Skip to content

Commit ec4f4ab

Browse files
pitbulkpitbulk
committed
Publish KeyDescriptor[use=encryption] only when required
1 parent 34d22e0 commit ec4f4ab

File tree

3 files changed

+34
-7
lines changed

3 files changed

+34
-7
lines changed

‎src/onelogin/saml2/metadata.py‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,7 @@ def __add_x509_key_descriptors(root, cert, signing):
229229
key_descriptor.set('use', ('encryption', 'signing')[signing])
230230

231231
@staticmethod
232-
def add_x509_key_descriptors(metadata, cert=None):
232+
def add_x509_key_descriptors(metadata, cert=None, add_encryption=True):
233233
"""
234234
Adds the x509 descriptors (sign/encryption) to the metadata
235235
The same cert will be used for sign/encrypt
@@ -240,6 +240,9 @@ def add_x509_key_descriptors(metadata, cert=None):
240240
:param cert: x509 cert
241241
:type cert: string
242242
243+
:param add_encryption: Determines if the KeyDescriptor[use="encryption"] should be added.
244+
:type add_encryption: boolean
245+
243246
:returns: Metadata with KeyDescriptors
244247
:rtype: string
245248
"""
@@ -256,6 +259,7 @@ def add_x509_key_descriptors(metadata, cert=None):
256259
except StopIteration:
257260
raise Exception('Malformed metadata.')
258261

259-
OneLogin_Saml2_Metadata.__add_x509_key_descriptors(sp_sso_descriptor, cert, False)
262+
if add_encryption:
263+
OneLogin_Saml2_Metadata.__add_x509_key_descriptors(sp_sso_descriptor, cert, False)
260264
OneLogin_Saml2_Metadata.__add_x509_key_descriptors(sp_sso_descriptor, cert, True)
261265
return OneLogin_Saml2_XML.to_string(root)

‎src/onelogin/saml2/settings.py‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -617,11 +617,13 @@ def get_sp_metadata(self):
617617
self.get_contacts(), self.get_organization()
618618
)
619619

620+
add_encryption = self.__security['wantNameIdEncrypted'] or self.__security['wantAssertionsEncrypted']
621+
620622
cert_new = self.get_sp_cert_new()
621-
metadata = OneLogin_Saml2_Metadata.add_x509_key_descriptors(metadata, cert_new)
623+
metadata = OneLogin_Saml2_Metadata.add_x509_key_descriptors(metadata, cert_new, add_encryption)
622624

623625
cert = self.get_sp_cert()
624-
metadata = OneLogin_Saml2_Metadata.add_x509_key_descriptors(metadata, cert)
626+
metadata = OneLogin_Saml2_Metadata.add_x509_key_descriptors(metadata, cert, add_encryption)
625627

626628
# Sign metadata
627629
if 'signMetadata' in self.__security and self.__security['signMetadata'] is not False:

‎tests/src/OneLogin/saml2_tests/settings_test.py‎

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -399,7 +399,10 @@ def testGetSPMetadata(self):
399399
Tests the getSPMetadata method of the OneLogin_Saml2_Settings
400400
Case unsigned metadata
401401
"""
402-
settings = OneLogin_Saml2_Settings(self.loadSettingsJSON())
402+
settings_info = self.loadSettingsJSON()
403+
settings_info['security']['wantNameIdEncrypted'] = False
404+
settings_info['security']['wantAssertionsEncrypted'] = False
405+
settings = OneLogin_Saml2_Settings(settings_info)
403406
metadata = compat.to_string(settings.get_sp_metadata())
404407

405408
self.assertNotEqual(len(metadata), 0)
@@ -410,6 +413,14 @@ def testGetSPMetadata(self):
410413
self.assertIn('<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://stuff.com/endpoints/endpoints/acs.php" index="1"/>', metadata)
411414
self.assertIn('<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://stuff.com/endpoints/endpoints/sls.php"/>', metadata)
412415
self.assertIn('<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>', metadata)
416+
self.assertEqual(1, metadata.count('<md:KeyDescriptor'))
417+
self.assertEqual(1, metadata.count('<md:KeyDescriptor use="signing"'))
418+
self.assertEqual(0, metadata.count('<md:KeyDescriptor use="encryption"'))
419+
420+
settings_info['security']['wantNameIdEncrypted'] = False
421+
settings_info['security']['wantAssertionsEncrypted'] = True
422+
settings = OneLogin_Saml2_Settings(settings_info)
423+
metadata = compat.to_string(settings.get_sp_metadata())
413424
self.assertEqual(2, metadata.count('<md:KeyDescriptor'))
414425
self.assertEqual(1, metadata.count('<md:KeyDescriptor use="signing"'))
415426
self.assertEqual(1, metadata.count('<md:KeyDescriptor use="encryption"'))
@@ -419,11 +430,21 @@ def testGetSPMetadataWithx509certNew(self):
419430
Tests the getSPMetadata method of the OneLogin_Saml2_Settings
420431
Case with x509certNew
421432
"""
422-
settings = OneLogin_Saml2_Settings(self.loadSettingsJSON('settings7.json'))
433+
settings_info = self.loadSettingsJSON('settings7.json')
434+
settings_info['security']['wantNameIdEncrypted'] = False
435+
settings_info['security']['wantAssertionsEncrypted'] = False
436+
settings = OneLogin_Saml2_Settings(settings_info)
423437
metadata = compat.to_string(settings.get_sp_metadata())
424-
425438
self.assertNotEqual(len(metadata), 0)
426439
self.assertIn('<md:SPSSODescriptor', metadata)
440+
self.assertEquals(2, metadata.count('<md:KeyDescriptor'))
441+
self.assertEquals(2, metadata.count('<md:KeyDescriptor use="signing"'))
442+
self.assertEquals(0, metadata.count('<md:KeyDescriptor use="encryption"'))
443+
444+
settings_info['security']['wantNameIdEncrypted'] = True
445+
settings_info['security']['wantAssertionsEncrypted'] = False
446+
settings = OneLogin_Saml2_Settings(settings_info)
447+
metadata = settings.get_sp_metadata()
427448
self.assertEqual(4, metadata.count('<md:KeyDescriptor'))
428449
self.assertEqual(2, metadata.count('<md:KeyDescriptor use="signing"'))
429450
self.assertEqual(2, metadata.count('<md:KeyDescriptor use="encryption"'))

0 commit comments

Comments
 (0)