ó
6£ßNc@s,
dd
lZdd
l
Z
ddlmZmZ
ddlmZmZ
ddlmZm	Z	
ddlm
Z

ddlmZmZm
Z

ddlmZ
ddlmZ
dd	lmZ
dd
lmZ
ddlmZ
ddlmZ
d
„Zd„Zd„Zidd6dd6Zddd„ƒYZd
S(iÿÿÿÿN(turlparsetparse_qs(tSaml2ClienttLogoutError(tsamlptBINDING_HTTP_POST(
tBINDING_SOAP(tsamltconfigt
class_name(
tServer(
tdecode_base64_and_inflate(
t
in_a_while(
t	Assertion(
tPolicy(
traisescCs:x3|jD](}|j
}|jjƒ|
kr
tSq
WdS(
N(taudience_restrictiontaudiencettexttstriptTrue(t	conditiontmetrestrictionR((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pytfor_mes

	

c
Csei}
xX|jD]M}|j
jƒ}g|
|<x+|jD] }|
|j|jjƒƒ

q9WqW|
S(
N(t	attributetnameRtattribute_valuetappendR(tattribute_statementtresultRRtvalue((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pytavas





"
cCst|ƒ
t|
ƒ
kS(
N(
tset(tl1tl2((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyt_leq$s
sE<?xml version='1.0' encoding='UTF-8'?>
<ns0:AttributeQuery Destination="https://idp.example.com/idp/" ID="id1" IssueInstant="%s" Version="2.0" xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol"><ns1:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" xmlns:ns1="urn:oasis:names:tc:SAML:2.0:assertion">urn:mace:example.com:saml:roland:sp</ns1:Issuer><ns1:Subject xmlns:ns1="urn:oasis:names:tc:SAML:2.0:assertion"><ns1:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">E8042FB4-4D5B-48C3-8E14-8EDD852790DD</ns1:NameID></ns1:Subject></ns0:AttributeQuery>s1.2.14s<?xml version='1.0' encoding='UTF-8'?>
<ns0:AttributeQuery xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns1="urn:oasis:names:tc:SAML:2.0:assertion" Destination="https://idp.example.com/idp/" ID="id1" IssueInstant="%s" Version="2.0"><ns1:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:example.com:saml:roland:sp</ns1:Issuer><ns1:Subject><ns1:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">E8042FB4-4D5B-48C3-8E14-8EDD852790DD</ns1:NameID></ns1:Subject></ns0:AttributeQuery>s1.2.16t
TestClientc
Bs³eZ
d„Zd
„Zd„Zd„Zd„Zd„Zd„Zd„Z	d„Z
d	„Zd
„Zd„Z
d„Zd
„Zd„Zd„Zd„Zd„Zd„ZRS(c
Cs;td
ƒ
|_
tjƒ}
|
jdƒ

t|
ƒ
|_dS(Ntidp_conftserver_conf(R
tserverRtSPConfigt	load_fileRtclient(tselftconf((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pytsetup_class9s



c
Csù|jj
d
dddtjƒ
}
d|
jƒ}td|
j}|GH||ksYt‚
|
jdksnt‚
|
j	d
ksƒt‚
|
j
dks˜t‚
|
j}|j}|j
tjksÂt‚
|jdks×t‚
|
j}|jdksõt‚
dS(	Ntid1s$E8042FB4-4D5B-48C3-8E14-8EDD852790DDshttps://idp.example.com/idp/t
nameid_formats%ss1.2.16s2.0s#urn:mace:example.com:saml:roland:sp(R+tcreate_attribute_queryRtNAMEID_FORMAT_PERSISTENTt	to_stringtREQ1t
issue_instanttAssertionErrortdestinationtidtversiontsubjecttname_idtformatRtissuer(R,treqtreqstrtexpected_reqR:R;R=((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyttest_create_attribute_query1@s"









	
	


	
c

Cs|jj
d
dddidd6dd6dd6dtjƒ}
|
jƒGH|
jdks\t‚
|
jd
ksqt‚
|
j	dks†t‚
|
j
}|j}|jtjks°t‚
|j
dksÅt‚
t|
jƒ
d
ksàt‚
g}xþ|
jD]ó}|jdkrB
|jtjks
t‚
|jdks2
t‚
|jdƒ

qð|jdkrŽ
|jtjksi
t‚
|jd	ks~
t‚
|jd	ƒ

qð|jd
krð|jtjksµ
t‚
t|dƒrÓ
tsÓ
t‚
n|jdƒ

qðqðWt|ƒ
dd	dhkst‚
dS(NR/s$E8042FB4-4D5B-48C3-8E14-8EDD852790DDshttps://idp.example.com/idp/Rsurn:oid:2.5.4.42s/urn:oasis:names:tc:SAML:2.0:attrname-format:urit	givenNamesurn:oid:2.5.4.4tsurnamesurn:oid:1.2.840.113549.1.9.1R0s2.0it
friendly_nametemail(surn:oid:2.5.4.42s/urn:oasis:names:tc:SAML:2.0:attrname-format:uris	givenName(surn:oid:2.5.4.4s/urn:oasis:names:tc:SAML:2.0:attrname-format:urissurname(surn:oid:1.2.840.113549.1.9.1s/urn:oasis:names:tc:SAML:2.0:attrname-format:uri(R+R1tNoneRR2R3R7R6R8R9R:R;R<RtlenRRtname_formattNAME_FORMAT_URIRDRtgetattrtFalseR!(R,R>R:R;tseenR((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyttest_create_attribute_query2^sB








	
	

















c
CsÜ|jj
d
dddtjƒ
}
t|
tjƒs9t‚
|
jdksNt‚
|
j	d
ksct‚
|
j
dksxt‚
|
js‡t‚
|
jj
dksŸt‚
|
jj}|jtjksÃt‚
|j
dksØt‚
dS(NR/t!_e7b68a04488f715cda642fbdd90099f5s-https://aai-demo-idp.switch.ch/idp/shibbolethR0s2.0s#urn:mace:example.com:saml:roland:sp(R+R1RtNAMEID_FORMAT_TRANSIENTt
isinstanceRtAttributeQueryR6R7R8R9R5R=RR:R;R<(R,R>tnameid((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyttest_create_attribute_query_3‰s











c
Cs4|jj
d
ddtjƒ
}
|
dks0t‚
dS(NRNs-https://aai-demo-idp.switch.ch/idp/shibbolethR0(R+tattribute_queryRRORFR6(R,R>((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyttest_attribute_query™s

	


c
Csñd
|jj
dddddƒ}
tj|
ƒ
}|GH|jdksKt‚
|jdks`t‚
|jtksut‚
|j	dksŠt‚
|j
dksŸt‚
|jjdks·t‚
|j
}|jdksÕt‚
|jtjksít‚
dS(	Ns%sR/shttp://www.example.com/ssoshttp://www.example.org/servicesurn:mace:example.org:saml:spsMy Names2.0ttrue(R+t
authn_requestRtauthn_request_from_stringtassertion_consumer_service_urlR6R7tprotocol_bindingRR9t
provider_nameR=Rtname_id_policytallow_createR<RRO(R,tar_strtart
nid_policy((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyttest_create_auth_request_0´s 














	

c
	CsE
|jj
jjƒd
g
ks$t‚
d|jjddddddd
ƒ
}
tj|
ƒ
}|GH|jdksut‚
|j	dksŠt‚
|j
dksŸt‚
|jtks´t‚
|j
d	ksÉt‚
|jdksÞt‚
|jjdksöt‚
|j}|jd
ks
t‚
|jtjks,
t‚
|jd
ksA
t‚
dS(Nsurn:mace:example.com:it:teks%st666shttp://www.example.com/ssoshttp://www.example.org/servicesurn:mace:example.org:saml:spsMy Nametvorgs2.0RV(R+Rtvirtual_organizationtkeysR6RWRRXR8RYR7RZRR9R[R=RR\R]R<RR2tsp_name_qualifier(R,R^R_R`((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyttest_create_auth_request_voÆs*
















	


c
	Cs0
d
|jj
ddddddtƒ
}
tj|
ƒ
}|sCt‚
|jsRt‚
|jjsdt‚
|jj}t	|j
ƒ
dks‹t‚
|j
d	jd
ks§t‚
|j
d	js½t‚
dGHy7|jj
j|
|jjj|jjjƒsøt‚
Wn0tk
r+



|jj
j|
dt|ƒ
ƒ


n
XdS(
Ns%sR/shttp://www.example.com/ssoshttp://www.example.org/servicesurn:mace:example.org:saml:spsMy Nametsigni
is#id1s0------------------------------------------------t	node_name(R+RWRRRXR6t	signaturetsignature_valuetsigned_infoRGt	referenceturitdigest_valuetsectcorrectly_signed_authn_requestRt
xmlsec_binarytmetadatat	Exceptiontverify_signatureR	(R,R^R_Rl((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyttest_sign_auth_request_0ßs(
















c

Cs"d
}
idg
d6dg
d6dg
d6}dj|j
jd	|d
ddd
dddtjdtjƒ
ddƒƒ
}tj|ƒ
}|j	j
i
|d6i
dd6ƒ}|dk	s¹t‚
|j
ƒ|
ksÑt‚
|j
jdj
j|
ksót‚
|jƒ}|GH|didg
d6dg
d6dg
d6ks8
t‚
|d|
ksN
t‚
|ddksd
t‚
tj|jƒ
}|jd
ks‹
t‚
t|j	jjƒƒ
dks¯
t‚
|j	jjƒd}dG|j	jj||
ƒGH|j	jj|ƒ
|
g
kst‚
idg
d6dg
d6dg
d6}dj|j
jd	|d
d dd
dddtjdtjƒ
dd!ƒƒ
}tj|ƒ
}|j	j
i
|d6i
dd 6ƒ
t|j	jjƒƒ
d"ksÇt‚
g|j	jjƒD]}|j	jj|ƒ
^qÚ}	|	GH|	|
g
|
g
gkst‚
dS(#Ns$urn:mace:example.com:saml:roland:idptDerekRBtJeterRCsderek@nyy.mlb.comtmails

tidentitytin_response_toR/R7s http://lingon.catalogix.se:8087/tsp_entity_ids#urn:mace:example.com:saml:roland:spR\R<tuseridsfoba0001@example.comtSAMLResponseshttp://foo.example.com/serviceiR tsnR=t	came_fromi
s||||tAlfonsontSorianosalfonson@chc.mlb.comtid2salso0001@example.comi(tjoinR(tauthn_responseRtNameIDPolicyRR2tbase64tencodestringR+tresponseRFR6R=t	assertionRtsession_infotresponse_from_stringtxmlstrR7RGtuserstsubjectst
get_info_fromtissuers_of_info(
R,tIDPR tresp_strR…R‹R‰t
subject_idt
stissuers((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyt
test_responseúsZ







	




"

4



$

$






	


$
4
c
CsÏ|jj
ƒ}
|
GH|
d
ks&t‚
|jjjGH|jjjjƒGH|jjjƒGH|jjƒ}|GH|dkst‚
|jjƒ}|GH|dks¥t‚
|jj	ƒ}|GH|d
ksËt‚
dS(Ns#urn:mace:example.com:saml:roland:spshttp://localhost:8088/ssos http://lingon.catalogix.se:8087/(
R+t	_entityidR6RtidpRstidpst
_sso_locationtservice_urlt_my_name(R,tentityidtlocationRœtmy_name((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyttest_init_values;
s














c
CsÕ|jj
jƒGH|jjd
dƒ\}
}|
dk	s>t‚
|ddksTt‚
t|dƒ
}t|jƒ
}t	|j
ƒddgƒs”t‚
t|ddƒ
}|GHtj
|ƒ
}|j|
ksÑt‚
dS(Ns$urn:mace:example.com:saml:roland:idps"http://www.example.com/relay_stateitLocationi
tSAMLRequestt
RelayState(R+RRštauthenticateRFR6RR
tqueryR$ReRRRXR8(R,tsidR‰t
otqdicttsaml_requesttauthnreq((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyttest_authenticateL
s

	






!



c
	CsŽ
|jj
d
dƒ
\}
}|
dk	s-t‚
|ddksCt‚
t|dƒ
}t|jƒ
}t|jƒddgƒsƒt‚
t	|ddƒ
}|dddks±t‚
|GHt
j|ƒ
}|jƒGH|j
|
ksåt‚
|jdksút‚
|jd	ks
t‚
|jd
ks$
t‚
|jtks9
t‚
|j}|jdksW
t‚
|jdksl
t‚
|j}|jd
ksŠ
t‚
dS(
Ntrelay_states"http://www.example.com/relay_stateiR¢i
R£R¤shttp://localhost:8088/ssos http://lingon.catalogix.se:8087/s#urn:mace:example.com:saml:roland:spRVs3urn:oasis:names:tc:SAML:2.0:nameid-format:transient(R+R¥RFR6RR
R¦R$ReRRRXtkeyswvR8R7RYR[RZRR\R]R<R=R(	R,R§trequestR¨R©RªR«R\R=((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyttest_authenticate_no_args[
s*





!










	


	
c
CsÇ
id
d6dd6tddƒ
d6idd	6d
d6dd
6d6}
|j
jj|
ƒ

|j
jjd
ƒ
}|dg
ks}t‚
|j
jd
dtddƒ
ƒ}|GH|s¯t‚
|ds¿t‚
|ddksÕt‚
|dd"g
ksît‚
|dddks
t‚
|dddks"
t‚
|j
j|d}
|
GH|
d|dksU
t‚
|
dd
ksk
t‚
|
ddks
t‚
|
ddks—
t‚
|
d|ks­
t‚
|
d tksÃ
t‚
d!S(#s? one IdP/AA with BINDING_HTTP_REDIRECT on single_logout_servicet123456R;s$urn:mace:example.com:saml:roland:idpR=tminutesitnot_on_or_aftertAndersRBt	AnderssontsurNamesanders.andersson@example.comRyR tTirediii
s200 OKisContent-types	text/htmlis<head>s<title>SAML 2.0 POST</title>t	entity_idR”treasont	operationtSLOt
entity_idsRhN(sContent-types	text/html(	RR+RŽtadd_information_about_personR‘R6t
global_logouttstateRK(R,R‹R¼tresp((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyt
test_logout_1s
s6









!














c
Csãtj
ƒ}
|
jd
ƒ

t|
ƒ
}idd6dd6tddƒ
d6id	d
6dd6d
d6d6}|jj|ƒ

|jjjdƒ
}|dg
ksŸt	‚
|jj
|dtƒ}|GH|dg
ksÒt	‚
tt
dƒ
dS(s< one IdP/AA with BINDING_SOAP, can't actually send somethingtserver2_confR±R;s$urn:mace:example.com:saml:roland:idpR=R²iR³R´RBRµR¶sanders.andersson@example.comRyR ishttp://localhost:8088/slos>client.global_logout("123456", "Tired", in_a_while(minutes=5))N(RR)R*RRRŽR½R+R‘R6tsingle_logout_servicesRRR(R,R-R+R‹R¼tdestinations((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyt
test_logout_2•
s&













	

c
Cs(tj
ƒ}
|
jd
ƒ

t|
ƒ
}idd6dd6tddƒ
d6id	d
6dd6d
d6d6}|jj|ƒ

idd6dd6tddƒ
d6i
dd6d6}|jj|ƒ

|jjdƒ
}t|ddgƒsät	‚
|j
ddtddƒ
ƒ}|GH|s
t	‚
|ds#
t	‚
|ddks9
t	‚
|dd&g
ksR
t	‚
|dddksl
t	‚
|dddks†
t	‚
|j|d}|GH|d|dks¶
t	‚
|ddksÌ
t	‚
|d dksâ
t	‚
|d!d"ksø
t	‚
|d#|kst	‚
|d$tks$t	‚
d%S('s. two or more IdP/AA with BINDING_HTTP_REDIRECTtserver3_confR±R;s$urn:mace:example.com:saml:roland:idpR=R²iR³R´RBRµR¶sanders.andersson@example.comRyR s#urn:mace:example.com:saml:roland:aatFoobarteduPersonEntitlementR·iii
s200 OKisContent-types	text/htmlis<head>s<title>SAML 2.0 POST</title>R¸R”R¹RºR»R¼RhN(sContent-types	text/html(
RR)R*RRRŽR½R‘R$R6R¾R¿RK(R,R-R+tsession_info_authntsession_info_aaR¼RÀt
state_info((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyt
test_logout_3²
sL

















	














c
	Cs>
tj
ƒ}
|
jd
ƒ

t|
ƒ
}idd6dd6dd6dd	6}d
}d}d}tjtjd
dƒ

}tƒ}t|ƒ
}	|	j	|||||
j
|d|jƒƒ
}
|jd|
ddƒ}|s×t
‚
|GH|jƒgksôt
‚
|jdks	
t
‚
|jdks
t
‚
|jdjdks:
t
‚
dS(NRÆuroland.hedberg@adm.umu.seRyt 95e9ae91dbe62d35198fbbd5e1fb0976teduPersonTargetedIDuRoland HedbergtdisplayNames#http://roland.hedberg.myopenid.com/tuidR|t1234shttp://example.com/consumerRR;R=R¸treadshttp://example.com/texti(RR)R*RRtNameIDRORR
t	constructtattribute_convertersR=t$authz_decision_query_using_assertionR6R®R7tresourcetactionR(R,R-R+tAVAR|R{tconsumer_urlR;tpolicyR RŠtadq((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyttest_authz_decision_queryä
s6












	




	


	




c
Csbd
}
|jj
|
ƒ
}|GH|dks/t‚
|jj
|
ddƒ

}|GH|dks^t‚
dS(Ns!http://example.com/saml2/idp/discsXhttp://example.com/saml2/idp/disc?entityID=urn%3Amace%3Aexample.com%3Asaml%3Aroland%3Aspt
return_urlshttp://example.org/saml2/sp/dssŠhttp://example.com/saml2/idp/disc?entityID=urn%3Amace%3Aexample.com%3Asaml%3Aroland%3Asp&return=http%3A%2F%2Fexample.org%2Fsaml2%2Fsp%2Fds(R+trequest_to_discovery_serviceR6(R,tdisc_urlturl((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyt!test_request_to_discovery_services




	
c
Cs¤i
d
d6}
tj
|
ƒ
}d|}|jjd|ƒ
}|d
ksMt‚
i
d
d6}
tj
|
ƒ
}d|}|jjd|ddƒ}|d
ks t‚
dS(Ns http://example.org/saml2/idp/ssotentityIDs#http://example.com/saml2/sp/disc?%sRátidpIDt
returnIDParam(turllibt	urlencodeR+tget_idp_from_discovery_serviceR6(R,tpdirtparamstredirect_urlR¸((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyt#test_get_idp_from_discovery_services










	c
Csè
x-|jj
jƒD]}
|jj
j|
ƒ

qWd
}idg
d6dg
d6dg
d6}dj|jjd	|d
ddd
dddtjdt	j
ƒ
ddƒƒ
}tj|ƒ
}t
|j_|jji
|d6dƒ}|dk	sît‚
|jƒ|ks
t‚
|jjdjj|ks(
t‚
|jƒ}|GH|didg
d6dg
d6dg
d6ksm
t‚
|d|ksƒ
t‚
|ddks™
t‚
tj|jƒ
}|jd
ksÀ
t‚
t|jj
jƒƒ
dksä
t‚
dS(s


        s$urn:mace:example.com:saml:roland:idpRwRBRxRCsderek@nyy.mlb.comRys

RzR{R/R7s http://lingon.catalogix.se:8087/R|s#urn:mace:example.com:saml:roland:spR\R<R}sfoba0001@example.comR~iR RR=R€ti
N((R+RŽRt
remove_personR„R(R…RR†RR2R‡RˆRtallow_unsolicitedR‰RFR6R=RŠRR‹RŒRR7RG(R,R:R’R R“R…R‹R‰((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyttest_unsolicited_response"s6







	




"

4



(t__name__t
__module__R.RARMRSRURaRgRvR—R¡R¬R°RÁRÅRÌRÝRâRìRð(((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyR%8s&
			+						A				"		2	!		((R‡RæRR
tsaml2.clientRRtsaml2RRRRRR	tsaml2.serverR
t
saml2.s_utilsRtsaml2.time_utilRtsaml2.assertionR
Rtpy.testRRR R$R4R%(((s@/home/lgs/proyectos/yaco/pysaml2/pysaml2/tests/test_51_client.pyt<module>s&