From 217cabe5a2b0950b9ac4090568aa8986d51f4fc5 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Thu, 19 Mar 2015 15:15:26 -0400 Subject: Implement urn:oasis:names:tc:SAML:2.0:nameid-format:persistent This also makes persistent the default NameID format when generating metadata. https://fedorahosted.org/ipsilon/ticket/27 Signed-off-by: Rob Crittenden Reviewed-by: Simo Sorce --- ipsilon/providers/saml2idp.py | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) (limited to 'ipsilon/providers/saml2idp.py') diff --git a/ipsilon/providers/saml2idp.py b/ipsilon/providers/saml2idp.py index 96a7d11..5d8aa03 100644 --- a/ipsilon/providers/saml2idp.py +++ b/ipsilon/providers/saml2idp.py @@ -33,6 +33,7 @@ from datetime import timedelta import lasso import os import time +import uuid class Redirect(AuthenticateRequest): @@ -194,6 +195,10 @@ Provides SAML 2.0 authentication infrastructure. """ 'idp key file', 'The IdP Certificate Key genearated at install time.', 'certificate.key'), + pconfig.String( + 'idp nameid salt', + 'The salt used for persistent Name IDs.', + None), pconfig.Condition( 'allow self registration', 'Allow authenticated users to register applications.', @@ -252,6 +257,10 @@ Provides SAML 2.0 authentication infrastructure. """ return os.path.join(self.idp_storage_path, self.get_config_value('idp key file')) + @property + def idp_nameid_salt(self): + return self.get_config_value('idp nameid salt') + @property def default_allowed_nameids(self): return self.get_config_value('default allowed nameids') @@ -323,10 +332,10 @@ class IdpMetadataGenerator(object): '%s/saml2/SSO/Redirect' % url) self.meta.add_service(metadata.SAML2_SERVICE_MAP['logout-redirect'], '%s/saml2/SLO/Redirect' % url) - self.meta.add_allowed_name_format( - lasso.SAML2_NAME_IDENTIFIER_FORMAT_TRANSIENT) self.meta.add_allowed_name_format( lasso.SAML2_NAME_IDENTIFIER_FORMAT_PERSISTENT) + self.meta.add_allowed_name_format( + lasso.SAML2_NAME_IDENTIFIER_FORMAT_TRANSIENT) self.meta.add_allowed_name_format( lasso.SAML2_NAME_IDENTIFIER_FORMAT_EMAIL) @@ -379,7 +388,8 @@ class Installer(ProviderInstaller): config = {'idp storage path': path, 'idp metadata file': 'metadata.xml', 'idp certificate file': cert.cert, - 'idp key file': cert.key} + 'idp key file': cert.key, + 'idp nameid salt': uuid.uuid4().hex} po.save_plugin_config(config) # Update global config to add login plugin -- cgit