Skip to content

Commit 728d51f

Browse files
pitbulkpitbulk
committed
Be able to register future SP x509cert on the settings and publish it on SP metadata
1 parent f7a9652 commit 728d51f

File tree

10 files changed

+157
-22
lines changed

10 files changed

+157
-22
lines changed

‎README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,9 @@ Or also we can provide those data in the setting file at the 'x509cert' and the
143143

144144
Sometimes we could need a signature on the metadata published by the SP, in this case we could use the x.509 cert previously mentioned or use a new x.509 cert: metadata.crt and metadata.key.
145145

146+
Use `sp_new.crt` if you are in a key rollover process and you want to
147+
publish that x509certificate on Service Provider metadata.
148+
146149
If you want to create self-signed certs, you can do it at the https://www.samltool.com/self_signed_certs.php service, or using the command:
147150

148151
```bash
@@ -253,6 +256,15 @@ This is the settings.json file:
253256
// the certs folder. But we can also provide them with the following parameters
254257
"x509cert": "",
255258
"privateKey": ""
259+
260+
/*
261+
* Key rollover
262+
* If you plan to update the SP x509cert and privateKey
263+
* you can define here the new x509cert and it will be
264+
* published on the SP metadata so Identity Providers can
265+
* read them and get ready for rollover.
266+
*/
267+
// 'x509certNew': '',
256268
},
257269

258270
// Identity Provider Data that we want connected with our SP.
@@ -776,6 +788,11 @@ else:
776788
print ', '.join(errors)
777789
```
778790

791+
### SP Key rollover ###
792+
793+
If you plan to update the SP x509cert and privateKey you can define the new x509cert as $settings['sp']['x509certNew'] and it will be
794+
published on the SP metadata so Identity Providers can read them and get ready for rollover.
795+
779796

780797
### Main classes and methods ###
781798

@@ -884,6 +901,7 @@ Configuration of the OneLogin Python Toolkit
884901
* ***check_sp_certs*** Checks if the x509 certs of the SP exists and are valid.
885902
* ***get_sp_key*** Returns the x509 private key of the SP.
886903
* ***get_sp_cert*** Returns the x509 public cert of the SP.
904+
* ***get_sp_cert_new*** Returns the future x509 public cert of the SP.
887905
* ***get_idp_cert*** Returns the x509 public cert of the IdP.
888906
* ***get_sp_data*** Gets the SP data.
889907
* ***get_idp_data*** Gets the IdP data.
@@ -892,6 +910,7 @@ Configuration of the OneLogin Python Toolkit
892910
* ***get_organization*** Gets organization data.
893911
* ***format_idp_cert*** Formats the IdP cert.
894912
* ***format_sp_cert*** Formats the SP cert.
913+
* ***format_sp_cert_new*** Formats the SP cert new.
895914
* ***format_sp_key*** Formats the private key.
896915
* ***set_strict*** Activates or deactivates the strict mode.
897916
* ***is_strict*** Returns if the 'strict' mode is active.

‎demo-django/saml/certs/README‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,10 @@ Take care of this folder that could contain private key. Be sure that this folde
22

33
Onelogin Python Toolkit expects that certs for the SP could be stored in this folder as:
44

5-
* sp.key Private Key
6-
* sp.crt Public cert
5+
* sp.key Private Key
6+
* sp.crt Public cert
7+
* sp_new.crt Future Public cert
8+
79

810
Also you can use other cert to sign the metadata of the SP using the:
911

‎demo-flask/saml/certs/README‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,10 @@ Take care of this folder that could contain private key. Be sure that this folde
22

33
Onelogin Python Toolkit expects that certs for the SP could be stored in this folder as:
44

5-
* sp.key Private Key
6-
* sp.crt Public cert
5+
* sp.key Private Key
6+
* sp.crt Public cert
7+
* sp_new.crt Future Public cert
8+
79

810
Also you can use other cert to sign the metadata of the SP using the:
911

‎demo_pyramid/demo_pyramid/saml/certs/README‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,10 @@ Take care of this folder that could contain private key. Be sure that this folde
22

33
Onelogin Python Toolkit expects that certs for the SP could be stored in this folder as:
44

5-
* sp.key Private Key
6-
* sp.crt Public cert
5+
* sp.key Private Key
6+
* sp.crt Public cert
7+
* sp_new.crt Future Public cert
8+
79

810
Also you can use other cert to sign the metadata of the SP using the:
911

‎src/onelogin/saml2/settings.py‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,8 @@ def __init__(self, settings=None, custom_base_path=None, sp_validation_only=Fals
121121

122122
self.format_idp_cert()
123123
self.format_sp_cert()
124+
if 'x509certNew' in self.__sp:
125+
self.format_sp_cert_new()
124126
self.format_sp_key()
125127

126128
def __load_paths(self, base_path=None):
@@ -523,6 +525,22 @@ def get_sp_cert(self):
523525

524526
return cert or None
525527

528+
def get_sp_cert_new(self):
529+
"""
530+
Returns the x509 public of the SP planned
531+
to be used soon instead the other public cert
532+
:returns: SP public cert new
533+
:rtype: string or None
534+
"""
535+
cert = self.__sp.get('x509certNew')
536+
cert_file_name = self.__paths['cert'] + 'sp_new.crt'
537+
538+
if not cert and exists(cert_file_name):
539+
with open(cert_file_name) as f:
540+
cert = f.read()
541+
542+
return cert or None
543+
526544
def get_idp_cert(self):
527545
"""
528546
Returns the x509 public cert of the IdP.
@@ -589,6 +607,10 @@ def get_sp_metadata(self):
589607
self.__security['metadataCacheDuration'],
590608
self.get_contacts(), self.get_organization()
591609
)
610+
611+
cert_new = self.get_sp_cert_new()
612+
metadata = OneLogin_Saml2_Metadata.add_x509_key_descriptors(metadata, cert_new)
613+
592614
cert = self.get_sp_cert()
593615
metadata = OneLogin_Saml2_Metadata.add_x509_key_descriptors(metadata, cert)
594616

@@ -699,6 +721,12 @@ def format_sp_cert(self):
699721
"""
700722
self.__sp['x509cert'] = OneLogin_Saml2_Utils.format_cert(self.__sp['x509cert'])
701723

724+
def format_sp_cert_new(self):
725+
"""
726+
Formats the SP cert.
727+
"""
728+
self.__sp['x509certNew'] = OneLogin_Saml2_Utils.format_cert(self.__sp['x509certNew'])
729+
702730
def format_sp_key(self):
703731
"""
704732
Formats the private key.

‎tests/settings/settings7.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"strict": false,
3+
"debug": false,
4+
"custom_base_path": "../../../tests/data/customPath/",
5+
"sp": {
6+
"entityId": "http://stuff.com/endpoints/metadata.php",
7+
"assertionConsumerService": {
8+
"url": "http://stuff.com/endpoints/endpoints/acs.php"
9+
},
10+
"singleLogoutService": {
11+
"url": "http://stuff.com/endpoints/endpoints/sls.php"
12+
},
13+
"NameIDFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
14+
"privateKey": "MIICXgIBAAKBgQDivbhR7P516x/S3BqKxupQe0LONoliupiBOesCO3SHbDrl3+q9IbfnfmE04rNuMcPsIxB161TdDpIesLCn7c8aPHISKOtPlAeTZSnb8QAu7aRjZq3+PbrP5uW3TcfCGPtKTytHOge/OlJbo078dVhXQ14d1EDwXJW1rRXuUt4C8QIDAQABAoGAD4/Z4LWVWV6D1qMIp1Gzr0ZmdWTE1SPdZ7Ej8glGnCzPdguCPuzbhGXmIg0VJ5D+02wsqws1zd48JSMXXM8zkYZVwQYIPUsNn5FetQpwxDIMPmhHg+QNBgwOnk8JK2sIjjLPL7qY7Itv7LT7Gvm5qSOkZ33RCgXcgz+okEIQMYkCQQDzbTOyDL0c5WQV6A2k06T/azdhUdGXF9C0+WkWSfNaovmTgRXh1G+jMlr82Snz4p4/STt7P/XtyWzF3pkVgZr3AkEA7nPjXwHlttNEMo6AtxHd47nizK2NUN803ElIUT8P9KSCoERmSXq66PDekGNic4ldpsSvOeYCk8MAYoDBy9kvVwJBAMLgX4xg6lzhv7hR5+pWjTb1rIY6rCHbrPfU264+UZXz9v2BT/VUznLF81WMvStD9xAPHpFS6R0OLghSZhdzhI0CQQDL8Duvfxzrn4b9QlmduV8wLERoT6rEVxKLsPVz316TGrxJvBZLk/cV0SRZE1cZf4ukXSWMfEcJ/0Zt+LdG1CqjAkEAqwLSglJ9Dy3HpgMz4vAAyZWzAxvyA1zW0no9GOLcPQnYaNUN/Fy2SYtETXTb0CQ9X1rt8ffkFP7ya+5TC83aMg==",
15+
"x509cert": "MIICgTCCAeoCCQCbOlrWDdX7FTANBgkqhkiG9w0BAQUFADCBhDELMAkGA1UEBhMCTk8xGDAWBgNVBAgTD0FuZHJlYXMgU29sYmVyZzEMMAoGA1UEBxMDRm9vMRAwDgYDVQQKEwdVTklORVRUMRgwFgYDVQQDEw9mZWlkZS5lcmxhbmcubm8xITAfBgkqhkiG9w0BCQEWEmFuZHJlYXNAdW5pbmV0dC5ubzAeFw0wNzA2MTUxMjAxMzVaFw0wNzA4MTQxMjAxMzVaMIGEMQswCQYDVQQGEwJOTzEYMBYGA1UECBMPQW5kcmVhcyBTb2xiZXJnMQwwCgYDVQQHEwNGb28xEDAOBgNVBAoTB1VOSU5FVFQxGDAWBgNVBAMTD2ZlaWRlLmVybGFuZy5ubzEhMB8GCSqGSIb3DQEJARYSYW5kcmVhc0B1bmluZXR0Lm5vMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDivbhR7P516x/S3BqKxupQe0LONoliupiBOesCO3SHbDrl3+q9IbfnfmE04rNuMcPsIxB161TdDpIesLCn7c8aPHISKOtPlAeTZSnb8QAu7aRjZq3+PbrP5uW3TcfCGPtKTytHOge/OlJbo078dVhXQ14d1EDwXJW1rRXuUt4C8QIDAQABMA0GCSqGSIb3DQEBBQUAA4GBACDVfp86HObqY+e8BUoWQ9+VMQx1ASDohBjwOsg2WykUqRXF+dLfcUH9dWR63CtZIKFDbStNomPnQz7nbK+onygwBspVEbnHuUihZq3ZUdmumQqCw4Uvs/1Uvq3orOo/WJVhTyvLgFVK2QarQ4/67OZfHd7R+POBXhophSMv1ZOo",
16+
"x509certNew": "MIICVDCCAb2gAwIBAgIBADANBgkqhkiG9w0BAQ0FADBHMQswCQYDVQQGEwJ1czEQMA4GA1UECAwHZXhhbXBsZTEQMA4GA1UECgwHZXhhbXBsZTEUMBIGA1UEAwwLZXhhbXBsZS5jb20wHhcNMTcwNDA3MDgzMDAzWhcNMjcwNDA1MDgzMDAzWjBHMQswCQYDVQQGEwJ1czEQMA4GA1UECAwHZXhhbXBsZTEQMA4GA1UECgwHZXhhbXBsZTEUMBIGA1UEAwwLZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKhPS4/0azxbQekHHewQGKD7Pivr3CDpsrKxY3xlVanxj427OwzOb5KUVzsDEazumt6sZFY8HfidsjXY4EYA4ZzyL7ciIAR5vlAsIYN9nJ4AwVDnN/RjVwj+TN6BqWPLpVIpHc6Dl005HyE0zJnk1DZDn2tQVrIzbD3FhCp7YeotAgMBAAGjUDBOMB0GA1UdDgQWBBRYZx4thASfNvR/E7NsCF2IaZ7wIDAfBgNVHSMEGDAWgBRYZx4thASfNvR/E7NsCF2IaZ7wIDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBACz4aobx9aG3kh+rNyrlgM3K6dYfnKG1/YH5sJCAOvg8kDr0fQAQifH8lFVWumKUMoAe0bFTfwWtp/VJ8MprrEJth6PFeZdczpuv+fpLcNj2VmNVJqvQYvS4m36OnBFh1QFZW8UrbFIfdtm2nuZ+twSKqfKwjLdqcoX0p39h7Uw/"
17+
},
18+
"idp": {
19+
"entityId": "http://idp.example.com/",
20+
"singleSignOnService": {
21+
"url": "http://idp.example.com/SSOService.php"
22+
},
23+
"singleLogoutService": {
24+
"url": "http://idp.example.com/SingleLogoutService.php"
25+
},
26+
"x509cert": "MIICgTCCAeoCCQCbOlrWDdX7FTANBgkqhkiG9w0BAQUFADCBhDELMAkGA1UEBhMCTk8xGDAWBgNVBAgTD0FuZHJlYXMgU29sYmVyZzEMMAoGA1UEBxMDRm9vMRAwDgYDVQQKEwdVTklORVRUMRgwFgYDVQQDEw9mZWlkZS5lcmxhbmcubm8xITAfBgkqhkiG9w0BCQEWEmFuZHJlYXNAdW5pbmV0dC5ubzAeFw0wNzA2MTUxMjAxMzVaFw0wNzA4MTQxMjAxMzVaMIGEMQswCQYDVQQGEwJOTzEYMBYGA1UECBMPQW5kcmVhcyBTb2xiZXJnMQwwCgYDVQQHEwNGb28xEDAOBgNVBAoTB1VOSU5FVFQxGDAWBgNVBAMTD2ZlaWRlLmVybGFuZy5ubzEhMB8GCSqGSIb3DQEJARYSYW5kcmVhc0B1bmluZXR0Lm5vMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDivbhR7P516x/S3BqKxupQe0LONoliupiBOesCO3SHbDrl3+q9IbfnfmE04rNuMcPsIxB161TdDpIesLCn7c8aPHISKOtPlAeTZSnb8QAu7aRjZq3+PbrP5uW3TcfCGPtKTytHOge/OlJbo078dVhXQ14d1EDwXJW1rRXuUt4C8QIDAQABMA0GCSqGSIb3DQEBBQUAA4GBACDVfp86HObqY+e8BUoWQ9+VMQx1ASDohBjwOsg2WykUqRXF+dLfcUH9dWR63CtZIKFDbStNomPnQz7nbK+onygwBspVEbnHuUihZq3ZUdmumQqCw4Uvs/1Uvq3orOo/WJVhTyvLgFVK2QarQ4/67OZfHd7R+POBXhophSMv1ZOo"
27+
},
28+
"security": {
29+
"authnRequestsSigned": false,
30+
"wantAssertionsSigned": false,
31+
"signMetadata": false
32+
},
33+
"contactPerson": {
34+
"technical": {
35+
"givenName": "technical_name",
36+
"emailAddress": "technical@example.com"
37+
},
38+
"support": {
39+
"givenName": "support_name",
40+
"emailAddress": "support@example.com"
41+
}
42+
},
43+
"organization": {
44+
"en-US": {
45+
"name": "sp_test",
46+
"displayname": "SP test",
47+
"url": "http://sp.example.com"
48+
}
49+
}
50+
}

‎tests/src/OneLogin/saml2_tests/logout_request_test.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,8 @@
2020

2121

2222
class OneLogin_Saml2_Logout_Request_Test(unittest.TestCase):
23-
data_path = join(dirname(__file__), '..', '..', '..', 'data')
23+
data_path = join(dirname(dirname(dirname(dirname(__file__)))), 'data')
24+
settings_path = join(dirname(dirname(dirname(dirname(__file__)))), 'settings')
2425

2526
# assertRegexpMatches deprecated on python3
2627
def assertRegex(self, text, regexp, msg=None):
@@ -29,8 +30,8 @@ def assertRegex(self, text, regexp, msg=None):
2930
else:
3031
return self.assertRegexpMatches(text, regexp, msg)
3132

32-
def loadSettingsJSON(self):
33-
filename = join(dirname(__file__), '..', '..', '..', 'settings', 'settings1.json')
33+
def loadSettingsJSON(self, name='settings1.json'):
34+
filename = join(self.settings_path, name)
3435
if exists(filename):
3536
stream = open(filename, 'r')
3637
settings = json.load(stream)

‎tests/src/OneLogin/saml2_tests/logout_response_test.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,8 @@
2222

2323

2424
class OneLogin_Saml2_Logout_Response_Test(unittest.TestCase):
25-
data_path = join(dirname(__file__), '..', '..', '..', 'data')
25+
data_path = join(dirname(dirname(dirname(dirname(__file__)))), 'data')
26+
settings_path = join(dirname(dirname(dirname(dirname(__file__)))), 'settings')
2627

2728
# assertRegexpMatches deprecated on python3
2829
def assertRegex(self, text, regexp, msg=None):
@@ -31,8 +32,8 @@ def assertRegex(self, text, regexp, msg=None):
3132
else:
3233
return self.assertRegexpMatches(text, regexp, msg)
3334

34-
def loadSettingsJSON(self):
35-
filename = join(dirname(__file__), '..', '..', '..', 'settings', 'settings1.json')
35+
def loadSettingsJSON(self, name='settings1.json'):
36+
filename = join(self.settings_path, name)
3637
if exists(filename):
3738
stream = open(filename, 'r')
3839
settings = json.load(stream)

‎tests/src/OneLogin/saml2_tests/response_test.py‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,11 @@
2020

2121

2222
class OneLogin_Saml2_Response_Test(unittest.TestCase):
23-
data_path = join(dirname(__file__), '..', '..', '..', 'data')
23+
data_path = join(dirname(dirname(dirname(dirname(__file__)))), 'data')
24+
settings_path = join(dirname(dirname(dirname(dirname(__file__)))), 'settings')
2425

25-
def loadSettingsJSON(self, filename=None):
26-
if filename:
27-
filename = join(dirname(__file__), '..', '..', '..', 'settings', filename)
28-
else:
29-
filename = join(dirname(__file__), '..', '..', '..', 'settings', 'settings1.json')
26+
def loadSettingsJSON(self, name='settings1.json'):
27+
filename = join(self.settings_path, name)
3028
if exists(filename):
3129
stream = open(filename, 'r')
3230
settings = json.load(stream)

‎tests/src/OneLogin/saml2_tests/settings_test.py‎

Lines changed: 36 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,11 @@
1414

1515

1616
class OneLogin_Saml2_Settings_Test(unittest.TestCase):
17-
data_path = join(dirname(__file__), '..', '..', '..', 'data')
18-
settings_path = join(dirname(__file__), '..', '..', '..', 'settings')
17+
data_path = join(dirname(dirname(dirname(dirname(__file__)))), 'data')
18+
settings_path = join(dirname(dirname(dirname(dirname(__file__)))), 'settings')
1919

20-
def loadSettingsJSON(self):
21-
filename = join(self.settings_path, 'settings1.json')
20+
def loadSettingsJSON(self, name='settings1.json'):
21+
filename = join(self.settings_path, name)
2222
if exists(filename):
2323
stream = open(filename, 'r')
2424
settings = json.load(stream)
@@ -186,6 +186,21 @@ def testGetSPCert(self):
186186
settings_3 = OneLogin_Saml2_Settings(settings_data, custom_base_path=custom_base_path)
187187
self.assertIsNone(settings_3.get_sp_cert())
188188

189+
def testGetSPCertNew(self):
190+
"""
191+
Tests the get_sp_cert_new method of the OneLogin_Saml2_Settings
192+
"""
193+
settings_data = self.loadSettingsJSON()
194+
cert = "-----BEGIN CERTIFICATE-----\nMIICgTCCAeoCCQCbOlrWDdX7FTANBgkqhkiG9w0BAQUFADCBhDELMAkGA1UEBhMC\nTk8xGDAWBgNVBAgTD0FuZHJlYXMgU29sYmVyZzEMMAoGA1UEBxMDRm9vMRAwDgYD\nVQQKEwdVTklORVRUMRgwFgYDVQQDEw9mZWlkZS5lcmxhbmcubm8xITAfBgkqhkiG\n9w0BCQEWEmFuZHJlYXNAdW5pbmV0dC5ubzAeFw0wNzA2MTUxMjAxMzVaFw0wNzA4\nMTQxMjAxMzVaMIGEMQswCQYDVQQGEwJOTzEYMBYGA1UECBMPQW5kcmVhcyBTb2xi\nZXJnMQwwCgYDVQQHEwNGb28xEDAOBgNVBAoTB1VOSU5FVFQxGDAWBgNVBAMTD2Zl\naWRlLmVybGFuZy5ubzEhMB8GCSqGSIb3DQEJARYSYW5kcmVhc0B1bmluZXR0Lm5v\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDivbhR7P516x/S3BqKxupQe0LO\nNoliupiBOesCO3SHbDrl3+q9IbfnfmE04rNuMcPsIxB161TdDpIesLCn7c8aPHIS\nKOtPlAeTZSnb8QAu7aRjZq3+PbrP5uW3TcfCGPtKTytHOge/OlJbo078dVhXQ14d\n1EDwXJW1rRXuUt4C8QIDAQABMA0GCSqGSIb3DQEBBQUAA4GBACDVfp86HObqY+e8\nBUoWQ9+VMQx1ASDohBjwOsg2WykUqRXF+dLfcUH9dWR63CtZIKFDbStNomPnQz7n\nbK+onygwBspVEbnHuUihZq3ZUdmumQqCw4Uvs/1Uvq3orOo/WJVhTyvLgFVK2Qar\nQ4/67OZfHd7R+POBXhophSMv1ZOo\n-----END CERTIFICATE-----\n"
195+
settings = OneLogin_Saml2_Settings(settings_data)
196+
self.assertEqual(cert, settings.get_sp_cert())
197+
self.assertIsNone(settings.get_sp_cert_new())
198+
199+
settings = OneLogin_Saml2_Settings(self.loadSettingsJSON('settings7.json'))
200+
cert_new = "-----BEGIN CERTIFICATE-----\nMIICVDCCAb2gAwIBAgIBADANBgkqhkiG9w0BAQ0FADBHMQswCQYDVQQGEwJ1czEQ\nMA4GA1UECAwHZXhhbXBsZTEQMA4GA1UECgwHZXhhbXBsZTEUMBIGA1UEAwwLZXhh\nbXBsZS5jb20wHhcNMTcwNDA3MDgzMDAzWhcNMjcwNDA1MDgzMDAzWjBHMQswCQYD\nVQQGEwJ1czEQMA4GA1UECAwHZXhhbXBsZTEQMA4GA1UECgwHZXhhbXBsZTEUMBIG\nA1UEAwwLZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKhP\nS4/0azxbQekHHewQGKD7Pivr3CDpsrKxY3xlVanxj427OwzOb5KUVzsDEazumt6s\nZFY8HfidsjXY4EYA4ZzyL7ciIAR5vlAsIYN9nJ4AwVDnN/RjVwj+TN6BqWPLpVIp\nHc6Dl005HyE0zJnk1DZDn2tQVrIzbD3FhCp7YeotAgMBAAGjUDBOMB0GA1UdDgQW\nBBRYZx4thASfNvR/E7NsCF2IaZ7wIDAfBgNVHSMEGDAWgBRYZx4thASfNvR/E7Ns\nCF2IaZ7wIDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBACz4aobx9aG3\nkh+rNyrlgM3K6dYfnKG1/YH5sJCAOvg8kDr0fQAQifH8lFVWumKUMoAe0bFTfwWt\np/VJ8MprrEJth6PFeZdczpuv+fpLcNj2VmNVJqvQYvS4m36OnBFh1QFZW8UrbFIf\ndtm2nuZ+twSKqfKwjLdqcoX0p39h7Uw/\n-----END CERTIFICATE-----\n"
201+
self.assertEqual(cert, settings.get_sp_cert())
202+
self.assertEqual(cert_new, settings.get_sp_cert_new())
203+
189204
def testGetSPKey(self):
190205
"""
191206
Tests the get_sp_key method of the OneLogin_Saml2_Settings
@@ -395,6 +410,23 @@ def testGetSPMetadata(self):
395410
self.assertIn('<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://stuff.com/endpoints/endpoints/acs.php" index="1"/>', metadata)
396411
self.assertIn('<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://stuff.com/endpoints/endpoints/sls.php"/>', metadata)
397412
self.assertIn('<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>', metadata)
413+
self.assertEquals(2, metadata.count('<md:KeyDescriptor'))
414+
self.assertEquals(1, metadata.count('<md:KeyDescriptor use="signing"'))
415+
self.assertEquals(1, metadata.count('<md:KeyDescriptor use="encryption"'))
416+
417+
def testGetSPMetadataWithx509certNew(self):
418+
"""
419+
Tests the getSPMetadata method of the OneLogin_Saml2_Settings
420+
Case with x509certNew
421+
"""
422+
settings = OneLogin_Saml2_Settings(self.loadSettingsJSON('settings7.json'))
423+
metadata = settings.get_sp_metadata()
424+
425+
self.assertNotEqual(len(metadata), 0)
426+
self.assertIn('<md:SPSSODescriptor', metadata)
427+
self.assertEquals(4, metadata.count('<md:KeyDescriptor'))
428+
self.assertEquals(2, metadata.count('<md:KeyDescriptor use="signing"'))
429+
self.assertEquals(2, metadata.count('<md:KeyDescriptor use="encryption"'))
398430

399431
def testGetSPMetadataSigned(self):
400432
"""

0 commit comments

Comments
 (0)