summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* Return the ResponseLocation before falling back to Locationfeature-logout-response-locationIvan Kanakarakis2020-10-284-33/+74
| | | | | | | | | | | | | | | | | | | | | | | | ResponseLocation [Optional] Optionally specifies a different location to which response messages sent as part of the protocol or profile should be sent. The allowable syntax of this URI depends on the protocol binding. The ResponseLocation attribute is used to enable different endpoints to be specified for receiving request and response messages associated with a protocol or profile, not as a means of load-balancing or redundancy (multiple elements of this type can be included for this purpose). When a role contains an element of this type pertaining to a protocol or profile for which only a single type of message (request or response) is applicable, then the ResponseLocation attribute is unused. [E41]If the ResponseLocation attribute is omitted, any response messages associated with a protocol or profile may be assumed to be handled at the URI indicated by the Location attribute. ArtifactResolutionService, SingleSignOnService and NameIDMappingService MUST omit the ResponseLocation attribute. This is enforced here, but metadata with such service declarations and such attributes should not have been part of the metadata store in the first place. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fixes #720: honor ResponseLocation in metadata when building logout responsesMaxime Besson2020-10-272-4/+17
|
* The xsd:id attribute value must not start with a numberIvan Kanakarakis2020-10-051-9/+8
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #704 from canderson90/fix-601-default-nameformatIvan Kanakarakis2020-09-291-0/+5
|\ | | | | Set the default attribute NameFormat to NAME_FORMAT_UNSPECIFIED
| * Add explanatory comment for harvest_element_tree usageIvan Kanakarakis2020-09-291-0/+1
| |
| * Ensure IdP configurations still default to NAME_FORMAT_URIChris Anderson2020-08-111-1/+5
| |
| * Set the default attribute NameFormat to NAME_FORMAT_UNSPECIFIED as per ↵Chris Anderson2020-07-241-1/+1
| | | | | | | | section 2.7.3.1 of the spec
* | Support logging configuration through the python loggerIvan Kanakarakis2020-09-291-18/+6
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | Replace assert with proper checksassert_deletionIvan Kanakarakis2020-09-1115-97/+173
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | Refactor active_cert checkIvan Kanakarakis2020-09-101-7/+7
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | Use ValueError instead of ExceptionIvan Kanakarakis2020-09-102-5/+5
| | | | | | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | first deletion of assertionGiuseppe2020-09-063-7/+9
| |
* | Allow request signing in artifact2messageKrzysztof Jurewicz2020-08-251-2/+8
| |
* | Fix wrong identifiers for ecdsa algosMathieu Hinderyckx2020-08-112-10/+10
| |
* | Merge pull request #707 from richvdh/fix_acs_fixupIvan Kanakarakis2020-08-101-21/+36
|\ \ | | | | | | Fix automatic inversion of attribute map files
| * | Fix automatic inversion of attribute map filesRichard van der Hoff2020-08-101-1/+3
| | | | | | | | | | | | | | | In order for automatic inversion of attribute maps to work, we need to accept definitions of attribute maps with only one of `to` or `fro`.
| * | Factor out common codepaths in attribute_converterRichard van der Hoff2020-08-101-21/+34
| |/ | | | | | | | | We have three copies of the code that looks for attribute map definitions in a python module: let's factor them out.
* | Remove spurious `exception` loggingRichard van der Hoff2020-08-101-4/+0
|/ | | | | | These two `logger.exception` calls are both incorrect, because neither are in an `except` block - which means that they will log a stacktrace for whatever the most recent exception was (which may be wholly unrelated).
* Support arbitrary entity attributesIvan Kanakarakis2020-07-112-0/+20
| | | | | | | | | | | | | | | | | | Introduce new configuration option `entity_attributes` that defines a list of dictionaries each of which represents an <Attribute> element. Each dicrionary has fields for the NameFormat, the Name, the FriendName and a list of strings that are used to create <AttributeValue> elements, each with the string as the text node. "entity_attributes": [ { "name_format": "urn:oasis:names:tc:SAML:2.0:attrname-format:uri", "name": "urn:oasis:names:tc:SAML:profiles:subject-id:req", # "friendly_name" is not set "values": ["any"], }, ] Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Revert "Fix check for signed logout"Ivan Kanakarakis2020-07-101-1/+1
| | | | This reverts commit b8539198eb02149510a831e2c93c88ef8c438042.
* Differentiate between metadata NameIDFormat and AuthnRequest NameIDPolicy FormatIvan Kanakarakis2020-07-103-26/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | The `name_id_format` configuration option is used to define 1. the value of the `<NameIDFormat>` metadata element 2. and the value of the `<NameIDPolicy>` `Format` attribute in an `AuthnRequest` The configuration option to set what the value of `<NameIDFormat>` element is in the metadata should be different from the configuration option to specify what should be requested in an `AuthnRequest` through the `<NameIDPolicy Format="...">` attribute. Introduce a new option (`name_id_policy_format`), or use the same name but scoped in a specific section for metadata and AuthnRequest. On the side of this, pysaml2 defaults to _transient_ as the `<NameIDPolicy Format="...">` attribute value. To omit requesting a value for the `<NameIDPolicy Format="">` attribute the value `"None"` (a string) must be set in the configuration. This is unintuitive. It is better to be explicit and set transient to request a transient NameID, than not setting a value and requesting transient by default. If no value is set, no specific `<NameIDPolicy Format="...">` should be requested. - Refactor the name_id_format usage - Add name_id_policy_format configuration option - Remove the "None" convention value Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Added PKIX attributes used in Sweden ConnectJohan Lundberg2020-07-101-0/+14
|
* Updated SWAMID entity categoriesJohan Lundberg2020-07-091-23/+69
|
* Added attributes used for Sweden ConnectJohan Lundberg2020-07-091-0/+41
| | | | https://docs.swedenconnect.se/technical-framework/latest/00_-_Swedish_eID_Framework_-_Introduction.html
* Fixes #693: Allow generation of signed metadata in python3Nate Otto2020-07-041-2/+2
|
* Fix check for nameid_format set to the string NoneIvan Kanakarakis2020-06-241-1/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Refactor create_authn_request messageIvan Kanakarakis2020-06-111-11/+33
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Unpack the NameIDPolicy Format before examining its valueIvan Kanakarakis2020-06-111-2/+5
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Allow different than NameIDPolicy persistent format when SPNameQualifier is setIvan Kanakarakis2020-06-111-1/+2
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Refactor create_authn_request comment titlesIvan Kanakarakis2020-06-111-0/+3
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Refactor create_authn_request name_id_policyIvan Kanakarakis2020-06-111-49/+35
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Refactor create_authn_request nsprefix, client_crt and signIvan Kanakarakis2020-06-111-11/+4
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Refactor create_authn_request loop paramIvan Kanakarakis2020-06-111-15/+10
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Refactor create_authn_request provider_nameIvan Kanakarakis2020-06-111-8/+5
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Refactor create_authn_request assertion_consumer_service_urlIvan Kanakarakis2020-06-111-22/+17
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Prevent an Extensions element appearing in the AuthnRequestIvan Kanakarakis2020-06-101-50/+52
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Do not fix the configured requested_attributesfeat-requested-attributes-per-requestIvan Kanakarakis2020-06-051-44/+0
| | | | | | This is always done on use, ie, on client_base.py::create_authn_request Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix attribute maps orderIvan Kanakarakis2020-06-051-1/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Minor formatting changesIvan Kanakarakis2020-06-021-10/+13
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix param documentationIvan Kanakarakis2020-06-021-3/+5
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Requested fixesNikos Sklikas2020-05-281-53/+51
|
* Add requested_attributes paramNikos Sklikas2020-05-282-19/+67
| | | | Add requested_attributes param to create_authn_request
* Remove the id_attr_name configuration optionIvan Kanakarakis2020-05-261-2/+0
| | | | | | | The name of the id-attribute for signing, encrypting and decrypting an XML document is well know for each of those operations. There is no need to define another. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix xmlsec1 --id-attr optionIvan Kanakarakis2020-05-261-89/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We need to know _the name of the attribute_ that represents the identifier of the node that is being signed, or encrypted, or verified. We guess the name -by trying `ID`, `Id` and `id`- and pass it to `xmlsec1` using the `--id-attr` command line option. _Why is this needed?_ Shouldn't the attribute names be specified by the corresponding specifications? Let's look into the specs to find out. * saml-core: * `StatusResponseType` uses `ID` * `RequestAbstractType` uses `ID` * `Assertion` uses `ID` * xmldsig-core: * `SignatureType` uses `Id` * xmlenc-core: * `EncryptedType` uses `Id` So, the answer is _yes_ - the attribute names are defined and, instead of guessing, we should be passing in the id-attribute names as defined by the specs. _Note_: But, do we even need to do this? If the names are standardized, why do we bother with this? In fact, the manual for `xmlsec1` explicitly says that --id-attr[:<attr-name>] [<node-namespace-uri>:]<node-name> adds attributes <attr-name> (default value "id") from all nodes with<node-name> and namespace <node-namespace-uri> to the list of known ID attributes; this is a hack and if you can use DTD or schema to declare ID attributes instead (see "--dtd-file" option), I don't know what else might be broken in your application when you use this hack However, it seems that `xmlsec1` by default will only look for an attribute with name `id`. The right way to solve this is to pass in a DTD file. Then, `xmlsec1` will understand that it needs to look up a different attribute name. Unfortunately, there are no official DTDs (or even unofficial, to my knowledge) for SAML. The SAML specifications instead provide XSD files. Even though `xmlsec1` mentions _schema_, there doesn't seem to be a way to pass in an XSD file. So, we have to resort to this "hack". When we sign a document, we need to point to the node that will be signed. The nodes that we are signing are always SAML nodes (Assertion, StatusResponseType (Response, etc), RequestAbstractType (AuthnRequest, etc)). All SAML nodes that will be signed use `ID` as the attribute name. So, in order to sign and verify a signature, we need to pass in `ID`. When encrypting a document, we need to point to the node whose content will be encrypted. Currently, we use XPath to point to that node, without the use of an id. But, we could be using an identifier to locate the node, and if we did so, we would still be using `ID`. When decrypting a document, we need to point to the node that contains the encrypted data. This is where things change. Since the SAML node itself is encrypted we cannot point to an `ID` attribute, as we did in the other cases. Instead, it is specified that a node named `EncryptedData` exists, that may have an `Id` attribute. This is where we want to point to. So, we need to use `Id`. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix call to urlencodepylint-fixesIvan Kanakarakis2020-05-121-2/+2
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Remove unneeded string formatIvan Kanakarakis2020-05-121-1/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Remove py2 compatibility checkIvan Kanakarakis2020-05-121-6/+2
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Replace NotImplemented with NotImplementedErrorIvan Kanakarakis2020-05-121-1/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Raise exception with message; not tupleIvan Kanakarakis2020-05-121-3/+4
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Remove assignment for function with no returnIvan Kanakarakis2020-05-121-1/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
View Lorry Controller Status