Skip to content

Commit 63023d2

Browse files
skorandaskoranda
authored
Merge pull request #423 from jkakavas/fix_attr_filtering
Use the internal representation names instead of metadata FriendlyNames for attributes in order to do name filtering. Solves #422
2 parents 63d3165 + f00e0dd commit 63023d2

File tree

4 files changed

+58
-43
lines changed

4 files changed

+58
-43
lines changed

‎src/saml2/assertion.py

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -78,19 +78,22 @@ def filter_on_attributes(ava, required=None, optional=None, acs=None,
7878
"""
7979

8080
def _match_attr_name(attr, ava):
81-
try:
82-
friendly_name = attr["friendly_name"]
83-
except KeyError:
84-
friendly_name = get_local_name(acs, attr["name"],
85-
attr["name_format"])
81+
82+
local_name = get_local_name(acs, attr["name"], attr["name_format"])
83+
if not local_name:
84+
try:
85+
local_name = attr["friendly_name"]
86+
except KeyError:
87+
pass
8688

87-
_fn = _match(friendly_name, ava)
89+
_fn = _match(local_name, ava)
8890
if not _fn: # In the unlikely case that someone has provided us with
8991
# URIs as attribute names
9092
_fn = _match(attr["name"], ava)
9193

9294
return _fn
9395

96+
9497
def _apply_attr_value_restrictions(attr, res, must=False):
9598
try:
9699
values = [av["text"] for av in attr["attribute_value"]]
@@ -105,7 +108,6 @@ def _apply_attr_value_restrictions(attr, res, must=False):
105108
return _filter_values(ava[_fn], values, must)
106109

107110
res = {}
108-
109111
if required is None:
110112
required = []
111113

‎tests/test_20_assertion.py

Lines changed: 25 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ def test_filter_on_attributes_0():
6464
required = [a]
6565
ava = {"serialNumber": ["12345"]}
6666

67-
ava = filter_on_attributes(ava, required)
67+
ava = filter_on_attributes(ava, required, acs=ac_factory())
6868
assert list(ava.keys()) == ["serialNumber"]
6969
assert ava["serialNumber"] == ["12345"]
7070

@@ -76,11 +76,23 @@ def test_filter_on_attributes_1():
7676
required = [a]
7777
ava = {"serialNumber": ["12345"], "givenName": ["Lars"]}
7878

79-
ava = filter_on_attributes(ava, required)
79+
ava = filter_on_attributes(ava, required, acs=ac_factory())
8080
assert list(ava.keys()) == ["serialNumber"]
8181
assert ava["serialNumber"] == ["12345"]
8282

8383

84+
def test_filter_on_attributes_2():
85+
86+
a = to_dict(Attribute(friendly_name="surName",name="urn:oid:2.5.4.4",
87+
name_format=NAME_FORMAT_URI), ONTS)
88+
required = [a]
89+
ava = {"sn":["kakavas"]}
90+
91+
ava = filter_on_attributes(ava,required,acs=ac_factory())
92+
assert list(ava.keys()) == ['sn']
93+
assert ava["sn"] == ["kakavas"]
94+
95+
8496
def test_filter_on_attributes_without_friendly_name():
8597
ava = {"eduPersonTargetedID": "[email protected]",
8698
"eduPersonAffiliation": "test",
@@ -106,7 +118,7 @@ def test_filter_on_attributes_with_missing_required_attribute():
106118
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10",
107119
name_format=NAME_FORMAT_URI), ONTS)
108120
with pytest.raises(MissingValue):
109-
filter_on_attributes(ava, required=[eptid])
121+
filter_on_attributes(ava, required=[eptid], acs=ac_factory())
110122

111123

112124
def test_filter_on_attributes_with_missing_optional_attribute():
@@ -115,7 +127,7 @@ def test_filter_on_attributes_with_missing_optional_attribute():
115127
friendly_name="eduPersonTargetedID",
116128
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10",
117129
name_format=NAME_FORMAT_URI), ONTS)
118-
assert filter_on_attributes(ava, optional=[eptid]) == {}
130+
assert filter_on_attributes(ava, optional=[eptid], acs=ac_factory()) == {}
119131

120132

121133
# ----------------------------------------------------------------------
@@ -420,7 +432,7 @@ def test_filter_values_req_2():
420432
required = [a1, a2]
421433
ava = {"serialNumber": ["12345"], "givenName": ["Lars"]}
422434

423-
raises(MissingValue, filter_on_attributes, ava, required)
435+
raises(MissingValue, filter_on_attributes, ava, required, acs=ac_factory())
424436

425437

426438
def test_filter_values_req_3():
@@ -432,7 +444,7 @@ def test_filter_values_req_3():
432444
required = [a]
433445
ava = {"serialNumber": ["12345"]}
434446

435-
ava = filter_on_attributes(ava, required)
447+
ava = filter_on_attributes(ava, required, acs=ac_factory())
436448
assert list(ava.keys()) == ["serialNumber"]
437449
assert ava["serialNumber"] == ["12345"]
438450

@@ -446,7 +458,7 @@ def test_filter_values_req_4():
446458
required = [a]
447459
ava = {"serialNumber": ["12345"]}
448460

449-
raises(MissingValue, filter_on_attributes, ava, required)
461+
raises(MissingValue, filter_on_attributes, ava, required, acs=ac_factory())
450462

451463

452464
def test_filter_values_req_5():
@@ -458,7 +470,7 @@ def test_filter_values_req_5():
458470
required = [a]
459471
ava = {"serialNumber": ["12345", "54321"]}
460472

461-
ava = filter_on_attributes(ava, required)
473+
ava = filter_on_attributes(ava, required, acs=ac_factory())
462474
assert list(ava.keys()) == ["serialNumber"]
463475
assert ava["serialNumber"] == ["12345"]
464476

@@ -472,7 +484,7 @@ def test_filter_values_req_6():
472484
required = [a]
473485
ava = {"serialNumber": ["12345", "54321"]}
474486

475-
ava = filter_on_attributes(ava, required)
487+
ava = filter_on_attributes(ava, required, acs=ac_factory())
476488
assert list(ava.keys()) == ["serialNumber"]
477489
assert ava["serialNumber"] == ["54321"]
478490

@@ -489,7 +501,7 @@ def test_filter_values_req_opt_0():
489501

490502
ava = {"serialNumber": ["12345", "54321"]}
491503

492-
ava = filter_on_attributes(ava, [r], [o])
504+
ava = filter_on_attributes(ava, [r], [o], acs=ac_factory())
493505
assert list(ava.keys()) == ["serialNumber"]
494506
assert _eq(ava["serialNumber"], ["12345", "54321"])
495507

@@ -507,7 +519,7 @@ def test_filter_values_req_opt_1():
507519

508520
ava = {"serialNumber": ["12345", "54321"]}
509521

510-
ava = filter_on_attributes(ava, [r], [o])
522+
ava = filter_on_attributes(ava, [r], [o], acs=ac_factory())
511523
assert list(ava.keys()) == ["serialNumber"]
512524
assert _eq(ava["serialNumber"], ["12345", "54321"])
513525

@@ -543,7 +555,7 @@ def test_filter_values_req_opt_2():
543555
ava = {"surname": ["Hedberg"], "givenName": ["Roland"],
544556
"eduPersonAffiliation": ["staff"], "uid": ["rohe0002"]}
545557

546-
raises(MissingValue, "filter_on_attributes(ava, r, o)")
558+
raises(MissingValue, "filter_on_attributes(ava, r, o, acs=ac_factory())")
547559

548560

549561
# ---------------------------------------------------------------------------
@@ -923,3 +935,4 @@ def test_assertion_with_authn_instant():
923935

924936
if __name__ == "__main__":
925937
test_assertion_2()
938+

‎tests/test_50_server.py

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ def setup_class(self):
9696
self.client = client.Saml2Client(conf)
9797
self.name_id = self.server.ident.transient_nameid(
9898
"urn:mace:example.com:saml:roland:sp", "id12")
99-
self.ava = {"givenName": ["Derek"], "surName": ["Jeter"],
99+
self.ava = {"givenName": ["Derek"], "sn": ["Jeter"],
100100
"mail": ["[email protected]"], "title": "The man"}
101101

102102
def teardown_class(self):
@@ -110,7 +110,7 @@ def verify_assertion(self, assertion):
110110

111111
assert ava ==\
112112
{'mail': ['[email protected]'], 'givenName': ['Derek'],
113-
'surName': ['Jeter'], 'title': ['The man']}
113+
'sn': ['Jeter'], 'title': ['The man']}
114114

115115

116116
def verify_encrypted_assertion(self, assertion, decr_text):
@@ -145,7 +145,7 @@ def test_assertion(self):
145145
format=saml.NAMEID_FORMAT_TRANSIENT)),
146146
attribute_statement=do_attribute_statement(
147147
{
148-
("", "", "surName"): ("Jeter", ""),
148+
("", "", "sn"): ("Jeter", ""),
149149
("", "", "givenName"): ("Derek", ""),
150150
}
151151
),
@@ -164,12 +164,12 @@ def test_assertion(self):
164164
attr1 = attribute_statement.attribute[1]
165165
if attr0.attribute_value[0].text == "Derek":
166166
assert attr0.friendly_name == "givenName"
167-
assert attr1.friendly_name == "surName"
167+
assert attr1.friendly_name == "sn"
168168
assert attr1.attribute_value[0].text == "Jeter"
169169
else:
170170
assert attr1.friendly_name == "givenName"
171171
assert attr1.attribute_value[0].text == "Derek"
172-
assert attr0.friendly_name == "surName"
172+
assert attr0.friendly_name == "sn"
173173
assert attr0.attribute_value[0].text == "Jeter"
174174
#
175175
subject = assertion.subject
@@ -187,7 +187,7 @@ def test_response(self):
187187
name_id=saml.NAMEID_FORMAT_TRANSIENT),
188188
attribute_statement=do_attribute_statement(
189189
{
190-
("", "", "surName"): ("Jeter", ""),
190+
("", "", "sn"): ("Jeter", ""),
191191
("", "", "givenName"): ("Derek", ""),
192192
}
193193
),
@@ -277,7 +277,7 @@ def test_sso_response_with_identity(self):
277277
resp = self.server.create_authn_response(
278278
{
279279
"eduPersonEntitlement": "Short stop",
280-
"surName": "Jeter",
280+
"sn": "Jeter",
281281
"givenName": "Derek",
282282
"mail": "[email protected]",
283283
"title": "The man"
@@ -394,7 +394,7 @@ def test_authn_response_0(self):
394394
conf.load_file("server_conf")
395395
self.client = client.Saml2Client(conf)
396396

397-
ava = {"givenName": ["Derek"], "surName": ["Jeter"],
397+
ava = {"givenName": ["Derek"], "sn": ["Jeter"],
398398
"mail": ["[email protected]"], "title": "The man"}
399399

400400
npolicy = samlp.NameIDPolicy(format=saml.NAMEID_FORMAT_TRANSIENT,
@@ -425,7 +425,7 @@ def test_authn_response_0(self):
425425
def test_signed_response(self):
426426
name_id = self.server.ident.transient_nameid(
427427
"urn:mace:example.com:saml:roland:sp", "id12")
428-
ava = {"givenName": ["Derek"], "surName": ["Jeter"],
428+
ava = {"givenName": ["Derek"], "sn": ["Jeter"],
429429
"mail": ["[email protected]"], "title": "The man"}
430430

431431
signed_resp = self.server.create_authn_response(
@@ -1139,7 +1139,7 @@ def test_slo_http_post(self):
11391139
"not_on_or_after": soon,
11401140
"user": {
11411141
"givenName": "Leo",
1142-
"surName": "Laport",
1142+
"sn": "Laport",
11431143
}
11441144
}
11451145
self.client.users.add_information_about_person(sinfo)
@@ -1163,7 +1163,7 @@ def test_slo_soap(self):
11631163
"not_on_or_after": soon,
11641164
"user": {
11651165
"givenName": "Leo",
1166-
"surName": "Laport",
1166+
"sn": "Laport",
11671167
}
11681168
}
11691169

@@ -1188,7 +1188,7 @@ def test_slo_soap(self):
11881188
#------------------------------------------------------------------------
11891189

11901190
IDENTITY = {"eduPersonAffiliation": ["staff", "member"],
1191-
"surName": ["Jeter"], "givenName": ["Derek"],
1191+
"sn": ["Jeter"], "givenName": ["Derek"],
11921192
"mail": ["[email protected]"], "title": "The man"}
11931193

11941194

@@ -1234,7 +1234,7 @@ def _logout_request(conf_file):
12341234
"not_on_or_after": soon,
12351235
"user": {
12361236
"givenName": "Leo",
1237-
"surName": "Laport",
1237+
"sn": "Laport",
12381238
}
12391239
}
12401240
sp.users.add_information_about_person(sinfo)

‎tests/test_51_client.py

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -366,7 +366,7 @@ def test_create_logout_request(self):
366366
def test_response_1(self):
367367
IDP = "urn:mace:example.com:saml:roland:idp"
368368

369-
ava = {"givenName": ["Derek"], "surName": ["Jeter"],
369+
ava = {"givenName": ["Derek"], "sn": ["Jeter"],
370370
"mail": ["[email protected]"], "title": ["The man"]}
371371

372372
nameid_policy = samlp.NameIDPolicy(allow_create="false",
@@ -414,7 +414,7 @@ def test_response_1(self):
414414

415415
# --- authenticate another person
416416

417-
ava = {"givenName": ["Alfonson"], "surName": ["Soriano"],
417+
ava = {"givenName": ["Alfonson"], "sn": ["Soriano"],
418418
"mail": ["[email protected]"], "title": ["outfielder"]}
419419

420420
resp_str = "%s" % self.server.create_authn_response(
@@ -732,7 +732,7 @@ def test_response_8(self):
732732

733733
def setup_verify_authn_response(self):
734734
idp = "urn:mace:example.com:saml:roland:idp"
735-
ava = {"givenName": ["Derek"], "surName": ["Jeter"],
735+
ava = {"givenName": ["Derek"], "sn": ["Jeter"],
736736
"mail": ["[email protected]"], "title": ["The man"]}
737737
ava_verify = {'mail': ['[email protected]'], 'givenName': ['Derek'],
738738
'sn': ['Jeter'], 'title': ["The man"]}
@@ -781,7 +781,7 @@ def test_sign_then_encrypt_assertion(self):
781781
format=saml.NAMEID_FORMAT_TRANSIENT)),
782782
attribute_statement=do_attribute_statement(
783783
{
784-
("", "", "surName"): ("Jeter", ""),
784+
("", "", "sn"): ("Jeter", ""),
785785
("", "", "givenName"): ("Derek", ""),
786786
}
787787
),
@@ -845,7 +845,7 @@ def test_sign_then_encrypt_assertion2(self):
845845
nameid_policy = samlp.NameIDPolicy(allow_create="false",
846846
format=saml.NAMEID_FORMAT_PERSISTENT)
847847

848-
asser = Assertion({"givenName": "Derek", "surName": "Jeter"})
848+
asser = Assertion({"givenName": "Derek", "sn": "Jeter"})
849849
farg = add_path(
850850
{},
851851
['assertion', 'subject', 'subject_confirmation', 'method',
@@ -916,7 +916,7 @@ def test_sign_then_encrypt_assertion_advice_1(self):
916916
nameid_policy = samlp.NameIDPolicy(allow_create="false",
917917
format=saml.NAMEID_FORMAT_PERSISTENT)
918918

919-
asser = Assertion({"givenName": "Derek", "surName": "Jeter"})
919+
asser = Assertion({"givenName": "Derek", "sn": "Jeter"})
920920

921921
subject_confirmation_specs = {
922922
'recipient': "http://lingon.catalogix.se:8087/",
@@ -1047,7 +1047,7 @@ def test_sign_then_encrypt_assertion_advice_2(self):
10471047
name_id=name_id,
10481048
farg=farg['assertion'])
10491049

1050-
asser_2 = Assertion({"surName": "Jeter"})
1050+
asser_2 = Assertion({"sn": "Jeter"})
10511051

10521052
assertion_2 = asser_2.construct(
10531053
self.client.config.entityid,
@@ -1333,7 +1333,7 @@ def test_do_logout_signed_redirect(self):
13331333
"not_on_or_after": in_a_while(minutes=15),
13341334
"ava": {
13351335
"givenName": "Anders",
1336-
"surName": "Andersson",
1336+
"sn": "Andersson",
13371337
"mail": "[email protected]"
13381338
}
13391339
}
@@ -1370,7 +1370,7 @@ def test_do_logout_post(self):
13701370
"not_on_or_after": in_a_while(minutes=15),
13711371
"ava": {
13721372
"givenName": "Anders",
1373-
"surName": "Andersson",
1373+
"sn": "Andersson",
13741374
"mail": "[email protected]"
13751375
},
13761376
"session_index": SessionIndex("_foo")
@@ -1400,7 +1400,7 @@ def test_do_logout_session_expired(self):
14001400
"not_on_or_after": a_while_ago(minutes=15),
14011401
"ava": {
14021402
"givenName": "Anders",
1403-
"surName": "Andersson",
1403+
"sn": "Andersson",
14041404
"mail": "[email protected]"
14051405
},
14061406
"session_index": SessionIndex("_foo")
@@ -1493,7 +1493,7 @@ def test_logout_1(self):
14931493
"not_on_or_after": in_a_while(minutes=15),
14941494
"ava": {
14951495
"givenName": "Anders",
1496-
"surName": "Andersson",
1496+
"sn": "Andersson",
14971497
"mail": "[email protected]"
14981498
}
14991499
}

0 commit comments

Comments
 (0)