providers/saml: disallow idp-initiated SSO by default and validate Request ID

2020-09-12 00:53:38 +02:00
parent c2ebaa7f64
commit ca0ba85023
10 changed files with 138 additions and 47 deletions
--- a/passbook/sources/saml/exceptions.py
+++ b/passbook/sources/saml/exceptions.py
@ -8,3 +8,7 @@ class MissingSAMLResponse(SentryIgnoredException):

 class UnsupportedNameIDFormat(SentryIgnoredException):
    """Exception raised when SAML Response contains NameID Format not supported."""
+
+
+class MismatchedRequestID(SentryIgnoredException):
+    """Exception raised when the returned request ID doesn't match the saved ID."""