Merge branch 'jgehrcke-jp/fixparser2'. IdP metadata parser/merger adjustments + test compatibility + code style

Author: pitbulk

src/onelogin/saml2/idp_metadata_parser.py

@@ -6,6 +6,10 @@
 Metadata class of OneLogin's Python Toolkit.
 """
 
+
+from copy import deepcopy
+
+
 try:
     import urllib.request as urllib2
 except ImportError:
@@ -48,7 +52,7 @@ def get_metadata(url):
         return xml
 
     @staticmethod
-    def parse_remote(url):
+    def parse_remote(url, **kwargs):
         """
         Get the metadata XML from the provided URL and parse it, returning a dict with extracted data
         :param url: Url where the XML of the Identity Provider Metadata is published.
@@ -57,19 +61,41 @@ def parse_remote(url):
         :rtype: dict
         """
         idp_metadata = OneLogin_Saml2_IdPMetadataParser.get_metadata(url)
-        return OneLogin_Saml2_IdPMetadataParser.parse(idp_metadata)
+        return OneLogin_Saml2_IdPMetadataParser.parse(idp_metadata, **kwargs)
 
     @staticmethod
-    def parse(idp_metadata):
+    def parse(
+            idp_metadata,
+            required_sso_binding=OneLogin_Saml2_Constants.BINDING_HTTP_REDIRECT,
+            required_slo_binding=OneLogin_Saml2_Constants.BINDING_HTTP_REDIRECT):
         """
-        Parse the Identity Provider metadata and returns a dict with extracted data
-        If there are multiple IDPSSODescriptor it will only parse the first
+        Parse the Identity Provider metadata and return a dict with extracted data.
+
+        If there are multiple <IDPSSODescriptor> tags, parse only the first.
+
+        Parse only those SSO endpoints with the same binding as given by
+        the `required_sso_binding` parameter.
+
+        Parse only those SLO endpoints with the same binding as given by
+        the `required_slo_binding` parameter.
+
+        If the metadata specifies multiple SSO endpoints with the required
+        binding, extract only the first (the same holds true for SLO
+        endpoints).
+
         :param idp_metadata: XML of the Identity Provider Metadata.
         :type idp_metadata: string
-        :param url: If true and the URL is HTTPs, the cert of the domain is checked.
-        :type url: bool
+
+        :param required_sso_binding: Parse only POST or REDIRECT SSO endpoints.
+        :type required_sso_binding: one of OneLogin_Saml2_Constants.BINDING_HTTP_REDIRECT
+            or OneLogin_Saml2_Constants.BINDING_HTTP_POST
+
+        :param required_slo_binding: Parse only POST or REDIRECT SLO endpoints.
+        :type required_slo_binding: one of OneLogin_Saml2_Constants.BINDING_HTTP_REDIRECT
+            or OneLogin_Saml2_Constants.BINDING_HTTP_POST
+
         :returns: settings dict with extracted data
-        :rtype: string
+        :rtype: dict
         """
         data = {}
 
@@ -92,11 +118,19 @@ def parse(idp_metadata):
                     if len(name_id_format_nodes) > 0:
                         idp_name_id_format = name_id_format_nodes[0].text
 
-                    sso_nodes = OneLogin_Saml2_XML.query(idp_descriptor_node, "./md:SingleSignOnService[@Binding='%s']" % OneLogin_Saml2_Constants.BINDING_HTTP_REDIRECT)
+                    sso_nodes = OneLogin_Saml2_XML.query(
+                        idp_descriptor_node,
+                        "./md:SingleSignOnService[@Binding='%s']" % required_sso_binding
+                    )
+
                     if len(sso_nodes) > 0:
                         idp_sso_url = sso_nodes[0].get('Location', None)
 
-                    slo_nodes = OneLogin_Saml2_XML.query(idp_descriptor_node, "./md:SingleLogoutService[@Binding='%s']" % OneLogin_Saml2_Constants.BINDING_HTTP_REDIRECT)
+                    slo_nodes = OneLogin_Saml2_XML.query(
+                        idp_descriptor_node,
+                        "./md:SingleLogoutService[@Binding='%s']" % required_slo_binding
+                    )
+
                     if len(slo_nodes) > 0:
                         idp_slo_url = slo_nodes[0].get('Location', None)
 
@@ -108,12 +142,17 @@ def parse(idp_metadata):
 
                     if idp_entity_id is not None:
                         data['idp']['entityId'] = idp_entity_id
+
                     if idp_sso_url is not None:
                         data['idp']['singleSignOnService'] = {}
                         data['idp']['singleSignOnService']['url'] = idp_sso_url
+                        data['idp']['singleSignOnService']['binding'] = required_sso_binding
+
                     if idp_slo_url is not None:
                         data['idp']['singleLogoutService'] = {}
                         data['idp']['singleLogoutService']['url'] = idp_slo_url
+                        data['idp']['singleLogoutService']['binding'] = required_slo_binding
+
                     if idp_x509_cert is not None:
                         data['idp']['x509cert'] = idp_x509_cert
 
@@ -139,6 +178,35 @@ def merge_settings(settings, new_metadata_settings):
         :returns: merged settings
         :rtype: dict
         """
-        result_settings = settings.copy()
-        result_settings.update(new_metadata_settings)
+        for d in (settings, new_metadata_settings):
+            if not isinstance(d, dict):
+                raise TypeError('Both arguments must be dictionaries.')
+
+        # Guarantee to not modify original data (`settings.copy()` would not
+        # be sufficient, as it's just a shallow copy).
+        result_settings = deepcopy(settings)
+        # Merge `new_metadata_settings` into `result_settings`.
+        dict_deep_merge(result_settings, new_metadata_settings)
         return result_settings
+
+
+def dict_deep_merge(a, b, path=None):
+    """Deep-merge dictionary `b` into dictionary `a`.
+
+    Kudos to http://stackoverflow.com/a/7205107/145400
+    """
+    if path is None:
+        path = []
+    for key in b:
+        if key in a:
+            if isinstance(a[key], dict) and isinstance(b[key], dict):
+                dict_deep_merge(a[key], b[key], path + [str(key)])
+            elif a[key] == b[key]:
+                # Key conflict, but equal value.
+                pass
+            else:
+                # Key/value conflict. Prioritize b over a.
+                a[key] = b[key]
+        else:
+            a[key] = b[key]
+    return a

tests/data/metadata/idp_metadata2.xml

@@ -0,0 +1 @@
+<EntityDescriptor entityID="urn:example:idp" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">  <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">    <KeyDescriptor use="signing">      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">        <X509Data>          <X509Certificate>MIIDPDCCAiQCCQDydJgOlszqbzANBgkqhkiG9w0BAQUFADBgMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEQMA4GA1UEChMHSmFua3lDbzESMBAGA1UEAxMJbG9jYWxob3N0MB4XDTE0MDMxMjE5NDYzM1oXDTI3MTExOTE5NDYzM1owYDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28xEDAOBgNVBAoTB0phbmt5Q28xEjAQBgNVBAMTCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMGvJpRTTasRUSPqcbqCG+ZnTAurnu0vVpIG9lzExnh11o/BGmzu7lB+yLHcEdwrKBBmpepDBPCYxpVajvuEhZdKFx/Fdy6j5mH3rrW0Bh/zd36CoUNjbbhHyTjeM7FN2yF3u9lcyubuvOzr3B3gX66IwJlU46+wzcQVhSOlMk2tXR+fIKQExFrOuK9tbX3JIBUqItpI+HnAow509CnM134svw8PTFLkR6/CcMqnDfDK1m993PyoC1Y+N4X9XkhSmEQoAlAHPI5LHrvuujM13nvtoVYvKYoj7ScgumkpWNEvX652LfXOnKYlkB8ZybuxmFfIkzedQrbJsyOhfL03cMECAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAeHwzqwnzGEkxjzSD47imXaTqtYyETZow7XwBc0ZaFS50qRFJUgKTAmKS1xQBP/qHpStsROT35DUxJAE6NY1Kbq3ZbCuhGoSlY0L7VzVT5tpu4EY8+Dq/u2EjRmmhoL7UkskvIZ2n1DdERtd+YUMTeqYl9co43csZwDno/IKomeN5qaPc39IZjikJ+nUC6kPFKeu/3j9rgHNlRtocI6S1FdtFz9OZMQlpr0JbUt2T3xS/YoQJn6coDmJL5GTiiKM6cOe+Ur1VwzS1JEDbSS2TWWhzq8ojLdrotYLGd9JOsoQhElmz+tMfCFQUFLExinPAyy7YHlSiVX13QH2XTu/iQQ==</X509Certificate>        </X509Data>      </KeyInfo>    </KeyDescriptor>    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://idp.example.com/logout"/>    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://idp.example.com"/>        <Attribute Name="Email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="E-Mail Address" xmlns="urn:oasis:names:tc:SAML:2.0:assertion"/>        <Attribute Name="FirstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="First Name" xmlns="urn:oasis:names:tc:SAML:2.0:assertion"/>        <Attribute Name="LastName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="Last Name" xmlns="urn:oasis:names:tc:SAML:2.0:assertion"/>      </IDPSSODescriptor></EntityDescriptor>