summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Release version 4.8.0v4.8.0v.4.8.0Ivan Kanakarakis2019-07-082-1/+21
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix tests to be compatible with latest pytestIvan Kanakarakis2019-07-0811-64/+100
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Update release instructionsIvan Kanakarakis2019-07-081-10/+7
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Increase max line length to 88, as defined by blackIvan Kanakarakis2019-07-081-1/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Set force_authn when the value is "true" or "1"Ivan Kanakarakis2019-06-272-16/+39
| | | | | | | | | | | | | | Following d257d3054f36b4f3dfaba8b7394a2e8bab0aaf2e the ForceAuthn attribute is an xsd:boolean value which can be any of "false", "true", "0" or "1". We must set force_authn when the value is "true" or "1". We set the value into kwargs, which is then mirrored onto _args, which is merged with args, which is finally given to the saml2.samlp.AuthnRequest class to construct the object. Previously, we set the value into args directly, which would be overwritten by the call to _filter_args. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Use shorthand to remove the "id" item from dictIvan Kanakarakis2019-06-271-4/+1
| | | | | | No need to generate an exception and stack trace. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #621 from skoranda/better_edupersontargetedidIvan Kanakarakis2019-06-172-6/+61
|\ | | | | Allow NameQualifier and SPNameQualifier attributes to be set for ePTID
| * Restructure to_eptid_value functionIvan Kanakarakis2019-06-172-37/+44
| | | | | | | | | | | | | | Use "text" instead of "value" as the key that denotes the text-value of the NameID node. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Enable NameQualifier and SPNameQualifier attributes for ePTIDScott Koranda2019-06-042-6/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | The attribute value for eduPersonTargetedID (ePTID) is a NameID element. The SAML specification allows the NameID element to include the two optional attributes 'NameQualifier' and 'SPNameQualifier'. This patch enables specifying a dictionary as the internal or local attribute value instead of a string. When the local attribute value is a dictionary with keys 'value', 'NameQualifier', and 'SPNameQualifier' then the resulting XML NameID element will include the 'NameQualifier' and 'SPNameQualifier' attributes with values taken from the values of the dictionary. The value for the NameID element is taken from the value associated with tthe 'value' key.
* | Merge pull request #622 from c00kiemon5ter/feature-improve-ciIvan Kanakarakis2019-06-172-2/+6
|\ \ | | | | | | Add py37 as a test target
| * | Use pytest inplace of py.testIvan Kanakarakis2019-06-171-2/+2
| | | | | | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * | Add py37 as a test targetIvan Kanakarakis2019-06-172-0/+4
|/ / | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | Set force_authn only when the value is "true"Ivan Kanakarakis2019-06-131-7/+6
|/ | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #618 from abliqo/holder-of-keyIvan Kanakarakis2019-05-297-17/+244
|\ | | | | Fix parsing of assertions with Holder-of-Key profile
| * Format codeIvan Kanakarakis2019-05-292-54/+72
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Use `extension_elements` to extract `KeyInfo`Alex Bublichenko2019-05-284-12/+10
| | | | | | | | Instead of explicitly declaring `KeyInfo` as child of `SubjectConfirmationData`, use `extension_elements` to extract `KeyInfo` element(s).
| * Gracefully handle invalid HOK assertionsAlex Bublichenko2019-05-243-10/+56
| |
| * Clean up and fix tests for python 3.* versionsAlex Bublichenko2019-05-242-35/+46
| |
| * Parse assertions with Holder-of-Key profileAlex Bublichenko2019-05-237-18/+172
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: Holder-of-Key assertions are used to achieve higher levels of federation security, compared to bearer assertions, by having Relying Party challenge subscriber to prove possession of the key specified in the assertion that represents subscriber in addition to verifying the assertion itself signed by Identity Provider. More information about it can be found in https://pages.nist.gov/800-63-3/sp800-63c.html This library fails to parase SAML respones containing assertions with Holder-of-Key profile, for example: ``` <ns1:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key"> <ns1:SubjectConfirmationData InResponseTo="id-KHlas49TtW2VdC8WN" NotOnOrAfter="2019-05-14T20:36:13Z" Recipient="https://sp:443/.auth/saml/login"> <ns2:KeyInfo> <ns2:X509Data> <ns2:X509Certificate>MIICITCCAYoCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNVBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwFWnp6enoxDTALBgNVBAMMBHRlc3QwIBcNMTkwNDEyMTk1MDM0WhgPMzAxODA4MTMxOTUwMzRaMFgxCzAJBgNVBAYTAnp6MQswCQYDVQQIDAJ6ejENMAsGA1UEBwwEenp6ejEOMAwGA1UECgwFWnp6enoxDjAMBgNVBAsMBVp6enp6MQ0wCwYDVQQDDAR0ZXN0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHcj80WU/XBsd9FlyQmfjPUdfmedhCFDd6TEQmZNNqP/UG+VkGa+BXjRIHMfic/WxPTbGhCjv68ci0UDNomUXagFexLGNpkwa7+CRVtoc/1xgq+ySE6M4nhcCutScoxNvWNn5eSQ66i3U0sTv91MgsXxqEdTaiZg0BIufEc3dueQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAGUV5B+USHvaRa8kgCNJSuNpo6ARlv0ekrk8bbdNRBiEUdCMyoGJFfuM9K0zybX6Vr25wai3nvaog294Vx/jWjX2g5SDbjItH6VGy6C9GCGf1A07VxFRCfJn5tA9HuJjPKiE+g/BmrV5N4CealzFxPHWYkNOzoRU8qI7OqUai1kL</ns2:X509Certificate> </ns2:X509Data> </ns2:KeyInfo> </ns1:SubjectConfirmationData> </ns1:SubjectConfirmation> ``` fails to be parsed with the following error: ``` ERROR saml2.response:response.py:836 get subject Traceback (most recent call last): File "/home/abublich/repos/abliqo-pysaml2/venv/local/lib/python2.7/site-packages/pysaml2-4.7.0-py2.7.egg/saml2/response.py", line 828, in _assertion self.get_subject() File "/home/abublich/repos/abliqo-pysaml2/venv/local/lib/python2.7/site-packages/pysaml2-4.7.0-py2.7.egg/saml2/response.py", line 753, in get_subject if not self._holder_of_key_confirmed(_data): File "/home/abublich/repos/abliqo-pysaml2/venv/local/lib/python2.7/site-packages/pysaml2-4.7.0-py2.7.egg/saml2/response.py", line 730, in _holder_of_key_confirmed [samlp, saml, xenc, ds]): File "/home/abublich/repos/abliqo-pysaml2/venv/local/lib/python2.7/site-packages/pysaml2-4.7.0-py2.7.egg/saml2/__init__.py", line 1004, in extension_elements_to_elements for extension_element in extension_elements: TypeError: 'SubjectConfirmationData' object is not iterable ``` The root cause is two-fold: 1. The type SubjectConfirmationDataType_ does not declare KeyInfo as child element. 2. The bug in function _holder_of_key_confirmed: it should check KeyInfo child element of SubjectConfirmationData instead of SubjectConfirmationData itself. Solution: Fixed the root cause and added new unit tests that verify successful parsing of Holder-of-Key assertions.
* | Merge pull request #619 from stdedos/patch-1Ivan Kanakarakis2019-05-281-1/+1
|\ \ | |/ |/| Explicit request of cherrypy version for the example application
| * Explicit cherrypy requirements for the example applicationStavros Ntentos2019-05-281-1/+1
|/ | | | | | | Unless you are pulling always from https://pypi.org/simple, it is possible that you might get an older version of `cherrypy`. Make sure we request a "relatively recent" version. `pip install 'CherryPy>14.0.2,<15'` gave `CherryPy-14.2.0` which works
* Simplify Base::create_discovery_service_request methodIvan Kanakarakis2019-05-161-21/+14
| | | | | | | Allow values of None in the collected information. Filter out those fields later. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #593 from AmbientLighter/patch-2Ivan Kanakarakis2019-05-141-3/+3
|\ | | | | Fix typos: tupel and test_ouput
| * Fix typo: test_ouput to test_outputIvan Kanakarakis2019-05-141-1/+1
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Fix typo: tupel to tupleVictor Mireyev2019-05-141-3/+3
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | Merge pull request #610 from peppelinux/deprecation_warningsIvan Kanakarakis2019-05-141-4/+12
|\ \ | | | | | | Use html.escape when available
| * | Escape single and double quotes, alwaysIvan Kanakarakis2019-05-141-3/+7
| | | | | | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * | Format import statementsIvan Kanakarakis2019-05-141-3/+4
| | | | | | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * | DeprecationWarning: cgi.escape is deprecated, use html.escape instead. FixedGiuseppe2019-04-261-4/+7
| | |
* | | Merge pull request #606 from bmwiedemann/fix2025Ivan Kanakarakis2019-05-147-48/+60
|\ \ \ | | | | | | | | Make tests pass after 2024
| * | | Make tests pass after 2024Bernhard M. Wiedemann2019-04-127-48/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Background: As part of my work on reproducible builds for openSUSE, I check that software still gives identical build results in the future. The usual offset is +15 years, because that is how long I expect some software will be used in some places. This showed up failing tests in our package build. See https://reproducible-builds.org/ for why this matters. This patch made tests pass in 2037
* | | | Merge pull request #613 from skoranda/more_flexible_entity_category_importIvan Kanakarakis2019-05-144-2/+144
|\ \ \ \ | | | | | | | | | | Make entity category imports more flexible
| * | | | Added tests for new entity category import functionalityScott Koranda2019-05-073-0/+139
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added tests for the new entity category import functionality that searches for entity category modules on the general import path before searching in saml2.entity_category.<module>.
| * | | | Enable entity category import from module search pathScott Koranda2019-05-071-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This enhancement causes an entity category import to first be tried from the general module search path, and if that fails then to fall back to the current default of importing saml2.entity_category.<module>. This allows deployers to overlay their own customized versions of entity category modules like edugain.py that contain CoCo. This is helpful since the list of attributes to be included as part of the entity category may not be globally the same for all deployments. Such is the case with CoCo where the list of attributes changes from federation to federation and deployment to deployment.
* | | | | Merge pull request #615 from srinivasreddy42/patch-1Ivan Kanakarakis2019-05-141-0/+3
|\ \ \ \ \ | | | | | | | | | | | | Add installation instruction to README
| * | | | | Update README.rstSrinivas Reddy Thatiparthy2019-05-141-0/+3
| | | | | |
* | | | | | Merge pull request #617 from SUNET/eduid-mongodb_timestampsIvan Kanakarakis2019-05-141-0/+4
|\ \ \ \ \ \ | | | | | | | | | | | | | | Add timestamps for ident mongodb documents
| * | | | | | add created_at timestamps to all mongodb documentsFredrik Thulin2019-05-141-0/+4
| |/ / / / /
* | | | | | Merge pull request #616 from SUNET/eduid-nameid_fixesIvan Kanakarakis2019-05-145-10/+44
|\ \ \ \ \ \ | |/ / / / / |/| | | | | Check for an existing local-persistent NameID when retrieving it
| * | | | | Format codeIvan Kanakarakis2019-05-142-10/+19
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * | | | | update tests with regards to AllowCreateFredrik Thulin2019-05-082-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | AllowCreate is not supposed to be present for transient Name IDs.
| * | | | | improve commentFredrik Thulin2019-05-081-1/+1
| | | | | |
| * | | | | Look for existing persistent id's before creating new ones.Fredrik Thulin2019-05-081-3/+8
| | | | | |
| * | | | | implement match_local_idFredrik Thulin2019-05-081-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement MongoDB version of function to look for an existing persistent NameId for a user.
| * | | | | Don't add AllowCreate for default transient name idsFredrik Thulin2019-05-081-0/+4
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | http://docs.oasis-open.org/security/saml/v2.0/errata05/os/saml-v2.0-errata05-os.html#__RefHeading__8058_1983180497: "The use of the AllowCreate attribute MUST NOT be used and SHOULD be ignored in conjunction with requests for or assertions issued with name identifiers with a Format of urn:oasis:names:tc:SAML:2.0:nameid-format:transient (they preclude any such state in and of themselves)."
* | | | | Merge pull request #614 from liamkinney/patch-1Ivan Kanakarakis2019-05-091-1/+1
|\ \ \ \ \ | |/ / / / |/| | | | Typo in comment
| * | | | Typo in commentLiam Kinney2019-05-081-1/+1
|/ / / /
* | | | Merge pull request #607 from alexstuart/SAML-subject-idIvan Kanakarakis2019-04-151-0/+8
|\ \ \ \ | |/ / / |/| | | Add SAML subject identifier attributes to saml2_uri attributemap
| * | | Add SAML subject identifier attributes to saml2_uri attributemapAlex Stuart2019-04-141-0/+8
|/ / /
* | | Merge pull request #605 from stdedos/patch-1Ivan Kanakarakis2019-04-121-1/+2
|\ \ \ | |/ / |/| | install.rst: complete pytest invocation
View Lorry Controller Status