From 0dbe951fe21c6c7b705bfc2467b624acb65408fc Mon Sep 17 00:00:00 2001 From: sunmoonone Date: Thu, 31 Mar 2016 17:01:18 +0800 Subject: [PATCH 1/4] private fields using one underscore --- src/onelogin/saml2/auth.py | 140 +++++++++++++------------- src/onelogin/saml2/authn_request.py | 16 +-- src/onelogin/saml2/logout_request.py | 32 +++--- src/onelogin/saml2/logout_response.py | 36 +++---- src/onelogin/saml2/response.py | 64 ++++++------ 5 files changed, 144 insertions(+), 144 deletions(-) diff --git a/src/onelogin/saml2/auth.py b/src/onelogin/saml2/auth.py index 17a19d51..f0f6be73 100644 --- a/src/onelogin/saml2/auth.py +++ b/src/onelogin/saml2/auth.py @@ -49,16 +49,16 @@ def __init__(self, request_data, old_settings=None, custom_base_path=None): :param custom_base_path: Optional. Path where are stored the settings file and the cert folder :type custom_base_path: string """ - self.__request_data = request_data - self.__settings = OneLogin_Saml2_Settings(old_settings, custom_base_path) - self.__attributes = [] - self.__nameid = None - self.__session_index = None - self.__session_expiration = None - self.__authenticated = False - self.__errors = [] - self.__error_reason = None - self.__last_request_id = None + self._request_data = request_data + self._settings = OneLogin_Saml2_Settings(old_settings, custom_base_path) + self._attributes = [] + self._nameid = None + self._session_index = None + self._session_expiration = None + self._authenticated = False + self._errors = [] + self._error_reason = None + self._last_request_id = None def get_settings(self): """ @@ -66,7 +66,7 @@ def get_settings(self): :return: Setting info :rtype: OneLogin_Saml2_Setting object """ - return self.__settings + return self._settings def set_strict(self, value): """ @@ -76,7 +76,7 @@ def set_strict(self, value): :type value: bool """ assert isinstance(value, bool) - self.__settings.set_strict(value) + self._settings.set_strict(value) def process_response(self, request_id=None): """ @@ -87,25 +87,25 @@ def process_response(self, request_id=None): :raises: OneLogin_Saml2_Error.SAML_RESPONSE_NOT_FOUND, when a POST with a SAMLResponse is not found """ - self.__errors = [] + self._errors = [] - if 'post_data' in self.__request_data and 'SAMLResponse' in self.__request_data['post_data']: + if 'post_data' in self._request_data and 'SAMLResponse' in self._request_data['post_data']: # AuthnResponse -- HTTP_POST Binding - response = OneLogin_Saml2_Response(self.__settings, self.__request_data['post_data']['SAMLResponse']) + response = OneLogin_Saml2_Response(self._settings, self._request_data['post_data']['SAMLResponse']) - if response.is_valid(self.__request_data, request_id): - self.__attributes = response.get_attributes() - self.__nameid = response.get_nameid() - self.__session_index = response.get_session_index() - self.__session_expiration = response.get_session_not_on_or_after() - self.__authenticated = True + if response.is_valid(self._request_data, request_id): + self._attributes = response.get_attributes() + self._nameid = response.get_nameid() + self._session_index = response.get_session_index() + self._session_expiration = response.get_session_not_on_or_after() + self._authenticated = True else: - self.__errors.append('invalid_response') - self.__error_reason = response.get_error() + self._errors.append('invalid_response') + self._error_reason = response.get_error() else: - self.__errors.append('invalid_binding') + self._errors.append('invalid_binding') raise OneLogin_Saml2_Error( 'SAML Response not found, Only supported HTTP_POST Binding', OneLogin_Saml2_Error.SAML_RESPONSE_NOT_FOUND @@ -123,46 +123,46 @@ def process_slo(self, keep_local_session=False, request_id=None, delete_session_ :returns: Redirection url """ - self.__errors = [] + self._errors = [] - if 'get_data' in self.__request_data and 'SAMLResponse' in self.__request_data['get_data']: - logout_response = OneLogin_Saml2_Logout_Response(self.__settings, self.__request_data['get_data']['SAMLResponse']) - if not logout_response.is_valid(self.__request_data, request_id): - self.__errors.append('invalid_logout_response') - self.__error_reason = logout_response.get_error() + if 'get_data' in self._request_data and 'SAMLResponse' in self._request_data['get_data']: + logout_response = OneLogin_Saml2_Logout_Response(self._settings, self._request_data['get_data']['SAMLResponse']) + if not logout_response.is_valid(self._request_data, request_id): + self._errors.append('invalid_logout_response') + self._error_reason = logout_response.get_error() elif logout_response.get_status() != OneLogin_Saml2_Constants.STATUS_SUCCESS: - self.__errors.append('logout_not_success') + self._errors.append('logout_not_success') elif not keep_local_session: OneLogin_Saml2_Utils.delete_local_session(delete_session_cb) - elif 'get_data' in self.__request_data and 'SAMLRequest' in self.__request_data['get_data']: - logout_request = OneLogin_Saml2_Logout_Request(self.__settings, self.__request_data['get_data']['SAMLRequest']) - if not logout_request.is_valid(self.__request_data): - self.__errors.append('invalid_logout_request') - self.__error_reason = logout_request.get_error() + elif 'get_data' in self._request_data and 'SAMLRequest' in self._request_data['get_data']: + logout_request = OneLogin_Saml2_Logout_Request(self._settings, self._request_data['get_data']['SAMLRequest']) + if not logout_request.is_valid(self._request_data): + self._errors.append('invalid_logout_request') + self._error_reason = logout_request.get_error() else: if not keep_local_session: OneLogin_Saml2_Utils.delete_local_session(delete_session_cb) in_response_to = logout_request.id - response_builder = OneLogin_Saml2_Logout_Response(self.__settings) + response_builder = OneLogin_Saml2_Logout_Response(self._settings) response_builder.build(in_response_to) logout_response = response_builder.get_response() parameters = {'SAMLResponse': logout_response} - if 'RelayState' in self.__request_data['get_data']: - parameters['RelayState'] = self.__request_data['get_data']['RelayState'] + if 'RelayState' in self._request_data['get_data']: + parameters['RelayState'] = self._request_data['get_data']['RelayState'] else: - parameters['RelayState'] = OneLogin_Saml2_Utils.get_self_url_no_query(self.__request_data) + parameters['RelayState'] = OneLogin_Saml2_Utils.get_self_url_no_query(self._request_data) - security = self.__settings.get_security_data() + security = self._settings.get_security_data() if 'logoutResponseSigned' in security and security['logoutResponseSigned']: parameters['SigAlg'] = security['signatureAlgorithm'] parameters['Signature'] = self.build_response_signature(logout_response, parameters.get('RelayState', None), security['signatureAlgorithm']) return self.redirect_to(self.get_slo_url(), parameters) else: - self.__errors.append('invalid_binding') + self._errors.append('invalid_binding') raise OneLogin_Saml2_Error( 'SAML LogoutRequest/LogoutResponse not found. Only supported HTTP_REDIRECT Binding', OneLogin_Saml2_Error.SAML_LOGOUTMESSAGE_NOT_FOUND @@ -179,9 +179,9 @@ def redirect_to(self, url=None, parameters={}): :returns: Redirection url """ - if url is None and 'RelayState' in self.__request_data['get_data']: - url = self.__request_data['get_data']['RelayState'] - return OneLogin_Saml2_Utils.redirect(url, parameters, request_data=self.__request_data) + if url is None and 'RelayState' in self._request_data['get_data']: + url = self._request_data['get_data']['RelayState'] + return OneLogin_Saml2_Utils.redirect(url, parameters, request_data=self._request_data) def is_authenticated(self): """ @@ -190,7 +190,7 @@ def is_authenticated(self): :returns: True if is authenticated, False if not :rtype: bool """ - return self.__authenticated + return self._authenticated def get_attributes(self): """ @@ -199,7 +199,7 @@ def get_attributes(self): :returns: SAML attributes :rtype: dict """ - return self.__attributes + return self._attributes def get_nameid(self): """ @@ -208,7 +208,7 @@ def get_nameid(self): :returns: NameID :rtype: string """ - return self.__nameid + return self._nameid def get_session_index(self): """ @@ -216,7 +216,7 @@ def get_session_index(self): :returns: The SessionIndex of the assertion :rtype: string """ - return self.__session_index + return self._session_index def get_session_expiration(self): """ @@ -224,7 +224,7 @@ def get_session_expiration(self): :returns: The SessionNotOnOrAfter of the assertion :rtype: DateTime|null """ - return self.__session_expiration + return self._session_expiration def get_errors(self): """ @@ -233,7 +233,7 @@ def get_errors(self): :returns: List of errors :rtype: list """ - return self.__errors + return self._errors def get_last_error_reason(self): """ @@ -242,7 +242,7 @@ def get_last_error_reason(self): :returns: Reason of the last error :rtype: None | string """ - return self.__error_reason + return self._error_reason def get_attribute(self, name): """ @@ -256,8 +256,8 @@ def get_attribute(self, name): """ assert isinstance(name, basestring) value = None - if self.__attributes and name in self.__attributes.keys(): - value = self.__attributes[name] + if self._attributes and name in self._attributes.keys(): + value = self._attributes[name] return value def get_last_request_id(self): @@ -265,7 +265,7 @@ def get_last_request_id(self): :returns: The ID of the last Request SAML message generated. :rtype: string """ - return self.__last_request_id + return self._last_request_id def login(self, return_to=None, force_authn=False, is_passive=False): """ @@ -282,9 +282,9 @@ def login(self, return_to=None, force_authn=False, is_passive=False): :returns: Redirection url """ - authn_request = OneLogin_Saml2_Authn_Request(self.__settings, force_authn, is_passive) + authn_request = OneLogin_Saml2_Authn_Request(self._settings, force_authn, is_passive) - self.__last_request_id = authn_request.get_id() + self._last_request_id = authn_request.get_id() saml_request = authn_request.get_request() parameters = {'SAMLRequest': saml_request} @@ -292,9 +292,9 @@ def login(self, return_to=None, force_authn=False, is_passive=False): if return_to is not None: parameters['RelayState'] = return_to else: - parameters['RelayState'] = OneLogin_Saml2_Utils.get_self_url_no_query(self.__request_data) + parameters['RelayState'] = OneLogin_Saml2_Utils.get_self_url_no_query(self._request_data) - security = self.__settings.get_security_data() + security = self._settings.get_security_data() if security.get('authnRequestsSigned', False): parameters['SigAlg'] = security['signatureAlgorithm'] parameters['Signature'] = self.build_request_signature(saml_request, parameters['RelayState'], security['signatureAlgorithm']) @@ -322,12 +322,12 @@ def logout(self, return_to=None, name_id=None, session_index=None): OneLogin_Saml2_Error.SAML_SINGLE_LOGOUT_NOT_SUPPORTED ) - if name_id is None and self.__nameid is not None: - name_id = self.__nameid + if name_id is None and self._nameid is not None: + name_id = self._nameid - logout_request = OneLogin_Saml2_Logout_Request(self.__settings, name_id=name_id, session_index=session_index) + logout_request = OneLogin_Saml2_Logout_Request(self._settings, name_id=name_id, session_index=session_index) - self.__last_request_id = logout_request.id + self._last_request_id = logout_request.id saml_request = logout_request.get_request() @@ -335,9 +335,9 @@ def logout(self, return_to=None, name_id=None, session_index=None): if return_to is not None: parameters['RelayState'] = return_to else: - parameters['RelayState'] = OneLogin_Saml2_Utils.get_self_url_no_query(self.__request_data) + parameters['RelayState'] = OneLogin_Saml2_Utils.get_self_url_no_query(self._request_data) - security = self.__settings.get_security_data() + security = self._settings.get_security_data() if security.get('logoutRequestSigned', False): parameters['SigAlg'] = security['signatureAlgorithm'] parameters['Signature'] = self.build_request_signature(saml_request, parameters['RelayState'], security['signatureAlgorithm']) @@ -350,7 +350,7 @@ def get_sso_url(self): :returns: An URL, the SSO endpoint of the IdP :rtype: string """ - idp_data = self.__settings.get_idp_data() + idp_data = self._settings.get_idp_data() return idp_data['singleSignOnService']['url'] def get_slo_url(self): @@ -361,7 +361,7 @@ def get_slo_url(self): :rtype: string """ url = None - idp_data = self.__settings.get_idp_data() + idp_data = self._settings.get_idp_data() if 'singleLogoutService' in idp_data.keys() and 'url' in idp_data['singleLogoutService']: url = idp_data['singleLogoutService']['url'] return url @@ -379,7 +379,7 @@ def build_request_signature(self, saml_request, relay_state, sign_algorithm=OneL :param sign_algorithm: Signature algorithm method :type sign_algorithm: string """ - return self.__build_signature(saml_request, relay_state, 'SAMLRequest', sign_algorithm) + return self._build_signature(saml_request, relay_state, 'SAMLRequest', sign_algorithm) def build_response_signature(self, saml_response, relay_state, sign_algorithm=OneLogin_Saml2_Constants.RSA_SHA1): """ @@ -393,7 +393,7 @@ def build_response_signature(self, saml_response, relay_state, sign_algorithm=On :param sign_algorithm: Signature algorithm method :type sign_algorithm: string """ - return self.__build_signature(saml_response, relay_state, 'SAMLResponse', sign_algorithm) + return self._build_signature(saml_response, relay_state, 'SAMLResponse', sign_algorithm) def __build_signature(self, saml_data, relay_state, saml_type, sign_algorithm=OneLogin_Saml2_Constants.RSA_SHA1): """ @@ -413,7 +413,7 @@ def __build_signature(self, saml_data, relay_state, saml_type, sign_algorithm=On assert saml_type in ['SAMLRequest', 'SAMLResponse'] # Load the key into the xmlsec context - key = self.__settings.get_sp_key() + key = self._settings.get_sp_key() if not key: raise OneLogin_Saml2_Error( diff --git a/src/onelogin/saml2/authn_request.py b/src/onelogin/saml2/authn_request.py index b36734fe..6416ef96 100644 --- a/src/onelogin/saml2/authn_request.py +++ b/src/onelogin/saml2/authn_request.py @@ -37,14 +37,14 @@ def __init__(self, settings, force_authn=False, is_passive=False): :param is_passive: Optional argument. When true the AuthNReuqest will set the Ispassive='true'. :type is_passive: bool """ - self.__settings = settings + self._settings = settings - sp_data = self.__settings.get_sp_data() - idp_data = self.__settings.get_idp_data() - security = self.__settings.get_security_data() + sp_data = self._settings.get_sp_data() + idp_data = self._settings.get_idp_data() + security = self._settings.get_security_data() uid = OneLogin_Saml2_Utils.generate_unique_id() - self.__id = uid + self._id = uid issue_instant = OneLogin_Saml2_Utils.parse_time_to_SAML(OneLogin_Saml2_Utils.now()) destination = idp_data['singleSignOnService']['url'] @@ -119,7 +119,7 @@ def __init__(self, settings, force_authn=False, is_passive=False): 'requested_authn_context_str': requested_authn_context_str, } - self.__authn_request = request + self._authn_request = request def get_request(self): """ @@ -127,7 +127,7 @@ def get_request(self): :return: Unsigned AuthnRequest :rtype: str object """ - deflated_request = compress(self.__authn_request)[2:-4] + deflated_request = compress(self._authn_request)[2:-4] return b64encode(deflated_request) def get_id(self): @@ -136,4 +136,4 @@ def get_id(self): :return: AuthNRequest ID :rtype: string """ - return self.__id + return self._id diff --git a/src/onelogin/saml2/logout_request.py b/src/onelogin/saml2/logout_request.py index 235e07d2..b9b40eaf 100644 --- a/src/onelogin/saml2/logout_request.py +++ b/src/onelogin/saml2/logout_request.py @@ -45,14 +45,14 @@ def __init__(self, settings, request=None, name_id=None, session_index=None): :param session_index: SessionIndex that identifies the session of the user. :type session_index: string """ - self.__settings = settings - self.__error = None + self._settings = settings + self._error = None self.id = None if request is None: - sp_data = self.__settings.get_sp_data() - idp_data = self.__settings.get_idp_data() - security = self.__settings.get_security_data() + sp_data = self._settings.get_sp_data() + idp_data = self._settings.get_idp_data() + security = self._settings.get_security_data() uid = OneLogin_Saml2_Utils.generate_unique_id() self.id = uid @@ -112,7 +112,7 @@ def __init__(self, settings, request=None, name_id=None, session_index=None): logout_request = decoded self.id = self.get_id(logout_request) - self.__logout_request = logout_request + self._logout_request = logout_request def get_request(self): """ @@ -120,7 +120,7 @@ def get_request(self): :return: Deflated base64 encoded Logout Request :rtype: str object """ - return OneLogin_Saml2_Utils.deflate_and_base64_encode(self.__logout_request) + return OneLogin_Saml2_Utils.deflate_and_base64_encode(self._logout_request) @staticmethod def get_id(request): @@ -252,11 +252,11 @@ def is_valid(self, request_data): :return: If the Logout Request is or not valid :rtype: boolean """ - self.__error = None + self._error = None try: - dom = fromstring(self.__logout_request) + dom = fromstring(self._logout_request) - idp_data = self.__settings.get_idp_data() + idp_data = self._settings.get_idp_data() idp_entity_id = idp_data['entityId'] if 'get_data' in request_data.keys(): @@ -264,12 +264,12 @@ def is_valid(self, request_data): else: get_data = {} - if self.__settings.is_strict(): - res = OneLogin_Saml2_Utils.validate_xml(dom, 'saml-schema-protocol-2.0.xsd', self.__settings.is_debug_active()) + if self._settings.is_strict(): + res = OneLogin_Saml2_Utils.validate_xml(dom, 'saml-schema-protocol-2.0.xsd', self._settings.is_debug_active()) if not isinstance(res, Document): raise Exception('Invalid SAML Logout Request. Not match the saml-schema-protocol-2.0.xsd') - security = self.__settings.get_security_data() + security = self._settings.get_security_data() current_url = OneLogin_Saml2_Utils.get_self_url_no_query(request_data) @@ -323,8 +323,8 @@ def is_valid(self, request_data): return True except Exception as err: # pylint: disable=R0801sign_alg - self.__error = err.__str__() - debug = self.__settings.is_debug_active() + self._error = err.__str__() + debug = self._settings.is_debug_active() if debug: print err.__str__() return False @@ -333,4 +333,4 @@ def get_error(self): """ After execute a validation process, if fails this method returns the cause """ - return self.__error + return self._error diff --git a/src/onelogin/saml2/logout_response.py b/src/onelogin/saml2/logout_response.py index 3c79a989..ac914b56 100644 --- a/src/onelogin/saml2/logout_response.py +++ b/src/onelogin/saml2/logout_response.py @@ -38,12 +38,12 @@ def __init__(self, settings, response=None): * (string) response. An UUEncoded SAML Logout response from the IdP. """ - self.__settings = settings - self.__error = None + self._settings = settings + self._error = None if response is not None: - self.__logout_response = OneLogin_Saml2_Utils.decode_base64_and_inflate(response) - self.document = parseString(self.__logout_response) + self._logout_response = OneLogin_Saml2_Utils.decode_base64_and_inflate(response) + self.document = parseString(self._logout_response) def get_issuer(self): """ @@ -52,7 +52,7 @@ def get_issuer(self): :rtype: string """ issuer = None - issuer_nodes = self.__query('/samlp:LogoutResponse/saml:Issuer') + issuer_nodes = self._query('/samlp:LogoutResponse/saml:Issuer') if len(issuer_nodes) == 1: issuer = issuer_nodes[0].text return issuer @@ -63,7 +63,7 @@ def get_status(self): :return: The Status :rtype: string """ - entries = self.__query('/samlp:LogoutResponse/samlp:Status/samlp:StatusCode') + entries = self._query('/samlp:LogoutResponse/samlp:Status/samlp:StatusCode') if len(entries) == 0: return None status = entries[0].attrib['Value'] @@ -77,18 +77,18 @@ def is_valid(self, request_data, request_id=None): :return: Returns if the SAML LogoutResponse is or not valid :rtype: boolean """ - self.__error = None + self._error = None try: - idp_data = self.__settings.get_idp_data() + idp_data = self._settings.get_idp_data() idp_entity_id = idp_data['entityId'] get_data = request_data['get_data'] - if self.__settings.is_strict(): - res = OneLogin_Saml2_Utils.validate_xml(self.document, 'saml-schema-protocol-2.0.xsd', self.__settings.is_debug_active()) + if self._settings.is_strict(): + res = OneLogin_Saml2_Utils.validate_xml(self.document, 'saml-schema-protocol-2.0.xsd', self._settings.is_debug_active()) if not isinstance(res, Document): raise Exception('Invalid SAML Logout Request. Not match the saml-schema-protocol-2.0.xsd') - security = self.__settings.get_security_data() + security = self._settings.get_security_data() # Check if the InResponseTo of the Logout Response matchs the ID of the Logout Request (requestId) if provided if request_id is not None and self.document.documentElement.hasAttribute('InResponseTo'): @@ -135,8 +135,8 @@ def is_valid(self, request_data, request_id=None): return True # pylint: disable=R0801 except Exception as err: - self.__error = err.__str__() - debug = self.__settings.is_debug_active() + self._error = err.__str__() + debug = self._settings.is_debug_active() if debug: print err.__str__() return False @@ -159,8 +159,8 @@ def build(self, in_response_to): :param in_response_to: InResponseTo value for the Logout Response. :type in_response_to: string """ - sp_data = self.__settings.get_sp_data() - idp_data = self.__settings.get_idp_data() + sp_data = self._settings.get_sp_data() + idp_data = self._settings.get_idp_data() uid = OneLogin_Saml2_Utils.generate_unique_id() issue_instant = OneLogin_Saml2_Utils.parse_time_to_SAML(OneLogin_Saml2_Utils.now()) @@ -186,7 +186,7 @@ def build(self, in_response_to): 'entity_id': sp_data['entityId'], } - self.__logout_response = logout_response + self._logout_response = logout_response def get_response(self): """ @@ -194,10 +194,10 @@ def get_response(self): :return: Logout Response deflated and base64 encoded :rtype: string """ - return OneLogin_Saml2_Utils.deflate_and_base64_encode(self.__logout_response) + return OneLogin_Saml2_Utils.deflate_and_base64_encode(self._logout_response) def get_error(self): """ After execute a validation process, if fails this method returns the cause """ - return self.__error + return self._error diff --git a/src/onelogin/saml2/response.py b/src/onelogin/saml2/response.py index 5d73ff99..1dae8987 100644 --- a/src/onelogin/saml2/response.py +++ b/src/onelogin/saml2/response.py @@ -37,19 +37,19 @@ def __init__(self, settings, response): :param response: The base64 encoded, XML string containing the samlp:Response :type response: string """ - self.__settings = settings - self.__error = None + self._settings = settings + self._error = None self.response = b64decode(response) self.document = fromstring(self.response) self.decrypted_document = None self.encrypted = None # Quick check for the presence of EncryptedAssertion - encrypted_assertion_nodes = self.__query('/samlp:Response/saml:EncryptedAssertion') + encrypted_assertion_nodes = self._query('/samlp:Response/saml:EncryptedAssertion') if encrypted_assertion_nodes: decrypted_document = deepcopy(self.document) self.encrypted = True - self.decrypted_document = self.__decrypt_assertion(decrypted_document) + self.decrypted_document = self._decrypt_assertion(decrypted_document) def is_valid(self, request_data, request_id=None): """ @@ -64,7 +64,7 @@ def is_valid(self, request_data, request_id=None): :returns: True if the SAML Response is valid, False if not :rtype: bool """ - self.__error = None + self._error = None try: # Checks SAML version if self.document.get('Version', None) != '2.0': @@ -81,23 +81,23 @@ def is_valid(self, request_data, request_id=None): # Checks that the response has the SUCCESS status self.check_status() - idp_data = self.__settings.get_idp_data() + idp_data = self._settings.get_idp_data() idp_entity_id = idp_data.get('entityId', '') - sp_data = self.__settings.get_sp_data() + sp_data = self._settings.get_sp_data() sp_entity_id = sp_data.get('entityId', '') - sign_nodes = self.__query('//ds:Signature') + sign_nodes = self._query('//ds:Signature') signed_elements = [] for sign_node in sign_nodes: signed_elements.append(sign_node.getparent().tag) - if self.__settings.is_strict(): - res = OneLogin_Saml2_Utils.validate_xml(etree.tostring(self.document), 'saml-schema-protocol-2.0.xsd', self.__settings.is_debug_active()) + if self._settings.is_strict(): + res = OneLogin_Saml2_Utils.validate_xml(etree.tostring(self.document), 'saml-schema-protocol-2.0.xsd', self._settings.is_debug_active()) if not isinstance(res, Document): raise Exception('Invalid SAML Response. Not match the saml-schema-protocol-2.0.xsd') - security = self.__settings.get_security_data() + security = self._settings.get_security_data() current_url = OneLogin_Saml2_Utils.get_self_url_no_query(request_data) # Check if the InResponseTo of the Response matchs the ID of the AuthNRequest (requestId) if provided @@ -110,12 +110,12 @@ def is_valid(self, request_data, request_id=None): raise Exception('The assertion of the Response is not encrypted and the SP require it') if security.get('wantNameIdEncrypted', False): - encrypted_nameid_nodes = self.__query_assertion('/saml:Subject/saml:EncryptedID/xenc:EncryptedData') + encrypted_nameid_nodes = self._query_assertion('/saml:Subject/saml:EncryptedID/xenc:EncryptedData') if len(encrypted_nameid_nodes) == 0: raise Exception('The NameID of the Response is not encrypted and the SP require it') # Checks that there is at least one AttributeStatement if required - attribute_statement_nodes = self.__query_assertion('/saml:AttributeStatement') + attribute_statement_nodes = self._query_assertion('/saml:AttributeStatement') if security.get('wantAttributeStatement', True) and not attribute_statement_nodes: raise Exception('There is no AttributeStatement on the Response') @@ -123,7 +123,7 @@ def is_valid(self, request_data, request_id=None): if not self.validate_timestamps(): raise Exception('Timing issues (please check your clock settings)') - encrypted_attributes_nodes = self.__query_assertion('/saml:AttributeStatement/saml:EncryptedAttribute') + encrypted_attributes_nodes = self._query_assertion('/saml:AttributeStatement/saml:EncryptedAttribute') if encrypted_attributes_nodes: raise Exception('There is an EncryptedAttribute in the Response and this SP not support them') @@ -155,7 +155,7 @@ def is_valid(self, request_data, request_id=None): # Checks the SubjectConfirmation, at least one SubjectConfirmation must be valid any_subject_confirmation = False - subject_confirmation_nodes = self.__query_assertion('/saml:Subject/saml:SubjectConfirmation') + subject_confirmation_nodes = self._query_assertion('/saml:Subject/saml:SubjectConfirmation') for scn in subject_confirmation_nodes: method = scn.get('Method', None) @@ -216,8 +216,8 @@ def is_valid(self, request_data, request_id=None): return True except Exception as err: - self.__error = err.__str__() - debug = self.__settings.is_debug_active() + self._error = err.__str__() + debug = self._settings.is_debug_active() if debug: print err.__str__() return False @@ -246,7 +246,7 @@ def get_audiences(self): :returns: The valid audiences for the SAML Response :rtype: list """ - audience_nodes = self.__query_assertion('/saml:Conditions/saml:AudienceRestriction/saml:Audience') + audience_nodes = self._query_assertion('/saml:Conditions/saml:AudienceRestriction/saml:Audience') return [node.text for node in audience_nodes if node.text is not None] def get_issuers(self): @@ -258,11 +258,11 @@ def get_issuers(self): """ issuers = [] - message_issuer_nodes = self.__query('/samlp:Response/saml:Issuer') + message_issuer_nodes = self._query('/samlp:Response/saml:Issuer') if message_issuer_nodes: issuers.append(message_issuer_nodes[0].text) - assertion_issuer_nodes = self.__query_assertion('/saml:Issuer') + assertion_issuer_nodes = self._query_assertion('/saml:Issuer') if assertion_issuer_nodes: issuers.append(assertion_issuer_nodes[0].text) @@ -276,13 +276,13 @@ def get_nameid_data(self): :rtype: dict """ nameid = None - encrypted_id_data_nodes = self.__query_assertion('/saml:Subject/saml:EncryptedID/xenc:EncryptedData') + encrypted_id_data_nodes = self._query_assertion('/saml:Subject/saml:EncryptedID/xenc:EncryptedData') if encrypted_id_data_nodes: encrypted_data = encrypted_id_data_nodes[0] - key = self.__settings.get_sp_key() + key = self._settings.get_sp_key() nameid = OneLogin_Saml2_Utils.decrypt_element(encrypted_data, key) else: - nameid_nodes = self.__query_assertion('/saml:Subject/saml:NameID') + nameid_nodes = self._query_assertion('/saml:Subject/saml:NameID') if nameid_nodes: nameid = nameid_nodes[0] if nameid is None: @@ -314,7 +314,7 @@ def get_session_not_on_or_after(self): :rtype: time|None """ not_on_or_after = None - authn_statement_nodes = self.__query_assertion('/saml:AuthnStatement[@SessionNotOnOrAfter]') + authn_statement_nodes = self._query_assertion('/saml:AuthnStatement[@SessionNotOnOrAfter]') if authn_statement_nodes: not_on_or_after = OneLogin_Saml2_Utils.parse_SAML_to_time(authn_statement_nodes[0].get('SessionNotOnOrAfter')) return not_on_or_after @@ -330,7 +330,7 @@ def get_session_index(self): :rtype: string|None """ session_index = None - authn_statement_nodes = self.__query_assertion('/saml:AuthnStatement[@SessionIndex]') + authn_statement_nodes = self._query_assertion('/saml:AuthnStatement[@SessionIndex]') if authn_statement_nodes: session_index = authn_statement_nodes[0].get('SessionIndex') return session_index @@ -341,7 +341,7 @@ def get_attributes(self): EncryptedAttributes are not supported """ attributes = {} - attribute_nodes = self.__query_assertion('/saml:AttributeStatement/saml:Attribute') + attribute_nodes = self._query_assertion('/saml:AttributeStatement/saml:Attribute') for attribute_node in attribute_nodes: attr_name = attribute_node.get('Name') values = [] @@ -384,7 +384,7 @@ def validate_timestamps(self): :returns: True if the condition is valid, False otherwise :rtype: bool """ - conditions_nodes = self.__query_assertion('/saml:Conditions') + conditions_nodes = self._query_assertion('/saml:Conditions') for conditions_node in conditions_nodes: nb_attr = conditions_node.get('NotBefore') @@ -411,12 +411,12 @@ def __query_assertion(self, xpath_expr): assertion_expr = '/saml:Assertion' signature_expr = '/ds:Signature/ds:SignedInfo/ds:Reference' signed_assertion_query = '/samlp:Response' + assertion_expr + signature_expr - assertion_reference_nodes = self.__query(signed_assertion_query) + assertion_reference_nodes = self._query(signed_assertion_query) if not assertion_reference_nodes: # Check if the message is signed signed_message_query = '/samlp:Response' + signature_expr - message_reference_nodes = self.__query(signed_message_query) + message_reference_nodes = self._query(signed_message_query) if message_reference_nodes: message_id = message_reference_nodes[0].get('URI') final_query = "/samlp:Response[@ID='%s']/" % message_id[1:] @@ -427,7 +427,7 @@ def __query_assertion(self, xpath_expr): assertion_id = assertion_reference_nodes[0].get('URI') final_query = '/samlp:Response' + assertion_expr + "[@ID='%s']" % assertion_id[1:] final_query += xpath_expr - return self.__query(final_query) + return self._query(final_query) def __query(self, query): """ @@ -455,7 +455,7 @@ def __decrypt_assertion(self, dom): :returns: Decrypted Assertion :rtype: Element """ - key = self.__settings.get_sp_key() + key = self._settings.get_sp_key() if not key: raise Exception('No private key available, check settings') @@ -491,4 +491,4 @@ def get_error(self): """ After execute a validation process, if fails this method returns the cause """ - return self.__error + return self._error From 3db387bbdd676c838f46b43a392e8bf2d15ddcb0 Mon Sep 17 00:00:00 2001 From: sunmoonone Date: Thu, 31 Mar 2016 18:07:15 +0800 Subject: [PATCH 2/4] change def __query to def _query --- src/onelogin/saml2/auth.py | 2 +- src/onelogin/saml2/logout_response.py | 2 +- src/onelogin/saml2/response.py | 6 ++-- tests/data/customPath/settings.json | 48 ++++++++++++++++++++++++++- tests/settings/settings.json | 48 ++++++++++++++++++++++++++- 5 files changed, 99 insertions(+), 7 deletions(-) mode change 120000 => 100644 tests/data/customPath/settings.json mode change 120000 => 100644 tests/settings/settings.json diff --git a/src/onelogin/saml2/auth.py b/src/onelogin/saml2/auth.py index f0f6be73..77454e25 100644 --- a/src/onelogin/saml2/auth.py +++ b/src/onelogin/saml2/auth.py @@ -395,7 +395,7 @@ def build_response_signature(self, saml_response, relay_state, sign_algorithm=On """ return self._build_signature(saml_response, relay_state, 'SAMLResponse', sign_algorithm) - def __build_signature(self, saml_data, relay_state, saml_type, sign_algorithm=OneLogin_Saml2_Constants.RSA_SHA1): + def _build_signature(self, saml_data, relay_state, saml_type, sign_algorithm=OneLogin_Saml2_Constants.RSA_SHA1): """ Builds the Signature :param saml_data: The SAML Data diff --git a/src/onelogin/saml2/logout_response.py b/src/onelogin/saml2/logout_response.py index ac914b56..5709fc20 100644 --- a/src/onelogin/saml2/logout_response.py +++ b/src/onelogin/saml2/logout_response.py @@ -141,7 +141,7 @@ def is_valid(self, request_data, request_id=None): print err.__str__() return False - def __query(self, query): + def _query(self, query): """ Extracts a node from the DOMDocument (Logout Response Menssage) :param query: Xpath Expresion diff --git a/src/onelogin/saml2/response.py b/src/onelogin/saml2/response.py index 1dae8987..69006db0 100644 --- a/src/onelogin/saml2/response.py +++ b/src/onelogin/saml2/response.py @@ -395,7 +395,7 @@ def validate_timestamps(self): return False return True - def __query_assertion(self, xpath_expr): + def _query_assertion(self, xpath_expr): """ Extracts nodes that match the query from the Assertion @@ -429,7 +429,7 @@ def __query_assertion(self, xpath_expr): final_query += xpath_expr return self._query(final_query) - def __query(self, query): + def _query(self, query): """ Extracts nodes that match the query from the Response @@ -445,7 +445,7 @@ def __query(self, query): document = self.document return OneLogin_Saml2_Utils.query(document, query) - def __decrypt_assertion(self, dom): + def _decrypt_assertion(self, dom): """ Decrypts the Assertion diff --git a/tests/data/customPath/settings.json b/tests/data/customPath/settings.json deleted file mode 120000 index 0d813456..00000000 --- a/tests/data/customPath/settings.json +++ /dev/null @@ -1 +0,0 @@ -../../settings/settings1.json \ No newline at end of file diff --git a/tests/data/customPath/settings.json b/tests/data/customPath/settings.json new file mode 100644 index 00000000..d809b7d6 --- /dev/null +++ b/tests/data/customPath/settings.json @@ -0,0 +1,47 @@ +{ + "strict": false, + "debug": false, + "custom_base_path": "../../../tests/data/customPath/", + "sp": { + "entityId": "http://stuff.com/endpoints/metadata.php", + "assertionConsumerService": { + "url": "http://stuff.com/endpoints/endpoints/acs.php" + }, + "singleLogoutService": { + "url": "http://stuff.com/endpoints/endpoints/sls.php" + }, + "NameIDFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" + }, + "idp": { + "entityId": "http://idp.example.com/", + "singleSignOnService": { + "url": "http://idp.example.com/SSOService.php" + }, + "singleLogoutService": { + "url": "http://idp.example.com/SingleLogoutService.php" + }, + "x509cert": "MIICgTCCAeoCCQCbOlrWDdX7FTANBgkqhkiG9w0BAQUFADCBhDELMAkGA1UEBhMCTk8xGDAWBgNVBAgTD0FuZHJlYXMgU29sYmVyZzEMMAoGA1UEBxMDRm9vMRAwDgYDVQQKEwdVTklORVRUMRgwFgYDVQQDEw9mZWlkZS5lcmxhbmcubm8xITAfBgkqhkiG9w0BCQEWEmFuZHJlYXNAdW5pbmV0dC5ubzAeFw0wNzA2MTUxMjAxMzVaFw0wNzA4MTQxMjAxMzVaMIGEMQswCQYDVQQGEwJOTzEYMBYGA1UECBMPQW5kcmVhcyBTb2xiZXJnMQwwCgYDVQQHEwNGb28xEDAOBgNVBAoTB1VOSU5FVFQxGDAWBgNVBAMTD2ZlaWRlLmVybGFuZy5ubzEhMB8GCSqGSIb3DQEJARYSYW5kcmVhc0B1bmluZXR0Lm5vMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDivbhR7P516x/S3BqKxupQe0LONoliupiBOesCO3SHbDrl3+q9IbfnfmE04rNuMcPsIxB161TdDpIesLCn7c8aPHISKOtPlAeTZSnb8QAu7aRjZq3+PbrP5uW3TcfCGPtKTytHOge/OlJbo078dVhXQ14d1EDwXJW1rRXuUt4C8QIDAQABMA0GCSqGSIb3DQEBBQUAA4GBACDVfp86HObqY+e8BUoWQ9+VMQx1ASDohBjwOsg2WykUqRXF+dLfcUH9dWR63CtZIKFDbStNomPnQz7nbK+onygwBspVEbnHuUihZq3ZUdmumQqCw4Uvs/1Uvq3orOo/WJVhTyvLgFVK2QarQ4/67OZfHd7R+POBXhophSMv1ZOo" + }, + "security": { + "authnRequestsSigned": false, + "wantAssertionsSigned": false, + "signMetadata": false + }, + "contactPerson": { + "technical": { + "givenName": "technical_name", + "emailAddress": "technical@example.com" + }, + "support": { + "givenName": "support_name", + "emailAddress": "support@example.com" + } + }, + "organization": { + "en-US": { + "name": "sp_test", + "displayname": "SP test", + "url": "http://sp.example.com" + } + } +} diff --git a/tests/settings/settings.json b/tests/settings/settings.json deleted file mode 120000 index eb2af51e..00000000 --- a/tests/settings/settings.json +++ /dev/null @@ -1 +0,0 @@ -settings1.json \ No newline at end of file diff --git a/tests/settings/settings.json b/tests/settings/settings.json new file mode 100644 index 00000000..d809b7d6 --- /dev/null +++ b/tests/settings/settings.json @@ -0,0 +1,47 @@ +{ + "strict": false, + "debug": false, + "custom_base_path": "../../../tests/data/customPath/", + "sp": { + "entityId": "http://stuff.com/endpoints/metadata.php", + "assertionConsumerService": { + "url": "http://stuff.com/endpoints/endpoints/acs.php" + }, + "singleLogoutService": { + "url": "http://stuff.com/endpoints/endpoints/sls.php" + }, + "NameIDFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" + }, + "idp": { + "entityId": "http://idp.example.com/", + "singleSignOnService": { + "url": "http://idp.example.com/SSOService.php" + }, + "singleLogoutService": { + "url": "http://idp.example.com/SingleLogoutService.php" + }, + "x509cert": "MIICgTCCAeoCCQCbOlrWDdX7FTANBgkqhkiG9w0BAQUFADCBhDELMAkGA1UEBhMCTk8xGDAWBgNVBAgTD0FuZHJlYXMgU29sYmVyZzEMMAoGA1UEBxMDRm9vMRAwDgYDVQQKEwdVTklORVRUMRgwFgYDVQQDEw9mZWlkZS5lcmxhbmcubm8xITAfBgkqhkiG9w0BCQEWEmFuZHJlYXNAdW5pbmV0dC5ubzAeFw0wNzA2MTUxMjAxMzVaFw0wNzA4MTQxMjAxMzVaMIGEMQswCQYDVQQGEwJOTzEYMBYGA1UECBMPQW5kcmVhcyBTb2xiZXJnMQwwCgYDVQQHEwNGb28xEDAOBgNVBAoTB1VOSU5FVFQxGDAWBgNVBAMTD2ZlaWRlLmVybGFuZy5ubzEhMB8GCSqGSIb3DQEJARYSYW5kcmVhc0B1bmluZXR0Lm5vMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDivbhR7P516x/S3BqKxupQe0LONoliupiBOesCO3SHbDrl3+q9IbfnfmE04rNuMcPsIxB161TdDpIesLCn7c8aPHISKOtPlAeTZSnb8QAu7aRjZq3+PbrP5uW3TcfCGPtKTytHOge/OlJbo078dVhXQ14d1EDwXJW1rRXuUt4C8QIDAQABMA0GCSqGSIb3DQEBBQUAA4GBACDVfp86HObqY+e8BUoWQ9+VMQx1ASDohBjwOsg2WykUqRXF+dLfcUH9dWR63CtZIKFDbStNomPnQz7nbK+onygwBspVEbnHuUihZq3ZUdmumQqCw4Uvs/1Uvq3orOo/WJVhTyvLgFVK2QarQ4/67OZfHd7R+POBXhophSMv1ZOo" + }, + "security": { + "authnRequestsSigned": false, + "wantAssertionsSigned": false, + "signMetadata": false + }, + "contactPerson": { + "technical": { + "givenName": "technical_name", + "emailAddress": "technical@example.com" + }, + "support": { + "givenName": "support_name", + "emailAddress": "support@example.com" + } + }, + "organization": { + "en-US": { + "name": "sp_test", + "displayname": "SP test", + "url": "http://sp.example.com" + } + } +} From b6fda75daa9dc20073e8c10cf47a62e727d157d4 Mon Sep 17 00:00:00 2001 From: sunmoonone Date: Thu, 31 Mar 2016 18:08:34 +0800 Subject: [PATCH 3/4] __query to _query --- src/onelogin/saml2/logout_response.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/onelogin/saml2/logout_response.py b/src/onelogin/saml2/logout_response.py index 5709fc20..ac914b56 100644 --- a/src/onelogin/saml2/logout_response.py +++ b/src/onelogin/saml2/logout_response.py @@ -141,7 +141,7 @@ def is_valid(self, request_data, request_id=None): print err.__str__() return False - def _query(self, query): + def __query(self, query): """ Extracts a node from the DOMDocument (Logout Response Menssage) :param query: Xpath Expresion From 942d5cf81e1686e3cc9b9e61381eb26f75923906 Mon Sep 17 00:00:00 2001 From: sunmoonone Date: Thu, 31 Mar 2016 18:26:59 +0800 Subject: [PATCH 4/4] all tests passed --- src/onelogin/saml2/logout_response.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/onelogin/saml2/logout_response.py b/src/onelogin/saml2/logout_response.py index ac914b56..5709fc20 100644 --- a/src/onelogin/saml2/logout_response.py +++ b/src/onelogin/saml2/logout_response.py @@ -141,7 +141,7 @@ def is_valid(self, request_data, request_id=None): print err.__str__() return False - def __query(self, query): + def _query(self, query): """ Extracts a node from the DOMDocument (Logout Response Menssage) :param query: Xpath Expresion