def test_signature_mismatch(self): saml_request = self.saml_request.format( break_digest='', signature_value=self.signature_value, signed_info=self.signed_info.format(sig_alg=self.sig_alg, break_signature='broken'), certificate=self.cert, ) relay_state = 'relay_state' request = HTTPPostRequest(saml_request=saml_request, relay_state=relay_state) verifier = HTTPPostSignatureVerifier(self.cert, request) with pytest.raises(SignatureVerificationError) as excinfo: verifier.verify() exc = excinfo.value self.assertEqual('Verifica della firma fallita.', exc.args[0])
def test_certificate_mismatch(self): saml_request = self.saml_request.format( break_digest='', signature_value=self.signature_value, signed_info=self.signed_info.format(sig_alg=self.sig_alg, break_signature=''), certificate='fake cert', ) relay_state = 'relay_state' request = HTTPPostRequest(saml_request=saml_request, relay_state=relay_state) verifier = HTTPPostSignatureVerifier(self.cert, request) with pytest.raises(SignatureVerificationError) as excinfo: verifier.verify() exc = excinfo.value self.assertEqual( 'Il certificato X509 contenuto nella request è differente ' 'rispetto a quello contenuto nei metadata del Service Provider.', exc.args[0])
def test_deprecated_algorithm(self): sig_alg = 'http://www.w3.org/2000/09/xmldsig#rsa-sha1' saml_request = self.saml_request.format( break_digest='', signature_value=self.signature_value, signed_info=self.signed_info.format(sig_alg=sig_alg, break_signature=''), certificate=self.cert, ) relay_state = 'relay_state' request = HTTPPostRequest(saml_request=saml_request, relay_state=relay_state) verifier = HTTPPostSignatureVerifier(self.cert, request) with pytest.raises(SignatureVerificationError) as excinfo: verifier.verify() exc = excinfo.value self.assertEqual( "L'algoritmo 'http://www.w3.org/2000/09/xmldsig#rsa-sha1' è considerato deprecato. " "Si prega di utilizzare uno dei seguenti: {}".format( self.supported_sig_alg), exc.args[0])
def test_unknown_algorithm(self): sig_alg = 'unknown_sig_alg' saml_request = self.saml_request.format( break_digest='', signature_value=self.signature_value, signed_info=self.signed_info.format(sig_alg=sig_alg, break_signature=''), certificate=self.cert, ) relay_state = 'relay_state' request = HTTPPostRequest(saml_request=saml_request, relay_state=relay_state) verifier = HTTPPostSignatureVerifier(self.cert, request) with pytest.raises(SignatureVerificationError) as excinfo: verifier.verify() exc = excinfo.value self.assertEqual( "L'algoritmo 'unknown_sig_alg' è sconosciuto o non supportato. Si prega di " "utilizzare uno dei seguenti: {}".format(self.supported_sig_alg), exc.args[0])
def test_valid_signature(self): saml_request = self.saml_request.format( break_digest='', signature_value=self.signature_value, signed_info=self.signed_info.format(sig_alg=self.sig_alg, break_signature=''), certificate=self.cert, ) relay_state = 'relay_state' request = HTTPPostRequest(saml_request=saml_request, relay_state=relay_state) verifier = HTTPPostSignatureVerifier(self.cert, request) self.assertIsNone(verifier.verify())