion = ast.construct(
371372
sp_entity_id, self.config.attribute_converters, policy,
372373
issuer=_issuer, farg=farg['assertion'], name_id=name_id,
374+
session_not_on_or_after=session_not_on_or_after,
373375
**authn_args)
374376

375377
elif authn_statement: # Got a complete AuthnStatement
376378
assertion = ast.construct(
377379
sp_entity_id, self.config.attribute_converters, policy,
378380
issuer=_issuer, authn_statem=authn_statement,
379-
farg=farg['assertion'], name_id=name_id, **kwargs)
381+
farg=farg['assertion'], name_id=name_id,
382+
**kwargs)
380383
else:
381384
assertion = ast.construct(
382385
sp_entity_id, self.config.attribute_converters, policy,
383386
issuer=_issuer, farg=farg['assertion'], name_id=name_id,
387+
session_not_on_or_after=session_not_on_or_after,
384388
**kwargs)
385389
return assertion
386390

@@ -394,7 +398,7 @@ def _authn_response(self, in_response_to, consumer_url,
394398
encrypt_assertion_self_contained=False,
395399
encrypted_advice_attributes=False,
396400
pefim=False, sign_alg=None, digest_alg=None,
397-
farg=None):
401+
farg=None, session_not_on_or_after=None):
398402
""" Create a response. A layer of indirection.
399403
400404
:param in_response_to: The session identifier of the request
@@ -455,7 +459,7 @@ def _authn_response(self, in_response_to, consumer_url,
455459
assertion = self.setup_assertion(
456460
authn, sp_entity_id, in_response_to, consumer_url, name_id,
457461
policy, _issuer, authn_statement, [], True, sign_response,
458-
farg=farg)
462+
farg=farg, session_not_on_or_after=session_not_on_or_after)
459463
assertion.advice = saml.Advice()
460464

461465
# assertion.advice.assertion_id_ref.append(saml.AssertionIDRef())
@@ -465,7 +469,8 @@ def _authn_response(self, in_response_to, consumer_url,
465469
assertion = self.setup_assertion(
466470
authn, sp_entity_id, in_response_to, consumer_url, name_id,
467471
policy, _issuer, authn_statement, identity, True,
468-
sign_response, farg=farg)
472+
sign_response, farg=farg,
473+
session_not_on_or_after=session_not_on_or_after)
469474

470475
to_sign = []
471476
if not encrypt_assertion:
@@ -681,6 +686,7 @@ def create_authn_response(self, identity, in_response_to, destination,
681686
encrypt_assertion_self_contained=True,
682687
encrypted_advice_attributes=False, pefim=False,
683688
sign_alg=None, digest_alg=None,
689+
session_not_on_or_after=None,
684690
**kwargs):
685691
""" Constructs an AuthenticationResponse
686692
@@ -741,11 +747,13 @@ def create_authn_response(self, identity, in_response_to, destination,
741747
return self._authn_response(
742748
in_response_to, destination, sp_entity_id, identity,
743749
authn=_authn, issuer=issuer, pefim=pefim,
744-
sign_alg=sign_alg, digest_alg=digest_alg, **args)
750+
sign_alg=sign_alg, digest_alg=digest_alg,
751+
session_not_on_or_after=session_not_on_or_after, **args)
745752
return self._authn_response(
746753
in_response_to, destination, sp_entity_id, identity,
747754
authn=_authn, issuer=issuer, pefim=pefim, sign_alg=sign_alg,
748-
digest_alg=digest_alg, **args)
755+
digest_alg=digest_alg,
756+
session_not_on_or_after=session_not_on_or_after, **args)
749757

750758
except MissingValue as exc:
751759
return self.create_error_response(in_response_to, destination,
@@ -756,13 +764,15 @@ def create_authn_request_response(self, identity, in_response_to,
756764
name_id_policy=None, userid=None,
757765
name_id=None, authn=None, authn_decl=None,
758766
issuer=None, sign_response=False,
759-
sign_assertion=False, **kwargs):
767+
sign_assertion=False,
768+
session_not_on_or_after=None, **kwargs):
760769

761770
return self.create_authn_response(identity, in_response_to, destination,
762771
sp_entity_id, name_id_policy, userid,
763772
name_id, authn, issuer,
764773
sign_response, sign_assertion,
765-
authn_decl=authn_decl)
774+
authn_decl=authn_decl,
775+
session_not_on_or_after=session_not_on_or_after)
766776

767777
# noinspection PyUnusedLocal
768778
def create_assertion_id_request_response(self, assertion_id, sign=False,

‎src/saml2/sigver.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -586,7 +586,7 @@ def parse_xmlsec_output(output):
586586
:param output: The output from Popen
587587
:return: A boolean; True if the command was a success otherwise False
588588
"""
589-
for line in output.split("\n"):
589+
for line in output.splitlines():
590590
if line == "OK":
591591
return True
592592
elif line == "FAIL":

0 commit comments

Comments
 (0)