def redirect_to_auth(self, _cli, entity_id, came_from, sigalg=""):
try:
# Picks a binding to use for sending the Request to the IDP
_binding, destination = _cli.pick_binding("single_sign_on_service",
self.bindings,
"idpsso",
entity_id=entity_id)
logger.debug("binding: %s, destination: %s", _binding, destination)
# Binding here is the response binding that is which binding the
# IDP should use to return the response.
acs = _cli.config.getattr("endpoints",
"sp")["assertion_consumer_service"]
# just pick one
endp, return_binding = acs[0]
extensions = None
cert = None
if _cli.config.generate_cert_func is not None:
cert_str, req_key_str = _cli.config.generate_cert_func()
cert = {"cert": cert_str, "key": req_key_str}
spcertenc = SPCertEnc(x509_data=ds.X509Data(
x509_certificate=ds.X509Certificate(text=cert_str)))
extensions = Extensions(extension_elements=[
element_to_extension_element(spcertenc)
])
req_id, req = _cli.create_authn_request(
destination,
binding=return_binding,
extensions=extensions,
nameid_format=NAMEID_FORMAT_PERSISTENT,
)
_rstate = rndstr()
self.cache.relay_state[_rstate] = came_from
ht_args = _cli.apply_binding(_binding,
"%s" % req,
destination,
relay_state=_rstate,
sigalg=sigalg)
_sid = req_id
if cert is not None:
self.cache.outstanding_certs[_sid] = cert
except Exception as exc:
logger.exception(exc)
resp = ServiceError("Failed to construct the AuthnRequest: %s" %
exc)
return resp
# remember the request
self.cache.outstanding_queries[_sid] = came_from
return self.response(_binding, ht_args, do_not_start_response=True)
def do_key_descriptor(cert=None, enc_cert=None, use="both"):
kd_list = []
if use in ["signing", "both"] and cert is not None:
if not isinstance(cert, list):
cert = [cert]
for _cert in cert:
kd_list.append(
md.KeyDescriptor(key_info=ds.KeyInfo(x509_data=ds.X509Data(
x509_certificate=ds.X509Certificate(text=_cert))),
use="signing"))
if use in ["both", "encryption"] and enc_cert is not None:
if not isinstance(enc_cert, list):
enc_cert = [enc_cert]
for _enc_cert in enc_cert:
kd_list.append(
md.KeyDescriptor(key_info=ds.KeyInfo(x509_data=ds.X509Data(
x509_certificate=ds.X509Certificate(text=_enc_cert))),
use="encryption"))
if len(kd_list) == 0 and cert is not None:
return md.KeyDescriptor(key_info=ds.KeyInfo(x509_data=ds.X509Data(
x509_certificate=ds.X509Certificate(text=cert))))
return kd_list
from saml2_tophat.extension.pefim import SPCertEnc
from saml2_tophat.samlp import Extensions
from saml2_tophat.samlp import authn_request_from_string
from saml2_tophat.sigver import read_cert_from_file
from pathutils import full_path
__author__ = 'roland'
conf = config.SPConfig()
conf.load_file("server_conf")
client = Saml2Client(conf)
# place a certificate in an authn request
cert = read_cert_from_file(full_path("test.pem"), "pem")
spcertenc = SPCertEnc(x509_data=ds.X509Data(
x509_certificate=ds.X509Certificate(text=cert)))
extensions = Extensions(
extension_elements=[element_to_extension_element(spcertenc)])
req_id, req = client.create_authn_request(
"http://www.example.com/sso",
"urn:mace:example.com:it:tek",
nameid_format=saml.NAMEID_FORMAT_PERSISTENT,
message_id="666",
extensions=extensions)
print(req)
# Get a certificate from an authn request
def challenge(self, environ, _status, _app_headers, _forget_headers):
_cli = self.saml_client
if "REMOTE_USER" in environ:
name_id = decode(environ["REMOTE_USER"])
_cli = self.saml_client
path_info = environ["PATH_INFO"]
if "samlsp.logout" in environ:
responses = _cli.global_logout(name_id)
return self._handle_logout(responses)
if "samlsp.pending" in environ:
response = environ["samlsp.pending"]
if isinstance(response, HTTPRedirection):
response.headers += _forget_headers
return response
# logger = environ.get('repoze.who.logger','')
# Which page was accessed to get here
came_from = construct_came_from(environ)
environ["myapp.came_from"] = came_from
logger.debug("[sp.challenge] RelayState >> '%s'", came_from)
# Am I part of a virtual organization or more than one ?
try:
vorg_name = environ["myapp.vo"]
except KeyError:
try:
vorg_name = _cli.vorg._name
except AttributeError:
vorg_name = ""
logger.info("[sp.challenge] VO: %s", vorg_name)
# If more than one idp and if none is selected, I have to do wayf
(done, response) = self._pick_idp(environ, came_from)
# Three cases: -1 something went wrong or Discovery service used
# 0 I've got an IdP to send a request to
# >0 ECP in progress
logger.debug("_idp_pick returned: %s", done)
if done == -1:
return response
elif done > 0:
self.outstanding_queries[done] = came_from
return ECP_response(response)
else:
entity_id = response
logger.info("[sp.challenge] entity_id: %s", entity_id)
# Do the AuthnRequest
_binding = BINDING_HTTP_REDIRECT
try:
srvs = _cli.metadata.single_sign_on_service(
entity_id, _binding)
logger.debug("srvs: %s", srvs)
dest = srvs[0]["location"]
logger.debug("destination: %s", dest)
extensions = None
cert = None
if _cli.config.generate_cert_func is not None:
cert_str, req_key_str = _cli.config.generate_cert_func()
cert = {"cert": cert_str, "key": req_key_str}
spcertenc = SPCertEnc(x509_data=ds.X509Data(
x509_certificate=ds.X509Certificate(text=cert_str)))
extensions = Extensions(extension_elements=[
element_to_extension_element(spcertenc)
])
if _cli.authn_requests_signed:
_sid = saml2_tophat.s_utils.sid()
req_id, msg_str = _cli.create_authn_request(
dest,
vorg=vorg_name,
sign=_cli.authn_requests_signed,
message_id=_sid,
extensions=extensions,
)
_sid = req_id
else:
req_id, req = _cli.create_authn_request(
dest,
vorg=vorg_name,
sign=False,
extensions=extensions)
msg_str = "%s" % req
_sid = req_id
if cert is not None:
self.outstanding_certs[_sid] = cert
ht_args = _cli.apply_binding(
_binding,
msg_str,
destination=dest,
relay_state=came_from,
sign=_cli.authn_requests_signed,
)
logger.debug("ht_args: %s", ht_args)
except Exception as exc:
logger.exception(exc)
raise Exception("Failed to construct the AuthnRequest: %s" %
exc)
try:
ret = _cli.config.getattr("endpoints",
"sp")["discovery_response"][0][0]
if (environ["PATH_INFO"]) in ret and ret.split(
environ["PATH_INFO"])[1] == "":
query = parse_qs(environ["QUERY_STRING"])
sid = query["sid"][0]
came_from = self.outstanding_queries[sid]
except:
pass
# remember the request
self.outstanding_queries[_sid] = came_from
if not ht_args["data"] and ht_args["headers"][0][0] == "Location":
logger.debug("redirect to: %s", ht_args["headers"][0][1])
return HTTPSeeOther(headers=ht_args["headers"])
else:
return ht_args["data"]
def setup_class(self):
self.x509_data = ds.X509Data()