Skip to content

Commit

Permalink
Support Signature on Response and on Assertion
Browse files Browse the repository at this point in the history
  • Loading branch information
@pitbulk
pitbulk committed Jun 26, 2014
1 parent 658d9a9 commit 5d2e297
Showing 1 changed file with 7 additions and 1 deletion.
8 changes: 7 additions & 1 deletion onelogin/saml/SignatureVerifier.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,12 @@ def verify(document, signature, _etree=None, _tempfile=None, _subprocess=None,
if _os is None:
_os = os

signatureNodes = document.xpath("//ds:Signature", namespaces={'ds': 'http://www.w3.org/2000/09/xmldsig#'})

parent_id_container = 'urn:oasis:names:tc:SAML:2.0:assertion:Assertion'
if signatureNodes and signatureNodes[0].getparent().tag == '{urn:oasis:names:tc:SAML:2.0:protocol}Response':
parent_id_container = 'urn:oasis:names:tc:SAML:2.0:protocol:Response'

xmlsec_bin = _get_xmlsec_bin()

verified = False
Expand Down Expand Up @@ -117,7 +123,7 @@ def verify(document, signature, _etree=None, _tempfile=None, _subprocess=None,
'--pubkey-cert-pem',
cert_filename,
'--id-attr:ID',
'urn:oasis:names:tc:SAML:2.0:assertion:Assertion',
parent_id_container,
xml_filename,
]

Expand Down

4 comments on commit 5d2e297

@rwscarb
Copy link

@rwscarb rwscarb commented on 5d2e297 Jul 2, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should this be based on the ds:Reference URI of the signature as opposed to the location of the signature?

@pitbulk
Copy link
Contributor Author

@pitbulk pitbulk commented on 5d2e297 Jul 2, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When validating SAML signature on a Response, the elements signed could be the whole Response, the Assertion of both.
When both (response and assertion) are signed, is enought if we validate the sign on the response.

This code worked for me, I'm putting as parameter of the xmlsec command the ID of the Message of or the Assertion to be verified.

@rwscarb
Copy link

@rwscarb rwscarb commented on 5d2e297 Jul 2, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it possible that the URI of the ds:Signature points to something other than the Assertion or Response and validates fine with xmlsec1? This is regarding XSW

@pitbulk
Copy link
Contributor Author

@pitbulk pitbulk commented on 5d2e297 Jul 2, 2014

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the code, the xpath expresion search over all the ds:Signature, by default the xmlsec will validate the ID Assertion, but if a Sign is found at the Response level, then xmlsec will validate the ID Response.

Maybe there is a better solution for that (I will think on it for the final version).

Thanks for contribute. your feedback is welcome!!

Please sign in to comment.