@@ -364,25 +364,32 @@ def check_settings(self, settings):
364364 'certFileName' not in security ['signMetadata' ]:
365365 errors .append ('sp_signMetadata_invalid' )
366366
367- if (('authnRequestsSigned' in security and security ['authnRequestsSigned' ]) or \
368- ('logoutRequestSigned' in security and security ['logoutRequestSigned' ]) or \
369- ('logoutResponseSigned' in security and security ['logoutResponseSigned' ]) or \
370- ('wantAssertionsEncrypted' in security and security ['wantAssertionsEncrypted' ]) or \
371- ('wantNameIdEncrypted' in security and security ['wantNameIdEncrypted' ])) and \
372- not self .check_sp_certs ():
373- errors .append ('sp_cert_not_found_and_required' )
367+ authn_sign = 'authnRequestsSigned' in security .keys () and security ['authnRequestsSigned' ]
368+ logout_req_sign = 'logoutRequestSigned' in security .keys () and security ['logoutRequestSigned' ]
369+ logout_res_sign = 'logoutResponseSigned' in security .keys () and security ['logoutResponseSigned' ]
370+ want_assert_enc = 'wantAssertionsEncrypted' in security .keys () and security ['wantAssertionsEncrypted' ]
371+ want_nameid_enc = 'wantNameIdEncrypted' in security .keys () and security ['wantNameIdEncrypted' ]
372+
373+ if not self .check_sp_certs ():
374+ if authn_sign or logout_req_sign or logout_res_sign or \
375+ want_assert_enc or want_nameid_enc :
376+ errors .append ('sp_cert_not_found_and_required' )
374377
375378 exists_x509 = ('idp' in settings and
376379 'x509cert' in settings ['idp' ] and
377380 len (settings ['idp' ]['x509cert' ]) > 0 )
378381 exists_fingerprint = ('idp' in settings and
379382 'certFingerprint' in settings ['idp' ] and
380383 len (settings ['idp' ]['certFingerprint' ]) > 0 )
381- if (('wantAssertionsSigned' in security and security ['wantAssertionsSigned' ]) or \
382- ('wantMessagesSigned' in security and security ['wantMessagesSigned' ])) and \
384+
385+ want_assert_sign = 'wantAssertionsSigned' in security .keys () and security ['wantAssertionsSigned' ]
386+ want_mes_signed = 'wantMessagesSigned' in security .keys () and security ['wantMessagesSigned' ]
387+ nameid_enc = 'nameIdEncrypted' in security .keys () and security ['nameIdEncrypted' ]
388+
389+ if (want_assert_sign or want_mes_signed ) and \
383390 not (exists_x509 or exists_fingerprint ):
384391 errors .append ('idp_cert_or_fingerprint_not_found_and_required' )
385- if ( 'nameIdEncrypted' in security and security [ 'nameIdEncrypted' ]) and not exists_x509 :
392+ if nameid_enc and not exists_x509 :
386393 errors .append ('idp_cert_not_found_and_required' )
387394
388395 if 'contactPerson' in settings :
0 commit comments