summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Release version 4.9.0v4.9.0v4.9.0Ivan Kanakarakis2019-11-032-1/+15
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix warnings from docs generationIvan Kanakarakis2019-11-034-29/+32
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Improve mdstore methods that extract mdui uiinfo subelementsIvan Kanakarakis2019-10-311-59/+40
| | | | | | | | - Do not raise KeyError if entity-id is wrong - Keep only the generator form; as more perfomant and generic - Generalize internal searchers Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Add attribute mapping for umbrellaID attributes (#648)Christos Kanellopoulos2019-10-151-0/+8
| | | | | | umbrellaID is the federated identity system for the users of the (European) large neutron and photon facilities. This commit adds the mapping for the EAAHash and EEAKey, which are used for identifying users in the umbrellaID AAI.
* Do not set a preferred language for uiinfo elementsIvan Kanakarakis2019-10-091-9/+9
| | | | | | | The return values are list of text values. By default return, all possible values. Users need to specify their own preference and choose whether they need one or more values. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Cleanup importsIvan Kanakarakis2019-10-084-43/+7
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Deprecate saml2.extension.ui - use saml2.extension.mduiIvan Kanakarakis2019-10-087-335/+8
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Add mdstore methods to extract mdui uiinfo subelementsIvan Kanakarakis2019-10-081-0/+108
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Add mdstore method to extract mdui uiinfo elementsIvan Kanakarakis2019-10-081-0/+35
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Generate class names for metadata elementsIvan Kanakarakis2019-10-081-13/+17
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #632 from peppelinux/docIvan Kanakarakis2019-09-101-0/+16
|\ | | | | Add Documentation for name_id_format_allow_create and metadata folder
| * name_id_format_allow_create and metadata folderGiuseppe De Marco2019-08-161-0/+16
| |
* | Merge pull request #641 from skoranda/better_pick_bindingIvan Kanakarakis2019-08-263-14/+104
|\ \ | | | | | | Better pick binding by index
| * | Added test file for tests around authentication requestsScott Koranda2019-08-261-0/+37
| | | | | | | | | | | | | | | | | | | | | Added a file for holding tests around authentication requests and added a first test to test that the IdP code can pick the correct location from SAML metadata using the AssertionConsumerServiceIndex from an authentication request.
| * | Added second HTTP-POST binding in metadata for test SPScott Koranda2019-08-261-0/+1
| | | | | | | | | | | | | | | Added a second HTTP-POST binding to the SAML metadata for test SP so that it can be used for various tests.
| * | Formatting of SP SAML metadata used for testsScott Koranda2019-08-261-4/+64
| | | | | | | | | | | | | | | Formatted some of the SP SAML metadata used for tests so that it can be read by a human.
| * | Fix logic error in pick_binding method for class EntityScott Koranda2019-08-261-10/+2
|/ / | | | | | | | | | | | | | | | | | | | | | | Fix logic in the pick_binding method for the class Entity that prevented the method from properly returning binding and location tuples for authentication requests with AssertionConsumerServiceIndex instead of AssertionConsumerServiceURL. The logic error was assuming that a getattr() call on a request without an AssertionConsumerServiceURL would throw an AttributeError. It does not and instead returns None, so the resulting path through the code would cause the "first" binding and location tuple found in the SAML metadata to be returned instead of the tuple corresponding to the AssertionConsumerServiceIndex.
* | Merge pull request #640 from kalevivt/masterIvan Kanakarakis2019-08-255-59/+59
|\ \ | | | | | | Various typo fixes
| * | Various typo fixesKalevi Vázquez Tuisku2019-08-255-59/+59
|/ /
* | Merge pull request #637 from benjaminbecker/patch-1Ivan Kanakarakis2019-08-241-2/+2
|\ \ | | | | | | Fix PKCS_9 url:oid prefix in attributemaps
| * | Update saml_uri.pybenjaminbecker2019-08-221-2/+2
| | | | | | | | | | | | According to https://tools.ietf.org/html/rfc2985 the urn for emailAddress has to be `1.2.840.113549.1.9.1`. In saml_uri.py this is not implemented correctly. The current version uses `PKCS_9+'1'` which equals to `1.2.840.113549.1.9.1.1`. This can be fixed by deleting the trailing '1.' from line 8. This should not cause any side-effects, because the variable `PKCS_9` in combination with `+'1'`.
* | | Validate the audience of assertions regardless of a response being unsolicitedIvan Kanakarakis2019-08-242-6/+5
| | | | | | | | | | | | | | | | | | Fixes #609 Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | | Merge pull request #639 from timgates42/feature/fix_simple_typo__allowes__42Ivan Kanakarakis2019-08-231-1/+1
|\ \ \ | | | | | | | | Fix simple typo: allowes -> allows
| * | | Fix simple typo: allowes -> allowsTim Gates2019-08-231-1/+1
| |/ /
* | | Merge pull request #638 from timgates42/feature/fix_simple_typo__activite_11Ivan Kanakarakis2019-08-231-1/+1
|\ \ \ | |/ / |/| | Fix simple typo: activites -> activities
| * | Fix simple typo: activites -> activitiesTim Gates2019-08-231-1/+1
|/ /
* | Merge pull request #631 from zehuanli/patch-1Ivan Kanakarakis2019-08-201-0/+1
|\ \ | | | | | | Fix IdP example list
| * | Fix IdP example listZehuan Li2019-08-151-0/+1
|/ /
* | Update release instructions to mention release branch creationIvan Kanakarakis2019-07-091-11/+15
|/ | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Release version 4.8.0v4.8.0v.4.8.0Ivan Kanakarakis2019-07-082-1/+21
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix tests to be compatible with latest pytestIvan Kanakarakis2019-07-0811-64/+100
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Update release instructionsIvan Kanakarakis2019-07-081-10/+7
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Increase max line length to 88, as defined by blackIvan Kanakarakis2019-07-081-1/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Set force_authn when the value is "true" or "1"Ivan Kanakarakis2019-06-272-16/+39
| | | | | | | | | | | | | | Following d257d3054f36b4f3dfaba8b7394a2e8bab0aaf2e the ForceAuthn attribute is an xsd:boolean value which can be any of "false", "true", "0" or "1". We must set force_authn when the value is "true" or "1". We set the value into kwargs, which is then mirrored onto _args, which is merged with args, which is finally given to the saml2.samlp.AuthnRequest class to construct the object. Previously, we set the value into args directly, which would be overwritten by the call to _filter_args. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Use shorthand to remove the "id" item from dictIvan Kanakarakis2019-06-271-4/+1
| | | | | | No need to generate an exception and stack trace. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #621 from skoranda/better_edupersontargetedidIvan Kanakarakis2019-06-172-6/+61
|\ | | | | Allow NameQualifier and SPNameQualifier attributes to be set for ePTID
| * Restructure to_eptid_value functionIvan Kanakarakis2019-06-172-37/+44
| | | | | | | | | | | | | | Use "text" instead of "value" as the key that denotes the text-value of the NameID node. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Enable NameQualifier and SPNameQualifier attributes for ePTIDScott Koranda2019-06-042-6/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | The attribute value for eduPersonTargetedID (ePTID) is a NameID element. The SAML specification allows the NameID element to include the two optional attributes 'NameQualifier' and 'SPNameQualifier'. This patch enables specifying a dictionary as the internal or local attribute value instead of a string. When the local attribute value is a dictionary with keys 'value', 'NameQualifier', and 'SPNameQualifier' then the resulting XML NameID element will include the 'NameQualifier' and 'SPNameQualifier' attributes with values taken from the values of the dictionary. The value for the NameID element is taken from the value associated with tthe 'value' key.
* | Merge pull request #622 from c00kiemon5ter/feature-improve-ciIvan Kanakarakis2019-06-172-2/+6
|\ \ | | | | | | Add py37 as a test target
| * | Use pytest inplace of py.testIvan Kanakarakis2019-06-171-2/+2
| | | | | | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * | Add py37 as a test targetIvan Kanakarakis2019-06-172-0/+4
|/ / | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | Set force_authn only when the value is "true"Ivan Kanakarakis2019-06-131-7/+6
|/ | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #618 from abliqo/holder-of-keyIvan Kanakarakis2019-05-297-17/+244
|\ | | | | Fix parsing of assertions with Holder-of-Key profile
| * Format codeIvan Kanakarakis2019-05-292-54/+72
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
| * Use `extension_elements` to extract `KeyInfo`Alex Bublichenko2019-05-284-12/+10
| | | | | | | | Instead of explicitly declaring `KeyInfo` as child of `SubjectConfirmationData`, use `extension_elements` to extract `KeyInfo` element(s).
| * Gracefully handle invalid HOK assertionsAlex Bublichenko2019-05-243-10/+56
| |
| * Clean up and fix tests for python 3.* versionsAlex Bublichenko2019-05-242-35/+46
| |
| * Parse assertions with Holder-of-Key profileAlex Bublichenko2019-05-237-18/+172
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: Holder-of-Key assertions are used to achieve higher levels of federation security, compared to bearer assertions, by having Relying Party challenge subscriber to prove possession of the key specified in the assertion that represents subscriber in addition to verifying the assertion itself signed by Identity Provider. More information about it can be found in https://pages.nist.gov/800-63-3/sp800-63c.html This library fails to parase SAML respones containing assertions with Holder-of-Key profile, for example: ``` <ns1:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key"> <ns1:SubjectConfirmationData InResponseTo="id-KHlas49TtW2VdC8WN" NotOnOrAfter="2019-05-14T20:36:13Z" Recipient="https://sp:443/.auth/saml/login"> <ns2:KeyInfo> <ns2:X509Data> <ns2:X509Certificate>MIICITCCAYoCAQEwDQYJKoZIhvcNAQELBQAwWDELMAkGA1UEBhMCenoxCzAJBgNVBAgMAnp6MQ0wCwYDVQQHDAR6enp6MQ4wDAYDVQQKDAVaenp6ejEOMAwGA1UECwwFWnp6enoxDTALBgNVBAMMBHRlc3QwIBcNMTkwNDEyMTk1MDM0WhgPMzAxODA4MTMxOTUwMzRaMFgxCzAJBgNVBAYTAnp6MQswCQYDVQQIDAJ6ejENMAsGA1UEBwwEenp6ejEOMAwGA1UECgwFWnp6enoxDjAMBgNVBAsMBVp6enp6MQ0wCwYDVQQDDAR0ZXN0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHcj80WU/XBsd9FlyQmfjPUdfmedhCFDd6TEQmZNNqP/UG+VkGa+BXjRIHMfic/WxPTbGhCjv68ci0UDNomUXagFexLGNpkwa7+CRVtoc/1xgq+ySE6M4nhcCutScoxNvWNn5eSQ66i3U0sTv91MgsXxqEdTaiZg0BIufEc3dueQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAGUV5B+USHvaRa8kgCNJSuNpo6ARlv0ekrk8bbdNRBiEUdCMyoGJFfuM9K0zybX6Vr25wai3nvaog294Vx/jWjX2g5SDbjItH6VGy6C9GCGf1A07VxFRCfJn5tA9HuJjPKiE+g/BmrV5N4CealzFxPHWYkNOzoRU8qI7OqUai1kL</ns2:X509Certificate> </ns2:X509Data> </ns2:KeyInfo> </ns1:SubjectConfirmationData> </ns1:SubjectConfirmation> ``` fails to be parsed with the following error: ``` ERROR saml2.response:response.py:836 get subject Traceback (most recent call last): File "/home/abublich/repos/abliqo-pysaml2/venv/local/lib/python2.7/site-packages/pysaml2-4.7.0-py2.7.egg/saml2/response.py", line 828, in _assertion self.get_subject() File "/home/abublich/repos/abliqo-pysaml2/venv/local/lib/python2.7/site-packages/pysaml2-4.7.0-py2.7.egg/saml2/response.py", line 753, in get_subject if not self._holder_of_key_confirmed(_data): File "/home/abublich/repos/abliqo-pysaml2/venv/local/lib/python2.7/site-packages/pysaml2-4.7.0-py2.7.egg/saml2/response.py", line 730, in _holder_of_key_confirmed [samlp, saml, xenc, ds]): File "/home/abublich/repos/abliqo-pysaml2/venv/local/lib/python2.7/site-packages/pysaml2-4.7.0-py2.7.egg/saml2/__init__.py", line 1004, in extension_elements_to_elements for extension_element in extension_elements: TypeError: 'SubjectConfirmationData' object is not iterable ``` The root cause is two-fold: 1. The type SubjectConfirmationDataType_ does not declare KeyInfo as child element. 2. The bug in function _holder_of_key_confirmed: it should check KeyInfo child element of SubjectConfirmationData instead of SubjectConfirmationData itself. Solution: Fixed the root cause and added new unit tests that verify successful parsing of Holder-of-Key assertions.
* | Merge pull request #619 from stdedos/patch-1Ivan Kanakarakis2019-05-281-1/+1
|\ \ | |/ |/| Explicit request of cherrypy version for the example application
| * Explicit cherrypy requirements for the example applicationStavros Ntentos2019-05-281-1/+1
|/ | | | | | | Unless you are pulling always from https://pypi.org/simple, it is possible that you might get an older version of `cherrypy`. Make sure we request a "relatively recent" version. `pip install 'CherryPy>14.0.2,<15'` gave `CherryPy-14.2.0` which works
View Lorry Controller Status