Projet

Général

Profil

0001-saml-use-RSA-SHA256-signature-method-32011.patch

Benjamin Dauvergne, 04 avril 2019 19:02

Télécharger (4,26 ko)

Voir les différences: 

Subject: [PATCH] saml: use RSA-SHA256 signature method (#32011)


 src/authentic2/idp/saml/app_settings.py | 1 +
 src/authentic2/saml/common.py           | 7 +++++++
 tests/test_idp_saml2.py                 | 9 +++++++--
 3 files changed, 15 insertions(+), 2 deletions(-)
src/authentic2/idp/saml/app_settings.py
51 51 
TKX6tp6oI+7MIJE6ySZ0cBqOiydAkBePZhu57j6ToBkTa0dbHjn1WA==
52 52 
-----END RSA PRIVATE KEY-----''',
53 53 
            ADD_CERTIFICATE_TO_KEY_INFO=True,
54 
            SIGNATURE_METHOD='RSA-SHA256',
54 55 
    )
55 56 

  		




  56
  57
  
    
    def __init__(self, prefix):

  		












  

    
      src/authentic2/saml/common.py
    
  





  113
  113
  
    
        get_saml2_metadata(request, metadata, idp_map=idp_map, sp_map=sp_map,

  		




  114
  114
  
    
                           options=options),

  		




  115
  115
  
    
        options.get('private_key'), certificate_content=certificate_content)

  		




  
  116
  
    
    if app_settings.SIGNATURE_METHOD:

  		




  
  117
  
    
            signature_method = app_settings.SIGNATURE_METHOD

  		




  
  118
  
    
            symbol_name = 'SIGNATURE_METHOD_' + signature_method.replace('-', '_').upper()

  		




  
  119
  
    
            if hasattr(lasso, symbol_name):

  		




  
  120
  
    
                server.signatureMethod = getattr(lasso, symbol_name)

  		




  
  121
  
    
            else:

  		




  
  122
  
    
                logger.warning('idp_saml: unable to set signature method %s', signature_method)

  		




  116
  123
  
    
    if not server:

  		




  117
  124
  
    
        raise Exception('Cannot create LassoServer object')

  		




  118
  125
  
    
    return server

  		












  

    
      tests/test_idp_saml2.py
    
  





  72
  72
  
    
        sp_meta = self.get_sp_metadata(base_url=base_url)

  		




  73
  73
  
    
        idp_meta = self.get_idp_metadata()

  		




  74
  74
  
    
        server = lasso.Server.newFromBuffers(sp_meta)

  		




  
  75
  
    
        server.signatureMethod = lasso.SIGNATURE_METHOD_RSA_SHA256

  		




  75
  76
  
    
        server.addProviderFromBuffer(lasso.PROVIDER_ROLE_IDP, idp_meta)

  		




  76
  77
  
    
        return server

  		




  77
  78
  
    

  		




  ......




  213
  214
  
    
        url_parsed = urlparse.urlparse(login.msgUrl)

  		




  214
  215
  
    
        self.assertEqual(url_parsed.path, reverse('a2-idp-saml-sso'),

  		




  215
  216
  
    
                         'msgUrl should target the sso endpoint')

  		




  
  217
  
    
        if sign:

  		




  
  218
  
    
            assert 'rsa-sha256' in login.msgUrl

  		




  216
  219
  
    
        return login.msgUrl, login.msgBody, request.id

  		




  217
  220
  
    

  		




  218
  221
  
    
    def parse_authn_response(self, saml_response):

  		




  ......




  291
  294
  
    
            self.assertIn('SAMLResponse', doc.forms[0].fields)

  		




  292
  295
  
    
            saml_response = doc.forms[0].fields['SAMLResponse']

  		




  293
  296
  
    
            try:

  		




  294
  
  
    
                base64.b64decode(saml_response)

  		




  
  297
  
    
                decoded_saml_response = base64.b64decode(saml_response)

  		




  295
  298
  
    
            except TypeError:

  		




  296
  299
  
    
                self.fail('SAMLResponse is not base64 encoded: %s'

  		




  297
  300
  
    
                          % saml_response)

  		




  
  301
  
    
            assert b'rsa-sha256' in decoded_saml_response

  		




  298
  302
  
    
            with self.assertRaises(lasso.ProfileRequestDeniedError):

  		




  299
  303
  
    
                assertion = self.parse_authn_response(saml_response)

  		




  300
  304
  
    
        elif not authorized_service:

  		




  ......




  335
  339
  
    
            self.assertIn('SAMLResponse', doc.forms[0].fields)

  		




  336
  340
  
    
            saml_response = doc.forms[0].fields['SAMLResponse']

  		




  337
  341
  
    
            try:

  		




  338
  
  
    
                base64.b64decode(saml_response)

  		




  
  342
  
    
                decoded_saml_response = base64.b64decode(saml_response)

  		




  339
  343
  
    
            except TypeError:

  		




  340
  344
  
    
                self.fail('SAMLResponse is not base64 encoded: %s' % saml_response)

  		




  
  345
  
    
            assert b'rsa-sha256' in decoded_saml_response

  		




  341
  346
  
    
            login = self.parse_authn_response(saml_response)

  		




  342
  347
  
    
            assertion = login.assertion

  		




  343
  348
  
    
            session_not_on_or_after = login.assertion.authnStatement[0].sessionNotOnOrAfter

  		




  344
  
  
    
-