summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* Simplify Base::create_discovery_service_request methodIvan Kanakarakis2019-05-161-21/+14
| | | | | | | Allow values of None in the collected information. Filter out those fields later. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #593 from AmbientLighter/patch-2Ivan Kanakarakis2019-05-141-3/+3
|\ | | | | Fix typos: tupel and test_ouput
| * Fix typo: test_ouput to test_outputIvan Kanakarakis2019-05-141-1/+1
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Fix typo: tupel to tupleVictor Mireyev2019-05-141-3/+3
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | Merge pull request #610 from peppelinux/deprecation_warningsIvan Kanakarakis2019-05-141-4/+12
|\ \ | | | | | | Use html.escape when available
| * | Escape single and double quotes, alwaysIvan Kanakarakis2019-05-141-3/+7
| | | | | | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * | Format import statementsIvan Kanakarakis2019-05-141-3/+4
| | | | | | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * | DeprecationWarning: cgi.escape is deprecated, use html.escape instead. FixedGiuseppe2019-04-261-4/+7
| | |
* | | Merge pull request #606 from bmwiedemann/fix2025Ivan Kanakarakis2019-05-147-48/+60
|\ \ \ | | | | | | | | Make tests pass after 2024
| * | | Make tests pass after 2024Bernhard M. Wiedemann2019-04-127-48/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Background: As part of my work on reproducible builds for openSUSE, I check that software still gives identical build results in the future. The usual offset is +15 years, because that is how long I expect some software will be used in some places. This showed up failing tests in our package build. See https://reproducible-builds.org/ for why this matters. This patch made tests pass in 2037
* | | | Merge pull request #613 from skoranda/more_flexible_entity_category_importIvan Kanakarakis2019-05-144-2/+144
|\ \ \ \ | | | | | | | | | | Make entity category imports more flexible
| * | | | Added tests for new entity category import functionalityScott Koranda2019-05-073-0/+139
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added tests for the new entity category import functionality that searches for entity category modules on the general import path before searching in saml2.entity_category.<module>.
| * | | | Enable entity category import from module search pathScott Koranda2019-05-071-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This enhancement causes an entity category import to first be tried from the general module search path, and if that fails then to fall back to the current default of importing saml2.entity_category.<module>. This allows deployers to overlay their own customized versions of entity category modules like edugain.py that contain CoCo. This is helpful since the list of attributes to be included as part of the entity category may not be globally the same for all deployments. Such is the case with CoCo where the list of attributes changes from federation to federation and deployment to deployment.
* | | | | Merge pull request #615 from srinivasreddy42/patch-1Ivan Kanakarakis2019-05-141-0/+3
|\ \ \ \ \ | | | | | | | | | | | | Add installation instruction to README
| * | | | | Update README.rstSrinivas Reddy Thatiparthy2019-05-141-0/+3
| | | | | |
* | | | | | Merge pull request #617 from SUNET/eduid-mongodb_timestampsIvan Kanakarakis2019-05-141-0/+4
|\ \ \ \ \ \ | | | | | | | | | | | | | | Add timestamps for ident mongodb documents
| * | | | | | add created_at timestamps to all mongodb documentsFredrik Thulin2019-05-141-0/+4
| |/ / / / /
* | | | | | Merge pull request #616 from SUNET/eduid-nameid_fixesIvan Kanakarakis2019-05-145-10/+44
|\ \ \ \ \ \ | |/ / / / / |/| | | | | Check for an existing local-persistent NameID when retrieving it
| * | | | | Format codeIvan Kanakarakis2019-05-142-10/+19
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * | | | | update tests with regards to AllowCreateFredrik Thulin2019-05-082-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | AllowCreate is not supposed to be present for transient Name IDs.
| * | | | | improve commentFredrik Thulin2019-05-081-1/+1
| | | | | |
| * | | | | Look for existing persistent id's before creating new ones.Fredrik Thulin2019-05-081-3/+8
| | | | | |
| * | | | | implement match_local_idFredrik Thulin2019-05-081-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement MongoDB version of function to look for an existing persistent NameId for a user.
| * | | | | Don't add AllowCreate for default transient name idsFredrik Thulin2019-05-081-0/+4
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | http://docs.oasis-open.org/security/saml/v2.0/errata05/os/saml-v2.0-errata05-os.html#__RefHeading__8058_1983180497: "The use of the AllowCreate attribute MUST NOT be used and SHOULD be ignored in conjunction with requests for or assertions issued with name identifiers with a Format of urn:oasis:names:tc:SAML:2.0:nameid-format:transient (they preclude any such state in and of themselves)."
* | | | | Merge pull request #614 from liamkinney/patch-1Ivan Kanakarakis2019-05-091-1/+1
|\ \ \ \ \ | |/ / / / |/| | | | Typo in comment
| * | | | Typo in commentLiam Kinney2019-05-081-1/+1
|/ / / /
* | | | Merge pull request #607 from alexstuart/SAML-subject-idIvan Kanakarakis2019-04-151-0/+8
|\ \ \ \ | |/ / / |/| | | Add SAML subject identifier attributes to saml2_uri attributemap
| * | | Add SAML subject identifier attributes to saml2_uri attributemapAlex Stuart2019-04-141-0/+8
|/ / /
* | | Merge pull request #605 from stdedos/patch-1Ivan Kanakarakis2019-04-121-1/+2
|\ \ \ | |/ / |/| | install.rst: complete pytest invocation
| * | install.rst: complete pytest invocationStavros Ntentos2019-04-121-1/+2
|/ /
* | Release version 4.7.0v4.7.0v4.7.0Ivan Kanakarakis2019-04-022-1/+14
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | Introduce middleware to convert data to bytesIvan Kanakarakis2019-04-011-8/+23
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | Handle eduPersonTargetedID as a single value on examplesIvan Kanakarakis2019-03-181-2/+2
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | Fix metadata endpoint on sp-wsgi exampleIvan Kanakarakis2019-03-181-1/+1
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | Keep old behaviour until decryption is properly understoodIvan Kanakarakis2019-03-121-2/+19
|/ | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Align parse_assertion with the new decryption codeIvan Kanakarakis2019-02-051-36/+39
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix python2 compatibility for metadata creationIvan Kanakarakis2019-02-041-4/+5
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix examples python3 compatibilityIvan Kanakarakis2019-02-041-1/+3
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #581 from bmwiedemann/test2020Ivan Kanakarakis2019-02-024-4/+4
|\ | | | | Allow tests to pass after 2020
| * Allow tests to pass after 2020Bernhard M. Wiedemann2019-01-074-4/+4
| | | | | | | | | | This helps to verify reproducible builds. See https://reproducible-builds.org/ for why this matters.
* | Merge pull request #585 from johanlundberg/fix_xmlsec_sign_statementIvan Kanakarakis2019-01-251-1/+4
|\ \ | | | | | | Python 3 problem with lxml.etree.tostring
| * | Convert sign_statement result to native stringJohan Lundberg2019-01-251-1/+4
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Using lxml.etree.tostring without encoding in python3 results in a unparsable xml document. To fix this, we always set the encoding to UTF-8 and omit the xml declaration. We then convert the result to the native string type before returning it. --- Our preferred encoding (in general) is `utf-8`. `lxml` defaults to `ASCII`, or expects us to provide an encoding. Provided an encoding, `lxml` serializes the tree-representation of the xml document by encoding it with that encoding. If it is directed to include an xml declaration, it embeds that encoding in the xml declaration as the `encoding` property. (ie, `<?xml version='1.0' encoding='iso-8859-7'?>`) `lxml` allows for some _special_ values as an encoding. - In python2 those are: `"unicode"` and `unicode`. - In python3 those are: `"unicode"` and `str`. By specifying those values, the result will be _decoded_ from bytes to unicode ("unicode" is not an actual encoding; the actual encoding will be utf-8). The encoding is already the _type_ of the result. This is why you are not allowed to have an xml declaration for those cases. The result is not bytes that have to be read by some encoding rules, but decoded data that their type dictates how they are managed. With the latest changes, what we do is: 1. we always encode the result as UTF-8 2. we do not include an xml declaration (because of _(3)_) 3. we convert to the native string type (that is `bytes`/`str` for Python2, and `str` for Python3 (the equivalent of `unicode` in Python2) The consumer of the result should expect to treat the result as utf8-encoded bytes in Python2, and utf8-decoded string in Python3. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | Fix docstring for the return type of create_authn_requestIvan Kanakarakis2019-01-141-1/+2
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | Merge pull request #583 from c00kiemon5ter/fix-check-xmlsec-returncodeIvan Kanakarakis2019-01-144-219/+210
|\ \ | |/ |/| Check the xmlsec returncode
| * Refactor CryptoBackendXmlSec1::sign_statementIvan Kanakarakis2019-01-141-13/+10
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Convert exception expectation to with-raises idiomIvan Kanakarakis2019-01-142-60/+33
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Reformat code for test_40_sigverIvan Kanakarakis2019-01-141-49/+74
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Refactor SecurityContext::decrypt to report failuresIvan Kanakarakis2019-01-141-46/+43
| | | | | | | | | | | | | | | | | | | | Previously there was no reliable way to know whether decryption failed. Now, when decryption fails an DecryptError exception is raised containing the keys that were tried to decrypt the given ciphertext. The same refactoring is done to SecurityContext::decrypt_keys. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Reformat code related to PYSAML2_KEEP_XMLSEC_TMPIvan Kanakarakis2019-01-141-18/+23
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Raise XmlsecError if xmlsec1 returns an errorIvan Kanakarakis2019-01-142-28/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When xmlsec1 fails, it returns a non-zero returncode. The returncode was checked only for values less than zero, and not greater than zero. This results in situations where xmlsec1 fails to run a command, but the executation continues as nothing failed. This happens to be ok, because, the result we depend upon is coupled to xmlsec1's output stream. When xmlsec1 fails, the output stream is empty and the error stream will have information relevant to the failure cause. Now, the check expects a returncode with value zero, otherwise an XmlsecError exception is raised, to be handled by the caller up the stack. This could have been a major security issue, but we stood lucky. Special thanks to @pjsg for bringing this to our attention. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
View Lorry Controller Status