Classes representing Identity Provider or Attribute Authority instances

Author:Roland Hedberg
Version:1.2

Module

Contains classes and functions that a SAML2.0 Identity provider (IdP) or attribute authority (AA) may use to conclude its tasks.

class saml2.server.Server(config_file='', config=None, cache=None, stype='idp', symkey='')

A class that does things that IdPs or AAs do

create_assertion_id_request_response(assertion_id, sign=False, **kwargs)
Parameters:
  • assertion_id
  • sign
Returns:

create_attribute_response(identity, in_response_to, destination, sp_entity_id, userid='', name_id=None, status=None, issuer=None, sign_assertion=False, sign_response=False, attributes=None, **kwargs)

Create an attribute assertion response.

Parameters:
  • identity – A dictionary with attributes and values that are expected to be the bases for the assertion in the response.
  • in_response_to – The session identifier of the request
  • destination – The URL which should receive the response
  • sp_entity_id – The entity identifier of the SP
  • userid – A identifier of the user
  • name_id – The identifier of the subject
  • status – The status of the response
  • issuer – The issuer of the response
  • sign_assertion – Whether the assertion should be signed or not
  • sign_response – Whether the whole response should be signed
  • attributes
  • kwargs – To catch extra keyword arguments
Returns:

A response instance

create_authn_query_response(subject, session_index=None, requested_context=None, in_response_to=None, issuer=None, sign_response=False, status=None, **kwargs)

A successful <Response> will contain one or more assertions containing authentication statements.

Returns:
create_authn_response(identity, in_response_to, destination, sp_entity_id, name_id_policy=None, userid=None, name_id=None, authn=None, issuer=None, sign_response=False, sign_assertion=False, **kwargs)

Constructs an AuthenticationResponse

Parameters:
  • identity – Information about an user
  • in_response_to – The identifier of the authentication request this response is an answer to.
  • destination – Where the response should be sent
  • sp_entity_id – The entity identifier of the Service Provider
  • name_id_policy – How the NameID should be constructed
  • userid – The subject identifier
  • authn – Dictionary with information about the authentication context
  • issuer – Issuer of the response
  • sign_assertion – Whether the assertion should be signed or not.
  • sign_response – Whether the response should be signed or not.
Returns:

A response instance

create_name_id_mapping_response(name_id=None, encrypted_id=None, in_response_to=None, issuer=None, sign_response=False, status=None, **kwargs)

protocol for mapping a principal’s name identifier into a different name identifier for the same principal. Done over soap.

Parameters:
  • name_id
  • encrypted_id
  • in_response_to
  • issuer
  • sign_response
  • status
Returns:

init_config(stype='idp')

Remaining init of the server configuration

Parameters:stype – The type of Server (“idp”/”aa”)
parse_assertion_id_request(xml_string, binding)

Parse an assertion id query

Parameters:
  • xml_string – The AssertionIDRequest as an XML string
  • binding – Which binding that was used when receiving this request
Returns:

Query instance

parse_attribute_query(xml_string, binding)

Parse an attribute query

Parameters:
  • xml_string – The Attribute Query as an XML string
  • binding – Which binding that was used for the request
Returns:

A query instance

parse_authn_query(xml_string, binding)

Parse an authn query

Parameters:
  • xml_string – The AuthnQuery as an XML string
  • binding – Which binding that was used when receiving this query
Returns:

Query instance

parse_authn_request(enc_request, binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect')

Parse a Authentication Request

Parameters:
  • enc_request – The request in its transport format
  • binding – Which binding that was used to transport the message to this entity.
Returns:

A dictionary with keys: consumer_url - as gotten from the SPs entity_id and the metadata id - the id of the request sp_entity_id - the entity id of the SP request - The verified request

parse_authz_decision_query(xml_string, binding)

Parse an authorization decision query

Parameters:
  • xml_string – The Authz decision Query as an XML string
  • binding – Which binding that was used when receiving this query
Returns:

Query instance

parse_name_id_mapping_request(xml_string, binding)

Parse a nameid mapping request

Parameters:
  • xml_string – The NameIDMappingRequest as an XML string
  • binding – Which binding that was used when receiving this request
Returns:

Query instance

wants(sp_entity_id, index=None)

Returns what attributes the SP requires and which are optional if any such demands are registered in the Metadata.

Parameters:
  • sp_entity_id – The entity id of the SP
  • index – which of the attribute consumer services its all about
Returns:

2-tuple, list of required and list of optional attributes

Table Of Contents

Previous topic

Classes representing Service Provider instances

Next topic

These are examples of the usage of pySAML2!

This Page