From 69973f19a25f245ea1363e5870cabfc0ef40187c Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Mon, 11 Sep 2023 22:14:46 +0200 Subject: [PATCH] providers/saml: set WantAuthnRequestsSigned in metadata Signed-off-by: Jens Langhammer --- .../providers/saml/processors/metadata.py | 2 ++ .../providers/saml/tests/test_metadata.py | 20 ++++++++++++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/authentik/providers/saml/processors/metadata.py b/authentik/providers/saml/processors/metadata.py index 83c1a1ee3a28..5aecf24f6760 100644 --- a/authentik/providers/saml/processors/metadata.py +++ b/authentik/providers/saml/processors/metadata.py @@ -171,6 +171,8 @@ def build_entity_descriptor(self) -> str: entity_descriptor, f"{{{NS_SAML_METADATA}}}IDPSSODescriptor" ) idp_sso_descriptor.attrib["protocolSupportEnumeration"] = NS_SAML_PROTOCOL + if self.provider.verification_kp: + idp_sso_descriptor.attrib["WantAuthnRequestsSigned"] = "true" signing_descriptor = self.get_signing_key_descriptor() if signing_descriptor is not None: diff --git a/authentik/providers/saml/tests/test_metadata.py b/authentik/providers/saml/tests/test_metadata.py index ffe1b2a4a813..74d644d4713e 100644 --- a/authentik/providers/saml/tests/test_metadata.py +++ b/authentik/providers/saml/tests/test_metadata.py @@ -12,7 +12,7 @@ from authentik.providers.saml.models import SAMLBindings, SAMLPropertyMapping, SAMLProvider from authentik.providers.saml.processors.metadata import MetadataProcessor from authentik.providers.saml.processors.metadata_parser import ServiceProviderMetadataParser -from authentik.sources.saml.processors.constants import NS_MAP +from authentik.sources.saml.processors.constants import NS_MAP, NS_SAML_METADATA class TestServiceProviderMetadataParser(TestCase): @@ -55,6 +55,24 @@ def test_schema(self): schema = etree.XMLSchema(etree.parse("schemas/saml-schema-metadata-2.0.xsd")) # nosec self.assertTrue(schema.validate(metadata)) + def test_schema_WantAuthnRequestsSigned(self): + """Test metadata generation with WantAuthnRequestsSigned""" + cert = create_test_cert() + provider = SAMLProvider.objects.create( + name=generate_id(), + authorization_flow=self.flow, + verification_kp=cert, + ) + Application.objects.create( + name=generate_id(), + slug=generate_id(), + provider=provider, + ) + request = self.factory.get("/") + metadata = lxml_from_string(MetadataProcessor(provider, request).build_entity_descriptor()) + idp_sso_descriptor = metadata.findall(f"{{{NS_SAML_METADATA}}}IDPSSODescriptor")[0] + self.assertEqual(idp_sso_descriptor.attrib["WantAuthnRequestsSigned"], "true") + def test_simple(self): """Test simple metadata without Signing""" metadata = ServiceProviderMetadataParser().parse(load_fixture("fixtures/simple.xml"))