Projet

Général

Profil

0001-WIP-support-federation-file-loading-19396.patch

Paul Marillonnet, 11 janvier 2018 18:49

Télécharger (86 ko)

Voir les différences: 

Subject: [PATCH] WIP support federation file loading (#19396)


 README                          |  13 +
 mellon/adapters.py              |  86 +++++--
 mellon/app_settings.py          |  20 +-
 mellon/federation_utils.py      | 231 +++++++++++++++++
 mellon/utils.py                 | 114 +++++---
 mellon/views.py                 |   4 +-
 setup.py                        |   1 +
 tests/conftest.py               |   7 +
 tests/dummy_md.xml              | 367 ++++++++++++++++++++++++++
 tests/federation-sample.xml     | 557 ++++++++++++++++++++++++++++++++++++++++
 tests/test_default_adapter.py   |  10 +-
 tests/test_federations_utils.py |  35 +++
 tests/test_sso_slo.py           |  88 ++++++-
 tests/test_utils.py             |  59 ++++-
 tests/utils.py                  |  10 +
 15 files changed, 1522 insertions(+), 80 deletions(-)
 create mode 100644 mellon/federation_utils.py
 create mode 100644 tests/dummy_md.xml
 create mode 100644 tests/federation-sample.xml
 create mode 100644 tests/test_federations_utils.py
README
82 82 
the absolute path toward a metadata file. All other keys are override
83 83 
of generic settings.
84 84 

  		




  
  85
  
    
MELLON_FEDERATIONS

  		




  
  86
  
    
------------------

  		




  
  87
  
    

  		




  
  88
  
    
A list of dictionaries, only one key 'FEDERATION' is mandatory in those

  		




  
  89
  
    
dictionaries. It should contain the local path or the remote URL for the

  		




  
  90
  
    
metadata file describing the SAML-based federation to be loaded in mellon. Both

  		




  
  91
  
    
relative and absolute paths are supported.

  		




  
  92
  
    
Additional parameters can be given as key/value pairs in the dictionaries, on

  		




  
  93
  
    
a similar basis as the aforementioned MELLON_IDENTITY_PROVIDERS config.

  		




  
  94
  
    
For each dictionary describing a federation, these parameters will apply to

  		




  
  95
  
    
any successfully-loaded provider belonging to that federation.

  		




  
  96
  
    
These parameters also override the global settings.

  		




  
  97
  
    

  		




  85
  98
  
    
MELLON_PUBLIC_KEYS

  		




  86
  99
  
    
------------------

  		




  87
  100
  
    

  		












  

    
      mellon/adapters.py
    
  





  9
  9
  
    
from django.core.exceptions import PermissionDenied

  		




  10
  10
  
    
from django.contrib import auth

  		




  11
  11
  
    
from django.contrib.auth.models import Group

  		




  
  12
  
    
from django.utils.text import slugify

  		




  12
  13
  
    

  		




  13
  14
  
    
from . import utils, app_settings, models

  		




  
  15
  
    
from mellon.federation_utils import idp_metadata_store, url2filename, \

  		




  
  16
  
    
        idp_metadata_extract_entity_id, idp_metadata_is_cached, \

  		




  
  17
  
    
        idp_metadata_load, idp_settings_store, idp_settings_load

  		




  14
  18
  
    

  		




  15
  19
  
    

  		




  16
  20
  
    
class UserCreationError(Exception):

  		




  ......




  23
  27
  
    

  		




  24
  28
  
    
    def get_idp(self, entity_id):

  		




  25
  29
  
    
        '''Find the first IdP definition matching entity_id'''

  		




  26
  
  
    
        for idp in self.get_idps():

  		




  27
  
  
    
            if entity_id == idp['ENTITY_ID']:

  		




  28
  
  
    
                return idp

  		




  
  30
  
    
        idp = None

  		




  
  31
  
    
        if idp_metadata_is_cached(entity_id):

  		




  
  32
  
    
            metadata_content = idp_metadata_load(entity_id)

  		




  
  33
  
    
            entity_id = idp_metadata_extract_entity_id(metadata_content)

  		




  
  34
  
    
            idp = {'METADATA': metadata_content,

  		




  
  35
  
    
                   'ENTITY_ID': entity_id}

  		




  
  36
  
    
        else:

  		




  
  37
  
    
            for extra_idp in self.get_identity_providers_setting():

  		




  
  38
  
    
                if extra_idp.get('ENTITY_ID') == entity_id or \

  		




  
  39
  
    
                        idp_metadata_extract_entity_id(extra_idp.get('METADATA')) == entity_id:

  		




  
  40
  
    
                    idp = extra_idp.copy()

  		




  
  41
  
    

  		




  
  42
  
    
        extra_idp_settings = idp_settings_load(entity_id)

  		




  
  43
  
    
        if extra_idp_settings and idp:

  		




  
  44
  
    
            idp.update(extra_idp_settings)

  		




  
  45
  
    
        return idp

  		




  29
  46
  
    

  		




  30
  47
  
    
    def get_identity_providers_setting(self):

  		




  31
  
  
    
        return app_settings.IDENTITY_PROVIDERS

  		




  
  48
  
    
        for federation_data in self.get_federations():

  		




  
  49
  
    
            if not isinstance(federation_data, dict) or \

  		




  
  50
  
    
                    'FEDERATION' not in federation_data:

  		




  
  51
  
    
                continue

  		




  
  52
  
    
            fed_extra_attrs = federation_data.copy()

  		




  
  53
  
    
            fed_content = fed_extra_attrs.pop('FEDERATION')

  		




  
  54
  
    
            fed_filepath, _ = utils.get_federation_metadata(fed_content)

  		




  
  55
  
    

  		




  
  56
  
    
            try:

  		




  
  57
  
    
                tree = ET.parse(fed_filepath)

  		




  
  58
  
    
                root = tree.getroot()

  		




  
  59
  
    
                for child in root:

  		




  
  60
  
    
                    provider = {}

  		




  
  61
  
    
                    entity_id = idp_metadata_extract_entity_id(ET.tostring(child))

  		




  
  62
  
    
                    if not entity_id:

  		




  
  63
  
    
                        continue

  		




  
  64
  
    
                    provider['METADATA'] = idp_metadata_store(ET.tostring(child))

  		




  
  65
  
    
                    provider.update({'ENTITY_ID': entity_id})

  		




  
  66
  
    
                    provider.update(fed_extra_attrs)

  		




  
  67
  
    
                    idp_settings_store(provider)

  		




  
  68
  
    
                    yield provider

  		




  
  69
  
    
            except:

  		




  
  70
  
    
                self.logger.error('Couldn\'t load federation metadata file %r',

  		




  
  71
  
    
                                  fed_filepath)

  		




  
  72
  
    
                continue

  		




  
  73
  
    

  		




  
  74
  
    
        for extra_provider in app_settings.IDENTITY_PROVIDERS:

  		




  
  75
  
    
            yield extra_provider

  		




  
  76
  
    

  		




  
  77
  
    
    def get_federations(self):

  		




  
  78
  
    
        for federation in getattr(app_settings, 'FEDERATIONS', []):

  		




  
  79
  
    
            yield federation

  		




  32
  80
  
    

  		




  33
  81
  
    
    def get_idps(self):

  		




  34
  82
  
    
        for i, idp in enumerate(self.get_identity_providers_setting()):

  		




  
  83
  
    
            entity_id = idp.get('ENTITY_ID')

  		




  35
  84
  
    
            if 'METADATA_URL' in idp and 'METADATA' not in idp:

  		




  36
  85
  
    
                verify_ssl_certificate = utils.get_setting(

  		




  37
  86
  
    
                    idp, 'VERIFY_SSL_CERTIFICATE')

  		




  ......




  43
  92
  
    
                        u'retrieval of metadata URL %r failed with error %s for %d-th idp',

  		




  44
  93
  
    
                        idp['METADATA_URL'], e, i)

  		




  45
  94
  
    
                    continue

  		




  46
  
  
    
                idp['METADATA'] = response.content

  		




  47
  
  
    
            elif 'METADATA' in idp:

  		




  48
  
  
    
                if idp['METADATA'].startswith('/'):

  		




  49
  
  
    
                    idp['METADATA'] = file(idp['METADATA']).read()

  		




  50
  
  
    
            else:

  		




  
  95
  
    
                md_content = response.content

  		




  
  96
  
    
                if not entity_id:

  		




  
  97
  
    
                    entity_id = idp_metadata_extract_entity_id(md_content)

  		




  
  98
  
    
                idp['METADATA'] = idp_metadata_store(md_content)

  		




  
  99
  
    
            elif not idp.get('METADATA'):

  		




  51
  100
  
    
                self.logger.error(u'missing METADATA or METADATA_URL in %d-th idp', i)

  		




  52
  101
  
    
                continue

  		




  53
  
  
    
            if 'ENTITY_ID' not in idp:

  		




  54
  
  
    
                try:

  		




  55
  
  
    
                    doc = ET.fromstring(idp['METADATA'])

  		




  56
  
  
    
                except (TypeError, ET.ParseError):

  		




  57
  
  
    
                    self.logger.error(u'METADATA of %d-th idp is invalid', i)

  		




  58
  
  
    
                    continue

  		




  59
  
  
    
                if doc.tag != '{%s}EntityDescriptor' % lasso.SAML2_METADATA_HREF:

  		




  60
  
  
    
                    self.logger.error(u'METADATA of %d-th idp has no EntityDescriptor root tag', i)

  		




  61
  
  
    
                    continue

  		




  62
  
  
    

  		




  63
  
  
    
                if not 'entityID' in doc.attrib:

  		




  64
  
  
    
                    self.logger.error(

  		




  65
  
  
    
                        u'METADATA of %d-th idp has no entityID attribute on its root tag', i)

  		




  66
  
  
    
                    continue

  		




  67
  
  
    
                idp['ENTITY_ID'] = doc.attrib['entityID']

  		




  
  102
  
    
            # load federation-specific configuration

  		




  
  103
  
    
            extra_idp_settings = idp_settings_load(entity_id)

  		




  
  104
  
    
            if extra_idp_settings:

  		




  
  105
  
    
                idp.update(idp_settings_load(entity_id))

  		




  68
  106
  
    
            yield idp

  		




  69
  107
  
    

  		




  70
  108
  
    
    def authorize(self, idp, saml_attributes):

  		












  

    
      mellon/app_settings.py
    
  





  36
  36
  
    
        'LOGIN_URL': 'mellon_login',

  		




  37
  37
  
    
        'LOGOUT_URL': 'mellon_logout',

  		




  38
  38
  
    
        'ARTIFACT_RESOLVE_TIMEOUT': 10.0,

  		




  
  39
  
    
        'FEDERATIONS': [],

  		




  39
  40
  
    
    }

  		




  40
  41
  
    

  		




  41
  42
  
    
    @property

  		




  
  43
  
    
    def FEDERATIONS(self):

  		




  
  44
  
    
        from django.conf import settings

  		




  
  45
  
    
        if settings.hasattr('MELLON_FEDERATIONS'):

  		




  
  46
  
    
            federations = settings.MELLON_FEDERATIONS

  		




  
  47
  
    
        if isinstance(federations, dict):

  		




  
  48
  
    
            federations = [federations]

  		




  
  49
  
    
        return federations

  		




  
  50
  
    

  		




  
  51
  
    
    @property

  		




  42
  52
  
    
    def IDENTITY_PROVIDERS(self):

  		




  43
  53
  
    
        from django.conf import settings

  		




  
  54
  
    
        idps = []

  		




  44
  55
  
    
        try:

  		




  45
  
  
    
            idps = settings.MELLON_IDENTITY_PROVIDERS

  		




  
  56
  
    
            if hasattr(settings, 'MELLON_IDENTITY_PROVIDERS'):

  		




  
  57
  
    
                idps = settings.MELLON_IDENTITY_PROVIDERS

  		




  
  58
  
    
            elif not hasattr(settings, 'MELLON_FEDERATIONS'):

  		




  
  59
  
    
                raise AttributeError

  		




  46
  60
  
    
        except AttributeError:

  		




  47
  61
  
    
            from django.core.exceptions import ImproperlyConfigured

  		




  48
  
  
    
            raise ImproperlyConfigured('The MELLON_IDENTITY_PROVIDERS setting is mandatory')

  		




  
  62
  
    
            raise ImproperlyConfigured('Either the MELLON_IDENTITY_PROVIDERS '

  		




  
  63
  
    
                                       'or the MELLON_FEDERATIONS settings '

  		




  
  64
  
    
                                       'are mandatory')

  		




  49
  65
  
    
        if isinstance(idps, dict):

  		




  50
  66
  
    
            idps = [idps]

  		




  51
  67
  
    
        return idps

  		












  

    
      mellon/federation_utils.py
    
  





  
  1
  
    
import fcntl

  		




  
  2
  
    
import json

  		




  
  3
  
    
import lasso

  		




  
  4
  
    
import logging

  		




  
  5
  
    
import tempfile

  		




  
  6
  
    
from datetime import timedelta

  		




  
  7
  
    

  		




  
  8
  
    
from django.utils.text import slugify

  		




  
  9
  
    
from datetime import datetime

  		




  
  10
  
    

  		




  
  11
  
    
import requests

  		




  
  12
  
    
from xml.etree import ElementTree as ET

  		




  
  13
  
    
import os

  		




  
  14
  
    
import hashlib

  		




  
  15
  
    
import os.path

  		




  
  16
  
    

  		




  
  17
  
    
from django.core.files.storage import default_storage

  		




  
  18
  
    

  		




  
  19
  
    

  		




  
  20
  
    
def truncate_unique(s, length=250):

  		




  
  21
  
    
    if len(s) < length:

  		




  
  22
  
    
        return s

  		




  
  23
  
    
    md5 = hashlib.md5(s.encode('ascii')).hexdigest()

  		




  
  24
  
    
    # we should be the first and last characters from the URL

  		




  
  25
  
    
    l = (length - len(md5)) / 2 - 2  # four additional characters

  		




  
  26
  
    
    assert l > 20

  		




  
  27
  
    
    return s[:l] + '...' + s[-l:] + '_' + md5

  		




  
  28
  
    

  		




  
  29
  
    

  		




  
  30
  
    
def url2filename(url):

  		




  
  31
  
    
    return truncate_unique(slugify(url), 230)

  		




  
  32
  
    

  		




  
  33
  
    

  		




  
  34
  
    
def load_federation_cache(url):

  		




  
  35
  
    
    logger = logging.getLogger(__name__)

  		




  
  36
  
    
    try:

  		




  
  37
  
    
        filename = url2filename(url)

  		




  
  38
  
    
        path = os.path.join('metadata-cache', filename)

  		




  
  39
  
    

  		




  
  40
  
    
        unix_path = default_storage.path(path)

  		




  
  41
  
    
        dirname = os.path.dirname(unix_path)

  		




  
  42
  
    
        if not os.path.exists(dirname):

  		




  
  43
  
    
            os.makedirs(dirname)

  		




  
  44
  
    
        f = open(unix_path, 'w')

  		




  
  45
  
    
        try:

  		




  
  46
  
    
            fcntl.lockf(f, fcntl.LOCK_EX | fcntl.LOCK_NB)

  		




  
  47
  
    
        except IOError:

  		




  
  48
  
    
            return

  		




  
  49
  
    
        else:

  		




  
  50
  
    
            with tempfile.NamedTemporaryFile(dir=os.path.dirname(unix_path), delete=False) as temp:

  		




  
  51
  
    
                try:

  		




  
  52
  
    
                    # increase modified time by one hour to prevent too many updates

  		




  
  53
  
    
                    st = os.stat(unix_path)

  		




  
  54
  
    
                    os.utime(unix_path, (st.st_atime, st.st_mtime + 3600))

  		




  
  55
  
    
                    response = requests.get(url)

  		




  
  56
  
    
                    response.raise_for_status()

  		




  
  57
  
    
                    temp.write(response.content)

  		




  
  58
  
    
                    temp.flush()

  		




  
  59
  
    
                    os.rename(temp.name, unix_path)

  		




  
  60
  
    
                except:

  		




  
  61
  
    
                    logger.error('Could\'nt fetch %r', url)

  		




  
  62
  
    
                    os.unlink(temp.name)

  		




  
  63
  
    
                finally:

  		




  
  64
  
    
                    fcntl.lockf(f, fcntl.LOCK_UN)

  		




  
  65
  
    
        finally:

  		




  
  66
  
    
            f.close()

  		




  
  67
  
    
    except OSError:

  		




  
  68
  
    
        logger.exception(u"could create the intermediary 'metadata-cache' "

  		




  
  69
  
    
                         "folder")

  		




  
  70
  
    
        return

  		




  
  71
  
    
    except:

  		




  
  72
  
    
        logger.exception(u'failed to load federation from %s', url)

  		




  
  73
  
    

  		




  
  74
  
    

  		




  
  75
  
    
def get_federation_from_url(url, update_cache=False):

  		




  
  76
  
    
    logger = logging.getLogger(__name__)

  		




  
  77
  
    
    filename = url2filename(url)

  		




  
  78
  
    
    filepath = os.path.join('metadata-cache', filename)

  		




  
  79
  
    
    if not default_storage.exists(filepath) or update_cache or \

  		




  
  80
  
    
            default_storage.created_time(filepath) < datetime.now() - timedelta(days=1):

  		




  
  81
  
    
        load_federation_cache(url)

  		




  
  82
  
    
    else:

  		




  
  83
  
    
        logger.warning('federation %s has not been loaded', url)

  		




  
  84
  
    
    return default_storage.path(filepath)

  		




  
  85
  
    

  		




  
  86
  
    

  		




  
  87
  
    
def idp_metadata_filepath(entity_id):

  		




  
  88
  
    
    filename = url2filename(entity_id)

  		




  
  89
  
    
    filepath = os.path.join('./metadata-cache', filename)

  		




  
  90
  
    
    return filepath

  		




  
  91
  
    

  		




  
  92
  
    

  		




  
  93
  
    
def idp_settings_filepath(entity_id):

  		




  
  94
  
    
    filename = url2filename(entity_id) + "_settings.json"

  		




  
  95
  
    
    filepath = os.path.join('./metadata-cache', filename)

  		




  
  96
  
    
    return filepath

  		




  
  97
  
    

  		




  
  98
  
    

  		




  
  99
  
    
def idp_metadata_is_cached(entity_id):

  		




  
  100
  
    
    filepath = idp_metadata_filepath(entity_id)

  		




  
  101
  
    
    if not default_storage.exists(filepath):

  		




  
  102
  
    
        return False

  		




  
  103
  
    
    return True

  		




  
  104
  
    

  		




  
  105
  
    

  		




  
  106
  
    
def idp_metadata_is_file(metadata):

  		




  
  107
  
    
    # XXX too restrictive (e.g. 'metadata/http-somemetadataserver-com-md00.xml'

  		




  
  108
  
    
    # could be a file too...)

  		




  
  109
  
    
    # On the opposite, `if "http://" in metadata or "https://" in metadata:" is

  		




  
  110
  
    
    # equally restrictive.

  		




  
  111
  
    
    # Using a URLValidator doesn't seem adequate either.

  		




  
  112
  
    
    if metadata.startswith('/') or metadata.startswith('./'):

  		




  
  113
  
    
        return True

  		




  
  114
  
    

  		




  
  115
  
    

  		




  
  116
  
    
def idp_metadata_needs_refresh(entity_id, update_cache=False):

  		




  
  117
  
    
    filepath = idp_metadata_filepath(entity_id)

  		




  
  118
  
    
    if not default_storage.exists(filepath) or update_cache or \

  		




  
  119
  
    
            default_storage.created_time(filepath) < datetime.now() - timedelta(days=1):

  		




  
  120
  
    
        return True

  		




  
  121
  
    
    return False

  		




  
  122
  
    

  		




  
  123
  
    

  		




  
  124
  
    
def idp_settings_needs_refresh(entity_id, update_cache=False):

  		




  
  125
  
    
    filepath = idp_settings_filepath(entity_id)

  		




  
  126
  
    
    if not default_storage.exists(filepath) or update_cache or \

  		




  
  127
  
    
            default_storage.created_time(filepath) < datetime.now() - timedelta(days=1):

  		




  
  128
  
    
        return True

  		




  
  129
  
    
    return False

  		




  
  130
  
    

  		




  
  131
  
    

  		




  
  132
  
    
def idp_metadata_store(metadata_content):

  		




  
  133
  
    
    entity_id = idp_metadata_extract_entity_id(metadata_content)

  		




  
  134
  
    
    if not entity_id:

  		




  
  135
  
    
        return

  		




  
  136
  
    
    logger = logging.getLogger(__name__)

  		




  
  137
  
    
    filepath = idp_metadata_filepath(entity_id)

  		




  
  138
  
    

  		




  
  139
  
    
    dirname = os.path.dirname(filepath)

  		




  
  140
  
    
    if not default_storage.exists(dirname):

  		




  
  141
  
    
        os.makedirs(default_storage.path(dirname))

  		




  
  142
  
    

  		




  
  143
  
    
    if idp_metadata_needs_refresh(entity_id):

  		




  
  144
  
    
        with open(default_storage.path(filepath), 'w') as f:

  		




  
  145
  
    
            try:

  		




  
  146
  
    
                fcntl.lockf(f, fcntl.LOCK_EX | fcntl.LOCK_NB)

  		




  
  147
  
    
                f.write(metadata_content)

  		




  
  148
  
    
                fcntl.lockf(f, fcntl.LOCK_UN)

  		




  
  149
  
    
            except:

  		




  
  150
  
    
                logger.error('Couldn\'t store metadata for EntityID %r',

  		




  
  151
  
    
                        entity_id)

  		




  
  152
  
    
                return

  		




  
  153
  
    
    return default_storage.path(filepath)

  		




  
  154
  
    

  		




  
  155
  
    

  		




  
  156
  
    
def idp_metadata_load(entity_id):

  		




  
  157
  
    
    logger = logging.getLogger(__name__)

  		




  
  158
  
    
    filepath = idp_metadata_filepath(entity_id)

  		




  
  159
  
    
    if default_storage.exists(filepath):

  		




  
  160
  
    
        logger.info('Loading metadata for EntityID %r', entity_id)

  		




  
  161
  
    
        with open(default_storage.path(filepath), 'r') as f:

  		




  
  162
  
    
            return f.read()

  		




  
  163
  
    
    else:

  		




  
  164
  
    
        logger.warning('No metadata file for EntityID %r', entity_id)

  		




  
  165
  
    

  		




  
  166
  
    

  		




  
  167
  
    
def idp_settings_store(idp):

  		




  
  168
  
    
    """

  		




  
  169
  
    
    Stores an IDP settings when loaded from a federation.

  		




  
  170
  
    
    """

  		




  
  171
  
    
    logger = logging.getLogger(__name__)

  		




  
  172
  
    
    entity_id = idp.get('ENTITY_ID')

  		




  
  173
  
    
    filepath = idp_settings_filepath(entity_id)

  		




  
  174
  
    
    idp_settings = {}

  		




  
  175
  
    

  		




  
  176
  
    
    if not entity_id:

  		




  
  177
  
    
        return

  		




  
  178
  
    

  		




  
  179
  
    
    dirname = os.path.dirname(filepath)

  		




  
  180
  
    
    if not default_storage.exists(dirname):

  		




  
  181
  
    
        os.makedirs(default_storage.path(dirname))

  		




  
  182
  
    

  		




  
  183
  
    
    for key, value in idp.items():

  		




  
  184
  
    
        if key not in ('METADATA', 'ENTITY_ID'):

  		




  
  185
  
    
            idp_settings.update({key: value})

  		




  
  186
  
    

  		




  
  187
  
    
    if idp_settings_needs_refresh(entity_id) and idp_settings:

  		




  
  188
  
    
        with open(default_storage.path(filepath), 'w') as f:

  		




  
  189
  
    
            try:

  		




  
  190
  
    
                fcntl.lockf(f, fcntl.LOCK_EX | fcntl.LOCK_NB)

  		




  
  191
  
    
                f.write(json.dumps(idp_settings))

  		




  
  192
  
    
                fcntl.lockf(f, fcntl.LOCK_UN)

  		




  
  193
  
    
            except:

  		




  
  194
  
    
                logger.error('Couldn\'t store settings for EntityID %r',

  		




  
  195
  
    
                        entity_id)

  		




  
  196
  
    

  		




  
  197
  
    

  		




  
  198
  
    
def idp_settings_load(entity_id):

  		




  
  199
  
    
    logger = logging.getLogger(__name__)

  		




  
  200
  
    
    filepath = idp_settings_filepath(entity_id)

  		




  
  201
  
    
    if default_storage.exists(filepath):

  		




  
  202
  
    
        logger.info('Loading JSON settings for EntityID %r', entity_id)

  		




  
  203
  
    
        with open(default_storage.path(filepath), 'r') as f:

  		




  
  204
  
    
            try:

  		




  
  205
  
    
                idp_settings = json.loads(f.read())

  		




  
  206
  
    
            except:

  		




  
  207
  
    
                logger.warning('Couldn\'t load JSON settings for EntityID %r',

  		




  
  208
  
    
                        entity_id)

  		




  
  209
  
    
            else:

  		




  
  210
  
    
                return idp_settings

  		




  
  211
  
    
    else:

  		




  
  212
  
    
        logger.warning('No JSON settings file for EntityID %r', entity_id)

  		




  
  213
  
    

  		




  
  214
  
    

  		




  
  215
  
    
def idp_metadata_extract_entity_id(metadata_content):

  		




  
  216
  
    
    logger = logging.getLogger(__name__)

  		




  
  217
  
    
    try:

  		




  
  218
  
    
        doc = ET.fromstring(metadata_content)

  		




  
  219
  
    
    except (TypeError, ET.ParseError):

  		




  
  220
  
    
        logger.error(u'METADATA of idp %r is invalid', metadata_content)

  		




  
  221
  
    
        return

  		




  
  222
  
    
    if doc.tag != '{%s}EntityDescriptor' % lasso.SAML2_METADATA_HREF:

  		




  
  223
  
    
        logger.error(u'METADATA of idp %r has no EntityDescriptor root tag',

  		




  
  224
  
    
                metadata_content)

  		




  
  225
  
    
        return

  		




  
  226
  
    
    if not 'entityID' in doc.attrib:

  		




  
  227
  
    
        logger.error(

  		




  
  228
  
    
                u'METADATA of idp %r has no entityID attribute on its root tag',

  		




  
  229
  
    
                metadata_content)

  		




  
  230
  
    
        return

  		




  
  231
  
    
    return doc.attrib['entityID']

  		












  

    
      mellon/utils.py
    
  





  5
  5
  
    
import isodate

  		




  6
  6
  
    

  		




  7
  7
  
    
from django.contrib import auth

  		




  
  8
  
    
from django.core.exceptions import ValidationError

  		




  8
  9
  
    
from django.core.urlresolvers import reverse

  		




  
  10
  
    
from django.core.validators import URLValidator

  		




  9
  11
  
    
from django.template.loader import render_to_string

  		




  
  12
  
    
from django.utils.text import slugify

  		




  10
  13
  
    
from django.utils.timezone import make_aware, now, make_naive, is_aware, get_default_timezone

  		




  11
  14
  
    
from django.conf import settings

  		




  12
  15
  
    
from django.utils.six.moves.urllib.parse import urlparse

  		




  13
  16
  
    
import lasso

  		




  14
  17
  
    

  		




  15
  18
  
    
from . import app_settings

  		




  
  19
  
    
from federation_utils import get_federation_from_url, idp_metadata_is_file

  		




  16
  20
  
    

  		




  17
  21
  
    

  		




  18
  22
  
    
def create_metadata(request):

  		




  ......




  48
  52
  
    
def create_server(request):

  		




  49
  53
  
    
    logger = logging.getLogger(__name__)

  		




  50
  54
  
    
    root = request.build_absolute_uri('/')

  		




  51
  
  
    
    cache = getattr(settings, '_MELLON_SERVER_CACHE', {})

  		




  52
  
  
    
    if root not in cache:

  		




  53
  
  
    
        metadata = create_metadata(request)

  		




  54
  
  
    
        if app_settings.PRIVATE_KEY:

  		




  55
  
  
    
            private_key = app_settings.PRIVATE_KEY

  		




  56
  
  
    
            private_key_password = app_settings.PRIVATE_KEY_PASSWORD

  		




  57
  
  
    
        elif app_settings.PRIVATE_KEYS:

  		




  58
  
  
    
            private_key = app_settings.PRIVATE_KEYS[0]

  		




  59
  
  
    
            private_key_password = None

  		




  60
  
  
    
            if isinstance(private_key, (tuple, list)):

  		




  61
  
  
    
                private_key_password = private_key[1]

  		




  62
  
  
    
                private_key = private_key[0]

  		




  63
  
  
    
        else:  # no signature

  		




  64
  
  
    
            private_key = None

  		




  65
  
  
    
            private_key_password = None

  		




  66
  
  
    
        server = lasso.Server.newFromBuffers(metadata, private_key_content=private_key,

  		




  67
  
  
    
                                             private_key_password=private_key_password)

  		




  68
  
  
    
        server.setEncryptionPrivateKeyWithPassword(private_key, private_key_password)

  		




  69
  
  
    
        private_keys = app_settings.PRIVATE_KEYS

  		




  70
  
  
    
        # skip first key if it is already loaded

  		




  71
  
  
    
        if not app_settings.PRIVATE_KEY:

  		




  72
  
  
    
            private_keys = app_settings.PRIVATE_KEYS[1:]

  		




  73
  
  
    
        for key in private_keys:

  		




  74
  
  
    
            password = None

  		




  75
  
  
    
            if isinstance(key, (tuple, list)):

  		




  76
  
  
    
                password = key[1]

  		




  77
  
  
    
                key = key[0]

  		




  78
  
  
    
            server.setEncryptionPrivateKeyWithPassword(key, password)

  		




  79
  
  
    
        for idp in get_idps():

  		




  80
  
  
    
            try:

  		




  81
  
  
    
                server.addProviderFromBuffer(lasso.PROVIDER_ROLE_IDP, idp['METADATA'])

  		




  82
  
  
    
            except lasso.Error as e:

  		




  83
  
  
    
                logger.error(u'bad metadata in idp %r', idp['ENTITY_ID'])

  		




  84
  
  
    
                logger.debug(u'lasso error: %s', e)

  		




  85
  
  
    
                continue

  		




  86
  
  
    
        cache[root] = server

  		




  87
  
  
    
        settings._MELLON_SERVER_CACHE = cache

  		




  88
  
  
    
    return settings._MELLON_SERVER_CACHE.get(root)

  		




  
  55
  
    
    metadata = create_metadata(request)

  		




  
  56
  
    
    if app_settings.PRIVATE_KEY:

  		




  
  57
  
    
        private_key = app_settings.PRIVATE_KEY

  		




  
  58
  
    
        private_key_password = app_settings.PRIVATE_KEY_PASSWORD

  		




  
  59
  
    
    elif app_settings.PRIVATE_KEYS:

  		




  
  60
  
    
        private_key = app_settings.PRIVATE_KEYS[0]

  		




  
  61
  
    
        private_key_password = None

  		




  
  62
  
    
        if isinstance(private_key, (tuple, list)):

  		




  
  63
  
    
            private_key_password = private_key[1]

  		




  
  64
  
    
            private_key = private_key[0]

  		




  
  65
  
    
    else:  # no signature

  		




  
  66
  
    
        private_key = None

  		




  
  67
  
    
        private_key_password = None

  		




  
  68
  
    
    server = lasso.Server.newFromBuffers(metadata, private_key_content=private_key,

  		




  
  69
  
    
                                         private_key_password=private_key_password)

  		




  
  70
  
    
    server.setEncryptionPrivateKeyWithPassword(private_key, private_key_password)

  		




  
  71
  
    
    private_keys = app_settings.PRIVATE_KEYS

  		




  
  72
  
    
    # skip first key if it is already loaded

  		




  
  73
  
    
    if not app_settings.PRIVATE_KEY:

  		




  
  74
  
    
        private_keys = app_settings.PRIVATE_KEYS[1:]

  		




  
  75
  
    
    for key in private_keys:

  		




  
  76
  
    
        password = None

  		




  
  77
  
    
        if isinstance(key, (tuple, list)):

  		




  
  78
  
    
            password = key[1]

  		




  
  79
  
    
            key = key[0]

  		




  
  80
  
    
        server.setEncryptionPrivateKeyWithPassword(key, password)

  		




  
  81
  
    
    for idp in get_idps():

  		




  
  82
  
    
        try:

  		




  
  83
  
    
            metadata = idp.get('METADATA')

  		




  
  84
  
    
            if idp_metadata_is_file(metadata):

  		




  
  85
  
    
                with open(metadata, 'r') as f:

  		




  
  86
  
    
                    metadata = f.read()

  		




  
  87
  
    
            server.addProviderFromBuffer(lasso.PROVIDER_ROLE_IDP, metadata)

  		




  
  88
  
    
        except lasso.Error, e:

  		




  
  89
  
    
            logger.error(u'bad metadata in idp %r', idp)

  		




  
  90
  
    
            logger.debug(u'lasso error: %s', e)

  		




  
  91
  
    
        except IOError, e:

  		




  
  92
  
    
            logger.warning('No such metadata file: %r', metadata)

  		




  
  93
  
    
            continue

  		




  
  94
  
    
    return server

  		




  
  95
  
    

  		




  
  96
  
    

  		




  
  97
  
    
def get_federation_metadata(federation):

  		




  
  98
  
    
    logger = logging.getLogger(__name__)

  		




  
  99
  
    
    fedmd = None

  		




  
  100
  
    
    pemcert = None

  		




  
  101
  
    
    if (isinstance(federation, tuple) and len(federation) == 2):

  		




  
  102
  
    
        logger.info('Loading local cert-based federation %r',

  		




  
  103
  
    
                    federation)

  		




  
  104
  
    
        if federation[1].endswith('.pem'):

  		




  
  105
  
    
            fedmd = federation[0]

  		




  
  106
  
    
            pemcert = federation[1]

  		




  
  107
  
    
    else:

  		




  
  108
  
    
        urlval = URLValidator()

  		




  
  109
  
    
        try:

  		




  
  110
  
    
            urlval(federation)

  		




  
  111
  
    
        except ValidationError as e:

  		




  
  112
  
    
            logger.info('Loading file-based federation %s',

  		




  
  113
  
    
                        federation)

  		




  
  114
  
    
            fedmd = federation

  		




  
  115
  
    
        else:

  		




  
  116
  
    
            logger.info('Fetching and loading url-based federation %s',

  		




  
  117
  
    
                        federation)

  		




  
  118
  
    
            fedmd = get_federation_from_url(federation)

  		




  
  119
  
    
    return (fedmd, pemcert)

  		




  89
  120
  
    

  		




  90
  121
  
    

  		




  91
  122
  
    
def create_login(request):

  		




  ......




  112
  143
  
    
                yield idp

  		




  113
  144
  
    

  		




  114
  145
  
    

  		




  
  146
  
    
def get_federations():

  		




  
  147
  
    
    for adapter in get_adapters():

  		




  
  148
  
    
        if hasattr(adapter, 'get_federations'):

  		




  
  149
  
    
            for federation in adapter.get_federations():

  		




  
  150
  
    
                yield federation

  		




  
  151
  
    

  		




  
  152
  
    

  		




  115
  153
  
    
def flatten_datetime(d):

  		




  116
  154
  
    
    d = d.copy()

  		




  117
  155
  
    
    for key, value in d.iteritems():

  		












  

    
      mellon/views.py
    
  





  342
  342
  
    
        if idp is None:

  		




  343
  343
  
    
            return HttpResponseBadRequest('no idp found')

  		




  344
  344
  
    
        self.profile = login = utils.create_login(request)

  		




  345
  
  
    
        self.log.debug('authenticating to %r', idp['ENTITY_ID'])

  		




  
  345
  
    
        self.log.debug('authenticating to %r', idp.get('ENTITY_ID') or idp['METADATA'])

  		




  346
  346
  
    
        try:

  		




  347
  
  
    
            login.initAuthnRequest(idp['ENTITY_ID'], lasso.HTTP_METHOD_REDIRECT)

  		




  
  347
  
    
            login.initAuthnRequest(idp.get('ENTITY_ID'), lasso.HTTP_METHOD_REDIRECT)

  		




  348
  348
  
    
            authn_request = login.request

  		




  349
  349
  
    
            # configure NameID policy

  		




  350
  350
  
    
            policy = authn_request.nameIdPolicy

  		












  

    
      setup.py
    
  





  94
  94
  
    
          'django>=1.5,<2.0',

  		




  95
  95
  
    
          'requests',

  		




  96
  96
  
    
          'isodate',

  		




  
  97
  
    
          'pytz',

  		




  97
  98
  
    
      ],

  		




  98
  99
  
    
      setup_requires=[

  		




  99
  100
  
    
          'django>=1.5,<2.0',

  		












  

    
      tests/conftest.py
    
  





  42
  42
  
    
    caplog.handler.stream = py.io.TextIO()

  		




  43
  43
  
    
    caplog.handler.records = []

  		




  44
  44
  
    
    return caplog

  		




  
  45
  
    

  		




  
  46
  
    

  		




  
  47
  
    
# XXX temporary workaround

  		




  
  48
  
    
#     non-federated IdPs shouldn't have their MD cached

  		




  
  49
  
    
@pytest.fixture(autouse=True)

  		




  
  50
  
    
def mellon_settings(settings, tmpdir):

  		




  
  51
  
    
        settings.MEDIA_ROOT = str(tmpdir)

  		












  

    
      tests/dummy_md.xml
    
  





  
  1
  
    
<?xml version="1.0" encoding="UTF-8" standalone="no"?><md:EntitiesDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:pyff="http://pyff.io/NS" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xrd="http://docs.oasis-open.org/ns/xri/xrd-1.0" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="_20171018T113001Z" Name="https://federation.renater.fr/" cacheDuration="PT1H" validUntil="2017-10-27T11:30:01Z"><ds:Signature>

  		




  
  2
  
    
<ds:SignedInfo>

  		




  
  3
  
    
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

  		




  
  4
  
    
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>

  		




  
  5
  
    
<ds:Reference URI="">

  		




  
  6
  
    
<ds:Transforms>

  		




  
  7
  
    
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>

  		




  
  8
  
    
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

  		




  
  9
  
    
</ds:Transforms>

  		




  
  10
  
    
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>

  		




  
  11
  
    
<ds:DigestValue>JKdLdd5yGvkFdb1fCAByMMnurIKYhZepRouZfOjIUrg=</ds:DigestValue>

  		




  
  12
  
    
</ds:Reference>

  		




  
  13
  
    
</ds:SignedInfo>

  		




  
  14
  
    
<ds:SignatureValue>

  		




  
  15
  
    
OTexfi8c63TsP1V9j5m6digA2NomUfqBtT8pPKhwdqEDQS5qLh6fxvT+wWkP6JaIhkP8nxwpbArl

  		




  
  16
  
    
7cUHkRv5ibZzcknIAjXYMhsSTtFQUq89OMcDHtZHG54jiKyHPhu2+XEbvv6DsAYanYC6SHEnGjNG

  		




  
  17
  
    
opnOEUB2XqeycsvvTQQIuWZEoABTVcKYyk2CW7Ij5EUmPOAPiidtbt8lzrtkV6dwLbkyoEbChAyj

  		




  
  18
  
    
emrL/oS01aJgT9sQoJxR8lyRMGiZ/BwQqYTareiKwOXLPdGThzsfZXD8de9T1xuysILaAM7sHPJV

  		




  
  19
  
    
QfrQJm80Zo2MM/GnhJTO9rc4m3kRnRhqmA6qMw==

  		




  
  20
  
    
</ds:SignatureValue>

  		




  
  21
  
    
<ds:KeyInfo>

  		




  
  22
  
    
<ds:KeyValue>

  		




  
  23
  
    
<ds:RSAKeyValue>

  		




  
  24
  
    
<ds:Modulus>

  		




  
  25
  
    
71+vTf66BPgYUF7sm4T++W69qMVyGQn9wNqpBLc6sp53eq/JRTOUD26Yehjsld5qN52Bv2r5QG7o

  		




  
  26
  
    
4VU123akXUYzupvq1f+tmF9NwYa7MPEPFzCzJHhNXjZNRxcsW1WLW34fhQCm0oak3oSPoNo5qeGi

  		




  
  27
  
    
jNsTSkgSt1mPH0P8d95af2VJnT6zbrclxvH4emqpT9oGLsWqKWLlIbZ7u1PUjuNVwLHuj909/apm

  		




  
  28
  
    
C13RBIpV52fey4qey34bnRHdCTknZeN/TJLTJ9hMWzz9TbdjfIFaiF7MeY+OYRXzUJeQuHHMu/2I

  		




  
  29
  
    
emkoR26mYi6irvmx8AdPcPCwcRKw2Ca4xLhbNw==

  		




  
  30
  
    
</ds:Modulus>

  		




  
  31
  
    
<ds:Exponent>AQAB</ds:Exponent>

  		




  
  32
  
    
</ds:RSAKeyValue>

  		




  
  33
  
    
</ds:KeyValue>

  		




  
  34
  
    
<ds:X509Data>

  		




  
  35
  
    
<ds:X509Certificate>

  		




  
  36
  
    
MIIC9zCCAd+gAwIBAgIEfe6j3jANBgkqhkiG9w0BAQsFADAsMSowKAYDVQQDEyFTQU1MIE1ldGFk

  		




  
  37
  
    
YXRhIFNpZ25pbmcgQ2VydGlmaWNhdGUwHhcNMTYwNzI5MDczNjM4WhcNMjYwNjA3MDczNjM4WjAs

  		




  
  38
  
    
MSowKAYDVQQDEyFTQU1MIE1ldGFkYXRhIFNpZ25pbmcgQ2VydGlmaWNhdGUwggEiMA0GCSqGSIb3

  		




  
  39
  
    
DQEBAQUAA4IBDwAwggEKAoIBAQDvX69N/roE+BhQXuybhP75br2oxXIZCf3A2qkEtzqynnd6r8lF

  		




  
  40
  
    
M5QPbph6GOyV3mo3nYG/avlAbujhVTXbdqRdRjO6m+rV/62YX03Bhrsw8Q8XMLMkeE1eNk1HFyxb

  		




  
  41
  
    
VYtbfh+FAKbShqTehI+g2jmp4aKM2xNKSBK3WY8fQ/x33lp/ZUmdPrNutyXG8fh6aqlP2gYuxaop

  		




  
  42
  
    
YuUhtnu7U9SO41XAse6P3T39qmYLXdEEilXnZ97Lip7LfhudEd0JOSdl439MktMn2ExbPP1Nt2N8

  		




  
  43
  
    
gVqIXsx5j45hFfNQl5C4ccy7/Yh6aShHbqZiLqKu+bHwB09w8LBxErDYJrjEuFs3AgMBAAGjITAf

  		




  
  44
  
    
MB0GA1UdDgQWBBTT88iZzWO+hN9SBUkpx871lmTuLTANBgkqhkiG9w0BAQsFAAOCAQEABoPpODry

  		




  
  45
  
    
XwiM5jjtqk6veR02FevCKHpZP6Od7Kqcfs6lg5LcQmGUOgpmW3Gg4UMjBYkgARsT2Nsnah1CJqa8

  		




  
  46
  
    
cjvv8p5KEIhY0hVS8iMJnrb3PDeiFSeP4xSfct/6z/ebV4+QFl22bsm2zpAC6BpFz8+IJ/jAmQzT

  		




  
  47
  
    
Vob4MAUeQPnwwzm3xz6yanLZx7BK5cfrTCa+hrarNQCboRjXPwiejF8WRCxpgRHH6yNs5QH/Z6o5

  		




  
  48
  
    
e3tUP7uEpn2Ob+kcLsEMGb9DghkoDAgkHCOZeTy+7hgxt+/T94cLTa58gVtvEOnd0GuL7Vfd+IVd

  		




  
  49
  
    
XgSard8RfR3OyZlf6M4aSGQA73sskQ==

  		




  
  50
  
    
</ds:X509Certificate>

  		




  
  51
  
    
</ds:X509Data>

  		




  
  52
  
    
</ds:KeyInfo>

  		




  
  53
  
    
</ds:Signature><md:EntityDescriptor entityID="https://aishib.agropolis.fr/idp/shibboleth">

  		




  
  54
  
    
			<md:Extensions>

  		




  
  55
  
    
				<mdrpi:RegistrationInfo registrationAuthority="https://federation.renater.fr/" registrationInstant="2013-06-06T11:49:20Z">

  		




  
  56
  
    
					<mdrpi:RegistrationPolicy xml:lang="en">https://services.renater.fr/federation/en/metadata_registration_practice_statement</mdrpi:RegistrationPolicy>

  		




  
  57
  
    
				</mdrpi:RegistrationInfo>

  		




  
  58
  
    
			</md:Extensions>

  		




  
  59
  
    
		<md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:2.0:protocol">

  		




  
  60
  
    
			<md:Extensions>

  		




  
  61
  
    
    				<shibmd:Scope regexp="false">agropolis.fr</shibmd:Scope>

  		




  
  62
  
    

  		




  
  63
  
    
			    <mdui:UIInfo>

  		




  
  64
  
    

  		




  
  65
  
    
			      <mdui:DisplayName xml:lang="en">Agropolis International</mdui:DisplayName>

  		




  
  66
  
    

  		




  
  67
  
    
			      <mdui:Logo height="16" width="16">data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAAAQAAAAEABcxq3DAAACPUlEQVQoz21SPW8TQRR8u7d3ju34Er6UCHACRqK4Bjk0oDSEjiYSBQVS8k9AkWgp+AuUASGEaCASkoPcgARVMF8iTnxJwMFJfL47397u3u6jsGVFwLzmFTN6ozdDEBEAAOD4kiRJsVgkhMA/YMfZzc3NVstnzGq1/KXlJfgf2Ii9XquVZ2YWbi5Io4MsbfPeZK4wRm0AOH6KICIivq2tV6/O5cYLHztbW9FvYTKuZaLk7PjpW+UrJXtspCHGmGazCQBnZ8svtj/0tbAINYhcy1DyThpRhHtztyedwkBDAWBnZ6dSqbzZ+7THu0IraTJplDSZ0JnQ2Y+482jj1cgSRUTHdrhW9fa3SKaxErFKIyUiKaIsjVQaKf5s631HxP1+X2vNwjB0J9zd+OgnD044Ra4lI5ZBw7XqyeRQREciaqe9xoE/K/OFfIENnqBM1uZBqlWBOYxQjYZnqieTThru8zCU3AASIAjIXNellGLePkjCUPICy1mEDAShSg7SqCsTBtQ7WfY3vlarVUYpdUsuAs5PXV7dfpe3HEYtjSbNZJwJoRUi3rl4fSrvfufctm0ySA0RD0V84+WDL1EbCCDCYIDApeKZ+uKK6faDIPA8jw7jIORUbry2eH+5Mu8ARTSAkCPW3QvX6osrE+B8bjQ8zxu2aACDaIwxxuzzsLbbePj88a8k0Mb4vr/2ei3LMoOIiGRU0iGGVuDp6pNz5fNSiKnpac/zgAABMuzSXwIggIjdbrdUKjHGYGQaAAD+AJBJecXxnEvWAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE1LTA3LTIwVDEwOjQ4OjE1KzAyOjAwpWiGMQAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxNS0wNy0yMFQxMDo0ODoxNSswMjowMNQ1Po0AAAAASUVORK5CYII=</mdui:Logo>

  		




  
  68
  
    
			      <mdui:InformationURL xml:lang="fr">http://www.agropolis.fr</mdui:InformationURL>

  		




  
  69
  
    

  		




  
  70
  
    
          		      <mdui:DisplayName xml:lang="fr">Agropolis International</mdui:DisplayName>

  		




  
  71
  
    

  		




  
  72
  
    
      			    </mdui:UIInfo>

  		




  
  73
  
    
			</md:Extensions>

  		




  
  74
  
    
				<md:KeyDescriptor use="signing">

  		




  
  75
  
    
<ds:KeyInfo>

  		




  
  76
  
    

  		




  
  77
  
    
					  <ds:X509Data>

  		




  
  78
  
    
					    <ds:X509Certificate>

  		




  
  79
  
    
					      MIIDNzCCAh+gAwIBAgIUYY3sGXwChkj2CRy6QFDvkdj2zlAwDQYJKoZIhvcNAQEF

  		




  
  80
  
    
BQAwHjEcMBoGA1UEAxMTYWlzaGliLmFncm9wb2xpcy5mcjAeFw0xMzA1MTUxMzM3

  		




  
  81
  
    
MTJaFw0zMzA1MTUxMzM3MTJaMB4xHDAaBgNVBAMTE2Fpc2hpYi5hZ3JvcG9saXMu

  		




  
  82
  
    
ZnIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCxrDy6lrhIBjcxv16n

  		




  
  83
  
    
4UJ2cEMYPO4wSmfDwhO6feoSIEuIblYRHE2nQKirMokwD6seF4rbDHyxLXg/ColL

  		




  
  84
  
    
VLv+0CJteIOZjSCgSN90WzQRrC1Ex5sJfPu6yPEXvW8H1906gEg6ok8rlCIHRGfE

  		




  
  85
  
    
15pHK5eqxQS5f2n8c2t/Uk33/FBj79/hb3Cd7vE4mdlvReD3AFswC0lV4bPmj3Ka

  		




  
  86
  
    
KUuMj9xwipwnfWCu6p2/ZJF4M3ADU5grXHJ2Vqmd8DWm5raaObKjYwJddbRBByI8

  		




  
  87
  
    
bJJLIwAQQmX4Dh4hf1QKlf2oqWPWVQxLQp0erL1U8IWmj1RG8TTH9xOJl6kkEhYq

  		




  
  88
  
    
Z2gfAgMBAAGjbTBrMEoGA1UdEQRDMEGCE2Fpc2hpYi5hZ3JvcG9saXMuZnKGKmh0

  		




  
  89
  
    
dHBzOi8vYWlzaGliLmFncm9wb2xpcy5mci9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4E

  		




  
  90
  
    
FgQU9A7iQ8Qo+t2JCpKuOOV9YBoYs4MwDQYJKoZIhvcNAQEFBQADggEBAG0LOW6I

  		




  
  91
  
    
F+M8n2NpzyQjfVCJCA6QhWjbXrfemiPJFZGZZb2dVmHof4yCpCUYgHOBoZaXPOlB

  		




  
  92
  
    
nLYsUWvFZ6V2GELZpLHzHSSrYidieW07qQkh1DwcIYpvtZgLviOtT/tCEGsk925f

  		




  
  93
  
    
DUoGdeIqpqt54WZcW9+TbKicvjg3JT4BFOQ17bFNwPW+YjTbvsWYxen+e0mRp4vM

  		




  
  94
  
    
V0yMu2f3bccVhePASSZGL3yod3sJ1dPvlrJO9c35BekhtirolVjZqMQ0AYPVifua

  		




  
  95
  
    
yIU0dWXsZkAOcBL9kZFbJcYRUIxMgvp8U2Zdv1+ZlwOyXnnWDOOh9wjuT7FAyObU

  		




  
  96
  
    
ChvjHlgZHkvLwJI=

  		




  
  97
  
    
					    </ds:X509Certificate>

  		




  
  98
  
    
					  </ds:X509Data>

  		




  
  99
  
    

  		




  
  100
  
    
					</ds:KeyInfo>

  		




  
  101
  
    
				</md:KeyDescriptor>

  		




  
  102
  
    

  		




  
  103
  
    

  		




  
  104
  
    

  		




  
  105
  
    

  		




  
  106
  
    

  		




  
  107
  
    
			<md:NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</md:NameIDFormat>

  		




  
  108
  
    
			<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

  		




  
  109
  
    

  		




  
  110
  
    

  		




  
  111
  
    
			<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://aishib.agropolis.fr/idp/profile/SAML2/POST/SSO"/>

  		




  
  112
  
    

  		




  
  113
  
    
	        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://aishib.agropolis.fr/idp/profile/SAML2/Redirect/SSO"/>

  		




  
  114
  
    

  		




  
  115
  
    

  		




  
  116
  
    
			<md:SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://aishib.agropolis.fr/idp/profile/Shibboleth/SSO"/>

  		




  
  117
  
    

  		




  
  118
  
    

  		




  
  119
  
    
		</md:IDPSSODescriptor>

  		




  
  120
  
    

  		




  
  121
  
    

  		




  
  122
  
    

  		




  
  123
  
    
		<md:Organization>

  		




  
  124
  
    

  		




  
  125
  
    
			<md:OrganizationName xml:lang="en">Agropolis International</md:OrganizationName>

  		




  
  126
  
    
			<md:OrganizationDisplayName xml:lang="en">Agropolis International</md:OrganizationDisplayName>

  		




  
  127
  
    
			<md:OrganizationURL xml:lang="en">http://www.agropolis.fr</md:OrganizationURL>

  		




  
  128
  
    

  		




  
  129
  
    
		</md:Organization>

  		




  
  130
  
    

  		




  
  131
  
    

  		




  
  132
  
    

  		




  
  133
  
    
			    <md:ContactPerson contactType="technical">

  		




  
  134
  
    
				 <md:SurName>Jean Cerda</md:SurName>

  		




  
  135
  
    
				 <md:EmailAddress>cerda@agropolis.fr</md:EmailAddress>

  		




  
  136
  
    
		        </md:ContactPerson>

  		




  
  137
  
    

  		




  
  138
  
    

  		




  
  139
  
    

  		




  
  140
  
    
			    <md:ContactPerson contactType="technical">

  		




  
  141
  
    
				 <md:SurName>Jean-Pierre  Allano</md:SurName>

  		




  
  142
  
    
				 <md:EmailAddress>allano@agropolis.fr</md:EmailAddress>

  		




  
  143
  
    
		        </md:ContactPerson>

  		




  
  144
  
    

  		




  
  145
  
    

  		




  
  146
  
    

  		




  
  147
  
    

  		




  
  148
  
    
	</md:EntityDescriptor><md:EntityDescriptor entityID="https://ambre.vetagro-sup.fr/idp/shibboleth">

  		




  
  149
  
    
			<md:Extensions>

  		




  
  150
  
    
				<mdrpi:RegistrationInfo registrationAuthority="https://federation.renater.fr/" registrationInstant="2013-01-14T16:11:53Z">

  		




  
  151
  
    
					<mdrpi:RegistrationPolicy xml:lang="en">https://services.renater.fr/federation/en/metadata_registration_practice_statement</mdrpi:RegistrationPolicy>

  		




  
  152
  
    
				</mdrpi:RegistrationInfo>

  		




  
  153
  
    
			</md:Extensions>

  		




  
  154
  
    
		<md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:2.0:protocol">

  		




  
  155
  
    
			<md:Extensions>

  		




  
  156
  
    
    				<shibmd:Scope regexp="false">vetagro-sup.fr</shibmd:Scope>

  		




  
  157
  
    

  		




  
  158
  
    
			    <mdui:UIInfo>

  		




  
  159
  
    

  		




  
  160
  
    
			      <mdui:DisplayName xml:lang="en">Vetagro Sup</mdui:DisplayName>

  		




  
  161
  
    

  		




  
  162
  
    
			      <mdui:Logo height="16" width="16">data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAAAQAAAAEABcxq3DAAAB/klEQVQ4y2NkQAP///+X+/jxI/PO7dujP3/7kf7v778ffDzciw2MDFaqq6t/Y2RkfIysngndAEZGxkezZ8/25xEQqVDTs5eRVrNU4RQUL7x9+7YtumasBjAwMDBISIgbcvBKct998p7h1fvfDKyc4nz//jF6yjAwSBNlwM+fP3/9/PmT4dbl4wysrCwMf//9Z/r7959UcFISD1EGPH107xgfD9sbTg52hrcvHjDw87Aw/Pz+7tLEefNuEmWAm6ffxvu3Ll4zMjZleHz/KsO7lw+f3bh+czs2tVgNsLS0fPfs4b3VnKy//wrycW84e2L/uobmtg0MpIKurt6N////Z8jPzxcnWTMDAwPD79//tbq7+9bhU8OMTfD//8cMP79L1X/8tjxMQYHXT0Uh88aBgyuvEW3Aly+8ntw8jLU3bx20cnH/xPz2jTyvk9OGpTt3NhIOxP//GRgkJGR8tPVeyElIvWA4dfIqg57Bff0nD+eHExULIb5dqkYmYgYm5r8YPH3vMzx//omBk+edpI4+vxVRBnz5zPqbi4vt7a9fv//9+cvAYG79jIGZmZWBg4NJiCgDdh4sfHD/7u9j714Z/BYWiGBQVkxjePNK8+erV5+uYDOABTMM/nP09y9Z8+OHgNjli9ahf//++8vGwrlAS0tp/v///7kYGRm/IasHAIVTy8DG/VpJAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE1LTA3LTIwVDEwOjUwOjA5KzAyOjAwfDtz7wAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxNS0wNy0yMFQxMDo1MDowOSswMjowMA1my1MAAAAASUVORK5CYII=</mdui:Logo>

  		




  
  163
  
    
			      <mdui:InformationURL xml:lang="fr">http://www.vetagro-sup.fr</mdui:InformationURL>

  		




  
  164
  
    

  		




  
  165
  
    
          		      <mdui:DisplayName xml:lang="fr">Vetagro Sup</mdui:DisplayName>

  		




  
  166
  
    

  		




  
  167
  
    
      			    </mdui:UIInfo>

  		




  
  168
  
    
			</md:Extensions>

  		




  
  169
  
    
				<md:KeyDescriptor use="signing">

  		




  
  170
  
    
<ds:KeyInfo>

  		




  
  171
  
    

  		




  
  172
  
    
					  <ds:X509Data>

  		




  
  173
  
    
					    <ds:X509Certificate>

  		




  
  174
  
    
					      MIIDPDCCAiSgAwIBAgIVAL9PsuadPSIZcMHNxlK/oevezmzWMA0GCSqGSIb3DQEB

  		




  
  175
  
    
BQUAMB8xHTAbBgNVBAMTFGFtYnJlLnZldGFncm8tc3VwLmZyMB4XDTEyMTEwODEw

  		




  
  176
  
    
MTQwNFoXDTMyMTEwODEwMTQwNFowHzEdMBsGA1UEAxMUYW1icmUudmV0YWdyby1z

  		




  
  177
  
    
dXAuZnIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCc/ptfpmkomwmT

  		




  
  178
  
    
4RsID+1Ce1dX0eUjcLgSOZN8hVpHWLag2ERWkpmvB5aK7BAFcI5i//Gk80tAiasu

  		




  
  179
  
    
JtlZhBnEw54aTJRGpyL2CVkHyl6SMRxprIi1Ji67IoGqEgUeGaheAxo+tG5e1WSc

  		




  
  180
  
    
bIbldcSKdwvjAV+7HSB4C6NqLsAzJH25++yaRH2uf2LTD0TDzNR9Q2hVj/VyYWR+

  		




  
  181
  
    
K3HWI1Snjn/i7aFfZZhYmBkwHuQOaPhwCM+khikg5XicMsxUhHCMi93UgHGIsdkr

  		




  
  182
  
    
IEGj4xydBTUKsLaykeuFS8EgXbWwCLGkeX76w8xDoFIpnppU/yFd9v7Zg3EBfn4p

  		




  
  183
  
    
kTW3GdIjAgMBAAGjbzBtMEwGA1UdEQRFMEOCFGFtYnJlLnZldGFncm8tc3VwLmZy

  		




  
  184
  
    
hitodHRwczovL2FtYnJlLnZldGFncm8tc3VwLmZyL2lkcC9zaGliYm9sZXRoMB0G

  		




  
  185
  
    
A1UdDgQWBBTPTqWkVHrHXFjmxMWkNt/sp2h5ozANBgkqhkiG9w0BAQUFAAOCAQEA

  		




  
  186
  
    
FvXMtfBUmRZCzz8CjanGzr1TBUPmnkrKci5AtkseKw9YlfUmBXTHB01y697nYq6m

  		




  
  187
  
    
RB6KhvfW212h9CF0IOEEjoadgDhXqGYhq8PnAOtT4Ty3XDy8SbRh8aQWfvnfSngv

  		




  
  188
  
    
FdpHRiSpj5UXXuT5zTtkf59h58XKtEfCkMbUzvdOgUobJzpD0WISmQHPQnx+Neg6

  		




  
  189
  
    
9j7oMRrDiZjS39Om8Imu9xvsnddDM3PlsDBIsvrr1o7K5iLkEdR1YYX0ZNDbiFuw

  		




  
  190
  
    
QXXl2dwQPB8KrScPUvCe57slU2gFQvvIBzjQysxC6V6TPSuM3A/ee56lACuB3jKj

  		




  
  191
  
    
oYkHQc5Gj/1rSMLmu9aLMg==

  		




  
  192
  
    
					    </ds:X509Certificate>

  		




  
  193
  
    
					  </ds:X509Data>

  		




  
  194
  
    

  		




  
  195
  
    
					</ds:KeyInfo>

  		




  
  196
  
    
				</md:KeyDescriptor>

  		




  
  197
  
    

  		




  
  198
  
    

  		




  
  199
  
    

  		




  
  200
  
    

  		




  
  201
  
    

  		




  
  202
  
    
			<md:NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</md:NameIDFormat>

  		




  
  203
  
    
			<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

  		




  
  204
  
    

  		




  
  205
  
    

  		




  
  206
  
    
			<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://ambre.vetagro-sup.fr/idp/profile/SAML2/POST/SSO"/>

  		




  
  207
  
    

  		




  
  208
  
    
	        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://ambre.vetagro-sup.fr/idp/profile/SAML2/Redirect/SSO"/>

  		




  
  209
  
    

  		




  
  210
  
    

  		




  
  211
  
    
			<md:SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://ambre.vetagro-sup.fr/idp/profile/Shibboleth/SSO"/>

  		




  
  212
  
    

  		




  
  213
  
    

  		




  
  214
  
    
		</md:IDPSSODescriptor>

  		




  
  215
  
    

  		




  
  216
  
    

  		




  
  217
  
    

  		




  
  218
  
    
		<md:Organization>

  		




  
  219
  
    

  		




  
  220
  
    
			<md:OrganizationName xml:lang="en">Vetagro Sup</md:OrganizationName>

  		




  
  221
  
    
			<md:OrganizationDisplayName xml:lang="en">Vetagro Sup</md:OrganizationDisplayName>

  		




  
  222
  
    
			<md:OrganizationURL xml:lang="en">http://www.vetagro-sup.fr</md:OrganizationURL>

  		




  
  223
  
    

  		




  
  224
  
    
		</md:Organization>

  		




  
  225
  
    

  		




  
  226
  
    

  		




  
  227
  
    

  		




  
  228
  
    
			    <md:ContactPerson contactType="technical">

  		




  
  229
  
    
				 <md:SurName>Nicolas Aulas</md:SurName>

  		




  
  230
  
    
				 <md:EmailAddress>nicolas.aulas@vetagro-sup.fr</md:EmailAddress>

  		




  
  231
  
    
		        </md:ContactPerson>

  		




  
  232
  
    

  		




  
  233
  
    

  		




  
  234
  
    

  		




  
  235
  
    

  		




  
  236
  
    

  		




  
  237
  
    

  		




  
  238
  
    
	</md:EntityDescriptor><md:EntityDescriptor entityID="https://antimoine.insa-strasbourg.fr/idp/shibboleth">

  		




  
  239
  
    
			<md:Extensions>

  		




  
  240
  
    
				<mdrpi:RegistrationInfo registrationAuthority="https://federation.renater.fr/" registrationInstant="2014-02-11T08:44:08Z">

  		




  
  241
  
    
					<mdrpi:RegistrationPolicy xml:lang="en">https://services.renater.fr/federation/en/metadata_registration_practice_statement</mdrpi:RegistrationPolicy>

  		




  
  242
  
    
				</mdrpi:RegistrationInfo>

  		




  
  243
  
    
			</md:Extensions>

  		




  
  244
  
    
		<md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:2.0:protocol">

  		




  
  245
  
    
			<md:Extensions>

  		




  
  246
  
    
    				<shibmd:Scope regexp="false">insa-strasbourg.fr</shibmd:Scope>

  		




  
  247
  
    

  		




  
  248
  
    
			    <mdui:UIInfo>

  		




  
  249
  
    

  		




  
  250
  
    
			      <mdui:DisplayName xml:lang="en">INSA Strasbourg</mdui:DisplayName>

  		




  
  251
  
    

  		




  
  252
  
    
			      <mdui:Logo height="16" width="16">data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAMAAAAoLQ9TAAAAq1BMVEXeAACEhoTWz87nQTn3oqXnIBjvgnvWlpT/5+fnEAjvZWOltrXnNDH3mpT/9/fnCAD/4+fvioz3x8bnVVL3qq3nKCnvkpTnHBjvcXP3sq3vgoT/7+/nFBDnODH3mpz////nDAj3z87vlpTveXv3vr3nAACMmpznRUL3pqXnJCHnFAj/+//nDADvjoz3y87vXVr3rq3nLCnvdXP3srXvhoT/8/fvODH3npz3lpQaie6kAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAAAQAAAAEABcxq3DAAAAe0lEQVQY053OwQqCQBhF4VM22VSMMWrFGP2kkIpUQ1nz/m8Ws20TeFeHb3WRnzEBBjO8xRjZrURi0TFiy+UITjTpjIKaOndZuDSGxF0j9G1+e7CuLN1nE2F7VI28tAoqMMezP1ieFOOp7RPueBXKSqdnMq8Wg66nPP0LX4uIG4jEwJ0sAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE1LTA3LTIwVDEwOjQ5OjA0KzAyOjAwIHfmJQAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxNS0wNy0yMFQxMDo0OTowNCswMjowMFEqXpkAAAAASUVORK5CYII=</mdui:Logo>

  		




  
  253
  
    
			      <mdui:InformationURL xml:lang="fr">http://www.insa-strasbourg.fr</mdui:InformationURL>

  		




  
  254
  
    

  		




  
  255
  
    
          		      <mdui:DisplayName xml:lang="fr">INSA Strasbourg</mdui:DisplayName>

  		




  
  256
  
    

  		




  
  257
  
    
      			    </mdui:UIInfo>

  		




  
  258
  
    
			</md:Extensions>

  		




  
  259
  
    
				<md:KeyDescriptor use="signing">

  		




  
  260
  
    
<ds:KeyInfo>

  		




  
  261
  
    

  		




  
  262
  
    
					  <ds:X509Data>

  		




  
  263
  
    
					    <ds:X509Certificate>

  		




  
  264
  
    
					      MIIDUDCCAjigAwIBAgIVAIbX8U0uAqAhuXm1jWxiFpggtDTDMA0GCSqGSIb3DQEB

  		




  
  265
  
    
CwUAMCQxIjAgBgNVBAMMGXNvdWZyZS5pbnNhLXN0cmFzYm91cmcuZnIwHhcNMTYw

  		




  
  266
  
    
OTI3MTIzNjIxWhcNMzYwOTI3MTIzNjIxWjAkMSIwIAYDVQQDDBlzb3VmcmUuaW5z

  		




  
  267
  
    
YS1zdHJhc2JvdXJnLmZyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA

  		




  
  268
  
    
sEE02sLRPAG5N81DMHEeGpI2MYF8yG/RiwH07cFIlLqgV80ewOmi0FWPYijxMb8A

  		




  
  269
  
    
bmx0RwUMvJBVI6WMxtT9fykhID20k8rWOuYOzvaynzVqCktqVgKoEAxP1PFE9b0n

  		




  
  270
  
    
iGKFprjjNl9ZD90GOUsxbAO7yXG9Q4WBa/eThl6XkUvNkSaZp5hcdWrgcAdsae3q

  		




  
  271
  
    
iD/uxFa38NXNNeRLGyfxjd2K5qYSzbwBza9s9TOq1+pfw7sxu3/4BnfQ0RLGO6co

  		




  
  272
  
    
4tH4Mufh0ome4cyYk4pvW5DOd1AznxDb8HpqvE0zwEsa69c/FDX0akgFZydmc77a

  		




  
  273
  
    
j6USn6JKjjbO49yGtG1gVQIDAQABo3kwdzAdBgNVHQ4EFgQUjzMsxZYiokPYxper

  		




  
  274
  
    
9zadM8J0F0kwVgYDVR0RBE8wTYIZc291ZnJlLmluc2Etc3RyYXNib3VyZy5mcoYw

  		




  
  275
  
    
aHR0cHM6Ly9zb3VmcmUuaW5zYS1zdHJhc2JvdXJnLmZyL2lkcC9zaGliYm9sZXRo

  		




  
  276
  
    
MA0GCSqGSIb3DQEBCwUAA4IBAQBFJKsiS3yfWuDB/E+iqQ0TuQJzL5+JIcloN0dw

  		




  
  277
  
    
BFxW3VZOju15zeQ7LwRBg9S4SGLMPJU+LM1lvr68cK9brut/FjF51SETIXEeCWo3

  		




  
  278
  
    
7+PIqgOCzraLNinmpU/OtN8ENalOPvpS6Jvbd23qB2t+IqOtZ+j15b0Yq4/on1E3

  		




  
  279
  
    
W2F9CVzKpe4EwmmtCPQbe7U1wvhgFylEx797pex8veWs79YSYwqvcKMh79dzl8Fo

  		




  
  280
  
    
/CgsO5pDrfKmc6SGMkByq75dZj+PqhZDzZ9EFTxbrXOTaS08VRN6a5Rh2iYRnGxq

  		




  
  281
  
    
yZl66tPcaIm5PHgOEmu5X4lPkUoY+Jt36Gj3SGCbYt8qH5S0

  		




  
  282
  
    
					    </ds:X509Certificate>

  		




  
  283
  
    
					  </ds:X509Data>

  		




  
  284
  
    

  		




  
  285
  
    
					</ds:KeyInfo>

  		




  
  286
  
    
				</md:KeyDescriptor>

  		




  
  287
  
    

  		




  
  288
  
    

  		




  
  289
  
    

  		




  
  290
  
    
				<md:KeyDescriptor use="signing">

  		




  
  291
  
    
				       <ds:KeyInfo>

  		




  
  292
  
    
					  <ds:X509Data>

  		




  
  293
  
    
					    <ds:X509Certificate>

  		




  
  294
  
    
					      MIIDXDCCAkSgAwIBAgIVAKI+qiqDCk9wTTqn7OVAoZrvj/CpMA0GCSqGSIb3DQEB

  		




  
  295
  
    
BQUAMCcxJTAjBgNVBAMTHGFudGltb2luZS5pbnNhLXN0cmFzYm91cmcuZnIwHhcN

  		




  
  296
  
    
MTQwMTEzMTAzOTU4WhcNMzQwMTEzMTAzOTU4WjAnMSUwIwYDVQQDExxhbnRpbW9p

  		




  
  297
  
    
bmUuaW5zYS1zdHJhc2JvdXJnLmZyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB

  		




  
  298
  
    
CgKCAQEAtuM8lRjlVjjmrHq9VtguaOMQL+Wd99BiOs56kL3Mbctg1FwH69LYThCW

  		




  
  299
  
    
6dOz6WJg/jU/naF7jEikXKc71xGyu7Ph7Iqa9S5hoXXAT8u/0q2nZDeTOraJqKe1

  		




  
  300
  
    
FMF2RzXhEEMyQO3CiKNK9b+tbKoNZS7FQCixMZklWZPt4EcEKd6jyRq1WYX3dpnb

  		




  
  301
  
    
r9I/aCdhtK/PGvGe5gKTDoTR2HKyWKJTc/obf8x/vlYIEwiaGgdlqI2KiBE0x48n

  		




  
  302
  
    
zQdP6XVi3T8ZWbnkLmCfgJtP2C8PtEJuwDRAy0Z9N4DSwvxn5YCVYgBLSi0TLa10

  		




  
  303
  
    
B/lUqqBezZrTrA9p9Lt8JtGXW5YGHwIDAQABo38wfTBcBgNVHREEVTBTghxhbnRp

  		




  
  304
  
    
bW9pbmUuaW5zYS1zdHJhc2JvdXJnLmZyhjNodHRwczovL2FudGltb2luZS5pbnNh

  		




  
  305
  
    
LXN0cmFzYm91cmcuZnIvaWRwL3NoaWJib2xldGgwHQYDVR0OBBYEFLFkjPZUc9JY

  		




  
  306
  
    
qrWjldJ/iGGkKAt4MA0GCSqGSIb3DQEBBQUAA4IBAQBSk/wU1mRn4VF2ifmy261K

  		




  
  307
  
    
DK7uX+t1H1hh8S38fKSFU7HoNXJTV3vQnmBOpYIGC1gtvmb+qjqpNtikU2zO84Gq

  		




  
  308
  
    
Q0bXHxYF2d9RUP89mKaFxE5uNcXFmlOA3ChZY3pMT5zwAPI/T60tGrex7zci7OLn

  		




  
  309
  
    
JDAQj/q4Yk9ejx6JTFggQSCCVh+oV/SDIMd2p5AY6H3mto3b6XCk7Lssa8a/D30k

  		




  
  310
  
    
pEkZnhTKdN82eRyynuOR7UDU4tasV4d7Mi/j53f5ihnRcsvwh/pYodjoVYY8cEcZ

  		




  
  311
  
    
JLnAXYF8coSwh8UN4D/0NHsvTuSOFQc85hGrqacMsvxiQiw9mv01AX5+A5YLEbVQ

  		




  
  312
  
    
					    </ds:X509Certificate>

  		




  
  313
  
    
					  </ds:X509Data>

  		




  
  314
  
    
					</ds:KeyInfo>

  		




  
  315
  
    
				</md:KeyDescriptor>

  		




  
  316
  
    

  		




  
  317
  
    

  		




  
  318
  
    

  		




  
  319
  
    
			   <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://antimoine.insa-strasbourg.fr/idp/profile/SAML2/Redirect/SLO"/>

  		




  
  320
  
    

  		




  
  321
  
    
			   <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://antimoine.insa-strasbourg.fr/idp/profile/SAML2/POST/SLO"/>

  		




  
  322
  
    

  		




  
  323
  
    
			   <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://antimoine.insa-strasbourg.fr/idp/profile/SAML2/SOAP/SLO"/>

  		




  
  324
  
    

  		




  
  325
  
    

  		




  
  326
  
    
			<md:NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</md:NameIDFormat>

  		




  
  327
  
    
			<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

  		




  
  328
  
    

  		




  
  329
  
    

  		




  
  330
  
    
			<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://antimoine.insa-strasbourg.fr/idp/profile/SAML2/POST/SSO"/>

  		




  
  331
  
    

  		




  
  332
  
    
	        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://antimoine.insa-strasbourg.fr/idp/profile/SAML2/Redirect/SSO"/>

  		




  
  333
  
    

  		




  
  334
  
    

  		




  
  335
  
    
			<md:SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://antimoine.insa-strasbourg.fr/idp/profile/Shibboleth/SSO"/>

  		




  
  336
  
    

  		




  
  337
  
    

  		




  
  338
  
    
		</md:IDPSSODescriptor>

  		




  
  339
  
    

  		




  
  340
  
    

  		




  
  341
  
    

  		




  
  342
  
    
		<md:Organization>

  		




  
  343
  
    

  		




  
  344
  
    
			<md:OrganizationName xml:lang="en">INSA Strasbourg</md:OrganizationName>

  		




  
  345
  
    
			<md:OrganizationDisplayName xml:lang="en">INSA Strasbourg</md:OrganizationDisplayName>

  		




  
  346
  
    
			<md:OrganizationURL xml:lang="en">http://www.insa-strasbourg.fr</md:OrganizationURL>

  		




  
  347
  
    

  		




  
  348
  
    
		</md:Organization>

  		




  
  349
  
    

  		




  
  350
  
    

  		




  
  351
  
    

  		




  
  352
  
    
			    <md:ContactPerson contactType="technical">

  		




  
  353
  
    
				 <md:SurName>Lahsen BOUZID</md:SurName>

  		




  
  354
  
    
				 <md:EmailAddress>lahsen.bouzid@insa-strasbourg.fr</md:EmailAddress>

  		




  
  355
  
    
		        </md:ContactPerson>

  		




  
  356
  
    

  		




  
  357
  
    

  		




  
  358
  
    

  		




  
  359
  
    
			    <md:ContactPerson contactType="technical">

  		




  
  360
  
    
				 <md:SurName>Simon SCHERRER</md:SurName>

  		




  
  361
  
    
				 <md:EmailAddress>simon.scherrer@insa-strasbourg.fr</md:EmailAddress>

  		




  
  362
  
    
		        </md:ContactPerson>

  		




  
  363
  
    

  		




  
  364
  
    

  		




  
  365
  
    

  		




  
  366
  
    

  		




  
  367
  
    
	</md:EntityDescriptor></md:EntitiesDescriptor>

  		












  

    
      tests/federation-sample.xml
    
  





  
  1
  
    
<?xml version="1.0" encoding="UTF-8" standalone="no"?><md:EntitiesDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:pyff="http://pyff.io/NS" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xrd="http://docs.oasis-open.org/ns/xri/xrd-1.0" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="_20171018T113001Z" Name="https://federation.renater.fr/" cacheDuration="PT1H" validUntil="2017-10-27T11:30:01Z"><ds:Signature>

  		




  
  2
  
    
<ds:SignedInfo>

  		




  
  3
  
    
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

  		




  
  4
  
    
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>

  		




  
  5
  
    
<ds:Reference URI="">

  		




  
  6
  
    
<ds:Transforms>

  		




  
  7
  
    
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>

  		




  
  8
  
    
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

  		




  
  9
  
    
</ds:Transforms>

  		




  
  10
  
    
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>

  		




  
  11
  
    
<ds:DigestValue>JKdLdd5yGvkFdb1fCAByMMnurIKYhZepRouZfOjIUrg=</ds:DigestValue>

  		




  
  12
  
    
</ds:Reference>

  		




  
  13
  
    
</ds:SignedInfo>

  		




  
  14
  
    
<ds:SignatureValue>

  		




  
  15
  
    
OTexfi8c63TsP1V9j5m6digA2NomUfqBtT8pPKhwdqEDQS5qLh6fxvT+wWkP6JaIhkP8nxwpbArl

  		




  
  16
  
    
7cUHkRv5ibZzcknIAjXYMhsSTtFQUq89OMcDHtZHG54jiKyHPhu2+XEbvv6DsAYanYC6SHEnGjNG

  		




  
  17
  
    
opnOEUB2XqeycsvvTQQIuWZEoABTVcKYyk2CW7Ij5EUmPOAPiidtbt8lzrtkV6dwLbkyoEbChAyj

  		




  
  18
  
    
emrL/oS01aJgT9sQoJxR8lyRMGiZ/BwQqYTareiKwOXLPdGThzsfZXD8de9T1xuysILaAM7sHPJV

  		




  
  19
  
    
QfrQJm80Zo2MM/GnhJTO9rc4m3kRnRhqmA6qMw==

  		




  
  20
  
    
</ds:SignatureValue>

  		




  
  21
  
    
<ds:KeyInfo>

  		




  
  22
  
    
<ds:KeyValue>

  		




  
  23
  
    
<ds:RSAKeyValue>

  		




  
  24
  
    
<ds:Modulus>

  		




  
  25
  
    
71+vTf66BPgYUF7sm4T++W69qMVyGQn9wNqpBLc6sp53eq/JRTOUD26Yehjsld5qN52Bv2r5QG7o

  		




  
  26
  
    
4VU123akXUYzupvq1f+tmF9NwYa7MPEPFzCzJHhNXjZNRxcsW1WLW34fhQCm0oak3oSPoNo5qeGi

  		




  
  27
  
    
jNsTSkgSt1mPH0P8d95af2VJnT6zbrclxvH4emqpT9oGLsWqKWLlIbZ7u1PUjuNVwLHuj909/apm

  		




  
  28
  
    
C13RBIpV52fey4qey34bnRHdCTknZeN/TJLTJ9hMWzz9TbdjfIFaiF7MeY+OYRXzUJeQuHHMu/2I

  		




  
  29
  
    
emkoR26mYi6irvmx8AdPcPCwcRKw2Ca4xLhbNw==

  		




  
  30
  
    
</ds:Modulus>

  		




  
  31
  
    
<ds:Exponent>AQAB</ds:Exponent>

  		




  
  32
  
    
</ds:RSAKeyValue>

  		




  
  33
  
    
</ds:KeyValue>

  		




  
  34
  
    
<ds:X509Data>

  		




  
  35
  
    
<ds:X509Certificate>

  		




  
  36
  
    
MIIC9zCCAd+gAwIBAgIEfe6j3jANBgkqhkiG9w0BAQsFADAsMSowKAYDVQQDEyFTQU1MIE1ldGFk

  		




  
  37
  
    
YXRhIFNpZ25pbmcgQ2VydGlmaWNhdGUwHhcNMTYwNzI5MDczNjM4WhcNMjYwNjA3MDczNjM4WjAs

  		




  
  38
  
    
MSowKAYDVQQDEyFTQU1MIE1ldGFkYXRhIFNpZ25pbmcgQ2VydGlmaWNhdGUwggEiMA0GCSqGSIb3

  		




  
  39
  
    
DQEBAQUAA4IBDwAwggEKAoIBAQDvX69N/roE+BhQXuybhP75br2oxXIZCf3A2qkEtzqynnd6r8lF

  		




  
  40
  
    
M5QPbph6GOyV3mo3nYG/avlAbujhVTXbdqRdRjO6m+rV/62YX03Bhrsw8Q8XMLMkeE1eNk1HFyxb

  		




  
  41
  
    
VYtbfh+FAKbShqTehI+g2jmp4aKM2xNKSBK3WY8fQ/x33lp/ZUmdPrNutyXG8fh6aqlP2gYuxaop

  		




  
  42
  
    
YuUhtnu7U9SO41XAse6P3T39qmYLXdEEilXnZ97Lip7LfhudEd0JOSdl439MktMn2ExbPP1Nt2N8

  		




  
  43
  
    
gVqIXsx5j45hFfNQl5C4ccy7/Yh6aShHbqZiLqKu+bHwB09w8LBxErDYJrjEuFs3AgMBAAGjITAf

  		




  
  44
  
    
MB0GA1UdDgQWBBTT88iZzWO+hN9SBUkpx871lmTuLTANBgkqhkiG9w0BAQsFAAOCAQEABoPpODry

  		




  
  45
  
    
XwiM5jjtqk6veR02FevCKHpZP6Od7Kqcfs6lg5LcQmGUOgpmW3Gg4UMjBYkgARsT2Nsnah1CJqa8

  		




  
  46
  
    
cjvv8p5KEIhY0hVS8iMJnrb3PDeiFSeP4xSfct/6z/ebV4+QFl22bsm2zpAC6BpFz8+IJ/jAmQzT

  		




  
  47
  
    
Vob4MAUeQPnwwzm3xz6yanLZx7BK5cfrTCa+hrarNQCboRjXPwiejF8WRCxpgRHH6yNs5QH/Z6o5

  		




  
  48
  
    
e3tUP7uEpn2Ob+kcLsEMGb9DghkoDAgkHCOZeTy+7hgxt+/T94cLTa58gVtvEOnd0GuL7Vfd+IVd

  		




  
  49
  
    
XgSard8RfR3OyZlf6M4aSGQA73sskQ==

  		




  
  50
  
    
</ds:X509Certificate>

  		




  
  51
  
    
</ds:X509Data>

  		




  
  52
  
    
</ds:KeyInfo>

  		




  
  53
  
    
</ds:Signature><md:EntityDescriptor entityID="https://access-check.edugain.org/simplesaml/saml2/idp/metadata.php">

  		




  
  54
  
    
			<md:Extensions>

  		




  
  55
  
    
				<mdrpi:RegistrationInfo registrationAuthority="https://federation.renater.fr/" registrationInstant="2015-01-30T15:32:58Z">

  		




  
  56
  
    
					<mdrpi:RegistrationPolicy xml:lang="en">https://services.renater.fr/federation/en/metadata_registration_practice_statement</mdrpi:RegistrationPolicy>

  		




  
  57
  
    
				</mdrpi:RegistrationInfo>

  		




  
  58
  
    
			</md:Extensions>

  		




  
  59
  
    
		<md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

  		




  
  60
  
    
			<md:Extensions>

  		




  
  61
  
    
    				<shibmd:Scope regexp="false">access-check.edugain.org</shibmd:Scope>

  		




  
  62
  
    

  		




  
  63
  
    
			    <mdui:UIInfo>

  		




  
  64
  
    

  		




  
  65
  
    
			      <mdui:DisplayName xml:lang="en">eduGAIN Access Check</mdui:DisplayName>

  		




  
  66
  
    

  		




  
  67
  
    
			      <mdui:Logo height="16" width="16">data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAAAQAAAAEABcxq3DAAABbUlEQVQoz52RPW4UQRCFv6ru6fnZNSxCJuVKpFwAicR3IUI+AakvhQhI7JU8M/1T3QQzsg1sAhWV3qtPVaonfPrCX9W+fpTP3y7otzceGJKJxCiujpVUkCv0+m3K967hixUfWgWSHwAPxG6UqtIFbEFHGoCqR721BX+wirO8LVGg+a6amEXXjqxhM5ZxNFPvX1Odocn5ZwB7HCn4hWI42wxD6KWUBVfIZxXd9J2zNhHFmro2Gx3QPKSReGCiV40ESM/A1NcxTDnn7HvLFViXBRZ6MKJnmwaktca/lFzO4fZG7n5e0D9cK4DjFI69yrGbwvhqP7KWp7kR99QrQAn3cW5N5/SQ1rivDgdUCUegFfkDkKF26TG7FijzZoS0sM7kM7D6gncvgG5d7cEdu6wN+v3R/cRwQgaAdnA2vACQvn9Tk6NNqjtwjis1Iyp4JOpafwvu3ZAYa3TV2fBjBnjfe8uLKErOZLk6fU//lcMvhuSrh7MzMwcAAAAldEVYdGRhdGU6Y3JlYXRlADIwMTUtMDctMjBUMTA6NTA6MTErMDI6MDCDfj0WAAAAJXRFWHRkYXRlOm1vZGlmeQAyMDE1LTA3LTIwVDEwOjUwOjExKzAyOjAw8iOFqgAAAABJRU5ErkJggg==</mdui:Logo>

  		




  
  68
  
    
			      <mdui:InformationURL xml:lang="fr">http://www.renater.fr</mdui:InformationURL>

  		




  
  69
  
    
			      <mdui:Description xml:lang="en">eduGAIN Access Check allows administrators of a Service Provider (SP) registered in eduGAIN to create test accounts with different profiles to validate the behaviour and test federated login. The test accounts can only be used to access own services.</mdui:Description>

  		




  
  70
  
    
          		      <mdui:DisplayName xml:lang="fr">eduGAIN Access Check</mdui:DisplayName>

  		




  
  71
  
    
          		      <mdui:Description xml:lang="fr">eduGAIN Access Check allows administrators of a Service Provider (SP) registered in eduGAIN to create test accounts with different profiles to validate the behaviour and test federated login. The test accounts can only be used to access own services.</mdui:Description>

  		




  
  72
  
    
      			    </mdui:UIInfo>

  		




  
  73
  
    
			</md:Extensions>

  		




  
  74
  
    
				<md:KeyDescriptor use="signing">

  		




  
  75
  
    
<ds:KeyInfo>

  		




  
  76
  
    

  		




  
  77
  
    
					  <ds:X509Data>

  		




  
  78
  
    
					    <ds:X509Certificate>

  		




  
  79
  
    
					      MIID2zCCAsOgAwIBAgIJAJpdV2MFitUqMA0GCSqGSIb3DQEBBQUAMIGDMQswCQYD

  		




  
  80
  
    
VQQGEwJGUjEVMBMGA1UEBwwMRGVmYXVsdCBDaXR5MQ4wDAYDVQQKDAVHRUFOVDEd

  		




  
  81
  
    
MBsGA1UEAwwUdGVzdC1pZHAuZWR1Z2Fpbi5vcmcxLjAsBgkqhkiG9w0BCQEWH3Rl

  		




  
  82
  
    
c3RpZHBhY2NvdW50bWFuYWdlckBnZWFudC5uZXQwHhcNMTQxMjE4MTAxODU5WhcN

  		




  
  83
  
    
MjQxMjE3MTAxODU5WjCBgzELMAkGA1UEBhMCRlIxFTATBgNVBAcMDERlZmF1bHQg

  		




  
  84
  
    
Q2l0eTEOMAwGA1UECgwFR0VBTlQxHTAbBgNVBAMMFHRlc3QtaWRwLmVkdWdhaW4u

  		




  
  85
  
    
b3JnMS4wLAYJKoZIhvcNAQkBFh90ZXN0aWRwYWNjb3VudG1hbmFnZXJAZ2VhbnQu

  		




  
  86
  
    
bmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo48FFP0P/81e3WHb

  		




  
  87
  
    
U91F/TYDZC/JypEqO2XQNH50baXpk2JrJFVFOWdgdK6qWHsLznuxngRsfOasAaVA

  		




  
  88
  
    
Ob1Bf3g2xgPUd2htSLxds+o/Y24DOM6ZairxbWJk2rOvLhJFchlrcNWCpMtUCkfJ

  		




  
  89
  
    
xmqGmeo93XAud5byj3wQ1NuH2o8rjTPAkMgQdr8D2b8EG1NYEH00AqRlXZTFCWGL

  		




  
  90
  
    
KDEuZwyta6vgMQYT4K6UF/F+HWF2wzbmVgRTHguJ0rzNqz6t+9CtLkhyZO+/57Ro

  		




  
  91
  
    
4U0ikshVWkUOENPKCnB1t+ebs/AsNozbIGA/HcdtwUwDgIowv/K0hdnLDC1vz6/S

  		




  
  92
  
    
F3rnGQIDAQABo1AwTjAdBgNVHQ4EFgQUgWN9jmJxOEHYU5m8D0atl895HxowHwYD

  		




  
  93
  
    
VR0jBBgwFoAUgWN9jmJxOEHYU5m8D0atl895HxowDAYDVR0TBAUwAwEB/zANBgkq

  		




  
  94
  
    
hkiG9w0BAQUFAAOCAQEAXvlBHMaBK6m0PQNanTqGBRdRAFt8Xkr5texD5mPTmS/7

  		




  
  95
  
    
nqnxlN0orqYWGCaARmQE+T77EB2a2n9g2s130pUXwJxcbUwIOdPKH6CMKEHT/512

  		




  
  96
  
    
bndJXQ3DyhkuVSLtRFOdfleIhi8qUkNC9FWxM4jDHDTTQtNEHnCjFxlhxw+ri5QJ

  		




  
  97
  
    
AVKpH9MkcuIkM6Jx+QhNwTDwCRIJffoDOH420yR5EWx/sQ4tjKQGiFOPv/WHFjXd

  		




  
  98
  
    
LqHU+X8ErzxeNmUHHST6pHePWRCMtoPTdCPhEroJhou6NMHh8ylQOIVHt6gggc7r

  		




  
  99
  
    
kUWMUybDUxPp49qMeNkdKqFPby2aW7ouKRoOXuxZhg==

  		




  
  100
  
    
					    </ds:X509Certificate>

  		




  
  101
  
    
					  </ds:X509Data>

  		




  
  102
  
    

  		




  
  103
  
    
					</ds:KeyInfo>

  		




  
  104
  
    
				</md:KeyDescriptor>

  		




  
  105
  
    

  		




  
  106
  
    

  		




  
  107
  
    

  		




  
  108
  
    

  		




  
  109
  
    

  		




  
  110
  
    

  		




  
  111
  
    
			<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

  		




  
  112
  
    

  		




  
  113
  
    

  		




  
  114
  
    

  		




  
  115
  
    
	        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://access-check.edugain.org/simplesaml/saml2/idp/SSOService.php"/>

  		




  
  116
  
    

  		




  
  117
  
    

  		




  
  118
  
    

  		




  
  119
  
    
		</md:IDPSSODescriptor>

  		




  
  120
  
    

  		




  
  121
  
    

  		




  
  122
  
    

  		




  
  123
  
    
		<md:Organization>

  		




  
  124
  
    

  		




  
  125
  
    
			<md:OrganizationName xml:lang="en">eduGAIN Access Check</md:OrganizationName>

  		




  
  126
  
    
			<md:OrganizationDisplayName xml:lang="en">eduGAIN Access Check</md:OrganizationDisplayName>

  		




  
  127
  
    
			<md:OrganizationURL xml:lang="en">http://www.renater.fr</md:OrganizationURL>

  		




  
  128
  
    

  		




  
  129
  
    
		</md:Organization>

  		




  
  130
  
    

  		




  
  131
  
    

  		




  
  132
  
    
			    <md:ContactPerson contactType="technical">

  		




  
  133
  
    
			     <md:EmailAddress>edugain-integration@geant.net</md:EmailAddress>

  		




  
  134
  
    
		        </md:ContactPerson>

  		




  
  135
  
    

  		




  
  136
  
    

  		




  
  137
  
    
	</md:EntityDescriptor><md:EntityDescriptor entityID="https://aishib.agropolis.fr/idp/shibboleth">

  		




  
  138
  
    
			<md:Extensions>

  		




  
  139
  
    
				<mdrpi:RegistrationInfo registrationAuthority="https://federation.renater.fr/" registrationInstant="2013-06-06T11:49:20Z">

  		




  
  140
  
    
					<mdrpi:RegistrationPolicy xml:lang="en">https://services.renater.fr/federation/en/metadata_registration_practice_statement</mdrpi:RegistrationPolicy>

  		




  
  141
  
    
				</mdrpi:RegistrationInfo>

  		




  
  142
  
    
			</md:Extensions>

  		




  
  143
  
    
		<md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:2.0:protocol">

  		




  
  144
  
    
			<md:Extensions>

  		




  
  145
  
    
    				<shibmd:Scope regexp="false">agropolis.fr</shibmd:Scope>

  		




  
  146
  
    

  		




  
  147
  
    
			    <mdui:UIInfo>

  		




  
  148
  
    

  		




  
  149
  
    
			      <mdui:DisplayName xml:lang="en">Agropolis International</mdui:DisplayName>

  		




  
  150
  
    

  		




  
  151
  
    
			      <mdui:Logo height="16" width="16">data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAAAQAAAAEABcxq3DAAACPUlEQVQoz21SPW8TQRR8u7d3ju34Er6UCHACRqK4Bjk0oDSEjiYSBQVS8k9AkWgp+AuUASGEaCASkoPcgARVMF8iTnxJwMFJfL47397u3u6jsGVFwLzmFTN6ozdDEBEAAOD4kiRJsVgkhMA/YMfZzc3NVstnzGq1/KXlJfgf2Ii9XquVZ2YWbi5Io4MsbfPeZK4wRm0AOH6KICIivq2tV6/O5cYLHztbW9FvYTKuZaLk7PjpW+UrJXtspCHGmGazCQBnZ8svtj/0tbAINYhcy1DyThpRhHtztyedwkBDAWBnZ6dSqbzZ+7THu0IraTJplDSZ0JnQ2Y+482jj1cgSRUTHdrhW9fa3SKaxErFKIyUiKaIsjVQaKf5s631HxP1+X2vNwjB0J9zd+OgnD044Ra4lI5ZBw7XqyeRQREciaqe9xoE/K/OFfIENnqBM1uZBqlWBOYxQjYZnqieTThru8zCU3AASIAjIXNellGLePkjCUPICy1mEDAShSg7SqCsTBtQ7WfY3vlarVUYpdUsuAs5PXV7dfpe3HEYtjSbNZJwJoRUi3rl4fSrvfufctm0ySA0RD0V84+WDL1EbCCDCYIDApeKZ+uKK6faDIPA8jw7jIORUbry2eH+5Mu8ARTSAkCPW3QvX6osrE+B8bjQ8zxu2aACDaIwxxuzzsLbbePj88a8k0Mb4vr/2ei3LMoOIiGRU0iGGVuDp6pNz5fNSiKnpac/zgAABMuzSXwIggIjdbrdUKjHGYGQaAAD+AJBJecXxnEvWAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE1LTA3LTIwVDEwOjQ4OjE1KzAyOjAwpWiGMQAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxNS0wNy0yMFQxMDo0ODoxNSswMjowMNQ1Po0AAAAASUVORK5CYII=</mdui:Logo>

  		




  
  152
  
    
			      <mdui:InformationURL xml:lang="fr">http://www.agropolis.fr</mdui:InformationURL>

  		




  
  153
  
    

  		




  
  154
  
    
          		      <mdui:DisplayName xml:lang="fr">Agropolis International</mdui:DisplayName>

  		




  
  155
  
    

  		




  
  156
  
    
      			    </mdui:UIInfo>

  		




  
  157
  
    
			</md:Extensions>

  		




  
  158
  
    
				<md:KeyDescriptor use="signing">

  		




  
  159
  
    
<ds:KeyInfo>

  		




  
  160
  
    

  		




  
  161
  
    
					  <ds:X509Data>

  		




  
  162
  
    
					    <ds:X509Certificate>

  		




  
  163
  
    
					      MIIDNzCCAh+gAwIBAgIUYY3sGXwChkj2CRy6QFDvkdj2zlAwDQYJKoZIhvcNAQEF

  		




  
  164
  
    
BQAwHjEcMBoGA1UEAxMTYWlzaGliLmFncm9wb2xpcy5mcjAeFw0xMzA1MTUxMzM3

  		




  
  165
  
    
MTJaFw0zMzA1MTUxMzM3MTJaMB4xHDAaBgNVBAMTE2Fpc2hpYi5hZ3JvcG9saXMu

  		




  
  166
  
    
ZnIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCxrDy6lrhIBjcxv16n

  		




  
  167
  
    
4UJ2cEMYPO4wSmfDwhO6feoSIEuIblYRHE2nQKirMokwD6seF4rbDHyxLXg/ColL

  		




  
  168
  
    
VLv+0CJteIOZjSCgSN90WzQRrC1Ex5sJfPu6yPEXvW8H1906gEg6ok8rlCIHRGfE

  		




  
  169
  
    
15pHK5eqxQS5f2n8c2t/Uk33/FBj79/hb3Cd7vE4mdlvReD3AFswC0lV4bPmj3Ka

  		




  
  170
  
    
KUuMj9xwipwnfWCu6p2/ZJF4M3ADU5grXHJ2Vqmd8DWm5raaObKjYwJddbRBByI8

  		




  
  171
  
    
bJJLIwAQQmX4Dh4hf1QKlf2oqWPWVQxLQp0erL1U8IWmj1RG8TTH9xOJl6kkEhYq

  		




  
  172
  
    
Z2gfAgMBAAGjbTBrMEoGA1UdEQRDMEGCE2Fpc2hpYi5hZ3JvcG9saXMuZnKGKmh0

  		




  
  173
  
    
dHBzOi8vYWlzaGliLmFncm9wb2xpcy5mci9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4E

  		




  
  174
  
    
FgQU9A7iQ8Qo+t2JCpKuOOV9YBoYs4MwDQYJKoZIhvcNAQEFBQADggEBAG0LOW6I

  		




  
  175
  
    
F+M8n2NpzyQjfVCJCA6QhWjbXrfemiPJFZGZZb2dVmHof4yCpCUYgHOBoZaXPOlB

  		




  
  176
  
    
nLYsUWvFZ6V2GELZpLHzHSSrYidieW07qQkh1DwcIYpvtZgLviOtT/tCEGsk925f

  		




  
  177
  
    
DUoGdeIqpqt54WZcW9+TbKicvjg3JT4BFOQ17bFNwPW+YjTbvsWYxen+e0mRp4vM

  		




  
  178
  
    
V0yMu2f3bccVhePASSZGL3yod3sJ1dPvlrJO9c35BekhtirolVjZqMQ0AYPVifua

  		




  
  179
  
    
yIU0dWXsZkAOcBL9kZFbJcYRUIxMgvp8U2Zdv1+ZlwOyXnnWDOOh9wjuT7FAyObU

  		




  
  180
  
    
ChvjHlgZHkvLwJI=

  		




  
  181
  
    
					    </ds:X509Certificate>

  		




  
  182
  
    
					  </ds:X509Data>

  		




  
  183
  
    

  		




  
  184
  
    
					</ds:KeyInfo>

  		




  
  185
  
    
				</md:KeyDescriptor>

  		




  
  186
  
    

  		




  
  187
  
    

  		




  
  188
  
    

  		




  
  189
  
    

  		




  
  190
  
    

  		




  
  191
  
    
			<md:NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</md:NameIDFormat>

  		




  
  192
  
    
			<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

  		




  
  193
  
    

  		




  
  194
  
    

  		




  
  195
  
    
			<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://aishib.agropolis.fr/idp/profile/SAML2/POST/SSO"/>

  		




  
  196
  
    

  		




  
  197
  
    
	        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://aishib.agropolis.fr/idp/profile/SAML2/Redirect/SSO"/>

  		




  
  198
  
    

  		




  
  199
  
    

  		




  
  200
  
    
			<md:SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://aishib.agropolis.fr/idp/profile/Shibboleth/SSO"/>

  		




  
  201
  
    

  		




  
  202
  
    

  		




  
  203
  
    
		</md:IDPSSODescriptor>

  		




  
  204
  
    

  		




  
  205
  
    

  		




  
  206
  
    

  		




  
  207
  
    
		<md:Organization>

  		




  
  208
  
    

  		




  
  209
  
    
			<md:OrganizationName xml:lang="en">Agropolis International</md:OrganizationName>

  		




  
  210
  
    
			<md:OrganizationDisplayName xml:lang="en">Agropolis International</md:OrganizationDisplayName>

  		




  
  211
  
    
			<md:OrganizationURL xml:lang="en">http://www.agropolis.fr</md:OrganizationURL>

  		




  
  212
  
    

  		




  
  213
  
    
		</md:Organization>

  		




  
  214
  
    

  		




  
  215
  
    

  		




  
  216
  
    

  		




  
  217
  
    
			    <md:ContactPerson contactType="technical">

  		




  
  218
  
    
				 <md:SurName>Jean Cerda</md:SurName>

  		




  
  219
  
    
				 <md:EmailAddress>cerda@agropolis.fr</md:EmailAddress>

  		




  
  220
  
    
		        </md:ContactPerson>

  		




  
  221
  
    

  		




  
  222
  
    

  		




  
  223
  
    

  		




  
  224
  
    
			    <md:ContactPerson contactType="technical">

  		




  
  225
  
    
				 <md:SurName>Jean-Pierre  Allano</md:SurName>

  		




  
  226
  
    
				 <md:EmailAddress>allano@agropolis.fr</md:EmailAddress>

  		




  
  227
  
    
		        </md:ContactPerson>

  		




  
  228
  
    

  		




  
  229
  
    

  		




  
  230
  
    

  		




  
  231
  
    

  		




  
  232
  
    
	</md:EntityDescriptor><md:EntityDescriptor entityID="https://ambre.vetagro-sup.fr/idp/shibboleth">

  		




  
  233
  
    
			<md:Extensions>

  		




  
  234
  
    
				<mdrpi:RegistrationInfo registrationAuthority="https://federation.renater.fr/" registrationInstant="2013-01-14T16:11:53Z">

  		




  
  235
  
    
					<mdrpi:RegistrationPolicy xml:lang="en">https://services.renater.fr/federation/en/metadata_registration_practice_statement</mdrpi:RegistrationPolicy>

  		




  
  236
  
    
				</mdrpi:RegistrationInfo>

  		




  
  237
  
    
			</md:Extensions>

  		




  
  238
  
    
		<md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:2.0:protocol">

  		




  
  239
  
    
			<md:Extensions>

  		




  
  240
  
    
    				<shibmd:Scope regexp="false">vetagro-sup.fr</shibmd:Scope>

  		




  
  241
  
    

  		




  
  242
  
    
			    <mdui:UIInfo>

  		




  
  243
  
    

  		




  
  244
  
    
			      <mdui:DisplayName xml:lang="en">Vetagro Sup</mdui:DisplayName>

  		




  
  245
  
    

  		




  
  246
  
    
			      <mdui:Logo height="16" width="16">data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAAAQAAAAEABcxq3DAAAB/klEQVQ4y2NkQAP///+X+/jxI/PO7dujP3/7kf7v778ffDzciw2MDFaqq6t/Y2RkfIysngndAEZGxkezZ8/25xEQqVDTs5eRVrNU4RQUL7x9+7YtumasBjAwMDBISIgbcvBKct998p7h1fvfDKyc4nz//jF6yjAwSBNlwM+fP3/9/PmT4dbl4wysrCwMf//9Z/r7959UcFISD1EGPH107xgfD9sbTg52hrcvHjDw87Aw/Pz+7tLEefNuEmWAm6ffxvu3Ll4zMjZleHz/KsO7lw+f3bh+czs2tVgNsLS0fPfs4b3VnKy//wrycW84e2L/uobmtg0MpIKurt6N////Z8jPzxcnWTMDAwPD79//tbq7+9bhU8OMTfD//8cMP79L1X/8tjxMQYHXT0Uh88aBgyuvEW3Aly+8ntw8jLU3bx20cnH/xPz2jTyvk9OGpTt3NhIOxP//GRgkJGR8tPVeyElIvWA4dfIqg57Bff0nD+eHExULIb5dqkYmYgYm5r8YPH3vMzx//omBk+edpI4+vxVRBnz5zPqbi4vt7a9fv//9+cvAYG79jIGZmZWBg4NJiCgDdh4sfHD/7u9j714Z/BYWiGBQVkxjePNK8+erV5+uYDOABTMM/nP09y9Z8+OHgNjli9ahf//++8vGwrlAS0tp/v///7kYGRm/IasHAIVTy8DG/VpJAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE1LTA3LTIwVDEwOjUwOjA5KzAyOjAwfDtz7wAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxNS0wNy0yMFQxMDo1MDowOSswMjowMA1my1MAAAAASUVORK5CYII=</mdui:Logo>

  		




  
  247
  
    
			      <mdui:InformationURL xml:lang="fr">http://www.vetagro-sup.fr</mdui:InformationURL>

  		




  
  248
  
    

  		




  
  249
  
    
          		      <mdui:DisplayName xml:lang="fr">Vetagro Sup</mdui:DisplayName>

  		




  
  250
  
    

  		




  
  251
  
    
      			    </mdui:UIInfo>

  		




  
  252
  
    
			</md:Extensions>

  		




  
  253
  
    
				<md:KeyDescriptor use="signing">

  		




  
  254
  
    
<ds:KeyInfo>

  		




  
  255
  
    

  		




  
  256
  
    
					  <ds:X509Data>

  		




  
  257
  
    
					    <ds:X509Certificate>

  		




  
  258
  
    
					      MIIDPDCCAiSgAwIBAgIVAL9PsuadPSIZcMHNxlK/oevezmzWMA0GCSqGSIb3DQEB

  		




  
  259
  
    
BQUAMB8xHTAbBgNVBAMTFGFtYnJlLnZldGFncm8tc3VwLmZyMB4XDTEyMTEwODEw

  		




  
  260
  
    
MTQwNFoXDTMyMTEwODEwMTQwNFowHzEdMBsGA1UEAxMUYW1icmUudmV0YWdyby1z

  		




  
  261
  
    
dXAuZnIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCc/ptfpmkomwmT

  		




  
  262
  
    
4RsID+1Ce1dX0eUjcLgSOZN8hVpHWLag2ERWkpmvB5aK7BAFcI5i//Gk80tAiasu

  		




  
  263
  
    
JtlZhBnEw54aTJRGpyL2CVkHyl6SMRxprIi1Ji67IoGqEgUeGaheAxo+tG5e1WSc

  		




  
  264
  
    
bIbldcSKdwvjAV+7HSB4C6NqLsAzJH25++yaRH2uf2LTD0TDzNR9Q2hVj/VyYWR+

  		




  
  265
  
    
K3HWI1Snjn/i7aFfZZhYmBkwHuQOaPhwCM+khikg5XicMsxUhHCMi93UgHGIsdkr

  		




  
  266
  
    
IEGj4xydBTUKsLaykeuFS8EgXbWwCLGkeX76w8xDoFIpnppU/yFd9v7Zg3EBfn4p

  		




  
  267
  
    
kTW3GdIjAgMBAAGjbzBtMEwGA1UdEQRFMEOCFGFtYnJlLnZldGFncm8tc3VwLmZy

  		




  
  268
  
    
hitodHRwczovL2FtYnJlLnZldGFncm8tc3VwLmZyL2lkcC9zaGliYm9sZXRoMB0G

  		




  
  269
  
    
A1UdDgQWBBTPTqWkVHrHXFjmxMWkNt/sp2h5ozANBgkqhkiG9w0BAQUFAAOCAQEA

  		




  
  270
  
    
FvXMtfBUmRZCzz8CjanGzr1TBUPmnkrKci5AtkseKw9YlfUmBXTHB01y697nYq6m

  		




  
  271
  
    
RB6KhvfW212h9CF0IOEEjoadgDhXqGYhq8PnAOtT4Ty3XDy8SbRh8aQWfvnfSngv

  		




  
  272
  
    
FdpHRiSpj5UXXuT5zTtkf59h58XKtEfCkMbUzvdOgUobJzpD0WISmQHPQnx+Neg6

  		




  
  273
  
    
9j7oMRrDiZjS39Om8Imu9xvsnddDM3PlsDBIsvrr1o7K5iLkEdR1YYX0ZNDbiFuw

  		




  
  274
  
    
QXXl2dwQPB8KrScPUvCe57slU2gFQvvIBzjQysxC6V6TPSuM3A/ee56lACuB3jKj

  		




  
  275
  
    
oYkHQc5Gj/1rSMLmu9aLMg==

  		




  
  276
  
    
					    </ds:X509Certificate>

  		




  
  277
  
    
					  </ds:X509Data>

  		




  
  278
  
    

  		




  
  279
  
    
					</ds:KeyInfo>

  		




  
  280
  
    
				</md:KeyDescriptor>

  		




  
  281
  
    

  		




  
  282
  
    

  		




  
  283
  
    

  		




  
  284
  
    

  		




  
  285
  
    

  		




  
  286
  
    
			<md:NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</md:NameIDFormat>

  		




  
  287
  
    
			<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

  		




  
  288
  
    

  		




  
  289
  
    

  		




  
  290
  
    
			<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://ambre.vetagro-sup.fr/idp/profile/SAML2/POST/SSO"/>

  		




  
  291
  
    

  		




  
  292
  
    
	        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://ambre.vetagro-sup.fr/idp/profile/SAML2/Redirect/SSO"/>

  		




  
  293
  
    

  		




  
  294
  
    

  		




  
  295
  
    
			<md:SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://ambre.vetagro-sup.fr/idp/profile/Shibboleth/SSO"/>

  		




  
  296
  
    

  		




  
  297
  
    

  		




  
  298
  
    
		</md:IDPSSODescriptor>

  		




  
  299
  
    

  		




  
  300
  
    

  		




  
  301
  
    

  		




  
  302
  
    
		<md:Organization>

  		




  
  303
  
    

  		




  
  304
  
    
			<md:OrganizationName xml:lang="en">Vetagro Sup</md:OrganizationName>

  		




  
  305
  
    
			<md:OrganizationDisplayName xml:lang="en">Vetagro Sup</md:OrganizationDisplayName>

  		




  
  306
  
    
			<md:OrganizationURL xml:lang="en">http://www.vetagro-sup.fr</md:OrganizationURL>

  		




  
  307
  
    

  		




  
  308
  
    
		</md:Organization>

  		




  
  309
  
    

  		




  
  310
  
    

  		




  
  311
  
    

  		




  
  312
  
    
			    <md:ContactPerson contactType="technical">

  		




  
  313
  
    
				 <md:SurName>Nicolas Aulas</md:SurName>

  		




  
  314
  
    
				 <md:EmailAddress>nicolas.aulas@vetagro-sup.fr</md:EmailAddress>

  		




  
  315
  
    
		        </md:ContactPerson>

  		




  
  316
  
    

  		




  
  317
  
    

  		




  
  318
  
    

  		




  
  319
  
    

  		




  
  320
  
    

  		




  
  321
  
    

  		




  
  322
  
    
	</md:EntityDescriptor><md:EntityDescriptor entityID="https://antimoine.insa-strasbourg.fr/idp/shibboleth">

  		




  
  323
  
    
			<md:Extensions>

  		




  
  324
  
    
				<mdrpi:RegistrationInfo registrationAuthority="https://federation.renater.fr/" registrationInstant="2014-02-11T08:44:08Z">

  		




  
  325
  
    
					<mdrpi:RegistrationPolicy xml:lang="en">https://services.renater.fr/federation/en/metadata_registration_practice_statement</mdrpi:RegistrationPolicy>

  		




  
  326
  
    
				</mdrpi:RegistrationInfo>

  		




  
  327
  
    
			</md:Extensions>

  		




  
  328
  
    
		<md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:2.0:protocol">

  		




  
  329
  
    
			<md:Extensions>

  		




  
  330
  
    
    				<shibmd:Scope regexp="false">insa-strasbourg.fr</shibmd:Scope>

  		




  
  331
  
    

  		




  
  332
  
    
			    <mdui:UIInfo>

  		




  
  333
  
    

  		




  
  334
  
    
			      <mdui:DisplayName xml:lang="en">INSA Strasbourg</mdui:DisplayName>

  		




  
  335
  
    

  		




  
  336
  
    
			      <mdui:Logo height="16" width="16">data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAMAAAAoLQ9TAAAAq1BMVEXeAACEhoTWz87nQTn3oqXnIBjvgnvWlpT/5+fnEAjvZWOltrXnNDH3mpT/9/fnCAD/4+fvioz3x8bnVVL3qq3nKCnvkpTnHBjvcXP3sq3vgoT/7+/nFBDnODH3mpz////nDAj3z87vlpTveXv3vr3nAACMmpznRUL3pqXnJCHnFAj/+//nDADvjoz3y87vXVr3rq3nLCnvdXP3srXvhoT/8/fvODH3npz3lpQaie6kAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAAAQAAAAEABcxq3DAAAAe0lEQVQY053OwQqCQBhF4VM22VSMMWrFGP2kkIpUQ1nz/m8Ws20TeFeHb3WRnzEBBjO8xRjZrURi0TFiy+UITjTpjIKaOndZuDSGxF0j9G1+e7CuLN1nE2F7VI28tAoqMMezP1ieFOOp7RPueBXKSqdnMq8Wg66nPP0LX4uIG4jEwJ0sAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE1LTA3LTIwVDEwOjQ5OjA0KzAyOjAwIHfmJQAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxNS0wNy0yMFQxMDo0OTowNCswMjowMFEqXpkAAAAASUVORK5CYII=</mdui:Logo>

  		




  
  337
  
    
			      <mdui:InformationURL xml:lang="fr">http://www.insa-strasbourg.fr</mdui:InformationURL>

  		




  
  338
  
    

  		




  
  339
  
    
          		      <mdui:DisplayName xml:lang="fr">INSA Strasbourg</mdui:DisplayName>

  		




  
  340
  
    

  		




  
  341
  
    
      			    </mdui:UIInfo>

  		




  
  342
  
    
			</md:Extensions>

  		




  
  343
  
    
				<md:KeyDescriptor use="signing">

  		




  
  344
  
    
<ds:KeyInfo>

  		




  
  345
  
    

  		




  
  346
  
    
					  <ds:X509Data>

  		




  
  347
  
    
					    <ds:X509Certificate>

  		




  
  348
  
    
					      MIIDUDCCAjigAwIBAgIVAIbX8U0uAqAhuXm1jWxiFpggtDTDMA0GCSqGSIb3DQEB

  		




  
  349
  
    
CwUAMCQxIjAgBgNVBAMMGXNvdWZyZS5pbnNhLXN0cmFzYm91cmcuZnIwHhcNMTYw

  		




  
  350
  
    
OTI3MTIzNjIxWhcNMzYwOTI3MTIzNjIxWjAkMSIwIAYDVQQDDBlzb3VmcmUuaW5z

  		




  
  351
  
    
YS1zdHJhc2JvdXJnLmZyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA

  		




  
  352
  
    
sEE02sLRPAG5N81DMHEeGpI2MYF8yG/RiwH07cFIlLqgV80ewOmi0FWPYijxMb8A

  		




  
  353
  
    
bmx0RwUMvJBVI6WMxtT9fykhID20k8rWOuYOzvaynzVqCktqVgKoEAxP1PFE9b0n

  		




  
  354
  
    
iGKFprjjNl9ZD90GOUsxbAO7yXG9Q4WBa/eThl6XkUvNkSaZp5hcdWrgcAdsae3q

  		




  
  355
  
    
iD/uxFa38NXNNeRLGyfxjd2K5qYSzbwBza9s9TOq1+pfw7sxu3/4BnfQ0RLGO6co

  		




  
  356
  
    
4tH4Mufh0ome4cyYk4pvW5DOd1AznxDb8HpqvE0zwEsa69c/FDX0akgFZydmc77a

  		




  
  357
  
    
j6USn6JKjjbO49yGtG1gVQIDAQABo3kwdzAdBgNVHQ4EFgQUjzMsxZYiokPYxper

  		




  
  358
  
    
9zadM8J0F0kwVgYDVR0RBE8wTYIZc291ZnJlLmluc2Etc3RyYXNib3VyZy5mcoYw

  		




  
  359
  
    
aHR0cHM6Ly9zb3VmcmUuaW5zYS1zdHJhc2JvdXJnLmZyL2lkcC9zaGliYm9sZXRo

  		




  
  360
  
    
MA0GCSqGSIb3DQEBCwUAA4IBAQBFJKsiS3yfWuDB/E+iqQ0TuQJzL5+JIcloN0dw

  		




  
  361
  
    
BFxW3VZOju15zeQ7LwRBg9S4SGLMPJU+LM1lvr68cK9brut/FjF51SETIXEeCWo3

  		




  
  362
  
    
7+PIqgOCzraLNinmpU/OtN8ENalOPvpS6Jvbd23qB2t+IqOtZ+j15b0Yq4/on1E3

  		




  
  363
  
    
W2F9CVzKpe4EwmmtCPQbe7U1wvhgFylEx797pex8veWs79YSYwqvcKMh79dzl8Fo

  		




  
  364
  
    
/CgsO5pDrfKmc6SGMkByq75dZj+PqhZDzZ9EFTxbrXOTaS08VRN6a5Rh2iYRnGxq

  		




  
  365
  
    
yZl66tPcaIm5PHgOEmu5X4lPkUoY+Jt36Gj3SGCbYt8qH5S0

  		




  
  366
  
    
					    </ds:X509Certificate>

  		




  
  367
  
    
					  </ds:X509Data>

  		




  
  368
  
    

  		




  
  369
  
    
					</ds:KeyInfo>

  		




  
  370
  
    
				</md:KeyDescriptor>

  		




  
  371
  
    

  		




  
  372
  
    

  		




  
  373
  
    

  		




  
  374
  
    
				<md:KeyDescriptor use="signing">

  		




  
  375
  
    
				       <ds:KeyInfo>

  		




  
  376
  
    
					  <ds:X509Data>

  		




  
  377
  
    
					    <ds:X509Certificate>

  		




  
  378
  
    
					      MIIDXDCCAkSgAwIBAgIVAKI+qiqDCk9wTTqn7OVAoZrvj/CpMA0GCSqGSIb3DQEB

  		




  
  379
  
    
BQUAMCcxJTAjBgNVBAMTHGFudGltb2luZS5pbnNhLXN0cmFzYm91cmcuZnIwHhcN

  		




  
  380
  
    
MTQwMTEzMTAzOTU4WhcNMzQwMTEzMTAzOTU4WjAnMSUwIwYDVQQDExxhbnRpbW9p

  		




  
  381
  
    
bmUuaW5zYS1zdHJhc2JvdXJnLmZyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB

  		




  
  382
  
    
CgKCAQEAtuM8lRjlVjjmrHq9VtguaOMQL+Wd99BiOs56kL3Mbctg1FwH69LYThCW

  		




  
  383
  
    
6dOz6WJg/jU/naF7jEikXKc71xGyu7Ph7Iqa9S5hoXXAT8u/0q2nZDeTOraJqKe1

  		




  
  384
  
    
FMF2RzXhEEMyQO3CiKNK9b+tbKoNZS7FQCixMZklWZPt4EcEKd6jyRq1WYX3dpnb

  		




  
  385
  
    
r9I/aCdhtK/PGvGe5gKTDoTR2HKyWKJTc/obf8x/vlYIEwiaGgdlqI2KiBE0x48n

  		




  
  386
  
    
zQdP6XVi3T8ZWbnkLmCfgJtP2C8PtEJuwDRAy0Z9N4DSwvxn5YCVYgBLSi0TLa10

  		




  
  387
  
    
B/lUqqBezZrTrA9p9Lt8JtGXW5YGHwIDAQABo38wfTBcBgNVHREEVTBTghxhbnRp

  		




  
  388
  
    
bW9pbmUuaW5zYS1zdHJhc2JvdXJnLmZyhjNodHRwczovL2FudGltb2luZS5pbnNh

  		




  
  389
  
    
LXN0cmFzYm91cmcuZnIvaWRwL3NoaWJib2xldGgwHQYDVR0OBBYEFLFkjPZUc9JY

  		




  
  390
  
    
qrWjldJ/iGGkKAt4MA0GCSqGSIb3DQEBBQUAA4IBAQBSk/wU1mRn4VF2ifmy261K

  		




  
  391
  
    
DK7uX+t1H1hh8S38fKSFU7HoNXJTV3vQnmBOpYIGC1gtvmb+qjqpNtikU2zO84Gq

  		




  
  392
  
    
Q0bXHxYF2d9RUP89mKaFxE5uNcXFmlOA3ChZY3pMT5zwAPI/T60tGrex7zci7OLn

  		




  
  393
  
    
JDAQj/q4Yk9ejx6JTFggQSCCVh+oV/SDIMd2p5AY6H3mto3b6XCk7Lssa8a/D30k

  		




  
  394
  
    
pEkZnhTKdN82eRyynuOR7UDU4tasV4d7Mi/j53f5ihnRcsvwh/pYodjoVYY8cEcZ

  		




  
  395
  
    
JLnAXYF8coSwh8UN4D/0NHsvTuSOFQc85hGrqacMsvxiQiw9mv01AX5+A5YLEbVQ

  		




  
  396
  
    
					    </ds:X509Certificate>

  		




  
  397
  
    
					  </ds:X509Data>

  		




  
  398
  
    
					</ds:KeyInfo>

  		




  
  399
  
    
				</md:KeyDescriptor>

  		




  
  400
  
    

  		




  
  401
  
    

  		




  
  402
  
    

  		




  
  403
  
    
			   <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://antimoine.insa-strasbourg.fr/idp/profile/SAML2/Redirect/SLO"/>

  		




  
  404
  
    

  		




  
  405
  
    
			   <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://antimoine.insa-strasbourg.fr/idp/profile/SAML2/POST/SLO"/>

  		




  
  406
  
    

  		




  
  407
  
    
			   <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://antimoine.insa-strasbourg.fr/idp/profile/SAML2/SOAP/SLO"/>

  		




  
  408
  
    

  		




  
  409
  
    

  		




  
  410
  
    
			<md:NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</md:NameIDFormat>

  		




  
  411
  
    
			<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

  		




  
  412
  
    

  		




  
  413
  
    

  		




  
  414
  
    
			<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://antimoine.insa-strasbourg.fr/idp/profile/SAML2/POST/SSO"/>

  		




  
  415
  
    

  		




  
  416
  
    
	        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://antimoine.insa-strasbourg.fr/idp/profile/SAML2/Redirect/SSO"/>

  		




  
  417
  
    

  		




  
  418
  
    

  		




  
  419
  
    
			<md:SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://antimoine.insa-strasbourg.fr/idp/profile/Shibboleth/SSO"/>

  		




  
  420
  
    

  		




  
  421
  
    

  		




  
  422
  
    
		</md:IDPSSODescriptor>

  		




  
  423
  
    

  		




  
  424
  
    

  		




  
  425
  
    

  		




  
  426
  
    
		<md:Organization>

  		




  
  427
  
    

  		




  
  428
  
    
			<md:OrganizationName xml:lang="en">INSA Strasbourg</md:OrganizationName>

  		




  
  429
  
    
			<md:OrganizationDisplayName xml:lang="en">INSA Strasbourg</md:OrganizationDisplayName>

  		




  
  430
  
    
			<md:OrganizationURL xml:lang="en">http://www.insa-strasbourg.fr</md:OrganizationURL>

  		




  
  431
  
    

  		




  
  432
  
    
		</md:Organization>

  		




  
  433
  
    

  		




  
  434
  
    

  		




  
  435
  
    

  		




  
  436
  
    
			    <md:ContactPerson contactType="technical">

  		




  
  437
  
    
				 <md:SurName>Lahsen BOUZID</md:SurName>

  		




  
  438
  
    
				 <md:EmailAddress>lahsen.bouzid@insa-strasbourg.fr</md:EmailAddress>

  		




  
  439
  
    
		        </md:ContactPerson>

  		




  
  440
  
    

  		




  
  441
  
    

  		




  
  442
  
    

  		




  
  443
  
    
			    <md:ContactPerson contactType="technical">

  		




  
  444
  
    
				 <md:SurName>Simon SCHERRER</md:SurName>

  		




  
  445
  
    
				 <md:EmailAddress>simon.scherrer@insa-strasbourg.fr</md:EmailAddress>

  		




  
  446
  
    
		        </md:ContactPerson>

  		




  
  447
  
    

  		




  
  448
  
    

  		




  
  449
  
    

  		




  
  450
  
    

  		




  
  451
  
    
        </md:EntityDescriptor>

  		




  
  452
  
    
    

  		




  
  453
  
    
<md:EntityDescriptor entityID="http://idp5/metadata">

  		




  
  454
  
    
<md:IDPSSODescriptor

  		




  
  455
  
    
    WantAuthnRequestsSigned="true"

  		




  
  456
  
    
    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

  		




  
  457
  
    
<md:KeyDescriptor use="signing">

  		




  
  458
  
    
    <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

  		




  
  459
  
    
      <ds:X509Data><ds:X509Certificate>

  		




  
  460
  
    
MIIDnjCCAoagAwIBAgIBATANBgkqhkiG9w0BAQUFADBUMQswCQYDVQQGEwJGUjEP

  		




  
  461
  
    
MA0GA1UECBMGRnJhbmNlMQ4wDAYDVQQHEwVQYXJpczETMBEGA1UEChMKRW50cm91

  		




  
  462
  
    
dmVydDEPMA0GA1UEAxMGRGFtaWVuMB4XDTA2MTAyNzA5MDc1NFoXDTExMTAyNjA5

  		




  
  463
  
    
MDc1NFowVDELMAkGA1UEBhMCRlIxDzANBgNVBAgTBkZyYW5jZTEOMAwGA1UEBxMF

  		




  
  464
  
    
UGFyaXMxEzARBgNVBAoTCkVudHJvdXZlcnQxDzANBgNVBAMTBkRhbWllbjCCASIw

  		




  
  465
  
    
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM06Hx6VgHYR9wUf/tZVVTRkVWNq

  		




  
  466
  
    
h9x+PvHA2qH4OYMuqGs4Af6lU2YsZvnrmRdcFWv0+UkdAgXhReCWAZgtB1pd/W9m

  		




  
  467
  
    
6qDRldCCyysow6xPPKRz/pOTwRXm/fM0QGPeXzwzj34BXOIOuFu+n764vKn18d+u

  		




  
  468
  
    
uVAEzk1576pxTp4pQPzJfdNLrLeQ8vyCshoFU+MYJtp1UA+h2JoO0Y8oGvywbUxH

  		




  
  469
  
    
ioHN5PvnzObfAM4XaDQohmfxM9Uc7Wp4xKAc1nUq5hwBrHpjFMRSz6UCfMoJSGIi

  		




  
  470
  
    
+3xJMkNCjL0XEw5NKVc5jRKkzSkN5j8KTM/k1jPPsDHPRYzbWWhnNtd6JlkCAwEA

  		




  
  471
  
    
AaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0

  		




  
  472
  
    
ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFP2WWMDShux3iF74+SoO1xf6qhqaMB8G

  		




  
  473
  
    
A1UdIwQYMBaAFGjl6TRXbQDHzSlZu+e8VeBaZMB5MA0GCSqGSIb3DQEBBQUAA4IB

  		




  
  474
  
    
AQAZ/imK7UMognXbs5RfSB8cMW6iNAI+JZqe9XWjvtmLfIIPbHM96o953SiFvrvQ

  		




  
  475
  
    
BZjGmmPMK3UH29cjzDx1R/RQaYTyMrHyTePLh3BMd5mpJ/9eeJCSxPzE2ECqWRUa

  		




  
  476
  
    
pkjukecFXqmRItwgTxSIUE9QkpzvuQRb268PwmgroE0mwtiREADnvTFkLkdiEMew

  		




  
  477
  
    
fiYxZfJJLPBqwlkw/7f1SyzXoPXnz5QbNwDmrHelga6rKSprYKb3pueqaIe8j/AP

  		




  
  478
  
    
NC1/bzp8cGOcJ88BD5+Ny6qgPVCrMLE5twQumJ12V3SvjGNtzFBvg2c/9S5OmVqR

  		




  
  479
  
    
LlTxKnCrWAXftSm1rNtewTsF

  		




  
  480
  
    
</ds:X509Certificate></ds:X509Data>

  		




  
  481
  
    
    </ds:KeyInfo>

  		




  
  482
  
    
  </md:KeyDescriptor>

  		




  
  483
  
    
<md:KeyDescriptor use="encryption">

  		




  
  484
  
    
    <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

  		




  
  485
  
    
      <ds:KeyValue>

  		




  
  486
  
    
MIIDnjCCAoagAwIBAgIBATANBgkqhkiG9w0BAQUFADBUMQswCQYDVQQGEwJGUjEP

  		




  
  487
  
    
MA0GA1UECBMGRnJhbmNlMQ4wDAYDVQQHEwVQYXJpczETMBEGA1UEChMKRW50cm91

  		




  
  488
  
    
dmVydDEPMA0GA1UEAxMGRGFtaWVuMB4XDTA2MTAyNzA5MDc1NFoXDTExMTAyNjA5

  		




  
  489
  
    
MDc1NFowVDELMAkGA1UEBhMCRlIxDzANBgNVBAgTBkZyYW5jZTEOMAwGA1UEBxMF

  		




  
  490
  
    
UGFyaXMxEzARBgNVBAoTCkVudHJvdXZlcnQxDzANBgNVBAMTBkRhbWllbjCCASIw

  		




  
  491
  
    
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM06Hx6VgHYR9wUf/tZVVTRkVWNq

  		




  
  492
  
    
h9x+PvHA2qH4OYMuqGs4Af6lU2YsZvnrmRdcFWv0+UkdAgXhReCWAZgtB1pd/W9m

  		




  
  493
  
    
6qDRldCCyysow6xPPKRz/pOTwRXm/fM0QGPeXzwzj34BXOIOuFu+n764vKn18d+u

  		




  
  494
  
    
uVAEzk1576pxTp4pQPzJfdNLrLeQ8vyCshoFU+MYJtp1UA+h2JoO0Y8oGvywbUxH

  		




  
  495
  
    
ioHN5PvnzObfAM4XaDQohmfxM9Uc7Wp4xKAc1nUq5hwBrHpjFMRSz6UCfMoJSGIi

  		




  
  496
  
    
+3xJMkNCjL0XEw5NKVc5jRKkzSkN5j8KTM/k1jPPsDHPRYzbWWhnNtd6JlkCAwEA

  		




  
  497
  
    
AaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0

  		




  
  498
  
    
ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFP2WWMDShux3iF74+SoO1xf6qhqaMB8G

  		




  
  499
  
    
A1UdIwQYMBaAFGjl6TRXbQDHzSlZu+e8VeBaZMB5MA0GCSqGSIb3DQEBBQUAA4IB

  		




  
  500
  
    
AQAZ/imK7UMognXbs5RfSB8cMW6iNAI+JZqe9XWjvtmLfIIPbHM96o953SiFvrvQ

  		




  
  501
  
    
BZjGmmPMK3UH29cjzDx1R/RQaYTyMrHyTePLh3BMd5mpJ/9eeJCSxPzE2ECqWRUa

  		




  
  502
  
    
pkjukecFXqmRItwgTxSIUE9QkpzvuQRb268PwmgroE0mwtiREADnvTFkLkdiEMew

  		




  
  503
  
    
fiYxZfJJLPBqwlkw/7f1SyzXoPXnz5QbNwDmrHelga6rKSprYKb3pueqaIe8j/AP

  		




  
  504
  
    
NC1/bzp8cGOcJ88BD5+Ny6qgPVCrMLE5twQumJ12V3SvjGNtzFBvg2c/9S5OmVqR

  		




  
  505
  
    
LlTxKnCrWAXftSm1rNtewTsF

  		




  
  506
  
    
</ds:KeyValue>

  		




  
  507
  
    
    </ds:KeyInfo>

  		




  
  508
  
    
  </md:KeyDescriptor>

  		




  
  509
  
    

  		




  
  510
  
    
  <md:ArtifactResolutionService isDefault="true" index="0"

  		




  
  511
  
    
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"

  		




  
  512
  
    
    Location="http://idp5/artifact" />

  		




  
  513
  
    
  <md:SingleLogoutService

  		




  
  514
  
    
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"

  		




  
  515
  
    
    Location="http://idp5/singleLogoutSOAP" />

  		




  
  516
  
    
  <md:SingleLogoutService

  		




  
  517
  
    
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"

  		




  
  518
  
    
    Location="http://idp5/singleLogout"

  		




  
  519
  
    
    ResponseLocation="http://idp5/singleLogoutReturn" />

  		




  
  520
  
    
  <md:ManageNameIDService

  		




  
  521
  
    
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"

  		




  
  522
  
    
    Location="http://idp5/manageNameIdSOAP" />

  		




  
  523
  
    
  <md:ManageNameIDService

  		




  
  524
  
    
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"

  		




  
  525
  
    
    Location="http://idp5/manageNameId"

  		




  
  526
  
    
    ResponseLocation="http://idp5/manageNameIdReturn" />

  		




  
  527
  
    
  <md:SingleSignOnService

  		




  
  528
  
    
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"

  		




  
  529
  
    
    Location="http://idp5/singleSignOn" />

  		




  
  530
  
    
  <md:SingleSignOnService

  		




  
  531
  
    
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"

  		




  
  532
  
    
    Location="http://idp5/singleSignOnSOAP" />

  		




  
  533
  
    
</md:IDPSSODescriptor>

  		




  
  534
  
    
<md:AuthnAuthorityDescriptor

  		




  
  535
  
    
    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

  		




  
  536
  
    
	<md:AuthnQueryService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="http://idp6/authnQueryService"/>

  		




  
  537
  
    
	<md:AssertionIDRequestService Binding="urn:oasis:names:tc:SAML:2.0:bindings:URI" Location="http://idp6/authnAuthAssertionIDRequestService"/>

  		




  
  538
  
    
	<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>

  		




  
  539
  
    
</md:AuthnAuthorityDescriptor>

  		




  
  540
  
    
<md:PDPDescriptor

  		




  
  541
  
    
    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

  		




  
  542
  
    
	<md:AuthzService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="http://idp6/authzService"/>

  		




  
  543
  
    
	<md:AssertionIDRequestService Binding="urn:oasis:names:tc:SAML:2.0:bindings:URI" Location="http://idp6/PDPAuthAssertionIDRequestService"/>

  		




  
  544
  
    
	<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:kerberos</md:NameIDFormat>

  		




  
  545
  
    
</md:PDPDescriptor>

  		




  
  546
  
    
<md:AttributeAuthorityDescriptor

  		




  
  547
  
    
    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

  		




  
  548
  
    
	<md:AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="http://idp6/attributeService"/>

  		




  
  549
  
    
	<md:AssertionIDRequestService Binding="urn:oasis:names:tc:SAML:2.0:bindings:URI" Location="http://idp6/AttributeAuthAssertionIDRequestService"/>

  		




  
  550
  
    
	<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat>

  		




  
  551
  
    
</md:AttributeAuthorityDescriptor>

  		




  
  552
  
    
<md:Organization>

  		




  
  553
  
    
   <md:OrganizationName xml:lang="en">Entr'ouvert</md:OrganizationName>

  		




  
  554
  
    
</md:Organization>

  		




  
  555
  
    

  		




  
  556
  
    
</md:EntityDescriptor>

  		




  
  557
  
    
    </md:EntitiesDescriptor>

  		












  

    
      tests/test_default_adapter.py
    
  





  89
  89
  
    
    assert user.email == 'test@example.net'

  		




  90
  90
  
    
    assert user.is_superuser is False

  		




  91
  91
  
    
    assert user.is_staff is False

  		




  92
  
  
    
    assert len(caplog.records) == 4

  		




  
  92
  
    
    assert len(caplog.records) == 5

  		




  93
  93
  
    
    assert 'created new user' in caplog.text

  		




  94
  94
  
    
    assert 'set field first_name' in caplog.text

  		




  95
  95
  
    
    assert 'set field last_name' in caplog.text

  		




  ......




  102
  102
  
    
    user = SAMLBackend().authenticate(saml_attributes=saml_attributes)

  		




  103
  103
  
    
    assert user.groups.count() == 3

  		




  104
  104
  
    
    assert set(user.groups.values_list('name', flat=True)) == set(saml_attributes['group'])

  		




  105
  
  
    
    assert len(caplog.records) == 4

  		




  
  105
  
    
    assert len(caplog.records) == 5

  		




  106
  106
  
    
    assert 'created new user' in caplog.text

  		




  107
  107
  
    
    assert 'adding group GroupA' in caplog.text

  		




  108
  108
  
    
    assert 'adding group GroupB' in caplog.text

  		




  ......




  112
  112
  
    
    user = SAMLBackend().authenticate(saml_attributes=saml_attributes2)

  		




  113
  113
  
    
    assert user.groups.count() == 2

  		




  114
  114
  
    
    assert set(user.groups.values_list('name', flat=True)) == set(saml_attributes2['group'])

  		




  115
  
  
    
    assert len(caplog.records) == 5

  		




  
  115
  
    
    assert len(caplog.records) == 7

  		




  116
  116
  
    
    assert 'removing group GroupA' in caplog.records[-1].message

  		




  117
  117
  
    

  		




  118
  118
  
    

  		




  ......




  142
  142
  
    
    del local_saml_attributes['email']

  		




  143
  143
  
    
    user = SAMLBackend().authenticate(saml_attributes=local_saml_attributes)

  		




  144
  144
  
    
    assert not user.email

  		




  145
  
  
    
    assert len(caplog.records) == 4

  		




  
  145
  
    
    assert len(caplog.records) == 5

  		




  146
  146
  
    
    assert 'created new user' in caplog.text

  		




  147
  147
  
    
    assert re.search(r'invalid reference.*email', caplog.text)

  		




  148
  148
  
    
    assert 'set field first_name' in caplog.text

  		




  ......




  160
  160
  
    
    local_saml_attributes['first_name'] = [('y' * 32)]

  		




  161
  161
  
    
    user = SAMLBackend().authenticate(saml_attributes=local_saml_attributes)

  		




  162
  162
  
    
    assert user.first_name == 'y' * 30

  		




  163
  
  
    
    assert len(caplog.records) == 4

  		




  
  163
  
    
    assert len(caplog.records) == 5

  		




  164
  164
  
    
    assert 'created new user' in caplog.text

  		




  165
  165
  
    
    assert 'set field first_name' in caplog.text

  		




  166
  166
  
    
    assert 'to value %r ' % (u'y' * 30) in caplog.text

  		












  

    
      tests/test_federations_utils.py
    
  





  
  1
  
    
import os

  		




  
  2
  
    
import time

  		




  
  3
  
    

  		




  
  4
  
    
from django.core.files.storage import default_storage

  		




  
  5
  
    
from django.utils.text import slugify

  		




  
  6
  
    
from httmock import HTTMock

  		




  
  7
  
    

  		




  
  8
  
    
from mellon.federation_utils import get_federation_from_url, truncate_unique

  		




  
  9
  
    
from utils import sample_federation_response

  		




  
  10
  
    

  		




  
  11
  
    

  		




  
  12
  
    
def test_mock_fedmd_caching():

  		




  
  13
  
    
    url = u'https://dummy.mdserver/metadata.xml'

  		




  
  14
  
    
    filepath = default_storage.path(os.path.join('metadata-cache/', truncate_unique(slugify(url))))

  		




  
  15
  
    

  		




  
  16
  
    
    with HTTMock(sample_federation_response):

  		




  
  17
  
    
        tmp = get_federation_from_url(url)

  		




  
  18
  
    

  		




  
  19
  
    
    assert default_storage.path(tmp) == filepath

  		




  
  20
  
    

  		




  
  21
  
    
    st = os.stat(filepath)

  		




  
  22
  
    

  		




  
  23
  
    
    assert os.path.isfile(filepath)

  		




  
  24
  
    
    assert st.st_mtime < time.time() + 3600

  		




  
  25
  
    

  		




  
  26
  
    
    with HTTMock(sample_federation_response):

  		




  
  27
  
    
        get_federation_from_url(url)

  		




  
  28
  
    
    stnew = os.stat(filepath)

  		




  
  29
  
    

  		




  
  30
  
    
    assert stnew.st_ctime == st.st_ctime

  		




  
  31
  
    
    assert stnew.st_mtime == st.st_mtime

  		




  
  32
  
    

  		




  
  33
  
    
    storig = os.stat(os.path.join('tests', 'federation-sample.xml'))

  		




  
  34
  
    

  		




  
  35
  
    
    assert storig.st_size == st.st_size

  		












  

    
      tests/test_sso_slo.py
    
  





  4
  4
  
    

  		




  5
  5
  
    
from django.core.urlresolvers import reverse

  		




  6
  6
  
    

  		




  7
  
  
    
from mellon.utils import create_metadata

  		




  
  7
  
    
from mellon.utils import create_metadata, create_server

  		




  
  8
  
    
from django.utils.http import urlencode

  		




  8
  9
  
    

  		




  9
  10
  
    
from httmock import all_requests, HTTMock, response as mock_response

  		




  10
  11
  
    

  		




  ......




  17
  18
  
    

  		




  18
  19
  
    

  		




  19
  20
  
    
@fixture

  		




  
  21
  
    
def federation_metadata():

  		




  
  22
  
    
    return './tests/federation-sample.xml'

  		




  
  23
  
    

  		




  
  24
  
    

  		




  
  25
  
    
@fixture

  		




  20
  26
  
    
def idp_private_key():

  		




  21
  27
  
    
    return open('tests/idp-private-key.pem').read()

  		




  22
  28
  
    

  		




  ......




  44
  50
  
    

  		




  45
  51
  
    

  		




  46
  52
  
    
@fixture

  		




  
  53
  
    
def federated_sp_settings(private_settings, federation_metadata, sp_private_key, public_key):

  		




  
  54
  
    
    private_settings.MELLON_FEDERATIONS = [{

  		




  
  55
  
    
        'FEDERATION': federation_metadata,

  		




  
  56
  
    
    }]

  		




  
  57
  
    
    private_settings.MELLON_PUBLIC_KEYS = [public_key]

  		




  
  58
  
    
    private_settings.MELLON_PRIVATE_KEYS = [sp_private_key]

  		




  
  59
  
    
    private_settings.MELLON_NAME_ID_POLICY_FORMAT = lasso.SAML2_NAME_IDENTIFIER_FORMAT_PERSISTENT

  		




  
  60
  
    
    private_settings.LOGIN_REDIRECT_URL = '/'

  		




  
  61
  
    
    return private_settings

  		




  
  62
  
    

  		




  
  63
  
    

  		




  
  64
  
    
@fixture

  		




  47
  65
  
    
def sp_metadata(sp_settings, rf):

  		




  48
  66
  
    
    request = rf.get('/')

  		




  49
  67
  
    
    return create_metadata(request)

  		




  50
  68
  
    

  		




  51
  69
  
    

  		




  
  70
  
    
@fixture

  		




  
  71
  
    
def federated_sp_metadata(federated_sp_settings, rf):

  		




  
  72
  
    
    request = rf.get('/')

  		




  
  73
  
    
    return create_metadata(request)

  		




  
  74
  
    

  		




  
  75
  
    

  		




  52
  76
  
    
class MockIdp(object):

  		




  53
  77
  
    
    def __init__(self, idp_metadata, private_key, sp_metadata):

  		




  54
  78
  
    
        self.server = server = lasso.Server.newFromBuffers(idp_metadata, private_key)

  		




  ......




  103
  127
  
    
    return MockIdp(idp_metadata, idp_private_key, sp_metadata)

  		




  104
  128
  
    

  		




  105
  129
  
    

  		




  
  130
  
    
@fixture

  		




  
  131
  
    
def federated_idp(federated_sp_settings, idp_metadata, idp_private_key, federated_sp_metadata):

  		




  
  132
  
    
    return MockIdp(idp_metadata, idp_private_key, federated_sp_metadata)

  		




  
  133
  
    

  		




  
  134
  
    

  		




  106
  135
  
    
def test_sso_slo(db, app, idp, caplog, sp_settings):

  		




  107
  136
  
    
    response = app.get(reverse('mellon_login'))

  		




  108
  137
  
    
    url, body = idp.process_authn_request_redirect(response['Location'])

  		




  ......




  171
  200
  
    
    assert 'created new user' in caplog.text

  		




  172
  201
  
    
    assert 'logged in using SAML' in caplog.text

  		




  173
  202
  
    
    assert response['Location'].endswith(sp_settings.LOGIN_REDIRECT_URL)

  		




  
  203
  
    

  		




  
  204
  
    

  		




  
  205
  
    
def test_login_federation(db, app, federated_idp, caplog, federated_sp_settings):

  		




  
  206
  
    
    qs = urlencode({

  		




  
  207
  
    
        'entityID': 'http://idp5/metadata',

  		




  
  208
  
    
    })

  		




  
  209
  
    
    response = app.get('/login/?' + qs)

  		




  
  210
  
    
    url, body = federated_idp.process_authn_request_redirect(response['Location'])

  		




  
  211
  
    
    assert url.endswith(reverse('mellon_login'))

  		




  
  212
  
    
    response = app.post(reverse('mellon_login'), params={'SAMLResponse': body})

  		




  
  213
  
    
    assert 'created new user' in caplog.text

  		




  
  214
  
    
    assert 'logged in using SAML' in caplog.text

  		




  
  215
  
    
    assert response['Location'].endswith(federated_sp_settings.LOGIN_REDIRECT_URL)

  		




  
  216
  
    

  		




  
  217
  
    

  		




  
  218
  
    
def test_sso_artifact_federation(db, app, caplog, federated_sp_settings, idp_metadata, idp_private_key, rf):

  		




  
  219
  
    
    qs = urlencode({

  		




  
  220
  
    
        'entityID': 'http://idp5/metadata',

  		




  
  221
  
    
    })

  		




  
  222
  
    
    federated_sp_settings.MELLON_DEFAULT_ASSERTION_CONSUMER_BINDING = 'artifact'

  		




  
  223
  
    
    request = rf.get('/')

  		




  
  224
  
    
    federated_sp_metadata = create_metadata(request)

  		




  
  225
  
    
    idp = MockIdp(idp_metadata, idp_private_key, federated_sp_metadata)

  		




  
  226
  
    
    response = app.get('/login/?' + qs)

  		




  
  227
  
    
    url, body = idp.process_authn_request_redirect(response['Location'])

  		




  
  228
  
    
    assert body is None

  		




  
  229
  
    
    assert reverse('mellon_login') in url

  		




  
  230
  
    
    assert 'SAMLart' in url

  		




  
  231
  
    
    acs_artifact_url = url.split('testserver', 1)[1]

  		




  
  232
  
    
    with HTTMock(idp.mock_artifact_resolver()):

  		




  
  233
  
    
        response = app.get(acs_artifact_url)

  		




  
  234
  
    
    assert 'created new user' in caplog.text

  		




  
  235
  
    
    assert 'logged in using SAML' in caplog.text

  		




  
  236
  
    
    assert response['Location'].endswith(federated_sp_settings.LOGIN_REDIRECT_URL)

  		




  
  237
  
    
    # force delog

  		




  
  238
  
    
    app.session.flush()

  		




  
  239
  
    
    assert 'dead artifact' not in caplog.text

  		




  
  240
  
    
    with HTTMock(idp.mock_artifact_resolver()):

  		




  
  241
  
    
        response = app.get(acs_artifact_url)

  		




  
  242
  
    
    # verify retry login was asked

  		




  
  243
  
    
    assert 'dead artifact' in caplog.text

  		




  
  244
  
    
    assert response.status_code == 302

  		




  
  245
  
    
    assert reverse('mellon_login') in url

  		




  
  246
  
    
    response = response.follow()

  		




  
  247
  
    
    url, body = idp.process_authn_request_redirect(response['Location'])

  		




  
  248
  
    
    reset_caplog(caplog)

  		




  
  249
  
    
    # verify caplog has been cleaned

  		




  
  250
  
    
    assert 'created new user' not in caplog.text

  		




  
  251
  
    
    assert body is None

  		




  
  252
  
    
    assert reverse('mellon_login') in url

  		




  
  253
  
    
    assert 'SAMLart' in url

  		




  
  254
  
    
    acs_artifact_url = url.split('testserver', 1)[1]

  		




  
  255
  
    
    with HTTMock(idp.mock_artifact_resolver()):

  		




  
  256
  
    
        response = app.get(acs_artifact_url)

  		




  
  257
  
    
    assert 'created new user' in caplog.text

  		




  
  258
  
    
    assert 'logged in using SAML' in caplog.text

  		




  
  259
  
    
    assert response['Location'].endswith(federated_sp_settings.LOGIN_REDIRECT_URL)

  		












  

    
      tests/test_utils.py
    
  





  
  1
  
    
import os

  		




  1
  2
  
    
import re

  		




  2
  3
  
    
import datetime

  		




  3
  4
  
    

  		




  ......




  6
  7
  
    
import requests.exceptions

  		




  7
  8
  
    
from httmock import HTTMock

  		




  8
  9
  
    

  		




  9
  
  
    
from mellon.utils import create_server, create_metadata, iso8601_to_datetime, flatten_datetime

  		




  
  10
  
    
from mellon.utils import create_server, create_metadata, iso8601_to_datetime, \

  		




  
  11
  
    
        flatten_datetime, get_idp

  		




  10
  12
  
    
import mellon.utils

  		




  11
  13
  
    
from xml_utils import assert_xml_constraints

  		




  12
  14
  
    

  		




  13
  
  
    
from utils import error_500, metadata_response

  		




  
  15
  
    
from utils import error_500, metadata_response, sample_federation_response, \

  		




  
  16
  
    
        html_response, dummy_md_response

  		




  14
  17
  
    

  		




  15
  18
  
    

  		




  16
  19
  
    
def test_create_server_connection_error(mocker, rf, private_settings, caplog):

  		




  ......




  39
  42
  
    
    assert 'failed with error' in caplog.text

  		




  40
  43
  
    

  		




  41
  44
  
    

  		




  
  45
  
    
def test_load_federation_file(mocker, rf, private_settings, caplog, tmpdir):

  		




  
  46
  
    
    private_settings.MELLON_FEDERATIONS = [

  		




  
  47
  
    
            {'FEDERATION': 'tests/federation-sample.xml'},

  		




  
  48
  
    
    ]

  		




  
  49
  
    
    request = rf.get('/')

  		




  
  50
  
    
    assert 'failed with error' not in caplog.text

  		




  
  51
  
    
    with HTTMock(html_response):

  		




  
  52
  
    
        server = create_server(request)

  		




  
  53
  
    
    assert len(server.providers) == 5

  		




  
  54
  
    

  		




  
  55
  
    

  		




  
  56
  
    
def test_load_federation_url(mocker, rf, private_settings, caplog, tmpdir):

  		




  
  57
  
    
    private_settings.MELLON_FEDERATIONS = [

  		




  
  58
  
    
            {'FEDERATION': 'https://dummy.server/metadata.xml'},

  		




  
  59
  
    
    ]

  		




  
  60
  
    
    request = rf.get('/')

  		




  
  61
  
    
    assert 'failed with error' not in caplog.text

  		




  
  62
  
    
    with HTTMock(dummy_md_response):

  		




  
  63
  
    
        server = create_server(request)

  		




  
  64
  
    
    assert len(server.providers) == 3

  		




  
  65
  
    

  		




  
  66
  
    

  		




  
  67
  
    
def test_federation_parameters(mocker, rf, private_settings, caplog, tmpdir):

  		




  
  68
  
    
    private_settings.MELLON_FEDERATIONS = [{

  		




  
  69
  
    
            'FEDERATION': 'tests/federation-sample.xml',

  		




  
  70
  
    
            'VERIFY_SSL_CERTIFICATE': False,

  		




  
  71
  
    
            'ERROR_REDIRECT_AFTER_TIMEOUT': 150,

  		




  
  72
  
    
            'PROVISION': True

  		




  
  73
  
    
    }]

  		




  
  74
  
    
    request = rf.get('/')

  		




  
  75
  
    
    assert 'failed with error' not in caplog.text

  		




  
  76
  
    
    with HTTMock(html_response):

  		




  
  77
  
    
        server = create_server(request)

  		




  
  78
  
    
    assert len(server.providers) == 5

  		




  
  79
  
    
    for entity_id in server.providers.keys():

  		




  
  80
  
    
        idp = get_idp(entity_id)

  		




  
  81
  
    
        assert idp

  		




  
  82
  
    
        assert idp['VERIFY_SSL_CERTIFICATE'] is False

  		




  
  83
  
    
        assert idp['ERROR_REDIRECT_AFTER_TIMEOUT'] == 150

  		




  
  84
  
    
        assert idp['PROVISION'] is True

  		




  
  85
  
    

  		




  
  86
  
    

  		




  42
  87
  
    
def test_create_server_invalid_metadata(mocker, rf, private_settings, caplog):

  		




  43
  88
  
    
    private_settings.MELLON_IDENTITY_PROVIDERS = [

  		




  44
  89
  
    
        {

  		




  ......




  49
  94
  
    
    assert not 'failed with error' in caplog.text

  		




  50
  95
  
    
    with HTTMock(error_500):

  		




  51
  96
  
    
        create_server(request)

  		




  52
  
  
    
    assert len(caplog.records) == 1

  		




  53
  
  
    
    assert re.search('METADATA.*is invalid', caplog.text)

  		




  
  97
  
    
    assert len(caplog.records) == 5

  		




  
  98
  
    
    assert re.search('METADATA.*is invalid|bad metadata in idp', caplog.text)

  		




  54
  99
  
    

  		




  55
  100
  
    

  		




  56
  101
  
    
def test_create_server_invalid_metadata_file(mocker, rf, private_settings, caplog):

  		




  ......




  70
  115
  
    
def test_create_server_good_metadata_file(mocker, rf, private_settings, caplog):

  		




  71
  116
  
    
    private_settings.MELLON_IDENTITY_PROVIDERS = [

  		




  72
  117
  
    
        {

  		




  73
  
  
    
            'METADATA': '/xxx',

  		




  
  118
  
    
            'METADATA': './tests/metadata.xml',

  		




  74
  119
  
    
        }

  		




  75
  120
  
    
    ]

  		




  76
  121
  
    
    request = rf.get('/')

  		




  77
  
  
    
    with mock.patch(

  		




  78
  
  
    
        'mellon.adapters.file', mock.mock_open(read_data=file('tests/metadata.xml').read()),

  		




  79
  
  
    
            create=True):

  		




  
  122
  
    
    with HTTMock(html_response):

  		




  80
  123
  
    
        server = create_server(request)

  		




  81
  124
  
    
    assert 'ERROR' not in caplog.text

  		




  82
  125
  
    
    assert len(server.providers) == 1

  		












  

    
      tests/utils.py
    
  





  16
  16
  
    
    return response(200, content=file('tests/metadata.xml').read())

  		




  17
  17
  
    

  		




  18
  18
  
    

  		




  
  19
  
    
@all_requests

  		




  
  20
  
    
def dummy_md_response(url, request):

  		




  
  21
  
    
    return response(200, content=file('tests/dummy_md.xml').read())

  		




  
  22
  
    

  		




  
  23
  
    

  		




  
  24
  
    
@all_requests

  		




  
  25
  
    
def sample_federation_response(url, request):

  		




  
  26
  
    
    return response(200, content=file('tests/federation-sample.xml').read())

  		




  
  27
  
    

  		




  
  28
  
    

  		




  19
  29
  
    
def reset_caplog(cap):

  		




  20
  30
  
    
    cap.handler.stream.truncate(0)

  		




  21
  31
  
    
    cap.handler.records = []

  		




  22
  
  
    
-