3 # Copyright (C) 2014 Simo Sorce <simo@redhat.com>
5 # see file 'COPYING' for use and warranty information
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation, either version 3 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
20 from ipsilon.tools.certs import Certificate
21 from lxml import etree
26 'email': lasso.SAML2_NAME_IDENTIFIER_FORMAT_EMAIL,
27 'encrypted': lasso.SAML2_NAME_IDENTIFIER_FORMAT_ENCRYPTED,
28 'entity': lasso.SAML2_NAME_IDENTIFIER_FORMAT_ENTITY,
29 'kerberos': lasso.SAML2_NAME_IDENTIFIER_FORMAT_KERBEROS,
30 'persistent': lasso.SAML2_NAME_IDENTIFIER_FORMAT_PERSISTENT,
31 'transient': lasso.SAML2_NAME_IDENTIFIER_FORMAT_TRANSIENT,
32 'unspecified': lasso.SAML2_NAME_IDENTIFIER_FORMAT_UNSPECIFIED,
33 'windows': lasso.SAML2_NAME_IDENTIFIER_FORMAT_WINDOWS,
34 'x509': lasso.SAML2_NAME_IDENTIFIER_FORMAT_X509,
38 EDESC = '{%s}EntityDescriptor' % lasso.SAML2_METADATA_HREF
40 'md': lasso.SAML2_METADATA_HREF,
44 IDPDESC = 'IDPSSODescriptor'
45 SPDESC = 'SPSSODescriptor'
50 SSO_SERVICE = 'SingleSignOnService'
51 LOGOUT_SERVICE = 'SingleLogoutService'
52 ASSERTION_SERVICE = 'AssertionConsumerService'
55 def mdElement(_parent, _tag, **kwargs):
56 tag = '{%s}%s' % (lasso.SAML2_METADATA_HREF, _tag)
57 return etree.SubElement(_parent, tag, **kwargs)
60 def dsElement(_parent, _tag, **kwargs):
61 tag = '{%s}%s' % (lasso.DS_HREF, _tag)
62 return etree.SubElement(_parent, tag, **kwargs)
65 class Metadata(object):
67 def __init__(self, role=None):
68 self.root = etree.Element(EDESC, nsmap=NSMAP)
73 def set_entity_id(self, url):
75 self.root.set('entityID', url)
77 def set_role(self, role):
80 elif role == IDP_ROLE:
85 raise ValueError('invalid role: %s' % role)
86 self.role = mdElement(self.root, description)
87 self.role.set('protocolSupportEnumeration', lasso.SAML2_PROTOCOL_HREF)
90 def add_cert(self, certdata, use):
91 desc = mdElement(self.role, 'KeyDescriptor')
93 info = dsElement(desc, 'KeyInfo')
94 data = dsElement(info, 'X509Data')
95 cert = dsElement(data, 'X509Certificate')
98 def add_certs(self, signcert=None, enccert=None):
100 self.add_cert(signcert.get_cert(), 'signing')
102 self.add_cert(enccert.get_cert(), 'encryption')
104 def add_service(self, svctype, binding, location):
105 svc = mdElement(self.role, svctype)
106 svc.set('Binding', binding)
107 svc.set('Location', location)
109 def add_allowed_name_format(self, name_format):
110 nameidfmt = mdElement(self.role, 'NameIDFormat')
111 nameidfmt.text = name_format
113 def output(self, path):
114 data = etree.tostring(self.root, xml_declaration=True,
115 encoding='UTF-8', pretty_print=True)
116 with open(path, 'w') as f:
120 if __name__ == '__main__':
125 tmpdir = tempfile.mkdtemp()
128 # Test IDP generation
129 sign_cert = Certificate(tmpdir)
130 sign_cert.generate('idp-signing-cert', 'idp.ipsilon.example.com')
131 enc_cert = Certificate(tmpdir)
132 enc_cert.generate('idp-encryption-cert', 'idp.ipsilon.example.com')
134 idp.set_entity_id('https://ipsilon.example.com/idp/metadata')
135 idp.set_role(IDP_ROLE)
136 idp.add_certs(sign_cert, enc_cert)
137 idp.add_service(SSO_SERVICE, lasso.SAML2_METADATA_BINDING_POST,
138 'https://ipsilon.example.com/idp/saml2/POST')
139 idp.add_service(SSO_SERVICE, lasso.SAML2_METADATA_BINDING_REDIRECT,
140 'https://ipsilon.example.com/idp/saml2/Redirect')
141 for k in SAML2_NAMEID_MAP:
142 idp.add_allowed_name_format(SAML2_NAMEID_MAP[k])
143 md_file = os.path.join(tmpdir, 'metadata.xml')
145 with open(md_file) as fd:
147 print '==================== IDP ===================='
149 print '============================================='
152 sign_cert = Certificate(tmpdir)
153 sign_cert.generate('sp-signing-cert', 'sp.ipsilon.example.com')
155 sp.set_entity_id('https://ipsilon.example.com/samlsp/metadata')
157 sp.add_certs(sign_cert)
158 sp.add_service(LOGOUT_SERVICE, lasso.SAML2_METADATA_BINDING_REDIRECT,
159 'https://ipsilon.example.com/samlsp/logout')
160 sp.add_service(ASSERTION_SERVICE, lasso.SAML2_METADATA_BINDING_POST,
161 'https://ipsilon.example.com/samlsp/postResponse')
162 md_file = os.path.join(tmpdir, 'metadata.xml')
164 with open(md_file) as fd:
166 print '===================== SP ===================='
168 print '============================================='
171 shutil.rmtree(tmpdir)