-
Notifications
You must be signed in to change notification settings - Fork 136
Use higher-level function to create a saml request on the saml2 backend #380
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
@vladimir-mencl-eresearch in reference to IdentityPython/pysaml2#819 would like to test this? |
logger.debug(logline) | ||
raise SATOSAAuthenticationError(context.state, msg) | ||
self.outstanding_queries[req_id] = req | ||
self.outstanding_queries[req_id] = req_id |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I know that this looks weird.
outstanding_queries
is used as a dict
throughout the code. It seems that the value content is not used; the value is only checked to be non-null (value is not None
). This allows us to put anything we want as the value, except for None
.
I think that outstanding_queries
could be turned into a list/set. But that would require to sync changes under pysaml2. We can look into that later.
In general, the way we check for unsolicited responses should be refactored.
Hi @c00kiemon5ter , Thanks - yes, I'm happy to confirm this works in my environment and does the right thing - SAML AuthnRequest is only signed via external Thanks for the fix - and sorry, did not get to it yet myself. Cheers, |
Signed-off-by: Ivan Kanakarakis <[email protected]>
9bdcfef
to
7ed0774
Compare
The current version of pysaml2 (7.5.2) has an issue where AuthNRequests are both signed in the XML and with an extra `Signature` queryparam. This was reported initially in 2021: IdentityPython/pysaml2#819 And it was fixed by a changed in SATOSA: IdentityPython/SATOSA#380 But it reappeared apparently and the original reporter has a PR open against pysaml2 that is supposed to fix it: IdentityPython/pysaml2#973 They report that the regression was introduced in pysaml2 by IdentityPython/pysaml2#834 We try here to pin pysaml2 to the last version before this PR was merged. Unfortunately this is quite an old version, but from basic testing it seems to still be compatible with the current SATOSA version. Hopefully this can be temporary.
The current version of pysaml2 (7.5.2) has an issue where AuthNRequests are both signed in the XML and with an extra `Signature` queryparam. This was reported initially in 2021: IdentityPython/pysaml2#819 And it was fixed by a changed in SATOSA: IdentityPython/SATOSA#380 But it reappeared apparently and the original reporter has a PR open against pysaml2 that is supposed to fix it: IdentityPython/pysaml2#973 They report that the regression was introduced in pysaml2 by IdentityPython/pysaml2#834 We try here to pin pysaml2 to the last version before this PR was merged. Unfortunately this is quite an old version, but from basic testing it seems to still be compatible with the current SATOSA version. Hopefully this can be temporary.
The current version of pysaml2 (7.5.2) has an issue where AuthNRequests are both signed in the XML and with an extra `Signature` queryparam. This was reported initially in 2021: IdentityPython/pysaml2#819 And it was fixed by a changed in SATOSA: IdentityPython/SATOSA#380 But it reappeared apparently and the original reporter has a PR open against pysaml2 that is supposed to fix it: IdentityPython/pysaml2#973 They report that the regression was introduced in pysaml2 by IdentityPython/pysaml2#834 We try here to pin pysaml2 to the last version before this PR was merged. Unfortunately this is quite an old version, but from basic testing it seems to still be compatible with the current SATOSA version. This in turn forces us to also pin xmlschema to avoid IdentityPython/pysaml2#947 Hopefully this can be temporary.
The current version of pysaml2 (7.5.2) has an issue where AuthNRequests are both signed in the XML and with an extra `Signature` queryparam. This was reported initially in 2021: IdentityPython/pysaml2#819 And it was fixed by a changed in SATOSA: IdentityPython/SATOSA#380 But it reappeared apparently and the original reporter has a PR open against pysaml2 that is supposed to fix it: IdentityPython/pysaml2#973 They report that the regression was introduced in pysaml2 by IdentityPython/pysaml2#834 We try here to pin pysaml2 to the last version before this PR was merged. Unfortunately this is quite an old version, but from basic testing it seems to still be compatible with the current SATOSA version. This in turn forces us to also pin xmlschema to avoid IdentityPython/pysaml2#947 Hopefully this can be temporary.
The current version of pysaml2 (7.5.2) has an issue where AuthNRequests are both signed in the XML and with an extra `Signature` queryparam. This was reported initially in 2021: IdentityPython/pysaml2#819 And it was fixed by a changed in SATOSA: IdentityPython/SATOSA#380 But it reappeared apparently and the original reporter has a PR open against pysaml2 that is supposed to fix it: IdentityPython/pysaml2#973 They report that the regression was introduced in pysaml2 by IdentityPython/pysaml2#834 We try here to pin pysaml2 to the last version before this PR was merged. Unfortunately this is quite an old version, but from basic testing it seems to still be compatible with the current SATOSA version. This in turn forces us to also pin xmlschema to avoid IdentityPython/pysaml2#947 Hopefully this can be temporary.
The current version of pysaml2 (7.5.2) has an issue where AuthNRequests are both signed in the XML and with an extra `Signature` queryparam. This was reported initially in 2021: IdentityPython/pysaml2#819 And it was fixed by a changed in SATOSA: IdentityPython/SATOSA#380 But it reappeared apparently and the original reporter has a PR open against pysaml2 that is supposed to fix it: IdentityPython/pysaml2#973 They report that the regression was introduced in pysaml2 by IdentityPython/pysaml2#834 We try here to pin pysaml2 to the last version before this PR was merged. Unfortunately this is quite an old version, but from basic testing it seems to still be compatible with the current SATOSA version. This in turn forces us to also pin xmlschema to avoid IdentityPython/pysaml2#947 Hopefully this can be temporary.
ref: IdentityPython/pysaml2#819
All Submissions: