Skip to content

Commit fbb8c10

Browse files
author
Hans Hörberg
committed
Add functionality to generate new certificates for each authn reqeust and response.
1 parent a608d92 commit fbb8c10

File tree

16 files changed

+935
-85
lines changed

16 files changed

+935
-85
lines changed

‎example/idp2/idp.py

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -297,10 +297,13 @@ def do(self, query, binding_in, relay_state=""):
297297
if REPOZE_ID_EQUIVALENT:
298298
identity[REPOZE_ID_EQUIVALENT] = self.user
299299
try:
300+
sign_assertion = IDP.config.getattr("sign_assertion", "idp")
301+
if sign_assertion is None:
302+
sign_assertion = False
300303
_resp = IDP.create_authn_response(
301304
identity, userid=self.user,
302-
authn=AUTHN_BROKER[self.environ["idp.authn_ref"]],
303-
**resp_args)
305+
authn=AUTHN_BROKER[self.environ["idp.authn_ref"]], sign_assertion=sign_assertion,
306+
sign_response=False, **resp_args)
304307
except Exception, excp:
305308
logging.error(exception_trace(excp))
306309
resp = ServiceError("Exception: %s" % (excp,))
@@ -322,6 +325,7 @@ def _store_request(self, _dict):
322325

323326
def redirect(self):
324327
""" This is the HTTP-redirect endpoint """
328+
325329
logger.info("--- In SSO Redirect ---")
326330
_info = self.unpack_redirect()
327331

‎example/sp/nocert_sp_conf/sp.xml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
<?xml version='1.0' encoding='UTF-8'?>
2+
<ns0:EntityDescriptor xmlns:ns0="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ns1="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:ns2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ns4="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" xmlns:ns5="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" entityID="http://localhost:8087/LocalTestSPHans.xml"><ns0:Extensions><ns1:EntityAttributes><ns2:Attribute Name="http://macedir.org/entity-category"><ns2:AttributeValue xsi:type="xs:string">http://www.geant.net/uri/dataprotection-code-of-conduct/v1</ns2:AttributeValue><ns2:AttributeValue xsi:type="xs:string">http://www.swamid.se/category/research-and-education</ns2:AttributeValue><ns2:AttributeValue xsi:type="xs:string">http://www.swamid.se/category/hei-service</ns2:AttributeValue><ns2:AttributeValue xsi:type="xs:string">http://www.swamid.se/category/sfs-1993-1153</ns2:AttributeValue><ns2:AttributeValue xsi:type="xs:string">http://www.swamid.se/category/nren-service</ns2:AttributeValue><ns2:AttributeValue xsi:type="xs:string">http://www.swamid.se/category/eu-adequate-protection</ns2:AttributeValue></ns2:Attribute></ns1:EntityAttributes></ns0:Extensions><ns0:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><ns0:Extensions><ns4:DiscoveryResponse Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="http://localhost:8087/disco" index="1" /></ns0:Extensions><ns0:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://localhost:8087/slo" /><ns0:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://localhost:8087" index="1" /></ns0:SPSSODescriptor><ns0:Organization><ns0:OrganizationName xml:lang="en">Lokal test SP Hans</ns0:OrganizationName><ns0:OrganizationDisplayName xml:lang="se">Lokal test SP Hans</ns0:OrganizationDisplayName><ns0:OrganizationDisplayName xml:lang="en">Lokal test SP Hans</ns0:OrganizationDisplayName><ns0:OrganizationURL xml:lang="en">http://130.239.200.146:8087</ns0:OrganizationURL></ns0:Organization></ns0:EntityDescriptor>

‎example/sp/nocert_sp_conf/sp_conf.py

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
from saml2 import BINDING_HTTP_REDIRECT
2+
from saml2.extension.idpdisc import BINDING_DISCO
3+
from saml2.saml import NAME_FORMAT_URI
4+
from saml2.sigver import get_xmlsec_binary, CertHandlerExtra
5+
from saml2.entity_category.edugain import COC
6+
from saml2.entity_category.swamid import RESEARCH_AND_EDUCATION
7+
from saml2.entity_category.swamid import HEI
8+
from saml2.entity_category.swamid import SFS_1993_1153
9+
from saml2.entity_category.swamid import NREN
10+
from saml2.entity_category.swamid import EU
11+
12+
13+
#BASE= "http://130.239.200.146:8087"
14+
BASE= "http://localhost:8087"
15+
#BASE= "http://lingon.catalogix.se:8087"
16+
17+
18+
class SpCertHandlerExtraClass(CertHandlerExtra):
19+
20+
def use_generate_cert_func(self):
21+
return True
22+
23+
def generate_cert(self, generate_cert_info, ca_cert_string, ca_key_string):
24+
print "Hello"
25+
return (ca_cert_string, ca_key_string)
26+
27+
def use_validate_cert_func(self):
28+
return False
29+
30+
def validate_cert(self, cert_str, ca_cert_string, ca_key_string):
31+
pass
32+
33+
CONFIG = {
34+
"entityid": "%s/LocalTestSPHans.xml" % BASE,
35+
"description": "Lokal test SP Hans",
36+
"entity_category": [COC, RESEARCH_AND_EDUCATION, HEI, SFS_1993_1153, NREN, EU],
37+
"only_use_keys_in_metadata": False,
38+
"cert_handler_extra_class": None,#MyCertGeneration(),
39+
"generate_cert_info": {
40+
"cn": "localhost",
41+
"country_code": "se",
42+
"state": "ac",
43+
"city": "Umea",
44+
"organization": "ITS Umea University",
45+
"organization_unit": "DIRG"
46+
},
47+
"tmp_key_file": "pki/tmp_mykey.pem",
48+
"tmp_cert_file": "pki/tmp_mycert.pem",
49+
"validate_certificate": True,
50+
"service": {
51+
"sp": {
52+
"authn_requests_signed": "true", #Will sign the request!
53+
"want_assertions_signed": "true", #Demands that the assertion is signed.
54+
"name": "LocalTestSPHans",
55+
"endpoints": {
56+
"assertion_consumer_service": [BASE],
57+
"single_logout_service": [(BASE + "/slo",
58+
BINDING_HTTP_REDIRECT)],
59+
"discovery_response": [
60+
("%s/disco" % BASE, BINDING_DISCO)
61+
]
62+
},
63+
"required_attributes": ["surname", "givenname",
64+
"edupersonaffiliation"],
65+
"optional_attributes": ["title"],
66+
}
67+
},
68+
"debug": 1,
69+
"key_file": "pki/localhost.ca.key",
70+
"cert_file": "pki/localhost.ca.crt",
71+
"attribute_map_dir": "./attributemaps",
72+
"metadata": {
73+
"local": ["../idp2/idp_nocert.xml"]
74+
# #"remote": [{"url": "http://130.239.201.5/role/idp.xml", "cert": None}],
75+
},
76+
#"metadata": {"local": ["/Users/haho0032/Develop/svn/trunk/pyOpSamlProxy/idp_nocert.xml"]},
77+
78+
# -- below used by make_metadata --
79+
"organization": {
80+
"name": "Lokal test SP Hans",
81+
"display_name": [("Lokal test SP Hans", "se"), ("Lokal test SP Hans", "en")],
82+
"url": "http://130.239.200.146:8087",
83+
},
84+
"contact_person": [
85+
],
86+
"xmlsec_binary": '/usr/local/bin/xmlsec1',
87+
"name_form": NAME_FORMAT_URI,
88+
"logger": {
89+
"rotating": {
90+
"filename": "sp.log",
91+
"maxBytes": 100000,
92+
"backupCount": 5,
93+
},
94+
"loglevel": "debug",
95+
}
96+
}
97+

‎example/sp/nocert_sp_conf/who.ini

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
[plugin:auth_tkt]
2+
# identification
3+
use = repoze.who.plugins.auth_tkt:make_plugin
4+
secret = kasamark
5+
cookie_name = pysaml2
6+
secure = False
7+
include_ip = True
8+
timeout = 3600
9+
reissue_time = 3000
10+
11+
# IDENTIFIER
12+
# @param :
13+
# - rememberer_name : name of the plugin for remembering (delegate)
14+
[plugin:saml2auth]
15+
use = s2repoze.plugins.sp:make_plugin
16+
saml_conf = sp_conf
17+
remember_name = auth_tkt
18+
sid_store = outstanding
19+
idp_query_param = IdPEntityId
20+
discovery = http://130.239.201.5/role/idp.ds
21+
22+
[general]
23+
request_classifier = s2repoze.plugins.challenge_decider:my_request_classifier
24+
challenge_decider = repoze.who.classifiers:default_challenge_decider
25+
remote_user_key = REMOTE_USER
26+
27+
[identifiers]
28+
# plugin_name;classifier_name:.. or just plugin_name (good for any)
29+
plugins =
30+
saml2auth
31+
auth_tkt
32+
33+
[authenticators]
34+
# plugin_name;classifier_name.. or just plugin_name (good for any)
35+
plugins = saml2auth
36+
37+
[challengers]
38+
# plugin_name;classifier_name:.. or just plugin_name (good for any)
39+
plugins = saml2auth
40+
41+
[mdproviders]
42+
plugins = saml2auth

‎example/sp/sp.xml

Lines changed: 1 addition & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,2 @@
11
<?xml version='1.0' encoding='UTF-8'?>
2-
<ns0:EntityDescriptor xmlns:ns0="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ns1="http://www.w3.org/2000/09/xmldsig#" entityID="http://localhost:8087/sp.xml"><ns0:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><ns0:KeyDescriptor use="encryption"><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIIC8jCCAlugAwIBAgIJAJHg2V5J31I8MA0GCSqGSIb3DQEBBQUAMFoxCzAJBgNV
3-
BAYTAlNFMQ0wCwYDVQQHEwRVbWVhMRgwFgYDVQQKEw9VbWVhIFVuaXZlcnNpdHkx
4-
EDAOBgNVBAsTB0lUIFVuaXQxEDAOBgNVBAMTB1Rlc3QgU1AwHhcNMDkxMDI2MTMz
5-
MTE1WhcNMTAxMDI2MTMzMTE1WjBaMQswCQYDVQQGEwJTRTENMAsGA1UEBxMEVW1l
6-
YTEYMBYGA1UEChMPVW1lYSBVbml2ZXJzaXR5MRAwDgYDVQQLEwdJVCBVbml0MRAw
7-
DgYDVQQDEwdUZXN0IFNQMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDkJWP7
8-
bwOxtH+E15VTaulNzVQ/0cSbM5G7abqeqSNSs0l0veHr6/ROgW96ZeQ57fzVy2MC
9-
FiQRw2fzBs0n7leEmDJyVVtBTavYlhAVXDNa3stgvh43qCfLx+clUlOvtnsoMiiR
10-
mo7qf0BoPKTj7c0uLKpDpEbAHQT4OF1HRYVxMwIDAQABo4G/MIG8MB0GA1UdDgQW
11-
BBQ7RgbMJFDGRBu9o3tDQDuSoBy7JjCBjAYDVR0jBIGEMIGBgBQ7RgbMJFDGRBu9
12-
o3tDQDuSoBy7JqFepFwwWjELMAkGA1UEBhMCU0UxDTALBgNVBAcTBFVtZWExGDAW
13-
BgNVBAoTD1VtZWEgVW5pdmVyc2l0eTEQMA4GA1UECxMHSVQgVW5pdDEQMA4GA1UE
14-
AxMHVGVzdCBTUIIJAJHg2V5J31I8MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF
15-
BQADgYEAMuRwwXRnsiyWzmRikpwinnhTmbooKm5TINPE7A7gSQ710RxioQePPhZO
16-
zkM27NnHTrCe2rBVg0EGz7QTd1JIwLPvgoj4VTi/fSha/tXrYUaqc9AqU1kWI4WN
17-
+vffBGQ09mo+6CffuFTZYeOhzP/2stAPwCTU4kxEoiy0KpZMANI=
18-
</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns0:KeyDescriptor><ns0:KeyDescriptor use="signing"><ns1:KeyInfo><ns1:X509Data><ns1:X509Certificate>MIIC8jCCAlugAwIBAgIJAJHg2V5J31I8MA0GCSqGSIb3DQEBBQUAMFoxCzAJBgNV
19-
BAYTAlNFMQ0wCwYDVQQHEwRVbWVhMRgwFgYDVQQKEw9VbWVhIFVuaXZlcnNpdHkx
20-
EDAOBgNVBAsTB0lUIFVuaXQxEDAOBgNVBAMTB1Rlc3QgU1AwHhcNMDkxMDI2MTMz
21-
MTE1WhcNMTAxMDI2MTMzMTE1WjBaMQswCQYDVQQGEwJTRTENMAsGA1UEBxMEVW1l
22-
YTEYMBYGA1UEChMPVW1lYSBVbml2ZXJzaXR5MRAwDgYDVQQLEwdJVCBVbml0MRAw
23-
DgYDVQQDEwdUZXN0IFNQMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDkJWP7
24-
bwOxtH+E15VTaulNzVQ/0cSbM5G7abqeqSNSs0l0veHr6/ROgW96ZeQ57fzVy2MC
25-
FiQRw2fzBs0n7leEmDJyVVtBTavYlhAVXDNa3stgvh43qCfLx+clUlOvtnsoMiiR
26-
mo7qf0BoPKTj7c0uLKpDpEbAHQT4OF1HRYVxMwIDAQABo4G/MIG8MB0GA1UdDgQW
27-
BBQ7RgbMJFDGRBu9o3tDQDuSoBy7JjCBjAYDVR0jBIGEMIGBgBQ7RgbMJFDGRBu9
28-
o3tDQDuSoBy7JqFepFwwWjELMAkGA1UEBhMCU0UxDTALBgNVBAcTBFVtZWExGDAW
29-
BgNVBAoTD1VtZWEgVW5pdmVyc2l0eTEQMA4GA1UECxMHSVQgVW5pdDEQMA4GA1UE
30-
AxMHVGVzdCBTUIIJAJHg2V5J31I8MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF
31-
BQADgYEAMuRwwXRnsiyWzmRikpwinnhTmbooKm5TINPE7A7gSQ710RxioQePPhZO
32-
zkM27NnHTrCe2rBVg0EGz7QTd1JIwLPvgoj4VTi/fSha/tXrYUaqc9AqU1kWI4WN
33-
+vffBGQ09mo+6CffuFTZYeOhzP/2stAPwCTU4kxEoiy0KpZMANI=
34-
</ns1:X509Certificate></ns1:X509Data></ns1:KeyInfo></ns0:KeyDescriptor><ns0:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://localhost:8087/slo" /><ns0:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://localhost:8087" index="1" /></ns0:SPSSODescriptor><ns0:Organization><ns0:OrganizationName xml:lang="en">Exempel AB</ns0:OrganizationName><ns0:OrganizationDisplayName xml:lang="se">Exempel AB</ns0:OrganizationDisplayName><ns0:OrganizationDisplayName xml:lang="en">Example Co.</ns0:OrganizationDisplayName><ns0:OrganizationURL xml:lang="en">http://www.example.com/roland</ns0:OrganizationURL></ns0:Organization><ns0:ContactPerson contactType="technical"><ns0:GivenName>John</ns0:GivenName><ns0:SurName>Smith</ns0:SurName><ns0:EmailAddress>[email protected]</ns0:EmailAddress></ns0:ContactPerson></ns0:EntityDescriptor>
2+
<ns0:EntityDescriptor xmlns:ns0="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ns1="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:ns2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ns4="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" xmlns:ns5="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" entityID="http://localhost:8087/LocalTestSPHans.xml"><ns0:Extensions><ns1:EntityAttributes><ns2:Attribute Name="http://macedir.org/entity-category"><ns2:AttributeValue xsi:type="xs:string">http://www.geant.net/uri/dataprotection-code-of-conduct/v1</ns2:AttributeValue><ns2:AttributeValue xsi:type="xs:string">http://www.swamid.se/category/research-and-education</ns2:AttributeValue><ns2:AttributeValue xsi:type="xs:string">http://www.swamid.se/category/hei-service</ns2:AttributeValue><ns2:AttributeValue xsi:type="xs:string">http://www.swamid.se/category/sfs-1993-1153</ns2:AttributeValue><ns2:AttributeValue xsi:type="xs:string">http://www.swamid.se/category/nren-service</ns2:AttributeValue><ns2:AttributeValue xsi:type="xs:string">http://www.swamid.se/category/eu-adequate-protection</ns2:AttributeValue></ns2:Attribute></ns1:EntityAttributes></ns0:Extensions><ns0:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><ns0:Extensions><ns4:DiscoveryResponse Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="http://localhost:8087/disco" index="1" /></ns0:Extensions><ns0:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://localhost:8087/slo" /><ns0:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://localhost:8087" index="1" /></ns0:SPSSODescriptor><ns0:Organization><ns0:OrganizationName xml:lang="en">Lokal test SP Hans</ns0:OrganizationName><ns0:OrganizationDisplayName xml:lang="se">Lokal test SP Hans</ns0:OrganizationDisplayName><ns0:OrganizationDisplayName xml:lang="en">Lokal test SP Hans</ns0:OrganizationDisplayName><ns0:OrganizationURL xml:lang="en">http://130.239.200.146:8087</ns0:OrganizationURL></ns0:Organization></ns0:EntityDescriptor>

‎example/sp/sp_conf.py

Lines changed: 63 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,90 @@
11
from saml2 import BINDING_HTTP_REDIRECT
2+
from saml2.extension.idpdisc import BINDING_DISCO
23
from saml2.saml import NAME_FORMAT_URI
4+
from saml2.sigver import get_xmlsec_binary, CertHandlerExtra
5+
from saml2.entity_category.edugain import COC
6+
from saml2.entity_category.swamid import RESEARCH_AND_EDUCATION
7+
from saml2.entity_category.swamid import HEI
8+
from saml2.entity_category.swamid import SFS_1993_1153
9+
from saml2.entity_category.swamid import NREN
10+
from saml2.entity_category.swamid import EU
311

12+
13+
#BASE= "http://130.239.200.146:8087"
414
BASE= "http://localhost:8087"
515
#BASE= "http://lingon.catalogix.se:8087"
616

17+
18+
class SpCertHandlerExtraClass(CertHandlerExtra):
19+
20+
def use_generate_cert_func(self):
21+
return True
22+
23+
def generate_cert(self, generate_cert_info, ca_cert_string, ca_key_string):
24+
print "Hello"
25+
return (ca_cert_string, ca_key_string)
26+
27+
def use_validate_cert_func(self):
28+
return False
29+
30+
def validate_cert(self, cert_str, ca_cert_string, ca_key_string):
31+
pass
32+
733
CONFIG = {
8-
"entityid": "%s/sp.xml" % BASE,
9-
"description": "My SP",
34+
"entityid": "%s/LocalTestSPHans.xml" % BASE,
35+
"description": "Lokal test SP Hans",
36+
"entity_category": [COC, RESEARCH_AND_EDUCATION, HEI, SFS_1993_1153, NREN, EU],
37+
"only_use_keys_in_metadata": False,
38+
"cert_handler_extra_class": None,#MyCertGeneration(),
39+
"generate_cert_info": {
40+
"cn": "localhost",
41+
"country_code": "se",
42+
"state": "ac",
43+
"city": "Umea",
44+
"organization": "ITS Umea University",
45+
"organization_unit": "DIRG"
46+
},
47+
"tmp_key_file": "pki/tmp_mykey.pem",
48+
"tmp_cert_file": "pki/tmp_mycert.pem",
49+
"validate_certificate": True,
1050
"service": {
1151
"sp": {
12-
"name": "Rolands SP",
52+
"authn_requests_signed": "true", #Will sign the request!
53+
"want_assertions_signed": "true", #Demands that the assertion is signed.
54+
"name": "LocalTestSPHans",
1355
"endpoints": {
1456
"assertion_consumer_service": [BASE],
1557
"single_logout_service": [(BASE + "/slo",
1658
BINDING_HTTP_REDIRECT)],
59+
"discovery_response": [
60+
("%s/disco" % BASE, BINDING_DISCO)
61+
]
1762
},
1863
"required_attributes": ["surname", "givenname",
1964
"edupersonaffiliation"],
2065
"optional_attributes": ["title"],
2166
}
2267
},
2368
"debug": 1,
24-
"key_file": "pki/mykey.pem",
25-
"cert_file": "pki/mycert.pem",
69+
"key_file": "pki/localhost.ca.key",
70+
"cert_file": "pki/localhost.ca.crt",
2671
"attribute_map_dir": "./attributemaps",
27-
"metadata": {"local": ["../idp2/idp.xml"]},
72+
"metadata": {
73+
#"local": ["../idp2/idp_nocert.xml"]
74+
"local": ["/Users/haho0032/Develop/svn/trunk/pyOpSamlProxy/idp_nocert.xml"]
75+
# #"remote": [{"url": "http://130.239.201.5/role/idp.xml", "cert": None}],
76+
},
77+
#"metadata": {"local": ["/Users/haho0032/Develop/svn/trunk/pyOpSamlProxy/idp_nocert.xml"]},
78+
2879
# -- below used by make_metadata --
2980
"organization": {
30-
"name": "Exempel AB",
31-
"display_name": [("Exempel AB", "se"), ("Example Co.", "en")],
32-
"url": "http://www.example.com/roland",
81+
"name": "Lokal test SP Hans",
82+
"display_name": [("Lokal test SP Hans", "se"), ("Lokal test SP Hans", "en")],
83+
"url": "http://130.239.200.146:8087",
3384
},
34-
"contact_person": [{
35-
"given_name":"John",
36-
"sur_name": "Smith",
37-
"email_address": ["[email protected]"],
38-
"contact_type": "technical",
39-
},
85+
"contact_person": [
4086
],
41-
#"xmlsec_binary":"/opt/local/bin/xmlsec1",
87+
"xmlsec_binary": '/usr/local/bin/xmlsec1',
4288
"name_form": NAME_FORMAT_URI,
4389
"logger": {
4490
"rotating": {
@@ -49,3 +95,4 @@
4995
"loglevel": "debug",
5096
}
5197
}
98+

‎example/sp/who.ini

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ saml_conf = sp_conf
1717
remember_name = auth_tkt
1818
sid_store = outstanding
1919
idp_query_param = IdPEntityId
20+
discovery = http://130.239.201.5/role/idp.ds
2021

2122
[general]
2223
request_classifier = s2repoze.plugins.challenge_decider:my_request_classifier

‎src/s2repoze/plugins/sp.py

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,9 @@
2323
import sys
2424
import platform
2525
import shelve
26+
import threading
2627
import traceback
28+
import saml2
2729
from urlparse import parse_qs, urlparse
2830

2931
from StringIO import StringIO
@@ -133,7 +135,6 @@ def __init__(self, rememberer_name, config, saml_client, wayf, cache,
133135
self.discosrv = discovery
134136
self.idp_query_param = idp_query_param
135137
self.logout_endpoints = [urlparse(ep)[2] for ep in config.endpoint("single_logout_service")]
136-
137138
try:
138139
self.metadata = self.conf.metadata
139140
except KeyError:
@@ -360,11 +361,18 @@ def challenge(self, environ, _status, _app_headers, _forget_headers):
360361
logger.debug("srvs: %s" % srvs)
361362
dest = srvs[0]["location"]
362363
logger.debug("destination: %s" % dest)
363-
req = _cli.create_authn_request(dest, vorg=vorg_name)
364-
ht_args = _cli.apply_binding(_binding, "%s" % req,
365-
destination=dest,
366-
relay_state=came_from)
367-
_sid = req.id
364+
365+
if _cli.authn_requests_signed:
366+
_sid = saml2.s_utils.sid(_cli.seed)
367+
msg_str = _cli.create_authn_request(dest, vorg=vorg_name, sign=_cli.authn_requests_signed,
368+
message_id=_sid)
369+
else:
370+
req = _cli.create_authn_request(dest, vorg=vorg_name, sign=False)
371+
msg_str = "%s" % req
372+
_sid = req.id
373+
374+
ht_args = _cli.apply_binding(_binding, msg_str, destination=dest, relay_state=came_from)
375+
368376
logger.debug("ht_args: %s" % ht_args)
369377
except Exception, exc:
370378
logger.exception(exc)

0 commit comments

Comments
 (0)