Idp blacklisting #141
Idp blacklisting #141
Conversation
| @@ -13,6 +13,8 @@ config: | |||
| local: [idp.xml] | |||
|
|
|||
| entityid: <base_url>/<name>/proxy_saml2_backend.xml | |||
| idp_blacklist_enabled: true | |||
There was a problem hiding this comment.
Do we really need this? An undefined or empty idp_blacklist_file entry would suffice, imo.
There was a problem hiding this comment.
yeap, could be done this way too.
src/satosa/backends/saml2.py
Outdated
|
|
||
| # If IDP blacklisting is enabled and the selected IDP is blacklisted, | ||
| # stop here | ||
| if self.config["sp_config"].get("idp_blacklist_enabled", None): |
There was a problem hiding this comment.
The place where the setting is set, is in pysaml2's configuration domain. As such it should be registered with pysaml2's configuration module, and accessed as self.sp.config.getattr("idp_blacklist_enabled", "").
If we intend this to be a SATOSA configuration option (which makes sense because it enforces policy) it should be moved out of the sp_config block, and placed under the config block. Then, one can either set it on initialization (through __init__ and use self. idp_blacklist_enabled) or invoke the configuration directly as config.get("idp_blacklist_enabled").
There was a problem hiding this comment.
you're right, this is intended to be SATOSA config, so I'll move this to config
|
LGTM |
This enables the SAML backend to define a list of blacklisted SAML IdPs that can't be used. If a user selects one of those, we return an error.
The assumed format of the
idp_blacklist_fileis :{"blacklist": [ "https://blacklisted_entityid1.org/saml/idp", "https://blacklisted_entityid2.org/saml/idp", "https://blacklisted_entityid3.org/saml/idp", ]}