Accept authn response with no NameID element #190
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The SAML backend SP should accept an authentication response from an IdP that does not contain a SAML NameID element since it is not required by the SAML 2.0 specification. This change enables the _translate_response method for the SAMLBackend class to continue gracefully if there is no NameID, and for the _auth_resp_callback_func method of the SATOSABase class to not insist on grabbing a user_id generated from a NameID and hashing it.
|
Note that this PR for SATOSA requires the PR 451 for pysaml2: |
c00kiemon5ter
approved these changes
Aug 22, 2018
There was a problem hiding this comment.
I think this is fine. We have to update the pysaml2 hardcoded version for SATOSA in order to use the latest available. I would also like to add more python versions to test and make the output more verbose. But this is all unrelated to this changeset. I will merge this asap.
|
Since pysaml2 PR 451 has been merged, do you have a timeline for when you can do a point release of pysaml2 and then merge this request? |
Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
Prior to pysaml2 v4.6.1 an exception is thrown when parsing a SAML response with no NameID element. satosa.exception.SATOSAAuthenticationError: Failed to parse authn request pysaml2 v4.6.1 onwards supports SAML responses with no NameID element. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The SAML backend SP should accept an authentication response from an IdP
that does not contain a SAML NameID element since it is not required by
the SAML 2.0 specification. This change enables the
_translate_responsemethod for the
SAMLBackendclass to continue gracefully if there is noNameID, and for the
_auth_resp_callback_funcmethod of theSATOSABaseclass to not insist on grabbing a
user_idgenerated from a NameID andhashing it.
All Submissions: