summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Return the ResponseLocation before falling back to Locationfeature-logout-response-locationIvan Kanakarakis2020-10-288-60/+109
| | | | | | | | | | | | | | | | | | | | | | | | ResponseLocation [Optional] Optionally specifies a different location to which response messages sent as part of the protocol or profile should be sent. The allowable syntax of this URI depends on the protocol binding. The ResponseLocation attribute is used to enable different endpoints to be specified for receiving request and response messages associated with a protocol or profile, not as a means of load-balancing or redundancy (multiple elements of this type can be included for this purpose). When a role contains an element of this type pertaining to a protocol or profile for which only a single type of message (request or response) is applicable, then the ResponseLocation attribute is unused. [E41]If the ResponseLocation attribute is omitted, any response messages associated with a protocol or profile may be assumed to be handled at the URI indicated by the Location attribute. ArtifactResolutionService, SingleSignOnService and NameIDMappingService MUST omit the ResponseLocation attribute. This is enforced here, but metadata with such service declarations and such attributes should not have been part of the metadata store in the first place. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Add unit test for #720Maxime Besson2020-10-272-2/+21
| | | | | making sure that ResponseLocation behaves properly when present and that Location is used in its place when missing
* Fixes #720: honor ResponseLocation in metadata when building logout responsesMaxime Besson2020-10-272-4/+17
|
* Do not out debug logs for example/idp2Ivan Kanakarakis2020-10-261-1/+1
| | | | | | The debug logs becomes part of the xml metadata. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix cleaning changes before deploying pre-releasesIvan Kanakarakis2020-10-051-1/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Do not clean changes before deploying pre-releasesIvan Kanakarakis2020-10-051-0/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Push pre-releases to test.pypi for every push on masterIvan Kanakarakis2020-10-051-6/+22
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Use encodebytes in place of encodestringIvan Kanakarakis2020-10-051-36/+34
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Refactor CI/CD to release new versions when a tag on master is presentIvan Kanakarakis2020-10-051-16/+71
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Release version 6.2.0v6.2.0Ivan Kanakarakis2020-10-052-1/+20
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* The xsd:id attribute value must not start with a numberIvan Kanakarakis2020-10-052-16/+42
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #704 from canderson90/fix-601-default-nameformatIvan Kanakarakis2020-09-294-3/+24
|\ | | | | Set the default attribute NameFormat to NAME_FORMAT_UNSPECIFIED
| * Add explanatory comment for harvest_element_tree usageIvan Kanakarakis2020-09-291-0/+1
| |
| * Ensure IdP configurations still default to NAME_FORMAT_URIChris Anderson2020-08-114-4/+24
| |
| * Set the default attribute NameFormat to NAME_FORMAT_UNSPECIFIED as per ↵Chris Anderson2020-07-241-1/+1
| | | | | | | | section 2.7.3.1 of the spec
* | Merge pull request #721 from dbaker-rh/dbaker-rh-patch-1Ivan Kanakarakis2020-09-291-1/+1
|\ \ | | | | | | Update to key generation to 2048 bits in example/create_key.sh
| * | Update create_key.shDave Baker2020-09-071-1/+1
| | | | | | | | | | | | Increase key size to prevent: ssl.SSLError: [SSL: EE_KEY_TOO_SMALL] ee key too small (_ssl.c:3542)
* | | Support logging configuration through the python loggerIvan Kanakarakis2020-09-293-34/+81
| | | | | | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | | Support both str and bytes SAML requests on the example idpIvan Kanakarakis2020-09-291-1/+6
| | | | | | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | | Merge pull request #715 from peppelinux/nameid_format_exampleIvan Kanakarakis2020-09-121-13/+113
|\ \ \ | | | | | | | | Document more configuration options and entity category settings
| * | | Rephrase documentation partsIvan Kanakarakis2020-09-121-29/+43
| | | | | | | | | | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * | | Additional DocumentationGiuseppe2020-09-121-11/+97
| | | |
| * | | [Documentation] fixes https://github.com/IdentityPython/pysaml2/issues/710Giuseppe2020-09-121-1/+1
|/ / /
* | | Merge pull request #716 from IdentityPython/assert_deletionIvan Kanakarakis2020-09-1117-110/+188
|\ \ \ | |/ / |/| | Replace assert statements
| * | Replace assert with proper checksassert_deletionIvan Kanakarakis2020-09-1115-97/+173
| | | | | | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * | Refactor active_cert checkIvan Kanakarakis2020-09-101-7/+7
| | | | | | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * | Use ValueError instead of ExceptionIvan Kanakarakis2020-09-102-5/+5
| | | | | | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * | first deletion of assertionGiuseppe2020-09-063-7/+9
|/ /
* | Merge pull request #711 from EE/artifact2message-signIvan Kanakarakis2020-09-011-2/+8
|\ \ | | | | | | Allow request signing in artifact2message
| * | Allow request signing in artifact2messageKrzysztof Jurewicz2020-08-251-2/+8
|/ /
* | Merge pull request #709 from mhindery/ecdsa-namingIvan Kanakarakis2020-08-112-10/+10
|\ \ | | | | | | Fix wrong identifiers for ecdsa algos
| * | Fix wrong identifiers for ecdsa algosMathieu Hinderyckx2020-08-112-10/+10
|/ /
* | Merge pull request #707 from richvdh/fix_acs_fixupIvan Kanakarakis2020-08-101-21/+36
|\ \ | | | | | | Fix automatic inversion of attribute map files
| * | Fix automatic inversion of attribute map filesRichard van der Hoff2020-08-101-1/+3
| | | | | | | | | | | | | | | In order for automatic inversion of attribute maps to work, we need to accept definitions of attribute maps with only one of `to` or `fro`.
| * | Factor out common codepaths in attribute_converterRichard van der Hoff2020-08-101-21/+34
| |/ | | | | | | | | We have three copies of the code that looks for attribute map definitions in a python module: let's factor them out.
* | Merge pull request #708 from richvdh/clean_up_exception_loggingIvan Kanakarakis2020-08-101-4/+0
|\ \ | |/ |/| Remove spurious `exception` logging
| * Remove spurious `exception` loggingRichard van der Hoff2020-08-101-4/+0
|/ | | | | | These two `logger.exception` calls are both incorrect, because neither are in an `except` block - which means that they will log a stacktrace for whatever the most recent exception was (which may be wholly unrelated).
* Support arbitrary entity attributesIvan Kanakarakis2020-07-115-23/+116
| | | | | | | | | | | | | | | | | | Introduce new configuration option `entity_attributes` that defines a list of dictionaries each of which represents an <Attribute> element. Each dicrionary has fields for the NameFormat, the Name, the FriendName and a list of strings that are used to create <AttributeValue> elements, each with the string as the text node. "entity_attributes": [ { "name_format": "urn:oasis:names:tc:SAML:2.0:attrname-format:uri", "name": "urn:oasis:names:tc:SAML:profiles:subject-id:req", # "friendly_name" is not set "values": ["any"], }, ] Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Release version 6.1.0v6.1.0Ivan Kanakarakis2020-07-102-1/+6
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Revert "Fix check for signed logout"Ivan Kanakarakis2020-07-101-1/+1
| | | | This reverts commit b8539198eb02149510a831e2c93c88ef8c438042.
* Release version 6.0.0v6.0.0Ivan Kanakarakis2020-07-102-1/+8
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix formatting for docsIvan Kanakarakis2020-07-101-14/+15
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Differentiate between metadata NameIDFormat and AuthnRequest NameIDPolicy FormatIvan Kanakarakis2020-07-107-46/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | | The `name_id_format` configuration option is used to define 1. the value of the `<NameIDFormat>` metadata element 2. and the value of the `<NameIDPolicy>` `Format` attribute in an `AuthnRequest` The configuration option to set what the value of `<NameIDFormat>` element is in the metadata should be different from the configuration option to specify what should be requested in an `AuthnRequest` through the `<NameIDPolicy Format="...">` attribute. Introduce a new option (`name_id_policy_format`), or use the same name but scoped in a specific section for metadata and AuthnRequest. On the side of this, pysaml2 defaults to _transient_ as the `<NameIDPolicy Format="...">` attribute value. To omit requesting a value for the `<NameIDPolicy Format="">` attribute the value `"None"` (a string) must be set in the configuration. This is unintuitive. It is better to be explicit and set transient to request a transient NameID, than not setting a value and requesting transient by default. If no value is set, no specific `<NameIDPolicy Format="...">` should be requested. - Refactor the name_id_format usage - Add name_id_policy_format configuration option - Remove the "None" convention value Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Release version 5.4.0v5.4.0Ivan Kanakarakis2020-07-102-1/+9
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #700 from ↵Ivan Kanakarakis2020-07-101-0/+14
|\ | | | | | | | | johanlundberg/lundberg_entity_category_and_attribute_mapping SwedenConnect attribute mapping and SWAMID entity category, part 2
| * Added PKIX attributes used in Sweden ConnectJohan Lundberg2020-07-101-0/+14
|/
* Merge pull request #699 from cnelson/patch-1Ivan Kanakarakis2020-07-091-1/+13
|\ | | | | Update documentation for additional_cert_files and cert_file
| * Update documentationChris Nelson2020-07-091-1/+13
|/ | | Mention `additional_cert_files` and the fact that `cert_file` only accepts a single cert and not a chain
* Merge pull request #698 from ↵Ivan Kanakarakis2020-07-092-23/+110
|\ | | | | | | | | johanlundberg/lundberg_entity_category_and_attribute_mapping Add SwedenConnect attribute mapping and SWAMID entity category
| * Updated SWAMID entity categoriesJohan Lundberg2020-07-091-23/+69
| |
View Lorry Controller Status