Added a method that checks any given return URL against what's registered in metadata.

Author: Roland Hedberg

src/saml2/discovery.py

@@ -62,7 +62,8 @@ def parse_discovery_service_request(self, url="", query=""):
 
     # -------------------------------------------------------------------------
 
-    def create_discovery_service_response(self, return_url=None,
+    @staticmethod
+    def create_discovery_service_response(return_url=None,
                                           returnIDParam="entityID",
                                           entity_id=None, **kwargs):
         if return_url is None:
@@ -87,3 +88,13 @@ def verify_sp_in_metadata(self, entity_id):
                 return True
 
         return False
+
+    def verify_return(self, entity_id, return_url):
+        for endp in self.metadata.discovery_response(entity_id):
+            try:
+                assert return_url.startswith(endp["location"])
+            except AssertionError:
+                pass
+            else:
+                return True
+        return False