WIP, TODO cleanup, see description

* client_base::Base is the base for an SP and manages SP_ARGS
* server::Server is the base for an IdP and maanges AA_IDP_ARGS
* entity::Entity is the base of SP/IdPs and manages the COMMON_ARGS

The signing_algorithm and digest_algorithm are COMMON_ARGS
and should be set and managed by entity::Entity.
On init they are set as properties of the Entity object.
If no configuration has been given, the internal-default is set (through DefaultSignature()).

The set sign_alg and digest_alg must be checked against an allow/block-list

---

- Signing is done both by SPs (on requests) and IdPs (on responses).
- Signing is done both for the Redirect-binding (apply_binding()) and the POST-binding (_message() > sign()).

---

* All client_base::Base(SP) (create_*) methods end in Entity::_message()
* Almost all server::Server(IdP) (create_*) methods end in Entity::_response()

thus:

- Entity::_message() must decide the value of "sign" and call Entity::sign()
- Entity::_response() must decide the value of "sign" and call Entity::sign()
- Entity::_status_response() must decide the value of "sign" and call Entity::sign()
- Entity::sign() must decide the value of sign_alg and digest_alg and call sigver::pre_signature_part()

---

All calls to Entity::_message() and Entity::_response() (or to their callers)
must pass on sign, sign_alg and digest_alg

All calls to sigver::pre_signature_part() should happen through the same call-chain
and should pass on specific sign_alg and digest_alg params

All relevant params should be set to None unless they have been set by the caller.

---

client::do_logout should be refactored to use the same call-chain

---

These type of checks (and self.lock blocks) should be removed (there are more for sign_assertion)
```
if (sign and self.sec.cert_handler.generate_cert()) or client_crt is not None:

```
```
if self.sec.cert_handler.generate_cert()
```

---

Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/src/saml2/sigver.py b/src/saml2/sigver.py
index 87441807..b8e924c2 100644
--- a/src/saml2/sigver.py
+++ b/src/saml2/sigver.py
@@ -1750,7 +1750,7 @@ class SecurityContext(object):
         return statement
 
 
-# XXX calls DefaultSignature
+# XXX FIXME calls DefaultSignature - remove to unveil chain of calls without proper args
 def pre_signature_part(ident, public_key=None, identifier=None, digest_alg=None, sign_alg=None):
     """
     If an assertion is to be signed the signature part has to be preset