diff --git a/catalog-info.yaml b/catalog-info.yaml new file mode 100644 index 00000000..6cf1f2c9 --- /dev/null +++ b/catalog-info.yaml @@ -0,0 +1,17 @@ +apiVersion: backstage.io/v1alpha1 +kind: Component +metadata: + name: python-saml + description: Python SAML Toolkit + annotations: + business-unit: EverHealth + github.com/project-slug: drchrono/python-saml + product: DRC +spec: + type: service + lifecycle: production + owner: EverHealth + implementation: + languages: + - Python + - HTML diff --git a/src/onelogin/saml2/response.py b/src/onelogin/saml2/response.py index 5d73ff99..0325ea98 100644 --- a/src/onelogin/saml2/response.py +++ b/src/onelogin/saml2/response.py @@ -193,26 +193,26 @@ def is_valid(self, request_data, request_id=None): if security.get('wantMessagesSigned', False) and ('{%s}Response' % OneLogin_Saml2_Constants.NS_SAMLP) not in signed_elements: raise Exception('The Message of the Response is not signed and the SP require it') - if len(signed_elements) > 0: - if len(signed_elements) > 2: - raise Exception('Too many Signatures found. SAML Response rejected') - cert = idp_data.get('x509cert', None) - fingerprint = idp_data.get('certFingerprint', None) - fingerprintalg = idp_data.get('certFingerprintAlgorithm', None) - - # If find a Signature on the Response, validates it checking the original response - if '{%s}Response' % OneLogin_Saml2_Constants.NS_SAMLP in signed_elements: - document_to_validate = self.document - # Otherwise validates the assertion (decrypted assertion if was encrypted) - else: - if self.encrypted: - document_to_validate = self.decrypted_document - else: + if len(signed_elements) > 0: + if len(signed_elements) > 2: + raise Exception('Too many Signatures found. SAML Response rejected') + cert = idp_data.get('x509cert', None) + fingerprint = idp_data.get('certFingerprint', None) + fingerprintalg = idp_data.get('certFingerprintAlgorithm', None) + + # If find a Signature on the Response, validates it checking the original response + if '{%s}Response' % OneLogin_Saml2_Constants.NS_SAMLP in signed_elements: document_to_validate = self.document - if not OneLogin_Saml2_Utils.validate_sign(document_to_validate, cert, fingerprint, fingerprintalg): - raise Exception('Signature validation failed. SAML Response rejected') - else: - raise Exception('No Signature found. SAML Response rejected') + # Otherwise validates the assertion (decrypted assertion if was encrypted) + else: + if self.encrypted: + document_to_validate = self.decrypted_document + else: + document_to_validate = self.document + if not OneLogin_Saml2_Utils.validate_sign(document_to_validate, cert, fingerprint, fingerprintalg): + raise Exception('Signature validation failed. SAML Response rejected') + else: + raise Exception('No Signature found. SAML Response rejected') return True except Exception as err: