Store away the original XML document (the SAML response) so it can be used later.

Verify signature on an assertion in the proper place, after possible decryption of an encrypted assertion.

Author: Roland Hedberg

src/saml2/response.py

@@ -263,6 +263,7 @@ def __init__(self, sec_context, return_addrs=None, timeslack=0,
         self.request_id = request_id
 
         self.xmlstr = ""
+        self.origxml = ""
         self.name_id = None
         self.response = None
         self.not_on_or_after = 0
@@ -290,7 +291,7 @@ def _postamble(self):
 
         try:
             valid_instance(self.response)
-        except NotValid, exc:
+        except NotValid as exc:
             logger.error("Not valid response: %s" % exc.args[0])
             self._clear()
             return self
@@ -318,18 +319,22 @@ def _loads(self, xmldata, decode=True, origxml=None):
         # own copy
         self.xmlstr = xmldata[:]
         logger.debug("xmlstr: %s" % (self.xmlstr,))
+        if origxml:
+            self.origxml = origxml
+        else:
+            self.origxml = self.xmlstr
 
         try:
-            self.response = self.signature_check(xmldata, origdoc=origxml,
-                                                 must=self.require_signature,
-                                                 require_response_signature=self.require_response_signature)
+            self.response = self.signature_check(
+                xmldata, origdoc=origxml, must=self.require_signature,
+                require_response_signature=self.require_response_signature)
 
         except TypeError:
             raise
         except SignatureError:
             raise
-        except Exception, excp:
-            #logger.exception("EXCEPTION: %s", excp)
+        except Exception as excp:
+            logger.exception("EXCEPTION: %s", excp)
             raise
 
         #print "<", self.response
@@ -577,7 +582,7 @@ def condition_ok(self, lax=False):
                     conditions.not_on_or_after, self.timeslack)
             if conditions.not_before:
                 validate_before(conditions.not_before, self.timeslack)
-        except Exception, excp:
+        except Exception as excp:
             logger.error("Exception on conditions: %s" % (excp,))
             if not lax:
                 raise
@@ -746,6 +751,19 @@ def _assertion(self, assertion):
         :return: True/False depending on if the assertion is sane or not
         """
 
+        if not hasattr(assertion, 'signature') or not assertion.signature:
+            logger.debug("unsigned")
+            if self.require_signature:
+                raise SignatureError("Signature missing for assertion")
+        else:
+            logger.debug("signed")
+
+        try:
+            self.sec.check_signature(assertion, class_name(assertion),
+                                     self.xmlstr)
+        except Exception as exc:
+            logger.error("correctly_signed_response: %s" % exc)
+            raise
         self.assertion = assertion
         logger.debug("assertion context: %s" % (self.context,))
         logger.debug("assertion keys: %s" % (assertion.keyswv()))
@@ -1041,6 +1059,7 @@ def __init__(self, sec_context, attribute_converters, timeslack=0,
         self.sec = sec_context
         self.timeslack = timeslack
         self.xmlstr = ""
+        self.origxml = ""
         self.name_id = ""
         self.response = None
         self.not_signed = False
@@ -1053,6 +1072,7 @@ def loads(self, xmldata, decode=True, origxml=None):
         # own copy
         self.xmlstr = xmldata[:]
         logger.debug("xmlstr: %s" % (self.xmlstr,))
+        self.origxml = origxml
 
         try:
             self.response = self.signature_check(xmldata, origdoc=origxml)
@@ -1061,7 +1081,7 @@ def loads(self, xmldata, decode=True, origxml=None):
             raise
         except SignatureError:
             raise
-        except Exception, excp:
+        except Exception as excp:
             logger.exception("EXCEPTION: %s", excp)
             raise
 
@@ -1072,7 +1092,7 @@ def loads(self, xmldata, decode=True, origxml=None):
     def verify(self, key_file=""):
         try:
             valid_instance(self.response)
-        except NotValid, exc:
+        except NotValid as exc:
             logger.error("Not valid response: %s" % exc.args[0])
             raise
         return self