summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Fix call to urlencodepylint-fixesIvan Kanakarakis2020-05-121-2/+2
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Remove unneeded string formatIvan Kanakarakis2020-05-121-1/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Remove py2 compatibility checkIvan Kanakarakis2020-05-121-6/+2
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Replace NotImplemented with NotImplementedErrorIvan Kanakarakis2020-05-121-1/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Raise exception with message; not tupleIvan Kanakarakis2020-05-121-3/+4
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Remove assignment for function with no returnIvan Kanakarakis2020-05-121-1/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix call to urlparseIvan Kanakarakis2020-05-121-1/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Check for bytes not unicodeIvan Kanakarakis2020-05-121-1/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Remove cast to unicodeIvan Kanakarakis2020-05-121-17/+16
| | | | | | | | | | | | | ``` ************* Module saml2.saml src/saml2/saml.py:168:15: E0602: Undefined variable 'unicode' (undefined-variable) ``` There is no compatibility to python2 anymore. We can safely remove any such checks that tried to set the right types for the string object to catter for the differences in types between py2 and py3. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix check for signed logoutIvan Kanakarakis2020-05-121-1/+1
| | | | | | | | | | | ``` ************* Module saml2.client src/saml2/client.py:225:27: E1101: Instance of 'Saml2Client' has no 'logout_requests_signed' member (no-member) ``` The reference should be through the config member of the Saml2Client object. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Remove compatibility check for py25Ivan Kanakarakis2020-05-121-4/+1
| | | | | | | | | | | | ``` ************* Module saml2.s_utils src/saml2/s_utils.py:385:42: E0602: Undefined variable 'sha' (undefined-variable) ``` This is referenced on a branch of a backwards compatibility check for py25. This branch will not be reached anymore and it is now removed. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Replace NotImplemented with NotImplementedErrorIvan Kanakarakis2020-05-121-3/+3
| | | | | | | | | | | | | | ``` ************* Module saml2.authn src/saml2/authn.py:32:8: E0711: NotImplemented raised - should raise NotImplementedError (notimplemented-raised) src/saml2/authn.py:32:8: E0702: Raising NotImplementedType while only classes or instances are allowed (raising-bad-type) src/saml2/authn.py:35:8: E0711: NotImplemented raised - should raise NotImplementedError (notimplemented-raised) src/saml2/authn.py:35:8: E0702: Raising NotImplementedType while only classes or instances are allowed (raising-bad-type) src/saml2/authn.py:38:8: E0711: NotImplemented raised - should raise NotImplementedError (notimplemented-raised) src/saml2/authn.py:38:8: E0702: Raising NotImplementedType while only classes or instances are allowed (raising-bad-type) ``` Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Remove logger configurationIvan Kanakarakis2020-05-124-113/+9
| | | | | | | | | | | | | | | | | | | | ``` ************* Module saml2.config src/saml2/config.py:464:23: E1135: Value '_logconf' doesn't support membership test (unsupported-membership-test) src/saml2/config.py:466:27: E1136: Value '_logconf' is unsubscriptable (unsubscriptable-object) src/saml2/config.py:481:50: E1136: Value '_logconf' is unsubscriptable (unsubscriptable-object) src/saml2/config.py:486:22: E1120: No value for argument 'filename' in constructor call (no-value-for-parameter) src/saml2/config.py:488:23: E1135: Value '_logconf' doesn't support membership test (unsupported-membership-test) src/saml2/config.py:489:42: E1136: Value '_logconf' is unsubscriptable (unsubscriptable-object) src/saml2/config.py:505:43: E1136: Value '_logconf' is unsubscriptable (unsubscriptable-object) src/saml2/config.py:552:19: E1136: Value 'self.virtual_organization' is unsubscriptable (unsubscriptable-object) ``` this seems right; the operations upon the Logger object do not make sense. There is no need to "fix" this, we just remove the relevant code. We should come back to this and refactor how the logger is configured for the library. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #685 from dnmvisser/dv_nitpick1Ivan Kanakarakis2020-05-121-1/+1
|\ | | | | Fix typo
| * revert new typoDick Visser2020-05-121-1/+1
|/
* Merge pull request #684 from dnmvisser/dv_nitpick1Ivan Kanakarakis2020-05-121-9/+9
|\ | | | | Fix typos and phrasing in docs
| * typoDick Visser2020-05-121-1/+1
| |
| * Presently means 'going to happen soon'Dick Visser2020-05-121-3/+3
| |
| * typos and spellingDick Visser2020-05-121-6/+6
|/
* Merge pull request #683 from rakvat/masterIvan Kanakarakis2020-05-081-2/+8
|\ | | | | Fix escape not in cgi in example for newer python versions
| * fix escape not in cgi for newer pythonsrakvat2020-05-081-2/+8
|/
* Merge pull request #681 from nsklikas/fix-eidas-attribute-mappingIvan Kanakarakis2020-05-041-4/+4
|\ | | | | Fix eidas attribute mapping for legal person
| * Fix eidas attribute mapping for legal personNikos Sklikas2020-05-041-4/+4
|/
* Merge pull request #680 from tauceti2/fix_disco_url_creationIvan Kanakarakis2020-05-041-1/+5
|\ | | | | Disco URL can already contain parameters
| * Disco URL can already contain parametersMichal Prochazka2020-04-291-1/+5
|/ | | | If it contains parameters we need to add return_url as another pamametr into URL.
* Merge pull request #678 from gliptak/python1Ivan Kanakarakis2020-04-283-0/+3
|\ | | | | Indicate python 3.8 as supported
| * Add Python 3.8 as supportedGábor Lipták2020-04-283-0/+3
|/
* Fix s2repoze check for content lengthIvan Kanakarakis2020-04-281-1/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #674 from jerrykan/docoIvan Kanakarakis2020-04-071-0/+2
|\ | | | | Document default value for 'want_response_signed'
| * Document default value for 'want_response_signed'John Kristensen2020-04-071-0/+2
|/ | | | | Document the default value for 'want_response_signed' so users don't have to dig through the code to fine it.
* Replace decodestring for decodebytes from base64 moduleIvan Kanakarakis2020-03-181-8/+3
| | | | | | decodestring has been removed from py39 Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Export both version and version_info from the version moduleIvan Kanakarakis2020-03-012-5/+3
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix compile warningsIvan Kanakarakis2020-02-107-14/+14
| | | | | | | | | Test for compile warning using: find src/ -iname '*.py' | xargs -P 4 -I{} python -Wall -m py_compile {} find tests/ -iname '*.py' | xargs -P 4 -I{} python -Wall -m py_compile {} Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #668 from ioparaskev/fix-testsIvan Kanakarakis2020-02-101-3/+3
|\ | | | | Update test metadata expiration date
| * Update test metadata expiration dateJohn Paraskevopoulos2020-02-101-3/+3
|/ | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #664 from rristow/masterIvan Kanakarakis2020-02-021-5/+3
|\ | | | | Provide more information in case of AudienceRestrictions conditions not satisfied
| * Merge pull request #1 from rristow/rristow-patch-1Rodrigo2020-01-311-5/+3
| |\ |/ / | | Update response.py
| * Update response.pyRodrigo2020-01-311-5/+3
|/ | | Providing more information in case of AudienceRestrictions conditions not satisfied
* Merge pull request #663 from theunraveler/windows_pem_fileIvan Kanakarakis2020-01-281-1/+1
|\ | | | | Use os.linesep to write pem files in a cross-platform way
| * Using `os.linesep` to write pem files in a cross-platform wayJake Bell2020-01-281-1/+1
|/
* Merge pull request #661 from isaachui/masterIvan Kanakarakis2020-01-161-0/+4
|\ | | | | Adding documentation regarding installation of xmlsec1 on centos/rhel 7
| * code blockIsaac Hui2020-01-151-1/+1
| |
| * adding centos 7 install for xmlsec instructionsIsaac Hui2020-01-151-0/+4
|/
* Release version 5.0.0v5.0.0Ivan Kanakarakis2020-01-132-1/+22
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix XML Signature Wrapping (XSW) vulnerabilitiesIvan Kanakarakis2020-01-093-0/+99
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | PySAML2 did not check that the signature in a SAML document is enveloped and thus XML signature wrapping (XSW) was effective. The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertions that have been signed. This was assigned CVE-2020-5390 Thanks to Alexey Sintsov and Yuri Goltsev from HERE Technologies to report this. + + + + + + + + In more detail: libxml2 follows the xmldsig-core specification. The xmldsig specification is way too general. saml-core reuses the xmldsig specification, but constrains it to use of specific facilities. The implementation of the SAML specification is responsible to enforce those constraints. libxml2/xmlsec1 are not aware of those constraints and thus process the document based on the full/general xmldsig rules. What is happening is the following: - xmldsig-core allows the signature-information and the data that was signed to be in different places. This works by setting the URI attribute of the Reference element. The URI attribute contains an optional identifier of the object being signed. (see "4.4.3 The Reference Element" -- https://www.w3.org/TR/xmldsig-core1/#sec-Reference) This identifier is actually a pointer that can be defined in many different ways; from XPath expressions that need to be executed(!), to a full URL that should be fetched(!) in order to recalculate the signature. - saml-core section "5.4 XML Signature Profile" defines constrains on the xmldsig-core facilities. It explicitly dictates that enveloped signatures are the only signatures allowed. This mean that: * Assertion/RequestType/ResponseType elements must have an ID attribute * signatures must have a single Reference element * the Reference element must have a URI attribute * the URI attribute contains an anchor * the anchor points to the enclosing element's ID attribute xmlsec1 does the right thing - it follows the reference URI pointer and validates the assertion. But, the pointer points to an assertion in another part of the document; not the assertion in which the signature is embedded/enveloped. SAML processing thinks that the signature is fine (that's what xmlsec1 said), and gets the assertion data from the assertion that contains the signature - but that assertion was never validated. The issue is that pysaml2 does not enforce the constrains on the signature validation facilities of xmldsig-core, that the saml-core spec defines. The solution is simple; all we need is to make sure that assertions with signatures (1) contain one reference element that (2) has a URI attribute (3) that is an anchor that (4) points to the assertion in which the signature is embedded. If those conditions are met then we're good, otherwise we should fail the verification. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge branch 'feature-add-metadata-freshness'Ivan Kanakarakis2019-12-265-137/+282
|\ | | | | | | | | | | Define a period for which the metadata fetched from an MDQ are considered valid. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Format configuration examplesIvan Kanakarakis2019-12-261-93/+136
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Reformat and rearrange codeIvan Kanakarakis2019-12-263-67/+112
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Update documentation with mdq freshness_periodNikos Sklikas2019-12-261-0/+9
| |
| * Remove unused default valueNikos Sklikas2019-12-261-1/+1
| |
View Lorry Controller Status