Skip to content

Commit c9907f7

Browse files
author
Roland Hedberg
committed
Merge pull request #140 from rhoerbe/upstream-merge-20140922
moved new class HttpParameters from samlp to httputil
2 parents 33db77a + 816dcc7 commit c9907f7

File tree

5 files changed

+93
-19
lines changed

5 files changed

+93
-19
lines changed

‎src/saml2/attributemaps/saml_uri.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
EDUCOURSE_OID = 'urn:oid:1.3.6.1.4.1.5923.1.6.1.'
22
EDUPERSON_OID = 'urn:oid:1.3.6.1.4.1.5923.1.1.1.'
3-
LDAPGVAT_OID = 'urn:oid:1.2.40.0.10.2.1.1.' # ldap.gv.at definitions as specified in http://www.ref.gv.at/AG-IZ-PVP2-Version-2-1-0-2.2754.0.html
3+
LDAPGVAT_OID = 'urn:oid:1.2.40.0.10.2.1.1.' # ldap.gv.at definitions as specified in http://www.ref.gv.at/AG-IZ-PVP2-Version-2-1-0-2.2754.0.html
44
UCL_DIR_PILOT = 'urn:oid:0.9.2342.19200300.100.1.'
55
X500ATTR_OID = 'urn:oid:2.5.4.'
66
LDAPGVAT_UCL_DIR_PILOT = UCL_DIR_PILOT

‎src/saml2/httputil.py

+14
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,20 @@ class BadGateway(Response):
142142
_status = "502 Bad Gateway"
143143

144144

145+
class HttpParameters():
146+
"""GET or POST signature parameters for Redirect or POST-SimpleSign bindings
147+
because they are not contained in XML unlike the POST binding
148+
"""
149+
signature = None
150+
sigalg = None
151+
# Relaystate and SAML message are stored elsewhere
152+
def __init__(self, dict):
153+
try:
154+
self.signature = dict["Signature"][0]
155+
self.sigalg = dict["SigAlg"][0]
156+
except KeyError:
157+
pass
158+
145159
def extract(environ, empty=False, err=False):
146160
"""Extracts strings in form data and returns a dict.
147161

‎src/saml2/saml.py

+13-2
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,14 @@
3636
"urn:oasis:names:tc:SAML:2.0:nameid-format:transient")
3737
NAMEID_FORMAT_ENTITY = (
3838
"urn:oasis:names:tc:SAML:2.0:nameid-format:entity")
39-
39+
NAMEID_FORMATS_SAML2 = (
40+
('NAMEID_FORMAT_EMAILADDRESS', NAMEID_FORMAT_EMAILADDRESS),
41+
('NAMEID_FORMAT_ENCRYPTED', NAMEID_FORMAT_ENCRYPTED),
42+
('NAMEID_FORMAT_ENTITY', NAMEID_FORMAT_ENTITY),
43+
('NAMEID_FORMAT_PERSISTENT', NAMEID_FORMAT_PERSISTENT),
44+
('NAMEID_FORMAT_TRANSIENT', NAMEID_FORMAT_TRANSIENT),
45+
('NAMEID_FORMAT_UNSPECIFIED', NAMEID_FORMAT_UNSPECIFIED),
46+
)
4047
PROFILE_ATTRIBUTE_BASIC = (
4148
"urn:oasis:names:tc:SAML:2.0:profiles:attribute:basic")
4249

@@ -48,7 +55,11 @@
4855
"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified")
4956
NAME_FORMAT_URI = "urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
5057
NAME_FORMAT_BASIC = "urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
51-
58+
NAME_FORMATS_SAML2 = (
59+
('NAME_FORMAT_BASIC', NAME_FORMAT_BASIC),
60+
('NAME_FORMAT_URI', NAME_FORMAT_URI),
61+
('NAME_FORMAT_UNSPECIFIED', NAME_FORMAT_UNSPECIFIED),
62+
)
5263
DECISION_TYPE_PERMIT = "Permit"
5364
DECISION_TYPE_DENY = "Deny"
5465
DECISION_TYPE_INDETERMINATE = "Indeterminate"

‎src/saml2/sigver.py

+24-14
Original file line numberDiff line numberDiff line change
@@ -42,26 +42,30 @@
4242

4343
from tempfile import NamedTemporaryFile
4444
from subprocess import Popen, PIPE
45+
46+
from xmldsig import digest_default
47+
from xmldsig import sig_default
48+
from xmldsig import SIG_RSA_SHA1
49+
from xmldsig import SIG_RSA_SHA224
50+
from xmldsig import SIG_RSA_SHA256
51+
from xmldsig import SIG_RSA_SHA384
52+
from xmldsig import SIG_RSA_SHA512
4553
from xmlenc import EncryptionMethod
4654
from xmlenc import EncryptedKey
4755
from xmlenc import CipherData
4856
from xmlenc import CipherValue
4957
from xmlenc import EncryptedData
5058

59+
from Crypto.Hash import SHA
60+
from Crypto.Hash import SHA224
5161
from Crypto.Hash import SHA256
5262
from Crypto.Hash import SHA384
5363
from Crypto.Hash import SHA512
54-
from Crypto.Hash import SHA
5564

5665
logger = logging.getLogger(__name__)
5766

5867
SIG = "{%s#}%s" % (ds.NAMESPACE, "Signature")
5968

60-
RSA_SHA1 = "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
61-
RSA_SHA256 = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
62-
RSA_SHA384 = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"
63-
RSA_SHA512 = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"
64-
6569
RSA_1_5 = "http://www.w3.org/2001/04/xmlenc#rsa-1_5"
6670
TRIPLE_DES_CBC = "http://www.w3.org/2001/04/xmlenc#tripledes-cbc"
6771
XMLTAG = "<?xml version='1.0'?>"
@@ -595,10 +599,11 @@ def verify(self, msg, sig, key):
595599

596600

597601
SIGNER_ALGS = {
598-
RSA_SHA1: RSASigner(SHA),
599-
RSA_SHA256: RSASigner(SHA256),
600-
RSA_SHA384: RSASigner(SHA384),
601-
RSA_SHA512: RSASigner(SHA512),
602+
SIG_RSA_SHA1: RSASigner(SHA),
603+
SIG_RSA_SHA224: RSASigner(SHA224),
604+
SIG_RSA_SHA256: RSASigner(SHA256),
605+
SIG_RSA_SHA384: RSASigner(SHA384),
606+
SIG_RSA_SHA512: RSASigner(SHA512),
602607
}
603608

604609
REQ_ORDER = ["SAMLRequest", "RelayState", "SigAlg"]
@@ -619,7 +624,7 @@ def verify_redirect_signature(saml_msg, cert):
619624
except KeyError:
620625
raise Unsupported("Signature algorithm: %s" % saml_msg["SigAlg"])
621626
else:
622-
if saml_msg["SigAlg"][0] == RSA_SHA1:
627+
if saml_msg["SigAlg"][0] == SIG_RSA_SHA1:
623628
if "SAMLRequest" in saml_msg:
624629
_order = REQ_ORDER
625630
elif "SAMLResponse" in saml_msg:
@@ -1682,7 +1687,8 @@ def multiple_signatures(self, statement, to_sign, key=None, key_file=None):
16821687
# ===========================================================================
16831688

16841689

1685-
def pre_signature_part(ident, public_key=None, identifier=None):
1690+
def pre_signature_part(ident, public_key=None, identifier=None,
1691+
digest_alg=None, sign_alg=None):
16861692
"""
16871693
If an assertion is to be signed the signature part has to be preset
16881694
with which algorithms to be used, this function returns such a
@@ -1695,13 +1701,17 @@ def pre_signature_part(ident, public_key=None, identifier=None):
16951701
:return: A preset signature part
16961702
"""
16971703

1698-
signature_method = ds.SignatureMethod(algorithm=ds.SIG_RSA_SHA1)
1704+
if not digest_alg:
1705+
digest_alg=ds.digest_default
1706+
if not sign_alg:
1707+
sign_alg=ds.sig_default
1708+
signature_method = ds.SignatureMethod(algorithm=sign_alg)
16991709
canonicalization_method = ds.CanonicalizationMethod(
17001710
algorithm=ds.ALG_EXC_C14N)
17011711
trans0 = ds.Transform(algorithm=ds.TRANSFORM_ENVELOPED)
17021712
trans1 = ds.Transform(algorithm=ds.ALG_EXC_C14N)
17031713
transforms = ds.Transforms(transform=[trans0, trans1])
1704-
digest_method = ds.DigestMethod(algorithm=ds.DIGEST_SHA1)
1714+
digest_method = ds.DigestMethod(algorithm=digest_alg)
17051715

17061716
reference = ds.Reference(uri="#%s" % ident, digest_value=ds.DigestValue(),
17071717
transforms=transforms, digest_method=digest_method)

‎src/xmldsig/__init__.py

+41-2
Original file line numberDiff line numberDiff line change
@@ -10,20 +10,59 @@
1010
NAMESPACE = 'http://www.w3.org/2000/09/xmldsig#'
1111

1212
ENCODING_BASE64 = 'http://www.w3.org/2000/09/xmldsig#base64'
13+
14+
# digest and signature algorithms (not implemented = commented out)
15+
DIGEST_MD5 = 'http://www.w3.org/2001/04/xmldsig-more#md5' # test framework only!
1316
DIGEST_SHA1 = 'http://www.w3.org/2000/09/xmldsig#sha1'
14-
ALG_EXC_C14N = 'http://www.w3.org/2001/10/xml-exc-c14n#'
15-
SIG_DSA_SHA1 = 'http://www.w3.org/2000/09/xmldsig#dsa-sha1'
17+
DIGEST_SHA224 = 'http://www.w3.org/2001/04/xmldsig-more#sha224'
18+
DIGEST_SHA256 = 'http://www.w3.org/2001/04/xmlenc#sha256'
19+
DIGEST_SHA384 = 'http://www.w3.org/2001/04/xmldsig-more#sha384'
20+
DIGEST_SHA512 = 'http://www.w3.org/2001/04/xmlenc#sha512'
21+
DIGEST_RIPEMD160 = 'http://www.w3.org/2001/04/xmlenc#ripemd160'
22+
digest_default = DIGEST_SHA1
23+
DIGEST_ALLOWED_ALG = (('DIGEST_SHA1', DIGEST_SHA1),
24+
('DIGEST_SHA224', DIGEST_SHA224),
25+
('DIGEST_SHA256', DIGEST_SHA256),
26+
('DIGEST_SHA384', DIGEST_SHA384),
27+
('DIGEST_SHA512', DIGEST_SHA512),
28+
('DIGEST_RIPEMD160', DIGEST_RIPEMD160))
29+
DIGEST_AVAIL_ALG = DIGEST_ALLOWED_ALG + (('DIGEST_MD5', DIGEST_MD5), )
30+
31+
#SIG_DSA_SHA1 = 'http,//www.w3.org/2000/09/xmldsig#dsa-sha1'
32+
#SIG_DSA_SHA256 = 'http://www.w3.org/2009/xmldsig11#dsa-sha256'
33+
#SIG_ECDSA_SHA1 = 'http://www.w3.org/2001/04/xmldsig-more#ECDSA_sha1'
34+
#SIG_ECDSA_SHA224 = 'http://www.w3.org/2001/04/xmldsig-more#ECDSA_sha224'
35+
#SIG_ECDSA_SHA256 = 'http://www.w3.org/2001/04/xmldsig-more#ECDSA_sha256'
36+
#SIG_ECDSA_SHA384 = 'http://www.w3.org/2001/04/xmldsig-more#ECDSA_sha384'
37+
#SIG_ECDSA_SHA512 = 'http://www.w3.org/2001/04/xmldsig-more#ECDSA_sha512'
38+
SIG_RSA_MD5 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-md5' # test framework
1639
SIG_RSA_SHA1 = 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'
40+
SIG_RSA_SHA224 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha224'
41+
SIG_RSA_SHA256 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
42+
SIG_RSA_SHA384 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384'
43+
SIG_RSA_SHA512 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'
44+
#SIG_RSA_RIPEMD160 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-ripemd160'
45+
sig_default = SIG_RSA_SHA1
46+
SIG_ALLOWED_ALG = (('SIG_RSA_SHA1', SIG_RSA_SHA1),
47+
('SIG_RSA_SHA224', SIG_RSA_SHA224),
48+
('SIG_RSA_SHA256', SIG_RSA_SHA256),
49+
('SIG_RSA_SHA384', SIG_RSA_SHA384),
50+
('SIG_RSA_SHA512', SIG_RSA_SHA512))
51+
SIG_AVAIL_ALG = SIG_ALLOWED_ALG + (('SIG_RSA_MD5', SIG_RSA_MD5), )
52+
1753
MAC_SHA1 = 'http://www.w3.org/2000/09/xmldsig#hmac-sha1'
1854

1955
C14N = 'http://www.w3.org/TR/2001/REC-xml-c14n-20010315'
2056
C14N_WITH_C = 'http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments'
57+
ALG_EXC_C14N = 'http://www.w3.org/2001/10/xml-exc-c14n#'
2158

2259
TRANSFORM_XSLT = 'http://www.w3.org/TR/1999/REC-xslt-19991116'
2360
TRANSFORM_XPATH = 'http://www.w3.org/TR/1999/REC-xpath-19991116'
2461
TRANSFORM_ENVELOPED = 'http://www.w3.org/2000/09/xmldsig#enveloped-signature'
2562

2663

64+
65+
2766
class CryptoBinary_(SamlBase):
2867
"""The http://www.w3.org/2000/09/xmldsig#:CryptoBinary element """
2968

0 commit comments

Comments
 (0)