diff --git a/src/onelogin/saml2/metadata.py b/src/onelogin/saml2/metadata.py
index 11adbf49..212c0e95 100644
--- a/src/onelogin/saml2/metadata.py
+++ b/src/onelogin/saml2/metadata.py
@@ -227,7 +227,7 @@ def sign_metadata(metadata, key, cert, sign_algorithm=OneLogin_Saml2_Constants.R
return OneLogin_Saml2_Utils.add_sign(metadata, key, cert, False, sign_algorithm, digest_algorithm)
@staticmethod
- def add_x509_key_descriptors(metadata, cert=None):
+ def add_x509_key_descriptors(metadata, cert=None, add_encryption=True):
"""
Adds the x509 descriptors (sign/encryption) to the metadata
The same cert will be used for sign/encrypt
@@ -238,6 +238,9 @@ def add_x509_key_descriptors(metadata, cert=None):
:param cert: x509 cert
:type cert: string
+ :param add_encryption: Determines if the KeyDescriptor[use="encryption"] should be added.
+ :type add_encryption: boolean
+
:returns: Metadata with KeyDescriptors
:rtype: string
"""
@@ -265,17 +268,18 @@ def add_x509_key_descriptors(metadata, cert=None):
sp_sso_descriptor = entity_descriptor.getElementsByTagName('md:SPSSODescriptor')[0]
sp_sso_descriptor.insertBefore(key_descriptor.cloneNode(True), sp_sso_descriptor.firstChild)
+ if add_encryption:
+ sp_sso_descriptor.insertBefore(key_descriptor.cloneNode(True), sp_sso_descriptor.firstChild)
signing = xml.getElementsByTagName('md:KeyDescriptor')[0]
signing.setAttribute('use', 'signing')
-
- encryption = xml.getElementsByTagName('md:KeyDescriptor')[1]
- encryption.setAttribute('use', 'encryption')
-
signing.appendChild(key_info)
- encryption.appendChild(key_info.cloneNode(True))
-
signing.setAttribute('xmlns:ds', OneLogin_Saml2_Constants.NS_DS)
- encryption.setAttribute('xmlns:ds', OneLogin_Saml2_Constants.NS_DS)
+
+ if add_encryption:
+ encryption = xml.getElementsByTagName('md:KeyDescriptor')[1]
+ encryption.setAttribute('use', 'encryption')
+ encryption.appendChild(key_info.cloneNode(True))
+ encryption.setAttribute('xmlns:ds', OneLogin_Saml2_Constants.NS_DS)
return xml.toxml()
diff --git a/src/onelogin/saml2/settings.py b/src/onelogin/saml2/settings.py
index de3200c9..f3c53be1 100644
--- a/src/onelogin/saml2/settings.py
+++ b/src/onelogin/saml2/settings.py
@@ -622,11 +622,13 @@ def get_sp_metadata(self):
self.get_contacts(), self.get_organization()
)
+ add_encryption = self.__security['wantNameIdEncrypted'] or self.__security['wantAssertionsEncrypted']
+
cert_new = self.get_sp_cert_new()
- metadata = OneLogin_Saml2_Metadata.add_x509_key_descriptors(metadata, cert_new)
+ metadata = OneLogin_Saml2_Metadata.add_x509_key_descriptors(metadata, cert_new, add_encryption)
cert = self.get_sp_cert()
- metadata = OneLogin_Saml2_Metadata.add_x509_key_descriptors(metadata, cert)
+ metadata = OneLogin_Saml2_Metadata.add_x509_key_descriptors(metadata, cert, add_encryption)
# Sign metadata
if 'signMetadata' in self.__security and self.__security['signMetadata'] is not False:
diff --git a/tests/src/OneLogin/saml2_tests/settings_test.py b/tests/src/OneLogin/saml2_tests/settings_test.py
index bca6de7a..4b79715d 100644
--- a/tests/src/OneLogin/saml2_tests/settings_test.py
+++ b/tests/src/OneLogin/saml2_tests/settings_test.py
@@ -341,7 +341,10 @@ def testGetSPMetadata(self):
Tests the getSPMetadata method of the OneLogin_Saml2_Settings
Case unsigned metadata
"""
- settings = OneLogin_Saml2_Settings(self.loadSettingsJSON())
+ settings_info = self.loadSettingsJSON()
+ settings_info['security']['wantNameIdEncrypted'] = False
+ settings_info['security']['wantAssertionsEncrypted'] = False
+ settings = OneLogin_Saml2_Settings(settings_info)
metadata = settings.get_sp_metadata()
self.assertNotEqual(len(metadata), 0)
@@ -352,6 +355,14 @@ def testGetSPMetadata(self):
self.assertIn('', metadata)
self.assertIn('', metadata)
self.assertIn('urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified', metadata)
+ self.assertEquals(1, metadata.count('