From 8dcb31bc4f24c11388cbf9906e2bd77c6e55f089 Mon Sep 17 00:00:00 2001 From: Ivan Kanakarakis Date: Fri, 8 Jan 2021 19:51:57 +0200 Subject: [PATCH 1/4] Strengthen XSW tests Signed-off-by: Ivan Kanakarakis --- MANIFEST.in | 2 +- tests/saml2_response_xsw.xml | 6 -- tests/test_xsw.py | 59 ++++++++++++++++--- tests/xsw/signed-xsw-assertion-assertion.xml | 8 +++ tests/xsw/signed-xsw-assertion-extensions.xml | 9 +++ tests/xsw/signed-xsw-assertion-wrapper.xml | 11 ++++ 6 files changed, 81 insertions(+), 14 deletions(-) delete mode 100644 tests/saml2_response_xsw.xml create mode 100644 tests/xsw/signed-xsw-assertion-assertion.xml create mode 100644 tests/xsw/signed-xsw-assertion-extensions.xml create mode 100644 tests/xsw/signed-xsw-assertion-wrapper.xml diff --git a/MANIFEST.in b/MANIFEST.in index 17e012f78..fa59af7bc 100644 --- a/MANIFEST.in +++ b/MANIFEST.in @@ -3,7 +3,7 @@ include LICENSE include README.rst include CHANGELOG.md -include src/saml2/xml_template/template.xml +include src/saml2/data/templates/*.xml graft docs prune docs/build diff --git a/tests/saml2_response_xsw.xml b/tests/saml2_response_xsw.xml deleted file mode 100644 index 3671eb483..000000000 --- a/tests/saml2_response_xsw.xml +++ /dev/null @@ -1,6 +0,0 @@ - -urn:mace:example.com:saml:roland:idpurn:mace:example.com:saml:roland:idpEWBvQUlrwQbtrAjuUXkSBAVsZ50=m4zRgTWleMcx1dFboeiYlbiDigHWAVhHVa+GLN++ELNMFDutuzBxc3tu6okyaNQGW3leu32wzbfdpb5+3RlpGoKj2wPX570/EMJj4uw91XfXsZfpNP+5GlgNT8w/elDmBXhG/KwmSO477Imk0szKovTBMVHmo3QOd+ba//dVsJE=MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=ANOTHER_IDurn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPasswordhttp://www.example.com/loginstaffADMINHACKER@gmail.comDerekJetershortstop - -urn:mace:example.com:saml:roland:idpac5b22bb8eac4a26ed07a55432a0fe0da243f6e911aa614cff402c44d7cdec36urn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPasswordhttp://www.example.com/loginstaffmemberfoo@gmail.comDerekJetershortstop - - diff --git a/tests/test_xsw.py b/tests/test_xsw.py index 9978c4d31..cb756f766 100644 --- a/tests/test_xsw.py +++ b/tests/test_xsw.py @@ -14,27 +14,72 @@ from pathutils import full_path -XML_RESPONSE_XSW = full_path("saml2_response_xsw.xml") +SIGNED_XSW_ASSERTION_WRAPPER = full_path("xsw/signed-xsw-assertion-wrapper.xml") +SIGNED_XSW_ASSERTION_EXTENSIONS = full_path("xsw/signed-xsw-assertion-extensions.xml") +SIGNED_XSW_ASSERTION_ASSERTION = full_path("xsw/signed-xsw-assertion-assertion.xml") -class TestAuthnResponse: + +class TestXSW: def setup_class(self): self.conf = config_factory("sp", dotname("server_conf")) - self.ar = authn_response(self.conf, "http://lingon.catalogix.se:8087/") + self.ar = authn_response(self.conf, return_addrs="https://example.org/acs/post") + + @patch('saml2.response.validate_on_or_after', return_value=True) + def test_signed_xsw_assertion_wrapper_should_fail(self, mock_validate_on_or_after): + self.ar.issue_instant_ok = Mock(return_value=True) + + with open(SIGNED_XSW_ASSERTION_WRAPPER) as fp: + xml_response = fp.read() + + self.ar.outstanding_queries = {"id-abc": "http://localhost:8088/sso"} + self.ar.timeslack = 10000 + self.ar.loads(xml_response, decode=False) + + assert self.ar.came_from == 'http://localhost:8088/sso' + assert self.ar.session_id() == "id-abc" + assert self.ar.issuer() == 'urn:mace:example.com:saml:roland:idp' + + with raises(SignatureError): + self.ar.verify() + + assert self.ar.ava is None + assert self.ar.name_id is None + + @patch('saml2.response.validate_on_or_after', return_value=True) + def test_signed_xsw_assertion_extensions_should_fail(self, mock_validate_on_or_after): + self.ar.issue_instant_ok = Mock(return_value=True) + + with open(SIGNED_XSW_ASSERTION_EXTENSIONS) as fp: + xml_response = fp.read() + + self.ar.outstanding_queries = {"id-abc": "http://localhost:8088/sso"} + self.ar.timeslack = 10000 + self.ar.loads(xml_response, decode=False) + + assert self.ar.came_from == 'http://localhost:8088/sso' + assert self.ar.session_id() == "id-abc" + assert self.ar.issuer() == 'urn:mace:example.com:saml:roland:idp' + + with raises(SignatureError): + self.ar.verify() + + assert self.ar.ava is None + assert self.ar.name_id is None @patch('saml2.response.validate_on_or_after', return_value=True) - def test_verify_signed_xsw(self, mock_validate_on_or_after): + def test_signed_xsw_assertion_assertion_should_fail(self, mock_validate_on_or_after): self.ar.issue_instant_ok = Mock(return_value=True) - with open(XML_RESPONSE_XSW) as fp: + with open(SIGNED_XSW_ASSERTION_ASSERTION) as fp: xml_response = fp.read() - self.ar.outstanding_queries = {"id12": "http://localhost:8088/sso"} + self.ar.outstanding_queries = {"id-abc": "http://localhost:8088/sso"} self.ar.timeslack = 10000 self.ar.loads(xml_response, decode=False) assert self.ar.came_from == 'http://localhost:8088/sso' - assert self.ar.session_id() == "id12" + assert self.ar.session_id() == "id-abc" assert self.ar.issuer() == 'urn:mace:example.com:saml:roland:idp' with raises(SignatureError): diff --git a/tests/xsw/signed-xsw-assertion-assertion.xml b/tests/xsw/signed-xsw-assertion-assertion.xml new file mode 100644 index 000000000..3d1ea19e2 --- /dev/null +++ b/tests/xsw/signed-xsw-assertion-assertion.xml @@ -0,0 +1,8 @@ + + + urn:mace:example.com:saml:roland:idp + + + + urn:mace:example.com:saml:roland:idpdOks15WkdjeZbZZE1IuDjmTCmgY=CCGBBssMsEikFV7mkPw1+/W5O8Q6y2I96LWTOFpa51GpaHbZ48jRVZf1vEp5hmfMa4p3/aFH8kXZuIyqvtlxs7U6j/NI4k9t9aF3TY0VNGJjlh2aC08pzNicV1J8MKtQi4PNmxCdbhVmvrWNcx2JhG4dPqfj5oyv0LpxK2zi2JI=MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=attack-name-idurn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:unspecifiedurn:mace:example.com:saml:roland:idpname-idurn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:unspecified + diff --git a/tests/xsw/signed-xsw-assertion-extensions.xml b/tests/xsw/signed-xsw-assertion-extensions.xml new file mode 100644 index 000000000..1bd2a8b63 --- /dev/null +++ b/tests/xsw/signed-xsw-assertion-extensions.xml @@ -0,0 +1,9 @@ + + + urn:mace:example.com:saml:roland:idp + urn:mace:example.com:saml:roland:idpname-idurn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:unspecified + + + + urn:mace:example.com:saml:roland:idpdOks15WkdjeZbZZE1IuDjmTCmgY=CCGBBssMsEikFV7mkPw1+/W5O8Q6y2I96LWTOFpa51GpaHbZ48jRVZf1vEp5hmfMa4p3/aFH8kXZuIyqvtlxs7U6j/NI4k9t9aF3TY0VNGJjlh2aC08pzNicV1J8MKtQi4PNmxCdbhVmvrWNcx2JhG4dPqfj5oyv0LpxK2zi2JI=MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=name-idurn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:unspecified + diff --git a/tests/xsw/signed-xsw-assertion-wrapper.xml b/tests/xsw/signed-xsw-assertion-wrapper.xml new file mode 100644 index 000000000..37d1fa5d2 --- /dev/null +++ b/tests/xsw/signed-xsw-assertion-wrapper.xml @@ -0,0 +1,11 @@ + + + urn:mace:example.com:saml:roland:idp + + + + urn:mace:example.com:saml:roland:idpdOks15WkdjeZbZZE1IuDjmTCmgY=CCGBBssMsEikFV7mkPw1+/W5O8Q6y2I96LWTOFpa51GpaHbZ48jRVZf1vEp5hmfMa4p3/aFH8kXZuIyqvtlxs7U6j/NI4k9t9aF3TY0VNGJjlh2aC08pzNicV1J8MKtQi4PNmxCdbhVmvrWNcx2JhG4dPqfj5oyv0LpxK2zi2JI=MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk=attack-name-idurn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:unspecified + + urn:mace:example.com:saml:roland:idpname-idurn:mace:example.com:saml:roland:spurn:oasis:names:tc:SAML:2.0:ac:classes:unspecified + + From cd6030d79e23d2421ff8b8bcbebb9632bc4caedc Mon Sep 17 00:00:00 2001 From: Ivan Kanakarakis Date: Fri, 15 Jan 2021 15:09:58 +0200 Subject: [PATCH 2/4] Fix the parser to not break on ePTID AttributeValues Signed-off-by: Ivan Kanakarakis --- src/saml2/saml.py | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/src/saml2/saml.py b/src/saml2/saml.py index 52e7429be..278083712 100644 --- a/src/saml2/saml.py +++ b/src/saml2/saml.py @@ -115,7 +115,7 @@ def __setattr__(self, key, value): SamlBase.__setattr__(self, key, value) def verify(self): - if not self.text: + if not self.text and not self.extension_elements: if not self.extension_attributes: raise Exception( "Attribute value base should not have extension attributes" @@ -293,11 +293,26 @@ def harvest_element_tree(self, tree): self._convert_element_tree_to_member(child) for attribute, value in iter(tree.attrib.items()): self._convert_element_attribute_to_member(attribute, value) - if tree.text: + + # if we have added children to this node + # we consider whitespace insignificant + # and remove/trim/strip whitespace + # and expect to not have actual text content + text = ( + tree.text.strip() + if tree.text and self.extension_elements + else tree.text + ) + if text: #print("set_text:", tree.text) # clear type #self.clear_type() - self.set_text(tree.text) + self.set_text(text) + + # if we have added a text node + # or other children to this node + # remove the nil marker + if text or self.extension_elements: if XSI_NIL in self.extension_attributes: del self.extension_attributes[XSI_NIL] From b76ea403e3107bbae73b653215985b9e1f27c5d4 Mon Sep 17 00:00:00 2001 From: Ivan Kanakarakis Date: Sat, 9 Jan 2021 00:30:16 +0200 Subject: [PATCH 3/4] Add xsd schemas Signed-off-by: Ivan Kanakarakis --- MANIFEST.in | 1 + setup.cfg | 1 + src/saml2/data/schemas/__init__.py | 0 src/saml2/data/schemas/envelope.xsd | 126 +++ .../schemas/saml-schema-assertion-2.0.xsd | 283 ++++++ .../schemas/saml-schema-authn-context-2.0.xsd | 23 + ...chema-authn-context-auth-telephony-2.0.xsd | 81 ++ .../saml-schema-authn-context-ip-2.0.xsd | 65 ++ .../saml-schema-authn-context-ippword-2.0.xsd | 67 ++ ...saml-schema-authn-context-kerberos-2.0.xsd | 83 ++ ...-authn-context-mobileonefactor-reg-2.0.xsd | 186 ++++ ...uthn-context-mobileonefactor-unreg-2.0.xsd | 183 ++++ ...-authn-context-mobiletwofactor-reg-2.0.xsd | 202 +++++ ...uthn-context-mobiletwofactor-unreg-2.0.xsd | 200 +++++ ...hema-authn-context-nomad-telephony-2.0.xsd | 81 ++ ...a-authn-context-personal-telephony-2.0.xsd | 80 ++ .../saml-schema-authn-context-pgp-2.0.xsd | 83 ++ .../saml-schema-authn-context-ppt-2.0.xsd | 81 ++ .../saml-schema-authn-context-pword-2.0.xsd | 64 ++ .../saml-schema-authn-context-session-2.0.xsd | 64 ++ ...aml-schema-authn-context-smartcard-2.0.xsd | 64 ++ ...-schema-authn-context-smartcardpki-2.0.xsd | 129 +++ ...l-schema-authn-context-softwarepki-2.0.xsd | 129 +++ .../saml-schema-authn-context-spki-2.0.xsd | 83 ++ .../saml-schema-authn-context-srp-2.0.xsd | 82 ++ .../saml-schema-authn-context-sslcert-2.0.xsd | 97 +++ ...aml-schema-authn-context-telephony-2.0.xsd | 79 ++ ...saml-schema-authn-context-timesync-2.0.xsd | 105 +++ .../saml-schema-authn-context-types-2.0.xsd | 821 ++++++++++++++++++ .../saml-schema-authn-context-x509-2.0.xsd | 83 ++ .../saml-schema-authn-context-xmldsig-2.0.xsd | 83 ++ .../data/schemas/saml-schema-dce-2.0.xsd | 29 + .../data/schemas/saml-schema-ecp-2.0.xsd | 57 ++ .../data/schemas/saml-schema-metadata-2.0.xsd | 337 +++++++ .../data/schemas/saml-schema-protocol-2.0.xsd | 302 +++++++ .../data/schemas/saml-schema-x500-2.0.xsd | 20 + .../data/schemas/saml-schema-xacml-2.0.xsd | 19 + .../schemas/saml-subject-id-attr-v1.0.xsd | 48 + src/saml2/data/schemas/sstc-metadata-attr.xsd | 25 + src/saml2/data/schemas/sstc-req-attr-ext.xsd | 43 + .../data/schemas/sstc-saml-attribute-ext.xsd | 25 + .../sstc-saml-metadata-algsupport-v1.0.xsd | 54 ++ .../schemas/sstc-saml-metadata-ui-v1.0.xsd | 98 +++ src/saml2/data/schemas/xenc-schema.xsd | 146 ++++ src/saml2/data/schemas/xml.xsd | 286 ++++++ .../data/schemas/xmldsig-core-schema.xsd | 318 +++++++ 46 files changed, 5516 insertions(+) create mode 100644 src/saml2/data/schemas/__init__.py create mode 100644 src/saml2/data/schemas/envelope.xsd create mode 100644 src/saml2/data/schemas/saml-schema-assertion-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-auth-telephony-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-ip-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-ippword-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-kerberos-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-mobileonefactor-reg-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-mobileonefactor-unreg-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-mobiletwofactor-reg-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-mobiletwofactor-unreg-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-nomad-telephony-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-personal-telephony-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-pgp-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-ppt-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-pword-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-session-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-smartcard-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-smartcardpki-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-softwarepki-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-spki-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-srp-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-sslcert-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-telephony-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-timesync-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-types-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-x509-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-authn-context-xmldsig-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-dce-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-ecp-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-metadata-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-protocol-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-x500-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-schema-xacml-2.0.xsd create mode 100644 src/saml2/data/schemas/saml-subject-id-attr-v1.0.xsd create mode 100644 src/saml2/data/schemas/sstc-metadata-attr.xsd create mode 100644 src/saml2/data/schemas/sstc-req-attr-ext.xsd create mode 100644 src/saml2/data/schemas/sstc-saml-attribute-ext.xsd create mode 100644 src/saml2/data/schemas/sstc-saml-metadata-algsupport-v1.0.xsd create mode 100644 src/saml2/data/schemas/sstc-saml-metadata-ui-v1.0.xsd create mode 100644 src/saml2/data/schemas/xenc-schema.xsd create mode 100644 src/saml2/data/schemas/xml.xsd create mode 100644 src/saml2/data/schemas/xmldsig-core-schema.xsd diff --git a/MANIFEST.in b/MANIFEST.in index fa59af7bc..2092bb0a5 100644 --- a/MANIFEST.in +++ b/MANIFEST.in @@ -4,6 +4,7 @@ include README.rst include CHANGELOG.md include src/saml2/data/templates/*.xml +include src/saml2/data/schemas/*.xsd graft docs prune docs/build diff --git a/setup.cfg b/setup.cfg index fba061b78..7f6a3da59 100644 --- a/setup.cfg +++ b/setup.cfg @@ -66,6 +66,7 @@ include = [options.package_data] * = *.xml + *.xsd [options.extras_require] diff --git a/src/saml2/data/schemas/__init__.py b/src/saml2/data/schemas/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/src/saml2/data/schemas/envelope.xsd b/src/saml2/data/schemas/envelope.xsd new file mode 100644 index 000000000..2b4a8c061 --- /dev/null +++ b/src/saml2/data/schemas/envelope.xsd @@ -0,0 +1,126 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Prose in the spec does not specify that attributes are allowed on the Body element + + + + + + + + + + + + + + + + + + + + 'encodingStyle' indicates any canonicalization conventions followed in the contents of the containing element. For example, the value 'http://schemas.xmlsoap.org/soap/encoding/' indicates the pattern described in SOAP specification + + + + + + + + + + + + + + + Fault reporting structure + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-assertion-2.0.xsd b/src/saml2/data/schemas/saml-schema-assertion-2.0.xsd new file mode 100644 index 000000000..9bbfa26e3 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-assertion-2.0.xsd @@ -0,0 +1,283 @@ + + + + + + + Document identifier: saml-schema-assertion-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V1.0 (November, 2002): + Initial Standard Schema. + V1.1 (September, 2003): + Updates within the same V1.0 namespace. + V2.0 (March, 2005): + New assertion schema for SAML V2.0 namespace. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-authn-context-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-2.0.xsd new file mode 100644 index 000000000..e4754faf8 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-2.0.xsd @@ -0,0 +1,23 @@ + + + + + + Document identifier: saml-schema-authn-context-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New core authentication context schema for SAML V2.0. + This is just an include of all types from the schema + referred to in the include statement below. + + + + + + \ No newline at end of file diff --git a/src/saml2/data/schemas/saml-schema-authn-context-auth-telephony-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-auth-telephony-2.0.xsd new file mode 100644 index 000000000..da59934be --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-auth-telephony-2.0.xsd @@ -0,0 +1,81 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:AuthenticatedTelephony + Document identifier: saml-schema-authn-context-auth-telephony-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/saml2/data/schemas/saml-schema-authn-context-ip-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-ip-2.0.xsd new file mode 100644 index 000000000..d4e7dfba1 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-ip-2.0.xsd @@ -0,0 +1,65 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol + Document identifier: saml-schema-authn-context-ip-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/saml2/data/schemas/saml-schema-authn-context-ippword-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-ippword-2.0.xsd new file mode 100644 index 000000000..708f59643 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-ippword-2.0.xsd @@ -0,0 +1,67 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword + Document identifier: saml-schema-authn-context-ippword-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-authn-context-kerberos-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-kerberos-2.0.xsd new file mode 100644 index 000000000..4b6a3a5da --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-kerberos-2.0.xsd @@ -0,0 +1,83 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos + Document identifier: saml-schema-authn-context-kerberos-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/saml2/data/schemas/saml-schema-authn-context-mobileonefactor-reg-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-mobileonefactor-reg-2.0.xsd new file mode 100644 index 000000000..f72443437 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-mobileonefactor-reg-2.0.xsd @@ -0,0 +1,186 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorContract + Document identifier: saml-schema-authn-context-mobileonefactor-reg-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-authn-context-mobileonefactor-unreg-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-mobileonefactor-unreg-2.0.xsd new file mode 100644 index 000000000..9727c45fd --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-mobileonefactor-unreg-2.0.xsd @@ -0,0 +1,183 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorUnregistered + Document identifier: saml-schema-authn-context-mobileonefactor-unreg-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-authn-context-mobiletwofactor-reg-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-mobiletwofactor-reg-2.0.xsd new file mode 100644 index 000000000..d0c59aa13 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-mobiletwofactor-reg-2.0.xsd @@ -0,0 +1,202 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract + Document identifier: saml-schema-authn-context-mobiletwofactor-reg-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-authn-context-mobiletwofactor-unreg-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-mobiletwofactor-unreg-2.0.xsd new file mode 100644 index 000000000..1a4578cd8 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-mobiletwofactor-unreg-2.0.xsd @@ -0,0 +1,200 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered + Document identifier: saml-schema-authn-context-mobiletwofactor-unreg-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-authn-context-nomad-telephony-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-nomad-telephony-2.0.xsd new file mode 100644 index 000000000..0eb861f93 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-nomad-telephony-2.0.xsd @@ -0,0 +1,81 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:NomadTelephony + Document identifier: saml-schema-authn-context-nomad-telephony-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/saml2/data/schemas/saml-schema-authn-context-personal-telephony-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-personal-telephony-2.0.xsd new file mode 100644 index 000000000..a9eebf425 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-personal-telephony-2.0.xsd @@ -0,0 +1,80 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:PersonalizedTelephony + Document identifier: saml-schema-authn-context-personal-telephony-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-authn-context-pgp-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-pgp-2.0.xsd new file mode 100644 index 000000000..74c73c1c2 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-pgp-2.0.xsd @@ -0,0 +1,83 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:PGP + Document identifier: saml-schema-authn-context-pgp-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/saml2/data/schemas/saml-schema-authn-context-ppt-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-ppt-2.0.xsd new file mode 100644 index 000000000..257296541 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-ppt-2.0.xsd @@ -0,0 +1,81 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport + Document identifier: saml-schema-authn-context-ppt-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/saml2/data/schemas/saml-schema-authn-context-pword-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-pword-2.0.xsd new file mode 100644 index 000000000..0c18a42c8 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-pword-2.0.xsd @@ -0,0 +1,64 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:Password + Document identifier: saml-schema-authn-context-pword-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/saml2/data/schemas/saml-schema-authn-context-session-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-session-2.0.xsd new file mode 100644 index 000000000..77ef000ac --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-session-2.0.xsd @@ -0,0 +1,64 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession + Document identifier: saml-schema-authn-context-session-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/saml2/data/schemas/saml-schema-authn-context-smartcard-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-smartcard-2.0.xsd new file mode 100644 index 000000000..1bd084a41 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-smartcard-2.0.xsd @@ -0,0 +1,64 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard + Document identifier: saml-schema-authn-context-smartcard-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/saml2/data/schemas/saml-schema-authn-context-smartcardpki-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-smartcardpki-2.0.xsd new file mode 100644 index 000000000..0508d4d5d --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-smartcardpki-2.0.xsd @@ -0,0 +1,129 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI + Document identifier: saml-schema-authn-context-smartcardpki-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-authn-context-softwarepki-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-softwarepki-2.0.xsd new file mode 100644 index 000000000..5c41a2f24 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-softwarepki-2.0.xsd @@ -0,0 +1,129 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwarePKI + Document identifier: saml-schema-authn-context-softwarepki-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-authn-context-spki-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-spki-2.0.xsd new file mode 100644 index 000000000..ce57d7957 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-spki-2.0.xsd @@ -0,0 +1,83 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:SPKI + Document identifier: saml-schema-authn-context-spki-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/saml2/data/schemas/saml-schema-authn-context-srp-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-srp-2.0.xsd new file mode 100644 index 000000000..9051dd5ab --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-srp-2.0.xsd @@ -0,0 +1,82 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:SecureRemotePassword + Document identifier: saml-schema-authn-context-srp-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-authn-context-sslcert-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-sslcert-2.0.xsd new file mode 100644 index 000000000..723103b00 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-sslcert-2.0.xsd @@ -0,0 +1,97 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient + Document identifier: saml-schema-authn-context-sslcert-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-authn-context-telephony-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-telephony-2.0.xsd new file mode 100644 index 000000000..15ff75313 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-telephony-2.0.xsd @@ -0,0 +1,79 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:Telephony + Document identifier: saml-schema-authn-context-telephony-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/saml2/data/schemas/saml-schema-authn-context-timesync-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-timesync-2.0.xsd new file mode 100644 index 000000000..afc92f398 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-timesync-2.0.xsd @@ -0,0 +1,105 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken + Document identifier: saml-schema-authn-context-timesync-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-authn-context-types-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-types-2.0.xsd new file mode 100644 index 000000000..8513959a5 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-types-2.0.xsd @@ -0,0 +1,821 @@ + + + + + + Document identifier: saml-schema-authn-context-types-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New core authentication context schema types for SAML V2.0. + + + + + + + A particular assertion on an identity + provider's part with respect to the authentication + context associated with an authentication assertion. + + + + + + + + Refers to those characteristics that describe the + processes and mechanisms + the Authentication Authority uses to initially create + an association between a Principal + and the identity (or name) by which the Principal will + be known + + + + + + + + This element indicates that identification has been + performed in a physical + face-to-face meeting with the principal and not in an + online manner. + + + + + + + + + + + + + + + + + + + + Refers to those characterstics that describe how the + 'secret' (the knowledge or possession + of which allows the Principal to authenticate to the + Authentication Authority) is kept secure + + + + + + + + This element indicates the types and strengths of + facilities + of a UA used to protect a shared secret key from + unauthorized access and/or use. + + + + + + + + This element indicates the types and strengths of + facilities + of a UA used to protect a private key from + unauthorized access and/or use. + + + + + + + The actions that must be performed + before the private key can be used. + + + + + + Whether or not the private key is shared + with the certificate authority. + + + + + + + In which medium is the key stored. + memory - the key is stored in memory. + smartcard - the key is stored in a smartcard. + token - the key is stored in a hardware token. + MobileDevice - the key is stored in a mobile device. + MobileAuthCard - the key is stored in a mobile + authentication card. + + + + + + + + + + + This element indicates that a password (or passphrase) + has been used to + authenticate the Principal to a remote system. + + + + + + + + This element indicates that a Pin (Personal + Identification Number) has been used to authenticate the Principal to + some local system in order to activate a key. + + + + + + + + This element indicates that a hardware or software + token is used + as a method of identifying the Principal. + + + + + + + + This element indicates that a time synchronization + token is used to identify the Principal. hardware - + the time synchonization + token has been implemented in hardware. software - the + time synchronization + token has been implemented in software. SeedLength - + the length, in bits, of the + random seed used in the time synchronization token. + + + + + + + + This element indicates that a smartcard is used to + identity the Principal. + + + + + + + + This element indicates the minimum and/or maximum + ASCII length of the password which is enforced (by the UA or the + IdP). In other words, this is the minimum and/or maximum number of + ASCII characters required to represent a valid password. + min - the minimum number of ASCII characters required + in a valid password, as enforced by the UA or the IdP. + max - the maximum number of ASCII characters required + in a valid password, as enforced by the UA or the IdP. + + + + + + + + This element indicates the length of time for which an + PIN-based authentication is valid. + + + + + + + + Indicates whether the password was chosen by the + Principal or auto-supplied by the Authentication Authority. + principalchosen - the Principal is allowed to choose + the value of the password. This is true even if + the initial password is chosen at random by the UA or + the IdP and the Principal is then free to change + the password. + automatic - the password is chosen by the UA or the + IdP to be cryptographically strong in some sense, + or to satisfy certain password rules, and that the + Principal is not free to change it or to choose a new password. + + + + + + + + + + + + + + + + + + + Refers to those characteristics that define the + mechanisms by which the Principal authenticates to the Authentication + Authority. + + + + + + + + The method that a Principal employs to perform + authentication to local system components. + + + + + + + + The method applied to validate a principal's + authentication across a network + + + + + + + + Supports Authenticators with nested combinations of + additional complexity. + + + + + + + + Indicates that the Principal has been strongly + authenticated in a previous session during which the IdP has set a + cookie in the UA. During the present session the Principal has only + been authenticated by the UA returning the cookie to the IdP. + + + + + + + + Rather like PreviousSession but using stronger + security. A secret that was established in a previous session with + the Authentication Authority has been cached by the local system and + is now re-used (e.g. a Master Secret is used to derive new session + keys in TLS, SSL, WTLS). + + + + + + + + This element indicates that the Principal has been + authenticated by a zero knowledge technique as specified in ISO/IEC + 9798-5. + + + + + + + + + + This element indicates that the Principal has been + authenticated by a challenge-response protocol utilizing shared secret + keys and symmetric cryptography. + + + + + + + + + + + + This element indicates that the Principal has been + authenticated by a mechanism which involves the Principal computing a + digital signature over at least challenge data provided by the IdP. + + + + + + + + The local system has a private key but it is used + in decryption mode, rather than signature mode. For example, the + Authentication Authority generates a secret and encrypts it using the + local system's public key: the local system then proves it has + decrypted the secret. + + + + + + + + The local system has a private key and uses it for + shared secret key agreement with the Authentication Authority (e.g. + via Diffie Helman). + + + + + + + + + + + + + + + This element indicates that the Principal has been + authenticated through connection from a particular IP address. + + + + + + + + The local system and Authentication Authority + share a secret key. The local system uses this to encrypt a + randomised string to pass to the Authentication Authority. + + + + + + + + The protocol across which Authenticator information is + transferred to an Authentication Authority verifier. + + + + + + + + This element indicates that the Authenticator has been + transmitted using bare HTTP utilizing no additional security + protocols. + + + + + + + + This element indicates that the Authenticator has been + transmitted using a transport mechanism protected by an IPSEC session. + + + + + + + + This element indicates that the Authenticator has been + transmitted using a transport mechanism protected by a WTLS session. + + + + + + + + This element indicates that the Authenticator has been + transmitted solely across a mobile network using no additional + security mechanism. + + + + + + + + + + + This element indicates that the Authenticator has been + transmitted using a transport mechnanism protected by an SSL or TLS + session. + + + + + + + + + + + + Refers to those characteristics that describe + procedural security controls employed by the Authentication Authority. + + + + + + + + + + + + Provides a mechanism for linking to external (likely + human readable) documents in which additional business agreements, + (e.g. liability constraints, obligations, etc) can be placed. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + This attribute indicates whether or not the + Identification mechanisms allow the actions of the Principal to be + linked to an actual end user. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + This element indicates that the Key Activation Limit is + defined as a specific duration of time. + + + + + + + + This element indicates that the Key Activation Limit is + defined as a number of usages. + + + + + + + + This element indicates that the Key Activation Limit is + the session. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-authn-context-x509-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-x509-2.0.xsd new file mode 100644 index 000000000..ce4bd65e0 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-x509-2.0.xsd @@ -0,0 +1,83 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:X509 + Document identifier: saml-schema-authn-context-x509-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-authn-context-xmldsig-2.0.xsd b/src/saml2/data/schemas/saml-schema-authn-context-xmldsig-2.0.xsd new file mode 100644 index 000000000..61fe0ac8e --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-authn-context-xmldsig-2.0.xsd @@ -0,0 +1,83 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:XMLDSig + Document identifier: saml-schema-authn-context-xmldsig-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-dce-2.0.xsd b/src/saml2/data/schemas/saml-schema-dce-2.0.xsd new file mode 100644 index 000000000..e89be866a --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-dce-2.0.xsd @@ -0,0 +1,29 @@ + + + + + Document identifier: saml-schema-dce-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + Custom schema for DCE attribute profile, first published in SAML 2.0. + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-ecp-2.0.xsd b/src/saml2/data/schemas/saml-schema-ecp-2.0.xsd new file mode 100644 index 000000000..e3f24b9a5 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-ecp-2.0.xsd @@ -0,0 +1,57 @@ + + + + + + + + Document identifier: saml-schema-ecp-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + Custom schema for ECP profile, first published in SAML 2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-metadata-2.0.xsd b/src/saml2/data/schemas/saml-schema-metadata-2.0.xsd new file mode 100644 index 000000000..923b598bf --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-metadata-2.0.xsd @@ -0,0 +1,337 @@ + + + + + + + + + Document identifier: saml-schema-metadata-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + Schema for SAML metadata, first published in SAML 2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-protocol-2.0.xsd b/src/saml2/data/schemas/saml-schema-protocol-2.0.xsd new file mode 100644 index 000000000..13656b18a --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-protocol-2.0.xsd @@ -0,0 +1,302 @@ + + + + + + + Document identifier: saml-schema-protocol-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V1.0 (November, 2002): + Initial Standard Schema. + V1.1 (September, 2003): + Updates within the same V1.0 namespace. + V2.0 (March, 2005): + New protocol schema based in a SAML V2.0 namespace. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/saml-schema-x500-2.0.xsd b/src/saml2/data/schemas/saml-schema-x500-2.0.xsd new file mode 100644 index 000000000..f67f1b04a --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-x500-2.0.xsd @@ -0,0 +1,20 @@ + + + + + Document identifier: saml-schema-x500-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + Custom schema for X.500 attribute profile, first published in SAML 2.0. + + + + + diff --git a/src/saml2/data/schemas/saml-schema-xacml-2.0.xsd b/src/saml2/data/schemas/saml-schema-xacml-2.0.xsd new file mode 100644 index 000000000..836f9db04 --- /dev/null +++ b/src/saml2/data/schemas/saml-schema-xacml-2.0.xsd @@ -0,0 +1,19 @@ + + + + + Document identifier: saml-schema-xacml-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + Custom schema for XACML attribute profile, first published in SAML 2.0. + + + + diff --git a/src/saml2/data/schemas/saml-subject-id-attr-v1.0.xsd b/src/saml2/data/schemas/saml-subject-id-attr-v1.0.xsd new file mode 100644 index 000000000..31d0b9d5f --- /dev/null +++ b/src/saml2/data/schemas/saml-subject-id-attr-v1.0.xsd @@ -0,0 +1,48 @@ + + + + + + + Document title: Metadata Extension Schema for + SAML V2.0 Subject Identifier Attributes Profile Version 1.0 + Document identifier: saml-subject-id-attr-v1.0.xsd + Location: http://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/ + Revision history: + September 2018: + Initial version contributed to OASIS, (c) The Ohio State University + + + + + + + SAML metadata extension used to regulate allowable attribute scopes. + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/sstc-metadata-attr.xsd b/src/saml2/data/schemas/sstc-metadata-attr.xsd new file mode 100644 index 000000000..5a445e21c --- /dev/null +++ b/src/saml2/data/schemas/sstc-metadata-attr.xsd @@ -0,0 +1,25 @@ + + + + + + Document title: SAML V2.0 Metadata Extention for Entity Attributes Schema + Document identifier: sstc-metadata-attr.xsd + Location: http://www.oasis-open.org/committees/documents.php?wg_abbrev=security + Revision history: + V1.0 (November 2008): + Initial version. + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/saml2/data/schemas/sstc-req-attr-ext.xsd b/src/saml2/data/schemas/sstc-req-attr-ext.xsd new file mode 100644 index 000000000..1e8f9de4d --- /dev/null +++ b/src/saml2/data/schemas/sstc-req-attr-ext.xsd @@ -0,0 +1,43 @@ + + + + + + + + + + Document title: SAML V2.0 Protocol Extension For Requesting Attributes Per Request + Document identifier: sstc-req-attr-ext + Location: http://docs.oasis-open.org/security/saml-protoc-req-attr-req/v1.0/csprd01/schema/ + Revision history: WD-03 + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/sstc-saml-attribute-ext.xsd b/src/saml2/data/schemas/sstc-saml-attribute-ext.xsd new file mode 100644 index 000000000..ad309c14b --- /dev/null +++ b/src/saml2/data/schemas/sstc-saml-attribute-ext.xsd @@ -0,0 +1,25 @@ + + + + + + Document title: SAML V2.0 Attribute Extension Schema + Document identifier: sstc-saml-attribute-ext.xsd + Location: http://www.oasis-open.org/committees/documents.php?wg_abbrev=security + Revision history: + V1.0 (October 2008): + Initial version. + + + + + + + + diff --git a/src/saml2/data/schemas/sstc-saml-metadata-algsupport-v1.0.xsd b/src/saml2/data/schemas/sstc-saml-metadata-algsupport-v1.0.xsd new file mode 100644 index 000000000..c4e0f58b2 --- /dev/null +++ b/src/saml2/data/schemas/sstc-saml-metadata-algsupport-v1.0.xsd @@ -0,0 +1,54 @@ + + + + + + + + + Document title: Metadata Extension Schema for SAML V2.0 Metadata Profile for Algorithm Support Version 1.0 + Document identifier: sstc-saml-metadata-algsupport.xsd + Location: http://docs.oasis-open.org/security/saml/Post2.0/ + Revision history: + V1.0 (June 2010): + Initial version. + (October 2010): + Add processContents="lax" to wildcards. + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/sstc-saml-metadata-ui-v1.0.xsd b/src/saml2/data/schemas/sstc-saml-metadata-ui-v1.0.xsd new file mode 100644 index 000000000..388f4d085 --- /dev/null +++ b/src/saml2/data/schemas/sstc-saml-metadata-ui-v1.0.xsd @@ -0,0 +1,98 @@ + + + + + + + + + Document title: Metadata Extension Schema for SAML V2.0 Metadata Extensions for Login and Discovery User Interface Version 1.0 + Document identifier: sstc-saml-metadata-ui-v1.0.xsd + Location: http://docs.oasis-open.org/security/saml/Post2.0/ + Revision history: + 01 November 2010 + Changed filename. + September 2010: + Initial version. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/xenc-schema.xsd b/src/saml2/data/schemas/xenc-schema.xsd new file mode 100644 index 000000000..85af68b55 --- /dev/null +++ b/src/saml2/data/schemas/xenc-schema.xsd @@ -0,0 +1,146 @@ + + + + + + ]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/saml2/data/schemas/xml.xsd b/src/saml2/data/schemas/xml.xsd new file mode 100644 index 000000000..bd291f3d4 --- /dev/null +++ b/src/saml2/data/schemas/xml.xsd @@ -0,0 +1,286 @@ + + + + + + +
+

About the XML namespace

+ +
+

+ This schema document describes the XML namespace, in a form + suitable for import by other schema documents. +

+

+ See + http://www.w3.org/XML/1998/namespace.html and + + http://www.w3.org/TR/REC-xml for information + about this namespace. +

+

+ Note that local names in this namespace are intended to be + defined only by the World Wide Web Consortium or its subgroups. + The names currently defined in this namespace are listed below. + They should not be used with conflicting semantics by any Working + Group, specification, or document instance. +

+

+ See further below in this document for more information about how to refer to this schema document from your own + XSD schema documents and about the + namespace-versioning policy governing this schema document. +

+
+
+ + + + + + +
+ +

lang (as an attribute name)

+

+ denotes an attribute whose value + is a language code for the natural language of the content of + any element; its value is inherited. This name is reserved + by virtue of its definition in the XML specification.

+ +
+
+

Notes

+

+ Attempting to install the relevant ISO 2- and 3-letter + codes as the enumerated possible values is probably never + going to be a realistic possibility. +

+

+ See BCP 47 at + http://www.rfc-editor.org/rfc/bcp/bcp47.txt + and the IANA language subtag registry at + + http://www.iana.org/assignments/language-subtag-registry + for further information. +

+

+ The union allows for the 'un-declaration' of xml:lang with + the empty string. +

+
+ + + + + + + + + + + + + + + + +
+ +

space (as an attribute name)

+

+ denotes an attribute whose + value is a keyword indicating what whitespace processing + discipline is intended for the content of the element; its + value is inherited. This name is reserved by virtue of its + definition in the XML specification.

+ +
+ + + + + + + + + + + + +
+ +

base (as an attribute name)

+

+ denotes an attribute whose value + provides a URI to be used as the base for interpreting any + relative URIs in the scope of the element on which it + appears; its value is inherited. This name is reserved + by virtue of its definition in the XML Base specification.

+ +

+ See http://www.w3.org/TR/xmlbase/ + for information about this attribute. +

+
+ + + + + + + +
+ +

id (as an attribute name)

+

+ denotes an attribute whose value + should be interpreted as if declared to be of type ID. + This name is reserved by virtue of its definition in the + xml:id specification.

+ +

+ See http://www.w3.org/TR/xml-id/ + for information about this attribute. +

+
+ + + + + + + + + + + + + +
+ +

Father (in any context at all)

+ +
+

+ denotes Jon Bosak, the chair of + the original XML Working Group. This name is reserved by + the following decision of the W3C XML Plenary and + XML Coordination groups: +

+
+

+ In appreciation for his vision, leadership and + dedication the W3C XML Plenary on this 10th day of + February, 2000, reserves for Jon Bosak in perpetuity + the XML name "xml:Father". +

+
+
+
+ + + + + +
+

About this schema document

+ +
+

+ This schema defines attributes and an attribute group suitable + for use by schemas wishing to allow xml:base, + xml:lang, xml:space or + xml:id attributes on elements they define. +

+

+ To enable this, such a schema must import this schema for + the XML namespace, e.g. as follows: +

+ 
+          <schema . . .>
+           . . .
+           <import namespace="http://www.w3.org/XML/1998/namespace"
+                      schemaLocation="http://www.w3.org/2001/xml.xsd"/>
+
+

+ or +

+ 
+           <import namespace="http://www.w3.org/XML/1998/namespace"
+                      schemaLocation="http://www.w3.org/2009/01/xml.xsd"/>
+
+

+ Subsequently, qualified reference to any of the attributes or the + group defined below will have the desired effect, e.g. +

+ 
+          <type . . .>
+           . . .
+           <attributeGroup ref="xml:specialAttrs"/>
+
+

+ will define a type which will schema-validate an instance element + with any of those attributes. +

+
+
+ + + + + +
+

Versioning policy for this schema document

+
+

+ In keeping with the XML Schema WG's standard versioning + policy, this schema document will persist at + + http://www.w3.org/2009/01/xml.xsd. +

+

+ At the date of issue it can also be found at + + http://www.w3.org/2001/xml.xsd. +

+

+ The schema document at that URI may however change in the future, + in order to remain compatible with the latest version of XML + Schema itself, or with the XML namespace itself. In other words, + if the XML Schema or XML namespaces change, the version of this + document at + http://www.w3.org/2001/xml.xsd + + will change accordingly; the version at + + http://www.w3.org/2009/01/xml.xsd + + will not change. +

+

+ Previous dated (and unchanging) versions of this schema + document are at: +

+ +
+
+ + + + diff --git a/src/saml2/data/schemas/xmldsig-core-schema.xsd b/src/saml2/data/schemas/xmldsig-core-schema.xsd new file mode 100644 index 000000000..df126b30e --- /dev/null +++ b/src/saml2/data/schemas/xmldsig-core-schema.xsd @@ -0,0 +1,318 @@ + + + + + + ]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From 3b707723dcf1bf60677b424aac398c0c3557641d Mon Sep 17 00:00:00 2001 From: Ivan Kanakarakis Date: Sat, 9 Jan 2021 00:31:13 +0200 Subject: [PATCH 4/4] Fix CVE-2021-21238 - SAML XML Signature wrapping MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All users of pysaml2 that use the default `CryptoBackendXmlSec1` backend and need to verify signed SAML documents are impacted. `pysaml2 <= 6.4.1` does not validate the SAML document against an XML schema. This allows invalid XML documents to trick the verification process, by presenting elements with a valid signature inside elements whose content has been malformed. The verification is offloaded to `xmlsec1` and `xmlsec1` will not validate every signature in the given document, but only the first it finds in the given scope. Credits for the report: - Victor Schönfelder Garcia (isits AG International School of IT Security) - Juraj Somorovsky (Paderborn University) - Vladislav Mladenov (Ruhr University Bochum) Signed-off-by: Ivan Kanakarakis --- setup.cfg | 1 + src/saml2/sigver.py | 26 ++++++ src/saml2/xml/__init__.py | 0 src/saml2/xml/schema/__init__.py | 74 +++++++++++++++ tests/test_xsw.py | 41 +++++++++ ...d-xsw-assertion-in-assertion-first-sig.xml | 85 +++++++++++++++++ ...ned-xsw-response-in-response-first-sig.xml | 91 +++++++++++++++++++ 7 files changed, 318 insertions(+) create mode 100644 src/saml2/xml/__init__.py create mode 100644 src/saml2/xml/schema/__init__.py create mode 100644 tests/xsw/signed-xsw-assertion-in-assertion-first-sig.xml create mode 100644 tests/xsw/signed-xsw-response-in-response-first-sig.xml diff --git a/setup.cfg b/setup.cfg index 7f6a3da59..b9bfe09ad 100644 --- a/setup.cfg +++ b/setup.cfg @@ -54,6 +54,7 @@ install_requires = requests >= 1.0.0 six importlib_resources + xmlschema [options.packages.find] diff --git a/src/saml2/sigver.py b/src/saml2/sigver.py index 0e8f1942f..4e45491b6 100644 --- a/src/saml2/sigver.py +++ b/src/saml2/sigver.py @@ -51,6 +51,8 @@ from saml2.xmlenc import CipherData from saml2.xmlenc import CipherValue from saml2.xmlenc import EncryptedData +from saml2.xml.schema import node_to_schema +from saml2.xml.schema import XMLSchemaError logger = logging.getLogger(__name__) @@ -1460,6 +1462,30 @@ def _check_signature(self, decoded_xml, item, node_name=NODE_NAME, origdoc=None, if not certs: raise MissingKey(_issuer) + # validate XML with the appropriate schema + try: + _schema = node_to_schema[node_name] + except KeyError as e: + error_context = { + "message": "Signature verification failed. Unknown node type.", + "issuer": _issuer, + "type": node_name, + "document": decoded_xml, + } + raise SignatureError(error_context) from e + + try: + _schema.validate(str(item)) + except XMLSchemaError as e: + error_context = { + "message": "Signature verification failed. Invalid document format.", + "ID": item.id, + "issuer": _issuer, + "type": node_name, + "document": decoded_xml, + } + raise SignatureError(error_context) from e + # saml-core section "5.4 XML Signature Profile" defines constrains on the # xmldsig-core facilities. It explicitly dictates that enveloped signatures # are the only signatures allowed. This means that: diff --git a/src/saml2/xml/__init__.py b/src/saml2/xml/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/src/saml2/xml/schema/__init__.py b/src/saml2/xml/schema/__init__.py new file mode 100644 index 000000000..56e08b1c5 --- /dev/null +++ b/src/saml2/xml/schema/__init__.py @@ -0,0 +1,74 @@ +from importlib_resources import path as _resource_path + +from xmlschema import XMLSchema as _XMLSchema +from xmlschema.exceptions import XMLSchemaException as XMLSchemaError + +import saml2.data.schemas as _data_schemas + + +def _create_xml_schema_validator(source, **kwargs): + kwargs = { + **kwargs, + "validation": "strict", + "locations": _locations, + "base_url": source, + "allow": "sandbox", + "use_fallback": False, + } + return _XMLSchema(source, **kwargs) + + +with _resource_path(_data_schemas, "xml.xsd") as fp: + _path_schema_xml = str(fp) +with _resource_path(_data_schemas, "envelope.xsd") as fp: + _path_schema_envelope = str(fp) +with _resource_path(_data_schemas, "xenc-schema.xsd") as fp: + _path_schema_xenc = str(fp) +with _resource_path(_data_schemas, "xmldsig-core-schema.xsd") as fp: + _path_schema_xmldsig_core = str(fp) +with _resource_path(_data_schemas, "saml-schema-assertion-2.0.xsd") as fp: + _path_schema_saml_assertion = str(fp) +with _resource_path(_data_schemas, "saml-schema-metadata-2.0.xsd") as fp: + _path_schema_saml_metadata = str(fp) +with _resource_path(_data_schemas, "saml-schema-protocol-2.0.xsd") as fp: + _path_schema_saml_protocol = str(fp) + +_locations = { + "http://www.w3.org/XML/1998/namespace": _path_schema_xml, + "http://schemas.xmlsoap.org/soap/envelope/": _path_schema_envelope, + "http://www.w3.org/2001/04/xmlenc#": _path_schema_xenc, + "http://www.w3.org/2000/09/xmldsig#": _path_schema_xmldsig_core, + "urn:oasis:names:tc:SAML:2.0:assertion": _path_schema_saml_assertion, + "urn:oasis:names:tc:SAML:2.0:protocol": _path_schema_saml_protocol, +} + +with _resource_path(_data_schemas, "saml-schema-assertion-2.0.xsd") as fp: + schema_saml_assertion = _create_xml_schema_validator(str(fp)) +with _resource_path(_data_schemas, "saml-schema-metadata-2.0.xsd") as fp: + schema_saml_metadata = _create_xml_schema_validator(str(fp)) +with _resource_path(_data_schemas, "saml-schema-protocol-2.0.xsd") as fp: + schema_saml_protocol = _create_xml_schema_validator(str(fp)) + + +node_to_schema = { + # AssertionType + "urn:oasis:names:tc:SAML:2.0:assertion:Assertion": schema_saml_assertion, + # EntitiesDescriptorType + "urn:oasis:names:tc:SAML:2.0:metadata:EntitiesDescriptor": schema_saml_metadata, + # EntityDescriptorType + "urn:oasis:names:tc:SAML:2.0:metadata:EntityDescriptor": schema_saml_metadata, + # RequestAbstractType + "urn:oasis:names:tc:SAML:2.0:protocol:AssertionIDRequest": schema_saml_protocol, + "urn:oasis:names:tc:SAML:2.0:protocol:SubjectQuery": schema_saml_protocol, + "urn:oasis:names:tc:SAML:2.0:protocol:AuthnRequest": schema_saml_protocol, + "urn:oasis:names:tc:SAML:2.0:protocol:ArtifactResolve": schema_saml_protocol, + "urn:oasis:names:tc:SAML:2.0:protocol:ManageNameIDRequest": schema_saml_protocol, + "urn:oasis:names:tc:SAML:2.0:protocol:LogoutRequest": schema_saml_protocol, + "urn:oasis:names:tc:SAML:2.0:protocol:NameIDMappingRequest": schema_saml_protocol, + # StatusResponseType + "urn:oasis:names:tc:SAML:2.0:protocol:Response": schema_saml_protocol, + "urn:oasis:names:tc:SAML:2.0:protocol:ArtifactResponse": schema_saml_protocol, + "urn:oasis:names:tc:SAML:2.0:protocol:ManageNameIDResponse": schema_saml_protocol, + "urn:oasis:names:tc:SAML:2.0:protocol:LogoutResponse": schema_saml_protocol, + "urn:oasis:names:tc:SAML:2.0:protocol:NameIDMappingResponse": schema_saml_protocol, +} diff --git a/tests/test_xsw.py b/tests/test_xsw.py index cb756f766..0e92a5bd1 100644 --- a/tests/test_xsw.py +++ b/tests/test_xsw.py @@ -18,6 +18,8 @@ SIGNED_XSW_ASSERTION_EXTENSIONS = full_path("xsw/signed-xsw-assertion-extensions.xml") SIGNED_XSW_ASSERTION_ASSERTION = full_path("xsw/signed-xsw-assertion-assertion.xml") +SIGNED_ASSERTION_FIRST_SIG = full_path("xsw/signed-xsw-assertion-in-assertion-first-sig.xml") +SIGNED_REPONSE_FIRST_SIG = full_path("xsw/signed-xsw-response-in-response-first-sig.xml") class TestXSW: @@ -87,3 +89,42 @@ def test_signed_xsw_assertion_assertion_should_fail(self, mock_validate_on_or_af assert self.ar.ava is None assert self.ar.name_id is None + + +class TestInvalidDepthFirstSig: + def setup_class(self): + self.conf = config_factory("sp", dotname("server_conf")) + self.ar = authn_response(self.conf, return_addrs="https://example.org/acs/post") + + @patch('saml2.response.validate_on_or_after', return_value=True) + def test_signed_assertion_first_sig_should_fail(self, mock_validate_on_or_after): + self.ar.issue_instant_ok = Mock(return_value=True) + + with open(SIGNED_ASSERTION_FIRST_SIG) as fp: + xml_response = fp.read() + + self.ar.outstanding_queries = {"id-abc": "http://localhost:8088/sso"} + self.ar.timeslack = 10000 + self.ar.loads(xml_response, decode=False) + + assert self.ar.came_from == 'http://localhost:8088/sso' + assert self.ar.session_id() == "id-abc" + assert self.ar.issuer() == 'urn:mace:example.com:saml:roland:idp' + + with raises(SignatureError): + self.ar.verify() + + assert self.ar.ava is None + assert self.ar.name_id is None + + @patch('saml2.response.validate_on_or_after', return_value=True) + def test_signed_response_first_sig_should_fail(self, mock_validate_on_or_after): + self.ar.issue_instant_ok = Mock(return_value=True) + + with open(SIGNED_REPONSE_FIRST_SIG) as fp: + xml_response = fp.read() + + self.ar.outstanding_queries = {"id-abc": "http://localhost:8088/sso"} + self.ar.timeslack = 10000 + with raises(SignatureError): + self.ar.loads(xml_response, decode=False) diff --git a/tests/xsw/signed-xsw-assertion-in-assertion-first-sig.xml b/tests/xsw/signed-xsw-assertion-in-assertion-first-sig.xml new file mode 100644 index 000000000..53ab46ea2 --- /dev/null +++ b/tests/xsw/signed-xsw-assertion-in-assertion-first-sig.xml @@ -0,0 +1,85 @@ + + + urn:mace:example.com:saml:roland:idp + + + + + + urn:mace:example.com:saml:roland:idp + + + + + + + + + + + iLDF5/5VJs4sb3TasVTvFCsIi0k= + + + Ked5gvNcRhHCivVN9y9+5LDAZLqLhRg3Sw2xlRR4HP2am1mFoBDdUx4khEWdcC2dknbzfo2AC1AtcbHTogDLOSLzYX9sT/gj995qotu4fUFQPMiocbCZRpbXTI6iDRiytwYtAkw28yQ4FVCe99GUThbV9tpLIoqMPZYNJ3TmL/I= + + + MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk= + + + + + the-name-id + + + + + + + urn:mace:example.com:saml:roland:sp + + + + + urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport + + + + urn:mace:example.com:saml:roland:idp + + + + + + + + + + + dGhpcyBpcyBza2lwcGVkOyBvbmx5IHRoZSBmaXJzdCBzaWduYXR1cmUgaXMgcHJvY2Vzc2VkCg== + + + dGhpcyBpcyBza2lwcGVkOyBvbmx5IHRoZSBmaXJzdCBzaWduYXR1cmUgaXMgcHJvY2Vzc2VkCg== + + + MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk= + + + + + attack-name-id + + + + + + + urn:mace:example.com:saml:roland:sp + + + + + urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport + + + + diff --git a/tests/xsw/signed-xsw-response-in-response-first-sig.xml b/tests/xsw/signed-xsw-response-in-response-first-sig.xml new file mode 100644 index 000000000..a400b2aee --- /dev/null +++ b/tests/xsw/signed-xsw-response-in-response-first-sig.xml @@ -0,0 +1,91 @@ + + + + urn:mace:example.com:saml:roland:idp + + + + + + + + + + + ykldcjeUTA6xMqk+BUQy9hvraOo= + + + TF6666UcgC3+ZO/CevRxvLAOjpZEttJm90J2j/vDfGBsjnIcAkHDO42x1u/VvrDXJrWpGmmAZ0vBcW8Hg+6qhXNQngzSfMfID+eE9OBf7Ptj1flAea1WrfvNQPFDy0qlriusYjc7tL6tFmUgwzhfzI3V8xPOH1Bxmh5Cl92JOk8= + + + MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk= + + + + + + + + urn:mace:example.com:saml:roland:idp + + the-name-id + + + + + + + urn:mace:example.com:saml:roland:sp + + + + + urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport + + + + + urn:mace:example.com:saml:roland:idp + + + + + + + + + + + ykldcjeUTA6xMqk+BUQy9hvraOo= + + + TF6666UcgC3+ZO/CevRxvLAOjpZEttJm90J2j/vDfGBsjnIcAkHDO42x1u/VvrDXJrWpGmmAZ0vBcW8Hg+6qhXNQngzSfMfID+eE9OBf7Ptj1flAea1WrfvNQPFDy0qlriusYjc7tL6tFmUgwzhfzI3V8xPOH1Bxmh5Cl92JOk8= + + + MIICsDCCAhmgAwIBAgIJAJrzqSSwmDY9MA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMDkxMDA2MTk0OTQxWhcNMDkxMTA1MTk0OTQxWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJg2cms7MqjniT8Fi/XkNHZNPbNVQyMUMXE9tXOdqwYCA1cc8vQdzkihscQMXy3iPw2cMggBu6gjMTOSOxECkuvX5ZCclKr8pXAJM5cY6gVOaVO2PdTZcvDBKGbiaNefiEw5hnoZomqZGp8wHNLAUkwtH9vjqqvxyS/vclc6k2ewIDAQABo4GnMIGkMB0GA1UdDgQWBBRePsKHKYJsiojE78ZWXccK9K4aJTB1BgNVHSMEbjBsgBRePsKHKYJsiojE78ZWXccK9K4aJaFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAJrzqSSwmDY9MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAJSrKOEzHO7TL5cy6h3qh+3+JAk8HbGBW+cbX6KBCAw/mzU8flK25vnWwXS3dv2FF3Aod0/S7AWNfKib5U/SA9nJaz/mWeF9S0farz9AQFc8/NSzAzaVq7YbM4F6f6N2FRl7GikdXRCed45j6mrPzGzk3ECbupFnqyREH3+ZPSdk= + + + + + + + + urn:mace:example.com:saml:roland:idp + + attack-name-id + + + + + + + urn:mace:example.com:saml:roland:sp + + + + + urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport + + + +