openstack/deb-python-pysaml2
Code Issues Proposed changes

Merge branch 'master' of github.com:rohe/pysaml2

Browse Source
This commit is contained in:
Roland Hedberg
2014-10-19 16:21:07 +02:00
parent 6d71aa8bc1 d14411a2e2
commit 9af755597d
5 changed files with 33 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
doc/howto/config.rst
View File

@@ -230,8 +230,8 @@ There are two options common to all services: 'name' and 'endpoints'.
The remaining options are specific to one or the other of the service types.
Which one is specified along side the name of the option.
timeslack
^^^^^^^^^
accepted_time_diff
^^^^^^^^^^^^^^^^^^
If your computer and another computer that you are communicating with are not
in synch regarding the computer clock, then here you can state how big a

4
doc/install.rst
View File

@@ -62,14 +62,14 @@ Hints
RHEL/CentOS installation issues
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
A number of packages may not install from pypi. Instead, you may wand to use packages supplies with the OS:
A number of packages may not install from pypi. Instead, you may want to use packages supplied with the OS:
yum -y install swig openssl-devel m2crypto xmlsec1 pyOpenSSL libffi-devel
OS X installation issues
^^^^^^^^^^^^^^^^^^^^^^^^
A number of packages may not install from pypi. Instead, you may wand to use macports:
A number of packages may not install from pypi. Instead, you may want to use macports:
sudo port install swig xmlsec py27-m2crypto py27-crypto db53

9
src/saml2/entity.py
View File

@@ -588,10 +588,10 @@ class Entity(HTTPBase):
else:
return typ
def _parse_request(self, xmlstr, request_cls, service, binding):
def _parse_request(self, enc_request, request_cls, service, binding):
"""Parse a Request
:param xmlstr: The request in its transport format
:param enc_request: The request in its transport format
:param request_cls: The type of requests I expect
:param service:
:param binding: Which binding that was used to transport the message
@@ -625,8 +625,7 @@ class Entity(HTTPBase):
self.config.attribute_converters,
timeslack=timeslack)
origdoc = xmlstr
xmlstr = self.unravel(xmlstr, binding, request_cls.msgtype)
xmlstr = self.unravel(enc_request, binding, request_cls.msgtype)
must = self.config.getattr("want_authn_requests_signed", "idp")
only_valid_cert = self.config.getattr(
"want_authn_requests_only_with_valid_cert", "idp")
@@ -634,7 +633,7 @@ class Entity(HTTPBase):
only_valid_cert = False
if only_valid_cert:
must = True
_request = _request.loads(xmlstr, binding, origdoc=origdoc, must=must,
_request = _request.loads(xmlstr, binding, origdoc=enc_request, must=must,
only_valid_cert=only_valid_cert)
_log_debug("Loaded request")

2
src/saml2/saml.py
View File

@@ -1040,7 +1040,7 @@ class AttributeType_(SamlBase):
def __init__(self,
attribute_value=None,
name=None,
name_format=None,
name_format=NAME_FORMAT_URI,
friendly_name=None,
text=None,
extension_elements=None,

34
src/saml2/sigver.py
View File

@@ -721,7 +721,7 @@ ASSERT_XPATH = ''.join(["/*[local-name()=\"%s\"]" % v for v in [
class CryptoBackendXmlSec1(CryptoBackend):
"""
CryptoBackend implementation using external binary xmlsec1 to sign
CryptoBackend implementation using external binary 1 to sign
and verify XML documents.
"""
@@ -731,6 +731,10 @@ class CryptoBackendXmlSec1(CryptoBackend):
CryptoBackend.__init__(self, **kwargs)
assert (isinstance(xmlsec_binary, basestring))
self.xmlsec = xmlsec_binary
if os.environ.get('PYSAML2_KEEP_XMLSEC_TMP', None):
self._xmlsec_delete_tmpfiles = False
else:
self._xmlsec_delete_tmpfiles = True
def version(self):
com_list = [self.xmlsec, "--version"]
@@ -832,7 +836,8 @@ class CryptoBackendXmlSec1(CryptoBackend):
:return: The signed statement
"""
_, fil = make_temp("%s" % statement, decode=False)
_, fil = make_temp("%s" % statement, suffix=".xml", decode=False,
delete=self._xmlsec_delete_tmpfiles)
com_list = [self.xmlsec, "--sign",
"--privkey-pem", key_file,
@@ -867,7 +872,8 @@ class CryptoBackendXmlSec1(CryptoBackend):
:param id_attr: Should normally be one of "id", "Id" or "ID"
:return: Boolean True if the signature was correct otherwise False.
"""
_, fil = make_temp(signedtext, decode=False)
_, fil = make_temp(signedtext, suffix=".xml",
decode=False, delete=self._xmlsec_delete_tmpfiles)
com_list = [self.xmlsec, "--verify",
"--pubkey-cert-%s" % cert_type, cert_file,
@@ -906,7 +912,7 @@ class CryptoBackendXmlSec1(CryptoBackend):
:param exception: The exception class to raise on errors
:result: Whatever xmlsec wrote to an --output temporary file
"""
ntf = NamedTemporaryFile()
ntf = NamedTemporaryFile(suffix=".xml", delete=self._xmlsec_delete_tmpfiles)
com_list.extend(["--output", ntf.name])
com_list += extra_args
@@ -1243,6 +1249,11 @@ class SecurityContext(object):
self.template = template
self.encrypt_key_type = encrypt_key_type
# keep certificate files to debug xmlsec invocations
if os.environ.get('PYSAML2_KEEP_XMLSEC_TMP', None):
self._xmlsec_delete_tmpfiles = False
else:
self._xmlsec_delete_tmpfiles = True
def correctly_signed(self, xml, must=False):
logger.debug("verify correct signature")
@@ -1334,7 +1345,9 @@ class SecurityContext(object):
certs = []
for cert in _certs:
if isinstance(cert, basestring):
certs.append(make_temp(pem_format(cert), ".pem", False))
certs.append(make_temp(pem_format(cert), suffix=".pem",
decode=False,
delete=self._xmlsec_delete_tmpfiles))
else:
certs.append(cert)
else:
@@ -1342,8 +1355,9 @@ class SecurityContext(object):
if not certs and not self.only_use_keys_in_metadata:
logger.debug("==== Certs from instance ====")
certs = [make_temp(pem_format(cert), ".pem",
False) for cert in cert_from_instance(item)]
certs = [make_temp(pem_format(cert), suffix=".pem",
decode=False, delete=self._xmlsec_delete_tmpfiles)
for cert in cert_from_instance(item)]
else:
logger.debug("==== Certs from metadata ==== %s: %s ====" % (issuer,
certs))
@@ -1417,8 +1431,8 @@ class SecurityContext(object):
the entity that sent the info use that, if not use the key that are in
the message if any.
:param decoded_xml: The SAML message as a XML string
:param msgtype:
:param decoded_xml: The SAML message as an XML infoset (a string)
:param msgtype: SAML protocol message type
:param must: Whether there must be a signature
:param origdoc:
:return:
@@ -1435,7 +1449,7 @@ class SecurityContext(object):
if not msg.signature:
if must:
raise SignatureError("Missing must signature")
raise SignatureError("Required signature missing on %s" % msgtype)
else:
return msg