Skip to content

Commit a11c341

Browse files
pitbulkpitbulk
authored
Merge pull request #178 from rahulraina7/master
Load idp certs from file
2 parents 6b41477 + 70c9a50 commit a11c341

File tree

8 files changed

+127
-8
lines changed

8 files changed

+127
-8
lines changed

‎src/onelogin/saml2/auth.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -606,7 +606,7 @@ def __validate_signature(self, data, saml_type, raise_exceptions=False):
606606

607607
idp_data = self.get_settings().get_idp_data()
608608

609-
exists_x509cert = 'x509cert' in idp_data and idp_data['x509cert']
609+
exists_x509cert = self.get_settings().get_idp_cert() is not None
610610
exists_multix509sign = 'x509certMulti' in idp_data and \
611611
'signing' in idp_data['x509certMulti'] and \
612612
idp_data['x509certMulti']['signing']
@@ -646,7 +646,7 @@ def __validate_signature(self, data, saml_type, raise_exceptions=False):
646646
OneLogin_Saml2_ValidationError.INVALID_SIGNATURE
647647
)
648648
else:
649-
cert = idp_data['x509cert']
649+
cert = self.get_settings().get_idp_cert()
650650

651651
if not OneLogin_Saml2_Utils.validate_binary_sign(signed_query,
652652
OneLogin_Saml2_Utils.b64decode(signature),

‎src/onelogin/saml2/logout_request.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ def __init__(self, settings, request=None, name_id=None, session_index=None, nq=
7272
if exists_multix509enc:
7373
cert = idp_data['x509certMulti']['encryption'][0]
7474
else:
75-
cert = idp_data['x509cert']
75+
cert = self.__settings.get_idp_cert()
7676

7777
if name_id is not None:
7878
if not name_id_format and sp_data['NameIDFormat'] != OneLogin_Saml2_Constants.NAMEID_UNSPECIFIED:

‎src/onelogin/saml2/response.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -293,7 +293,7 @@ def is_valid(self, request_data, request_id=None, raise_exceptions=False):
293293
OneLogin_Saml2_ValidationError.NO_SIGNATURE_FOUND
294294
)
295295
else:
296-
cert = idp_data.get('x509cert', None)
296+
cert = self.__settings.get_idp_cert()
297297
fingerprint = idp_data.get('certFingerprint', None)
298298
if fingerprint:
299299
fingerprint = OneLogin_Saml2_Utils.format_finger_print(fingerprint)

‎src/onelogin/saml2/settings.py‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -558,7 +558,12 @@ def get_idp_cert(self):
558558
:returns: IdP public cert
559559
:rtype: string
560560
"""
561-
return self.__idp.get('x509cert')
561+
cert = self.__idp.get('x509cert')
562+
cert_file_name = self.__paths['cert'] + 'idp.crt'
563+
if not cert and exists(cert_file_name):
564+
with open(cert_file_name) as f:
565+
cert = f.read()
566+
return cert or None
562567

563568
def get_idp_data(self):
564569
"""

‎tests/settings/settings10.json‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"strict": false,
3+
"debug": false,
4+
"sp": {
5+
"entityId": "http://stuff.com/endpoints/metadata.php",
6+
"assertionConsumerService": {
7+
"url": "http://stuff.com/endpoints/endpoints/acs.php"
8+
},
9+
"singleLogoutService": {
10+
"url": "http://stuff.com/endpoints/endpoints/sls.php"
11+
},
12+
"NameIDFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
13+
},
14+
"idp": {
15+
"entityId": "http://idp.example.com/",
16+
"singleSignOnService": {
17+
"url": "http://idp.example.com/SSOService.php"
18+
},
19+
"singleLogoutService": {
20+
"url": "http://idp.example.com/SingleLogoutService.php"
21+
},
22+
"x509cert": "MIICbDCCAdWgAwIBAgIBADANBgkqhkiG9w0BAQ0FADBTMQswCQYDVQQGEwJ1czETMBEGA1UECAwKQ2FsaWZvcm5pYTEVMBMGA1UECgwMT25lbG9naW4gSW5jMRgwFgYDVQQDDA9pZHAuZXhhbXBsZS5jb20wHhcNMTQwOTIzMTIyNDA4WhcNNDIwMjA4MTIyNDA4WjBTMQswCQYDVQQGEwJ1czETMBEGA1UECAwKQ2FsaWZvcm5pYTEVMBMGA1UECgwMT25lbG9naW4gSW5jMRgwFgYDVQQDDA9pZHAuZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOWA+YHU7cvPOrBOfxCscsYTJB+kH3MaA9BFrSHFS+KcR6cw7oPSktIJxUgvDpQbtfNcOkE/tuOPBDoech7AXfvH6d7Bw7xtW8PPJ2mB5Hn/HGW2roYhxmfh3tR5SdwN6i4ERVF8eLkvwCHsNQyK2Ref0DAJvpBNZMHCpS24916/AgMBAAGjUDBOMB0GA1UdDgQWBBQ77/qVeiigfhYDITplCNtJKZTM8DAfBgNVHSMEGDAWgBQ77/qVeiigfhYDITplCNtJKZTM8DAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBAJO2j/1uO80E5C2PM6Fk9mzerrbkxl7AZ/mvlbOn+sNZE+VZ1AntYuG8ekbJpJtG1YfRfc7EA9mEtqvv4dhv7zBy4nK49OR+KpIBjItWB5kYvrqMLKBa32sMbgqqUqeF1ENXKjpvLSuPdfGJZA3dNa/+Dyb8GGqWe707zLyc5F8m"
23+
},
24+
"security": {
25+
"authnRequestsSigned": false,
26+
"wantAssertionsSigned": false,
27+
"signMetadata": false
28+
},
29+
"contactPerson": {
30+
"technical": {
31+
"givenName": "technical_name",
32+
"emailAddress": "technical@example.com"
33+
},
34+
"support": {
35+
"givenName": "support_name",
36+
"emailAddress": "support@example.com"
37+
}
38+
},
39+
"organization": {
40+
"en-US": {
41+
"name": "sp_test",
42+
"displayname": "SP test",
43+
"url": "http://sp.example.com"
44+
}
45+
}
46+
}

‎tests/settings/settings9.json‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"strict": false,
3+
"debug": false,
4+
"custom_base_path": "../../../tests/data/customPath/",
5+
"sp": {
6+
"entityId": "http://stuff.com/endpoints/metadata.php",
7+
"assertionConsumerService": {
8+
"url": "http://stuff.com/endpoints/endpoints/acs.php"
9+
},
10+
"singleLogoutService": {
11+
"url": "http://stuff.com/endpoints/endpoints/sls.php"
12+
},
13+
"NameIDFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
14+
},
15+
"idp": {
16+
"entityId": "http://idp.example.com/",
17+
"singleSignOnService": {
18+
"url": "http://idp.example.com/SSOService.php"
19+
},
20+
"singleLogoutService": {
21+
"url": "http://idp.example.com/SingleLogoutService.php"
22+
}
23+
},
24+
"security": {
25+
"authnRequestsSigned": false,
26+
"wantAssertionsSigned": false,
27+
"signMetadata": false
28+
},
29+
"contactPerson": {
30+
"technical": {
31+
"givenName": "technical_name",
32+
"emailAddress": "technical@example.com"
33+
},
34+
"support": {
35+
"givenName": "support_name",
36+
"emailAddress": "support@example.com"
37+
}
38+
},
39+
"organization": {
40+
"en-US": {
41+
"name": "sp_test",
42+
"displayname": "SP test",
43+
"url": "http://sp.example.com"
44+
}
45+
}
46+
}

‎tests/src/OneLogin/saml2_tests/response_test.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1473,7 +1473,7 @@ def testIsValid2(self):
14731473
response_2 = OneLogin_Saml2_Response(settings_2, xml_2)
14741474
self.assertTrue(response_2.is_valid(self.get_request_data()))
14751475

1476-
settings_info_3 = self.loadSettingsJSON('settings2.json')
1476+
settings_info_3 = self.loadSettingsJSON('settings10.json')
14771477
idp_cert = OneLogin_Saml2_Utils.format_cert(settings_info_3['idp']['x509cert'])
14781478
settings_info_3['idp']['certFingerprint'] = OneLogin_Saml2_Utils.calculate_x509_fingerprint(idp_cert)
14791479
settings_info_3['idp']['x509cert'] = ''
@@ -1662,7 +1662,7 @@ def testIsValidSignFingerprint(self):
16621662
self.assertFalse(response_9.is_valid(self.get_request_data()))
16631663

16641664
def testMessageSignedIsValidSignWithEmptyReferenceURI(self):
1665-
settings_info = self.loadSettingsJSON()
1665+
settings_info = self.loadSettingsJSON("settings10.json")
16661666
del settings_info['idp']['x509cert']
16671667
settings_info['idp']['certFingerprint'] = "657302a5e11a4794a1e50a705988d66c9377575d"
16681668
settings = OneLogin_Saml2_Settings(settings_info)
@@ -1671,7 +1671,7 @@ def testMessageSignedIsValidSignWithEmptyReferenceURI(self):
16711671
self.assertTrue(response.is_valid(self.get_request_data()))
16721672

16731673
def testAssertionSignedIsValidSignWithEmptyReferenceURI(self):
1674-
settings_info = self.loadSettingsJSON()
1674+
settings_info = self.loadSettingsJSON('settings10.json')
16751675
del settings_info['idp']['x509cert']
16761676
settings_info['idp']['certFingerprint'] = "657302a5e11a4794a1e50a705988d66c9377575d"
16771677
settings = OneLogin_Saml2_Settings(settings_info)

‎tests/src/OneLogin/saml2_tests/settings_test.py‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,28 @@ def testGetSPKey(self):
222222
settings_3 = OneLogin_Saml2_Settings(settings_data, custom_base_path=custom_base_path)
223223
self.assertIsNone(settings_3.get_sp_key())
224224

225+
def testGetIDPCert(self):
226+
"""
227+
Tests the get_idp_cert method of the OneLogin_Saml2_Settings
228+
"""
229+
230+
settings = OneLogin_Saml2_Settings(self.loadSettingsJSON('settings9.json'))
231+
cert = "-----BEGIN CERTIFICATE-----\nMIICgTCCAeoCCQCbOlrWDdX7FTANBgkqhkiG9w0BAQUFADCBhDELMAkGA1UEBhMC\nTk8xGDAWBgNVBAgTD0FuZHJlYXMgU29sYmVyZzEMMAoGA1UEBxMDRm9vMRAwDgYD\nVQQKEwdVTklORVRUMRgwFgYDVQQDEw9mZWlkZS5lcmxhbmcubm8xITAfBgkqhkiG\n9w0BCQEWEmFuZHJlYXNAdW5pbmV0dC5ubzAeFw0wNzA2MTUxMjAxMzVaFw0wNzA4\nMTQxMjAxMzVaMIGEMQswCQYDVQQGEwJOTzEYMBYGA1UECBMPQW5kcmVhcyBTb2xi\nZXJnMQwwCgYDVQQHEwNGb28xEDAOBgNVBAoTB1VOSU5FVFQxGDAWBgNVBAMTD2Zl\naWRlLmVybGFuZy5ubzEhMB8GCSqGSIb3DQEJARYSYW5kcmVhc0B1bmluZXR0Lm5v\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDivbhR7P516x/S3BqKxupQe0LO\nNoliupiBOesCO3SHbDrl3+q9IbfnfmE04rNuMcPsIxB161TdDpIesLCn7c8aPHIS\nKOtPlAeTZSnb8QAu7aRjZq3+PbrP5uW3TcfCGPtKTytHOge/OlJbo078dVhXQ14d\n1EDwXJW1rRXuUt4C8QIDAQABMA0GCSqGSIb3DQEBBQUAA4GBACDVfp86HObqY+e8\nBUoWQ9+VMQx1ASDohBjwOsg2WykUqRXF+dLfcUH9dWR63CtZIKFDbStNomPnQz7n\nbK+onygwBspVEbnHuUihZq3ZUdmumQqCw4Uvs/1Uvq3orOo/WJVhTyvLgFVK2Qar\nQ4/67OZfHd7R+POBXhophSMv1ZOo\n-----END CERTIFICATE-----\n"
232+
self.assertEqual(cert, settings.get_idp_cert())
233+
234+
settings_data = self.loadSettingsJSON()
235+
236+
settings = OneLogin_Saml2_Settings(settings_data)
237+
settings_data['idp']['x509cert'] = cert
238+
self.assertEqual(cert, settings.get_sp_cert())
239+
240+
del settings_data['idp']['x509cert']
241+
del settings_data['custom_base_path']
242+
custom_base_path = dirname(__file__)
243+
244+
settings_3 = OneLogin_Saml2_Settings(settings_data, custom_base_path=custom_base_path)
245+
self.assertIsNone(settings_3.get_idp_cert())
246+
225247
def testFormatIdPCert(self):
226248
"""
227249
Tests the format_idp_cert method of the OneLogin_Saml2_Settings

0 commit comments

Comments
 (0)