summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Release version 4.6.1v4.6.1Ivan Kanakarakis2018-08-292-1/+10
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #537 from sheilatron/multi-attr-statementsIvan Kanakarakis2018-08-292-11/+83
|\ | | | | Allow for multiple AttributeStatement tags per Assertion
| * Add test for multiple attribute statementsIvan Kanakarakis2018-08-291-7/+77
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Multiple AttributeStatement tags per AssertionThomas Knott2018-08-291-4/+6
|/ | | | | | | | | | | | | | This was necessary to implement a real-world SSO integration, which required handlinge multiple AttributeStatement elements within a single assertion in a SAML response. Orginally this change was implemented in a private fork by Thomas Knott for pysaml 2.2.0, and has been ported by Sheila Allen for use in pysaml 4.6.0 to hopefully merge upstream. There was a similar PR for the same need by pcrownov: https://github.com/IdentityPython/pysaml2/pull/205/files
* Fix test that depended on actual datetimeIvan Kanakarakis2018-08-291-2/+8
| | | | | | | Mock utcnow call used by time_util module to return the same date as the IssueInstant date of the response. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #538 from sheilatron/Docstrings4LearningIvan Kanakarakis2018-08-242-1/+34
|\ | | | | Improve docstring for NameID and argtree.add_path
| * Docstring explanation of the NameID elementSheila Allen2018-08-141-1/+10
| |
| * Docstring explaining the argtree.add_path functionSheila Allen2018-08-141-0/+24
| |
* | Merge pull request #539 from cmurphy/fix-exceptionIvan Kanakarakis2018-08-242-1/+5
|\ \ | | | | | | Raise ValueError for invalid attribute type
| * | Raise ValueError for invalid attribute typeColleen Murphy2018-08-152-1/+5
| |/ | | | | | | | | | | | | | | | | | | | | Without this patch, the AttributeValueBase set_text method checks for a valid xsi:type before setting the text value, but when it gets to the catchall case, instead of raising an exception it simply creates an unassigned ValueError instance and does nothing with it. This is clearly not intentional, and it is a problem because it means it is possible to set an invalid xsi:type for an AttributeValue. This patch corrects the error by raising the ValueError exception rather than letting it disappear into the ether.
* | Merge pull request #542 from pganssle/pyprojectIvan Kanakarakis2018-08-231-0/+2
|\ \ | | | | | | Specify the minimum build-tool version
| * | Add pyproject.tomlPaul Ganssle2018-08-171-0/+2
| |/ | | | | | | | | | | The version=file:VERSION line in setup.cfg actually requires setuptools>=40.0.0, so this adds a pyproject.toml file describing the minimum build dependencies of the project.
* | Merge pull request #541 from skoranda/no_saml_subject_name_idIvan Kanakarakis2018-08-222-42/+98
|\ \ | |/ |/| | | | | Do not require a SAML authentication response to contain a NameID element - it is not required by the SAML 2.0 specification. Invoke add_information_about_person only when resp.assertion.subject.name_id is available.
| * Test parsing of authentication response with no NameIDScott Koranda2018-08-171-0/+57
| | | | | | | | | | Added a test to test the parsing of an authentication response that does not contain a <NameID> element.
| * SP class should not assume SAML NameID in assertionScott Koranda2018-08-161-42/+41
|/ | | | | | | | | | The basic pySAML2 service provider class upon which SPs are built should not require that a SAML authentication request response from an IdP contains a SAML NameID element since it is not required by the SAML 2.0 specification. This change enables the parse_authn_request_response method for the basic pySAML2 service provider class to successfully parse a SAML authentication request response that does not contain a SAML NameID element.
* Release 4.6.0v4.6.0Ivan Kanakarakis2018-08-072-1/+42
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #530 from c00kiemon5ter/feature-set-id-attr-nameIvan Kanakarakis2018-08-046-569/+629
|\ | | | | Allow configuration and specification of id attribute name
| * Add test for okta integrationDaniel Wang2018-08-043-0/+75
| | | | | | | | | | | | | | Okta integration requires decryption id_attr to be set to 'Id'. Add SAML2 response generated from okta into test directory, and test that this is successfully decrypted using a properly configured SecurityContext
| * Allow configuration and specification of id attribute nameIvan Kanakarakis2018-08-042-14/+31
| | | | | | | | | | | | | | The id attribute name is used by xmlsec1 to find the correct attribute in the given element that contains the id of the node that will be signed. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Formatting and cleanupIvan Kanakarakis2018-08-044-560/+528
|/ | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #528 from c00kiemon5ter/fix-logout-return-addrsIvan Kanakarakis2018-08-032-98/+95
|\ | | | | | | | | | | | | | | | | | | | | | | | | Retrieve SLO endpoint by the appropriate service type This is triggered when the self.config object has not been created through the SPConfig class, or the IdPConfig class, or the config_factory() function, but directly through the Config class. This results in the config object not having a context as it empty by default. When that happens and endpoint() is called without being passed a context parameter, then getattr() will fail to return the correct attribute. The solution is to pass the context parameter when calling the endpoint() method. This is achieved by passing the entity_type attribute. Moreover, _parse_response() used to call endpoint() only for BINDING_HTTP_REDIRECT and BINDING_HTTP_POST. Thus, return_addrs would be left empty for BINDING_SOAP. The second part of the solution is adding BINDING_SOAP to the bindings that will be checked to fill in return_addrs.
| * Retrieve SLO endpoint by the appropriate service typeIvan Kanakarakis2018-08-032-2/+46
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Cleanup Entity _parse_responseIvan Kanakarakis2018-08-032-98/+51
|/ | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #395 from DataShades/identify-session-info-fixIvan Kanakarakis2018-08-021-23/+21
|\ | | | | Initialize session_info before assignment
| * Initialize session_info and cleanup codeMark Gregson2018-08-021-23/+21
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | Merge pull request #394 from DataShades/redirect-logout-requestsIvan Kanakarakis2018-08-021-1/+5
|\ \ | | | | | | Correctly pull the SAMLRequest from Redirect LogoutRequests
| * | Correctly pull the SAMLRequest from Redirect LogoutRequestsMark Gregson2018-08-021-1/+5
| |/
* | Merge pull request #393 from DataShades/sp-repoze-scriptname-fixIvan Kanakarakis2018-08-021-3/+3
|\ \ | |/ |/| Include SCRIPT_NAME when checking if current URL is a logout endpoint
| * Include SCRIPT_NAME when checking whether current URL is a logout endpointMark Gregson2018-08-021-3/+3
|/
* Merge pull request #399 from frostburn/client-logout-typoIvan Kanakarakis2018-08-021-1/+1
|\ | | | | Fix a typo in Saml2Client.do_logout
| * Fix a typo in Saml2Client.do_logoutLumi Pakkanen2018-08-021-1/+1
|/ | | | Use "not_on_or_after" instead of "not_on_of_after" for the expiry entry in the state.
* Merge pull request #526 from c00kiemon5ter/refactor-cryptography-moduleIvan Kanakarakis2018-08-029-139/+266
|\ | | | | Introduce cryptography module
| * Deprecate AESCipher and aes.py moduleIvan Kanakarakis2018-08-022-99/+136
| | | | | | | | | | | | | | aes.py is deprecated and will be completely removed in a following release. Users should switch to saml2.cryptography.symmetric instead. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Use the new saml2.cryptography moduleIvan Kanakarakis2018-08-024-40/+38
| | | | | | | | | | | | | | | | | | Replace AESCipher with the default symmetric method. Use the default key generation method to generate a key for the server. Warn about the use of aes attribute of authn.UsernamePasswordMako class. Hide cryptography details behind the saml2.cryptography module. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Add saml2.cryptography moduleIvan Kanakarakis2018-08-024-0/+92
|/ | | | | | | | | | | This module provides cryptographic elements needed by saml2. There are separate modules for symmetric and asymmetric cryptography, as well as pki related operations. The default symmetric cryptography method used is Fernet by the cryptography library. Reference: https://cryptography.io/en/latest/fernet/ Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #519 from c00kiemon5ter/fix-aes-ctr-ecb-CVE-2017-1000246Ivan Kanakarakis2018-08-024-52/+83
|\ | | | | Fix AES IV reuse - drop support for CTR and ECB - address CVE-2017-1000246
| * Add tests for AES cipherIvan Kanakarakis2018-08-022-24/+74
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Always generate a random IV for AES operationsIvan Kanakarakis2018-08-023-31/+12
|/ | | | | | | | | | | | | | | Quoting @obi1kenobi: > Initialization vector reuse like this is a security concern, since it leaks > information about the encrypted data to attackers, regardless of the > encryption mode used. > Instead of relying on a fixed, randomly-generated IV, it would be better to > randomly-generate a new IV for every encryption operation. Breaks AESCipher ECB support Reported as CVE-2017-1000246 Fixes #417 Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #520 from c00kiemon5ter/fix-warningsIvan Kanakarakis2018-08-0211-111/+43
|\ | | | | Fix warnings and minor cleanup
| * Fix deprecation and resource warnings.Ivan Kanakarakis2018-08-0210-63/+43
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Remove unused and broken RSA codeIvan Kanakarakis2018-08-021-48/+0
|/ | | | | | | | | | commit afdf5b4a8cca33dbe746095d9442b958c5fa9a24 broke the RSA type that was provided by Cryptodome.PublicKey. This breakage did not seem to break tests or existing setups - I believe it is safe to remove the code altogether. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #525 from AmbientLighter/patch-1Ivan Kanakarakis2018-08-011-1/+1
|\ | | | | | | | | | | Specify minimal version for cryptography package Reference: https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/#cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey.sign
| * Specify minimal version for cryptography packageVictor Mireyev2018-08-011-1/+1
|/ | | | Otherwise if pysaml is installed with an older release of cryptography package it would fail with AttributeError: '_RSAPrivateKey' object has no attribute 'sign'
* Add more nameid-format definitionsIvan Kanakarakis2018-07-071-6/+12
| | | | | | | | | In accordance to Section _8.3 Name Identifier Format Identifiers_ of the SAML2-core specification. Only new definitions are added. Usage is not supported yet. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Remove invalid nameid-formatIvan Kanakarakis2018-07-071-3/+1
| | | | | | | | | | The nameid format urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified is invalid and not specified by any spec. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #516 from c00kiemon5ter/feature-tidy-metadataIvan Kanakarakis2018-07-0631-313/+386
|\ | | | | Tidy metadata and project files
| * Set the correct version in the docsIvan Kanakarakis2018-07-041-6/+16
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Remove gitignore from subdirectoriesIvan Kanakarakis2018-07-042-9/+1
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Remove bzr related filesIvan Kanakarakis2018-07-041-12/+0
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Fix references to docsIvan Kanakarakis2018-07-043-5/+5
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
View Lorry Controller Status