+# -*- coding: utf-8 -*-
+
+""" OneLogin_Saml2_Auth class
+
+MIT License
+
+Main class of Python Toolkit.
+
+Initializes the SP SAML instance
+
+"""
+
+from base64 import b64encode
+from urllib import quote_plus
+
+from onelogin.saml2.authn_request import OneLogin_Saml2_Authn_Request
+from onelogin.saml2.constants import OneLogin_Saml2_Constants
+from onelogin.saml2.errors import OneLogin_Saml2_Error
+from onelogin.saml2.logout_response import OneLogin_Saml2_Logout_Response
+from onelogin.saml2.logout_request import OneLogin_Saml2_Logout_Request
+from onelogin.saml2.response import OneLogin_Saml2_Response
+from onelogin.saml2.settings import OneLogin_Saml2_Settings
+from onelogin.saml2.utils import OneLogin_Saml2_Utils, xmlsec
+from onelogin.saml2.xmlparser import tostring
+
+
+[docs]class OneLogin_Saml2_Auth(object):
+ """
+
+ This class implements the SP SAML instance.
+
+ Defines the methods that you can invoke in your application in
+ order to add SAML support (initiates SSO, initiates SLO, processes a
+ SAML Response, a Logout Request or a Logout Response).
+ """
+
+ def __init__(self, request_data, old_settings=None, custom_base_path=None):
+ """
+ Initializes the SP SAML instance.
+
+ :param request_data: Request Data
+ :type request_data: dict
+
+ :param old_settings: Optional. SAML Toolkit Settings
+ :type old_settings: dict
+
+ :param custom_base_path: Optional. Path where are stored the settings file and the cert folder
+ :type custom_base_path: string
+ """
+ self.__request_data = request_data
+ self.__settings = OneLogin_Saml2_Settings(old_settings, custom_base_path)
+ self.__attributes = []
+ self.__friendlyname_attributes = []
+ self.__nameid = None
+ self.__nameid_format = None
+ self.__nameid_nq = None
+ self.__nameid_spnq = None
+ self.__session_index = None
+ self.__session_expiration = None
+ self.__authenticated = False
+ self.__errors = []
+ self.__error_reason = None
+ self.__last_request_id = None
+ self.__last_message_id = None
+ self.__last_assertion_id = None
+ self.__last_assertion_not_on_or_after = None
+ self.__last_authn_contexts = []
+ self.__last_request = None
+ self.__last_response = None
+
+[docs] def get_settings(self):
+ """
+ Returns the settings info
+ :return: Setting info
+ :rtype: OneLogin_Saml2_Setting object
+ """
+ return self.__settings
+
+[docs] def set_strict(self, value):
+ """
+ Set the strict mode active/disable
+
+ :param value:
+ :type value: bool
+ """
+ assert isinstance(value, bool)
+ self.__settings.set_strict(value)
+
+[docs] def process_response(self, request_id=None):
+ """
+ Process the SAML Response sent by the IdP.
+
+ :param request_id: Is an optional argument. Is the ID of the AuthNRequest sent by this SP to the IdP.
+ :type request_id: string
+
+ :raises: OneLogin_Saml2_Error.SAML_RESPONSE_NOT_FOUND, when a POST with a SAMLResponse is not found
+ """
+ self.__errors = []
+ self.__error_reason = None
+
+ if 'post_data' in self.__request_data and 'SAMLResponse' in self.__request_data['post_data']:
+ # AuthnResponse -- HTTP_POST Binding
+ response = OneLogin_Saml2_Response(self.__settings, self.__request_data['post_data']['SAMLResponse'])
+ self.__last_response = response.get_xml_document()
+ if response.is_valid(self.__request_data, request_id):
+ self.__attributes = response.get_attributes()
+ self.__friendlyname_attributes = response.get_friendlyname_attributes()
+ self.__nameid = response.get_nameid()
+ self.__nameid_format = response.get_nameid_format()
+ self.__nameid_nq = response.get_nameid_nq()
+ self.__nameid_spnq = response.get_nameid_spnq()
+ self.__session_index = response.get_session_index()
+ self.__session_expiration = response.get_session_not_on_or_after()
+ self.__last_message_id = response.get_id()
+ self.__last_assertion_id = response.get_assertion_id()
+ self.__last_authn_contexts = response.get_authn_contexts()
+ self.__last_assertion_not_on_or_after = response.get_assertion_not_on_or_after()
+ self.__authenticated = True
+ else:
+ self.__errors.append('invalid_response')
+ self.__error_reason = response.get_error()
+ else:
+ self.__errors.append('invalid_binding')
+ raise OneLogin_Saml2_Error(
+ 'SAML Response not found, Only supported HTTP_POST Binding',
+ OneLogin_Saml2_Error.SAML_RESPONSE_NOT_FOUND
+ )
+
+[docs] def process_slo(self, keep_local_session=False, request_id=None, delete_session_cb=None):
+ """
+ Process the SAML Logout Response / Logout Request sent by the IdP.
+
+ :param keep_local_session: When false will destroy the local session, otherwise will destroy it
+ :type keep_local_session: bool
+
+ :param request_id: The ID of the LogoutRequest sent by this SP to the IdP
+ :type request_id: string
+
+ :returns: Redirection URL
+ """
+ self.__errors = []
+ self.__error_reason = None
+
+ if 'get_data' in self.__request_data and 'SAMLResponse' in self.__request_data['get_data']:
+ logout_response = OneLogin_Saml2_Logout_Response(self.__settings, self.__request_data['get_data']['SAMLResponse'])
+ self.__last_response = logout_response.get_xml()
+ if not logout_response.is_valid(self.__request_data, request_id):
+ self.__errors.append('invalid_logout_response')
+ self.__error_reason = logout_response.get_error()
+ elif logout_response.get_status() != OneLogin_Saml2_Constants.STATUS_SUCCESS:
+ self.__errors.append('logout_not_success')
+ else:
+ self.__last_message_id = logout_response.id
+ if not keep_local_session:
+ OneLogin_Saml2_Utils.delete_local_session(delete_session_cb)
+
+ elif 'get_data' in self.__request_data and 'SAMLRequest' in self.__request_data['get_data']:
+ logout_request = OneLogin_Saml2_Logout_Request(self.__settings, self.__request_data['get_data']['SAMLRequest'])
+ self.__last_request = logout_request.get_xml()
+ if not logout_request.is_valid(self.__request_data):
+ self.__errors.append('invalid_logout_request')
+ self.__error_reason = logout_request.get_error()
+ else:
+ if not keep_local_session:
+ OneLogin_Saml2_Utils.delete_local_session(delete_session_cb)
+
+ in_response_to = logout_request.id
+ self.__last_message_id = logout_request.id
+ response_builder = OneLogin_Saml2_Logout_Response(self.__settings)
+ response_builder.build(in_response_to)
+ self.__last_response = response_builder.get_xml()
+ logout_response = response_builder.get_response()
+
+ parameters = {'SAMLResponse': logout_response}
+ if 'RelayState' in self.__request_data['get_data']:
+ parameters['RelayState'] = self.__request_data['get_data']['RelayState']
+ # else:
+ # parameters['RelayState'] = OneLogin_Saml2_Utils.get_self_url_no_query(self.__request_data)
+
+ security = self.__settings.get_security_data()
+ if 'logoutResponseSigned' in security and security['logoutResponseSigned']:
+ parameters['SigAlg'] = security['signatureAlgorithm']
+ parameters['Signature'] = self.build_response_signature(logout_response, parameters.get('RelayState', None), security['signatureAlgorithm'])
+
+ return self.redirect_to(self.get_slo_url(), parameters)
+ else:
+ self.__errors.append('invalid_binding')
+ raise OneLogin_Saml2_Error(
+ 'SAML LogoutRequest/LogoutResponse not found. Only supported HTTP_REDIRECT Binding',
+ OneLogin_Saml2_Error.SAML_LOGOUTMESSAGE_NOT_FOUND
+ )
+
+[docs] def redirect_to(self, url=None, parameters={}):
+ """
+ Redirects the user to the URL passed by parameter or to the URL that we defined in our SSO Request.
+
+ :param url: The target URL to redirect the user
+ :type url: string
+ :param parameters: Extra parameters to be passed as part of the URL
+ :type parameters: dict
+
+ :returns: Redirection URL
+ """
+ if url is None and 'RelayState' in self.__request_data['get_data']:
+ url = self.__request_data['get_data']['RelayState']
+ return OneLogin_Saml2_Utils.redirect(url, parameters, request_data=self.__request_data)
+
+[docs] def get_last_authn_contexts(self):
+ """
+ :returns: The list of authentication contexts sent in the last SAML Response.
+ :rtype: list
+ """
+ return self.__last_authn_contexts
+
+[docs] def is_authenticated(self):
+ """
+ Checks if the user is authenticated or not.
+
+ :returns: True if is authenticated, False if not
+ :rtype: bool
+ """
+ return self.__authenticated
+
+[docs] def get_attributes(self):
+ """
+ Returns the set of SAML attributes.
+
+ :returns: SAML attributes
+ :rtype: dict
+ """
+ return self.__attributes
+
+[docs] def get_friendlyname_attributes(self):
+ """
+ Returns the set of SAML attributes indexed by FiendlyName.
+
+ :returns: SAML attributes
+ :rtype: dict
+ """
+ return self.__friendlyname_attributes
+
+[docs] def get_nameid(self):
+ """
+ Returns the nameID.
+
+ :returns: NameID
+ :rtype: string|None
+ """
+ return self.__nameid
+
+[docs] def get_nameid_format(self):
+ """
+ Returns the nameID Format.
+
+ :returns: NameID Format
+ :rtype: string|None
+ """
+ return self.__nameid_format
+
+[docs] def get_nameid_nq(self):
+ """
+ Returns the nameID NameQualifier of the Assertion.
+
+ :returns: NameID NameQualifier
+ :rtype: string|None
+ """
+ return self.__nameid_nq
+
+[docs] def get_nameid_spnq(self):
+ """
+ Returns the nameID SP NameQualifier of the Assertion.
+
+ :returns: NameID SP NameQualifier
+ :rtype: string|None
+ """
+ return self.__nameid_spnq
+
+[docs] def get_session_index(self):
+ """
+ Returns the SessionIndex from the AuthnStatement.
+ :returns: The SessionIndex of the assertion
+ :rtype: string
+ """
+ return self.__session_index
+
+[docs] def get_session_expiration(self):
+ """
+ Returns the SessionNotOnOrAfter from the AuthnStatement.
+ :returns: The SessionNotOnOrAfter of the assertion
+ :rtype: unix/posix timestamp|None
+ """
+ return self.__session_expiration
+
+[docs] def get_last_assertion_not_on_or_after(self):
+ """
+ The NotOnOrAfter value of the valid SubjectConfirmationData node
+ (if any) of the last assertion processed
+ """
+ return self.__last_assertion_not_on_or_after
+
+[docs] def get_errors(self):
+ """
+ Returns a list with code errors if something went wrong
+
+ :returns: List of errors
+ :rtype: list
+ """
+ return self.__errors
+
+[docs] def get_last_error_reason(self):
+ """
+ Returns the reason for the last error
+
+ :returns: Reason of the last error
+ :rtype: None | string
+ """
+ return self.__error_reason
+
+[docs] def get_attribute(self, name):
+ """
+ Returns the requested SAML attribute.
+
+ :param name: Name of the attribute
+ :type name: string
+
+ :returns: Attribute value(s) if exists or None
+ :rtype: list
+ """
+ assert isinstance(name, basestring)
+ value = None
+ if self.__attributes and name in self.__attributes.keys():
+ value = self.__attributes[name]
+ return value
+
+[docs] def get_friendlyname_attribute(self, friendlyname):
+ """
+ Returns the requested SAML attribute searched by FriendlyName.
+
+ :param friendlyname: FriendlyName of the attribute
+ :type friendlyname: string
+
+ :returns: Attribute value(s) if exists or None
+ :rtype: list
+ """
+ assert isinstance(friendlyname, basestring)
+ value = None
+ if self.__friendlyname_attributes and friendlyname in self.__friendlyname_attributes.keys():
+ value = self.__friendlyname_attributes[friendlyname]
+ return value
+
+[docs] def get_last_request_id(self):
+ """
+ :returns: The ID of the last Request SAML message generated.
+ :rtype: string
+ """
+ return self.__last_request_id
+
+[docs] def get_last_message_id(self):
+ """
+ :returns: The ID of the last Response SAML message processed.
+ :rtype: string
+ """
+ return self.__last_message_id
+
+[docs] def get_last_assertion_id(self):
+ """
+ :returns: The ID of the last assertion processed.
+ :rtype: string
+ """
+ return self.__last_assertion_id
+
+[docs] def login(self, return_to=None, force_authn=False, is_passive=False, set_nameid_policy=True, name_id_value_req=None):
+ """
+ Initiates the SSO process.
+
+ :param return_to: Optional argument. The target URL the user should be redirected to after login.
+ :type return_to: string
+
+ :param force_authn: Optional argument. When true the AuthNRequest will set the ForceAuthn='true'.
+ :type force_authn: bool
+
+ :param is_passive: Optional argument. When true the AuthNRequest will set the Ispassive='true'.
+ :type is_passive: bool
+
+ :param set_nameid_policy: Optional argument. When true the AuthNRequest will set a nameIdPolicy element.
+ :type set_nameid_policy: bool
+
+ :param name_id_value_req: Optional argument. Indicates to the IdP the subject that should be authenticated
+ :type name_id_value_req: string
+
+ :returns: Redirection URL
+ :rtype: string
+ """
+ authn_request = OneLogin_Saml2_Authn_Request(self.__settings, force_authn, is_passive, set_nameid_policy, name_id_value_req)
+ self.__last_request = authn_request.get_xml()
+ self.__last_request_id = authn_request.get_id()
+ saml_request = authn_request.get_request()
+
+ parameters = {'SAMLRequest': saml_request}
+ if return_to is not None:
+ parameters['RelayState'] = return_to
+ else:
+ parameters['RelayState'] = OneLogin_Saml2_Utils.get_self_url_no_query(self.__request_data)
+
+ security = self.__settings.get_security_data()
+ if security.get('authnRequestsSigned', False):
+ parameters['SigAlg'] = security['signatureAlgorithm']
+ parameters['Signature'] = self.build_request_signature(saml_request, parameters['RelayState'], security['signatureAlgorithm'])
+ return self.redirect_to(self.get_sso_url(), parameters)
+
+[docs] def logout(self, return_to=None, name_id=None, session_index=None, nq=None, name_id_format=None, spnq=None):
+ """
+ Initiates the SLO process.
+
+ :param return_to: Optional argument. The target URL the user should be redirected to after logout.
+ :type return_to: string
+
+ :param name_id: The NameID that will be set in the LogoutRequest.
+ :type name_id: string
+
+ :param session_index: SessionIndex that identifies the session of the user.
+ :type session_index: string
+
+ :param nq: IDP Name Qualifier
+ :type: string
+
+ :param name_id_format: The NameID Format that will be set in the LogoutRequest.
+ :type: string
+
+ :param spnq: SP Name Qualifier
+ :type: string
+
+ :returns: Redirection url
+ """
+ slo_url = self.get_slo_url()
+ if slo_url is None:
+ raise OneLogin_Saml2_Error(
+ 'The IdP does not support Single Log Out',
+ OneLogin_Saml2_Error.SAML_SINGLE_LOGOUT_NOT_SUPPORTED
+ )
+
+ if name_id is None and self.__nameid is not None:
+ name_id = self.__nameid
+ if name_id_format is None and self.__nameid_format is not None:
+ name_id_format = self.__nameid_format
+
+ logout_request = OneLogin_Saml2_Logout_Request(
+ self.__settings,
+ name_id=name_id,
+ session_index=session_index,
+ nq=nq,
+ name_id_format=name_id_format,
+ spnq=spnq
+ )
+ self.__last_request = logout_request.get_xml()
+ self.__last_request_id = logout_request.id
+ saml_request = logout_request.get_request()
+
+ parameters = {'SAMLRequest': logout_request.get_request()}
+ if return_to is not None:
+ parameters['RelayState'] = return_to
+ else:
+ parameters['RelayState'] = OneLogin_Saml2_Utils.get_self_url_no_query(self.__request_data)
+
+ security = self.__settings.get_security_data()
+ if security.get('logoutRequestSigned', False):
+ parameters['SigAlg'] = security['signatureAlgorithm']
+ parameters['Signature'] = self.build_request_signature(saml_request, parameters['RelayState'], security['signatureAlgorithm'])
+ return self.redirect_to(slo_url, parameters)
+
+[docs] def get_sso_url(self):
+ """
+ Gets the IdP SSO URL.
+
+ :returns: An URL, the SSO endpoint of the IdP
+ :rtype: string
+ """
+ return self.__settings.get_idp_sso_url()
+
+[docs] def get_slo_url(self):
+ """
+ Gets the IdP SLO URL.
+
+ :returns: An URL, the SLO endpoint of the IdP
+ :rtype: string
+ """
+ return self.__settings.get_idp_slo_url()
+
+[docs] def get_slo_response_url(self):
+ """
+ Gets the SLO return URL for IdP-initiated logout.
+
+ :returns: an URL, the SLO return endpoint of the IdP
+ :rtype: string
+ """
+ return self.__settings.get_idp_slo_response_url()
+
+[docs] def build_request_signature(self, saml_request, relay_state, sign_algorithm=OneLogin_Saml2_Constants.RSA_SHA1):
+ """
+ Builds the Signature of the SAML Request.
+
+ :param saml_request: The SAML Request
+ :type saml_request: string
+
+ :param relay_state: The target URL the user should be redirected to
+ :type relay_state: string
+
+ :param sign_algorithm: Signature algorithm method
+ :type sign_algorithm: string
+ """
+ return self.__build_signature(saml_request, relay_state, 'SAMLRequest', sign_algorithm)
+
+[docs] def build_response_signature(self, saml_response, relay_state, sign_algorithm=OneLogin_Saml2_Constants.RSA_SHA1):
+ """
+ Builds the Signature of the SAML Response.
+ :param saml_request: The SAML Response
+ :type saml_request: string
+
+ :param relay_state: The target URL the user should be redirected to
+ :type relay_state: string
+
+ :param sign_algorithm: Signature algorithm method
+ :type sign_algorithm: string
+ """
+ return self.__build_signature(saml_response, relay_state, 'SAMLResponse', sign_algorithm)
+
+ def __build_signature(self, saml_data, relay_state, saml_type, sign_algorithm=OneLogin_Saml2_Constants.RSA_SHA1):
+ """
+ Builds the Signature
+ :param saml_data: The SAML Data
+ :type saml_data: string
+
+ :param relay_state: The target URL the user should be redirected to
+ :type relay_state: string
+
+ :param saml_type: The target URL the user should be redirected to
+ :type saml_type: string SAMLRequest | SAMLResponse
+
+ :param sign_algorithm: Signature algorithm method
+ :type sign_algorithm: string
+ """
+ assert saml_type in ['SAMLRequest', 'SAMLResponse']
+
+ # Load the key into the xmlsec context
+ key = self.__settings.get_sp_key()
+
+ if not key:
+ raise OneLogin_Saml2_Error(
+ "Trying to sign the %s but can't load the SP private key" % saml_type,
+ OneLogin_Saml2_Error.PRIVATE_KEY_NOT_FOUND
+ )
+
+ dsig_ctx = xmlsec.DSigCtx()
+ dsig_ctx.signKey = xmlsec.Key.loadMemory(key, xmlsec.KeyDataFormatPem, None)
+
+ msg = '%s=%s' % (saml_type, quote_plus(saml_data))
+ if relay_state is not None:
+ msg += '&RelayState=%s' % quote_plus(relay_state)
+ msg += '&SigAlg=%s' % quote_plus(sign_algorithm)
+
+ # Sign the metadata with our private key.
+ sign_algorithm_transform_map = {
+ OneLogin_Saml2_Constants.DSA_SHA1: xmlsec.TransformDsaSha1,
+ OneLogin_Saml2_Constants.RSA_SHA1: xmlsec.TransformRsaSha1,
+ OneLogin_Saml2_Constants.RSA_SHA256: xmlsec.TransformRsaSha256,
+ OneLogin_Saml2_Constants.RSA_SHA384: xmlsec.TransformRsaSha384,
+ OneLogin_Saml2_Constants.RSA_SHA512: xmlsec.TransformRsaSha512
+ }
+ sign_algorithm_transform = sign_algorithm_transform_map.get(sign_algorithm, xmlsec.TransformRsaSha1)
+
+ signature = dsig_ctx.signBinary(str(msg), sign_algorithm_transform)
+ return b64encode(signature)
+
+[docs] def get_last_response_xml(self, pretty_print_if_possible=False):
+ """
+ Retrieves the raw XML (decrypted) of the last SAML response,
+ or the last Logout Response generated or processed
+
+ :returns: SAML response XML
+ :rtype: string|None
+ """
+ response = None
+ if self.__last_response is not None:
+ if isinstance(self.__last_response, basestring):
+ response = self.__last_response
+ else:
+ response = tostring(self.__last_response, pretty_print=pretty_print_if_possible)
+ return response
+
+[docs] def get_last_request_xml(self):
+ """
+ Retrieves the raw XML sent in the last SAML request
+
+ :returns: SAML request XML
+ :rtype: string|None
+ """
+ return self.__last_request or None
+
+# -*- coding: utf-8 -*-
+
+""" OneLogin_Saml2_Authn_Request class
+
+MIT License
+
+AuthNRequest class of Python Toolkit.
+
+"""
+from base64 import b64encode
+
+from onelogin.saml2.constants import OneLogin_Saml2_Constants
+from onelogin.saml2.utils import OneLogin_Saml2_Utils
+
+
+[docs]class OneLogin_Saml2_Authn_Request(object):
+ """
+
+ This class handles an AuthNRequest. It builds an
+ AuthNRequest object.
+
+ """
+
+ def __init__(self, settings, force_authn=False, is_passive=False, set_nameid_policy=True, name_id_value_req=None):
+ """
+ Constructs the AuthnRequest object.
+
+ :param settings: OSetting data
+ :type settings: OneLogin_Saml2_Settings
+
+ :param force_authn: Optional argument. When true the AuthNRequest will set the ForceAuthn='true'.
+ :type force_authn: bool
+
+ :param is_passive: Optional argument. When true the AuthNRequest will set the Ispassive='true'.
+ :type is_passive: bool
+
+ :param set_nameid_policy: Optional argument. When true the AuthNRequest will set a nameIdPolicy element.
+ :type set_nameid_policy: bool
+
+ :param name_id_value_req: Optional argument. Indicates to the IdP the subject that should be authenticated
+ :type name_id_value_req: string
+ """
+ self.__settings = settings
+
+ sp_data = self.__settings.get_sp_data()
+ idp_data = self.__settings.get_idp_data()
+ security = self.__settings.get_security_data()
+
+ uid = OneLogin_Saml2_Utils.generate_unique_id()
+ self.__id = uid
+ issue_instant = OneLogin_Saml2_Utils.parse_time_to_SAML(OneLogin_Saml2_Utils.now())
+
+ destination = idp_data['singleSignOnService']['url']
+
+ provider_name_str = ''
+ organization_data = settings.get_organization()
+ if isinstance(organization_data, dict) and organization_data:
+ langs = organization_data.keys()
+ if 'en-US' in langs:
+ lang = 'en-US'
+ else:
+ lang = langs[0]
+ if 'displayname' in organization_data[lang] and organization_data[lang]['displayname'] is not None:
+ provider_name_str = "\n" + ' ProviderName="%s"' % organization_data[lang]['displayname']
+
+ force_authn_str = ''
+ if force_authn is True:
+ force_authn_str = "\n" + ' ForceAuthn="true"'
+
+ is_passive_str = ''
+ if is_passive is True:
+ is_passive_str = "\n" + ' IsPassive="true"'
+
+ subject_str = ''
+ if name_id_value_req:
+ subject_str = """
+ <saml:Subject>
+ <saml:NameID Format="%s">%s</saml:NameID>
+ <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></saml:SubjectConfirmation>
+ </saml:Subject>""" % (sp_data['NameIDFormat'], name_id_value_req)
+
+ nameid_policy_str = ''
+ if set_nameid_policy:
+ name_id_policy_format = sp_data['NameIDFormat']
+ if 'wantNameIdEncrypted' in security and security['wantNameIdEncrypted']:
+ name_id_policy_format = OneLogin_Saml2_Constants.NAMEID_ENCRYPTED
+
+ nameid_policy_str = """
+ <samlp:NameIDPolicy
+ Format="%s"
+ AllowCreate="true" />""" % name_id_policy_format
+
+ requested_authn_context_str = ''
+ if 'requestedAuthnContext' in security.keys() and security['requestedAuthnContext'] is not False:
+ authn_comparison = security['requestedAuthnContextComparison']
+
+ if security['requestedAuthnContext'] is True:
+ requested_authn_context_str = "\n" + """ <samlp:RequestedAuthnContext Comparison="%s">
+ <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
+ </samlp:RequestedAuthnContext>""" % authn_comparison
+ else:
+ requested_authn_context_str = "\n" + ' <samlp:RequestedAuthnContext Comparison="%s">' % authn_comparison
+ for authn_context in security['requestedAuthnContext']:
+ requested_authn_context_str += '<saml:AuthnContextClassRef>%s</saml:AuthnContextClassRef>' % authn_context
+ requested_authn_context_str += ' </samlp:RequestedAuthnContext>'
+
+ attr_consuming_service_str = ''
+ if 'attributeConsumingService' in sp_data and sp_data['attributeConsumingService']:
+ attr_consuming_service_str = 'AttributeConsumingServiceIndex="1"'
+
+ request = """<samlp:AuthnRequest
+ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
+ xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+ ID="%(id)s"
+ Version="2.0"%(provider_name)s%(force_authn_str)s%(is_passive_str)s
+ IssueInstant="%(issue_instant)s"
+ Destination="%(destination)s"
+ ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+ AssertionConsumerServiceURL="%(assertion_url)s"
+ %(attr_consuming_service_str)s>
+ <saml:Issuer>%(entity_id)s</saml:Issuer>%(subject_str)s%(nameid_policy_str)s%(requested_authn_context_str)s
+</samlp:AuthnRequest>""" % \
+ {
+ 'id': uid,
+ 'provider_name': provider_name_str,
+ 'force_authn_str': force_authn_str,
+ 'is_passive_str': is_passive_str,
+ 'issue_instant': issue_instant,
+ 'destination': destination,
+ 'assertion_url': sp_data['assertionConsumerService']['url'],
+ 'entity_id': sp_data['entityId'],
+ 'subject_str': subject_str,
+ 'nameid_policy_str': nameid_policy_str,
+ 'requested_authn_context_str': requested_authn_context_str,
+ 'attr_consuming_service_str': attr_consuming_service_str
+ }
+
+ self.__authn_request = request
+
+[docs] def get_request(self, deflate=True):
+ """
+ Returns unsigned AuthnRequest.
+ :param deflate: It makes the deflate process optional
+ :type: bool
+ :return: AuthnRequest maybe deflated and base64 encoded
+ :rtype: str object
+ """
+ if deflate:
+ request = OneLogin_Saml2_Utils.deflate_and_base64_encode(self.__authn_request)
+ else:
+ request = b64encode(self.__authn_request)
+ return request
+
+[docs] def get_id(self):
+ """
+ Returns the AuthNRequest ID.
+ :return: AuthNRequest ID
+ :rtype: string
+ """
+ return self.__id
+
+[docs] def get_xml(self):
+ """
+ Returns the XML that will be sent as part of the request
+ :return: XML request body
+ :rtype: string
+ """
+ return self.__authn_request
+
+# -*- coding: utf-8 -*-
+
+""" OneLogin_Saml2_Constants class
+
+MIT License
+
+Constants class of Python Toolkit.
+
+"""
+
+
+[docs]class OneLogin_Saml2_Constants(object):
+ """
+
+ This class defines all the constants that will be used
+ in the Python Toolkit.
+
+ """
+
+ # Value added to the current time in time condition validations
+ ALLOWED_CLOCK_DRIFT = 300
+
+ XML = 'http://www.w3.org/XML/1998/namespace'
+ XSI = 'http://www.w3.org/2001/XMLSchema-instance'
+
+ # NameID Formats
+ NAMEID_EMAIL_ADDRESS = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
+ NAMEID_X509_SUBJECT_NAME = 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName'
+ NAMEID_WINDOWS_DOMAIN_QUALIFIED_NAME = 'urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName'
+ NAMEID_UNSPECIFIED = 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'
+ NAMEID_KERBEROS = 'urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos'
+ NAMEID_ENTITY = 'urn:oasis:names:tc:SAML:2.0:nameid-format:entity'
+ NAMEID_TRANSIENT = 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
+ NAMEID_PERSISTENT = 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
+ NAMEID_ENCRYPTED = 'urn:oasis:names:tc:SAML:2.0:nameid-format:encrypted'
+
+ # Attribute Name Formats
+ ATTRNAME_FORMAT_UNSPECIFIED = 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified'
+ ATTRNAME_FORMAT_URI = 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
+ ATTRNAME_FORMAT_BASIC = 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
+
+ # Namespaces
+ NS_SAML = 'urn:oasis:names:tc:SAML:2.0:assertion'
+ NS_SAMLP = 'urn:oasis:names:tc:SAML:2.0:protocol'
+ NS_SOAP = 'http://schemas.xmlsoap.org/soap/envelope/'
+ NS_MD = 'urn:oasis:names:tc:SAML:2.0:metadata'
+ NS_XS = 'http://www.w3.org/2001/XMLSchema'
+ NS_XSI = 'http://www.w3.org/2001/XMLSchema-instance'
+ NS_XENC = 'http://www.w3.org/2001/04/xmlenc#'
+ NS_DS = 'http://www.w3.org/2000/09/xmldsig#'
+
+ # Namespace Prefixes
+ NS_PREFIX_SAML = 'saml'
+ NS_PREFIX_SAMLP = 'samlp'
+ NS_PREFIX_MD = 'md'
+ NS_PREFIX_XS = 'xs'
+ NS_PREFIX_XSI = 'xsi'
+ NS_PREFIX_XENC = 'xenc'
+ NS_PREFIX_DS = 'ds'
+
+ # Prefix:Namespace Mappings
+ NSMAP = {
+ NS_PREFIX_SAMLP: NS_SAMLP,
+ NS_PREFIX_SAML: NS_SAML,
+ NS_PREFIX_DS: NS_DS,
+ NS_PREFIX_XENC: NS_XENC,
+ NS_PREFIX_MD: NS_MD
+ }
+
+ # Bindings
+ BINDING_HTTP_POST = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
+ BINDING_HTTP_REDIRECT = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
+ BINDING_HTTP_ARTIFACT = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact'
+ BINDING_SOAP = 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP'
+ BINDING_DEFLATE = 'urn:oasis:names:tc:SAML:2.0:bindings:URL-Encoding:DEFLATE'
+
+ # Auth Context Class
+ AC_UNSPECIFIED = 'urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified'
+ AC_PASSWORD = 'urn:oasis:names:tc:SAML:2.0:ac:classes:Password'
+ AC_PASSWORD_PROTECTED = 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
+ AC_X509 = 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509'
+ AC_SMARTCARD = 'urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard'
+ AC_KERBEROS = 'urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos'
+
+ # Subject Confirmation
+ CM_BEARER = 'urn:oasis:names:tc:SAML:2.0:cm:bearer'
+ CM_HOLDER_KEY = 'urn:oasis:names:tc:SAML:2.0:cm:holder-of-key'
+ CM_SENDER_VOUCHES = 'urn:oasis:names:tc:SAML:2.0:cm:sender-vouches'
+
+ # Status Codes
+ STATUS_SUCCESS = 'urn:oasis:names:tc:SAML:2.0:status:Success'
+ STATUS_REQUESTER = 'urn:oasis:names:tc:SAML:2.0:status:Requester'
+ STATUS_RESPONDER = 'urn:oasis:names:tc:SAML:2.0:status:Responder'
+ STATUS_VERSION_MISMATCH = 'urn:oasis:names:tc:SAML:2.0:status:VersionMismatch'
+ STATUS_NO_PASSIVE = 'urn:oasis:names:tc:SAML:2.0:status:NoPassive'
+ STATUS_PARTIAL_LOGOUT = 'urn:oasis:names:tc:SAML:2.0:status:PartialLogout'
+ STATUS_PROXY_COUNT_EXCEEDED = 'urn:oasis:names:tc:SAML:2.0:status:ProxyCountExceeded'
+
+ # Sign & Crypto
+ SHA1 = 'http://www.w3.org/2000/09/xmldsig#sha1'
+ SHA256 = 'http://www.w3.org/2001/04/xmlenc#sha256'
+ SHA384 = 'http://www.w3.org/2001/04/xmldsig-more#sha384'
+ SHA512 = 'http://www.w3.org/2001/04/xmlenc#sha512'
+
+ DSA_SHA1 = 'http://www.w3.org/2000/09/xmldsig#dsa-sha1'
+ RSA_SHA1 = 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'
+ RSA_SHA256 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
+ RSA_SHA384 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384'
+ RSA_SHA512 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'
+
+ # Enc
+ TRIPLEDES_CBC = 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc'
+ AES128_CBC = 'http://www.w3.org/2001/04/xmlenc#aes128-cbc'
+ AES192_CBC = 'http://www.w3.org/2001/04/xmlenc#aes192-cbc'
+ AES256_CBC = 'http://www.w3.org/2001/04/xmlenc#aes256-cbc'
+ RSA_1_5 = 'http://www.w3.org/2001/04/xmlenc#rsa-1_5'
+ RSA_OAEP_MGF1P = 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p'
+
+ # Define here the deprecated algorithms
+ DEPRECATED_ALGORITHMS = [DSA_SHA1, RSA_SHA1, SHA1]
+
+# -*- coding: utf-8 -*-
+
+""" OneLogin_Saml2_Error class
+
+MIT License
+
+Error class of Python Toolkit.
+
+Defines common Error codes and has a custom initializator.
+
+"""
+
+
+[docs]class OneLogin_Saml2_Error(Exception):
+ """
+
+ This class implements a custom Exception handler.
+ Defines custom error codes.
+
+ """
+
+ # Errors
+ SETTINGS_FILE_NOT_FOUND = 0
+ SETTINGS_INVALID_SYNTAX = 1
+ SETTINGS_INVALID = 2
+ METADATA_SP_INVALID = 3
+ # SP_CERTS_NOT_FOUND is deprecated, use CERT_NOT_FOUND instead
+ SP_CERTS_NOT_FOUND = 4
+ CERT_NOT_FOUND = 4
+ REDIRECT_INVALID_URL = 5
+ PUBLIC_CERT_FILE_NOT_FOUND = 6
+ PRIVATE_KEY_FILE_NOT_FOUND = 7
+ SAML_RESPONSE_NOT_FOUND = 8
+ SAML_LOGOUTMESSAGE_NOT_FOUND = 9
+ SAML_LOGOUTREQUEST_INVALID = 10
+ SAML_LOGOUTRESPONSE_INVALID = 11
+ SAML_SINGLE_LOGOUT_NOT_SUPPORTED = 12
+ PRIVATE_KEY_NOT_FOUND = 13
+ UNSUPPORTED_SETTINGS_OBJECT = 14
+
+ def __init__(self, message, code=0, errors=None):
+ """
+ Initializes the Exception instance.
+
+ Arguments are:
+ * (str) message. Describes the error.
+ * (int) code. The code error (defined in the error class).
+ """
+ assert isinstance(message, basestring)
+ assert isinstance(code, int)
+
+ if errors is not None:
+ message = message % errors
+
+ Exception.__init__(self, message)
+ self.code = code
+
+
+[docs]class OneLogin_Saml2_ValidationError(Exception):
+ """
+
+ This class implements another custom Exception handler, related
+ to exceptions that happens during validation process.
+ Defines custom error codes .
+
+ """
+
+ # Validation Errors
+ UNSUPPORTED_SAML_VERSION = 0
+ MISSING_ID = 1
+ WRONG_NUMBER_OF_ASSERTIONS = 2
+ MISSING_STATUS = 3
+ MISSING_STATUS_CODE = 4
+ STATUS_CODE_IS_NOT_SUCCESS = 5
+ WRONG_SIGNED_ELEMENT = 6
+ ID_NOT_FOUND_IN_SIGNED_ELEMENT = 7
+ DUPLICATED_ID_IN_SIGNED_ELEMENTS = 8
+ INVALID_SIGNED_ELEMENT = 9
+ DUPLICATED_REFERENCE_IN_SIGNED_ELEMENTS = 10
+ UNEXPECTED_SIGNED_ELEMENTS = 11
+ WRONG_NUMBER_OF_SIGNATURES_IN_RESPONSE = 12
+ WRONG_NUMBER_OF_SIGNATURES_IN_ASSERTION = 13
+ INVALID_XML_FORMAT = 14
+ WRONG_INRESPONSETO = 15
+ NO_ENCRYPTED_ASSERTION = 16
+ NO_ENCRYPTED_NAMEID = 17
+ MISSING_CONDITIONS = 18
+ ASSERTION_TOO_EARLY = 19
+ ASSERTION_EXPIRED = 20
+ WRONG_NUMBER_OF_AUTHSTATEMENTS = 21
+ NO_ATTRIBUTESTATEMENT = 22
+ ENCRYPTED_ATTRIBUTES = 23
+ WRONG_DESTINATION = 24
+ EMPTY_DESTINATION = 25
+ WRONG_AUDIENCE = 26
+ ISSUER_MULTIPLE_IN_RESPONSE = 27
+ ISSUER_NOT_FOUND_IN_ASSERTION = 28
+ WRONG_ISSUER = 29
+ SESSION_EXPIRED = 30
+ WRONG_SUBJECTCONFIRMATION = 31
+ NO_SIGNED_MESSAGE = 32
+ NO_SIGNED_ASSERTION = 33
+ NO_SIGNATURE_FOUND = 34
+ KEYINFO_NOT_FOUND_IN_ENCRYPTED_DATA = 35
+ CHILDREN_NODE_NOT_FOUND_IN_KEYINFO = 36
+ UNSUPPORTED_RETRIEVAL_METHOD = 37
+ NO_NAMEID = 38
+ EMPTY_NAMEID = 39
+ SP_NAME_QUALIFIER_NAME_MISMATCH = 40
+ DUPLICATED_ATTRIBUTE_NAME_FOUND = 41
+ INVALID_SIGNATURE = 42
+ WRONG_NUMBER_OF_SIGNATURES = 43
+ RESPONSE_EXPIRED = 44
+ AUTHN_CONTEXT_MISMATCH = 45
+ DEPRECATED_SIGNATURE_METHOD = 46
+ DEPRECATED_DIGEST_METHOD = 47
+
+ def __init__(self, message, code=0, errors=None):
+ """
+ Initializes the Exception instance.
+
+ Arguments are:
+ * (str) message. Describes the error.
+ * (int) code. The code error (defined in the error class).
+ """
+ assert isinstance(message, basestring)
+ assert isinstance(code, int)
+
+ if errors is not None:
+ message = message % errors
+
+ Exception.__init__(self, message)
+ self.code = code
+
+# -*- coding: utf-8 -*-
+
+""" OneLogin_Saml2_IdPMetadataParser class
+
+MIT License
+
+Metadata class of Python Toolkit.
+
+"""
+
+import urllib2
+import ssl
+
+from copy import deepcopy
+
+from onelogin.saml2.constants import OneLogin_Saml2_Constants
+from onelogin.saml2.utils import OneLogin_Saml2_Utils
+from onelogin.saml2.xmlparser import fromstring
+
+
+[docs]class OneLogin_Saml2_IdPMetadataParser(object):
+ """
+ A class that contain methods related to obtaining and parsing metadata from IdP
+
+ This class does not validate in any way the URL that is introduced,
+ make sure to validate it properly before use it in a get_metadata method.
+ """
+
+[docs] @staticmethod
+ def get_metadata(url, validate_cert=True):
+ """
+ Gets the metadata XML from the provided URL
+
+ :param url: Url where the XML of the Identity Provider Metadata is published.
+ :type url: string
+
+ :param validate_cert: If the url uses https schema, that flag enables or not the verification of the associated certificate.
+ :type validate_cert: bool
+
+ :returns: metadata XML
+ :rtype: string
+ """
+ valid = False
+ if validate_cert:
+ response = urllib2.urlopen(url)
+ else:
+ ctx = ssl.create_default_context()
+ ctx.check_hostname = False
+ ctx.verify_mode = ssl.CERT_NONE
+ response = urllib2.urlopen(url, context=ctx)
+ xml = response.read()
+
+ if xml:
+ try:
+ dom = fromstring(xml, forbid_dtd=True)
+ idp_descriptor_nodes = OneLogin_Saml2_Utils.query(dom, '//md:IDPSSODescriptor')
+ if idp_descriptor_nodes:
+ valid = True
+ except Exception:
+ pass
+
+ if not valid:
+ raise Exception('Not valid IdP XML found from URL: %s' % (url))
+
+ return xml
+
+[docs] @staticmethod
+ def parse_remote(url, validate_cert=True, entity_id=None, **kwargs):
+ """
+ Gets the metadata XML from the provided URL and parse it, returning a dict with extracted data
+
+ :param url: Url where the XML of the Identity Provider Metadata is published.
+ :type url: string
+
+ :param validate_cert: If the url uses https schema, that flag enables or not the verification of the associated certificate.
+ :type validate_cert: bool
+
+ :param entity_id: Specify the entity_id of the EntityDescriptor that you want to parse a XML
+ that contains multiple EntityDescriptor.
+ :type entity_id: string
+
+ :returns: settings dict with extracted data
+ :rtype: dict
+ """
+ idp_metadata = OneLogin_Saml2_IdPMetadataParser.get_metadata(url, validate_cert)
+ return OneLogin_Saml2_IdPMetadataParser.parse(idp_metadata, entity_id=entity_id, **kwargs)
+
+[docs] @staticmethod
+ def parse(
+ idp_metadata,
+ required_sso_binding=OneLogin_Saml2_Constants.BINDING_HTTP_REDIRECT,
+ required_slo_binding=OneLogin_Saml2_Constants.BINDING_HTTP_REDIRECT,
+ entity_id=None):
+ """
+ Parse the Identity Provider metadata and return a dict with extracted data.
+
+ If there are multiple <IDPSSODescriptor> tags, parse only the first.
+
+ Parse only those SSO endpoints with the same binding as given by
+ the `required_sso_binding` parameter.
+
+ Parse only those SLO endpoints with the same binding as given by
+ the `required_slo_binding` parameter.
+
+ If the metadata specifies multiple SSO endpoints with the required
+ binding, extract only the first (the same holds true for SLO
+ endpoints).
+
+ :param idp_metadata: XML of the Identity Provider Metadata.
+ :type idp_metadata: string
+
+ :param required_sso_binding: Parse only POST or REDIRECT SSO endpoints.
+ :type required_sso_binding: one of OneLogin_Saml2_Constants.BINDING_HTTP_REDIRECT
+ or OneLogin_Saml2_Constants.BINDING_HTTP_POST
+
+ :param required_slo_binding: Parse only POST or REDIRECT SLO endpoints.
+ :type required_slo_binding: one of OneLogin_Saml2_Constants.BINDING_HTTP_REDIRECT
+ or OneLogin_Saml2_Constants.BINDING_HTTP_POST
+
+ :param entity_id: Specify the entity_id of the EntityDescriptor that you want to parse a XML
+ that contains multiple EntityDescriptor.
+ :type entity_id: string
+
+ :returns: settings dict with extracted data
+ :rtype: dict
+ """
+ data = {}
+
+ dom = fromstring(idp_metadata, forbid_dtd=True)
+
+ entity_desc_path = '//md:EntityDescriptor'
+ if entity_id:
+ entity_desc_path += "[@entityID='%s']" % entity_id
+
+ entity_descriptor_nodes = OneLogin_Saml2_Utils.query(dom, entity_desc_path)
+
+ idp_entity_id = want_authn_requests_signed = idp_name_id_format = idp_sso_url = idp_slo_url = certs = None
+
+ if len(entity_descriptor_nodes) > 0:
+ entity_descriptor_node = entity_descriptor_nodes[0]
+ idp_descriptor_nodes = OneLogin_Saml2_Utils.query(entity_descriptor_node, './md:IDPSSODescriptor')
+ if len(idp_descriptor_nodes) > 0:
+ idp_descriptor_node = idp_descriptor_nodes[0]
+
+ idp_entity_id = entity_descriptor_node.get('entityID', None)
+
+ want_authn_requests_signed = entity_descriptor_node.get('WantAuthnRequestsSigned', None)
+
+ name_id_format_nodes = OneLogin_Saml2_Utils.query(idp_descriptor_node, './md:NameIDFormat')
+ if len(name_id_format_nodes) > 0:
+ idp_name_id_format = OneLogin_Saml2_Utils.element_text(name_id_format_nodes[0])
+
+ sso_nodes = OneLogin_Saml2_Utils.query(
+ idp_descriptor_node,
+ "./md:SingleSignOnService[@Binding='%s']" % required_sso_binding
+ )
+
+ if len(sso_nodes) > 0:
+ idp_sso_url = sso_nodes[0].get('Location', None)
+
+ slo_nodes = OneLogin_Saml2_Utils.query(
+ idp_descriptor_node,
+ "./md:SingleLogoutService[@Binding='%s']" % required_slo_binding
+ )
+ if len(slo_nodes) > 0:
+ idp_slo_url = slo_nodes[0].get('Location', None)
+
+ signing_nodes = OneLogin_Saml2_Utils.query(idp_descriptor_node, "./md:KeyDescriptor[not(contains(@use, 'encryption'))]/ds:KeyInfo/ds:X509Data/ds:X509Certificate")
+ encryption_nodes = OneLogin_Saml2_Utils.query(idp_descriptor_node, "./md:KeyDescriptor[not(contains(@use, 'signing'))]/ds:KeyInfo/ds:X509Data/ds:X509Certificate")
+
+ if len(signing_nodes) > 0 or len(encryption_nodes) > 0:
+ certs = {}
+ if len(signing_nodes) > 0:
+ certs['signing'] = []
+ for cert_node in signing_nodes:
+ certs['signing'].append(''.join(OneLogin_Saml2_Utils.element_text(cert_node).split()))
+ if len(encryption_nodes) > 0:
+ certs['encryption'] = []
+ for cert_node in encryption_nodes:
+ certs['encryption'].append(''.join(OneLogin_Saml2_Utils.element_text(cert_node).split()))
+
+ data['idp'] = {}
+
+ if idp_entity_id is not None:
+ data['idp']['entityId'] = idp_entity_id
+
+ if idp_sso_url is not None:
+ data['idp']['singleSignOnService'] = {}
+ data['idp']['singleSignOnService']['url'] = idp_sso_url
+ data['idp']['singleSignOnService']['binding'] = required_sso_binding
+
+ if idp_slo_url is not None:
+ data['idp']['singleLogoutService'] = {}
+ data['idp']['singleLogoutService']['url'] = idp_slo_url
+ data['idp']['singleLogoutService']['binding'] = required_slo_binding
+
+ if certs is not None:
+ if (len(certs) == 1 and
+ (('signing' in certs and len(certs['signing']) == 1) or
+ ('encryption' in certs and len(certs['encryption']) == 1))) or \
+ (('signing' in certs and len(certs['signing']) == 1) and
+ ('encryption' in certs and len(certs['encryption']) == 1 and
+ certs['signing'][0] == certs['encryption'][0])):
+ if 'signing' in certs:
+ data['idp']['x509cert'] = certs['signing'][0]
+ else:
+ data['idp']['x509cert'] = certs['encryption'][0]
+ else:
+ data['idp']['x509certMulti'] = certs
+
+ if want_authn_requests_signed is not None:
+ data['security'] = {}
+ data['security']['authnRequestsSigned'] = want_authn_requests_signed
+
+ if idp_name_id_format:
+ data['sp'] = {}
+ data['sp']['NameIDFormat'] = idp_name_id_format
+ return data
+
+[docs] @staticmethod
+ def merge_settings(settings, new_metadata_settings):
+ """
+ Will update the settings with the provided new settings data extracted from the IdP metadata
+
+ :param settings: Current settings dict data
+ :type settings: dict
+
+ :param new_metadata_settings: Settings to be merged (extracted from IdP metadata after parsing)
+ :type new_metadata_settings: dict
+
+ :returns: merged settings
+ :rtype: dict
+ """
+ for d in (settings, new_metadata_settings):
+ if not isinstance(d, dict):
+ raise TypeError('Both arguments must be dictionaries.')
+
+ # Guarantee to not modify original data (`settings.copy()` would not
+ # be sufficient, as it's just a shallow copy).
+ result_settings = deepcopy(settings)
+
+ # previously I will take care of cert stuff
+ if 'idp' in new_metadata_settings and 'idp' in result_settings:
+ if new_metadata_settings['idp'].get('x509cert', None) and result_settings['idp'].get('x509certMulti', None):
+ del result_settings['idp']['x509certMulti']
+ if new_metadata_settings['idp'].get('x509certMulti', None) and result_settings['idp'].get('x509cert', None):
+ del result_settings['idp']['x509cert']
+
+ # Merge `new_metadata_settings` into `result_settings`.
+ dict_deep_merge(result_settings, new_metadata_settings)
+ return result_settings
+
+
+[docs]def dict_deep_merge(lhs, rhs):
+ """Deep-merge dictionary `rhs` into dictionary `lhs`."""
+ updated_rhs = {}
+ for key in rhs:
+ if key in lhs and isinstance(lhs[key], dict) and isinstance(rhs[key], dict):
+ updated_rhs[key] = dict_deep_merge(lhs[key], rhs[key])
+ else:
+ updated_rhs[key] = rhs[key]
+ lhs.update(updated_rhs)
+ return lhs
+
+# -*- coding: utf-8 -*-
+
+""" OneLogin_Saml2_Logout_Request class
+
+MIT License
+
+Logout Request class of Python Toolkit.
+
+"""
+
+from zlib import decompress
+from base64 import b64encode, b64decode
+from lxml import etree
+from xml.dom.minidom import Document
+
+from onelogin.saml2.constants import OneLogin_Saml2_Constants
+from onelogin.saml2.errors import OneLogin_Saml2_Error, OneLogin_Saml2_ValidationError
+from onelogin.saml2.utils import OneLogin_Saml2_Utils
+from onelogin.saml2.xmlparser import fromstring
+
+
+[docs]class OneLogin_Saml2_Logout_Request(object):
+ """
+
+ This class handles a Logout Request.
+
+ Builds a Logout Response object and validates it.
+
+ """
+
+ def __init__(self, settings, request=None, name_id=None, session_index=None, nq=None, name_id_format=None, spnq=None):
+ """
+ Constructs the Logout Request object.
+
+ :param settings: Setting data
+ :type request_data: OneLogin_Saml2_Settings
+
+ :param request: Optional. A LogoutRequest to be loaded instead build one.
+ :type request: string
+
+ :param name_id: The NameID that will be set in the LogoutRequest.
+ :type name_id: string
+
+ :param session_index: SessionIndex that identifies the session of the user.
+ :type session_index: string
+
+ :param nq: IDP Name Qualifier
+ :type: string
+
+ :param name_id_format: The NameID Format that will be set in the LogoutRequest.
+ :type: string
+
+ :param spnq: SP Name Qualifier
+ :type: string
+
+ """
+ self.__settings = settings
+ self.__error = None
+ self.id = None
+
+ if request is None:
+ sp_data = self.__settings.get_sp_data()
+ idp_data = self.__settings.get_idp_data()
+ security = self.__settings.get_security_data()
+
+ uid = OneLogin_Saml2_Utils.generate_unique_id()
+ self.id = uid
+
+ issue_instant = OneLogin_Saml2_Utils.parse_time_to_SAML(OneLogin_Saml2_Utils.now())
+
+ cert = None
+ if 'nameIdEncrypted' in security and security['nameIdEncrypted']:
+ exists_multix509enc = 'x509certMulti' in idp_data and \
+ 'encryption' in idp_data['x509certMulti'] and \
+ idp_data['x509certMulti']['encryption']
+ if exists_multix509enc:
+ cert = idp_data['x509certMulti']['encryption'][0]
+ else:
+ cert = idp_data['x509cert']
+
+ if name_id is not None:
+ if not name_id_format and sp_data['NameIDFormat'] != OneLogin_Saml2_Constants.NAMEID_UNSPECIFIED:
+ name_id_format = sp_data['NameIDFormat']
+ else:
+ name_id = idp_data['entityId']
+ name_id_format = OneLogin_Saml2_Constants.NAMEID_ENTITY
+
+ # From saml-core-2.0-os 8.3.6, when the entity Format is used:
+ # "The NameQualifier, SPNameQualifier, and SPProvidedID attributes
+ # MUST be omitted.
+ if name_id_format and name_id_format == OneLogin_Saml2_Constants.NAMEID_ENTITY:
+ nq = None
+ spnq = None
+
+ # NameID Format UNSPECIFIED omitted
+ if name_id_format and name_id_format == OneLogin_Saml2_Constants.NAMEID_UNSPECIFIED:
+ name_id_format = None
+
+ name_id_obj = OneLogin_Saml2_Utils.generate_name_id(
+ name_id,
+ spnq,
+ name_id_format,
+ cert,
+ False,
+ nq
+ )
+
+ if session_index:
+ session_index_str = '<samlp:SessionIndex>%s</samlp:SessionIndex>' % session_index
+ else:
+ session_index_str = ''
+
+ logout_request = """<samlp:LogoutRequest
+ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
+ xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+ ID="%(id)s"
+ Version="2.0"
+ IssueInstant="%(issue_instant)s"
+ Destination="%(single_logout_url)s">
+ <saml:Issuer>%(entity_id)s</saml:Issuer>
+ %(name_id)s
+ %(session_index)s
+ </samlp:LogoutRequest>""" % \
+ {
+ 'id': uid,
+ 'issue_instant': issue_instant,
+ 'single_logout_url': self.__settings.get_idp_slo_url(),
+ 'entity_id': sp_data['entityId'],
+ 'name_id': name_id_obj,
+ 'session_index': session_index_str,
+ }
+ else:
+ decoded = b64decode(request)
+ # We try to inflate
+ try:
+ inflated = decompress(decoded, -15)
+ logout_request = inflated
+ except Exception:
+ logout_request = decoded
+ self.id = self.get_id(logout_request)
+
+ self.__logout_request = logout_request
+
+[docs] def get_request(self, deflate=True):
+ """
+ Returns the Logout Request deflated, base64encoded
+ :param deflate: It makes the deflate process optional
+ :type: bool
+ :return: Logout Request maybe deflated and base64 encoded
+ :rtype: str object
+ """
+ if deflate:
+ request = OneLogin_Saml2_Utils.deflate_and_base64_encode(self.__logout_request)
+ else:
+ request = b64encode(self.__logout_request)
+ return request
+
+[docs] def get_xml(self):
+ """
+ Returns the XML that will be sent as part of the request
+ or that was received at the SP
+ :return: XML request body
+ :rtype: string
+ """
+ return self.__logout_request
+
+[docs] @staticmethod
+ def get_id(request):
+ """
+ Returns the ID of the Logout Request
+ :param request: Logout Request Message
+ :type request: string|DOMDocument
+ :return: string ID
+ :rtype: str object
+ """
+ if isinstance(request, etree._Element):
+ elem = request
+ else:
+ if isinstance(request, Document):
+ request = request.toxml()
+ elem = fromstring(request, forbid_dtd=True)
+ return elem.get('ID', None)
+
+[docs] @staticmethod
+ def get_nameid_data(request, key=None):
+ """
+ Gets the NameID Data of the the Logout Request
+ :param request: Logout Request Message
+ :type request: string|DOMDocument
+ :param key: The SP key
+ :type key: string
+ :return: Name ID Data (Value, Format, NameQualifier, SPNameQualifier)
+ :rtype: dict
+ """
+ if isinstance(request, etree._Element):
+ elem = request
+ else:
+ if isinstance(request, Document):
+ request = request.toxml()
+ elem = fromstring(request, forbid_dtd=True)
+
+ name_id = None
+ encrypted_entries = OneLogin_Saml2_Utils.query(elem, '/samlp:LogoutRequest/saml:EncryptedID')
+
+ if len(encrypted_entries) == 1:
+ if key is None:
+ raise OneLogin_Saml2_Error(
+ 'Private Key is required in order to decrypt the NameID, check settings',
+ OneLogin_Saml2_Error.PRIVATE_KEY_NOT_FOUND
+ )
+
+ encrypted_data_nodes = OneLogin_Saml2_Utils.query(elem, '/samlp:LogoutRequest/saml:EncryptedID/xenc:EncryptedData')
+ if len(encrypted_data_nodes) == 1:
+ encrypted_data = encrypted_data_nodes[0]
+ name_id = OneLogin_Saml2_Utils.decrypt_element(encrypted_data, key)
+ else:
+ entries = OneLogin_Saml2_Utils.query(elem, '/samlp:LogoutRequest/saml:NameID')
+ if len(entries) == 1:
+ name_id = entries[0]
+
+ if name_id is None:
+ raise OneLogin_Saml2_ValidationError(
+ 'NameID not found in the Logout Request',
+ OneLogin_Saml2_ValidationError.NO_NAMEID
+ )
+
+ name_id_data = {
+ 'Value': OneLogin_Saml2_Utils.element_text(name_id)
+ }
+ for attr in ['Format', 'SPNameQualifier', 'NameQualifier']:
+ if attr in name_id.attrib.keys():
+ name_id_data[attr] = name_id.attrib[attr]
+
+ return name_id_data
+
+[docs] @staticmethod
+ def get_nameid(request, key=None):
+ """
+ Gets the NameID of the Logout Request Message
+ :param request: Logout Request Message
+ :type request: string|DOMDocument
+ :param key: The SP key
+ :type key: string
+ :return: Name ID Value
+ :rtype: string
+ """
+ name_id = OneLogin_Saml2_Logout_Request.get_nameid_data(request, key)
+ return name_id['Value']
+
+[docs] @staticmethod
+ def get_nameid_format(request, key=None):
+ """
+ Gets the NameID Format of the Logout Request Message
+ :param request: Logout Request Message
+ :type request: string|DOMDocument
+ :param key: The SP key
+ :type key: string
+ :return: Name ID Value
+ :rtype: string
+ """
+ name_id_format = None
+ name_id_data = OneLogin_Saml2_Logout_Request.get_nameid_data(request, key)
+ if name_id_data and 'Format' in name_id_data.keys():
+ name_id_format = name_id_data['Format']
+ return name_id_format
+
+[docs] @staticmethod
+ def get_issuer(request):
+ """
+ Gets the Issuer of the Logout Request Message
+ :param request: Logout Request Message
+ :type request: string|DOMDocument
+ :return: The Issuer
+ :rtype: string
+ """
+ if isinstance(request, etree._Element):
+ elem = request
+ else:
+ if isinstance(request, Document):
+ request = request.toxml()
+ elem = fromstring(request, forbid_dtd=True)
+
+ issuer = None
+ issuer_nodes = OneLogin_Saml2_Utils.query(elem, '/samlp:LogoutRequest/saml:Issuer')
+ if len(issuer_nodes) == 1:
+ issuer = OneLogin_Saml2_Utils.element_text(issuer_nodes[0])
+ return issuer
+
+[docs] @staticmethod
+ def get_session_indexes(request):
+ """
+ Gets the SessionIndexes from the Logout Request
+ :param request: Logout Request Message
+ :type request: string|DOMDocument
+ :return: The SessionIndex value
+ :rtype: list
+ """
+ if isinstance(request, etree._Element):
+ elem = request
+ else:
+ if isinstance(request, Document):
+ request = request.toxml()
+ elem = fromstring(request, forbid_dtd=True)
+
+ session_indexes = []
+ session_index_nodes = OneLogin_Saml2_Utils.query(elem, '/samlp:LogoutRequest/samlp:SessionIndex')
+ for session_index_node in session_index_nodes:
+ session_indexes.append(OneLogin_Saml2_Utils.element_text(session_index_node))
+ return session_indexes
+
+[docs] def is_valid(self, request_data, raise_exceptions=False):
+ """
+ Checks if the Logout Request received is valid
+ :param request_data: Request Data
+ :type request_data: dict
+ :param raise_exceptions: Whether to return false on failure or raise an exception
+ :type raise_exceptions: Boolean
+ :return: If the Logout Request is or not valid
+ :rtype: boolean
+ """
+ self.__error = None
+ lowercase_urlencoding = False
+ try:
+ dom = fromstring(self.__logout_request, forbid_dtd=True)
+
+ idp_data = self.__settings.get_idp_data()
+ idp_entity_id = idp_data['entityId']
+
+ if 'get_data' in request_data.keys():
+ get_data = request_data['get_data']
+ else:
+ get_data = {}
+
+ if 'lowercase_urlencoding' in request_data.keys():
+ lowercase_urlencoding = request_data['lowercase_urlencoding']
+
+ security = self.__settings.get_security_data()
+ if self.__settings.is_strict():
+ res = OneLogin_Saml2_Utils.validate_xml(dom, 'saml-schema-protocol-2.0.xsd', self.__settings.is_debug_active())
+ if not isinstance(res, Document):
+ raise OneLogin_Saml2_ValidationError(
+ 'Invalid SAML Logout Request. Not match the saml-schema-protocol-2.0.xsd',
+ OneLogin_Saml2_ValidationError.INVALID_XML_FORMAT
+ )
+
+ current_url = OneLogin_Saml2_Utils.get_self_url_no_query(request_data)
+
+ # Check NotOnOrAfter
+ if dom.get('NotOnOrAfter', None):
+ na = OneLogin_Saml2_Utils.parse_SAML_to_time(dom.get('NotOnOrAfter'))
+ if na <= OneLogin_Saml2_Utils.now():
+ raise OneLogin_Saml2_ValidationError(
+ 'Could not validate timestamp: expired. Check system clock.',
+ OneLogin_Saml2_ValidationError.RESPONSE_EXPIRED
+ )
+
+ # Check destination
+ destination = dom.get('Destination')
+ if destination:
+ if not OneLogin_Saml2_Utils.normalize_url(url=destination).startswith(OneLogin_Saml2_Utils.normalize_url(url=current_url)):
+ raise Exception(
+ 'The LogoutRequest was received at '
+ '%(currentURL)s instead of %(destination)s' %
+ {
+ 'currentURL': current_url,
+ 'destination': destination,
+ },
+ OneLogin_Saml2_ValidationError.WRONG_DESTINATION
+ )
+
+ # Check issuer
+ issuer = OneLogin_Saml2_Logout_Request.get_issuer(dom)
+ if issuer is not None and issuer != idp_entity_id:
+ raise OneLogin_Saml2_ValidationError(
+ 'Invalid issuer in the Logout Request (expected %(idpEntityId)s, got %(issuer)s)' %
+ {
+ 'idpEntityId': idp_entity_id,
+ 'issuer': issuer
+ },
+ OneLogin_Saml2_ValidationError.WRONG_ISSUER
+ )
+
+ if security['wantMessagesSigned']:
+ if 'Signature' not in get_data:
+ raise OneLogin_Saml2_ValidationError(
+ 'The Message of the Logout Request is not signed and the SP require it',
+ OneLogin_Saml2_ValidationError.NO_SIGNED_MESSAGE
+ )
+
+ if 'Signature' in get_data:
+ if 'SigAlg' not in get_data:
+ sign_alg = OneLogin_Saml2_Constants.RSA_SHA1
+ else:
+ sign_alg = get_data['SigAlg']
+
+ reject_deprecated_alg = security.get('rejectDeprecatedAlgorithm', False)
+ if reject_deprecated_alg:
+ if sign_alg in OneLogin_Saml2_Constants.DEPRECATED_ALGORITHMS:
+ raise OneLogin_Saml2_ValidationError(
+ 'Deprecated signature algorithm found: %s' % sign_alg,
+ OneLogin_Saml2_ValidationError.DEPRECATED_SIGNATURE_METHOD
+ )
+
+ signed_query = 'SAMLRequest=%s' % OneLogin_Saml2_Utils.get_encoded_parameter(get_data, 'SAMLRequest', lowercase_urlencoding=lowercase_urlencoding)
+ if 'RelayState' in get_data:
+ signed_query = '%s&RelayState=%s' % (signed_query, OneLogin_Saml2_Utils.get_encoded_parameter(get_data, 'RelayState', lowercase_urlencoding=lowercase_urlencoding))
+ signed_query = '%s&SigAlg=%s' % (signed_query, OneLogin_Saml2_Utils.get_encoded_parameter(get_data, 'SigAlg', sign_alg, lowercase_urlencoding=lowercase_urlencoding))
+
+ exists_x509cert = 'x509cert' in idp_data and idp_data['x509cert']
+ exists_multix509sign = 'x509certMulti' in idp_data and \
+ 'signing' in idp_data['x509certMulti'] and \
+ idp_data['x509certMulti']['signing']
+
+ if not (exists_x509cert or exists_multix509sign):
+ raise OneLogin_Saml2_Error(
+ 'In order to validate the sign on the Logout Request, the x509cert of the IdP is required',
+ OneLogin_Saml2_Error.CERT_NOT_FOUND
+ )
+ if exists_multix509sign:
+ for cert in idp_data['x509certMulti']['signing']:
+ if OneLogin_Saml2_Utils.validate_binary_sign(signed_query, b64decode(get_data['Signature']), cert, sign_alg):
+ return True
+ raise OneLogin_Saml2_ValidationError(
+ 'Signature validation failed. Logout Request rejected',
+ OneLogin_Saml2_ValidationError.INVALID_SIGNATURE
+ )
+ else:
+ cert = idp_data['x509cert']
+
+ if not OneLogin_Saml2_Utils.validate_binary_sign(signed_query, b64decode(get_data['Signature']), cert, sign_alg):
+ raise OneLogin_Saml2_ValidationError(
+ 'Signature validation failed. Logout Request rejected',
+ OneLogin_Saml2_ValidationError.INVALID_SIGNATURE
+ )
+ return True
+ except Exception as err:
+ # pylint: disable=R0801sign_alg
+ self.__error = err.__str__()
+ debug = self.__settings.is_debug_active()
+ if debug:
+ print(err.__str__())
+ if raise_exceptions:
+ raise err
+ return False
+
+[docs] def get_error(self):
+ """
+ After executing a validation process, if it fails this method returns the cause
+ """
+ return self.__error
+
+# -*- coding: utf-8 -*-
+
+""" OneLogin_Saml2_Logout_Response class
+
+MIT License
+
+Logout Response class of Python Toolkit.
+
+"""
+
+from base64 import b64encode, b64decode
+from xml.dom.minidom import Document
+from defusedxml.minidom import parseString
+
+from onelogin.saml2.constants import OneLogin_Saml2_Constants
+from onelogin.saml2.errors import OneLogin_Saml2_Error, OneLogin_Saml2_ValidationError
+from onelogin.saml2.utils import OneLogin_Saml2_Utils
+from onelogin.saml2.xmlparser import fromstring
+
+
+[docs]class OneLogin_Saml2_Logout_Response(object):
+ """
+
+ This class handles a Logout Response. It Builds or parses a Logout Response object
+ and validates it.
+
+ """
+
+ def __init__(self, settings, response=None):
+ """
+ Constructs a Logout Response object (Initialize params from settings
+ and if provided load the Logout Response.
+
+ Arguments are:
+ * (OneLogin_Saml2_Settings) settings. Setting data
+ * (string) response. An UUEncoded SAML Logout
+ response from the IdP.
+ """
+ self.__settings = settings
+ self.__error = None
+ self.id = None
+
+ if response is not None:
+ self.__logout_response = OneLogin_Saml2_Utils.decode_base64_and_inflate(response)
+ self.document = parseString(self.__logout_response, forbid_dtd=True)
+ self.id = self.document.documentElement.getAttribute('ID')
+
+[docs] def get_issuer(self):
+ """
+ Gets the Issuer of the Logout Response Message
+ :return: The Issuer
+ :rtype: string
+ """
+ issuer = None
+ issuer_nodes = self.__query('/samlp:LogoutResponse/saml:Issuer')
+ if len(issuer_nodes) == 1:
+ issuer = OneLogin_Saml2_Utils.element_text(issuer_nodes[0])
+ return issuer
+
+[docs] def get_status(self):
+ """
+ Gets the Status
+ :return: The Status
+ :rtype: string
+ """
+ entries = self.__query('/samlp:LogoutResponse/samlp:Status/samlp:StatusCode')
+ if len(entries) == 0:
+ return None
+ status = entries[0].attrib['Value']
+ return status
+
+[docs] def is_valid(self, request_data, request_id=None, raise_exceptions=False):
+ """
+ Determines if the SAML LogoutResponse is valid
+ :param request_id: The ID of the LogoutRequest sent by this SP to the IdP
+ :type request_id: string
+ :param raise_exceptions: Whether to return false on failure or raise an exception
+ :type raise_exceptions: Boolean
+ :return: Returns if the SAML LogoutResponse is or not valid
+ :rtype: boolean
+ """
+ self.__error = None
+ lowercase_urlencoding = False
+ try:
+ idp_data = self.__settings.get_idp_data()
+ idp_entity_id = idp_data['entityId']
+ get_data = request_data['get_data']
+
+ if 'lowercase_urlencoding' in request_data.keys():
+ lowercase_urlencoding = request_data['lowercase_urlencoding']
+
+ security = self.__settings.get_security_data()
+ if self.__settings.is_strict():
+ res = OneLogin_Saml2_Utils.validate_xml(self.document, 'saml-schema-protocol-2.0.xsd', self.__settings.is_debug_active())
+ if not isinstance(res, Document):
+ raise OneLogin_Saml2_ValidationError(
+ 'Invalid SAML Logout Response. Not match the saml-schema-protocol-2.0.xsd',
+ OneLogin_Saml2_ValidationError.INVALID_XML_FORMAT
+ )
+
+ in_response_to = self.get_in_response_to()
+ # Check if the InResponseTo of the Logout Response matches the ID of the Logout Request (requestId) if provided
+ if request_id is not None and in_response_to and in_response_to != request_id:
+ raise OneLogin_Saml2_ValidationError(
+ 'The InResponseTo of the Logout Response: %s, does not match the ID of the Logout request sent by the SP: %s' % (in_response_to, request_id),
+ OneLogin_Saml2_ValidationError.WRONG_INRESPONSETO
+ )
+
+ # Check issuer
+ issuer = self.get_issuer()
+ if issuer is not None and issuer != idp_entity_id:
+ raise OneLogin_Saml2_ValidationError(
+ 'Invalid issuer in the Logout Response (expected %(idpEntityId)s, got %(issuer)s)' %
+ {
+ 'idpEntityId': idp_entity_id,
+ 'issuer': issuer
+ },
+ OneLogin_Saml2_ValidationError.WRONG_ISSUER
+ )
+
+ current_url = OneLogin_Saml2_Utils.get_self_url_no_query(request_data)
+
+ # Check destination
+ if self.document.documentElement.hasAttribute('Destination'):
+ destination = self.document.documentElement.getAttribute('Destination')
+ if destination:
+ if not OneLogin_Saml2_Utils.normalize_url(url=destination).startswith(OneLogin_Saml2_Utils.normalize_url(url=current_url)):
+ raise OneLogin_Saml2_ValidationError(
+ 'The LogoutResponse was received at %s instead of %s' % (current_url, destination),
+ OneLogin_Saml2_ValidationError.WRONG_DESTINATION
+ )
+
+ if security['wantMessagesSigned']:
+ if 'Signature' not in get_data:
+ raise OneLogin_Saml2_ValidationError(
+ 'The Message of the Logout Response is not signed and the SP require it',
+ OneLogin_Saml2_ValidationError.NO_SIGNED_MESSAGE
+ )
+
+ if 'Signature' in get_data:
+ if 'SigAlg' not in get_data:
+ sign_alg = OneLogin_Saml2_Constants.RSA_SHA1
+ else:
+ sign_alg = get_data['SigAlg']
+
+ reject_deprecated_alg = security.get('rejectDeprecatedAlgorithm', False)
+ if reject_deprecated_alg:
+ if sign_alg in OneLogin_Saml2_Constants.DEPRECATED_ALGORITHMS:
+ raise OneLogin_Saml2_ValidationError(
+ 'Deprecated signature algorithm found: %s' % sign_alg,
+ OneLogin_Saml2_ValidationError.DEPRECATED_SIGNATURE_METHOD
+ )
+
+ signed_query = 'SAMLResponse=%s' % OneLogin_Saml2_Utils.get_encoded_parameter(get_data, 'SAMLResponse', lowercase_urlencoding=lowercase_urlencoding)
+ if 'RelayState' in get_data:
+ signed_query = '%s&RelayState=%s' % (signed_query, OneLogin_Saml2_Utils.get_encoded_parameter(get_data, 'RelayState', lowercase_urlencoding=lowercase_urlencoding))
+ signed_query = '%s&SigAlg=%s' % (signed_query, OneLogin_Saml2_Utils.get_encoded_parameter(get_data, 'SigAlg', sign_alg, lowercase_urlencoding=lowercase_urlencoding))
+
+ exists_x509cert = 'x509cert' in idp_data and idp_data['x509cert']
+ exists_multix509sign = 'x509certMulti' in idp_data and \
+ 'signing' in idp_data['x509certMulti'] and \
+ idp_data['x509certMulti']['signing']
+
+ if not (exists_x509cert or exists_multix509sign):
+ raise OneLogin_Saml2_Error(
+ 'In order to validate the sign on the Logout Response, the x509cert of the IdP is required',
+ OneLogin_Saml2_Error.CERT_NOT_FOUND
+ )
+ if exists_multix509sign:
+ for cert in idp_data['x509certMulti']['signing']:
+ if OneLogin_Saml2_Utils.validate_binary_sign(signed_query, b64decode(get_data['Signature']), cert, sign_alg):
+ return True
+ raise OneLogin_Saml2_ValidationError(
+ 'Signature validation failed. Logout Response rejected',
+ OneLogin_Saml2_ValidationError.INVALID_SIGNATURE
+ )
+ else:
+ cert = idp_data['x509cert']
+
+ if not OneLogin_Saml2_Utils.validate_binary_sign(signed_query, b64decode(get_data['Signature']), cert, sign_alg):
+ raise OneLogin_Saml2_ValidationError(
+ 'Signature validation failed. Logout Response rejected',
+ OneLogin_Saml2_ValidationError.INVALID_SIGNATURE
+ )
+
+ return True
+ # pylint: disable=R0801
+ except Exception as err:
+ self.__error = err.__str__()
+ debug = self.__settings.is_debug_active()
+ if debug:
+ print(err.__str__())
+ if raise_exceptions:
+ raise err
+ return False
+
+ def __query(self, query):
+ """
+ Extracts a node from the DOMDocument (Logout Response Menssage)
+ :param query: Xpath Expresion
+ :type query: string
+ :return: The queried node
+ :rtype: DOMNodeList
+ """
+ # Switch to lxml for querying
+ xml = self.document.toxml()
+ return OneLogin_Saml2_Utils.query(fromstring(xml, forbid_dtd=True), query)
+
+[docs] def build(self, in_response_to):
+ """
+ Creates a Logout Response object.
+ :param in_response_to: InResponseTo value for the Logout Response.
+ :type in_response_to: string
+ """
+ sp_data = self.__settings.get_sp_data()
+
+ uid = OneLogin_Saml2_Utils.generate_unique_id()
+ issue_instant = OneLogin_Saml2_Utils.parse_time_to_SAML(OneLogin_Saml2_Utils.now())
+
+ logout_response = """<samlp:LogoutResponse xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
+ xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+ ID="%(id)s"
+ Version="2.0"
+ IssueInstant="%(issue_instant)s"
+ Destination="%(destination)s"
+ InResponseTo="%(in_response_to)s"
+>
+ <saml:Issuer>%(entity_id)s</saml:Issuer>
+ <samlp:Status>
+ <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
+ </samlp:Status>
+</samlp:LogoutResponse>""" % \
+ {
+ 'id': uid,
+ 'issue_instant': issue_instant,
+ 'destination': self.__settings.get_idp_slo_response_url(),
+ 'in_response_to': in_response_to,
+ 'entity_id': sp_data['entityId'],
+ }
+
+ self.__logout_response = logout_response
+
+[docs] def get_in_response_to(self):
+ """
+ Gets the ID of the LogoutRequest which this response is in response to
+ :returns: ID of LogoutRequest this LogoutResponse is in response to or None if it is not present
+ :rtype: str
+ """
+ return self.document.documentElement.getAttribute('InResponseTo')
+
+[docs] def get_response(self, deflate=True):
+ """
+ Returns the Logout Response defated, base64encoded
+ :param deflate: It makes the deflate process optional
+ :type: bool
+ :return: Logout Response maybe deflated and base64 encoded
+ :rtype: string
+ """
+ if deflate:
+ response = OneLogin_Saml2_Utils.deflate_and_base64_encode(self.__logout_response)
+ else:
+ response = b64encode(self.__logout_response)
+ return response
+
+[docs] def get_xml(self):
+ """
+ Returns the XML that will be sent as part of the response
+ or that was received at the SP
+ :return: XML response body
+ :rtype: string
+ """
+ return self.__logout_response
+
+[docs] def get_error(self):
+ """
+ After executing a validation process, if it fails this method returns the cause
+ """
+ return self.__error
+
+# -*- coding: utf-8 -*-
+
+""" OneLogin_Saml2_Metadata class
+
+MIT License
+
+Metadata class of Python Toolkit.
+
+"""
+
+from time import gmtime, strftime, time
+from datetime import datetime
+from defusedxml.minidom import parseString
+
+from onelogin.saml2.constants import OneLogin_Saml2_Constants
+from onelogin.saml2.utils import OneLogin_Saml2_Utils
+
+
+[docs]class OneLogin_Saml2_Metadata(object):
+ """
+
+ A class that contains methods related to the metadata of the SP
+
+ """
+
+ TIME_VALID = 172800 # 2 days
+ TIME_CACHED = 604800 # 1 week
+
+[docs] @staticmethod
+ def builder(sp, authnsign=False, wsign=False, valid_until=None, cache_duration=None, contacts=None, organization=None):
+ """
+ Builds the metadata of the SP
+
+ :param sp: The SP data
+ :type sp: string
+
+ :param authnsign: authnRequestsSigned attribute
+ :type authnsign: string
+
+ :param wsign: wantAssertionsSigned attribute
+ :type wsign: string
+
+ :param valid_until: Metadata's expiry date
+ :type valid_until: string|DateTime|Timestamp
+
+ :param cache_duration: Duration of the cache in seconds
+ :type cache_duration: int|string
+
+ :param contacts: Contacts info
+ :type contacts: dict
+
+ :param organization: Organization info
+ :type organization: dict
+ """
+ if valid_until is None:
+ valid_until = int(time()) + OneLogin_Saml2_Metadata.TIME_VALID
+ if not isinstance(valid_until, basestring):
+ if isinstance(valid_until, datetime):
+ valid_until_time = valid_until.timetuple()
+ else:
+ valid_until_time = gmtime(valid_until)
+ valid_until_str = strftime(r'%Y-%m-%dT%H:%M:%SZ', valid_until_time)
+ else:
+ valid_until_str = valid_until
+
+ if cache_duration is None:
+ cache_duration = OneLogin_Saml2_Metadata.TIME_CACHED
+ if not isinstance(cache_duration, basestring):
+ cache_duration_str = 'PT%sS' % cache_duration # 'P'eriod of 'T'ime x 'S'econds
+ else:
+ cache_duration_str = cache_duration
+
+ if contacts is None:
+ contacts = {}
+ if organization is None:
+ organization = {}
+
+ str_attribute_consuming_service = ''
+ if 'attributeConsumingService' in sp and len(sp['attributeConsumingService']):
+ attr_cs_desc_str = ''
+ if "serviceDescription" in sp['attributeConsumingService']:
+ attr_cs_desc_str = """ <md:ServiceDescription xml:lang="en">%s</md:ServiceDescription>
+""" % sp['attributeConsumingService']['serviceDescription']
+
+ requested_attribute_data = []
+ for req_attribs in sp['attributeConsumingService']['requestedAttributes']:
+ req_attr_nameformat_str = req_attr_friendlyname_str = req_attr_isrequired_str = ''
+ req_attr_aux_str = ' />'
+
+ if 'nameFormat' in req_attribs.keys() and req_attribs['nameFormat']:
+ req_attr_nameformat_str = " NameFormat=\"%s\"" % req_attribs['nameFormat']
+ if 'friendlyName' in req_attribs.keys() and req_attribs['friendlyName']:
+ req_attr_friendlyname_str = " FriendlyName=\"%s\"" % req_attribs['friendlyName']
+ if 'isRequired' in req_attribs.keys() and req_attribs['isRequired']:
+ req_attr_isrequired_str = " isRequired=\"%s\"" % 'true' if req_attribs['isRequired'] else 'false'
+
+ if 'attributeValue' in req_attribs.keys() and req_attribs['attributeValue']:
+ if isinstance(req_attribs['attributeValue'], basestring):
+ req_attribs['attributeValue'] = [req_attribs['attributeValue']]
+
+ req_attr_aux_str = ">"
+ for attrValue in req_attribs['attributeValue']:
+ req_attr_aux_str += """
+ <saml:AttributeValue xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">%(attributeValue)s</saml:AttributeValue>""" % \
+ {
+ 'attributeValue': attrValue
+ }
+ req_attr_aux_str += """
+ </md:RequestedAttribute>"""
+
+ requested_attribute = """ <md:RequestedAttribute Name="%(req_attr_name)s"%(req_attr_nameformat_str)s%(req_attr_friendlyname_str)s%(req_attr_isrequired_str)s%(req_attr_aux_str)s""" % \
+ {
+ 'req_attr_name': req_attribs['name'],
+ 'req_attr_nameformat_str': req_attr_nameformat_str,
+ 'req_attr_friendlyname_str': req_attr_friendlyname_str,
+ 'req_attr_isrequired_str': req_attr_isrequired_str,
+ 'req_attr_aux_str': req_attr_aux_str
+ }
+
+ requested_attribute_data.append(requested_attribute)
+
+ str_attribute_consuming_service = """ <md:AttributeConsumingService index="1">
+ <md:ServiceName xml:lang="en">%(service_name)s</md:ServiceName>
+%(attr_cs_desc)s%(requested_attribute_str)s
+ </md:AttributeConsumingService>
+""" % \
+ {
+ 'service_name': sp['attributeConsumingService']['serviceName'],
+ 'attr_cs_desc': attr_cs_desc_str,
+ 'requested_attribute_str': '\n'.join(requested_attribute_data)
+ }
+
+ sls = ''
+ if 'singleLogoutService' in sp and 'url' in sp['singleLogoutService']:
+ sls = """ <md:SingleLogoutService Binding="%(binding)s"
+ Location="%(location)s" />\n""" % \
+ {
+ 'binding': sp['singleLogoutService']['binding'],
+ 'location': sp['singleLogoutService']['url'],
+ }
+
+ str_authnsign = 'true' if authnsign else 'false'
+ str_wsign = 'true' if wsign else 'false'
+
+ str_organization = ''
+ if len(organization) > 0:
+ organization_names = []
+ organization_displaynames = []
+ organization_urls = []
+ for (lang, info) in organization.items():
+ organization_names.append(""" <md:OrganizationName xml:lang="%s">%s</md:OrganizationName>""" % (lang, info['name']))
+ organization_displaynames.append(""" <md:OrganizationDisplayName xml:lang="%s">%s</md:OrganizationDisplayName>""" % (lang, info['displayname']))
+ organization_urls.append(""" <md:OrganizationURL xml:lang="%s">%s</md:OrganizationURL>""" % (lang, info['url']))
+ org_data = '\n'.join(organization_names) + '\n' + '\n'.join(organization_displaynames) + '\n' + '\n'.join(organization_urls)
+ str_organization = """ <md:Organization>
+%(org)s
+ </md:Organization>\n""" % {'org': org_data}
+
+ str_contacts = ''
+ if len(contacts) > 0:
+ contacts_info = []
+ for (ctype, info) in contacts.items():
+ contact = """ <md:ContactPerson contactType="%(type)s">
+ <md:GivenName>%(name)s</md:GivenName>
+ <md:EmailAddress>%(email)s</md:EmailAddress>
+ </md:ContactPerson>""" % \
+ {
+ 'type': ctype,
+ 'name': info['givenName'],
+ 'email': info['emailAddress'],
+ }
+ contacts_info.append(contact)
+ str_contacts = '\n'.join(contacts_info) + '\n'
+
+ metadata = u"""<?xml version="1.0"?>
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+ %(valid)s
+ %(cache)s
+ entityID="%(entity_id)s">
+ <md:SPSSODescriptor AuthnRequestsSigned="%(authnsign)s" WantAssertionsSigned="%(wsign)s" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+%(sls)s <md:NameIDFormat>%(name_id_format)s</md:NameIDFormat>
+ <md:AssertionConsumerService Binding="%(binding)s"
+ Location="%(location)s"
+ index="1" />
+%(attribute_consuming_service)s </md:SPSSODescriptor>
+%(organization)s%(contacts)s</md:EntityDescriptor>""" % \
+ {
+ 'valid': ('validUntil="%s"' % valid_until_str) if valid_until_str else '',
+ 'cache': ('cacheDuration="%s"' % cache_duration_str) if cache_duration_str else '',
+ 'entity_id': sp['entityId'],
+ 'authnsign': str_authnsign,
+ 'wsign': str_wsign,
+ 'name_id_format': sp['NameIDFormat'],
+ 'binding': sp['assertionConsumerService']['binding'],
+ 'location': sp['assertionConsumerService']['url'],
+ 'sls': sls,
+ 'organization': str_organization,
+ 'contacts': str_contacts,
+ 'attribute_consuming_service': str_attribute_consuming_service
+ }
+ return metadata
+
+[docs] @staticmethod
+ def sign_metadata(metadata, key, cert, sign_algorithm=OneLogin_Saml2_Constants.RSA_SHA256, digest_algorithm=OneLogin_Saml2_Constants.SHA256):
+ """
+ Signs the metadata with the key/cert provided
+
+ :param metadata: SAML Metadata XML
+ :type metadata: string
+
+ :param key: x509 key
+ :type key: string
+
+ :param cert: x509 cert
+ :type cert: string
+
+ :param sign_algorithm: Signature algorithm method
+ :type sign_algorithm: string
+
+ :param digest_algorithm: Digest algorithm method
+ :type digest_algorithm: string
+
+ :returns: Signed Metadata
+ :rtype: string
+ """
+ return OneLogin_Saml2_Utils.add_sign(metadata, key, cert, False, sign_algorithm, digest_algorithm)
+
+[docs] @staticmethod
+ def add_x509_key_descriptors(metadata, cert=None, add_encryption=True):
+ """
+ Adds the x509 descriptors (sign/encryption) to the metadata
+ The same cert will be used for sign/encrypt
+
+ :param metadata: SAML Metadata XML
+ :type metadata: string
+
+ :param cert: x509 cert
+ :type cert: string
+
+ :param add_encryption: Determines if the KeyDescriptor[use="encryption"] should be added.
+ :type add_encryption: boolean
+
+ :returns: Metadata with KeyDescriptors
+ :rtype: string
+ """
+ if cert is None or cert == '':
+ return metadata
+ try:
+ xml = parseString(metadata.encode('utf-8'), forbid_dtd=True, forbid_entities=True, forbid_external=True)
+ except Exception as e:
+ raise Exception('Error parsing metadata. ' + e.message)
+
+ formated_cert = OneLogin_Saml2_Utils.format_cert(cert, False)
+ x509_certificate = xml.createElementNS(OneLogin_Saml2_Constants.NS_DS, 'ds:X509Certificate')
+ content = xml.createTextNode(formated_cert)
+ x509_certificate.appendChild(content)
+
+ key_data = xml.createElementNS(OneLogin_Saml2_Constants.NS_DS, 'ds:X509Data')
+ key_data.appendChild(x509_certificate)
+
+ key_info = xml.createElementNS(OneLogin_Saml2_Constants.NS_DS, 'ds:KeyInfo')
+ key_info.appendChild(key_data)
+
+ key_descriptor = xml.createElementNS(OneLogin_Saml2_Constants.NS_DS, 'md:KeyDescriptor')
+
+ entity_descriptor = xml.getElementsByTagName('md:EntityDescriptor')[0]
+
+ sp_sso_descriptor = entity_descriptor.getElementsByTagName('md:SPSSODescriptor')[0]
+ sp_sso_descriptor.insertBefore(key_descriptor.cloneNode(True), sp_sso_descriptor.firstChild)
+ if add_encryption:
+ sp_sso_descriptor.insertBefore(key_descriptor.cloneNode(True), sp_sso_descriptor.firstChild)
+
+ signing = xml.getElementsByTagName('md:KeyDescriptor')[0]
+ signing.setAttribute('use', 'signing')
+ signing.appendChild(key_info)
+ signing.setAttribute('xmlns:ds', OneLogin_Saml2_Constants.NS_DS)
+
+ if add_encryption:
+ encryption = xml.getElementsByTagName('md:KeyDescriptor')[1]
+ encryption.setAttribute('use', 'encryption')
+ encryption.appendChild(key_info.cloneNode(True))
+ encryption.setAttribute('xmlns:ds', OneLogin_Saml2_Constants.NS_DS)
+
+ return xml.toxml()
+
+# -*- coding: utf-8 -*-
+
+""" OneLogin_Saml2_Response class
+
+MIT License
+
+SAML Response class of Python Toolkit.
+
+"""
+
+from base64 import b64decode
+from copy import deepcopy
+from xml.dom.minidom import Document
+
+from onelogin.saml2.constants import OneLogin_Saml2_Constants
+from onelogin.saml2.errors import OneLogin_Saml2_Error, OneLogin_Saml2_ValidationError
+from onelogin.saml2.utils import OneLogin_Saml2_Utils, return_false_on_exception
+from onelogin.saml2.xmlparser import tostring, fromstring
+
+
+[docs]class OneLogin_Saml2_Response(object):
+ """
+
+ This class handles a SAML Response. It parses or validates
+ a Logout Response object.
+
+ """
+
+ def __init__(self, settings, response):
+ """
+ Constructs the response object.
+
+ :param settings: The setting info
+ :type settings: OneLogin_Saml2_Setting object
+
+ :param response: The base64 encoded, XML string containing the samlp:Response
+ :type response: string
+ """
+ self.__settings = settings
+ self.__error = None
+ self.response = b64decode(response)
+ self.document = fromstring(self.response, forbid_dtd=True)
+ self.decrypted_document = None
+ self.encrypted = None
+ self.valid_scd_not_on_or_after = None
+
+ # Quick check for the presence of EncryptedAssertion
+ encrypted_assertion_nodes = self.__query('/samlp:Response/saml:EncryptedAssertion')
+ if encrypted_assertion_nodes:
+ decrypted_document = deepcopy(self.document)
+ self.encrypted = True
+ self.decrypted_document = self.__decrypt_assertion(decrypted_document)
+
+[docs] def is_valid(self, request_data, request_id=None, raise_exceptions=False):
+ """
+ Validates the response object.
+
+ :param request_data: Request Data
+ :type request_data: dict
+
+ :param request_id: Optional argument. The ID of the AuthNRequest sent by this SP to the IdP
+ :type request_id: string
+
+ :param raise_exceptions: Whether to return false on failure or raise an exception
+ :type raise_exceptions: Boolean
+
+ :returns: True if the SAML Response is valid, False if not
+ :rtype: bool
+ """
+ self.__error = None
+ try:
+ # Checks SAML version
+ if self.document.get('Version', None) != '2.0':
+ raise OneLogin_Saml2_ValidationError(
+ 'Unsupported SAML version',
+ OneLogin_Saml2_ValidationError.UNSUPPORTED_SAML_VERSION
+ )
+
+ # Checks that ID exists
+ if self.document.get('ID', None) is None:
+ raise OneLogin_Saml2_ValidationError(
+ 'Missing ID attribute on SAML Response',
+ OneLogin_Saml2_ValidationError.MISSING_ID
+ )
+
+ # Checks that the response has the SUCCESS status
+ self.check_status()
+
+ # Checks that the response only has one assertion
+ if not self.validate_num_assertions():
+ raise OneLogin_Saml2_ValidationError(
+ 'SAML Response must contain 1 assertion',
+ OneLogin_Saml2_ValidationError.WRONG_NUMBER_OF_ASSERTIONS
+ )
+
+ idp_data = self.__settings.get_idp_data()
+ idp_entity_id = idp_data.get('entityId', '')
+ sp_data = self.__settings.get_sp_data()
+ sp_entity_id = sp_data.get('entityId', '')
+
+ signed_elements = self.process_signed_elements()
+
+ has_signed_response = '{%s}Response' % OneLogin_Saml2_Constants.NS_SAMLP in signed_elements
+ has_signed_assertion = '{%s}Assertion' % OneLogin_Saml2_Constants.NS_SAML in signed_elements
+
+ security = self.__settings.get_security_data()
+ if self.__settings.is_strict():
+ no_valid_xml_msg = 'Invalid SAML Response. Not match the saml-schema-protocol-2.0.xsd'
+ res = OneLogin_Saml2_Utils.validate_xml(
+ tostring(self.document),
+ 'saml-schema-protocol-2.0.xsd',
+ self.__settings.is_debug_active()
+ )
+ if not isinstance(res, Document):
+ raise OneLogin_Saml2_ValidationError(
+ no_valid_xml_msg,
+ OneLogin_Saml2_ValidationError.INVALID_XML_FORMAT
+ )
+
+ # If encrypted, check also the decrypted document
+ if self.encrypted:
+ res = OneLogin_Saml2_Utils.validate_xml(
+ tostring(self.decrypted_document),
+ 'saml-schema-protocol-2.0.xsd',
+ self.__settings.is_debug_active()
+ )
+ if not isinstance(res, Document):
+ raise OneLogin_Saml2_ValidationError(
+ no_valid_xml_msg,
+ OneLogin_Saml2_ValidationError.INVALID_XML_FORMAT
+ )
+
+ current_url = OneLogin_Saml2_Utils.get_self_url_no_query(request_data)
+
+ in_response_to = self.get_in_response_to()
+ if request_id is None and in_response_to is not None and security.get('rejectUnsolicitedResponsesWithInResponseTo', False):
+ raise OneLogin_Saml2_ValidationError(
+ 'The Response has an InResponseTo attribute: %s while no InResponseTo was expected' % in_response_to,
+ OneLogin_Saml2_ValidationError.WRONG_INRESPONSETO
+ )
+
+ # Check if the InResponseTo of the Response matchs the ID of the AuthNRequest (requestId) if provided
+ if request_id is not None and in_response_to != request_id:
+ raise OneLogin_Saml2_ValidationError(
+ 'The InResponseTo of the Response: %s, does not match the ID of the AuthNRequest sent by the SP: %s' % (in_response_to, request_id),
+ OneLogin_Saml2_ValidationError.WRONG_INRESPONSETO
+ )
+
+ if not self.encrypted and security.get('wantAssertionsEncrypted', False):
+ raise OneLogin_Saml2_ValidationError(
+ 'The assertion of the Response is not encrypted and the SP require it',
+ OneLogin_Saml2_ValidationError.NO_ENCRYPTED_ASSERTION
+ )
+
+ if security.get('wantNameIdEncrypted', False):
+ encrypted_nameid_nodes = self.__query_assertion('/saml:Subject/saml:EncryptedID/xenc:EncryptedData')
+ if len(encrypted_nameid_nodes) != 1:
+ raise OneLogin_Saml2_ValidationError(
+ 'The NameID of the Response is not encrypted and the SP require it',
+ OneLogin_Saml2_ValidationError.NO_ENCRYPTED_NAMEID
+ )
+
+ # Checks that a Conditions element exists
+ if not self.check_one_condition():
+ raise OneLogin_Saml2_ValidationError(
+ 'The Assertion must include a Conditions element',
+ OneLogin_Saml2_ValidationError.MISSING_CONDITIONS
+ )
+
+ # Validates Assertion timestamps
+ self.validate_timestamps(raise_exceptions=True)
+
+ # Checks that an AuthnStatement element exists and is unique
+ if not self.check_one_authnstatement():
+ raise OneLogin_Saml2_ValidationError(
+ 'The Assertion must include an AuthnStatement element',
+ OneLogin_Saml2_ValidationError.WRONG_NUMBER_OF_AUTHSTATEMENTS
+ )
+
+ # Checks that the response has all of the AuthnContexts that we provided in the request.
+ # Only check if failOnAuthnContextMismatch is true and requestedAuthnContext is set to a list.
+ requested_authn_contexts = security.get('requestedAuthnContext', True)
+
+ if security.get('failOnAuthnContextMismatch', False) and requested_authn_contexts and requested_authn_contexts is not True:
+ authn_contexts = self.get_authn_contexts()
+ unmatched_contexts = set(authn_contexts).difference(requested_authn_contexts)
+ if unmatched_contexts:
+ raise OneLogin_Saml2_ValidationError(
+ 'The AuthnContext "%s" was not a requested context "%s"' % (', '.join(unmatched_contexts), ', '.join(requested_authn_contexts)),
+ OneLogin_Saml2_ValidationError.AUTHN_CONTEXT_MISMATCH
+ )
+
+ # Checks that there is at least one AttributeStatement if required
+ attribute_statement_nodes = self.__query_assertion('/saml:AttributeStatement')
+ if security.get('wantAttributeStatement', True) and not attribute_statement_nodes:
+ raise OneLogin_Saml2_ValidationError(
+ 'There is no AttributeStatement on the Response',
+ OneLogin_Saml2_ValidationError.NO_ATTRIBUTESTATEMENT
+ )
+
+ encrypted_attributes_nodes = self.__query_assertion('/saml:AttributeStatement/saml:EncryptedAttribute')
+ if encrypted_attributes_nodes:
+ raise OneLogin_Saml2_ValidationError(
+ 'There is an EncryptedAttribute in the Response and this SP not support them',
+ OneLogin_Saml2_ValidationError.ENCRYPTED_ATTRIBUTES
+ )
+
+ # Checks destination
+ destination = self.document.get('Destination', None)
+ if destination:
+ if not OneLogin_Saml2_Utils.normalize_url(url=destination).startswith(OneLogin_Saml2_Utils.normalize_url(url=current_url)):
+ # TODO: Review if following lines are required, since we can control the
+ # request_data
+ # current_url_routed = OneLogin_Saml2_Utils.get_self_routed_url_no_query(request_data)
+ # if not destination.startswith(current_url_routed):
+ raise OneLogin_Saml2_ValidationError(
+ 'The response was received at %s instead of %s' % (current_url, destination),
+ OneLogin_Saml2_ValidationError.WRONG_DESTINATION
+ )
+ elif destination == '':
+ raise OneLogin_Saml2_ValidationError(
+ 'The response has an empty Destination value',
+ OneLogin_Saml2_ValidationError.EMPTY_DESTINATION
+ )
+
+ # Checks audience
+ valid_audiences = self.get_audiences()
+ if valid_audiences and sp_entity_id not in valid_audiences:
+ raise OneLogin_Saml2_ValidationError(
+ '%s is not a valid audience for this Response' % sp_entity_id,
+ OneLogin_Saml2_ValidationError.WRONG_AUDIENCE
+ )
+
+ # Checks the issuers
+ issuers = self.get_issuers()
+ for issuer in issuers:
+ if issuer is None or issuer != idp_entity_id:
+ raise OneLogin_Saml2_ValidationError(
+ 'Invalid issuer in the Assertion/Response (expected %(idpEntityId)s, got %(issuer)s)' %
+ {
+ 'idpEntityId': idp_entity_id,
+ 'issuer': issuer
+ },
+ OneLogin_Saml2_ValidationError.WRONG_ISSUER
+ )
+
+ # Checks the session Expiration
+ session_expiration = self.get_session_not_on_or_after()
+ if session_expiration and session_expiration <= OneLogin_Saml2_Utils.now():
+ raise OneLogin_Saml2_ValidationError(
+ 'The attributes have expired, based on the SessionNotOnOrAfter of the AttributeStatement of this Response',
+ OneLogin_Saml2_ValidationError.SESSION_EXPIRED
+ )
+
+ # Checks the SubjectConfirmation, at least one SubjectConfirmation must be valid
+ any_subject_confirmation = False
+ subject_confirmation_nodes = self.__query_assertion('/saml:Subject/saml:SubjectConfirmation')
+
+ for scn in subject_confirmation_nodes:
+ method = scn.get('Method', None)
+ if method and method != OneLogin_Saml2_Constants.CM_BEARER:
+ continue
+ sc_data = scn.find('saml:SubjectConfirmationData', namespaces=OneLogin_Saml2_Constants.NSMAP)
+ if sc_data is None:
+ continue
+ else:
+ irt = sc_data.get('InResponseTo', None)
+ if (in_response_to is None and irt is not None and
+ security.get('rejectUnsolicitedResponsesWithInResponseTo', False)) \
+ or in_response_to and irt and irt != in_response_to:
+ continue
+ recipient = sc_data.get('Recipient', None)
+ if recipient and current_url not in recipient:
+ continue
+ nooa = sc_data.get('NotOnOrAfter', None)
+ if nooa:
+ parsed_nooa = OneLogin_Saml2_Utils.parse_SAML_to_time(nooa)
+ if parsed_nooa <= OneLogin_Saml2_Utils.now():
+ continue
+ nb = sc_data.get('NotBefore', None)
+ if nb:
+ parsed_nb = OneLogin_Saml2_Utils.parse_SAML_to_time(nb)
+ if parsed_nb > OneLogin_Saml2_Utils.now():
+ continue
+
+ if nooa:
+ self.valid_scd_not_on_or_after = OneLogin_Saml2_Utils.parse_SAML_to_time(nooa)
+
+ any_subject_confirmation = True
+ break
+
+ if not any_subject_confirmation:
+ raise OneLogin_Saml2_ValidationError(
+ 'A valid SubjectConfirmation was not found on this Response',
+ OneLogin_Saml2_ValidationError.WRONG_SUBJECTCONFIRMATION
+ )
+
+ if security.get('wantAssertionsSigned', False) and not has_signed_assertion:
+ raise OneLogin_Saml2_ValidationError(
+ 'The Assertion of the Response is not signed and the SP require it',
+ OneLogin_Saml2_ValidationError.NO_SIGNED_ASSERTION
+ )
+
+ if security.get('wantMessagesSigned', False) and not has_signed_response:
+ raise OneLogin_Saml2_ValidationError(
+ 'The Message of the Response is not signed and the SP require it',
+ OneLogin_Saml2_ValidationError.NO_SIGNED_MESSAGE
+ )
+
+ if not signed_elements or (not has_signed_response and not has_signed_assertion):
+ raise OneLogin_Saml2_ValidationError(
+ 'No Signature found. SAML Response rejected',
+ OneLogin_Saml2_ValidationError.NO_SIGNATURE_FOUND
+ )
+ else:
+ cert = idp_data.get('x509cert', None)
+ fingerprint = idp_data.get('certFingerprint', None)
+ fingerprintalg = idp_data.get('certFingerprintAlgorithm', None)
+
+ multicerts = None
+ if 'x509certMulti' in idp_data and 'signing' in idp_data['x509certMulti'] and idp_data['x509certMulti']['signing']:
+ multicerts = idp_data['x509certMulti']['signing']
+
+ # If find a Signature on the Response, validates it checking the original response
+ if has_signed_response and not OneLogin_Saml2_Utils.validate_sign(self.document, cert, fingerprint, fingerprintalg, xpath=OneLogin_Saml2_Utils.RESPONSE_SIGNATURE_XPATH, multicerts=multicerts, raise_exceptions=False):
+ raise OneLogin_Saml2_ValidationError(
+ 'Signature validation failed. SAML Response rejected',
+ OneLogin_Saml2_ValidationError.INVALID_SIGNATURE
+ )
+
+ document_check_assertion = self.decrypted_document if self.encrypted else self.document
+ if has_signed_assertion and not OneLogin_Saml2_Utils.validate_sign(document_check_assertion, cert, fingerprint, fingerprintalg, xpath=OneLogin_Saml2_Utils.ASSERTION_SIGNATURE_XPATH, multicerts=multicerts, raise_exceptions=False):
+ raise OneLogin_Saml2_ValidationError(
+ 'Signature validation failed. SAML Response rejected',
+ OneLogin_Saml2_ValidationError.INVALID_SIGNATURE
+ )
+
+ return True
+ except Exception as err:
+ self.__error = err.__str__()
+ debug = self.__settings.is_debug_active()
+ if debug:
+ print(err.__str__())
+ if raise_exceptions:
+ raise err
+ return False
+
+[docs] def check_status(self):
+ """
+ Check if the status of the response is success or not
+
+ :raises: Exception. If the status is not success
+ """
+ status = OneLogin_Saml2_Utils.get_status(self.document)
+ code = status.get('code', None)
+ if code and code != OneLogin_Saml2_Constants.STATUS_SUCCESS:
+ splited_code = code.split(':')
+ printable_code = splited_code.pop()
+ status_exception_msg = 'The status code of the Response was not Success, was %s' % printable_code
+ status_msg = status.get('msg', None)
+ if status_msg:
+ status_exception_msg += ' -> ' + status_msg
+ raise OneLogin_Saml2_ValidationError(
+ status_exception_msg,
+ OneLogin_Saml2_ValidationError.STATUS_CODE_IS_NOT_SUCCESS
+ )
+
+[docs] def check_one_condition(self):
+ """
+ Checks that the samlp:Response/saml:Assertion/saml:Conditions element exists and is unique.
+ """
+ condition_nodes = self.__query_assertion('/saml:Conditions')
+ if len(condition_nodes) == 1:
+ return True
+ else:
+ return False
+
+[docs] def check_one_authnstatement(self):
+ """
+ Checks that the samlp:Response/saml:Assertion/saml:AuthnStatement element exists and is unique.
+ """
+ authnstatement_nodes = self.__query_assertion('/saml:AuthnStatement')
+ if len(authnstatement_nodes) == 1:
+ return True
+ else:
+ return False
+
+[docs] def get_audiences(self):
+ """
+ Gets the audiences
+
+ :returns: The valid audiences for the SAML Response
+ :rtype: list
+ """
+ audience_nodes = self.__query_assertion('/saml:Conditions/saml:AudienceRestriction/saml:Audience')
+ return [OneLogin_Saml2_Utils.element_text(node) for node in audience_nodes if OneLogin_Saml2_Utils.element_text(node) is not None]
+
+[docs] def get_authn_contexts(self):
+ """
+ Gets the authentication contexts
+ :returns: The authentication classes for the SAML Response
+ :rtype: list
+ """
+ authn_context_nodes = self.__query_assertion('/saml:AuthnStatement/saml:AuthnContext/saml:AuthnContextClassRef')
+ return [OneLogin_Saml2_Utils.element_text(node) for node in authn_context_nodes]
+
+[docs] def get_in_response_to(self):
+ """
+ Gets the ID of the request which this response is in response to
+ :returns: ID of AuthNRequest this Response is in response to or None if it is not present
+ :rtype: str
+ """
+ return self.document.get('InResponseTo')
+
+[docs] def get_issuers(self):
+ """
+ Gets the issuers (from message and from assertion)
+
+ :returns: The issuers
+ :rtype: list
+ """
+ issuers = []
+
+ message_issuer_nodes = OneLogin_Saml2_Utils.query(self.document, '/samlp:Response/saml:Issuer')
+ if len(message_issuer_nodes) > 0:
+ if len(message_issuer_nodes) == 1:
+ issuers.append(OneLogin_Saml2_Utils.element_text(message_issuer_nodes[0]))
+ else:
+ raise OneLogin_Saml2_ValidationError(
+ 'Issuer of the Response is multiple.',
+ OneLogin_Saml2_ValidationError.ISSUER_MULTIPLE_IN_RESPONSE
+ )
+
+ assertion_issuer_nodes = self.__query_assertion('/saml:Issuer')
+ if len(assertion_issuer_nodes) == 1:
+ issuers.append(OneLogin_Saml2_Utils.element_text(assertion_issuer_nodes[0]))
+ else:
+ raise OneLogin_Saml2_ValidationError(
+ 'Issuer of the Assertion not found or multiple.',
+ OneLogin_Saml2_ValidationError.ISSUER_NOT_FOUND_IN_ASSERTION
+ )
+
+ return list(set(issuers))
+
+[docs] def get_nameid_data(self):
+ """
+ Gets the NameID Data provided by the SAML Response from the IdP
+
+ :returns: Name ID Data (Value, Format, NameQualifier, SPNameQualifier)
+ :rtype: dict
+ """
+ nameid = None
+ nameid_data = {}
+
+ encrypted_id_data_nodes = self.__query_assertion('/saml:Subject/saml:EncryptedID/xenc:EncryptedData')
+ if encrypted_id_data_nodes:
+ encrypted_data = encrypted_id_data_nodes[0]
+ key = self.__settings.get_sp_key()
+ nameid = OneLogin_Saml2_Utils.decrypt_element(encrypted_data, key)
+ else:
+ nameid_nodes = self.__query_assertion('/saml:Subject/saml:NameID')
+ if nameid_nodes:
+ nameid = nameid_nodes[0]
+
+ is_strict = self.__settings.is_strict()
+ want_nameid = self.__settings.get_security_data().get('wantNameId', True)
+ if nameid is None:
+ if is_strict and want_nameid:
+ raise OneLogin_Saml2_ValidationError(
+ 'NameID not found in the assertion of the Response',
+ OneLogin_Saml2_ValidationError.NO_NAMEID
+ )
+ else:
+ if is_strict and want_nameid and not OneLogin_Saml2_Utils.element_text(nameid):
+ raise OneLogin_Saml2_ValidationError(
+ 'An empty NameID value found',
+ OneLogin_Saml2_ValidationError.EMPTY_NAMEID
+ )
+
+ nameid_data = {'Value': OneLogin_Saml2_Utils.element_text(nameid)}
+ for attr in ['Format', 'SPNameQualifier', 'NameQualifier']:
+ value = nameid.get(attr, None)
+ if value:
+ if is_strict and attr == 'SPNameQualifier':
+ sp_data = self.__settings.get_sp_data()
+ sp_entity_id = sp_data.get('entityId', '')
+ if sp_entity_id != value:
+ raise OneLogin_Saml2_ValidationError(
+ 'The SPNameQualifier value mistmatch the SP entityID value.',
+ OneLogin_Saml2_ValidationError.SP_NAME_QUALIFIER_NAME_MISMATCH
+ )
+
+ nameid_data[attr] = value
+ return nameid_data
+
+[docs] def get_nameid(self):
+ """
+ Gets the NameID provided by the SAML Response from the IdP
+
+ :returns: NameID (value)
+ :rtype: string|None
+ """
+ nameid_value = None
+ nameid_data = self.get_nameid_data()
+ if nameid_data and 'Value' in nameid_data.keys():
+ nameid_value = nameid_data['Value']
+ return nameid_value
+
+[docs] def get_nameid_format(self):
+ """
+ Gets the NameID Format provided by the SAML Response from the IdP
+
+ :returns: NameID Format
+ :rtype: string|None
+ """
+ nameid_format = None
+ nameid_data = self.get_nameid_data()
+ if nameid_data and 'Format' in nameid_data.keys():
+ nameid_format = nameid_data['Format']
+ return nameid_format
+
+[docs] def get_nameid_nq(self):
+ """
+ Gets the NameID NameQualifier provided by the SAML Response from the IdP
+
+ :returns: NameID NameQualifier
+ :rtype: string|None
+ """
+ nameid_nq = None
+ nameid_data = self.get_nameid_data()
+ if nameid_data and 'NameQualifier' in nameid_data.keys():
+ nameid_nq = nameid_data['NameQualifier']
+ return nameid_nq
+
+[docs] def get_nameid_spnq(self):
+ """
+ Gets the NameID SP NameQualifier provided by the SAML response from the IdP.
+
+ :returns: NameID SP NameQualifier
+ :rtype: string|None
+ """
+ nameid_spnq = None
+ nameid_data = self.get_nameid_data()
+ if nameid_data and 'SPNameQualifier' in nameid_data.keys():
+ nameid_spnq = nameid_data['SPNameQualifier']
+ return nameid_spnq
+
+[docs] def get_session_not_on_or_after(self):
+ """
+ Gets the SessionNotOnOrAfter from the AuthnStatement
+ Could be used to set the local session expiration
+
+ :returns: The SessionNotOnOrAfter value
+ :rtype: time|None
+ """
+ not_on_or_after = None
+ authn_statement_nodes = self.__query_assertion('/saml:AuthnStatement[@SessionNotOnOrAfter]')
+ if authn_statement_nodes:
+ not_on_or_after = OneLogin_Saml2_Utils.parse_SAML_to_time(authn_statement_nodes[0].get('SessionNotOnOrAfter'))
+ return not_on_or_after
+
+[docs] def get_assertion_not_on_or_after(self):
+ """
+ Returns the NotOnOrAfter value of the valid SubjectConfirmationData node if any
+ """
+ return self.valid_scd_not_on_or_after
+
+[docs] def get_session_index(self):
+ """
+ Gets the SessionIndex from the AuthnStatement
+ Could be used to be stored in the local session in order
+ to be used in a future Logout Request that the SP could
+ send to the SP, to set what specific session must be deleted
+
+ :returns: The SessionIndex value
+ :rtype: string|None
+ """
+ session_index = None
+ authn_statement_nodes = self.__query_assertion('/saml:AuthnStatement[@SessionIndex]')
+ if authn_statement_nodes:
+ session_index = authn_statement_nodes[0].get('SessionIndex')
+ return session_index
+
+[docs] def get_attributes(self):
+ """
+ Gets the Attributes from the AttributeStatement element.
+ EncryptedAttributes are not supported
+ """
+ attributes = {}
+ attribute_nodes = self.__query_assertion('/saml:AttributeStatement/saml:Attribute')
+ for attribute_node in attribute_nodes:
+ attr_name = attribute_node.get('Name')
+ if attr_name in attributes.keys():
+ raise OneLogin_Saml2_ValidationError(
+ 'Found an Attribute element with duplicated Name',
+ OneLogin_Saml2_ValidationError.DUPLICATED_ATTRIBUTE_NAME_FOUND
+ )
+
+ values = []
+ for attr in attribute_node.iterchildren('{%s}AttributeValue' % OneLogin_Saml2_Constants.NSMAP[OneLogin_Saml2_Constants.NS_PREFIX_SAML]):
+ # Remove any whitespace (which may be present where attributes are
+ # nested inside NameID children).
+ attr_text = OneLogin_Saml2_Utils.element_text(attr)
+ if attr_text:
+ attr_text = attr_text.strip()
+ if attr_text:
+ values.append(attr_text)
+
+ # Parse any nested NameID children
+ for nameid in attr.iterchildren('{%s}NameID' % OneLogin_Saml2_Constants.NSMAP[OneLogin_Saml2_Constants.NS_PREFIX_SAML]):
+ values.append({
+ 'NameID': {
+ 'Format': nameid.get('Format'),
+ 'NameQualifier': nameid.get('NameQualifier'),
+ 'value': OneLogin_Saml2_Utils.element_text(nameid)
+ }
+ })
+
+ attributes[attr_name] = values
+ return attributes
+
+[docs] def get_friendlyname_attributes(self):
+ """
+ Gets the Attributes from the AttributeStatement element indexed by FiendlyName.
+ EncryptedAttributes are not supported
+ """
+ attributes = {}
+ attribute_nodes = self.__query_assertion('/saml:AttributeStatement/saml:Attribute')
+ for attribute_node in attribute_nodes:
+ attr_friendlyname = attribute_node.get('FriendlyName')
+ if attr_friendlyname:
+ if attr_friendlyname in attributes.keys():
+ raise OneLogin_Saml2_ValidationError(
+ 'Found an Attribute element with duplicated FriendlyName',
+ OneLogin_Saml2_ValidationError.DUPLICATED_ATTRIBUTE_NAME_FOUND
+ )
+
+ values = []
+ for attr in attribute_node.iterchildren('{%s}AttributeValue' % OneLogin_Saml2_Constants.NSMAP[OneLogin_Saml2_Constants.NS_PREFIX_SAML]):
+ # Remove any whitespace (which may be present where attributes are
+ # nested inside NameID children).
+ attr_text = OneLogin_Saml2_Utils.element_text(attr)
+ if attr_text:
+ attr_text = attr_text.strip()
+ if attr_text:
+ values.append(attr_text)
+
+ # Parse any nested NameID children
+ for nameid in attr.iterchildren('{%s}NameID' % OneLogin_Saml2_Constants.NSMAP[OneLogin_Saml2_Constants.NS_PREFIX_SAML]):
+ values.append({
+ 'NameID': {
+ 'Format': nameid.get('Format'),
+ 'NameQualifier': nameid.get('NameQualifier'),
+ 'value': OneLogin_Saml2_Utils.element_text(nameid)
+ }
+ })
+
+ attributes[attr_friendlyname] = values
+ return attributes
+
+[docs] def validate_num_assertions(self):
+ """
+ Verifies that the document only contains a single Assertion (encrypted or not)
+
+ :returns: True if only 1 assertion encrypted or not
+ :rtype: bool
+ """
+ encrypted_assertion_nodes = OneLogin_Saml2_Utils.query(self.document, '//saml:EncryptedAssertion')
+ assertion_nodes = OneLogin_Saml2_Utils.query(self.document, '//saml:Assertion')
+
+ valid = len(encrypted_assertion_nodes) + len(assertion_nodes) == 1
+
+ if (self.encrypted):
+ assertion_nodes = OneLogin_Saml2_Utils.query(self.decrypted_document, '//saml:Assertion')
+ valid = valid and len(assertion_nodes) == 1
+
+ return valid
+
+[docs] def process_signed_elements(self):
+ """
+ Verifies the signature nodes:
+ - Checks that are Response or Assertion
+ - Check that IDs and reference URI are unique and consistent.
+
+ :returns: The signed elements tag names
+ :rtype: list
+ """
+ sign_nodes = self.__query('//ds:Signature')
+
+ security = self.__settings.get_security_data()
+ reject_deprecated_alg = security.get('rejectDeprecatedAlgorithm', False)
+
+ signed_elements = []
+ verified_seis = []
+ verified_ids = []
+ response_tag = '{%s}Response' % OneLogin_Saml2_Constants.NS_SAMLP
+ assertion_tag = '{%s}Assertion' % OneLogin_Saml2_Constants.NS_SAML
+
+ for sign_node in sign_nodes:
+ signed_element = sign_node.getparent().tag
+ if signed_element != response_tag and signed_element != assertion_tag:
+ raise OneLogin_Saml2_ValidationError(
+ 'Invalid Signature Element %s SAML Response rejected' % signed_element,
+ OneLogin_Saml2_ValidationError.WRONG_SIGNED_ELEMENT
+ )
+
+ if not sign_node.getparent().get('ID'):
+ raise OneLogin_Saml2_ValidationError(
+ 'Signed Element must contain an ID. SAML Response rejected',
+ OneLogin_Saml2_ValidationError.ID_NOT_FOUND_IN_SIGNED_ELEMENT
+ )
+
+ id_value = sign_node.getparent().get('ID')
+ if id_value in verified_ids:
+ raise OneLogin_Saml2_ValidationError(
+ 'Duplicated ID. SAML Response rejected',
+ OneLogin_Saml2_ValidationError.DUPLICATED_ID_IN_SIGNED_ELEMENTS
+ )
+ verified_ids.append(id_value)
+
+ # Check that reference URI matches the parent ID and no duplicate References or IDs
+ ref = OneLogin_Saml2_Utils.query(sign_node, './/ds:Reference')
+ if ref:
+ ref = ref[0]
+ if ref.get('URI'):
+ sei = ref.get('URI')[1:]
+
+ if sei != id_value:
+ raise OneLogin_Saml2_ValidationError(
+ 'Found an invalid Signed Element. SAML Response rejected',
+ OneLogin_Saml2_ValidationError.INVALID_SIGNED_ELEMENT
+ )
+
+ if sei in verified_seis:
+ raise OneLogin_Saml2_ValidationError(
+ 'Duplicated Reference URI. SAML Response rejected',
+ OneLogin_Saml2_ValidationError.DUPLICATED_REFERENCE_IN_SIGNED_ELEMENTS
+ )
+ verified_seis.append(sei)
+
+ # Check the signature and digest algorithm
+ if reject_deprecated_alg:
+ sig_method_node = OneLogin_Saml2_Utils.query(sign_node, './/ds:SignatureMethod')
+ if sig_method_node:
+ sig_method = sig_method_node[0].get("Algorithm")
+ if sig_method in OneLogin_Saml2_Constants.DEPRECATED_ALGORITHMS:
+ raise OneLogin_Saml2_ValidationError(
+ 'Deprecated signature algorithm found: %s' % sig_method,
+ OneLogin_Saml2_ValidationError.DEPRECATED_SIGNATURE_METHOD
+ )
+
+ dig_method_node = OneLogin_Saml2_Utils.query(sign_node, './/ds:DigestMethod')
+ if dig_method_node:
+ dig_method = dig_method_node[0].get("Algorithm")
+ if dig_method in OneLogin_Saml2_Constants.DEPRECATED_ALGORITHMS:
+ raise OneLogin_Saml2_ValidationError(
+ 'Deprecated digest algorithm found: %s' % dig_method,
+ OneLogin_Saml2_ValidationError.DEPRECATED_DIGEST_METHOD
+ )
+
+ signed_elements.append(signed_element)
+
+ if signed_elements:
+ if not self.validate_signed_elements(signed_elements, raise_exceptions=True):
+ raise OneLogin_Saml2_ValidationError(
+ 'Found an unexpected Signature Element. SAML Response rejected',
+ OneLogin_Saml2_ValidationError.UNEXPECTED_SIGNED_ELEMENTS
+ )
+ return signed_elements
+
+[docs] @return_false_on_exception
+ def validate_signed_elements(self, signed_elements):
+ """
+ Verifies that the document has the expected signed nodes.
+
+ :param signed_elements: The signed elements to be checked
+ :type signed_elements: list
+
+ :param raise_exceptions: Whether to return false on failure or raise an exception
+ :type raise_exceptions: Boolean
+ """
+ if len(signed_elements) > 2:
+ return False
+
+ response_tag = '{%s}Response' % OneLogin_Saml2_Constants.NS_SAMLP
+ assertion_tag = '{%s}Assertion' % OneLogin_Saml2_Constants.NS_SAML
+
+ if (response_tag in signed_elements and signed_elements.count(response_tag) > 1) or \
+ (assertion_tag in signed_elements and signed_elements.count(assertion_tag) > 1) or \
+ (response_tag not in signed_elements and assertion_tag not in signed_elements):
+ return False
+
+ # Check that the signed elements found here, are the ones that will be verified
+ # by OneLogin_Saml2_Utils.validate_sign
+ if response_tag in signed_elements:
+ expected_signature_nodes = OneLogin_Saml2_Utils.query(self.document, OneLogin_Saml2_Utils.RESPONSE_SIGNATURE_XPATH)
+ if len(expected_signature_nodes) != 1:
+ raise OneLogin_Saml2_ValidationError(
+ 'Unexpected number of Response signatures found. SAML Response rejected.',
+ OneLogin_Saml2_ValidationError.WRONG_NUMBER_OF_SIGNATURES_IN_RESPONSE
+ )
+
+ if assertion_tag in signed_elements:
+ expected_signature_nodes = self.__query(OneLogin_Saml2_Utils.ASSERTION_SIGNATURE_XPATH)
+ if len(expected_signature_nodes) != 1:
+ raise OneLogin_Saml2_ValidationError(
+ 'Unexpected number of Assertion signatures found. SAML Response rejected.',
+ OneLogin_Saml2_ValidationError.WRONG_NUMBER_OF_SIGNATURES_IN_ASSERTION
+ )
+
+ return True
+
+[docs] @return_false_on_exception
+ def validate_timestamps(self):
+ """
+ Verifies that the document is valid according to Conditions Element
+
+ :param raise_exceptions: Whether to return false on failure or raise an exception
+ :type raise_exceptions: Boolean
+
+ :returns: True if the condition is valid, False otherwise
+ :rtype: bool
+ """
+ conditions_nodes = self.__query_assertion('/saml:Conditions')
+
+ for conditions_node in conditions_nodes:
+ nb_attr = conditions_node.get('NotBefore')
+ nooa_attr = conditions_node.get('NotOnOrAfter')
+ if nb_attr and OneLogin_Saml2_Utils.parse_SAML_to_time(nb_attr) > OneLogin_Saml2_Utils.now() + OneLogin_Saml2_Constants.ALLOWED_CLOCK_DRIFT:
+ raise OneLogin_Saml2_ValidationError(
+ 'Could not validate timestamp: not yet valid. Check system clock.',
+ OneLogin_Saml2_ValidationError.ASSERTION_TOO_EARLY
+ )
+ if nooa_attr and OneLogin_Saml2_Utils.parse_SAML_to_time(nooa_attr) + OneLogin_Saml2_Constants.ALLOWED_CLOCK_DRIFT <= OneLogin_Saml2_Utils.now():
+ raise OneLogin_Saml2_ValidationError(
+ 'Could not validate timestamp: expired. Check system clock.',
+ OneLogin_Saml2_ValidationError.ASSERTION_EXPIRED
+ )
+ return True
+
+ def __query_assertion(self, xpath_expr):
+ """
+ Extracts nodes that match the query from the Assertion
+
+ :param query: Xpath Expresion
+ :type query: String
+
+ :returns: The queried nodes
+ :rtype: list
+ """
+ assertion_expr = '/saml:Assertion'
+ signature_expr = '/ds:Signature/ds:SignedInfo/ds:Reference'
+ signed_assertion_query = '/samlp:Response' + assertion_expr + signature_expr
+ assertion_reference_nodes = self.__query(signed_assertion_query)
+ tagid = None
+
+ if not assertion_reference_nodes:
+ # Check if the message is signed
+ signed_message_query = '/samlp:Response' + signature_expr
+ message_reference_nodes = self.__query(signed_message_query)
+ if message_reference_nodes:
+ message_id = message_reference_nodes[0].get('URI')
+ final_query = "/samlp:Response[@ID=$tagid]/"
+ tagid = message_id[1:]
+ else:
+ final_query = "/samlp:Response"
+ final_query += assertion_expr
+ else:
+ assertion_id = assertion_reference_nodes[0].get('URI')
+ final_query = '/samlp:Response' + assertion_expr + "[@ID=$tagid]"
+ tagid = assertion_id[1:]
+ final_query += xpath_expr
+ return self.__query(final_query, tagid)
+
+ def __query(self, query, tagid=None):
+ """
+ Extracts nodes that match the query from the Response
+
+ :param query: Xpath Expresion
+ :type query: String
+
+ :param tagid: Tag ID
+ :type query: String
+
+ :returns: The queried nodes
+ :rtype: list
+ """
+ if self.encrypted:
+ document = self.decrypted_document
+ else:
+ document = self.document
+ return OneLogin_Saml2_Utils.query(document, query, None, tagid)
+
+ def __decrypt_assertion(self, dom):
+ """
+ Decrypts the Assertion
+
+ :raises: Exception if no private key available
+
+ :param dom: Encrypted Assertion
+ :type dom: Element
+
+ :returns: Decrypted Assertion
+ :rtype: Element
+ """
+ key = self.__settings.get_sp_key()
+ debug = self.__settings.is_debug_active()
+
+ if not key:
+ raise OneLogin_Saml2_Error(
+ 'No private key available to decrypt the assertion, check settings',
+ OneLogin_Saml2_Error.PRIVATE_KEY_NOT_FOUND
+ )
+
+ encrypted_assertion_nodes = OneLogin_Saml2_Utils.query(dom, '/samlp:Response/saml:EncryptedAssertion')
+ if encrypted_assertion_nodes:
+ encrypted_data_nodes = OneLogin_Saml2_Utils.query(encrypted_assertion_nodes[0], '//saml:EncryptedAssertion/xenc:EncryptedData')
+ if encrypted_data_nodes:
+ keyinfo = OneLogin_Saml2_Utils.query(encrypted_assertion_nodes[0], '//saml:EncryptedAssertion/xenc:EncryptedData/ds:KeyInfo')
+ if not keyinfo:
+ raise OneLogin_Saml2_ValidationError(
+ 'No KeyInfo present, invalid Assertion',
+ OneLogin_Saml2_ValidationError.KEYINFO_NOT_FOUND_IN_ENCRYPTED_DATA
+ )
+ keyinfo = keyinfo[0]
+ children = keyinfo.getchildren()
+ if not children:
+ raise OneLogin_Saml2_ValidationError(
+ 'KeyInfo has no children nodes, invalid Assertion',
+ OneLogin_Saml2_ValidationError.CHILDREN_NODE_NOT_FOUND_IN_KEYINFO
+ )
+ for child in children:
+ if 'RetrievalMethod' in child.tag:
+ if child.attrib['Type'] != 'http://www.w3.org/2001/04/xmlenc#EncryptedKey':
+ raise OneLogin_Saml2_ValidationError(
+ 'Unsupported Retrieval Method found',
+ OneLogin_Saml2_ValidationError.UNSUPPORTED_RETRIEVAL_METHOD
+ )
+ uri = child.attrib['URI']
+ if not uri.startswith('#'):
+ break
+ uri = uri.split('#')[1]
+ encrypted_key = OneLogin_Saml2_Utils.query(encrypted_assertion_nodes[0], './xenc:EncryptedKey[@Id=$tagid]', None, uri)
+ if encrypted_key:
+ keyinfo.append(encrypted_key[0])
+
+ encrypted_data = encrypted_data_nodes[0]
+ decrypted = OneLogin_Saml2_Utils.decrypt_element(encrypted_data, key, debug=debug, inplace=True)
+ dom.replace(encrypted_assertion_nodes[0], decrypted)
+
+ return dom
+
+[docs] def get_error(self):
+ """
+ After executing a validation process, if it fails this method returns the cause
+ """
+ return self.__error
+
+[docs] def get_xml_document(self):
+ """
+ Returns the SAML Response document (If contains an encrypted assertion, decrypts it)
+
+ :return: Decrypted XML response document
+ :rtype: DOMDocument
+ """
+ if self.encrypted:
+ return self.decrypted_document
+ else:
+ return self.document
+
+[docs] def get_id(self):
+ """
+ :returns: the ID of the response
+ :rtype: string
+ """
+ return self.document.get('ID', None)
+
+[docs] def get_assertion_id(self):
+ """
+ :returns: the ID of the assertion in the response
+ :rtype: string
+ """
+ if not self.validate_num_assertions():
+ raise OneLogin_Saml2_ValidationError(
+ 'SAML Response must contain 1 assertion',
+ OneLogin_Saml2_ValidationError.WRONG_NUMBER_OF_ASSERTIONS
+ )
+ return self.__query_assertion('')[0].get('ID', None)
+
+# -*- coding: utf-8 -*-
+
+""" OneLogin_Saml2_Settings class
+
+MIT License
+
+Setting class of Python Toolkit.
+
+"""
+
+import json
+import re
+from time import time
+from os.path import dirname, exists, join, sep, abspath
+from xml.dom.minidom import Document
+
+from onelogin.saml2.constants import OneLogin_Saml2_Constants
+from onelogin.saml2.errors import OneLogin_Saml2_Error
+from onelogin.saml2.metadata import OneLogin_Saml2_Metadata
+from onelogin.saml2.utils import OneLogin_Saml2_Utils
+
+
+# Regex from Django Software Foundation and individual contributors.
+# Released under a BSD 3-Clause License
+url_regex = re.compile(
+ r'^(?:[a-z0-9\.\-]*)://' # scheme is validated separately
+ r'(?:(?:[A-Z0-9_](?:[A-Z0-9-_]{0,61}[A-Z0-9_])?\.)+(?:[A-Z]{2,6}\.?|[A-Z0-9-]{2,}\.?)|' # domain...
+ r'localhost|' # localhost...
+ r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|' # ...or ipv4
+ r'\[?[A-F0-9]*:[A-F0-9:]+\]?)' # ...or ipv6
+ r'(?::\d+)?' # optional port
+ r'(?:/?|[/?]\S+)$', re.IGNORECASE)
+url_regex_single_label_domain = re.compile(
+ r'^(?:[a-z0-9\.\-]*)://' # scheme is validated separately
+ r'(?:(?:[A-Z0-9_](?:[A-Z0-9-_]{0,61}[A-Z0-9_])?\.)+(?:[A-Z]{2,6}\.?|[A-Z0-9-]{2,}\.?)|' # domain...
+ r'(?:[A-Z0-9_](?:[A-Z0-9-_]{0,61}[A-Z0-9_]))|' # single-label-domain
+ r'localhost|' # localhost...
+ r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|' # ...or ipv4
+ r'\[?[A-F0-9]*:[A-F0-9:]+\]?)' # ...or ipv6
+ r'(?::\d+)?' # optional port
+ r'(?:/?|[/?]\S+)$', re.IGNORECASE)
+url_schemes = ['http', 'https', 'ftp', 'ftps']
+
+
+[docs]def validate_url(url, allow_single_label_domain=False):
+ """
+ Auxiliary method to validate an urllib
+ :param url: An url to be validated
+ :type url: string
+ :param allow_single_label_domain: In order to allow or not single label domain
+ :type url: bool
+ :returns: True if the url is valid
+ :rtype: bool
+ """
+
+ scheme = url.split('://')[0].lower()
+ if scheme not in url_schemes:
+ return False
+ if allow_single_label_domain:
+ if not bool(url_regex_single_label_domain.search(url)):
+ return False
+ else:
+ if not bool(url_regex.search(url)):
+ return False
+ return True
+
+
+[docs]class OneLogin_Saml2_Settings(object):
+ """
+
+ Handles the settings of the Python toolkits.
+
+ """
+
+ def __init__(self, settings=None, custom_base_path=None, sp_validation_only=False):
+ """
+ Initializes the settings:
+ - Sets the paths of the different folders
+ - Loads settings info from settings file or array/object provided
+
+ :param settings: SAML Toolkit Settings
+ :type settings: dict
+
+ :param custom_base_path: Path where are stored the settings file and the cert folder
+ :type custom_base_path: string
+ """
+ self.__sp_validation_only = sp_validation_only
+ self.__paths = {}
+ self.__strict = True
+ self.__debug = False
+ self.__sp = {}
+ self.__idp = {}
+ self.__security = {}
+ self.__contacts = {}
+ self.__organization = {}
+ self.__errors = []
+
+ self.__load_paths(base_path=custom_base_path)
+ self.__update_paths(settings)
+
+ if settings is None:
+ try:
+ valid = self.__load_settings_from_file()
+ except Exception as e:
+ raise e
+ if not valid:
+ raise OneLogin_Saml2_Error(
+ 'Invalid dict settings at the file: %s',
+ OneLogin_Saml2_Error.SETTINGS_INVALID,
+ ','.join(self.__errors)
+ )
+ self.__add_default_values()
+ elif isinstance(settings, dict):
+ if not self.__load_settings_from_dict(settings):
+ raise OneLogin_Saml2_Error(
+ 'Invalid dict settings: %s',
+ OneLogin_Saml2_Error.SETTINGS_INVALID,
+ ','.join(self.__errors)
+ )
+ else:
+ raise OneLogin_Saml2_Error(
+ 'Unsupported settings object',
+ OneLogin_Saml2_Error.UNSUPPORTED_SETTINGS_OBJECT
+ )
+
+ self.format_idp_cert()
+ self.format_sp_cert()
+ if 'x509certNew' in self.__sp:
+ self.format_sp_cert_new()
+ self.format_sp_key()
+ if 'x509certMulti' in self.__idp:
+ self.format_idp_cert_multi()
+
+ def __load_paths(self, base_path=None):
+ """
+ Set the paths of the different folders
+ """
+ if base_path is None:
+ base_path = dirname(dirname(dirname(abspath(__file__))))
+ if not base_path.endswith(sep):
+ base_path += sep
+ self.__paths = {
+ 'base': base_path,
+ 'cert': base_path + 'certs' + sep,
+ 'lib': dirname(__file__) + sep
+ }
+
+ def __update_paths(self, settings):
+ """
+ Set custom paths if necessary
+ """
+ if not isinstance(settings, dict):
+ return
+
+ if 'custom_base_path' in settings:
+ base_path = settings['custom_base_path']
+ base_path = join(dirname(abspath(__file__)), base_path)
+ self.__load_paths(base_path)
+
+[docs] def get_base_path(self):
+ """
+ Returns base path
+
+ :return: The base toolkit folder path
+ :rtype: string
+ """
+ return self.__paths['base']
+
+[docs] def set_cert_path(self, path):
+ """
+ Set a new cert path
+ """
+ self.__paths['cert'] = path
+
+[docs] def get_cert_path(self):
+ """
+ Returns cert path
+
+ :return: The cert folder path
+ :rtype: string
+ """
+ return self.__paths['cert']
+
+[docs] def get_lib_path(self):
+ """
+ Returns lib path
+
+ :return: The library folder path
+ :rtype: string
+ """
+ return self.__paths['lib']
+
+[docs] def get_schemas_path(self):
+ """
+ Returns schema path
+
+ :return: The schema folder path
+ :rtype: string
+ """
+ return self.__paths['lib'] + 'schemas/'
+
+ def __load_settings_from_dict(self, settings):
+ """
+ Loads settings info from a settings Dict
+
+ :param settings: SAML Toolkit Settings
+ :type settings: dict
+
+ :returns: True if the settings info is valid
+ :rtype: boolean
+ """
+ errors = self.check_settings(settings)
+ if len(errors) == 0:
+ self.__errors = []
+ self.__sp = settings['sp']
+
+ self.__idp = settings.get('idp', {})
+ self.__strict = settings.get('strict', True)
+ self.__debug = settings.get('debug', False)
+ self.__security = settings.get('security', {})
+ self.__contacts = settings.get('contactPerson', {})
+ self.__organization = settings.get('organization', {})
+
+ self.__add_default_values()
+ return True
+
+ self.__errors = errors
+ return False
+
+ def __load_settings_from_file(self):
+ """
+ Loads settings info from the settings json file
+
+ :returns: True if the settings info is valid
+ :rtype: boolean
+ """
+ filename = self.get_base_path() + 'settings.json'
+
+ if not exists(filename):
+ raise OneLogin_Saml2_Error(
+ 'Settings file not found: %s',
+ OneLogin_Saml2_Error.SETTINGS_FILE_NOT_FOUND,
+ filename
+ )
+
+ # In the php toolkit instead of being a json file it is a php file and
+ # it is directly included
+ json_data = open(filename, 'r')
+ settings = json.load(json_data)
+ json_data.close()
+
+ advanced_filename = self.get_base_path() + 'advanced_settings.json'
+ if exists(advanced_filename):
+ json_data = open(advanced_filename, 'r')
+ settings.update(json.load(json_data)) # Merge settings
+ json_data.close()
+
+ return self.__load_settings_from_dict(settings)
+
+ def __add_default_values(self):
+ """
+ Add default values if the settings info is not complete
+ """
+ self.__sp.setdefault('assertionConsumerService', {})
+ self.__sp['assertionConsumerService'].setdefault('binding', OneLogin_Saml2_Constants.BINDING_HTTP_POST)
+
+ self.__sp.setdefault('attributeConsumingService', {})
+
+ self.__sp.setdefault('singleLogoutService', {})
+ self.__sp['singleLogoutService'].setdefault('binding', OneLogin_Saml2_Constants.BINDING_HTTP_REDIRECT)
+
+ self.__idp.setdefault('singleLogoutService', {})
+
+ # Related to nameID
+ self.__sp.setdefault('NameIDFormat', OneLogin_Saml2_Constants.NAMEID_UNSPECIFIED)
+ self.__security.setdefault('nameIdEncrypted', False)
+
+ # Metadata format
+ self.__security.setdefault('metadataValidUntil', None) # None means use default
+ self.__security.setdefault('metadataCacheDuration', None) # None means use default
+
+ # Sign provided
+ self.__security.setdefault('authnRequestsSigned', False)
+ self.__security.setdefault('logoutRequestSigned', False)
+ self.__security.setdefault('logoutResponseSigned', False)
+ self.__security.setdefault('signMetadata', False)
+
+ # Sign expected
+ self.__security.setdefault('wantMessagesSigned', False)
+ self.__security.setdefault('wantAssertionsSigned', False)
+
+ # NameID element expected
+ self.__security.setdefault('wantNameId', True)
+
+ # SAML responses with a InResponseTo attribute not rejected when requestId not passed
+ self.__security.setdefault('rejectUnsolicitedResponsesWithInResponseTo', False)
+
+ # Encrypt expected
+ self.__security.setdefault('wantAssertionsEncrypted', False)
+ self.__security.setdefault('wantNameIdEncrypted', False)
+
+ # Signature Algorithm
+ self.__security.setdefault('signatureAlgorithm', OneLogin_Saml2_Constants.RSA_SHA256)
+
+ # Digest Algorithm
+ self.__security.setdefault('digestAlgorithm', OneLogin_Saml2_Constants.SHA256)
+
+ # Reject Deprecated Algorithms
+ self.__security.setdefault('rejectDeprecatedAlgorithm', False)
+
+ # AttributeStatement required by default
+ self.__security.setdefault('wantAttributeStatement', True)
+
+ self.__idp.setdefault('x509cert', '')
+ self.__idp.setdefault('certFingerprint', '')
+ self.__idp.setdefault('certFingerprintAlgorithm', 'sha1')
+
+ self.__sp.setdefault('x509cert', '')
+ self.__sp.setdefault('privateKey', '')
+
+ self.__security.setdefault('requestedAuthnContext', True)
+ self.__security.setdefault('requestedAuthnContextComparison', 'exact')
+ self.__security.setdefault('failOnAuthnContextMismatch', False)
+
+[docs] def check_settings(self, settings):
+ """
+ Checks the settings info.
+
+ :param settings: Dict with settings data
+ :type settings: dict
+
+ :returns: Errors found on the settings data
+ :rtype: list
+ """
+ assert isinstance(settings, dict)
+
+ errors = []
+ if not isinstance(settings, dict) or len(settings) == 0:
+ errors.append('invalid_syntax')
+ else:
+ if not self.__sp_validation_only:
+ errors += self.check_idp_settings(settings)
+ sp_errors = self.check_sp_settings(settings)
+ errors += sp_errors
+
+ return errors
+
+[docs] def check_idp_settings(self, settings):
+ """
+ Checks the IdP settings info.
+
+ :param settings: Dict with settings data
+ :type settings: dict
+
+ :returns: Errors found on the IdP settings data
+ :rtype: list
+ """
+ assert isinstance(settings, dict)
+
+ errors = []
+ if not isinstance(settings, dict) or len(settings) == 0:
+ errors.append('invalid_syntax')
+ else:
+ if not settings.get('idp'):
+ errors.append('idp_not_found')
+ else:
+ allow_single_domain_urls = self._get_allow_single_label_domain(settings)
+ idp = settings['idp']
+ if not idp.get('entityId'):
+ errors.append('idp_entityId_not_found')
+
+ if not idp.get('singleSignOnService', {}).get('url'):
+ errors.append('idp_sso_not_found')
+ elif not validate_url(idp['singleSignOnService']['url'], allow_single_domain_urls):
+ errors.append('idp_sso_url_invalid')
+
+ slo_url = idp.get('singleLogoutService', {}).get('url')
+ if slo_url and not validate_url(slo_url, allow_single_domain_urls):
+ errors.append('idp_slo_url_invalid')
+
+ if 'security' in settings:
+ security = settings['security']
+
+ exists_x509 = bool(idp.get('x509cert'))
+ exists_fingerprint = bool(idp.get('certFingerprint'))
+
+ exists_multix509sign = 'x509certMulti' in idp and \
+ 'signing' in idp['x509certMulti'] and \
+ idp['x509certMulti']['signing']
+ exists_multix509enc = 'x509certMulti' in idp and \
+ 'encryption' in idp['x509certMulti'] and \
+ idp['x509certMulti']['encryption']
+
+ want_assert_sign = bool(security.get('wantAssertionsSigned'))
+ want_mes_signed = bool(security.get('wantMessagesSigned'))
+ nameid_enc = bool(security.get('nameIdEncrypted'))
+
+ if (want_assert_sign or want_mes_signed) and \
+ not(exists_x509 or exists_fingerprint or exists_multix509sign):
+ errors.append('idp_cert_or_fingerprint_not_found_and_required')
+ if nameid_enc and not (exists_x509 or exists_multix509enc):
+ errors.append('idp_cert_not_found_and_required')
+
+ return errors
+
+[docs] def check_sp_settings(self, settings):
+ """
+ Checks the SP settings info.
+
+ :param settings: Dict with settings data
+ :type settings: dict
+
+ :returns: Errors found on the SP settings data
+ :rtype: list
+ """
+ assert isinstance(settings, dict)
+
+ errors = []
+ if not isinstance(settings, dict) or not settings:
+ errors.append('invalid_syntax')
+ else:
+ if not settings.get('sp'):
+ errors.append('sp_not_found')
+ else:
+ allow_single_domain_urls = self._get_allow_single_label_domain(settings)
+ # check_sp_certs uses self.__sp so I add it
+ old_sp = self.__sp
+ self.__sp = settings['sp']
+
+ sp = settings['sp']
+ security = settings.get('security', {})
+
+ if not sp.get('entityId'):
+ errors.append('sp_entityId_not_found')
+
+ if not sp.get('assertionConsumerService', {}).get('url'):
+ errors.append('sp_acs_not_found')
+ elif not validate_url(sp['assertionConsumerService']['url'], allow_single_domain_urls):
+ errors.append('sp_acs_url_invalid')
+
+ if sp.get('attributeConsumingService'):
+ attributeConsumingService = sp['attributeConsumingService']
+ if 'serviceName' not in attributeConsumingService:
+ errors.append('sp_attributeConsumingService_serviceName_not_found')
+ elif not isinstance(attributeConsumingService['serviceName'], basestring):
+ errors.append('sp_attributeConsumingService_serviceName_type_invalid')
+
+ if 'requestedAttributes' not in attributeConsumingService:
+ errors.append('sp_attributeConsumingService_requestedAttributes_not_found')
+ elif not isinstance(attributeConsumingService['requestedAttributes'], list):
+ errors.append('sp_attributeConsumingService_serviceName_type_invalid')
+ else:
+ for req_attrib in attributeConsumingService['requestedAttributes']:
+ if 'name' not in req_attrib:
+ errors.append('sp_attributeConsumingService_requestedAttributes_name_not_found')
+ if 'name' in req_attrib and not req_attrib['name'].strip():
+ errors.append('sp_attributeConsumingService_requestedAttributes_name_invalid')
+ if 'attributeValue' in req_attrib and type(req_attrib['attributeValue']) != list:
+ errors.append('sp_attributeConsumingService_requestedAttributes_attributeValue_type_invalid')
+ if 'isRequired' in req_attrib and type(req_attrib['isRequired']) != bool:
+ errors.append('sp_attributeConsumingService_requestedAttributes_isRequired_type_invalid')
+
+ if "serviceDescription" in attributeConsumingService and not isinstance(attributeConsumingService['serviceDescription'], basestring):
+ errors.append('sp_attributeConsumingService_serviceDescription_type_invalid')
+
+ slo_url = sp.get('singleLogoutService', {}).get('url')
+ if slo_url and not validate_url(slo_url, allow_single_domain_urls):
+ errors.append('sp_sls_url_invalid')
+
+ if 'signMetadata' in security and isinstance(security['signMetadata'], dict):
+ if 'keyFileName' not in security['signMetadata'] or \
+ 'certFileName' not in security['signMetadata']:
+ errors.append('sp_signMetadata_invalid')
+
+ authn_sign = bool(security.get('authnRequestsSigned'))
+ logout_req_sign = bool(security.get('logoutRequestSigned'))
+ logout_res_sign = bool(security.get('logoutResponseSigned'))
+ want_assert_enc = bool(security.get('wantAssertionsEncrypted'))
+ want_nameid_enc = bool(security.get('wantNameIdEncrypted'))
+
+ if not self.check_sp_certs():
+ if authn_sign or logout_req_sign or logout_res_sign or \
+ want_assert_enc or want_nameid_enc:
+ errors.append('sp_cert_not_found_and_required')
+
+ if 'contactPerson' in settings:
+ types = settings['contactPerson'].keys()
+ valid_types = ['technical', 'support', 'administrative', 'billing', 'other']
+ for c_type in types:
+ if c_type not in valid_types:
+ errors.append('contact_type_invalid')
+ break
+
+ for c_type in settings['contactPerson']:
+ contact = settings['contactPerson'][c_type]
+ if ('givenName' not in contact or len(contact['givenName']) == 0) or \
+ ('emailAddress' not in contact or len(contact['emailAddress']) == 0):
+ errors.append('contact_not_enough_data')
+ break
+
+ if 'organization' in settings:
+ for org in settings['organization']:
+ organization = settings['organization'][org]
+ if ('name' not in organization or len(organization['name']) == 0) or \
+ ('displayname' not in organization or len(organization['displayname']) == 0) or \
+ ('url' not in organization or len(organization['url']) == 0):
+ errors.append('organization_not_enough_data')
+ break
+ # Restores the value that had the self.__sp
+ if 'old_sp' in locals():
+ self.__sp = old_sp
+
+ return errors
+
+[docs] def check_sp_certs(self):
+ """
+ Checks if the x509 certs of the SP exists and are valid.
+
+ :returns: If the x509 certs of the SP exists and are valid
+ :rtype: boolean
+ """
+ key = self.get_sp_key()
+ cert = self.get_sp_cert()
+ return key is not None and cert is not None
+
+[docs] def get_idp_sso_url(self):
+ """
+ Gets the IdP SSO URL.
+
+ :returns: An URL, the SSO endpoint of the IdP
+ :rtype: string
+ """
+ idp_data = self.get_idp_data()
+ return idp_data['singleSignOnService']['url']
+
+[docs] def get_idp_slo_url(self):
+ """
+ Gets the IdP SLO URL.
+
+ :returns: An URL, the SLO endpoint of the IdP
+ :rtype: string
+ """
+ idp_data = self.get_idp_data()
+ if 'url' in idp_data['singleLogoutService']:
+ return idp_data['singleLogoutService']['url']
+
+[docs] def get_idp_slo_response_url(self):
+ """
+ Gets the IdP SLO return URL for IdP-initiated logout.
+
+ :returns: an URL, the SLO return endpoint of the IdP
+ :rtype: string
+ """
+ idp_data = self.get_idp_data()
+ if 'url' in idp_data['singleLogoutService']:
+ return idp_data['singleLogoutService'].get('responseUrl', self.get_idp_slo_url())
+
+[docs] def get_sp_key(self):
+ """
+ Returns the x509 private key of the SP.
+
+ :returns: SP private key
+ :rtype: string or None
+ """
+ key = self.__sp.get('privateKey')
+ key_file_name = self.__paths['cert'] + 'sp.key'
+
+ if not key and exists(key_file_name):
+ with open(key_file_name) as f:
+ key = f.read()
+
+ return key or None
+
+[docs] def get_sp_cert(self):
+ """
+ Returns the x509 public cert of the SP.
+
+ :returns: SP public cert
+ :rtype: string or None
+ """
+ cert = self.__sp.get('x509cert')
+ cert_file_name = self.__paths['cert'] + 'sp.crt'
+
+ if not cert and exists(cert_file_name):
+ with open(cert_file_name) as f:
+ cert = f.read()
+
+ return cert or None
+
+[docs] def get_sp_cert_new(self):
+ """
+ Returns the x509 public of the SP planned
+ to be used soon instead the other public cert
+
+ :returns: SP public cert new
+ :rtype: string or None
+ """
+ cert = self.__sp.get('x509certNew')
+ cert_file_name = self.__paths['cert'] + 'sp_new.crt'
+
+ if not cert and exists(cert_file_name):
+ with open(cert_file_name) as f:
+ cert = f.read()
+
+ return cert or None
+
+[docs] def get_idp_cert(self):
+ """
+ Returns the x509 public cert of the IdP.
+
+ :returns: IdP public cert
+ :rtype: string
+ """
+ return self.__idp.get('x509cert')
+
+[docs] def get_idp_data(self):
+ """
+ Gets the IdP data.
+
+ :returns: IdP info
+ :rtype: dict
+ """
+ return self.__idp
+
+[docs] def get_sp_data(self):
+ """
+ Gets the SP data.
+
+ :returns: SP info
+ :rtype: dict
+ """
+ return self.__sp
+
+[docs] def get_security_data(self):
+ """
+ Gets security data.
+
+ :returns: Security info
+ :rtype: dict
+ """
+ return self.__security
+
+[docs] def get_contacts(self):
+ """
+ Gets contact data.
+
+ :returns: Contacts info
+ :rtype: dict
+ """
+ return self.__contacts
+
+[docs] def get_organization(self):
+ """
+ Gets organization data.
+
+ :returns: Organization info
+ :rtype: dict
+ """
+ return self.__organization
+
+[docs] def get_sp_metadata(self):
+ """
+ Gets the SP metadata. The XML representation.
+
+ :returns: SP metadata (xml)
+ :rtype: string
+ """
+ metadata = OneLogin_Saml2_Metadata.builder(
+ self.__sp, self.__security['authnRequestsSigned'],
+ self.__security['wantAssertionsSigned'],
+ self.__security['metadataValidUntil'],
+ self.__security['metadataCacheDuration'],
+ self.get_contacts(), self.get_organization()
+ )
+
+ add_encryption = self.__security['wantNameIdEncrypted'] or self.__security['wantAssertionsEncrypted']
+
+ cert_new = self.get_sp_cert_new()
+ metadata = OneLogin_Saml2_Metadata.add_x509_key_descriptors(metadata, cert_new, add_encryption)
+
+ cert = self.get_sp_cert()
+ metadata = OneLogin_Saml2_Metadata.add_x509_key_descriptors(metadata, cert, add_encryption)
+
+ # Sign metadata
+ if 'signMetadata' in self.__security and self.__security['signMetadata'] is not False:
+ if self.__security['signMetadata'] is True:
+ # Use the SP's normal key to sign the metadata:
+ if not cert:
+ raise OneLogin_Saml2_Error(
+ 'Cannot sign metadata: missing SP public key certificate.',
+ OneLogin_Saml2_Error.PUBLIC_CERT_FILE_NOT_FOUND
+ )
+ cert_metadata = cert
+ key_metadata = self.get_sp_key()
+ if not key_metadata:
+ raise OneLogin_Saml2_Error(
+ 'Cannot sign metadata: missing SP private key.',
+ OneLogin_Saml2_Error.PRIVATE_KEY_FILE_NOT_FOUND
+ )
+ else:
+ # Use a custom key to sign the metadata:
+ if ('keyFileName' not in self.__security['signMetadata'] or
+ 'certFileName' not in self.__security['signMetadata']):
+ raise OneLogin_Saml2_Error(
+ 'Invalid Setting: signMetadata value of the sp is not valid',
+ OneLogin_Saml2_Error.SETTINGS_INVALID_SYNTAX
+ )
+ key_file_name = self.__security['signMetadata']['keyFileName']
+ cert_file_name = self.__security['signMetadata']['certFileName']
+ key_metadata_file = self.__paths['cert'] + key_file_name
+ cert_metadata_file = self.__paths['cert'] + cert_file_name
+
+ try:
+ with open(key_metadata_file, 'r') as f_metadata_key:
+ key_metadata = f_metadata_key.read()
+ except IOError:
+ raise OneLogin_Saml2_Error(
+ 'Private key file not readable: %s',
+ OneLogin_Saml2_Error.PRIVATE_KEY_FILE_NOT_FOUND,
+ key_metadata_file
+ )
+
+ try:
+ with open(cert_metadata_file, 'r') as f_metadata_cert:
+ cert_metadata = f_metadata_cert.read()
+ except IOError:
+ raise OneLogin_Saml2_Error(
+ 'Public cert file not readable: %s',
+ OneLogin_Saml2_Error.PUBLIC_CERT_FILE_NOT_FOUND,
+ cert_metadata_file
+ )
+
+ signature_algorithm = self.__security['signatureAlgorithm']
+ digest_algorithm = self.__security['digestAlgorithm']
+
+ metadata = OneLogin_Saml2_Metadata.sign_metadata(metadata, key_metadata, cert_metadata, signature_algorithm, digest_algorithm)
+
+ return metadata
+
+[docs] def validate_metadata(self, xml):
+ """
+ Validates an XML SP Metadata.
+
+ :param xml: Metadata's XML that will be validate
+ :type xml: string
+
+ :returns: The list of found errors
+ :rtype: list
+ """
+
+ assert isinstance(xml, basestring)
+
+ if len(xml) == 0:
+ raise Exception('Empty string supplied as input')
+
+ errors = []
+ res = OneLogin_Saml2_Utils.validate_xml(xml, 'saml-schema-metadata-2.0.xsd', self.__debug)
+ if not isinstance(res, Document):
+ errors.append(res)
+ else:
+ dom = res
+ element = dom.documentElement
+ if element.tagName not in 'md:EntityDescriptor':
+ errors.append('noEntityDescriptor_xml')
+ else:
+ if len(element.getElementsByTagName('md:SPSSODescriptor')) != 1:
+ errors.append('onlySPSSODescriptor_allowed_xml')
+ else:
+ valid_until = cache_duration = expire_time = None
+
+ if element.hasAttribute('validUntil'):
+ valid_until = OneLogin_Saml2_Utils.parse_SAML_to_time(element.getAttribute('validUntil'))
+ if element.hasAttribute('cacheDuration'):
+ cache_duration = element.getAttribute('cacheDuration')
+
+ expire_time = OneLogin_Saml2_Utils.get_expire_time(cache_duration, valid_until)
+ if expire_time is not None and int(time()) > int(expire_time):
+ errors.append('expired_xml')
+
+ # TODO: Validate Sign
+
+ return errors
+
+[docs] def format_idp_cert(self):
+ """
+ Formats the IdP cert.
+ """
+ self.__idp['x509cert'] = OneLogin_Saml2_Utils.format_cert(self.__idp['x509cert'])
+
+[docs] def format_idp_cert_multi(self):
+ """
+ Formats the Multple IdP certs.
+ """
+ if 'x509certMulti' in self.__idp:
+ if 'signing' in self.__idp['x509certMulti']:
+ for idx in range(len(self.__idp['x509certMulti']['signing'])):
+ self.__idp['x509certMulti']['signing'][idx] = OneLogin_Saml2_Utils.format_cert(self.__idp['x509certMulti']['signing'][idx])
+
+ if 'encryption' in self.__idp['x509certMulti']:
+ for idx in range(len(self.__idp['x509certMulti']['encryption'])):
+ self.__idp['x509certMulti']['encryption'][idx] = OneLogin_Saml2_Utils.format_cert(self.__idp['x509certMulti']['encryption'][idx])
+
+[docs] def format_sp_cert(self):
+ """
+ Formats the SP cert.
+ """
+ self.__sp['x509cert'] = OneLogin_Saml2_Utils.format_cert(self.__sp['x509cert'])
+
+[docs] def format_sp_cert_new(self):
+ """
+ Formats the SP cert.
+ """
+ self.__sp['x509certNew'] = OneLogin_Saml2_Utils.format_cert(self.__sp['x509certNew'])
+
+[docs] def format_sp_key(self):
+ """
+ Formats the private key.
+ """
+ self.__sp['privateKey'] = OneLogin_Saml2_Utils.format_private_key(self.__sp['privateKey'])
+
+[docs] def get_errors(self):
+ """
+ Returns an array with the errors, the array is empty when the settings is ok.
+
+ :returns: Errors
+ :rtype: list
+ """
+ return self.__errors
+
+[docs] def set_strict(self, value):
+ """
+ Activates or deactivates the strict mode.
+
+ :param value: Strict parameter
+ :type xml: boolean
+ """
+ assert isinstance(value, bool)
+
+ self.__strict = value
+
+[docs] def is_strict(self):
+ """
+ Returns if the 'strict' mode is active.
+
+ :returns: Strict parameter
+ :rtype: boolean
+ """
+ return self.__strict
+
+[docs] def is_debug_active(self):
+ """
+ Returns if the debug is active.
+
+ :returns: Debug parameter
+ :rtype: boolean
+ """
+ return self.__debug
+
+ def _get_allow_single_label_domain(self, settings):
+ security = settings.get('security', {})
+ return 'allowSingleLabelDomains' in security.keys() and security['allowSingleLabelDomains']
+
+# -*- coding: utf-8 -*-
+
+""" OneLogin_Saml2_Utils class
+
+MIT License
+
+Auxiliary class of Python Toolkit.
+
+"""
+
+import base64
+from copy import deepcopy
+from datetime import datetime
+import calendar
+from hashlib import sha1, sha256, sha384, sha512
+from isodate import parse_duration as duration_parser
+from lxml import etree
+from os.path import basename, dirname, join
+import re
+from sys import stderr
+from tempfile import NamedTemporaryFile
+from textwrap import wrap
+from urllib import quote_plus
+from urlparse import urlsplit, urlunsplit
+from uuid import uuid4
+from xml.dom.minidom import Document, Element
+from defusedxml.minidom import parseString
+from functools import wraps
+
+import zlib
+
+import dm.xmlsec.binding as xmlsec
+from dm.xmlsec.binding.tmpl import EncData, Signature
+
+from onelogin.saml2.constants import OneLogin_Saml2_Constants
+from onelogin.saml2.errors import OneLogin_Saml2_Error, OneLogin_Saml2_ValidationError
+from onelogin.saml2.xmlparser import tostring, fromstring
+
+
+if not globals().get('xmlsec_setup', False):
+ xmlsec.initialize()
+ globals()['xmlsec_setup'] = True
+
+
+[docs]def return_false_on_exception(func):
+ """
+ Decorator. When applied to a function, it will, by default, suppress any exceptions
+ raised by that function and return False. It may be overridden by passing a
+ "raise_exceptions" keyword argument when calling the wrapped function.
+ """
+ @wraps(func)
+ def exceptfalse(*args, **kwargs):
+ if not kwargs.pop('raise_exceptions', False):
+ try:
+ return func(*args, **kwargs)
+ except Exception:
+ return False
+ else:
+ return func(*args, **kwargs)
+ return exceptfalse
+
+
+[docs]def print_xmlsec_errors(filename, line, func, error_object, error_subject, reason, msg):
+ """
+ Auxiliary method. It overrides the default xmlsec debug message.
+ """
+
+ info = []
+ if error_object != "unknown":
+ info.append("obj=" + error_object)
+ if error_subject != "unknown":
+ info.append("subject=" + error_subject)
+ if msg.strip():
+ info.append("msg=" + msg)
+ if reason != 1:
+ info.append("errno=%d" % reason)
+ if info:
+ print("%s:%d(%s)" % (filename, line, func), " ".join(info))
+
+
+[docs]class OneLogin_Saml2_Utils(object):
+ """
+
+ Auxiliary class that contains several utility methods to parse time,
+ urls, add sign, encrypt, decrypt, sign validation, handle xml ...
+
+ """
+
+ RESPONSE_SIGNATURE_XPATH = '/samlp:Response/ds:Signature'
+ ASSERTION_SIGNATURE_XPATH = '/samlp:Response/saml:Assertion/ds:Signature'
+
+ TIME_FORMAT = "%Y-%m-%dT%H:%M:%SZ"
+ TIME_FORMAT_2 = "%Y-%m-%dT%H:%M:%S.%fZ"
+ TIME_FORMAT_WITH_FRAGMENT = re.compile(r'^(\d{4,4}-\d{2,2}-\d{2,2}T\d{2,2}:\d{2,2}:\d{2,2})(\.\d*)?Z?$')
+
+[docs] @staticmethod
+ def decode_base64_and_inflate(value):
+ """
+ base64 decodes and then inflates according to RFC1951
+ :param value: a deflated and encoded string
+ :type value: string
+ :returns: the string after decoding and inflating
+ :rtype: string
+ """
+ decoded = base64.b64decode(value)
+ # We try to inflate
+ try:
+ result = zlib.decompress(decoded, -15)
+ except Exception:
+ result = decoded
+
+ return result.decode('utf-8')
+
+[docs] @staticmethod
+ def deflate_and_base64_encode(value):
+ """
+ Deflates and then base64 encodes a string
+ :param value: The string to deflate and encode
+ :type value: string
+ :returns: The deflated and encoded string
+ :rtype: string
+ """
+ return base64.b64encode(zlib.compress(value.encode('utf-8'))[2:-4])
+
+[docs] @staticmethod
+ def validate_xml(xml, schema, debug=False):
+ """
+ Validates a xml against a schema
+ :param xml: The xml that will be validated
+ :type: string|DomDocument
+ :param schema: The schema
+ :type: string
+ :param debug: If debug is active, the parse-errors will be showed
+ :type: bool
+ :returns: Error code or the DomDocument of the xml
+ :rtype: string
+ """
+ assert isinstance(xml, basestring) or isinstance(xml, Document) or isinstance(xml, etree._Element)
+ assert isinstance(schema, basestring)
+
+ if isinstance(xml, Document):
+ xml = xml.toxml()
+ elif isinstance(xml, etree._Element):
+ xml = tostring(xml, encoding='unicode')
+
+ # Switch to lxml for schema validation
+ try:
+ dom = fromstring(xml.encode('utf-8'), forbid_dtd=True)
+ except Exception:
+ return 'unloaded_xml'
+
+ schema_file = join(dirname(__file__), 'schemas', schema)
+ f_schema = open(schema_file, 'r')
+ schema_doc = etree.parse(f_schema)
+ f_schema.close()
+ xmlschema = etree.XMLSchema(schema_doc)
+
+ if not xmlschema.validate(dom):
+ if debug:
+ stderr.write('Errors validating the metadata')
+ stderr.write(':\n\n')
+ for error in xmlschema.error_log:
+ stderr.write('%s\n' % error.message)
+
+ return 'invalid_xml'
+
+ return parseString(tostring(dom, encoding='unicode').encode('utf-8'), forbid_dtd=True, forbid_entities=True, forbid_external=True)
+
+[docs] @staticmethod
+ def element_text(node):
+ # Double check, the LXML Parser already removes comments
+ etree.strip_tags(node, etree.Comment)
+ return node.text
+
+[docs] @staticmethod
+ def format_cert(cert, heads=True):
+ """
+ Returns a x509 cert (adding header & footer if required).
+
+ :param cert: A x509 unformatted cert
+ :type: string
+
+ :param heads: True if we want to include head and footer
+ :type: boolean
+
+ :returns: Formatted cert
+ :rtype: string
+ """
+ x509_cert = cert.replace('\x0D', '')
+ x509_cert = x509_cert.replace('\r', '')
+ x509_cert = x509_cert.replace('\n', '')
+ if len(x509_cert) > 0:
+ x509_cert = x509_cert.replace('-----BEGIN CERTIFICATE-----', '')
+ x509_cert = x509_cert.replace('-----END CERTIFICATE-----', '')
+ x509_cert = x509_cert.replace(' ', '')
+
+ if heads:
+ x509_cert = "-----BEGIN CERTIFICATE-----\n" + "\n".join(wrap(x509_cert, 64)) + "\n-----END CERTIFICATE-----\n"
+
+ return x509_cert
+
+[docs] @staticmethod
+ def format_private_key(key, heads=True):
+ """
+ Returns a private key (adding header & footer if required).
+
+ :param key A private key
+ :type: string
+
+ :param heads: True if we want to include head and footer
+ :type: boolean
+
+ :returns: Formatted private key
+ :rtype: string
+ """
+ private_key = key.replace('\x0D', '')
+ private_key = private_key.replace('\r', '')
+ private_key = private_key.replace('\n', '')
+ if len(private_key) > 0:
+ if private_key.find('-----BEGIN PRIVATE KEY-----') != -1:
+ private_key = private_key.replace('-----BEGIN PRIVATE KEY-----', '')
+ private_key = private_key.replace('-----END PRIVATE KEY-----', '')
+ private_key = private_key.replace(' ', '')
+ if heads:
+ private_key = "-----BEGIN PRIVATE KEY-----\n" + "\n".join(wrap(private_key, 64)) + "\n-----END PRIVATE KEY-----\n"
+ else:
+ private_key = private_key.replace('-----BEGIN RSA PRIVATE KEY-----', '')
+ private_key = private_key.replace('-----END RSA PRIVATE KEY-----', '')
+ private_key = private_key.replace(' ', '')
+ if heads:
+ private_key = "-----BEGIN RSA PRIVATE KEY-----\n" + "\n".join(wrap(private_key, 64)) + "\n-----END RSA PRIVATE KEY-----\n"
+ return private_key
+
+[docs] @staticmethod
+ def redirect(url, parameters={}, request_data={}):
+ """
+ Executes a redirection to the provided url (or return the target url).
+
+ :param url: The target url
+ :type: string
+
+ :param parameters: Extra parameters to be passed as part of the url
+ :type: dict
+
+ :param request_data: The request as a dict
+ :type: dict
+
+ :returns: Url
+ :rtype: string
+ """
+ assert isinstance(url, basestring)
+ assert isinstance(parameters, dict)
+
+ if url.startswith('/'):
+ url = '%s%s' % (OneLogin_Saml2_Utils.get_self_url_host(request_data), url)
+
+ # Verify that the URL is to a http or https site.
+ if re.search('^https?://', url) is None:
+ raise OneLogin_Saml2_Error(
+ 'Redirect to invalid URL: ' + url,
+ OneLogin_Saml2_Error.REDIRECT_INVALID_URL
+ )
+
+ # Add encoded parameters
+ if url.find('?') < 0:
+ param_prefix = '?'
+ else:
+ param_prefix = '&'
+
+ for name, value in parameters.items():
+
+ if value is None:
+ param = quote_plus(name)
+ elif isinstance(value, list):
+ param = ''
+ for val in value:
+ param += quote_plus(name) + '[]=' + quote_plus(val) + '&'
+ if len(param) > 0:
+ param = param[0:-1]
+ else:
+ param = quote_plus(name) + '=' + quote_plus(value)
+
+ if param:
+ url += param_prefix + param
+ param_prefix = '&'
+
+ return url
+
+[docs] @staticmethod
+ def get_self_url_host(request_data):
+ """
+ Returns the protocol + the current host + the port (if different than
+ common ports).
+
+ :param request_data: The request as a dict
+ :type: dict
+
+ :return: Url
+ :rtype: string
+ """
+ current_host = OneLogin_Saml2_Utils.get_self_host(request_data)
+ port = ''
+ if OneLogin_Saml2_Utils.is_https(request_data):
+ protocol = 'https'
+ else:
+ protocol = 'http'
+
+ if 'server_port' in request_data and request_data['server_port'] is not None:
+ port_number = str(request_data['server_port'])
+ port = ':' + port_number
+
+ if protocol == 'http' and port_number == '80':
+ port = ''
+ elif protocol == 'https' and port_number == '443':
+ port = ''
+
+ return '%s://%s%s' % (protocol, current_host, port)
+
+[docs] @staticmethod
+ def get_self_host(request_data):
+ """
+ Returns the current host.
+
+ :param request_data: The request as a dict
+ :type: dict
+
+ :return: The current host
+ :rtype: string
+ """
+ if 'http_host' in request_data:
+ current_host = request_data['http_host']
+ elif 'server_name' in request_data:
+ current_host = request_data['server_name']
+ else:
+ raise Exception('No hostname defined')
+
+ if ':' in current_host:
+ current_host_data = current_host.split(':')
+ possible_port = current_host_data[-1]
+ try:
+ possible_port = float(possible_port)
+ current_host = current_host_data[0]
+ except ValueError:
+ current_host = ':'.join(current_host_data)
+
+ return current_host
+
+[docs] @staticmethod
+ def is_https(request_data):
+ """
+ Checks if https or http.
+
+ :param request_data: The request as a dict
+ :type: dict
+
+ :return: False if https is not active
+ :rtype: boolean
+ """
+ is_https = 'https' in request_data and request_data['https'] != 'off'
+ is_https = is_https or ('server_port' in request_data and str(request_data['server_port']) == '443')
+ return is_https
+
+[docs] @staticmethod
+ def get_self_url_no_query(request_data):
+ """
+ Returns the URL of the current host + current view.
+
+ :param request_data: The request as a dict
+ :type: dict
+
+ :return: The url of current host + current view
+ :rtype: string
+ """
+ self_url_host = OneLogin_Saml2_Utils.get_self_url_host(request_data)
+ script_name = request_data['script_name']
+ if script_name:
+ if script_name[0] != '/':
+ script_name = '/' + script_name
+ else:
+ script_name = ''
+ self_url_no_query = self_url_host + script_name
+ if 'path_info' in request_data:
+ self_url_no_query += request_data['path_info']
+
+ return self_url_no_query
+
+[docs] @staticmethod
+ def get_self_routed_url_no_query(request_data):
+ """
+ Returns the routed URL of the current host + current view.
+
+ :param request_data: The request as a dict
+ :type: dict
+
+ :return: The url of current host + current view
+ :rtype: string
+ """
+ self_url_host = OneLogin_Saml2_Utils.get_self_url_host(request_data)
+ route = ''
+ if 'request_uri' in request_data.keys() and request_data['request_uri']:
+ route = request_data['request_uri']
+ if 'query_string' in request_data.keys() and request_data['query_string']:
+ route = route.replace(request_data['query_string'], '')
+
+ return self_url_host + route
+
+[docs] @staticmethod
+ def get_self_url(request_data):
+ """
+ Returns the URL of the current host + current view + query.
+
+ :param request_data: The request as a dict
+ :type: dict
+
+ :return: The url of current host + current view + query
+ :rtype: string
+ """
+ self_url_host = OneLogin_Saml2_Utils.get_self_url_host(request_data)
+
+ request_uri = ''
+ if 'request_uri' in request_data:
+ request_uri = request_data['request_uri']
+ if not request_uri.startswith('/'):
+ match = re.search('^https?://[^/]*(/.*)', request_uri)
+ if match is not None:
+ request_uri = match.groups()[0]
+
+ return self_url_host + request_uri
+
+[docs] @staticmethod
+ def generate_unique_id():
+ """
+ Generates an unique string (used for example as ID for assertions).
+
+ :return: A unique string
+ :rtype: string
+ """
+ return 'ONELOGIN_%s' % sha1(uuid4().hex).hexdigest()
+
+[docs] @staticmethod
+ def parse_time_to_SAML(time):
+ r"""
+ Converts a UNIX timestamp to SAML2 timestamp on the form
+ yyyy-mm-ddThh:mm:ss(\.s+)?Z.
+
+ :param time: The time we should convert (DateTime).
+ :type: string
+
+ :return: SAML2 timestamp.
+ :rtype: string
+ """
+ data = datetime.utcfromtimestamp(float(time))
+ return data.strftime(OneLogin_Saml2_Utils.TIME_FORMAT)
+
+[docs] @staticmethod
+ def parse_SAML_to_time(timestr):
+ r"""
+ Converts a SAML2 timestamp on the form yyyy-mm-ddThh:mm:ss(\.s+)?Z
+ to a UNIX timestamp. The sub-second part is ignored.
+
+ :param time: The time we should convert (SAML Timestamp).
+ :type: string
+
+ :return: Converted to a unix timestamp.
+ :rtype: int
+ """
+ try:
+ data = datetime.strptime(timestr, OneLogin_Saml2_Utils.TIME_FORMAT)
+ except ValueError:
+ try:
+ data = datetime.strptime(timestr, OneLogin_Saml2_Utils.TIME_FORMAT_2)
+ except ValueError:
+ elem = OneLogin_Saml2_Utils.TIME_FORMAT_WITH_FRAGMENT.match(timestr)
+ if not elem:
+ raise Exception("time data %s does not match format %s" % (timestr, r'yyyy-mm-ddThh:mm:ss(\.s+)?Z'))
+ data = datetime.strptime(elem.groups()[0] + "Z", OneLogin_Saml2_Utils.TIME_FORMAT)
+
+ return calendar.timegm(data.utctimetuple())
+
+[docs] @staticmethod
+ def now():
+ """
+ :return: unix timestamp of actual time.
+ :rtype: int
+ """
+ return calendar.timegm(datetime.utcnow().utctimetuple())
+
+[docs] @staticmethod
+ def parse_duration(duration, timestamp=None):
+ """
+ Interprets a ISO8601 duration value relative to a given timestamp.
+
+ :param duration: The duration, as a string.
+ :type: string
+
+ :param timestamp: The unix timestamp we should apply the duration to.
+ Optional, default to the current time.
+ :type: string
+
+ :return: The new timestamp, after the duration is applied.
+ :rtype: int
+ """
+ assert isinstance(duration, basestring)
+ assert timestamp is None or isinstance(timestamp, int)
+
+ timedelta = duration_parser(duration)
+ if timestamp is None:
+ data = datetime.utcnow() + timedelta
+ else:
+ data = datetime.utcfromtimestamp(timestamp) + timedelta
+ return calendar.timegm(data.utctimetuple())
+
+[docs] @staticmethod
+ def get_expire_time(cache_duration=None, valid_until=None):
+ """
+ Compares 2 dates and returns the earliest.
+
+ :param cache_duration: The duration, as a string.
+ :type: string
+
+ :param valid_until: The valid until date, as a string or as a timestamp
+ :type: string
+
+ :return: The expiration time.
+ :rtype: int
+ """
+ expire_time = None
+
+ if cache_duration is not None:
+ expire_time = OneLogin_Saml2_Utils.parse_duration(cache_duration)
+
+ if valid_until is not None:
+ if isinstance(valid_until, int):
+ valid_until_time = valid_until
+ else:
+ valid_until_time = OneLogin_Saml2_Utils.parse_SAML_to_time(valid_until)
+ if expire_time is None or expire_time > valid_until_time:
+ expire_time = valid_until_time
+
+ if expire_time is not None:
+ return '%d' % expire_time
+ return None
+
+[docs] @staticmethod
+ def query(dom, query, context=None, tagid=None):
+ """
+ Extracts nodes that match the query from the Element
+
+ :param dom: The root of the lxml objet
+ :type: Element
+
+ :param query: Xpath Expresion
+ :type: string
+
+ :param context: Context Node
+ :type: DOMElement
+
+ :param tagid: Tag ID
+ :type: string
+
+ :returns: The queried nodes
+ :rtype: list
+ """
+ if context is None:
+ source = dom
+ else:
+ source = context
+
+ if tagid is None:
+ return source.xpath(query, namespaces=OneLogin_Saml2_Constants.NSMAP)
+ else:
+ return source.xpath(query, tagid=tagid, namespaces=OneLogin_Saml2_Constants.NSMAP)
+
+[docs] @staticmethod
+ def delete_local_session(callback=None):
+ """
+ Deletes the local session.
+ """
+
+ if callback is not None:
+ callback()
+
+[docs] @staticmethod
+ def calculate_x509_fingerprint(x509_cert, alg='sha1'):
+ """
+ Calculates the fingerprint of a formatted x509cert.
+
+ :param x509_cert: x509 cert formatted
+ :type: string
+
+ :param alg: The algorithm to build the fingerprint
+ :type: string
+
+ :returns: fingerprint
+ :rtype: string
+ """
+ assert isinstance(x509_cert, basestring)
+
+ lines = x509_cert.split('\n')
+ data = ''
+ inData = False
+
+ for line in lines:
+ # Remove '\r' from end of line if present.
+ line = line.rstrip()
+ if not inData:
+ if line == '-----BEGIN CERTIFICATE-----':
+ inData = True
+ elif line == '-----BEGIN PUBLIC KEY-----' or line == '-----BEGIN RSA PRIVATE KEY-----':
+ # This isn't an X509 certificate.
+ return None
+ else:
+ if line == '-----END CERTIFICATE-----':
+ break
+
+ # Append the current line to the certificate data.
+ data += line
+
+ if not data:
+ return None
+
+ decoded_data = base64.b64decode(data)
+
+ if alg == 'sha512':
+ fingerprint = sha512(decoded_data)
+ elif alg == 'sha384':
+ fingerprint = sha384(decoded_data)
+ elif alg == 'sha256':
+ fingerprint = sha256(decoded_data)
+ else:
+ fingerprint = sha1(decoded_data)
+
+ return fingerprint.hexdigest().lower()
+
+[docs] @staticmethod
+ def format_finger_print(fingerprint):
+ """
+ Formats a fingerprint.
+
+ :param fingerprint: fingerprint
+ :type: string
+
+ :returns: Formatted fingerprint
+ :rtype: string
+ """
+ formated_fingerprint = fingerprint.replace(':', '')
+ return formated_fingerprint.lower()
+
+[docs] @staticmethod
+ def generate_name_id(value, sp_nq, sp_format=None, cert=None, debug=False, nq=None):
+ """
+ Generates a nameID.
+
+ :param value: fingerprint
+ :type: string
+
+ :param sp_nq: SP Name Qualifier
+ :type: string
+
+ :param sp_format: SP Format
+ :type: string
+
+ :param cert: IdP Public Cert to encrypt the nameID
+ :type: string
+
+ :param debug: Activate the xmlsec debug
+ :type: bool
+
+ :param nq: IDP Name Qualifier
+ :type: string
+
+ :returns: DOMElement | XMLSec nameID
+ :rtype: string
+ """
+ doc = Document()
+ name_id_container = doc.createElementNS(OneLogin_Saml2_Constants.NS_SAML, 'container')
+ name_id_container.setAttribute("xmlns:saml", OneLogin_Saml2_Constants.NS_SAML)
+
+ name_id = doc.createElement('saml:NameID')
+ if sp_nq is not None:
+ name_id.setAttribute('SPNameQualifier', sp_nq)
+ if nq is not None:
+ name_id.setAttribute('NameQualifier', nq)
+ if sp_format is not None:
+ name_id.setAttribute('Format', sp_format)
+ name_id.appendChild(doc.createTextNode(value))
+ name_id_container.appendChild(name_id)
+
+ if cert is not None:
+ xml = name_id_container.toxml()
+ elem = fromstring(xml, forbid_dtd=True)
+
+ error_callback_method = None
+ if debug:
+ error_callback_method = print_xmlsec_errors
+ xmlsec.set_error_callback(error_callback_method)
+
+ # Load the public cert
+ mngr = xmlsec.KeysMngr()
+ file_cert = OneLogin_Saml2_Utils.write_temp_file(cert)
+ key_data = xmlsec.Key.load(file_cert.name, xmlsec.KeyDataFormatCertPem, None)
+ key_data.name = basename(file_cert.name)
+ mngr.addKey(key_data)
+ file_cert.close()
+
+ # Prepare for encryption
+ enc_data = EncData(xmlsec.TransformAes128Cbc, type=xmlsec.TypeEncElement)
+ enc_data.ensureCipherValue()
+ key_info = enc_data.ensureKeyInfo()
+ # enc_key = key_info.addEncryptedKey(xmlsec.TransformRsaPkcs1)
+ enc_key = key_info.addEncryptedKey(xmlsec.TransformRsaOaep)
+ enc_key.ensureCipherValue()
+
+ # Encrypt!
+ enc_ctx = xmlsec.EncCtx(mngr)
+ enc_ctx.encKey = xmlsec.Key.generate(xmlsec.KeyDataAes, 128, xmlsec.KeyDataTypeSession)
+
+ edata = enc_ctx.encryptXml(enc_data, elem[0])
+
+ newdoc = parseString(tostring(edata, encoding='unicode').encode('utf-8'), forbid_dtd=True, forbid_entities=True, forbid_external=True)
+
+ if newdoc.hasChildNodes():
+ child = newdoc.firstChild
+ child.removeAttribute('xmlns')
+ child.removeAttribute('xmlns:saml')
+ child.setAttribute('xmlns:xenc', OneLogin_Saml2_Constants.NS_XENC)
+ child.setAttribute('xmlns:dsig', OneLogin_Saml2_Constants.NS_DS)
+
+ nodes = newdoc.getElementsByTagName("*")
+ for node in nodes:
+ if node.tagName == 'ns0:KeyInfo':
+ node.tagName = 'dsig:KeyInfo'
+ node.removeAttribute('xmlns:ns0')
+ node.setAttribute('xmlns:dsig', OneLogin_Saml2_Constants.NS_DS)
+ else:
+ node.tagName = 'xenc:' + node.tagName
+
+ encrypted_id = newdoc.createElement('saml:EncryptedID')
+ encrypted_data = newdoc.replaceChild(encrypted_id, newdoc.firstChild)
+ encrypted_id.appendChild(encrypted_data)
+ return newdoc.saveXML(encrypted_id)
+ else:
+ return doc.saveXML(name_id)
+
+[docs] @staticmethod
+ def get_status(dom):
+ """
+ Gets Status from a Response.
+
+ :param dom: The Response as XML
+ :type: Document
+
+ :returns: The Status, an array with the code and a message.
+ :rtype: dict
+ """
+ status = {}
+
+ status_entry = OneLogin_Saml2_Utils.query(dom, '/samlp:Response/samlp:Status')
+ if len(status_entry) != 1:
+ raise OneLogin_Saml2_ValidationError(
+ 'Missing Status on response',
+ OneLogin_Saml2_ValidationError.MISSING_STATUS
+ )
+
+ code_entry = OneLogin_Saml2_Utils.query(dom, '/samlp:Response/samlp:Status/samlp:StatusCode', status_entry[0])
+ if len(code_entry) != 1:
+ raise OneLogin_Saml2_ValidationError(
+ 'Missing Status Code on response',
+ OneLogin_Saml2_ValidationError.MISSING_STATUS_CODE
+ )
+ code = code_entry[0].values()[0]
+ status['code'] = code
+
+ status['msg'] = ''
+ message_entry = OneLogin_Saml2_Utils.query(dom, '/samlp:Response/samlp:Status/samlp:StatusMessage', status_entry[0])
+ if len(message_entry) == 0:
+ subcode_entry = OneLogin_Saml2_Utils.query(dom, '/samlp:Response/samlp:Status/samlp:StatusCode/samlp:StatusCode', status_entry[0])
+ if len(subcode_entry) == 1:
+ status['msg'] = subcode_entry[0].values()[0]
+ elif len(message_entry) == 1:
+ status['msg'] = OneLogin_Saml2_Utils.element_text(message_entry[0])
+
+ return status
+
+[docs] @staticmethod
+ def decrypt_element(encrypted_data, key, debug=False, inplace=False):
+ """
+ Decrypts an encrypted element.
+
+ :param encrypted_data: The encrypted data.
+ :type: lxml.etree.Element | DOMElement | basestring
+
+ :param key: The key.
+ :type: string
+
+ :param debug: Activate the xmlsec debug
+ :type: bool
+
+ :param inplace: update passed data with decrypted result
+ :type: bool
+
+ :returns: The decrypted element.
+ :rtype: lxml.etree.Element
+ """
+ if isinstance(encrypted_data, Element):
+ encrypted_data = fromstring(str(encrypted_data.toxml()), forbid_dtd=True)
+ elif isinstance(encrypted_data, basestring):
+ encrypted_data = fromstring(str(encrypted_data), forbid_dtd=True)
+ elif not inplace and isinstance(encrypted_data, etree._Element):
+ encrypted_data = deepcopy(encrypted_data)
+
+ error_callback_method = None
+ if debug:
+ error_callback_method = print_xmlsec_errors
+ xmlsec.set_error_callback(error_callback_method)
+
+ mngr = xmlsec.KeysMngr()
+
+ key = xmlsec.Key.loadMemory(key, xmlsec.KeyDataFormatPem, None)
+ mngr.addKey(key)
+ enc_ctx = xmlsec.EncCtx(mngr)
+
+ return enc_ctx.decrypt(encrypted_data)
+
+[docs] @staticmethod
+ def write_temp_file(content):
+ """
+ Writes some content into a temporary file and returns it.
+
+ :param content: The file content
+ :type: string
+
+ :returns: The temporary file
+ :rtype: file-like object
+ """
+ f_temp = NamedTemporaryFile(delete=True)
+ f_temp.file.write(content)
+ f_temp.file.flush()
+ return f_temp
+
+[docs] @staticmethod
+ def add_sign(xml, key, cert, debug=False, sign_algorithm=OneLogin_Saml2_Constants.RSA_SHA256, digest_algorithm=OneLogin_Saml2_Constants.SHA256):
+ """
+ Adds signature key and senders certificate to an element (Message or
+ Assertion).
+
+ :param xml: The element we should sign
+ :type: string | Document
+
+ :param key: The private key
+ :type: string
+
+ :param cert: The public
+ :type: string
+
+ :param debug: Activate the xmlsec debug
+ :type: bool
+
+ :param sign_algorithm: Signature algorithm method
+ :type sign_algorithm: string
+
+ :param digest_algorithm: Digest algorithm method
+ :type digest_algorithm: string
+
+ :returns: Signed XML
+ :rtype: string
+ """
+ if xml is None or xml == '':
+ raise Exception('Empty string supplied as input')
+ elif isinstance(xml, etree._Element):
+ elem = xml
+ elif isinstance(xml, Document):
+ xml = xml.toxml()
+ elem = fromstring(xml.encode('utf-8'), forbid_dtd=True)
+ elif isinstance(xml, Element):
+ xml.setAttributeNS(
+ unicode(OneLogin_Saml2_Constants.NS_SAMLP),
+ 'xmlns:samlp',
+ unicode(OneLogin_Saml2_Constants.NS_SAMLP)
+ )
+ xml.setAttributeNS(
+ unicode(OneLogin_Saml2_Constants.NS_SAML),
+ 'xmlns:saml',
+ unicode(OneLogin_Saml2_Constants.NS_SAML)
+ )
+ xml = xml.toxml()
+ elem = fromstring(xml.encode('utf-8'), forbid_dtd=True)
+ elif isinstance(xml, basestring):
+ elem = fromstring(xml.encode('utf-8'), forbid_dtd=True)
+ else:
+ raise Exception('Error parsing xml string')
+
+ error_callback_method = None
+ if debug:
+ error_callback_method = print_xmlsec_errors
+ xmlsec.set_error_callback(error_callback_method)
+
+ sign_algorithm_transform_map = {
+ OneLogin_Saml2_Constants.DSA_SHA1: xmlsec.TransformDsaSha1,
+ OneLogin_Saml2_Constants.RSA_SHA1: xmlsec.TransformRsaSha1,
+ OneLogin_Saml2_Constants.RSA_SHA256: xmlsec.TransformRsaSha256,
+ OneLogin_Saml2_Constants.RSA_SHA384: xmlsec.TransformRsaSha384,
+ OneLogin_Saml2_Constants.RSA_SHA512: xmlsec.TransformRsaSha512
+ }
+ sign_algorithm_transform = sign_algorithm_transform_map.get(sign_algorithm, xmlsec.TransformRsaSha1)
+
+ signature = Signature(xmlsec.TransformExclC14N, sign_algorithm_transform, nsPrefix='ds')
+
+ issuer = OneLogin_Saml2_Utils.query(elem, '//saml:Issuer')
+ if len(issuer) > 0:
+ issuer = issuer[0]
+ issuer.addnext(signature)
+ elem_to_sign = issuer.getparent()
+ else:
+ entity_descriptor = OneLogin_Saml2_Utils.query(elem, '//md:EntityDescriptor')
+ if len(entity_descriptor) > 0:
+ elem.insert(0, signature)
+ else:
+ elem[0].insert(0, signature)
+ elem_to_sign = elem
+
+ elem_id = elem_to_sign.get('ID', None)
+ if elem_id is not None:
+ if elem_id:
+ elem_id = '#' + elem_id
+ else:
+ generated_id = generated_id = OneLogin_Saml2_Utils.generate_unique_id()
+ elem_id = '#' + generated_id
+ elem_to_sign.attrib['ID'] = generated_id
+
+ xmlsec.addIDs(elem_to_sign, ["ID"])
+
+ digest_algorithm_transform_map = {
+ OneLogin_Saml2_Constants.SHA1: xmlsec.TransformSha1,
+ OneLogin_Saml2_Constants.SHA256: xmlsec.TransformSha256,
+ OneLogin_Saml2_Constants.SHA384: xmlsec.TransformSha384,
+ OneLogin_Saml2_Constants.SHA512: xmlsec.TransformSha512
+ }
+ digest_algorithm_transform = digest_algorithm_transform_map.get(digest_algorithm, xmlsec.TransformSha1)
+
+ ref = signature.addReference(digest_algorithm_transform)
+ if elem_id:
+ ref.attrib['URI'] = elem_id
+
+ ref.addTransform(xmlsec.TransformEnveloped)
+ ref.addTransform(xmlsec.TransformExclC14N)
+
+ key_info = signature.ensureKeyInfo()
+ key_info.addX509Data()
+
+ dsig_ctx = xmlsec.DSigCtx()
+ sign_key = xmlsec.Key.loadMemory(key, xmlsec.KeyDataFormatPem, None)
+
+ file_cert = OneLogin_Saml2_Utils.write_temp_file(cert)
+ sign_key.loadCert(file_cert.name, xmlsec.KeyDataFormatCertPem)
+ file_cert.close()
+
+ dsig_ctx.signKey = sign_key
+ dsig_ctx.sign(signature)
+
+ return tostring(elem, encoding='unicode').encode('utf-8')
+
+[docs] @staticmethod
+ @return_false_on_exception
+ def validate_sign(xml, cert=None, fingerprint=None, fingerprintalg='sha1', validatecert=False, debug=False, xpath=None, multicerts=None):
+ """
+ Validates a signature (Message or Assertion).
+
+ :param xml: The element we should validate
+ :type: string | Document
+
+ :param cert: The pubic cert
+ :type: string
+
+ :param fingerprint: The fingerprint of the public cert
+ :type: string
+
+ :param fingerprintalg: The algorithm used to build the fingerprint
+ :type: string
+
+ :param validatecert: If true, will verify the signature and if the cert is valid.
+ :type: bool
+
+ :param debug: Activate the xmlsec debug
+ :type: bool
+
+ :param xpath: The xpath of the signed element
+ :type: string
+
+ :param multicerts: Multiple public certs
+ :type: list
+
+ :param raise_exceptions: Whether to return false on failure or raise an exception
+ :type raise_exceptions: Boolean
+ """
+ if xml is None or xml == '':
+ raise Exception('Empty string supplied as input')
+ elif isinstance(xml, etree._Element):
+ elem = xml
+ elif isinstance(xml, Document):
+ xml = xml.toxml()
+ elem = fromstring(str(xml), forbid_dtd=True)
+ elif isinstance(xml, Element):
+ xml.setAttributeNS(
+ unicode(OneLogin_Saml2_Constants.NS_SAMLP),
+ 'xmlns:samlp',
+ unicode(OneLogin_Saml2_Constants.NS_SAMLP)
+ )
+ xml.setAttributeNS(
+ unicode(OneLogin_Saml2_Constants.NS_SAML),
+ 'xmlns:saml',
+ unicode(OneLogin_Saml2_Constants.NS_SAML)
+ )
+ xml = xml.toxml()
+ elem = fromstring(str(xml), forbid_dtd=True)
+ elif isinstance(xml, basestring):
+ elem = fromstring(str(xml), forbid_dtd=True)
+ else:
+ raise Exception('Error parsing xml string')
+
+ error_callback_method = None
+ if debug:
+ error_callback_method = print_xmlsec_errors
+ xmlsec.set_error_callback(error_callback_method)
+
+ xmlsec.addIDs(elem, ["ID"])
+
+ if xpath:
+ signature_nodes = OneLogin_Saml2_Utils.query(elem, xpath)
+ else:
+ signature_nodes = OneLogin_Saml2_Utils.query(elem, OneLogin_Saml2_Utils.RESPONSE_SIGNATURE_XPATH)
+
+ if len(signature_nodes) == 0:
+ signature_nodes = OneLogin_Saml2_Utils.query(elem, OneLogin_Saml2_Utils.ASSERTION_SIGNATURE_XPATH)
+
+ if len(signature_nodes) == 1:
+ signature_node = signature_nodes[0]
+
+ if not multicerts:
+ return OneLogin_Saml2_Utils.validate_node_sign(signature_node, elem, cert, fingerprint, fingerprintalg, validatecert, debug, raise_exceptions=True)
+ else:
+ # If multiple certs are provided, I may ignore cert and
+ # fingerprint provided by the method and just check the
+ # certs multicerts
+ fingerprint = fingerprintalg = None
+ for cert in multicerts:
+ if OneLogin_Saml2_Utils.validate_node_sign(signature_node, elem, cert, fingerprint, fingerprintalg, validatecert, False, raise_exceptions=False):
+ return True
+ raise OneLogin_Saml2_ValidationError('Signature validation failed. SAML Response rejected.')
+ else:
+ raise OneLogin_Saml2_ValidationError('Expected exactly one signature node; got {}.'.format(len(signature_nodes)), OneLogin_Saml2_ValidationError.WRONG_NUMBER_OF_SIGNATURES)
+
+[docs] @staticmethod
+ @return_false_on_exception
+ def validate_metadata_sign(xml, cert=None, fingerprint=None, fingerprintalg='sha1', validatecert=False, debug=False):
+ """
+ Validates a signature of a EntityDescriptor.
+
+ :param xml: The element we should validate
+ :type: string | Document
+
+ :param cert: The pubic cert
+ :type: string
+
+ :param fingerprint: The fingerprint of the public cert
+ :type: string
+
+ :param fingerprintalg: The algorithm used to build the fingerprint
+ :type: string
+
+ :param validatecert: If true, will verify the signature and if the cert is valid.
+ :type: bool
+
+ :param debug: Activate the xmlsec debug
+ :type: bool
+
+ :param raise_exceptions: Whether to return false on failure or raise an exception
+ :type raise_exceptions: Boolean
+ """
+ if xml is None or xml == '':
+ raise Exception('Empty string supplied as input')
+ elif isinstance(xml, etree._Element):
+ elem = xml
+ elif isinstance(xml, Document):
+ xml = xml.toxml()
+ elem = fromstring(str(xml), forbid_dtd=True)
+ elif isinstance(xml, Element):
+ xml.setAttributeNS(
+ unicode(OneLogin_Saml2_Constants.NS_MD),
+ 'xmlns:md',
+ unicode(OneLogin_Saml2_Constants.NS_MD)
+ )
+ xml = xml.toxml()
+ elem = fromstring(str(xml), forbid_dtd=True)
+ elif isinstance(xml, basestring):
+ elem = fromstring(str(xml), forbid_dtd=True)
+ else:
+ raise Exception('Error parsing xml string')
+
+ error_callback_method = None
+ if debug:
+ error_callback_method = print_xmlsec_errors
+ xmlsec.set_error_callback(error_callback_method)
+
+ xmlsec.addIDs(elem, ["ID"])
+
+ signature_nodes = OneLogin_Saml2_Utils.query(elem, '/md:EntitiesDescriptor/ds:Signature')
+
+ if len(signature_nodes) == 0:
+ signature_nodes += OneLogin_Saml2_Utils.query(elem, '/md:EntityDescriptor/ds:Signature')
+
+ if len(signature_nodes) == 0:
+ signature_nodes += OneLogin_Saml2_Utils.query(elem, '/md:EntityDescriptor/md:SPSSODescriptor/ds:Signature')
+ signature_nodes += OneLogin_Saml2_Utils.query(elem, '/md:EntityDescriptor/md:IDPSSODescriptor/ds:Signature')
+
+ if len(signature_nodes) > 0:
+ for signature_node in signature_nodes:
+ OneLogin_Saml2_Utils.validate_node_sign(signature_node, elem, cert, fingerprint, fingerprintalg, validatecert, debug, raise_exceptions=True)
+ return True
+ else:
+ raise Exception('Could not validate metadata signature: No signature nodes found.')
+
+[docs] @staticmethod
+ @return_false_on_exception
+ def validate_node_sign(signature_node, elem, cert=None, fingerprint=None, fingerprintalg='sha1', validatecert=False, debug=False):
+ """
+ Validates a signature node.
+
+ :param signature_node: The signature node
+ :type: Node
+
+ :param xml: The element we should validate
+ :type: Document
+
+ :param cert: The public cert
+ :type: string
+
+ :param fingerprint: The fingerprint of the public cert
+ :type: string
+
+ :param fingerprintalg: The algorithm used to build the fingerprint
+ :type: string
+
+ :param validatecert: If true, will verify the signature and if the cert is valid.
+ :type: bool
+
+ :param debug: Activate the xmlsec debug
+ :type: bool
+
+ :param raise_exceptions: Whether to return false on failure or raise an exception
+ :type raise_exceptions: Boolean
+ """
+ error_callback_method = None
+ if debug:
+ error_callback_method = print_xmlsec_errors
+ xmlsec.set_error_callback(error_callback_method)
+
+ xmlsec.addIDs(elem, ["ID"])
+
+ if (cert is None or cert == '') and fingerprint:
+ x509_certificate_nodes = OneLogin_Saml2_Utils.query(signature_node, '//ds:Signature/ds:KeyInfo/ds:X509Data/ds:X509Certificate')
+ if len(x509_certificate_nodes) > 0:
+ x509_certificate_node = x509_certificate_nodes[0]
+ x509_cert_value = OneLogin_Saml2_Utils.element_text(x509_certificate_node)
+ x509_cert_value_formatted = OneLogin_Saml2_Utils.format_cert(x509_cert_value)
+ x509_fingerprint_value = OneLogin_Saml2_Utils.calculate_x509_fingerprint(x509_cert_value_formatted, fingerprintalg)
+
+ if fingerprint == x509_fingerprint_value:
+ cert = x509_cert_value_formatted
+
+ # Check if Reference URI is empty
+ # reference_elem = OneLogin_Saml2_Utils.query(signature_node, '//ds:Reference')
+ # if len(reference_elem) > 0:
+ # if reference_elem[0].get('URI') == '':
+ # reference_elem[0].set('URI', '#%s' % signature_node.getparent().get('ID'))
+
+ if cert is None or cert == '':
+ raise OneLogin_Saml2_Error(
+ 'Could not validate node signature: No certificate provided.',
+ OneLogin_Saml2_Error.CERT_NOT_FOUND
+ )
+
+ file_cert = OneLogin_Saml2_Utils.write_temp_file(cert)
+
+ if validatecert:
+ mngr = xmlsec.KeysMngr()
+ mngr.loadCert(file_cert.name, xmlsec.KeyDataFormatCertPem, xmlsec.KeyDataTypeTrusted)
+ dsig_ctx = xmlsec.DSigCtx(mngr)
+ else:
+ dsig_ctx = xmlsec.DSigCtx()
+ dsig_ctx.signKey = xmlsec.Key.load(file_cert.name, xmlsec.KeyDataFormatCertPem, None)
+
+ file_cert.close()
+
+ dsig_ctx.setEnabledKeyData([xmlsec.KeyDataX509])
+
+ try:
+ dsig_ctx.verify(signature_node)
+ except Exception as err:
+ raise OneLogin_Saml2_ValidationError(
+ 'Signature validation failed. SAML Response rejected. %s',
+ OneLogin_Saml2_ValidationError.INVALID_SIGNATURE,
+ err.__str__()
+ )
+
+ return True
+
+[docs] @staticmethod
+ @return_false_on_exception
+ def validate_binary_sign(signed_query, signature, cert=None, algorithm=OneLogin_Saml2_Constants.RSA_SHA1, debug=False):
+ """
+ Validates signed binary data (Used to validate GET Signature).
+
+ :param signed_query: The element we should validate
+ :type: string
+
+ :param signature: The signature that will be validate
+ :type: string
+
+ :param cert: The public cert
+ :type: string
+
+ :param algorithm: Signature algorithm
+ :type: string
+
+ :param debug: Activate the xmlsec debug
+ :type: bool
+
+ :param raise_exceptions: Whether to return false on failure or raise an exception
+ :type raise_exceptions: Boolean
+ """
+ error_callback_method = None
+ if debug:
+ error_callback_method = print_xmlsec_errors
+ xmlsec.set_error_callback(error_callback_method)
+
+ dsig_ctx = xmlsec.DSigCtx()
+
+ file_cert = OneLogin_Saml2_Utils.write_temp_file(cert)
+ dsig_ctx.signKey = xmlsec.Key.load(file_cert.name, xmlsec.KeyDataFormatCertPem, None)
+ file_cert.close()
+
+ # Sign the metadata with our private key.
+ sign_algorithm_transform_map = {
+ OneLogin_Saml2_Constants.DSA_SHA1: xmlsec.TransformDsaSha1,
+ OneLogin_Saml2_Constants.RSA_SHA1: xmlsec.TransformRsaSha1,
+ OneLogin_Saml2_Constants.RSA_SHA256: xmlsec.TransformRsaSha256,
+ OneLogin_Saml2_Constants.RSA_SHA384: xmlsec.TransformRsaSha384,
+ OneLogin_Saml2_Constants.RSA_SHA512: xmlsec.TransformRsaSha512
+ }
+ sign_algorithm_transform = sign_algorithm_transform_map.get(algorithm, xmlsec.TransformRsaSha1)
+
+ dsig_ctx.verifyBinary(signed_query, sign_algorithm_transform, signature)
+ return True
+
+[docs] @staticmethod
+ def get_encoded_parameter(get_data, name, default=None, lowercase_urlencoding=False):
+ """Return a URL encoded get parameter value
+ Prefer to extract the original encoded value directly from query_string since URL
+ encoding is not canonical. The encoding used by ADFS 3.0 is not compatible with
+ python's quote_plus (ADFS produces lower case hex numbers and quote_plus produces
+ upper case hex numbers)
+ """
+
+ if name not in get_data:
+ return OneLogin_Saml2_Utils.case_sensitive_urlencode(default, lowercase_urlencoding)
+ if 'query_string' in get_data:
+ return OneLogin_Saml2_Utils.extract_raw_query_parameter(get_data['query_string'], name)
+ return OneLogin_Saml2_Utils.case_sensitive_urlencode(get_data[name], lowercase_urlencoding)
+
+[docs] @staticmethod
+ def extract_raw_query_parameter(query_string, parameter, default=''):
+ m = re.search('%s=([^&]+)' % parameter, query_string)
+ if m:
+ return m.group(1)
+ else:
+ return default
+
+[docs] @staticmethod
+ def case_sensitive_urlencode(to_encode, lowercase=False):
+ encoded = quote_plus(to_encode)
+ return re.sub(r"%[A-F0-9]{2}", lambda m: m.group(0).lower(), encoded) if lowercase else encoded
+
+[docs] @staticmethod
+ def normalize_url(url):
+ """
+ Returns normalized URL for comparison.
+ This method converts the netloc to lowercase, as it should be case-insensitive (per RFC 4343, RFC 7617)
+ If standardization fails, the original URL is returned
+ Python documentation indicates that URL split also normalizes query strings if empty query fields are present
+
+ :param url: URL
+ :type url: String
+
+ :returns: A normalized URL, or the given URL string if parsing fails
+ :rtype: String
+ """
+ try:
+ scheme, netloc, path, query, fragment = urlsplit(url)
+ normalized_url = urlunsplit((scheme.lower(), netloc.lower(), path, query, fragment))
+ return normalized_url
+ except Exception:
+ return url
+
+# Based on the lxml example from defusedxml
+#
+# Copyright (c) 2013 by Christian Heimes <christian@python.org>
+# Licensed to PSF under a Contributor Agreement.
+# See https://www.python.org/psf/license for licensing details.
+"""lxml.etree protection"""
+
+from __future__ import print_function, absolute_import
+
+import threading
+
+from lxml import etree as _etree
+
+from defusedxml.lxml import DTDForbidden, EntitiesForbidden, NotSupportedError
+
+LXML3 = _etree.LXML_VERSION[0] >= 3
+
+__origin__ = "lxml.etree"
+
+tostring = _etree.tostring
+
+
+[docs]class RestrictedElement(_etree.ElementBase):
+ """A restricted Element class that filters out instances of some classes
+ """
+
+ __slots__ = ()
+ blacklist = (_etree._Entity, _etree._ProcessingInstruction, _etree._Comment)
+
+ def _filter(self, iterator):
+ blacklist = self.blacklist
+ for child in iterator:
+ if isinstance(child, blacklist):
+ continue
+ yield child
+
+ def __iter__(self):
+ iterator = super(RestrictedElement, self).__iter__()
+ return self._filter(iterator)
+
+[docs] def iterchildren(self, tag=None, reversed=False):
+ iterator = super(RestrictedElement, self).iterchildren(tag=tag, reversed=reversed)
+ return self._filter(iterator)
+
+[docs] def iter(self, tag=None, *tags):
+ iterator = super(RestrictedElement, self).iter(tag=tag, *tags)
+ return self._filter(iterator)
+
+[docs] def iterdescendants(self, tag=None, *tags):
+ iterator = super(RestrictedElement, self).iterdescendants(tag=tag, *tags)
+ return self._filter(iterator)
+
+[docs] def itersiblings(self, tag=None, preceding=False):
+ iterator = super(RestrictedElement, self).itersiblings(tag=tag, preceding=preceding)
+ return self._filter(iterator)
+
+[docs] def getchildren(self):
+ iterator = super(RestrictedElement, self).__iter__()
+ return list(self._filter(iterator))
+
+[docs] def getiterator(self, tag=None):
+ iterator = super(RestrictedElement, self).getiterator(tag)
+ return self._filter(iterator)
+
+
+[docs]class GlobalParserTLS(threading.local):
+ """Thread local context for custom parser instances
+ """
+
+ parser_config = {
+ "resolve_entities": False,
+ 'remove_comments': True,
+ 'no_network': True,
+ 'remove_pis': True,
+ 'huge_tree': False
+ }
+
+ element_class = RestrictedElement
+
+[docs] def createDefaultParser(self):
+ parser = _etree.XMLParser(**self.parser_config)
+ element_class = self.element_class
+ if self.element_class is not None:
+ lookup = _etree.ElementDefaultClassLookup(element=element_class)
+ parser.set_element_class_lookup(lookup)
+ return parser
+
+
+
+[docs] def getDefaultParser(self):
+ parser = getattr(self, "_default_parser", None)
+ if parser is None:
+ parser = self.createDefaultParser()
+ self.setDefaultParser(parser)
+ return parser
+
+
+_parser_tls = GlobalParserTLS()
+getDefaultParser = _parser_tls.getDefaultParser
+
+
+[docs]def check_docinfo(elementtree, forbid_dtd=False, forbid_entities=True):
+ """Check docinfo of an element tree for DTD and entity declarations
+ The check for entity declarations needs lxml 3 or newer. lxml 2.x does
+ not support dtd.iterentities().
+ """
+ docinfo = elementtree.docinfo
+ if docinfo.doctype:
+ if forbid_dtd:
+ raise DTDForbidden(docinfo.doctype, docinfo.system_url, docinfo.public_id)
+ if forbid_entities and not LXML3:
+ # lxml < 3 has no iterentities()
+ raise NotSupportedError("Unable to check for entity declarations " "in lxml 2.x")
+
+ if forbid_entities:
+ for dtd in docinfo.internalDTD, docinfo.externalDTD:
+ if dtd is None:
+ continue
+ for entity in dtd.iterentities():
+ raise EntitiesForbidden(entity.name, entity.content, None, None, None, None)
+
+
+[docs]def parse(source, parser=None, base_url=None, forbid_dtd=True, forbid_entities=True):
+ if parser is None:
+ parser = getDefaultParser()
+ elementtree = _etree.parse(source, parser, base_url=base_url)
+ check_docinfo(elementtree, forbid_dtd, forbid_entities)
+ return elementtree
+
+
+[docs]def fromstring(text, parser=None, base_url=None, forbid_dtd=True, forbid_entities=True):
+ if parser is None:
+ parser = getDefaultParser()
+ rootelement = _etree.fromstring(text, parser, base_url=base_url)
+ elementtree = rootelement.getroottree()
+ check_docinfo(elementtree, forbid_dtd, forbid_entities)
+ return rootelement
+
+
+XML = fromstring
+
+
+
+' + _('Hide Search Matches') + '
') + .appendTo($('#searchbox')); + } + }, + + /** + * init the domain index toggle buttons + */ + initIndexTable : function() { + var togglers = $('img.toggler').click(function() { + var src = $(this).attr('src'); + var idnum = $(this).attr('id').substr(7); + $('tr.cg-' + idnum).toggle(); + if (src.substr(-9) === 'minus.png') + $(this).attr('src', src.substr(0, src.length-9) + 'plus.png'); + else + $(this).attr('src', src.substr(0, src.length-8) + 'minus.png'); + }).css('display', ''); + if (DOCUMENTATION_OPTIONS.COLLAPSE_INDEX) { + togglers.click(); + } + }, + + /** + * helper function to hide the search marks again + */ + hideSearchWords : function() { + $('#searchbox .highlight-link').fadeOut(300); + $('span.highlighted').removeClass('highlighted'); + }, + + /** + * make the url absolute + */ + makeURL : function(relativeURL) { + return DOCUMENTATION_OPTIONS.URL_ROOT + '/' + relativeURL; + }, + + /** + * get the current relative url + */ + getCurrentURL : function() { + var path = document.location.pathname; + var parts = path.split(/\//); + $.each(DOCUMENTATION_OPTIONS.URL_ROOT.split(/\//), function() { + if (this === '..') + parts.pop(); + }); + var url = parts.join('/'); + return path.substring(url.lastIndexOf('/') + 1, path.length - 1); + }, + + initOnKeyListeners: function() { + $(document).keyup(function(event) { + var activeElementType = document.activeElement.tagName; + // don't navigate when in search box or textarea + if (activeElementType !== 'TEXTAREA' && activeElementType !== 'INPUT' && activeElementType !== 'SELECT') { + switch (event.keyCode) { + case 37: // left + var prevHref = $('link[rel="prev"]').prop('href'); + if (prevHref) { + window.location.href = prevHref; + return false; + } + case 39: // right + var nextHref = $('link[rel="next"]').prop('href'); + if (nextHref) { + window.location.href = nextHref; + return false; + } + } + } + }); + } +}; + +// quick alias for translations +_ = Documentation.gettext; + +$(document).ready(function() { + Documentation.init(); +}); diff --git a/docs/saml2/_static/documentation_options.js b/docs/saml2/_static/documentation_options.js new file mode 100644 index 0000000..f7bb3d0 --- /dev/null +++ b/docs/saml2/_static/documentation_options.js @@ -0,0 +1,10 @@ +var DOCUMENTATION_OPTIONS = { + URL_ROOT: document.getElementById("documentation_options").getAttribute('data-url_root'), + VERSION: '1', + LANGUAGE: 'None', + COLLAPSE_INDEX: false, + FILE_SUFFIX: '.html', + HAS_SOURCE: true, + SOURCELINK_SUFFIX: '.txt', + NAVIGATION_WITH_KEYS: false, +}; \ No newline at end of file diff --git a/docs/saml2/_static/down-pressed.png b/docs/saml2/_static/down-pressed.png new file mode 100644 index 0000000..5756c8c Binary files /dev/null and b/docs/saml2/_static/down-pressed.png differ diff --git a/docs/saml2/_static/down.png b/docs/saml2/_static/down.png new file mode 100644 index 0000000..1b3bdad Binary files /dev/null and b/docs/saml2/_static/down.png differ diff --git a/docs/saml2/_static/file.png b/docs/saml2/_static/file.png new file mode 100644 index 0000000..a858a41 Binary files /dev/null and b/docs/saml2/_static/file.png differ diff --git a/docs/saml2/_static/jquery-3.2.1.js b/docs/saml2/_static/jquery-3.2.1.js new file mode 100644 index 0000000..d2d8ca4 --- /dev/null +++ b/docs/saml2/_static/jquery-3.2.1.js @@ -0,0 +1,10253 @@ +/*! + * jQuery JavaScript Library v3.2.1 + * https://jquery.com/ + * + * Includes Sizzle.js + * https://sizzlejs.com/ + * + * Copyright JS Foundation and other contributors + * Released under the MIT license + * https://jquery.org/license + * + * Date: 2017-03-20T18:59Z + */ +( function( global, factory ) { + + "use strict"; + + if ( typeof module === "object" && typeof module.exports === "object" ) { + + // For CommonJS and CommonJS-like environments where a proper `window` + // is present, execute the factory and get jQuery. + // For environments that do not have a `window` with a `document` + // (such as Node.js), expose a factory as module.exports. + // This accentuates the need for the creation of a real `window`. + // e.g. var jQuery = require("jquery")(window); + // See ticket #14549 for more info. + module.exports = global.document ? + factory( global, true ) : + function( w ) { + if ( !w.document ) { + throw new Error( "jQuery requires a window with a document" ); + } + return factory( w ); + }; + } else { + factory( global ); + } + +// Pass this if window is not defined yet +} )( typeof window !== "undefined" ? window : this, function( window, noGlobal ) { + +// Edge <= 12 - 13+, Firefox <=18 - 45+, IE 10 - 11, Safari 5.1 - 9+, iOS 6 - 9.1 +// throw exceptions when non-strict code (e.g., ASP.NET 4.5) accesses strict mode +// arguments.callee.caller (trac-13335). But as of jQuery 3.0 (2016), strict mode should be common +// enough that all such attempts are guarded in a try block. +"use strict"; + +var arr = []; + +var document = window.document; + +var getProto = Object.getPrototypeOf; + +var slice = arr.slice; + +var concat = arr.concat; + +var push = arr.push; + +var indexOf = arr.indexOf; + +var class2type = {}; + +var toString = class2type.toString; + +var hasOwn = class2type.hasOwnProperty; + +var fnToString = hasOwn.toString; + +var ObjectFunctionString = fnToString.call( Object ); + +var support = {}; + + + + function DOMEval( code, doc ) { + doc = doc || document; + + var script = doc.createElement( "script" ); + + script.text = code; + doc.head.appendChild( script ).parentNode.removeChild( script ); + } +/* global Symbol */ +// Defining this global in .eslintrc.json would create a danger of using the global +// unguarded in another place, it seems safer to define global only for this module + + + +var + version = "3.2.1", + + // Define a local copy of jQuery + jQuery = function( selector, context ) { + + // The jQuery object is actually just the init constructor 'enhanced' + // Need init if jQuery is called (just allow error to be thrown if not included) + return new jQuery.fn.init( selector, context ); + }, + + // Support: Android <=4.0 only + // Make sure we trim BOM and NBSP + rtrim = /^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g, + + // Matches dashed string for camelizing + rmsPrefix = /^-ms-/, + rdashAlpha = /-([a-z])/g, + + // Used by jQuery.camelCase as callback to replace() + fcamelCase = function( all, letter ) { + return letter.toUpperCase(); + }; + +jQuery.fn = jQuery.prototype = { + + // The current version of jQuery being used + jquery: version, + + constructor: jQuery, + + // The default length of a jQuery object is 0 + length: 0, + + toArray: function() { + return slice.call( this ); + }, + + // Get the Nth element in the matched element set OR + // Get the whole matched element set as a clean array + get: function( num ) { + + // Return all the elements in a clean array + if ( num == null ) { + return slice.call( this ); + } + + // Return just the one element from the set + return num < 0 ? this[ num + this.length ] : this[ num ]; + }, + + // Take an array of elements and push it onto the stack + // (returning the new matched element set) + pushStack: function( elems ) { + + // Build a new jQuery matched element set + var ret = jQuery.merge( this.constructor(), elems ); + + // Add the old object onto the stack (as a reference) + ret.prevObject = this; + + // Return the newly-formed element set + return ret; + }, + + // Execute a callback for every element in the matched set. + each: function( callback ) { + return jQuery.each( this, callback ); + }, + + map: function( callback ) { + return this.pushStack( jQuery.map( this, function( elem, i ) { + return callback.call( elem, i, elem ); + } ) ); + }, + + slice: function() { + return this.pushStack( slice.apply( this, arguments ) ); + }, + + first: function() { + return this.eq( 0 ); + }, + + last: function() { + return this.eq( -1 ); + }, + + eq: function( i ) { + var len = this.length, + j = +i + ( i < 0 ? len : 0 ); + return this.pushStack( j >= 0 && j < len ? [ this[ j ] ] : [] ); + }, + + end: function() { + return this.prevObject || this.constructor(); + }, + + // For internal use only. + // Behaves like an Array's method, not like a jQuery method. + push: push, + sort: arr.sort, + splice: arr.splice +}; + +jQuery.extend = jQuery.fn.extend = function() { + var options, name, src, copy, copyIsArray, clone, + target = arguments[ 0 ] || {}, + i = 1, + length = arguments.length, + deep = false; + + // Handle a deep copy situation + if ( typeof target === "boolean" ) { + deep = target; + + // Skip the boolean and the target + target = arguments[ i ] || {}; + i++; + } + + // Handle case when target is a string or something (possible in deep copy) + if ( typeof target !== "object" && !jQuery.isFunction( target ) ) { + target = {}; + } + + // Extend jQuery itself if only one argument is passed + if ( i === length ) { + target = this; + i--; + } + + for ( ; i < length; i++ ) { + + // Only deal with non-null/undefined values + if ( ( options = arguments[ i ] ) != null ) { + + // Extend the base object + for ( name in options ) { + src = target[ name ]; + copy = options[ name ]; + + // Prevent never-ending loop + if ( target === copy ) { + continue; + } + + // Recurse if we're merging plain objects or arrays + if ( deep && copy && ( jQuery.isPlainObject( copy ) || + ( copyIsArray = Array.isArray( copy ) ) ) ) { + + if ( copyIsArray ) { + copyIsArray = false; + clone = src && Array.isArray( src ) ? src : []; + + } else { + clone = src && jQuery.isPlainObject( src ) ? src : {}; + } + + // Never move original objects, clone them + target[ name ] = jQuery.extend( deep, clone, copy ); + + // Don't bring in undefined values + } else if ( copy !== undefined ) { + target[ name ] = copy; + } + } + } + } + + // Return the modified object + return target; +}; + +jQuery.extend( { + + // Unique for each copy of jQuery on the page + expando: "jQuery" + ( version + Math.random() ).replace( /\D/g, "" ), + + // Assume jQuery is ready without the ready module + isReady: true, + + error: function( msg ) { + throw new Error( msg ); + }, + + noop: function() {}, + + isFunction: function( obj ) { + return jQuery.type( obj ) === "function"; + }, + + isWindow: function( obj ) { + return obj != null && obj === obj.window; + }, + + isNumeric: function( obj ) { + + // As of jQuery 3.0, isNumeric is limited to + // strings and numbers (primitives or objects) + // that can be coerced to finite numbers (gh-2662) + var type = jQuery.type( obj ); + return ( type === "number" || type === "string" ) && + + // parseFloat NaNs numeric-cast false positives ("") + // ...but misinterprets leading-number strings, particularly hex literals ("0x...") + // subtraction forces infinities to NaN + !isNaN( obj - parseFloat( obj ) ); + }, + + isPlainObject: function( obj ) { + var proto, Ctor; + + // Detect obvious negatives + // Use toString instead of jQuery.type to catch host objects + if ( !obj || toString.call( obj ) !== "[object Object]" ) { + return false; + } + + proto = getProto( obj ); + + // Objects with no prototype (e.g., `Object.create( null )`) are plain + if ( !proto ) { + return true; + } + + // Objects with prototype are plain iff they were constructed by a global Object function + Ctor = hasOwn.call( proto, "constructor" ) && proto.constructor; + return typeof Ctor === "function" && fnToString.call( Ctor ) === ObjectFunctionString; + }, + + isEmptyObject: function( obj ) { + + /* eslint-disable no-unused-vars */ + // See https://github.com/eslint/eslint/issues/6125 + var name; + + for ( name in obj ) { + return false; + } + return true; + }, + + type: function( obj ) { + if ( obj == null ) { + return obj + ""; + } + + // Support: Android <=2.3 only (functionish RegExp) + return typeof obj === "object" || typeof obj === "function" ? + class2type[ toString.call( obj ) ] || "object" : + typeof obj; + }, + + // Evaluates a script in a global context + globalEval: function( code ) { + DOMEval( code ); + }, + + // Convert dashed to camelCase; used by the css and data modules + // Support: IE <=9 - 11, Edge 12 - 13 + // Microsoft forgot to hump their vendor prefix (#9572) + camelCase: function( string ) { + return string.replace( rmsPrefix, "ms-" ).replace( rdashAlpha, fcamelCase ); + }, + + each: function( obj, callback ) { + var length, i = 0; + + if ( isArrayLike( obj ) ) { + length = obj.length; + for ( ; i < length; i++ ) { + if ( callback.call( obj[ i ], i, obj[ i ] ) === false ) { + break; + } + } + } else { + for ( i in obj ) { + if ( callback.call( obj[ i ], i, obj[ i ] ) === false ) { + break; + } + } + } + + return obj; + }, + + // Support: Android <=4.0 only + trim: function( text ) { + return text == null ? + "" : + ( text + "" ).replace( rtrim, "" ); + }, + + // results is for internal usage only + makeArray: function( arr, results ) { + var ret = results || []; + + if ( arr != null ) { + if ( isArrayLike( Object( arr ) ) ) { + jQuery.merge( ret, + typeof arr === "string" ? + [ arr ] : arr + ); + } else { + push.call( ret, arr ); + } + } + + return ret; + }, + + inArray: function( elem, arr, i ) { + return arr == null ? -1 : indexOf.call( arr, elem, i ); + }, + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + merge: function( first, second ) { + var len = +second.length, + j = 0, + i = first.length; + + for ( ; j < len; j++ ) { + first[ i++ ] = second[ j ]; + } + + first.length = i; + + return first; + }, + + grep: function( elems, callback, invert ) { + var callbackInverse, + matches = [], + i = 0, + length = elems.length, + callbackExpect = !invert; + + // Go through the array, only saving the items + // that pass the validator function + for ( ; i < length; i++ ) { + callbackInverse = !callback( elems[ i ], i ); + if ( callbackInverse !== callbackExpect ) { + matches.push( elems[ i ] ); + } + } + + return matches; + }, + + // arg is for internal usage only + map: function( elems, callback, arg ) { + var length, value, + i = 0, + ret = []; + + // Go through the array, translating each of the items to their new values + if ( isArrayLike( elems ) ) { + length = elems.length; + for ( ; i < length; i++ ) { + value = callback( elems[ i ], i, arg ); + + if ( value != null ) { + ret.push( value ); + } + } + + // Go through every key on the object, + } else { + for ( i in elems ) { + value = callback( elems[ i ], i, arg ); + + if ( value != null ) { + ret.push( value ); + } + } + } + + // Flatten any nested arrays + return concat.apply( [], ret ); + }, + + // A global GUID counter for objects + guid: 1, + + // Bind a function to a context, optionally partially applying any + // arguments. + proxy: function( fn, context ) { + var tmp, args, proxy; + + if ( typeof context === "string" ) { + tmp = fn[ context ]; + context = fn; + fn = tmp; + } + + // Quick check to determine if target is callable, in the spec + // this throws a TypeError, but we will just return undefined. + if ( !jQuery.isFunction( fn ) ) { + return undefined; + } + + // Simulated bind + args = slice.call( arguments, 2 ); + proxy = function() { + return fn.apply( context || this, args.concat( slice.call( arguments ) ) ); + }; + + // Set the guid of unique handler to the same of original handler, so it can be removed + proxy.guid = fn.guid = fn.guid || jQuery.guid++; + + return proxy; + }, + + now: Date.now, + + // jQuery.support is not used in Core but other projects attach their + // properties to it so it needs to exist. + support: support +} ); + +if ( typeof Symbol === "function" ) { + jQuery.fn[ Symbol.iterator ] = arr[ Symbol.iterator ]; +} + +// Populate the class2type map +jQuery.each( "Boolean Number String Function Array Date RegExp Object Error Symbol".split( " " ), +function( i, name ) { + class2type[ "[object " + name + "]" ] = name.toLowerCase(); +} ); + +function isArrayLike( obj ) { + + // Support: real iOS 8.2 only (not reproducible in simulator) + // `in` check used to prevent JIT error (gh-2145) + // hasOwn isn't used here due to false negatives + // regarding Nodelist length in IE + var length = !!obj && "length" in obj && obj.length, + type = jQuery.type( obj ); + + if ( type === "function" || jQuery.isWindow( obj ) ) { + return false; + } + + return type === "array" || length === 0 || + typeof length === "number" && length > 0 && ( length - 1 ) in obj; +} +var Sizzle = +/*! + * Sizzle CSS Selector Engine v2.3.3 + * https://sizzlejs.com/ + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license + * http://jquery.org/license + * + * Date: 2016-08-08 + */ +(function( window ) { + +var i, + support, + Expr, + getText, + isXML, + tokenize, + compile, + select, + outermostContext, + sortInput, + hasDuplicate, + + // Local document vars + setDocument, + document, + docElem, + documentIsHTML, + rbuggyQSA, + rbuggyMatches, + matches, + contains, + + // Instance-specific data + expando = "sizzle" + 1 * new Date(), + preferredDoc = window.document, + dirruns = 0, + done = 0, + classCache = createCache(), + tokenCache = createCache(), + compilerCache = createCache(), + sortOrder = function( a, b ) { + if ( a === b ) { + hasDuplicate = true; + } + return 0; + }, + + // Instance methods + hasOwn = ({}).hasOwnProperty, + arr = [], + pop = arr.pop, + push_native = arr.push, + push = arr.push, + slice = arr.slice, + // Use a stripped-down indexOf as it's faster than native + // https://jsperf.com/thor-indexof-vs-for/5 + indexOf = function( list, elem ) { + var i = 0, + len = list.length; + for ( ; i < len; i++ ) { + if ( list[i] === elem ) { + return i; + } + } + return -1; + }, + + booleans = "checked|selected|async|autofocus|autoplay|controls|defer|disabled|hidden|ismap|loop|multiple|open|readonly|required|scoped", + + // Regular expressions + + // http://www.w3.org/TR/css3-selectors/#whitespace + whitespace = "[\\x20\\t\\r\\n\\f]", + + // http://www.w3.org/TR/CSS21/syndata.html#value-def-identifier + identifier = "(?:\\\\.|[\\w-]|[^\0-\\xa0])+", + + // Attribute selectors: http://www.w3.org/TR/selectors/#attribute-selectors + attributes = "\\[" + whitespace + "*(" + identifier + ")(?:" + whitespace + + // Operator (capture 2) + "*([*^$|!~]?=)" + whitespace + + // "Attribute values must be CSS identifiers [capture 5] or strings [capture 3 or capture 4]" + "*(?:'((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\"|(" + identifier + "))|)" + whitespace + + "*\\]", + + pseudos = ":(" + identifier + ")(?:\\((" + + // To reduce the number of selectors needing tokenize in the preFilter, prefer arguments: + // 1. quoted (capture 3; capture 4 or capture 5) + "('((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\")|" + + // 2. simple (capture 6) + "((?:\\\\.|[^\\\\()[\\]]|" + attributes + ")*)|" + + // 3. anything else (capture 2) + ".*" + + ")\\)|)", + + // Leading and non-escaped trailing whitespace, capturing some non-whitespace characters preceding the latter + rwhitespace = new RegExp( whitespace + "+", "g" ), + rtrim = new RegExp( "^" + whitespace + "+|((?:^|[^\\\\])(?:\\\\.)*)" + whitespace + "+$", "g" ), + + rcomma = new RegExp( "^" + whitespace + "*," + whitespace + "*" ), + rcombinators = new RegExp( "^" + whitespace + "*([>+~]|" + whitespace + ")" + whitespace + "*" ), + + rattributeQuotes = new RegExp( "=" + whitespace + "*([^\\]'\"]*?)" + whitespace + "*\\]", "g" ), + + rpseudo = new RegExp( pseudos ), + ridentifier = new RegExp( "^" + identifier + "$" ), + + matchExpr = { + "ID": new RegExp( "^#(" + identifier + ")" ), + "CLASS": new RegExp( "^\\.(" + identifier + ")" ), + "TAG": new RegExp( "^(" + identifier + "|[*])" ), + "ATTR": new RegExp( "^" + attributes ), + "PSEUDO": new RegExp( "^" + pseudos ), + "CHILD": new RegExp( "^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\(" + whitespace + + "*(even|odd|(([+-]|)(\\d*)n|)" + whitespace + "*(?:([+-]|)" + whitespace + + "*(\\d+)|))" + whitespace + "*\\)|)", "i" ), + "bool": new RegExp( "^(?:" + booleans + ")$", "i" ), + // For use in libraries implementing .is() + // We use this for POS matching in `select` + "needsContext": new RegExp( "^" + whitespace + "*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\(" + + whitespace + "*((?:-\\d)?\\d*)" + whitespace + "*\\)|)(?=[^-]|$)", "i" ) + }, + + rinputs = /^(?:input|select|textarea|button)$/i, + rheader = /^h\d$/i, + + rnative = /^[^{]+\{\s*\[native \w/, + + // Easily-parseable/retrievable ID or TAG or CLASS selectors + rquickExpr = /^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/, + + rsibling = /[+~]/, + + // CSS escapes + // http://www.w3.org/TR/CSS21/syndata.html#escaped-characters + runescape = new RegExp( "\\\\([\\da-f]{1,6}" + whitespace + "?|(" + whitespace + ")|.)", "ig" ), + funescape = function( _, escaped, escapedWhitespace ) { + var high = "0x" + escaped - 0x10000; + // NaN means non-codepoint + // Support: Firefox<24 + // Workaround erroneous numeric interpretation of +"0x" + return high !== high || escapedWhitespace ? + escaped : + high < 0 ? + // BMP codepoint + String.fromCharCode( high + 0x10000 ) : + // Supplemental Plane codepoint (surrogate pair) + String.fromCharCode( high >> 10 | 0xD800, high & 0x3FF | 0xDC00 ); + }, + + // CSS string/identifier serialization + // https://drafts.csswg.org/cssom/#common-serializing-idioms + rcssescape = /([\0-\x1f\x7f]|^-?\d)|^-$|[^\0-\x1f\x7f-\uFFFF\w-]/g, + fcssescape = function( ch, asCodePoint ) { + if ( asCodePoint ) { + + // U+0000 NULL becomes U+FFFD REPLACEMENT CHARACTER + if ( ch === "\0" ) { + return "\uFFFD"; + } + + // Control characters and (dependent upon position) numbers get escaped as code points + return ch.slice( 0, -1 ) + "\\" + ch.charCodeAt( ch.length - 1 ).toString( 16 ) + " "; + } + + // Other potentially-special ASCII characters get backslash-escaped + return "\\" + ch; + }, + + // Used for iframes + // See setDocument() + // Removing the function wrapper causes a "Permission Denied" + // error in IE + unloadHandler = function() { + setDocument(); + }, + + disabledAncestor = addCombinator( + function( elem ) { + return elem.disabled === true && ("form" in elem || "label" in elem); + }, + { dir: "parentNode", next: "legend" } + ); + +// Optimize for push.apply( _, NodeList ) +try { + push.apply( + (arr = slice.call( preferredDoc.childNodes )), + preferredDoc.childNodes + ); + // Support: Android<4.0 + // Detect silently failing push.apply + arr[ preferredDoc.childNodes.length ].nodeType; +} catch ( e ) { + push = { apply: arr.length ? + + // Leverage slice if possible + function( target, els ) { + push_native.apply( target, slice.call(els) ); + } : + + // Support: IE<9 + // Otherwise append directly + function( target, els ) { + var j = target.length, + i = 0; + // Can't trust NodeList.length + while ( (target[j++] = els[i++]) ) {} + target.length = j - 1; + } + }; +} + +function Sizzle( selector, context, results, seed ) { + var m, i, elem, nid, match, groups, newSelector, + newContext = context && context.ownerDocument, + + // nodeType defaults to 9, since context defaults to document + nodeType = context ? context.nodeType : 9; + + results = results || []; + + // Return early from calls with invalid selector or context + if ( typeof selector !== "string" || !selector || + nodeType !== 1 && nodeType !== 9 && nodeType !== 11 ) { + + return results; + } + + // Try to shortcut find operations (as opposed to filters) in HTML documents + if ( !seed ) { + + if ( ( context ? context.ownerDocument || context : preferredDoc ) !== document ) { + setDocument( context ); + } + context = context || document; + + if ( documentIsHTML ) { + + // If the selector is sufficiently simple, try using a "get*By*" DOM method + // (excepting DocumentFragment context, where the methods don't exist) + if ( nodeType !== 11 && (match = rquickExpr.exec( selector )) ) { + + // ID selector + if ( (m = match[1]) ) { + + // Document context + if ( nodeType === 9 ) { + if ( (elem = context.getElementById( m )) ) { + + // Support: IE, Opera, Webkit + // TODO: identify versions + // getElementById can match elements by name instead of ID + if ( elem.id === m ) { + results.push( elem ); + return results; + } + } else { + return results; + } + + // Element context + } else { + + // Support: IE, Opera, Webkit + // TODO: identify versions + // getElementById can match elements by name instead of ID + if ( newContext && (elem = newContext.getElementById( m )) && + contains( context, elem ) && + elem.id === m ) { + + results.push( elem ); + return results; + } + } + + // Type selector + } else if ( match[2] ) { + push.apply( results, context.getElementsByTagName( selector ) ); + return results; + + // Class selector + } else if ( (m = match[3]) && support.getElementsByClassName && + context.getElementsByClassName ) { + + push.apply( results, context.getElementsByClassName( m ) ); + return results; + } + } + + // Take advantage of querySelectorAll + if ( support.qsa && + !compilerCache[ selector + " " ] && + (!rbuggyQSA || !rbuggyQSA.test( selector )) ) { + + if ( nodeType !== 1 ) { + newContext = context; + newSelector = selector; + + // qSA looks outside Element context, which is not what we want + // Thanks to Andrew Dupont for this workaround technique + // Support: IE <=8 + // Exclude object elements + } else if ( context.nodeName.toLowerCase() !== "object" ) { + + // Capture the context ID, setting it first if necessary + if ( (nid = context.getAttribute( "id" )) ) { + nid = nid.replace( rcssescape, fcssescape ); + } else { + context.setAttribute( "id", (nid = expando) ); + } + + // Prefix every selector in the list + groups = tokenize( selector ); + i = groups.length; + while ( i-- ) { + groups[i] = "#" + nid + " " + toSelector( groups[i] ); + } + newSelector = groups.join( "," ); + + // Expand context for sibling selectors + newContext = rsibling.test( selector ) && testContext( context.parentNode ) || + context; + } + + if ( newSelector ) { + try { + push.apply( results, + newContext.querySelectorAll( newSelector ) + ); + return results; + } catch ( qsaError ) { + } finally { + if ( nid === expando ) { + context.removeAttribute( "id" ); + } + } + } + } + } + } + + // All others + return select( selector.replace( rtrim, "$1" ), context, results, seed ); +} + +/** + * Create key-value caches of limited size + * @returns {function(string, object)} Returns the Object data after storing it on itself with + * property name the (space-suffixed) string and (if the cache is larger than Expr.cacheLength) + * deleting the oldest entry + */ +function createCache() { + var keys = []; + + function cache( key, value ) { + // Use (key + " ") to avoid collision with native prototype properties (see Issue #157) + if ( keys.push( key + " " ) > Expr.cacheLength ) { + // Only keep the most recent entries + delete cache[ keys.shift() ]; + } + return (cache[ key + " " ] = value); + } + return cache; +} + +/** + * Mark a function for special use by Sizzle + * @param {Function} fn The function to mark + */ +function markFunction( fn ) { + fn[ expando ] = true; + return fn; +} + +/** + * Support testing using an element + * @param {Function} fn Passed the created element and returns a boolean result + */ +function assert( fn ) { + var el = document.createElement("fieldset"); + + try { + return !!fn( el ); + } catch (e) { + return false; + } finally { + // Remove from its parent by default + if ( el.parentNode ) { + el.parentNode.removeChild( el ); + } + // release memory in IE + el = null; + } +} + +/** + * Adds the same handler for all of the specified attrs + * @param {String} attrs Pipe-separated list of attributes + * @param {Function} handler The method that will be applied + */ +function addHandle( attrs, handler ) { + var arr = attrs.split("|"), + i = arr.length; + + while ( i-- ) { + Expr.attrHandle[ arr[i] ] = handler; + } +} + +/** + * Checks document order of two siblings + * @param {Element} a + * @param {Element} b + * @returns {Number} Returns less than 0 if a precedes b, greater than 0 if a follows b + */ +function siblingCheck( a, b ) { + var cur = b && a, + diff = cur && a.nodeType === 1 && b.nodeType === 1 && + a.sourceIndex - b.sourceIndex; + + // Use IE sourceIndex if available on both nodes + if ( diff ) { + return diff; + } + + // Check if b follows a + if ( cur ) { + while ( (cur = cur.nextSibling) ) { + if ( cur === b ) { + return -1; + } + } + } + + return a ? 1 : -1; +} + +/** + * Returns a function to use in pseudos for input types + * @param {String} type + */ +function createInputPseudo( type ) { + return function( elem ) { + var name = elem.nodeName.toLowerCase(); + return name === "input" && elem.type === type; + }; +} + +/** + * Returns a function to use in pseudos for buttons + * @param {String} type + */ +function createButtonPseudo( type ) { + return function( elem ) { + var name = elem.nodeName.toLowerCase(); + return (name === "input" || name === "button") && elem.type === type; + }; +} + +/** + * Returns a function to use in pseudos for :enabled/:disabled + * @param {Boolean} disabled true for :disabled; false for :enabled + */ +function createDisabledPseudo( disabled ) { + + // Known :disabled false positives: fieldset[disabled] > legend:nth-of-type(n+2) :can-disable + return function( elem ) { + + // Only certain elements can match :enabled or :disabled + // https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled + // https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled + if ( "form" in elem ) { + + // Check for inherited disabledness on relevant non-disabled elements: + // * listed form-associated elements in a disabled fieldset + // https://html.spec.whatwg.org/multipage/forms.html#category-listed + // https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled + // * option elements in a disabled optgroup + // https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled + // All such elements have a "form" property. + if ( elem.parentNode && elem.disabled === false ) { + + // Option elements defer to a parent optgroup if present + if ( "label" in elem ) { + if ( "label" in elem.parentNode ) { + return elem.parentNode.disabled === disabled; + } else { + return elem.disabled === disabled; + } + } + + // Support: IE 6 - 11 + // Use the isDisabled shortcut property to check for disabled fieldset ancestors + return elem.isDisabled === disabled || + + // Where there is no isDisabled, check manually + /* jshint -W018 */ + elem.isDisabled !== !disabled && + disabledAncestor( elem ) === disabled; + } + + return elem.disabled === disabled; + + // Try to winnow out elements that can't be disabled before trusting the disabled property. + // Some victims get caught in our net (label, legend, menu, track), but it shouldn't + // even exist on them, let alone have a boolean value. + } else if ( "label" in elem ) { + return elem.disabled === disabled; + } + + // Remaining elements are neither :enabled nor :disabled + return false; + }; +} + +/** + * Returns a function to use in pseudos for positionals + * @param {Function} fn + */ +function createPositionalPseudo( fn ) { + return markFunction(function( argument ) { + argument = +argument; + return markFunction(function( seed, matches ) { + var j, + matchIndexes = fn( [], seed.length, argument ), + i = matchIndexes.length; + + // Match elements found at the specified indexes + while ( i-- ) { + if ( seed[ (j = matchIndexes[i]) ] ) { + seed[j] = !(matches[j] = seed[j]); + } + } + }); + }); +} + +/** + * Checks a node for validity as a Sizzle context + * @param {Element|Object=} context + * @returns {Element|Object|Boolean} The input node if acceptable, otherwise a falsy value + */ +function testContext( context ) { + return context && typeof context.getElementsByTagName !== "undefined" && context; +} + +// Expose support vars for convenience +support = Sizzle.support = {}; + +/** + * Detects XML nodes + * @param {Element|Object} elem An element or a document + * @returns {Boolean} True iff elem is a non-HTML XML node + */ +isXML = Sizzle.isXML = function( elem ) { + // documentElement is verified for cases where it doesn't yet exist + // (such as loading iframes in IE - #4833) + var documentElement = elem && (elem.ownerDocument || elem).documentElement; + return documentElement ? documentElement.nodeName !== "HTML" : false; +}; + +/** + * Sets document-related variables once based on the current document + * @param {Element|Object} [doc] An element or document object to use to set the document + * @returns {Object} Returns the current document + */ +setDocument = Sizzle.setDocument = function( node ) { + var hasCompare, subWindow, + doc = node ? node.ownerDocument || node : preferredDoc; + + // Return early if doc is invalid or already selected + if ( doc === document || doc.nodeType !== 9 || !doc.documentElement ) { + return document; + } + + // Update global variables + document = doc; + docElem = document.documentElement; + documentIsHTML = !isXML( document ); + + // Support: IE 9-11, Edge + // Accessing iframe documents after unload throws "permission denied" errors (jQuery #13936) + if ( preferredDoc !== document && + (subWindow = document.defaultView) && subWindow.top !== subWindow ) { + + // Support: IE 11, Edge + if ( subWindow.addEventListener ) { + subWindow.addEventListener( "unload", unloadHandler, false ); + + // Support: IE 9 - 10 only + } else if ( subWindow.attachEvent ) { + subWindow.attachEvent( "onunload", unloadHandler ); + } + } + + /* Attributes + ---------------------------------------------------------------------- */ + + // Support: IE<8 + // Verify that getAttribute really returns attributes and not properties + // (excepting IE8 booleans) + support.attributes = assert(function( el ) { + el.className = "i"; + return !el.getAttribute("className"); + }); + + /* getElement(s)By* + ---------------------------------------------------------------------- */ + + // Check if getElementsByTagName("*") returns only elements + support.getElementsByTagName = assert(function( el ) { + el.appendChild( document.createComment("") ); + return !el.getElementsByTagName("*").length; + }); + + // Support: IE<9 + support.getElementsByClassName = rnative.test( document.getElementsByClassName ); + + // Support: IE<10 + // Check if getElementById returns elements by name + // The broken getElementById methods don't pick up programmatically-set names, + // so use a roundabout getElementsByName test + support.getById = assert(function( el ) { + docElem.appendChild( el ).id = expando; + return !document.getElementsByName || !document.getElementsByName( expando ).length; + }); + + // ID filter and find + if ( support.getById ) { + Expr.filter["ID"] = function( id ) { + var attrId = id.replace( runescape, funescape ); + return function( elem ) { + return elem.getAttribute("id") === attrId; + }; + }; + Expr.find["ID"] = function( id, context ) { + if ( typeof context.getElementById !== "undefined" && documentIsHTML ) { + var elem = context.getElementById( id ); + return elem ? [ elem ] : []; + } + }; + } else { + Expr.filter["ID"] = function( id ) { + var attrId = id.replace( runescape, funescape ); + return function( elem ) { + var node = typeof elem.getAttributeNode !== "undefined" && + elem.getAttributeNode("id"); + return node && node.value === attrId; + }; + }; + + // Support: IE 6 - 7 only + // getElementById is not reliable as a find shortcut + Expr.find["ID"] = function( id, context ) { + if ( typeof context.getElementById !== "undefined" && documentIsHTML ) { + var node, i, elems, + elem = context.getElementById( id ); + + if ( elem ) { + + // Verify the id attribute + node = elem.getAttributeNode("id"); + if ( node && node.value === id ) { + return [ elem ]; + } + + // Fall back on getElementsByName + elems = context.getElementsByName( id ); + i = 0; + while ( (elem = elems[i++]) ) { + node = elem.getAttributeNode("id"); + if ( node && node.value === id ) { + return [ elem ]; + } + } + } + + return []; + } + }; + } + + // Tag + Expr.find["TAG"] = support.getElementsByTagName ? + function( tag, context ) { + if ( typeof context.getElementsByTagName !== "undefined" ) { + return context.getElementsByTagName( tag ); + + // DocumentFragment nodes don't have gEBTN + } else if ( support.qsa ) { + return context.querySelectorAll( tag ); + } + } : + + function( tag, context ) { + var elem, + tmp = [], + i = 0, + // By happy coincidence, a (broken) gEBTN appears on DocumentFragment nodes too + results = context.getElementsByTagName( tag ); + + // Filter out possible comments + if ( tag === "*" ) { + while ( (elem = results[i++]) ) { + if ( elem.nodeType === 1 ) { + tmp.push( elem ); + } + } + + return tmp; + } + return results; + }; + + // Class + Expr.find["CLASS"] = support.getElementsByClassName && function( className, context ) { + if ( typeof context.getElementsByClassName !== "undefined" && documentIsHTML ) { + return context.getElementsByClassName( className ); + } + }; + + /* QSA/matchesSelector + ---------------------------------------------------------------------- */ + + // QSA and matchesSelector support + + // matchesSelector(:active) reports false when true (IE9/Opera 11.5) + rbuggyMatches = []; + + // qSa(:focus) reports false when true (Chrome 21) + // We allow this because of a bug in IE8/9 that throws an error + // whenever `document.activeElement` is accessed on an iframe + // So, we allow :focus to pass through QSA all the time to avoid the IE error + // See https://bugs.jquery.com/ticket/13378 + rbuggyQSA = []; + + if ( (support.qsa = rnative.test( document.querySelectorAll )) ) { + // Build QSA regex + // Regex strategy adopted from Diego Perini + assert(function( el ) { + // Select is set to empty string on purpose + // This is to test IE's treatment of not explicitly + // setting a boolean content attribute, + // since its presence should be enough + // https://bugs.jquery.com/ticket/12359 + docElem.appendChild( el ).innerHTML = "" + + ""; + + // Support: IE8, Opera 11-12.16 + // Nothing should be selected when empty strings follow ^= or $= or *= + // The test attribute must be unknown in Opera but "safe" for WinRT + // https://msdn.microsoft.com/en-us/library/ie/hh465388.aspx#attribute_section + if ( el.querySelectorAll("[msallowcapture^='']").length ) { + rbuggyQSA.push( "[*^$]=" + whitespace + "*(?:''|\"\")" ); + } + + // Support: IE8 + // Boolean attributes and "value" are not treated correctly + if ( !el.querySelectorAll("[selected]").length ) { + rbuggyQSA.push( "\\[" + whitespace + "*(?:value|" + booleans + ")" ); + } + + // Support: Chrome<29, Android<4.4, Safari<7.0+, iOS<7.0+, PhantomJS<1.9.8+ + if ( !el.querySelectorAll( "[id~=" + expando + "-]" ).length ) { + rbuggyQSA.push("~="); + } + + // Webkit/Opera - :checked should return selected option elements + // http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked + // IE8 throws error here and will not see later tests + if ( !el.querySelectorAll(":checked").length ) { + rbuggyQSA.push(":checked"); + } + + // Support: Safari 8+, iOS 8+ + // https://bugs.webkit.org/show_bug.cgi?id=136851 + // In-page `selector#id sibling-combinator selector` fails + if ( !el.querySelectorAll( "a#" + expando + "+*" ).length ) { + rbuggyQSA.push(".#.+[+~]"); + } + }); + + assert(function( el ) { + el.innerHTML = "" + + ""; + + // Support: Windows 8 Native Apps + // The type and name attributes are restricted during .innerHTML assignment + var input = document.createElement("input"); + input.setAttribute( "type", "hidden" ); + el.appendChild( input ).setAttribute( "name", "D" ); + + // Support: IE8 + // Enforce case-sensitivity of name attribute + if ( el.querySelectorAll("[name=d]").length ) { + rbuggyQSA.push( "name" + whitespace + "*[*^$|!~]?=" ); + } + + // FF 3.5 - :enabled/:disabled and hidden elements (hidden elements are still enabled) + // IE8 throws error here and will not see later tests + if ( el.querySelectorAll(":enabled").length !== 2 ) { + rbuggyQSA.push( ":enabled", ":disabled" ); + } + + // Support: IE9-11+ + // IE's :disabled selector does not pick up the children of disabled fieldsets + docElem.appendChild( el ).disabled = true; + if ( el.querySelectorAll(":disabled").length !== 2 ) { + rbuggyQSA.push( ":enabled", ":disabled" ); + } + + // Opera 10-11 does not throw on post-comma invalid pseudos + el.querySelectorAll("*,:x"); + rbuggyQSA.push(",.*:"); + }); + } + + if ( (support.matchesSelector = rnative.test( (matches = docElem.matches || + docElem.webkitMatchesSelector || + docElem.mozMatchesSelector || + docElem.oMatchesSelector || + docElem.msMatchesSelector) )) ) { + + assert(function( el ) { + // Check to see if it's possible to do matchesSelector + // on a disconnected node (IE 9) + support.disconnectedMatch = matches.call( el, "*" ); + + // This should fail with an exception + // Gecko does not error, returns false instead + matches.call( el, "[s!='']:x" ); + rbuggyMatches.push( "!=", pseudos ); + }); + } + + rbuggyQSA = rbuggyQSA.length && new RegExp( rbuggyQSA.join("|") ); + rbuggyMatches = rbuggyMatches.length && new RegExp( rbuggyMatches.join("|") ); + + /* Contains + ---------------------------------------------------------------------- */ + hasCompare = rnative.test( docElem.compareDocumentPosition ); + + // Element contains another + // Purposefully self-exclusive + // As in, an element does not contain itself + contains = hasCompare || rnative.test( docElem.contains ) ? + function( a, b ) { + var adown = a.nodeType === 9 ? a.documentElement : a, + bup = b && b.parentNode; + return a === bup || !!( bup && bup.nodeType === 1 && ( + adown.contains ? + adown.contains( bup ) : + a.compareDocumentPosition && a.compareDocumentPosition( bup ) & 16 + )); + } : + function( a, b ) { + if ( b ) { + while ( (b = b.parentNode) ) { + if ( b === a ) { + return true; + } + } + } + return false; + }; + + /* Sorting + ---------------------------------------------------------------------- */ + + // Document order sorting + sortOrder = hasCompare ? + function( a, b ) { + + // Flag for duplicate removal + if ( a === b ) { + hasDuplicate = true; + return 0; + } + + // Sort on method existence if only one input has compareDocumentPosition + var compare = !a.compareDocumentPosition - !b.compareDocumentPosition; + if ( compare ) { + return compare; + } + + // Calculate position if both inputs belong to the same document + compare = ( a.ownerDocument || a ) === ( b.ownerDocument || b ) ? + a.compareDocumentPosition( b ) : + + // Otherwise we know they are disconnected + 1; + + // Disconnected nodes + if ( compare & 1 || + (!support.sortDetached && b.compareDocumentPosition( a ) === compare) ) { + + // Choose the first element that is related to our preferred document + if ( a === document || a.ownerDocument === preferredDoc && contains(preferredDoc, a) ) { + return -1; + } + if ( b === document || b.ownerDocument === preferredDoc && contains(preferredDoc, b) ) { + return 1; + } + + // Maintain original order + return sortInput ? + ( indexOf( sortInput, a ) - indexOf( sortInput, b ) ) : + 0; + } + + return compare & 4 ? -1 : 1; + } : + function( a, b ) { + // Exit early if the nodes are identical + if ( a === b ) { + hasDuplicate = true; + return 0; + } + + var cur, + i = 0, + aup = a.parentNode, + bup = b.parentNode, + ap = [ a ], + bp = [ b ]; + + // Parentless nodes are either documents or disconnected + if ( !aup || !bup ) { + return a === document ? -1 : + b === document ? 1 : + aup ? -1 : + bup ? 1 : + sortInput ? + ( indexOf( sortInput, a ) - indexOf( sortInput, b ) ) : + 0; + + // If the nodes are siblings, we can do a quick check + } else if ( aup === bup ) { + return siblingCheck( a, b ); + } + + // Otherwise we need full lists of their ancestors for comparison + cur = a; + while ( (cur = cur.parentNode) ) { + ap.unshift( cur ); + } + cur = b; + while ( (cur = cur.parentNode) ) { + bp.unshift( cur ); + } + + // Walk down the tree looking for a discrepancy + while ( ap[i] === bp[i] ) { + i++; + } + + return i ? + // Do a sibling check if the nodes have a common ancestor + siblingCheck( ap[i], bp[i] ) : + + // Otherwise nodes in our document sort first + ap[i] === preferredDoc ? -1 : + bp[i] === preferredDoc ? 1 : + 0; + }; + + return document; +}; + +Sizzle.matches = function( expr, elements ) { + return Sizzle( expr, null, null, elements ); +}; + +Sizzle.matchesSelector = function( elem, expr ) { + // Set document vars if needed + if ( ( elem.ownerDocument || elem ) !== document ) { + setDocument( elem ); + } + + // Make sure that attribute selectors are quoted + expr = expr.replace( rattributeQuotes, "='$1']" ); + + if ( support.matchesSelector && documentIsHTML && + !compilerCache[ expr + " " ] && + ( !rbuggyMatches || !rbuggyMatches.test( expr ) ) && + ( !rbuggyQSA || !rbuggyQSA.test( expr ) ) ) { + + try { + var ret = matches.call( elem, expr ); + + // IE 9's matchesSelector returns false on disconnected nodes + if ( ret || support.disconnectedMatch || + // As well, disconnected nodes are said to be in a document + // fragment in IE 9 + elem.document && elem.document.nodeType !== 11 ) { + return ret; + } + } catch (e) {} + } + + return Sizzle( expr, document, null, [ elem ] ).length > 0; +}; + +Sizzle.contains = function( context, elem ) { + // Set document vars if needed + if ( ( context.ownerDocument || context ) !== document ) { + setDocument( context ); + } + return contains( context, elem ); +}; + +Sizzle.attr = function( elem, name ) { + // Set document vars if needed + if ( ( elem.ownerDocument || elem ) !== document ) { + setDocument( elem ); + } + + var fn = Expr.attrHandle[ name.toLowerCase() ], + // Don't get fooled by Object.prototype properties (jQuery #13807) + val = fn && hasOwn.call( Expr.attrHandle, name.toLowerCase() ) ? + fn( elem, name, !documentIsHTML ) : + undefined; + + return val !== undefined ? + val : + support.attributes || !documentIsHTML ? + elem.getAttribute( name ) : + (val = elem.getAttributeNode(name)) && val.specified ? + val.value : + null; +}; + +Sizzle.escape = function( sel ) { + return (sel + "").replace( rcssescape, fcssescape ); +}; + +Sizzle.error = function( msg ) { + throw new Error( "Syntax error, unrecognized expression: " + msg ); +}; + +/** + * Document sorting and removing duplicates + * @param {ArrayLike} results + */ +Sizzle.uniqueSort = function( results ) { + var elem, + duplicates = [], + j = 0, + i = 0; + + // Unless we *know* we can detect duplicates, assume their presence + hasDuplicate = !support.detectDuplicates; + sortInput = !support.sortStable && results.slice( 0 ); + results.sort( sortOrder ); + + if ( hasDuplicate ) { + while ( (elem = results[i++]) ) { + if ( elem === results[ i ] ) { + j = duplicates.push( i ); + } + } + while ( j-- ) { + results.splice( duplicates[ j ], 1 ); + } + } + + // Clear input after sorting to release objects + // See https://github.com/jquery/sizzle/pull/225 + sortInput = null; + + return results; +}; + +/** + * Utility function for retrieving the text value of an array of DOM nodes + * @param {Array|Element} elem + */ +getText = Sizzle.getText = function( elem ) { + var node, + ret = "", + i = 0, + nodeType = elem.nodeType; + + if ( !nodeType ) { + // If no nodeType, this is expected to be an array + while ( (node = elem[i++]) ) { + // Do not traverse comment nodes + ret += getText( node ); + } + } else if ( nodeType === 1 || nodeType === 9 || nodeType === 11 ) { + // Use textContent for elements + // innerText usage removed for consistency of new lines (jQuery #11153) + if ( typeof elem.textContent === "string" ) { + return elem.textContent; + } else { + // Traverse its children + for ( elem = elem.firstChild; elem; elem = elem.nextSibling ) { + ret += getText( elem ); + } + } + } else if ( nodeType === 3 || nodeType === 4 ) { + return elem.nodeValue; + } + // Do not include comment or processing instruction nodes + + return ret; +}; + +Expr = Sizzle.selectors = { + + // Can be adjusted by the user + cacheLength: 50, + + createPseudo: markFunction, + + match: matchExpr, + + attrHandle: {}, + + find: {}, + + relative: { + ">": { dir: "parentNode", first: true }, + " ": { dir: "parentNode" }, + "+": { dir: "previousSibling", first: true }, + "~": { dir: "previousSibling" } + }, + + preFilter: { + "ATTR": function( match ) { + match[1] = match[1].replace( runescape, funescape ); + + // Move the given value to match[3] whether quoted or unquoted + match[3] = ( match[3] || match[4] || match[5] || "" ).replace( runescape, funescape ); + + if ( match[2] === "~=" ) { + match[3] = " " + match[3] + " "; + } + + return match.slice( 0, 4 ); + }, + + "CHILD": function( match ) { + /* matches from matchExpr["CHILD"] + 1 type (only|nth|...) + 2 what (child|of-type) + 3 argument (even|odd|\d*|\d*n([+-]\d+)?|...) + 4 xn-component of xn+y argument ([+-]?\d*n|) + 5 sign of xn-component + 6 x of xn-component + 7 sign of y-component + 8 y of y-component + */ + match[1] = match[1].toLowerCase(); + + if ( match[1].slice( 0, 3 ) === "nth" ) { + // nth-* requires argument + if ( !match[3] ) { + Sizzle.error( match[0] ); + } + + // numeric x and y parameters for Expr.filter.CHILD + // remember that false/true cast respectively to 0/1 + match[4] = +( match[4] ? match[5] + (match[6] || 1) : 2 * ( match[3] === "even" || match[3] === "odd" ) ); + match[5] = +( ( match[7] + match[8] ) || match[3] === "odd" ); + + // other types prohibit arguments + } else if ( match[3] ) { + Sizzle.error( match[0] ); + } + + return match; + }, + + "PSEUDO": function( match ) { + var excess, + unquoted = !match[6] && match[2]; + + if ( matchExpr["CHILD"].test( match[0] ) ) { + return null; + } + + // Accept quoted arguments as-is + if ( match[3] ) { + match[2] = match[4] || match[5] || ""; + + // Strip excess characters from unquoted arguments + } else if ( unquoted && rpseudo.test( unquoted ) && + // Get excess from tokenize (recursively) + (excess = tokenize( unquoted, true )) && + // advance to the next closing parenthesis + (excess = unquoted.indexOf( ")", unquoted.length - excess ) - unquoted.length) ) { + + // excess is a negative index + match[0] = match[0].slice( 0, excess ); + match[2] = unquoted.slice( 0, excess ); + } + + // Return only captures needed by the pseudo filter method (type and argument) + return match.slice( 0, 3 ); + } + }, + + filter: { + + "TAG": function( nodeNameSelector ) { + var nodeName = nodeNameSelector.replace( runescape, funescape ).toLowerCase(); + return nodeNameSelector === "*" ? + function() { return true; } : + function( elem ) { + return elem.nodeName && elem.nodeName.toLowerCase() === nodeName; + }; + }, + + "CLASS": function( className ) { + var pattern = classCache[ className + " " ]; + + return pattern || + (pattern = new RegExp( "(^|" + whitespace + ")" + className + "(" + whitespace + "|$)" )) && + classCache( className, function( elem ) { + return pattern.test( typeof elem.className === "string" && elem.className || typeof elem.getAttribute !== "undefined" && elem.getAttribute("class") || "" ); + }); + }, + + "ATTR": function( name, operator, check ) { + return function( elem ) { + var result = Sizzle.attr( elem, name ); + + if ( result == null ) { + return operator === "!="; + } + if ( !operator ) { + return true; + } + + result += ""; + + return operator === "=" ? result === check : + operator === "!=" ? result !== check : + operator === "^=" ? check && result.indexOf( check ) === 0 : + operator === "*=" ? check && result.indexOf( check ) > -1 : + operator === "$=" ? check && result.slice( -check.length ) === check : + operator === "~=" ? ( " " + result.replace( rwhitespace, " " ) + " " ).indexOf( check ) > -1 : + operator === "|=" ? result === check || result.slice( 0, check.length + 1 ) === check + "-" : + false; + }; + }, + + "CHILD": function( type, what, argument, first, last ) { + var simple = type.slice( 0, 3 ) !== "nth", + forward = type.slice( -4 ) !== "last", + ofType = what === "of-type"; + + return first === 1 && last === 0 ? + + // Shortcut for :nth-*(n) + function( elem ) { + return !!elem.parentNode; + } : + + function( elem, context, xml ) { + var cache, uniqueCache, outerCache, node, nodeIndex, start, + dir = simple !== forward ? "nextSibling" : "previousSibling", + parent = elem.parentNode, + name = ofType && elem.nodeName.toLowerCase(), + useCache = !xml && !ofType, + diff = false; + + if ( parent ) { + + // :(first|last|only)-(child|of-type) + if ( simple ) { + while ( dir ) { + node = elem; + while ( (node = node[ dir ]) ) { + if ( ofType ? + node.nodeName.toLowerCase() === name : + node.nodeType === 1 ) { + + return false; + } + } + // Reverse direction for :only-* (if we haven't yet done so) + start = dir = type === "only" && !start && "nextSibling"; + } + return true; + } + + start = [ forward ? parent.firstChild : parent.lastChild ]; + + // non-xml :nth-child(...) stores cache data on `parent` + if ( forward && useCache ) { + + // Seek `elem` from a previously-cached index + + // ...in a gzip-friendly way + node = parent; + outerCache = node[ expando ] || (node[ expando ] = {}); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ node.uniqueID ] || + (outerCache[ node.uniqueID ] = {}); + + cache = uniqueCache[ type ] || []; + nodeIndex = cache[ 0 ] === dirruns && cache[ 1 ]; + diff = nodeIndex && cache[ 2 ]; + node = nodeIndex && parent.childNodes[ nodeIndex ]; + + while ( (node = ++nodeIndex && node && node[ dir ] || + + // Fallback to seeking `elem` from the start + (diff = nodeIndex = 0) || start.pop()) ) { + + // When found, cache indexes on `parent` and break + if ( node.nodeType === 1 && ++diff && node === elem ) { + uniqueCache[ type ] = [ dirruns, nodeIndex, diff ]; + break; + } + } + + } else { + // Use previously-cached element index if available + if ( useCache ) { + // ...in a gzip-friendly way + node = elem; + outerCache = node[ expando ] || (node[ expando ] = {}); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ node.uniqueID ] || + (outerCache[ node.uniqueID ] = {}); + + cache = uniqueCache[ type ] || []; + nodeIndex = cache[ 0 ] === dirruns && cache[ 1 ]; + diff = nodeIndex; + } + + // xml :nth-child(...) + // or :nth-last-child(...) or :nth(-last)?-of-type(...) + if ( diff === false ) { + // Use the same loop as above to seek `elem` from the start + while ( (node = ++nodeIndex && node && node[ dir ] || + (diff = nodeIndex = 0) || start.pop()) ) { + + if ( ( ofType ? + node.nodeName.toLowerCase() === name : + node.nodeType === 1 ) && + ++diff ) { + + // Cache the index of each encountered element + if ( useCache ) { + outerCache = node[ expando ] || (node[ expando ] = {}); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ node.uniqueID ] || + (outerCache[ node.uniqueID ] = {}); + + uniqueCache[ type ] = [ dirruns, diff ]; + } + + if ( node === elem ) { + break; + } + } + } + } + } + + // Incorporate the offset, then check against cycle size + diff -= last; + return diff === first || ( diff % first === 0 && diff / first >= 0 ); + } + }; + }, + + "PSEUDO": function( pseudo, argument ) { + // pseudo-class names are case-insensitive + // http://www.w3.org/TR/selectors/#pseudo-classes + // Prioritize by case sensitivity in case custom pseudos are added with uppercase letters + // Remember that setFilters inherits from pseudos + var args, + fn = Expr.pseudos[ pseudo ] || Expr.setFilters[ pseudo.toLowerCase() ] || + Sizzle.error( "unsupported pseudo: " + pseudo ); + + // The user may use createPseudo to indicate that + // arguments are needed to create the filter function + // just as Sizzle does + if ( fn[ expando ] ) { + return fn( argument ); + } + + // But maintain support for old signatures + if ( fn.length > 1 ) { + args = [ pseudo, pseudo, "", argument ]; + return Expr.setFilters.hasOwnProperty( pseudo.toLowerCase() ) ? + markFunction(function( seed, matches ) { + var idx, + matched = fn( seed, argument ), + i = matched.length; + while ( i-- ) { + idx = indexOf( seed, matched[i] ); + seed[ idx ] = !( matches[ idx ] = matched[i] ); + } + }) : + function( elem ) { + return fn( elem, 0, args ); + }; + } + + return fn; + } + }, + + pseudos: { + // Potentially complex pseudos + "not": markFunction(function( selector ) { + // Trim the selector passed to compile + // to avoid treating leading and trailing + // spaces as combinators + var input = [], + results = [], + matcher = compile( selector.replace( rtrim, "$1" ) ); + + return matcher[ expando ] ? + markFunction(function( seed, matches, context, xml ) { + var elem, + unmatched = matcher( seed, null, xml, [] ), + i = seed.length; + + // Match elements unmatched by `matcher` + while ( i-- ) { + if ( (elem = unmatched[i]) ) { + seed[i] = !(matches[i] = elem); + } + } + }) : + function( elem, context, xml ) { + input[0] = elem; + matcher( input, null, xml, results ); + // Don't keep the element (issue #299) + input[0] = null; + return !results.pop(); + }; + }), + + "has": markFunction(function( selector ) { + return function( elem ) { + return Sizzle( selector, elem ).length > 0; + }; + }), + + "contains": markFunction(function( text ) { + text = text.replace( runescape, funescape ); + return function( elem ) { + return ( elem.textContent || elem.innerText || getText( elem ) ).indexOf( text ) > -1; + }; + }), + + // "Whether an element is represented by a :lang() selector + // is based solely on the element's language value + // being equal to the identifier C, + // or beginning with the identifier C immediately followed by "-". + // The matching of C against the element's language value is performed case-insensitively. + // The identifier C does not have to be a valid language name." + // http://www.w3.org/TR/selectors/#lang-pseudo + "lang": markFunction( function( lang ) { + // lang value must be a valid identifier + if ( !ridentifier.test(lang || "") ) { + Sizzle.error( "unsupported lang: " + lang ); + } + lang = lang.replace( runescape, funescape ).toLowerCase(); + return function( elem ) { + var elemLang; + do { + if ( (elemLang = documentIsHTML ? + elem.lang : + elem.getAttribute("xml:lang") || elem.getAttribute("lang")) ) { + + elemLang = elemLang.toLowerCase(); + return elemLang === lang || elemLang.indexOf( lang + "-" ) === 0; + } + } while ( (elem = elem.parentNode) && elem.nodeType === 1 ); + return false; + }; + }), + + // Miscellaneous + "target": function( elem ) { + var hash = window.location && window.location.hash; + return hash && hash.slice( 1 ) === elem.id; + }, + + "root": function( elem ) { + return elem === docElem; + }, + + "focus": function( elem ) { + return elem === document.activeElement && (!document.hasFocus || document.hasFocus()) && !!(elem.type || elem.href || ~elem.tabIndex); + }, + + // Boolean properties + "enabled": createDisabledPseudo( false ), + "disabled": createDisabledPseudo( true ), + + "checked": function( elem ) { + // In CSS3, :checked should return both checked and selected elements + // http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked + var nodeName = elem.nodeName.toLowerCase(); + return (nodeName === "input" && !!elem.checked) || (nodeName === "option" && !!elem.selected); + }, + + "selected": function( elem ) { + // Accessing this property makes selected-by-default + // options in Safari work properly + if ( elem.parentNode ) { + elem.parentNode.selectedIndex; + } + + return elem.selected === true; + }, + + // Contents + "empty": function( elem ) { + // http://www.w3.org/TR/selectors/#empty-pseudo + // :empty is negated by element (1) or content nodes (text: 3; cdata: 4; entity ref: 5), + // but not by others (comment: 8; processing instruction: 7; etc.) + // nodeType < 6 works because attributes (2) do not appear as children + for ( elem = elem.firstChild; elem; elem = elem.nextSibling ) { + if ( elem.nodeType < 6 ) { + return false; + } + } + return true; + }, + + "parent": function( elem ) { + return !Expr.pseudos["empty"]( elem ); + }, + + // Element/input types + "header": function( elem ) { + return rheader.test( elem.nodeName ); + }, + + "input": function( elem ) { + return rinputs.test( elem.nodeName ); + }, + + "button": function( elem ) { + var name = elem.nodeName.toLowerCase(); + return name === "input" && elem.type === "button" || name === "button"; + }, + + "text": function( elem ) { + var attr; + return elem.nodeName.toLowerCase() === "input" && + elem.type === "text" && + + // Support: IE<8 + // New HTML5 attribute values (e.g., "search") appear with elem.type === "text" + ( (attr = elem.getAttribute("type")) == null || attr.toLowerCase() === "text" ); + }, + + // Position-in-collection + "first": createPositionalPseudo(function() { + return [ 0 ]; + }), + + "last": createPositionalPseudo(function( matchIndexes, length ) { + return [ length - 1 ]; + }), + + "eq": createPositionalPseudo(function( matchIndexes, length, argument ) { + return [ argument < 0 ? argument + length : argument ]; + }), + + "even": createPositionalPseudo(function( matchIndexes, length ) { + var i = 0; + for ( ; i < length; i += 2 ) { + matchIndexes.push( i ); + } + return matchIndexes; + }), + + "odd": createPositionalPseudo(function( matchIndexes, length ) { + var i = 1; + for ( ; i < length; i += 2 ) { + matchIndexes.push( i ); + } + return matchIndexes; + }), + + "lt": createPositionalPseudo(function( matchIndexes, length, argument ) { + var i = argument < 0 ? argument + length : argument; + for ( ; --i >= 0; ) { + matchIndexes.push( i ); + } + return matchIndexes; + }), + + "gt": createPositionalPseudo(function( matchIndexes, length, argument ) { + var i = argument < 0 ? argument + length : argument; + for ( ; ++i < length; ) { + matchIndexes.push( i ); + } + return matchIndexes; + }) + } +}; + +Expr.pseudos["nth"] = Expr.pseudos["eq"]; + +// Add button/input type pseudos +for ( i in { radio: true, checkbox: true, file: true, password: true, image: true } ) { + Expr.pseudos[ i ] = createInputPseudo( i ); +} +for ( i in { submit: true, reset: true } ) { + Expr.pseudos[ i ] = createButtonPseudo( i ); +} + +// Easy API for creating new setFilters +function setFilters() {} +setFilters.prototype = Expr.filters = Expr.pseudos; +Expr.setFilters = new setFilters(); + +tokenize = Sizzle.tokenize = function( selector, parseOnly ) { + var matched, match, tokens, type, + soFar, groups, preFilters, + cached = tokenCache[ selector + " " ]; + + if ( cached ) { + return parseOnly ? 0 : cached.slice( 0 ); + } + + soFar = selector; + groups = []; + preFilters = Expr.preFilter; + + while ( soFar ) { + + // Comma and first run + if ( !matched || (match = rcomma.exec( soFar )) ) { + if ( match ) { + // Don't consume trailing commas as valid + soFar = soFar.slice( match[0].length ) || soFar; + } + groups.push( (tokens = []) ); + } + + matched = false; + + // Combinators + if ( (match = rcombinators.exec( soFar )) ) { + matched = match.shift(); + tokens.push({ + value: matched, + // Cast descendant combinators to space + type: match[0].replace( rtrim, " " ) + }); + soFar = soFar.slice( matched.length ); + } + + // Filters + for ( type in Expr.filter ) { + if ( (match = matchExpr[ type ].exec( soFar )) && (!preFilters[ type ] || + (match = preFilters[ type ]( match ))) ) { + matched = match.shift(); + tokens.push({ + value: matched, + type: type, + matches: match + }); + soFar = soFar.slice( matched.length ); + } + } + + if ( !matched ) { + break; + } + } + + // Return the length of the invalid excess + // if we're just parsing + // Otherwise, throw an error or return tokens + return parseOnly ? + soFar.length : + soFar ? + Sizzle.error( selector ) : + // Cache the tokens + tokenCache( selector, groups ).slice( 0 ); +}; + +function toSelector( tokens ) { + var i = 0, + len = tokens.length, + selector = ""; + for ( ; i < len; i++ ) { + selector += tokens[i].value; + } + return selector; +} + +function addCombinator( matcher, combinator, base ) { + var dir = combinator.dir, + skip = combinator.next, + key = skip || dir, + checkNonElements = base && key === "parentNode", + doneName = done++; + + return combinator.first ? + // Check against closest ancestor/preceding element + function( elem, context, xml ) { + while ( (elem = elem[ dir ]) ) { + if ( elem.nodeType === 1 || checkNonElements ) { + return matcher( elem, context, xml ); + } + } + return false; + } : + + // Check against all ancestor/preceding elements + function( elem, context, xml ) { + var oldCache, uniqueCache, outerCache, + newCache = [ dirruns, doneName ]; + + // We can't set arbitrary data on XML nodes, so they don't benefit from combinator caching + if ( xml ) { + while ( (elem = elem[ dir ]) ) { + if ( elem.nodeType === 1 || checkNonElements ) { + if ( matcher( elem, context, xml ) ) { + return true; + } + } + } + } else { + while ( (elem = elem[ dir ]) ) { + if ( elem.nodeType === 1 || checkNonElements ) { + outerCache = elem[ expando ] || (elem[ expando ] = {}); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ elem.uniqueID ] || (outerCache[ elem.uniqueID ] = {}); + + if ( skip && skip === elem.nodeName.toLowerCase() ) { + elem = elem[ dir ] || elem; + } else if ( (oldCache = uniqueCache[ key ]) && + oldCache[ 0 ] === dirruns && oldCache[ 1 ] === doneName ) { + + // Assign to newCache so results back-propagate to previous elements + return (newCache[ 2 ] = oldCache[ 2 ]); + } else { + // Reuse newcache so results back-propagate to previous elements + uniqueCache[ key ] = newCache; + + // A match means we're done; a fail means we have to keep checking + if ( (newCache[ 2 ] = matcher( elem, context, xml )) ) { + return true; + } + } + } + } + } + return false; + }; +} + +function elementMatcher( matchers ) { + return matchers.length > 1 ? + function( elem, context, xml ) { + var i = matchers.length; + while ( i-- ) { + if ( !matchers[i]( elem, context, xml ) ) { + return false; + } + } + return true; + } : + matchers[0]; +} + +function multipleContexts( selector, contexts, results ) { + var i = 0, + len = contexts.length; + for ( ; i < len; i++ ) { + Sizzle( selector, contexts[i], results ); + } + return results; +} + +function condense( unmatched, map, filter, context, xml ) { + var elem, + newUnmatched = [], + i = 0, + len = unmatched.length, + mapped = map != null; + + for ( ; i < len; i++ ) { + if ( (elem = unmatched[i]) ) { + if ( !filter || filter( elem, context, xml ) ) { + newUnmatched.push( elem ); + if ( mapped ) { + map.push( i ); + } + } + } + } + + return newUnmatched; +} + +function setMatcher( preFilter, selector, matcher, postFilter, postFinder, postSelector ) { + if ( postFilter && !postFilter[ expando ] ) { + postFilter = setMatcher( postFilter ); + } + if ( postFinder && !postFinder[ expando ] ) { + postFinder = setMatcher( postFinder, postSelector ); + } + return markFunction(function( seed, results, context, xml ) { + var temp, i, elem, + preMap = [], + postMap = [], + preexisting = results.length, + + // Get initial elements from seed or context + elems = seed || multipleContexts( selector || "*", context.nodeType ? [ context ] : context, [] ), + + // Prefilter to get matcher input, preserving a map for seed-results synchronization + matcherIn = preFilter && ( seed || !selector ) ? + condense( elems, preMap, preFilter, context, xml ) : + elems, + + matcherOut = matcher ? + // If we have a postFinder, or filtered seed, or non-seed postFilter or preexisting results, + postFinder || ( seed ? preFilter : preexisting || postFilter ) ? + + // ...intermediate processing is necessary + [] : + + // ...otherwise use results directly + results : + matcherIn; + + // Find primary matches + if ( matcher ) { + matcher( matcherIn, matcherOut, context, xml ); + } + + // Apply postFilter + if ( postFilter ) { + temp = condense( matcherOut, postMap ); + postFilter( temp, [], context, xml ); + + // Un-match failing elements by moving them back to matcherIn + i = temp.length; + while ( i-- ) { + if ( (elem = temp[i]) ) { + matcherOut[ postMap[i] ] = !(matcherIn[ postMap[i] ] = elem); + } + } + } + + if ( seed ) { + if ( postFinder || preFilter ) { + if ( postFinder ) { + // Get the final matcherOut by condensing this intermediate into postFinder contexts + temp = []; + i = matcherOut.length; + while ( i-- ) { + if ( (elem = matcherOut[i]) ) { + // Restore matcherIn since elem is not yet a final match + temp.push( (matcherIn[i] = elem) ); + } + } + postFinder( null, (matcherOut = []), temp, xml ); + } + + // Move matched elements from seed to results to keep them synchronized + i = matcherOut.length; + while ( i-- ) { + if ( (elem = matcherOut[i]) && + (temp = postFinder ? indexOf( seed, elem ) : preMap[i]) > -1 ) { + + seed[temp] = !(results[temp] = elem); + } + } + } + + // Add elements to results, through postFinder if defined + } else { + matcherOut = condense( + matcherOut === results ? + matcherOut.splice( preexisting, matcherOut.length ) : + matcherOut + ); + if ( postFinder ) { + postFinder( null, results, matcherOut, xml ); + } else { + push.apply( results, matcherOut ); + } + } + }); +} + +function matcherFromTokens( tokens ) { + var checkContext, matcher, j, + len = tokens.length, + leadingRelative = Expr.relative[ tokens[0].type ], + implicitRelative = leadingRelative || Expr.relative[" "], + i = leadingRelative ? 1 : 0, + + // The foundational matcher ensures that elements are reachable from top-level context(s) + matchContext = addCombinator( function( elem ) { + return elem === checkContext; + }, implicitRelative, true ), + matchAnyContext = addCombinator( function( elem ) { + return indexOf( checkContext, elem ) > -1; + }, implicitRelative, true ), + matchers = [ function( elem, context, xml ) { + var ret = ( !leadingRelative && ( xml || context !== outermostContext ) ) || ( + (checkContext = context).nodeType ? + matchContext( elem, context, xml ) : + matchAnyContext( elem, context, xml ) ); + // Avoid hanging onto element (issue #299) + checkContext = null; + return ret; + } ]; + + for ( ; i < len; i++ ) { + if ( (matcher = Expr.relative[ tokens[i].type ]) ) { + matchers = [ addCombinator(elementMatcher( matchers ), matcher) ]; + } else { + matcher = Expr.filter[ tokens[i].type ].apply( null, tokens[i].matches ); + + // Return special upon seeing a positional matcher + if ( matcher[ expando ] ) { + // Find the next relative operator (if any) for proper handling + j = ++i; + for ( ; j < len; j++ ) { + if ( Expr.relative[ tokens[j].type ] ) { + break; + } + } + return setMatcher( + i > 1 && elementMatcher( matchers ), + i > 1 && toSelector( + // If the preceding token was a descendant combinator, insert an implicit any-element `*` + tokens.slice( 0, i - 1 ).concat({ value: tokens[ i - 2 ].type === " " ? "*" : "" }) + ).replace( rtrim, "$1" ), + matcher, + i < j && matcherFromTokens( tokens.slice( i, j ) ), + j < len && matcherFromTokens( (tokens = tokens.slice( j )) ), + j < len && toSelector( tokens ) + ); + } + matchers.push( matcher ); + } + } + + return elementMatcher( matchers ); +} + +function matcherFromGroupMatchers( elementMatchers, setMatchers ) { + var bySet = setMatchers.length > 0, + byElement = elementMatchers.length > 0, + superMatcher = function( seed, context, xml, results, outermost ) { + var elem, j, matcher, + matchedCount = 0, + i = "0", + unmatched = seed && [], + setMatched = [], + contextBackup = outermostContext, + // We must always have either seed elements or outermost context + elems = seed || byElement && Expr.find["TAG"]( "*", outermost ), + // Use integer dirruns iff this is the outermost matcher + dirrunsUnique = (dirruns += contextBackup == null ? 1 : Math.random() || 0.1), + len = elems.length; + + if ( outermost ) { + outermostContext = context === document || context || outermost; + } + + // Add elements passing elementMatchers directly to results + // Support: IE<9, Safari + // Tolerate NodeList properties (IE: "length"; Safari: