e36d7928e4
add New fields for - assertion_valid_not_before - assertion_valid_not_on_or_after - session_valid_not_on_or_after allow flexible time durations for these fields fall back to Provider's ACS if none is specified in AuthNRequest
32 lines
1.1 KiB
Python
32 lines
1.1 KiB
Python
"""Signing code goes here."""
|
|
from cryptography.hazmat.backends import default_backend
|
|
from cryptography.hazmat.primitives import serialization
|
|
from lxml import etree # nosec
|
|
from signxml import XMLSigner, XMLVerifier
|
|
from structlog import get_logger
|
|
|
|
from passbook.lib.utils.template import render_to_string
|
|
|
|
LOGGER = get_logger()
|
|
|
|
|
|
def sign_with_signxml(private_key, data, cert, reference_uri=None):
|
|
"""Sign Data with signxml"""
|
|
key = serialization.load_pem_private_key(
|
|
str.encode("\n".join([x.strip() for x in private_key.split("\n")])),
|
|
password=None,
|
|
backend=default_backend(),
|
|
)
|
|
# defused XML is not used here because it messes up XML namespaces
|
|
# Data is trusted, so lxml is ok
|
|
root = etree.fromstring(data) # nosec
|
|
signer = XMLSigner(c14n_algorithm="http://www.w3.org/2001/10/xml-exc-c14n#")
|
|
signed = signer.sign(root, key=key, cert=[cert], reference_uri=reference_uri)
|
|
XMLVerifier().verify(signed, x509_cert=cert)
|
|
return etree.tostring(signed).decode("utf-8") # nosec
|
|
|
|
|
|
def get_signature_xml():
|
|
"""Returns XML Signature for subject."""
|
|
return render_to_string("saml/xml/signature.xml", {})
|