0001-misc-disable-AuthnRequest-eo-next_url-Extensions-by-.patch

Thomas Noël, 23 novembre 2017 10:25

Voir les différences: en ligne côte à côte

Subject: [PATCH] misc: disable AuthnRequest eo:next_url Extensions by default
 (#20229)

 mellon/app_settings.py |  1 +
 mellon/views.py        | 17 +++++++++--------
 2 files changed, 10 insertions(+), 8 deletions(-)

mellon/app_settings.py
13	13	'NAME_ID_POLICY_FORMAT': None,
14	14	'NAME_ID_POLICY_ALLOW_CREATE': True,
15	15	'FORCE_AUTHN': False,
	16	'ADD_AUTHNREQUEST_NEXT_URL_EXTENSION': False,
16	17	'ADAPTER': (
17	18	'mellon.adapters.DefaultAdapter',
18	19	),

                     authn_request.requestedAuthnContext = req_authncontext
                     req_authncontext.authnContextClassRef = authn_classref
                 authn_request.extensions = lasso.Samlp2Extensions()
                 authn_request.extensions.setOriginalXmlnode(
                         '''<samlp:Extensions
                                 xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                                 xmlns:eo="https://www.entrouvert.com/">
                               <eo:next_url>%s</eo:next_url>
                            </samlp:Extensions>''' %
                        escape(request.build_absolute_uri(next_url or '/')))
                 if utils.get_setting(idp, 'ADD_AUTHNREQUEST_NEXT_URL_EXTENSION'):
                     authn_request.extensions = lasso.Samlp2Extensions()
                     authn_request.extensions.setOriginalXmlnode(
                             '''<samlp:Extensions
                                     xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                                     xmlns:eo="https://www.entrouvert.com/">
                                   <eo:next_url>%s</eo:next_url>
                                </samlp:Extensions>''' %
                            escape(request.build_absolute_uri(next_url or '/')))
                 self.set_next_url(next_url)
                 login.buildAuthnRequestMsg()
             except lasso.Error, e:
+    -

Produits Entr'ouvert » django-mellon