def authn_context_decl_from_extension_elements(extelems): res = extension_elements_to_elements( extelems, [ippword, mobiletwofactor, ppt, pword, sslcert]) try: return res[0] except IndexError: return None
def decrypt_assertions(self, encrypted_assertions, decr_txt, issuer=None, verified=False): """ Moves the decrypted assertion from the encrypted assertion to a list. :param encrypted_assertions: A list of encrypted assertions. :param decr_txt: The string representation containing the decrypted data. Used when verifying signatures. :param issuer: The issuer of the response. :param verified: If True do not verify signatures, otherwise verify the signature if it exists. :return: A list of decrypted assertions. """ res = [] for encrypted_assertion in encrypted_assertions: if encrypted_assertion.extension_elements: assertions = extension_elements_to_elements( encrypted_assertion.extension_elements, [saml, samlp]) for assertion in assertions: if assertion.signature and not verified: if not self.sec.check_signature( assertion, origdoc=decr_txt, node_name=class_name(assertion), issuer=issuer): logger.error("Failed to verify signature on '%s'", assertion) raise SignatureError() res.append(assertion) return res
def authn_context_decl_from_extension_elements(extelems): res = extension_elements_to_elements(extelems, [ippword, mobiletwofactor, ppt, pword, sslcert]) try: return res[0] except IndexError: return None
def _holder_of_key_confirmed(self, data): if not data: return False has_keyinfo = False for element in extension_elements_to_elements(data, [samlp, saml, xenc, ds]): if isinstance(element, ds.KeyInfo): has_keyinfo = True return has_keyinfo
def test_xbox_non_ascii_ava(): conf = config.SPConfig() conf.load_file("server_conf") md = MetadataStore([saml, samlp], None, conf) md.load("local", full_path("idp_example.xml")) conf.metadata = md conf.only_use_keys_in_metadata = False sec = sigver.security_context(conf) assertion = factory( saml.Assertion, version="2.0", id="11111", issue_instant="2009-10-30T13:20:28Z", signature=sigver.pre_signature_part("11111", sec.my_cert, 1), attribute_statement=do_attribute_statement( {("", "", "surName"): ("Föö", ""), ("", "", "givenName"): ("Bär", ""), }) ) sigass = sec.sign_statement(assertion, class_name(assertion), key_file=full_path("test.key"), node_id=assertion.id) _ass0 = saml.assertion_from_string(sigass) encrypted_assertion = EncryptedAssertion() encrypted_assertion.add_extension_element(_ass0) _, pre = make_temp(str(pre_encryption_part()).encode('utf-8'), decode=False) enctext = sec.crypto.encrypt( str(encrypted_assertion), conf.cert_file, pre, "des-192", '/*[local-name()="EncryptedAssertion"]/*[local-name()="Assertion"]') decr_text = sec.decrypt(enctext) _seass = saml.encrypted_assertion_from_string(decr_text) assertions = [] assers = extension_elements_to_elements(_seass.extension_elements, [saml, samlp]) sign_cert_file = full_path("test.pem") for ass in assers: _ass = "%s" % ass #_ass = _ass.replace('xsi:nil="true" ', '') #assert sigass == _ass _txt = sec.verify_signature(_ass, sign_cert_file, node_name=class_name(assertion)) if _txt: assertions.append(ass) print(assertions)
def test_do_idp_sso_descriptor(): conf = IdPConfig().load(IDP, metadata_construction=True) idpsso = metadata.do_idpsso_descriptor(conf) assert isinstance(idpsso, md.IDPSSODescriptor) assert _eq(idpsso.keyswv(), [ 'protocol_support_enumeration', 'single_sign_on_service', 'want_authn_requests_signed', "extensions" ]) exts = idpsso.extensions.extension_elements assert len(exts) == 2 print(exts) inst = saml2_tophat.extension_element_to_element( exts[0], shibmd.ELEMENT_FROM_STRING, namespace=shibmd.NAMESPACE) assert isinstance(inst, shibmd.Scope) assert inst.text == "example.org" assert inst.regexp == "false" uiinfo = saml2_tophat.extension_element_to_element( exts[1], mdui.ELEMENT_FROM_STRING, namespace=mdui.NAMESPACE) assert uiinfo assert _eq(uiinfo.keyswv(), [ 'display_name', 'description', 'information_url', 'privacy_statement_url', 'keywords', 'logo' ]) assert len(uiinfo.privacy_statement_url) == 1 assert uiinfo.privacy_statement_url[ 0].text == "http://example.com/saml2_tophat/privacyStatement.html" assert len(uiinfo.description) == 1 assert uiinfo.description[0].text == "Exempel bolag" assert uiinfo.description[0].lang == "se" res = extension_elements_to_elements(exts, [shibmd, mdui]) assert len(res) == 2 # one is a shibmd.Scope instance and the other a mdui.UIInfo instance if isinstance(res[0], shibmd.Scope): assert isinstance(res[1], mdui.UIInfo) elif isinstance(res[1], shibmd.Scope): assert isinstance(res[0], mdui.UIInfo) found = idpsso.extensions.find_extensions(mdui.UIInfo.c_tag, mdui.NAMESPACE) assert len(found) == 1 elem = idpsso.extensions.extensions_as_elements(mdui.UIInfo.c_tag, mdui) assert len(elem) == 1 assert isinstance(elem[0], mdui.UIInfo)
def test_do_idp_sso_descriptor(): conf = IdPConfig().load(IDP, metadata_construction=True) idpsso = metadata.do_idpsso_descriptor(conf) assert isinstance(idpsso, md.IDPSSODescriptor) assert _eq(idpsso.keyswv(), ['protocol_support_enumeration', 'single_sign_on_service', 'want_authn_requests_signed', "extensions"]) exts = idpsso.extensions.extension_elements assert len(exts) == 2 print(exts) inst = saml2_tophat.extension_element_to_element(exts[0], shibmd.ELEMENT_FROM_STRING, namespace=shibmd.NAMESPACE) assert isinstance(inst, shibmd.Scope) assert inst.text == "example.org" assert inst.regexp == "false" uiinfo = saml2_tophat.extension_element_to_element(exts[1], mdui.ELEMENT_FROM_STRING, namespace=mdui.NAMESPACE) assert uiinfo assert _eq(uiinfo.keyswv(), ['display_name', 'description', 'information_url', 'privacy_statement_url', 'keywords', 'logo']) assert len(uiinfo.privacy_statement_url) == 1 assert uiinfo.privacy_statement_url[0].text == "http://example.com/saml2_tophat/privacyStatement.html" assert len(uiinfo.description) == 1 assert uiinfo.description[0].text == "Exempel bolag" assert uiinfo.description[0].lang == "se" res = extension_elements_to_elements(exts,[shibmd, mdui]) assert len(res) == 2 # one is a shibmd.Scope instance and the other a mdui.UIInfo instance if isinstance(res[0], shibmd.Scope): assert isinstance(res[1], mdui.UIInfo) elif isinstance(res[1], shibmd.Scope): assert isinstance(res[0], mdui.UIInfo) found = idpsso.extensions.find_extensions(mdui.UIInfo.c_tag, mdui.NAMESPACE) assert len(found) == 1 elem = idpsso.extensions.extensions_as_elements(mdui.UIInfo.c_tag, mdui) assert len(elem) == 1 assert isinstance(elem[0], mdui.UIInfo)
def to_dict(_dict, onts, mdb_safe=False): """ Convert a pysaml2 SAML2 message class instance into a basic dictionary format. The export interface. :param _dict: The pysaml2 metadata instance :param onts: List of schemas to use for the conversion :return: The converted information """ res = {} if isinstance(_dict, SamlBase): res["__class__"] = "%s&%s" % (_dict.c_namespace, _dict.c_tag) for key in _dict.keyswv(): if key in IMP_SKIP: continue val = getattr(_dict, key) if key == "extension_elements": _eel = extension_elements_to_elements(val, onts) _val = [_eval(_v, onts, mdb_safe) for _v in _eel] elif key == "extension_attributes": if mdb_safe: _val = dict([(k.replace(".", "__"), v) for k, v in val.items()]) #_val = {k.replace(".", "__"): v for k, v in val.items()} else: _val = val else: _val = _eval(val, onts, mdb_safe) if _val: if mdb_safe: key = key.replace(".", "__") res[key] = _val else: for key, val in _dict.items(): _val = _eval(val, onts, mdb_safe) if _val: if mdb_safe and "." in key: key = key.replace(".", "__") res[key] = _val return res
def to_dict(_dict, onts, mdb_safe=False): """ Convert a pysaml2 SAML2 message class instance into a basic dictionary format. The export interface. :param _dict: The pysaml2 metadata instance :param onts: List of schemas to use for the conversion :return: The converted information """ res = {} if isinstance(_dict, SamlBase): res["__class__"] = "%s&%s" % (_dict.c_namespace, _dict.c_tag) for key in _dict.keyswv(): if key in IMP_SKIP: continue val = getattr(_dict, key) if key == "extension_elements": _eel = extension_elements_to_elements(val, onts) _val = [_eval(_v, onts, mdb_safe) for _v in _eel] elif key == "extension_attributes": if mdb_safe: _val = dict([(k.replace(".", "__"), v) for k, v in val.items()]) #_val = {k.replace(".", "__"): v for k, v in val.items()} else: _val = val else: _val = _eval(val, onts, mdb_safe) if _val: if mdb_safe: key = key.replace(".", "__") res[key] = _val else: for key, val in _dict.items(): _val = _eval(val, onts, mdb_safe) if _val: if mdb_safe and "." in key: key = key.replace(".", "__") res[key] = _val return res
def test_okta(): conf = config.Config() conf.load_file("server_conf") conf.id_attr_name = 'Id' md = MetadataStore([saml, samlp], None, conf) md.load("local", full_path("idp_example.xml")) conf.metadata = md conf.only_use_keys_in_metadata = False sec = sigver.security_context(conf) with open(OKTA_RESPONSE) as f: enctext = f.read() decr_text = sec.decrypt(enctext) _seass = saml.encrypted_assertion_from_string(decr_text) assers = extension_elements_to_elements(_seass.extension_elements, [saml, samlp]) with open(OKTA_ASSERTION) as f: okta_assertion = f.read() expected_assert = assertion_from_string(okta_assertion) assert len(assers) == 1 assert assers[0] == expected_assert
def ava_from(self, attribute, allow_unknown=False): try: attr = self._fro[attribute.name.strip().lower()] except AttributeError: attr = attribute.friendly_name.strip().lower() except KeyError: if allow_unknown: try: attr = attribute.name.strip().lower() except AttributeError: attr = attribute.friendly_name.strip().lower() else: raise val = [] for value in attribute.attribute_value: if value.extension_elements: ext = extension_elements_to_elements(value.extension_elements, [saml]) for ex in ext: if attr == "eduPersonTargetedID" and ex.text: val.append(ex.text.strip()) else: cval = {} for key, (name, typ, mul) in ex.c_attributes.items(): exv = getattr(ex, name) if exv: cval[name] = exv if ex.text: cval["value"] = ex.text.strip() val.append({ex.c_tag: cval}) elif not value.text: val.append('') else: val.append(value.text.strip()) return attr, val
def ava_from(self, attribute, allow_unknown=False): try: attr = self._fro[attribute.name.strip().lower()] except AttributeError: attr = attribute.friendly_name.strip().lower() except KeyError: if allow_unknown: try: attr = attribute.name.strip().lower() except AttributeError: attr = attribute.friendly_name.strip().lower() else: raise val = [] for value in attribute.attribute_value: if value.extension_elements: ext = extension_elements_to_elements(value.extension_elements, [saml]) for ex in ext: if attr == "eduPersonTargetedID" and ex.text: val.append(ex.text.strip()) else: cval = {} for key, (name, typ, mul) in ex.c_attributes.items(): exv = getattr(ex, name) if exv: cval[name] = exv if ex.text: cval["value"] = ex.text.strip() val.append({ex.c_tag: cval}) elif not value.text: val.append('') else: val.append(value.text.strip()) return attr, val
cert = read_cert_from_file(full_path("test.pem"), "pem") spcertenc = SPCertEnc(x509_data=ds.X509Data( x509_certificate=ds.X509Certificate(text=cert))) extensions = Extensions( extension_elements=[element_to_extension_element(spcertenc)]) req_id, req = client.create_authn_request( "http://www.example.com/sso", "urn:mace:example.com:it:tek", nameid_format=saml.NAMEID_FORMAT_PERSISTENT, message_id="666", extensions=extensions) print(req) # Get a certificate from an authn request xml = "%s" % req parsed = authn_request_from_string(xml) _elem = extension_elements_to_elements(parsed.extensions.extension_elements, [pefim, ds]) assert len(_elem) == 1 _spcertenc = _elem[0] _cert = _spcertenc.key_info[0].x509_data[0].x509_certificate.text assert cert == _cert
spcertenc = SPCertEnc( x509_data=ds.X509Data( x509_certificate=ds.X509Certificate(text=cert))) extensions = Extensions( extension_elements=[element_to_extension_element(spcertenc)]) req_id, req = client.create_authn_request( "http://www.example.com/sso", "urn:mace:example.com:it:tek", nameid_format=saml.NAMEID_FORMAT_PERSISTENT, message_id="666", extensions=extensions) print(req) # Get a certificate from an authn request xml = "%s" % req parsed = authn_request_from_string(xml) _elem = extension_elements_to_elements(parsed.extensions.extension_elements, [pefim, ds]) assert len(_elem) == 1 _spcertenc = _elem[0] _cert = _spcertenc.key_info[0].x509_data[0].x509_certificate.text assert cert == _cert