Fix logic error in pick_binding method for class Entity

Fix logic in the pick_binding method for the class Entity that prevented
the method from properly returning binding and location tuples for
authentication requests with AssertionConsumerServiceIndex instead
of AssertionConsumerServiceURL. The logic error was assuming that
a getattr() call on a request without an AssertionConsumerServiceURL
would throw an AttributeError. It does not and instead returns None, so
the resulting path through the code would cause the "first" binding
and location tuple found in the SAML metadata to be returned instead
of the tuple corresponding to the AssertionConsumerServiceIndex.

1 files changed, 2 insertions, 10 deletions

diff --git a/src/saml2/entity.py b/src/saml2/entity.py
index e69fc1aa..0e2cc94c 100644
--- a/src/saml2/entity.py
+++ b/src/saml2/entity.py
@@ -269,16 +269,8 @@ class Entity(HTTPBase):
             else:
                 descr_type = "spsso"
 
-        _url = _index = None
-        if request:
-            try:
-                _url = getattr(request, "%s_url" % service)
-            except AttributeError:
-                _url = None
-                try:
-                    _index = getattr(request, "%s_index" % service)
-                except AttributeError:
-                    pass
+        _url = getattr(request, "%s_url" % service, None)
+        _index = getattr(request, "%s_index" % service, None)
 
         for binding in bindings:
             try: