From 8dcb31bc4f24c11388cbf9906e2bd77c6e55f089 Mon Sep 17 00:00:00 2001 From: Ivan Kanakarakis Date: Fri, 8 Jan 2021 19:51:57 +0200 Subject: [PATCH] Strengthen XSW tests Signed-off-by: Ivan Kanakarakis --- MANIFEST.in | 2 +- tests/saml2_response_xsw.xml | 6 -- tests/test_xsw.py | 59 ++++++++++++++++--- tests/xsw/signed-xsw-assertion-assertion.xml | 8 +++ tests/xsw/signed-xsw-assertion-extensions.xml | 9 +++ tests/xsw/signed-xsw-assertion-wrapper.xml | 11 ++++ 6 files changed, 81 insertions(+), 14 deletions(-) delete mode 100644 tests/saml2_response_xsw.xml create mode 100644 tests/xsw/signed-xsw-assertion-assertion.xml create mode 100644 tests/xsw/signed-xsw-assertion-extensions.xml create mode 100644 tests/xsw/signed-xsw-assertion-wrapper.xml diff --git a/MANIFEST.in b/MANIFEST.in index 17e012f78..fa59af7bc 100644 --- a/MANIFEST.in +++ b/MANIFEST.in @@ -3,7 +3,7 @@ include LICENSE include README.rst include CHANGELOG.md -include src/saml2/xml_template/template.xml +include src/saml2/data/templates/*.xml graft docs prune docs/build diff --git a/tests/saml2_response_xsw.xml b/tests/saml2_response_xsw.xml deleted file mode 100644 index 3671eb483..000000000 --- a/tests/saml2_response_xsw.xml +++ /dev/null @@ -1,6 +0,0 @@ - -urn:mace:example.com:saml:roland:idpurn:mace:example.com:saml:roland:idpEWBvQUlrwQbtrAjuUXkSBAVsZ50=m4zRgTWleMcx1dFboeiYlbiDigHWAVhHVa+GLN++ELNMFDutuzBxc3tu6okyaNQGW3leu32wzbfdpb5+3RlpGoKj2wPX570/EMJj4uw91XfXsZfpNP+5GlgNT8w/elDmBXhG/KwmSO477Imk0szKovTBMVHmo3QOd+ba//dVsJE=MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=ANOTHER_IDurn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPasswordhttp://www.example.com/loginstaffADMINHACKER@gmail.comDerekJetershortstop - -urn:mace:example.com:saml:roland:idpac5b22bb8eac4a26ed07a55432a0fe0da243f6e911aa614cff402c44d7cdec36urn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPasswordhttp://www.example.com/loginstaffmemberfoo@gmail.comDerekJetershortstop - - diff --git a/tests/test_xsw.py b/tests/test_xsw.py index 9978c4d31..cb756f766 100644 --- a/tests/test_xsw.py +++ b/tests/test_xsw.py @@ -14,27 +14,72 @@ from pathutils import full_path -XML_RESPONSE_XSW = full_path("saml2_response_xsw.xml") +SIGNED_XSW_ASSERTION_WRAPPER = full_path("xsw/signed-xsw-assertion-wrapper.xml") +SIGNED_XSW_ASSERTION_EXTENSIONS = full_path("xsw/signed-xsw-assertion-extensions.xml") +SIGNED_XSW_ASSERTION_ASSERTION = full_path("xsw/signed-xsw-assertion-assertion.xml") -class TestAuthnResponse: + +class TestXSW: def setup_class(self): self.conf = config_factory("sp", dotname("server_conf")) - self.ar = authn_response(self.conf, "http://lingon.catalogix.se:8087/") + self.ar = authn_response(self.conf, return_addrs="https://example.org/acs/post") + + @patch('saml2.response.validate_on_or_after', return_value=True) + def test_signed_xsw_assertion_wrapper_should_fail(self, mock_validate_on_or_after): + self.ar.issue_instant_ok = Mock(return_value=True) + + with open(SIGNED_XSW_ASSERTION_WRAPPER) as fp: + xml_response = fp.read() + + self.ar.outstanding_queries = {"id-abc": "http://localhost:8088/sso"} + self.ar.timeslack = 10000 + self.ar.loads(xml_response, decode=False) + + assert self.ar.came_from == 'http://localhost:8088/sso' + assert self.ar.session_id() == "id-abc" + assert self.ar.issuer() == 'urn:mace:example.com:saml:roland:idp' + + with raises(SignatureError): + self.ar.verify() + + assert self.ar.ava is None + assert self.ar.name_id is None + + @patch('saml2.response.validate_on_or_after', return_value=True) + def test_signed_xsw_assertion_extensions_should_fail(self, mock_validate_on_or_after): + self.ar.issue_instant_ok = Mock(return_value=True) + + with open(SIGNED_XSW_ASSERTION_EXTENSIONS) as fp: + xml_response = fp.read() + + self.ar.outstanding_queries = {"id-abc": "http://localhost:8088/sso"} + self.ar.timeslack = 10000 + self.ar.loads(xml_response, decode=False) + + assert self.ar.came_from == 'http://localhost:8088/sso' + assert self.ar.session_id() == "id-abc" + assert self.ar.issuer() == 'urn:mace:example.com:saml:roland:idp' + + with raises(SignatureError): + self.ar.verify() + + assert self.ar.ava is None + assert self.ar.name_id is None @patch('saml2.response.validate_on_or_after', return_value=True) - def test_verify_signed_xsw(self, mock_validate_on_or_after): + def test_signed_xsw_assertion_assertion_should_fail(self, mock_validate_on_or_after): self.ar.issue_instant_ok = Mock(return_value=True) - with open(XML_RESPONSE_XSW) as fp: + with open(SIGNED_XSW_ASSERTION_ASSERTION) as fp: xml_response = fp.read() - self.ar.outstanding_queries = {"id12": "http://localhost:8088/sso"} + self.ar.outstanding_queries = {"id-abc": "http://localhost:8088/sso"} self.ar.timeslack = 10000 self.ar.loads(xml_response, decode=False) assert self.ar.came_from == 'http://localhost:8088/sso' - assert self.ar.session_id() == "id12" + assert self.ar.session_id() == "id-abc" assert self.ar.issuer() == 'urn:mace:example.com:saml:roland:idp' with raises(SignatureError): diff --git a/tests/xsw/signed-xsw-assertion-assertion.xml b/tests/xsw/signed-xsw-assertion-assertion.xml new file mode 100644 index 000000000..3d1ea19e2 --- /dev/null +++ b/tests/xsw/signed-xsw-assertion-assertion.xml @@ -0,0 +1,8 @@ + + + urn:mace:example.com:saml:roland:idp + + + + urn:mace:example.com:saml:roland:idpdOks15WkdjeZbZZE1IuDjmTCmgY=CCGBBssMsEikFV7mkPw1+/W5O8Q6y2I96LWTOFpa51GpaHbZ48jRVZf1vEp5hmfMa4p3/aFH8kXZuIyqvtlxs7U6j/NI4k9t9aF3TY0VNGJjlh2aC08pzNicV1J8MKtQi4PNmxCdbhVmvrWNcx2JhG4dPqfj5oyv0LpxK2zi2JI=MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=attack-name-idurn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:unspecifiedurn:mace:example.com:saml:roland:idpname-idurn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:unspecified + diff --git a/tests/xsw/signed-xsw-assertion-extensions.xml b/tests/xsw/signed-xsw-assertion-extensions.xml new file mode 100644 index 000000000..1bd2a8b63 --- /dev/null +++ b/tests/xsw/signed-xsw-assertion-extensions.xml @@ -0,0 +1,9 @@ + + + urn:mace:example.com:saml:roland:idp + urn:mace:example.com:saml:roland:idpname-idurn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:unspecified + + + + urn:mace:example.com:saml:roland:idpdOks15WkdjeZbZZE1IuDjmTCmgY=CCGBBssMsEikFV7mkPw1+/W5O8Q6y2I96LWTOFpa51GpaHbZ48jRVZf1vEp5hmfMa4p3/aFH8kXZuIyqvtlxs7U6j/NI4k9t9aF3TY0VNGJjlh2aC08pzNicV1J8MKtQi4PNmxCdbhVmvrWNcx2JhG4dPqfj5oyv0LpxK2zi2JI=MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=name-idurn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:unspecified + diff --git a/tests/xsw/signed-xsw-assertion-wrapper.xml b/tests/xsw/signed-xsw-assertion-wrapper.xml new file mode 100644 index 000000000..37d1fa5d2 --- /dev/null +++ b/tests/xsw/signed-xsw-assertion-wrapper.xml @@ -0,0 +1,11 @@ + + + urn:mace:example.com:saml:roland:idp + + + + urn:mace:example.com:saml:roland:idpdOks15WkdjeZbZZE1IuDjmTCmgY=CCGBBssMsEikFV7mkPw1+/W5O8Q6y2I96LWTOFpa51GpaHbZ48jRVZf1vEp5hmfMa4p3/aFH8kXZuIyqvtlxs7U6j/NI4k9t9aF3TY0VNGJjlh2aC08pzNicV1J8MKtQi4PNmxCdbhVmvrWNcx2JhG4dPqfj5oyv0LpxK2zi2JI=MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=attack-name-idurn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:unspecified + + urn:mace:example.com:saml:roland:idpname-idurn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:unspecified + +