From 3f1ce6bf9605f13a203d9fa52a2b94026adfedf9 Mon Sep 17 00:00:00 2001 From: Scott Koranda Date: Tue, 7 May 2019 06:53:22 -0500 Subject: Enable entity category import from module search path This enhancement causes an entity category import to first be tried from the general module search path, and if that fails then to fall back to the current default of importing saml2.entity_category.. This allows deployers to overlay their own customized versions of entity category modules like edugain.py that contain CoCo. This is helpful since the list of attributes to be included as part of the entity category may not be globally the same for all deployments. Such is the case with CoCo where the list of attributes changes from federation to federation and deployment to deployment. --- src/saml2/assertion.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/saml2/assertion.py b/src/saml2/assertion.py index 8984db59..ed043d9a 100644 --- a/src/saml2/assertion.py +++ b/src/saml2/assertion.py @@ -353,8 +353,11 @@ class Policy(object): else: ecs = [] for cat in items: - _mod = importlib.import_module( - "saml2.entity_category.%s" % cat) + try: + _mod = importlib.import_module(cat) + except ImportError: + _mod = importlib.import_module( + "saml2.entity_category.%s" % cat) _ec = {} for key, items in _mod.RELEASE.items(): alist = [k.lower() for k in items] -- cgit v1.2.1 From 15bdc66ac776e04777666fff3d08a38e24f5305a Mon Sep 17 00:00:00 2001 From: Scott Koranda Date: Tue, 7 May 2019 07:41:08 -0500 Subject: Added tests for new entity category import functionality Added tests for the new entity category import functionality that searches for entity category modules on the general import path before searching in saml2.entity_category.. --- tests/entity_cat_rs.xml | 84 ++++++++++++++++++++++++++++++++++++++ tests/myentitycategory.py | 16 ++++++++ tests/test_37_entity_categories.py | 39 ++++++++++++++++++ 3 files changed, 139 insertions(+) create mode 100644 tests/entity_cat_rs.xml create mode 100644 tests/myentitycategory.py diff --git a/tests/entity_cat_rs.xml b/tests/entity_cat_rs.xml new file mode 100644 index 00000000..5f3e00f8 --- /dev/null +++ b/tests/entity_cat_rs.xml @@ -0,0 +1,84 @@ + + + + + + + http://refeds.org/category/research-and-scholarship + + + + + + + + + + + + + MIIC8jCCAlugAwIBAgIJAJHg2V5J31I8MA0GCSqGSIb3DQEBBQUAMFoxCzAJBgNV + BAYTAlNFMQ0wCwYDVQQHEwRVbWVhMRgwFgYDVQQKEw9VbWVhIFVuaXZlcnNpdHkx + EDAOBgNVBAsTB0lUIFVuaXQxEDAOBgNVBAMTB1Rlc3QgU1AwHhcNMDkxMDI2MTMz + MTE1WhcNMTAxMDI2MTMzMTE1WjBaMQswCQYDVQQGEwJTRTENMAsGA1UEBxMEVW1l + YTEYMBYGA1UEChMPVW1lYSBVbml2ZXJzaXR5MRAwDgYDVQQLEwdJVCBVbml0MRAw + DgYDVQQDEwdUZXN0IFNQMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDkJWP7 + bwOxtH+E15VTaulNzVQ/0cSbM5G7abqeqSNSs0l0veHr6/ROgW96ZeQ57fzVy2MC + FiQRw2fzBs0n7leEmDJyVVtBTavYlhAVXDNa3stgvh43qCfLx+clUlOvtnsoMiiR + mo7qf0BoPKTj7c0uLKpDpEbAHQT4OF1HRYVxMwIDAQABo4G/MIG8MB0GA1UdDgQW + BBQ7RgbMJFDGRBu9o3tDQDuSoBy7JjCBjAYDVR0jBIGEMIGBgBQ7RgbMJFDGRBu9 + o3tDQDuSoBy7JqFepFwwWjELMAkGA1UEBhMCU0UxDTALBgNVBAcTBFVtZWExGDAW + BgNVBAoTD1VtZWEgVW5pdmVyc2l0eTEQMA4GA1UECxMHSVQgVW5pdDEQMA4GA1UE + AxMHVGVzdCBTUIIJAJHg2V5J31I8MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF + BQADgYEAMuRwwXRnsiyWzmRikpwinnhTmbooKm5TINPE7A7gSQ710RxioQePPhZO + zkM27NnHTrCe2rBVg0EGz7QTd1JIwLPvgoj4VTi/fSha/tXrYUaqc9AqU1kWI4WN + +vffBGQ09mo+6CffuFTZYeOhzP/2stAPwCTU4kxEoiy0KpZMANI= + + + + + + + + + MIIC8jCCAlugAwIBAgIJAJHg2V5J31I8MA0GCSqGSIb3DQEBBQUAMFoxCzAJBgNV + BAYTAlNFMQ0wCwYDVQQHEwRVbWVhMRgwFgYDVQQKEw9VbWVhIFVuaXZlcnNpdHkx + EDAOBgNVBAsTB0lUIFVuaXQxEDAOBgNVBAMTB1Rlc3QgU1AwHhcNMDkxMDI2MTMz + MTE1WhcNMTAxMDI2MTMzMTE1WjBaMQswCQYDVQQGEwJTRTENMAsGA1UEBxMEVW1l + YTEYMBYGA1UEChMPVW1lYSBVbml2ZXJzaXR5MRAwDgYDVQQLEwdJVCBVbml0MRAw + DgYDVQQDEwdUZXN0IFNQMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDkJWP7 + bwOxtH+E15VTaulNzVQ/0cSbM5G7abqeqSNSs0l0veHr6/ROgW96ZeQ57fzVy2MC + FiQRw2fzBs0n7leEmDJyVVtBTavYlhAVXDNa3stgvh43qCfLx+clUlOvtnsoMiiR + mo7qf0BoPKTj7c0uLKpDpEbAHQT4OF1HRYVxMwIDAQABo4G/MIG8MB0GA1UdDgQW + BBQ7RgbMJFDGRBu9o3tDQDuSoBy7JjCBjAYDVR0jBIGEMIGBgBQ7RgbMJFDGRBu9 + o3tDQDuSoBy7JqFepFwwWjELMAkGA1UEBhMCU0UxDTALBgNVBAcTBFVtZWExGDAW + BgNVBAoTD1VtZWEgVW5pdmVyc2l0eTEQMA4GA1UECxMHSVQgVW5pdDEQMA4GA1UE + AxMHVGVzdCBTUIIJAJHg2V5J31I8MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF + BQADgYEAMuRwwXRnsiyWzmRikpwinnhTmbooKm5TINPE7A7gSQ710RxioQePPhZO + zkM27NnHTrCe2rBVg0EGz7QTd1JIwLPvgoj4VTi/fSha/tXrYUaqc9AqU1kWI4WN + +vffBGQ09mo+6CffuFTZYeOhzP/2stAPwCTU4kxEoiy0KpZMANI= + + + + + + + + diff --git a/tests/myentitycategory.py b/tests/myentitycategory.py new file mode 100644 index 00000000..9ec55bf9 --- /dev/null +++ b/tests/myentitycategory.py @@ -0,0 +1,16 @@ +CUSTOM_R_AND_S = ['eduPersonTargetedID', + 'eduPersonPrincipalName', + 'mail', + 'displayName', + 'givenName', + 'sn', + 'eduPersonScopedAffiliation', + 'eduPersonUniqueId' + ] + +RESEARCH_AND_SCHOLARSHIP = "http://refeds.org/category/research-and-scholarship" + +RELEASE = { + "": ["eduPersonTargetedID"], + RESEARCH_AND_SCHOLARSHIP: CUSTOM_R_AND_S, +} diff --git a/tests/test_37_entity_categories.py b/tests/test_37_entity_categories.py index 625caaa1..839030fd 100644 --- a/tests/test_37_entity_categories.py +++ b/tests/test_37_entity_categories.py @@ -152,5 +152,44 @@ def test_idp_policy_filter(): "eduPersonTargetedID"] # because no entity category +def test_entity_category_import_from_path(): + # The entity category module myentitycategory.py is in the tests + # directory which is on the standard module search path. + # The module uses a custom interpretation of the REFEDs R&S entity category + # by adding eduPersonUniqueId. + policy = Policy({ + "default": { + "lifetime": {"minutes": 15}, + "entity_categories": ["myentitycategory"] + } + }) + + mds = MetadataStore(ATTRCONV, sec_config, + disable_ssl_certificate_validation=True) + + # The file entity_cat_rs.xml contains the SAML metadata for an SP + # tagged with the REFEDs R&S entity category. + mds.imp([{"class": "saml2.mdstore.MetaDataFile", + "metadata": [(full_path("entity_cat_rs.xml"),)]}]) + + ava = {"givenName": ["Derek"], "sn": ["Jeter"], + "displayName": "Derek Jeter", + "mail": ["derek@nyy.mlb.com"], "c": ["USA"], + "eduPersonTargetedID": "foo!bar!xyz", + "eduPersonUniqueId": "R13ET7UD68K0HGR153KE@my.org", + "eduPersonScopedAffiliation": "member@my.org", + "eduPersonPrincipalName": "user01@my.org", + "norEduPersonNIN": "19800101134"} + + ava = policy.filter(ava, "urn:mace:example.com:saml:roland:sp", mds) + + # We expect c and norEduPersonNIN to be filtered out since they are not + # part of the custom entity category. + assert _eq(list(ava.keys()), + ["eduPersonTargetedID", "eduPersonPrincipalName", + "eduPersonUniqueId", "displayName", "givenName", + "eduPersonScopedAffiliation", "mail", "sn"]) + + if __name__ == "__main__": test_filter_ava3() -- cgit v1.2.1