Fixed decryption/verification of signed and encrypted assertions.

Author: Roland Hedberg

src/saml2/client_base.py

@@ -545,8 +545,8 @@ def parse_authn_request_response(self, xmlstr, binding, outstanding=None,
                 raise
             except UnravelError:
                 return None
-            except Exception:
-                logger.error("XML parse error")
+            except Exception as err:
+                logger.error("XML parse error: %s" % err)
                 raise
 
             #logger.debug(">> %s", resp)

src/saml2/entity.py

@@ -841,7 +841,7 @@ def _parse_response(self, xmlstr, response_cls, service, binding,
         response = None
 
         if self.config.accepted_time_diff:
-            timeslack = self.config.accepted_time_diff
+            kwargs["timeslack"] = self.config.accepted_time_diff
 
         if "asynchop" not in kwargs:
             if binding in [BINDING_SOAP, BINDING_PAOS]:

src/saml2/response.py

@@ -475,7 +475,7 @@ def __init__(self, sec_context, attribute_converters, entity_id,
         else:
             self.outstanding_queries = {}
         self.context = "AuthnReq"
-        self.came_from = ""
+        self.came_from = None
         self.ava = None
         self.assertion = None
         self.assertions = []
@@ -507,7 +507,7 @@ def loads(self, xmldata, decode=True, origxml=None):
         if self.asynchop:
             if self.in_response_to in self.outstanding_queries:
                 self.came_from = self.outstanding_queries[self.in_response_to]
-                del self.outstanding_queries[self.in_response_to]
+                #del self.outstanding_queries[self.in_response_to]
                 try:
                     if not self.check_subject_confirmation_in_response_to(
                             self.in_response_to):
@@ -529,7 +529,7 @@ def loads(self, xmldata, decode=True, origxml=None):
 
     def clear(self):
         self._clear()
-        self.came_from = ""
+        self.came_from = None
         self.ava = None
         self.assertion = None
 
@@ -667,12 +667,12 @@ def _bearer_confirmed(self, data):
         if not later_than(data.not_on_or_after, data.not_before):
             return False
 
-        if self.asynchop and not self.came_from:
+        if self.asynchop and self.came_from is None:
             if data.in_response_to:
                 if data.in_response_to in self.outstanding_queries:
                     self.came_from = self.outstanding_queries[
                         data.in_response_to]
-                    del self.outstanding_queries[data.in_response_to]
+                    #del self.outstanding_queries[data.in_response_to]
                 elif self.allow_unsolicited:
                     pass
                 else:
@@ -744,7 +744,7 @@ def get_subject(self):
         logger.info("Subject NameID: %s" % self.name_id)
         return self.name_id
 
-    def _assertion(self, assertion):
+    def _assertion(self, assertion, verified=False):
         """
         Check the assertion
         :param assertion:
@@ -758,12 +758,13 @@ def _assertion(self, assertion):
         else:
             logger.debug("signed")
 
-            try:
-                self.sec.check_signature(assertion, class_name(assertion),
-                                         self.xmlstr)
-            except Exception as exc:
-                logger.error("correctly_signed_response: %s" % exc)
-                raise
+            if not verified:
+                try:
+                    self.sec.check_signature(assertion, class_name(assertion),
+                                             self.xmlstr)
+                except Exception as exc:
+                    logger.error("correctly_signed_response: %s" % exc)
+                    raise
 
         self.assertion = assertion
         logger.debug("assertion context: %s" % (self.context,))
@@ -791,23 +792,23 @@ def _assertion(self, assertion):
             if self.asynchop:
                 if self.allow_unsolicited:
                     pass
-                elif not self.came_from:
+                elif self.came_from is None:
                     raise VerificationError("Came from")
             return True
         except Exception:
             logger.exception("get subject")
             raise
 
-    def decrypt_assertions(self, encrypted_assertions, key_file=""):
+    def decrypt_assertions(self, encrypted_assertions, decr_txt):
         res = []
         for encrypted_assertion in encrypted_assertions:
             if encrypted_assertion.extension_elements:
                 assertions = extension_elements_to_elements(
                     encrypted_assertion.extension_elements, [saml, samlp])
                 for assertion in assertions:
                     if assertion.signature:
-                        if not self.sec.verify_signature(
-                                "%s" % assertion, key_file,
+                        if not self.sec.check_signature(
+                                assertion, origdoc=decr_txt,
                                 node_name=class_name(assertion)):
                             logger.error(
                                 "Failed to verify signature on '%s'" % assertion)
@@ -826,21 +827,23 @@ def parse_assertion(self, key_file=""):
             except AssertionError:
                 raise Exception("No assertion part")
 
+        res = []
         if self.response.encrypted_assertion:
             logger.debug("***Encrypted assertion/-s***")
             decr_text = self.sec.decrypt(self.xmlstr, key_file)
             resp = samlp.response_from_string(decr_text)
-            res = self.decrypt_assertions(resp.encrypted_assertion, key_file)
+            res = self.decrypt_assertions(resp.encrypted_assertion, decr_text)
             if self.response.assertion:
                 self.response.assertion.extend(res)
             else:
                 self.response.assertion = res
             self.response.encrypted_assertion = []
+            self.xmlstr = decr_text
 
         if self.response.assertion:
             logger.debug("***Unencrypted assertion***")
             for assertion in self.response.assertion:
-                if not self._assertion(assertion):
+                if not self._assertion(assertion, assertion in res):
                     return False
                 else:
                     self.assertions.append(assertion)

src/saml2/sigver.py

@@ -1377,7 +1377,7 @@ def check_signature(self, item, node_name=NODE_NAME, origdoc=None,
         """
 
         :param item: Parsed entity
-        :param node_name:
+        :param node_name: The name of the class that is signed
         :param origdoc: The original XML string
         :param id_attr:
         :param must:

tests/test_41_response.py

@@ -8,13 +8,11 @@
 from saml2.response import response_factory
 from saml2.response import StatusResponse
 from saml2.response import AuthnResponse
-from saml2.sigver import security_context, SignatureError
-from saml2.sigver import MissingKey
-
-from pytest import raises
+from saml2.sigver import SignatureError
 
 FALSE_ASSERT_SIGNED = "saml_false_signed.xml"
 
+TIMESLACK = 2592000  # Roughly 3 month
 
 def _eq(l1, l2):
     return set(l1) == set(l2)
@@ -73,7 +71,7 @@ def test_1(self):
                                     "http://lingon.catalogix.se:8087/"],
                                 outstanding_queries={
                                     "id12": "http://localhost:8088/sso"},
-                                timeslack=10000, decode=False)
+                                timeslack=TIMESLACK, decode=False)
 
         assert isinstance(resp, StatusResponse)
         assert isinstance(resp, AuthnResponse)
@@ -85,7 +83,7 @@ def test_2(self):
                                     "http://lingon.catalogix.se:8087/"],
                                 outstanding_queries={
                                     "id12": "http://localhost:8088/sso"},
-                                timeslack=10000, decode=False)
+                                timeslack=TIMESLACK, decode=False)
 
         assert isinstance(resp, StatusResponse)
         assert isinstance(resp, AuthnResponse)
@@ -98,7 +96,7 @@ def test_false_sign(self):
             outstanding_queries={
                 "bahigehogffohiphlfmplepdpcohkhhmheppcdie":
                     "http://localhost:8088/sso"},
-            timeslack=1000000, decode=False)
+            timeslack=TIMESLACK, decode=False)
 
         assert isinstance(resp, StatusResponse)
         assert isinstance(resp, AuthnResponse)