Skip to content

Commit 4bc7037

Browse files
pitbulkpitbulk
committed
Allows the RequestedAuthnContext Comparison attribute to be set via config
1 parent 61c7bbe commit 4bc7037

3 files changed

Lines changed: 39 additions & 3 deletions

File tree

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -316,6 +316,8 @@ In addition to the required settings data (idp, sp), there is extra information
316316
// Set true or don't present thi parameter and you will get an AuthContext 'exact' 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
317317
// Set an array with the possible auth context values: array ('urn:oasis:names:tc:SAML:2.0:ac:classes:Password', 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509'),
318318
'requestedAuthnContext': true,
319+
// Allows the authn comparison parameter to be set, defaults to 'exact' if the setting is not present.
320+
'requestedAuthnContextComparison': 'exact',
319321

320322
// In some environment you will need to set how long the published metadata of the Service Provider gonna be valid.
321323
// is possible to not set the 2 following parameters (or set to null) and default values will be set (2 days, 1 week)

‎src/onelogin/saml2/authn_request.py‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -74,12 +74,16 @@ def __init__(self, settings, force_authn=False, is_passive=False):
7474

7575
requested_authn_context_str = ''
7676
if security['requestedAuthnContext'] is not False:
77+
authn_comparison = 'exact'
78+
if 'requestedAuthnContextComparison' in security.keys():
79+
authn_comparison = security['requestedAuthnContextComparison']
80+
7781
if security['requestedAuthnContext'] is True:
78-
requested_authn_context_str = """ <samlp:RequestedAuthnContext Comparison="exact">
82+
requested_authn_context_str = """ <samlp:RequestedAuthnContext Comparison="%s">
7983
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
80-
</samlp:RequestedAuthnContext>"""
84+
</samlp:RequestedAuthnContext>""" % authn_comparison
8185
else:
82-
requested_authn_context_str = ' <samlp:RequestedAuthnContext Comparison="exact">'
86+
requested_authn_context_str = ' <samlp:RequestedAuthnContext Comparison="%s">' % authn_comparison
8387
for authn_context in security['requestedAuthnContext']:
8488
requested_authn_context_str += '<saml:AuthnContextClassRef>%s</saml:AuthnContextClassRef>' % authn_context
8589
requested_authn_context_str += ' </samlp:RequestedAuthnContext>'

‎tests/src/OneLogin/saml2_tests/authn_request_test.py‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,36 @@ def testCreateRequestAuthContext(self):
115115
self.assertIn(OneLogin_Saml2_Constants.AC_PASSWORD_PROTECTED, inflated)
116116
self.assertIn(OneLogin_Saml2_Constants.AC_X509, inflated)
117117

118+
def testCreateRequestAuthContextComparision(self):
119+
"""
120+
Tests the OneLogin_Saml2_Authn_Request Constructor.
121+
The creation of a deflated SAML Request with defined AuthnContextComparison
122+
"""
123+
saml_settings = self.loadSettingsJSON()
124+
settings = OneLogin_Saml2_Settings(saml_settings)
125+
authn_request = OneLogin_Saml2_Authn_Request(settings)
126+
authn_request_encoded = authn_request.get_request()
127+
inflated = compat.to_string(OneLogin_Saml2_Utils.decode_base64_and_inflate(authn_request_encoded))
128+
self.assertRegexpMatches(inflated, '^<samlp:AuthnRequest')
129+
self.assertIn(OneLogin_Saml2_Constants.AC_PASSWORD, inflated)
130+
self.assertNotIn(OneLogin_Saml2_Constants.AC_X509, inflated)
131+
132+
saml_settings['security']['requestedAuthnContext'] = True
133+
settings = OneLogin_Saml2_Settings(saml_settings)
134+
authn_request = OneLogin_Saml2_Authn_Request(settings)
135+
authn_request_encoded = authn_request.get_request()
136+
inflated = compat.to_string(OneLogin_Saml2_Utils.decode_base64_and_inflate(authn_request_encoded))
137+
self.assertRegexpMatches(inflated, '^<samlp:AuthnRequest')
138+
self.assertIn('RequestedAuthnContext Comparison="exact"', inflated)
139+
140+
saml_settings['security']['requestedAuthnContextComparison'] = 'minimun'
141+
settings = OneLogin_Saml2_Settings(saml_settings)
142+
authn_request = OneLogin_Saml2_Authn_Request(settings)
143+
authn_request_encoded = authn_request.get_request()
144+
inflated = compat.to_string(OneLogin_Saml2_Utils.decode_base64_and_inflate(authn_request_encoded))
145+
self.assertRegexpMatches(inflated, '^<samlp:AuthnRequest')
146+
self.assertIn('RequestedAuthnContext Comparison="minimun"', inflated)
147+
118148
def testCreateRequestForceAuthN(self):
119149
"""
120150
Tests the OneLogin_Saml2_Authn_Request Constructor.

0 commit comments

Comments
 (0)