Skip to content

Commit

Permalink
Add an option to use query string as is for validation
Browse files Browse the repository at this point in the history
When validating request or response signature in process_slo() we
currently rebuild query string from 'get_data' elements. This requires
URL encoding components of the string. Unfortunately, some IdPs (AD,
ADFS) use lower-case encoding. To handle this, one needs to pass
lowercase_urlencoding=True. This complicates code that needs to support
different IdPs.

Instead, if 'query_string' is passed, use it as-as.
  • Loading branch information
eltoder committed Mar 27, 2021
1 parent a866e22 commit 4e6a8e8
Showing 1 changed file with 8 additions and 10 deletions.
18 changes: 8 additions & 10 deletions src/onelogin/saml2/auth.py
Original file line number Diff line number Diff line change
Expand Up @@ -660,16 +660,14 @@ def __validate_signature(self, data, saml_type, raise_exceptions=False):
if isinstance(sign_alg, bytes):
sign_alg = sign_alg.decode('utf8')

lowercase_urlencoding = False
if 'lowercase_urlencoding' in self.__request_data.keys():
lowercase_urlencoding = self.__request_data['lowercase_urlencoding']

signed_query = self.__build_sign_query(data[saml_type],
data.get('RelayState', None),
sign_alg,
saml_type,
lowercase_urlencoding
)
signed_query = self.__request_data.get('query_string')
if not signed_query:
lowercase_urlencoding = self.__request_data.get('lowercase_urlencoding', False)
signed_query = self.__build_sign_query(data[saml_type],
data.get('RelayState'),
sign_alg,
saml_type,
lowercase_urlencoding)

if exists_multix509sign:
for cert in idp_data['x509certMulti']['signing']:
Expand Down

0 comments on commit 4e6a8e8

Please sign in to comment.