summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* | Merge pull request #758 from peppelinux/statusresp_return_addrsIvan Kanakarakis2020-12-291-5/+6
|\ \ | | | | | | Fix StatusResponse when return_addrs is not set
| * | Fix StatusResponse when return_addrs is not setpeppelinux2020-12-291-5/+6
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `return_addrs` is set to `None` by default in `StatusResponse.__init__()`. If it is not filled with a proper value then `self._verify()` will fail because it tries to iterate over a `None` object. This PR avoids this error, by setting the `return_addrs` to `[]`. ``` if self.asynchop: if ( self.response.destination and self.response.destination not in self.return_addrs ): logger.error("%s not in %s", self.response.destination, self.return_addrs) return None ``` Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* | Use .path instead of an indexed memberIvan Kanakarakis2020-12-291-1/+1
|/ | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Set proper entity category restrictions when release is set to be emptyIvan Kanakarakis2020-12-142-1/+3
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* No eduPersonTargetedID for entity category refeds research-and-scholarshipJohan Lundberg2020-12-111-1/+0
|
* Update of SWAMID policy regarding eduPersonTargetedIDJohan Lundberg2020-12-101-1/+1
| | | | | According to SWAMID policy no attributes should be released when entitity category is missing
* Calculate entity configurations and then chooseIvan Kanakarakis2020-12-081-7/+6
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Resolve sign_alg and digest_alg wherever pre_signature_part is calledIvan Kanakarakis2020-12-082-9/+25
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Notes on _responseIvan Kanakarakis2020-12-071-43/+90
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Formatting and restructureIvan Kanakarakis2020-12-073-18/+33
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Do no prepare assertion signature in create_attribute_response but in _responseIvan Kanakarakis2020-12-071-15/+3
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Difference between sigver.signed_instance_factory and Entity.signIvan Kanakarakis2020-12-072-1/+12
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Remove unneeded response_factory helperIvan Kanakarakis2020-12-072-22/+4
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* WIP fix ensure callersIvan Kanakarakis2020-11-252-73/+156
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* WIP callersIvan Kanakarakis2020-11-242-15/+30
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* WIP, TODO cleanup, see descriptionIvan Kanakarakis2020-11-244-365/+723
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * client_base::Base is the base for an SP and manages SP_ARGS * server::Server is the base for an IdP and maanges AA_IDP_ARGS * entity::Entity is the base of SP/IdPs and manages the COMMON_ARGS The signing_algorithm and digest_algorithm are COMMON_ARGS and should be set and managed by entity::Entity. On init they are set as properties of the Entity object. If no configuration has been given, the internal-default is set (through DefaultSignature()). The set sign_alg and digest_alg must be checked against an allow/block-list --- - Signing is done both by SPs (on requests) and IdPs (on responses). - Signing is done both for the Redirect-binding (apply_binding()) and the POST-binding (_message() > sign()). --- * All client_base::Base(SP) (create_*) methods end in Entity::_message() * Almost all server::Server(IdP) (create_*) methods end in Entity::_response() thus: - Entity::_message() must decide the value of "sign" and call Entity::sign() - Entity::_response() must decide the value of "sign" and call Entity::sign() - Entity::_status_response() must decide the value of "sign" and call Entity::sign() - Entity::sign() must decide the value of sign_alg and digest_alg and call sigver::pre_signature_part() --- All calls to Entity::_message() and Entity::_response() (or to their callers) must pass on sign, sign_alg and digest_alg All calls to sigver::pre_signature_part() should happen through the same call-chain and should pass on specific sign_alg and digest_alg params All relevant params should be set to None unless they have been set by the caller. --- client::do_logout should be refactored to use the same call-chain --- These type of checks (and self.lock blocks) should be removed (there are more for sign_assertion) ``` if (sign and self.sec.cert_handler.generate_cert()) or client_crt is not None: ``` ``` if self.sec.cert_handler.generate_cert() ``` --- Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* WIP works good - set on init use on create_Ivan Kanakarakis2020-11-245-51/+70
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix formattingIvan Kanakarakis2020-11-243-76/+93
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Configurable signing and digest algpeppelinux2020-11-244-3/+22
|
* Allow do_attribute_query to set a signature algorithmIvan Kanakarakis2020-11-231-0/+2
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Allow phase2 to specify signing algorithm; although unused atmIvan Kanakarakis2020-11-231-15/+27
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix formattingIvan Kanakarakis2020-11-231-27/+46
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Do not sign logout requests if not specified to do soIvan Kanakarakis2020-11-231-4/+0
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Check allowed signature and digest algo for the POST bindingIvan Kanakarakis2020-11-234-8/+17
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Remove unneeded intermediate static methodsIvan Kanakarakis2020-11-232-44/+3
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Create the signer along with the sigalg allowance checkIvan Kanakarakis2020-11-233-43/+23
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Correctly sign an AuthnRequest with Redirect bindingIvan Kanakarakis2020-11-234-14/+60
| | | | | | | | | | | | | | When an AuthnRequest is created with HTTP-Redirect binding, the XML document is not signed, but instead, a signature is calculated and becomes part of the query params of the Redirect-URL, through the Signature and SignAlg params. Previously, when the Redirect binding was requested and signing was enabled but no SignAlg params were defined, the Signature and SignAlg query params would be missing. Now, if no SignAlg is defined, the default is used and the request is correctly created with the proper query params. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* FormattingIvan Kanakarakis2020-11-236-108/+207
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Ignore duplicate RequestedAttribute entries when filtering attributesIvan Kanakarakis2020-11-131-1/+3
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Fix #242: make sure status code is always returned in http_info dictFlorian Best2020-11-102-6/+9
|
* Restructure the registration_info methodIvan Kanakarakis2020-11-041-14/+21
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Use literal list over list-constructorIvan Kanakarakis2020-11-041-1/+1
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Handle registration_policy NoneJohan Lundberg2020-11-041-1/+1
|
* Remove the metadata_construction paramIvan Kanakarakis2020-10-302-6/+22
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Refactor do_subject_confirmation and do_subject for policy infoIvan Kanakarakis2020-10-301-18/+14
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Refactor Policy to check the registration authority for restrictionsIvan Kanakarakis2020-10-302-217/+213
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Move endpoints, metadata, ui_info and name_id_format as common config optionsIvan Kanakarakis2020-10-301-7/+4
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Handle complex configs in the same placeIvan Kanakarakis2020-10-301-0/+9
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Remove unneeded unicode_convert methodIvan Kanakarakis2020-10-301-16/+2
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Handle complex configs in the same placeIvan Kanakarakis2020-10-301-23/+5
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Remove python shebang from configIvan Kanakarakis2020-10-301-5/+0
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Do not keep per service-type attribute converters and metadataIvan Kanakarakis2020-10-302-45/+23
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Policy needs metadata store to lookup registration authority for a SPJohan Lundberg2020-10-301-1/+1
|
* Allow registration authorities in policyJohan Lundberg2020-10-301-66/+91
|
* Support registration info in mdstoreJohan Lundberg2020-10-301-0/+44
|
* Missing ONLY_REQUIREDJohan Lundberg2020-10-301-0/+2
|
* Improve warning messagesIvan Kanakarakis2020-10-303-9/+8
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Warn and log warning messagesIvan Kanakarakis2020-10-284-10/+27
| | | | Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
* Merge pull request #734 from Worteks/sign-logout-responseIvan Kanakarakis2020-10-283-1/+7
|\ | | | | Add logout_responses_signed configuration option to sign logout responses
| * Fixes #733: add setting to sign logout responsesMaxime Besson2020-10-073-1/+7
| |
View Lorry Controller Status