Skip to content

Commit a5297ca

Browse files
c00kiemon5terc00kiemon5ter
authored
Merge pull request #641 from skoranda/better_pick_binding
Better pick binding by index
2 parents 8214b54 + 75ca851 commit a5297ca

File tree

3 files changed

+104
-14
lines changed

3 files changed

+104
-14
lines changed

‎src/saml2/entity.py

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -269,16 +269,8 @@ def pick_binding(self, service, bindings=None, descr_type="", request=None,
269269
else:
270270
descr_type = "spsso"
271271

272-
_url = _index = None
273-
if request:
274-
try:
275-
_url = getattr(request, "%s_url" % service)
276-
except AttributeError:
277-
_url = None
278-
try:
279-
_index = getattr(request, "%s_index" % service)
280-
except AttributeError:
281-
pass
272+
_url = getattr(request, "%s_url" % service, None)
273+
_index = getattr(request, "%s_index" % service, None)
282274

283275
for binding in bindings:
284276
try:

‎tests/servera.xml

Lines changed: 65 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,29 @@
1-
<?xml version='1.0' encoding='UTF-8'?>
2-
<ns0:EntityDescriptor xmlns:ns0="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ns1="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:ns2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ns4="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" xmlns:ns5="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" entityID="urn:mace:example.com:saml:roland:sp"><ns0:Extensions><ns1:EntityAttributes><ns2:Attribute Name="http://macedir.org/entity-category"><ns2:AttributeValue xsi:type="xs:string">http://www.swamid.se/category/sfs-1993-1153</ns2:AttributeValue><ns2:AttributeValue xsi:type="xs:string">http://www.swamid.se/category/hei-service</ns2:AttributeValue></ns2:Attribute></ns1:EntityAttributes></ns0:Extensions><ns0:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><ns0:Extensions><ns4:DiscoveryResponse Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="http://lingon.catalogix.se:8087/disco" index="1" /></ns0:Extensions><ns0:KeyDescriptor use="encryption"><ns5:KeyInfo><ns5:X509Data><ns5:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<ns0:EntityDescriptor
3+
xmlns:ns0="urn:oasis:names:tc:SAML:2.0:metadata"
4+
xmlns:ns1="urn:oasis:names:tc:SAML:metadata:attribute"
5+
xmlns:ns2="urn:oasis:names:tc:SAML:2.0:assertion"
6+
xmlns:ns4="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
7+
xmlns:ns5="http://www.w3.org/2000/09/xmldsig#"
8+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
9+
entityID="urn:mace:example.com:saml:roland:sp">
10+
<ns0:Extensions>
11+
<ns1:EntityAttributes>
12+
<ns2:Attribute Name="http://macedir.org/entity-category">
13+
<ns2:AttributeValue xsi:type="xs:string">http://www.swamid.se/category/sfs-1993-1153</ns2:AttributeValue>
14+
<ns2:AttributeValue xsi:type="xs:string">http://www.swamid.se/category/hei-service</ns2:AttributeValue>
15+
</ns2:Attribute>
16+
</ns1:EntityAttributes>
17+
</ns0:Extensions>
18+
<ns0:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
19+
<ns0:Extensions>
20+
<ns4:DiscoveryResponse Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="http://lingon.catalogix.se:8087/disco" index="1"/>
21+
</ns0:Extensions>
22+
<ns0:KeyDescriptor use="encryption">
23+
<ns5:KeyInfo>
24+
<ns5:X509Data>
25+
<ns5:X509Certificate>
26+
MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV
327
BAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX
428
aWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBF
529
MQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50
@@ -14,7 +38,15 @@ mDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6
1438
h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5
1539
U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6
1640
mrPzGzk3ECbupFnqyREH3+ZPSdk=
17-
</ns5:X509Certificate></ns5:X509Data></ns5:KeyInfo></ns0:KeyDescriptor><ns0:KeyDescriptor use="signing"><ns5:KeyInfo><ns5:X509Data><ns5:X509Certificate>MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV
41+
</ns5:X509Certificate>
42+
</ns5:X509Data>
43+
</ns5:KeyInfo>
44+
</ns0:KeyDescriptor>
45+
<ns0:KeyDescriptor use="signing">
46+
<ns5:KeyInfo>
47+
<ns5:X509Data>
48+
<ns5:X509Certificate>
49+
MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV
1850
BAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX
1951
aWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBF
2052
MQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50
@@ -29,4 +61,33 @@ mDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6
2961
h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5
3062
U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6
3163
mrPzGzk3ECbupFnqyREH3+ZPSdk=
32-
</ns5:X509Certificate></ns5:X509Data></ns5:KeyInfo></ns0:KeyDescriptor><ns0:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="http://lingon.catalogix.se:8087/ars" index="1" /><ns0:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="http://lingon.catalogix.se:8087/sls" /><ns0:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="http://lingon.catalogix.se:8087/mni/soap" /><ns0:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://lingon.catalogix.se:8087/mni/post" /><ns0:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://lingon.catalogix.se:8087/mni/redirect" /><ns0:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="http://lingon.catalogix.se:8087/mni/art" /><ns0:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</ns0:NameIDFormat><ns0:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</ns0:NameIDFormat><ns0:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://lingon.catalogix.se:8087/" index="1" /><ns0:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="http://lingon.catalogix.se:8087/paos" index="2" /><ns0:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://lingon.catalogix.se:8087/redirect" index="3" /></ns0:SPSSODescriptor><ns0:Organization><ns0:OrganizationName xml:lang="se">AB Exempel</ns0:OrganizationName><ns0:OrganizationDisplayName xml:lang="se">AB Exempel</ns0:OrganizationDisplayName><ns0:OrganizationURL xml:lang="en">http://www.example.org</ns0:OrganizationURL></ns0:Organization><ns0:ContactPerson contactType="technical"><ns0:GivenName>Roland</ns0:GivenName><ns0:SurName>Hedberg</ns0:SurName><ns0:EmailAddress>[email protected]</ns0:EmailAddress><ns0:EmailAddress>[email protected]</ns0:EmailAddress><ns0:TelephoneNumber>+46 70 100 0000</ns0:TelephoneNumber></ns0:ContactPerson></ns0:EntityDescriptor>
64+
</ns5:X509Certificate>
65+
</ns5:X509Data>
66+
</ns5:KeyInfo>
67+
</ns0:KeyDescriptor>
68+
<ns0:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="http://lingon.catalogix.se:8087/ars" index="1"/>
69+
<ns0:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="http://lingon.catalogix.se:8087/sls"/>
70+
<ns0:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="http://lingon.catalogix.se:8087/mni/soap"/>
71+
<ns0:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://lingon.catalogix.se:8087/mni/post"/>
72+
<ns0:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://lingon.catalogix.se:8087/mni/redirect"/>
73+
<ns0:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="http://lingon.catalogix.se:8087/mni/art"/>
74+
<ns0:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</ns0:NameIDFormat>
75+
<ns0:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</ns0:NameIDFormat>
76+
<ns0:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://lingon.catalogix.se:8087/" index="1"/>
77+
<ns0:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="http://lingon.catalogix.se:8087/paos" index="2"/>
78+
<ns0:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://lingon.catalogix.se:8087/redirect" index="3"/>
79+
<ns0:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://lingon.catalogix.se:8087/another/path" index="4"/>
80+
</ns0:SPSSODescriptor>
81+
<ns0:Organization>
82+
<ns0:OrganizationName xml:lang="se">AB Exempel</ns0:OrganizationName>
83+
<ns0:OrganizationDisplayName xml:lang="se">AB Exempel</ns0:OrganizationDisplayName>
84+
<ns0:OrganizationURL xml:lang="en">http://www.example.org</ns0:OrganizationURL>
85+
</ns0:Organization>
86+
<ns0:ContactPerson contactType="technical">
87+
<ns0:GivenName>Roland</ns0:GivenName>
88+
<ns0:SurName>Hedberg</ns0:SurName>
89+
<ns0:EmailAddress>[email protected]</ns0:EmailAddress>
90+
<ns0:EmailAddress>[email protected]</ns0:EmailAddress>
91+
<ns0:TelephoneNumber>+46 70 100 0000</ns0:TelephoneNumber>
92+
</ns0:ContactPerson>
93+
</ns0:EntityDescriptor>

‎tests/test_71_authn_request.py

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
from contextlib import closing
2+
from saml2.client import Saml2Client
3+
from saml2.server import Server
4+
5+
6+
def test_authn_request_with_acs_by_index():
7+
# ACS index and location from SP metadata in servera.xml.
8+
ACS_INDEX = '4'
9+
ACS_LOCATION = 'http://lingon.catalogix.se:8087/another/path'
10+
11+
# Create SP using the configuration found in servera_conf.py.
12+
sp = Saml2Client(config_file="servera_conf")
13+
14+
# Generate an authn request object that uses AssertionConsumerServiceIndex
15+
# instead of AssertionConsumerServiceURL. The index with label ACS_INDEX
16+
# exists in the SP metadata in servera.xml.
17+
request_id, authn_request = sp.create_authn_request(
18+
sp.config.entityid,
19+
assertion_consumer_service_index=ACS_INDEX)
20+
21+
# Make sure the authn_request contains AssertionConsumerServiceIndex.
22+
acs_index = getattr(authn_request,
23+
'assertion_consumer_service_index', None)
24+
25+
assert acs_index == ACS_INDEX
26+
27+
# Create IdP.
28+
with closing(Server(config_file="idp_all_conf")) as idp:
29+
30+
# Ask the IdP to pick out the binding and destination from the
31+
# authn_request.
32+
binding, destination = idp.pick_binding("assertion_consumer_service",
33+
request=authn_request)
34+
35+
# Make sure the IdP pick_binding method picks the correct location
36+
# or destination based on the ACS index in the authn request.
37+
assert destination == ACS_LOCATION

0 commit comments

Comments
 (0)