Adds support for RequestedAuthnContext SSO kwarg #288
Conversation
pandafy
force-pushed
the
requested-authn-context
branch
from
5ee0407 to
c1c5da0
Compare
djangosaml2/views.py
Outdated
| ) | ||
| csc = settings.SAML_CONFIG.get( |
There was a problem hiding this comment.
please don't use, even/if possibile, django static settings but getattr(conf, ... instead.
There was a problem hiding this comment.
We have a commit for that, please update your branch
pandafy
force-pushed
the
requested-authn-context
branch
from
c1c5da0 to
42e5d52
Compare
| '_sp_digest_algorithm', | ||
| saml2.xmldsig.DIGEST_SHA256 | ||
| ) | ||
| csc = getattr(settings, 'SAML_CONFIG', {}).get( |
There was a problem hiding this comment.
This code is definitevely changed, please update your branch
djangosaml2/djangosaml2/views.py
Line 251 in 8c7a5e9
| saml2.xmldsig.SIG_RSA_SHA256) | ||
| sso_kwargs["digest_alg"] = csc.get('digest_algorithm', | ||
| saml2.xmldsig.DIGEST_SHA256) | ||
| sso_kwargs['requested_authn_context'] = csc.get('requested_authn_context', None) |
There was a problem hiding this comment.
Here you MUST build the AuthnContext object, until pysaml2 won't merge your PR
There was a problem hiding this comment.
I was expecting user to add the RequestedAuthnContext as following in SAML_CONFIG
...
'requested_authn_context': saml2.samlp.RequestedAuthnContext(
authn_context_class_ref=[
saml2.saml.AuthnContextClassRef(
saml2.saml.AUTHN_PASSWORD_PROTECTED
),
],
comparison="exact",
),
...How do you expect user to set this configuration?
There was a problem hiding this comment.
'requested_authn_context': {
'authn_context_class_ref': saml2.saml.AUTHN_PASSWORD_PROTECTED,
'comparison': "exact"
}
@c00kiemon5ter what do you think about this solution also for PySAML2 configuration?
There was a problem hiding this comment.
@peppelinux should I make these changes or wait for Ivan's review?
There was a problem hiding this comment.
Go ahead, Life Is youth!
We'll handle this in the way we decided, @c00kiemon5ter can Always make a good clue and we'll see if change again or not but, for now, let's get the things done!
pandafy
force-pushed
the
requested-authn-context
branch
from
42e5d52 to
85b03b5
Compare
pandafy
force-pushed
the
requested-authn-context
branch
from
85b03b5 to
9f34154
Compare
|
Hi @pandafy I couldn't get rid of you with a little chat, so I decided to join you halfway with this proposal, which ideally surpasses this PR, which I therefore close. The solution I propose is immediately usable and allows us to work waiting for pysaml2 to also join your contribution, when this happens, well, the solution I propose will continue to work as it is :) I love this job! |
Depends on IdentityPython/pysaml2#807