IdentityPython / SATOSA

Proxy translating between different authentication protocols (SAML2, OpenID Connect and OAuth2)
https://idpy.org
Apache License 2.0
203 stars 123 forks source link

Fixes and improvements for satosa-saml-metadata #429

Closed vladimir-mencl-eresearch closed 1 year ago

vladimir-mencl-eresearch commented 1 year ago

Hi @c00kiemon5ter ,

I am working on a new feature for my deployment where I'd rely on the metadata created by satosa-saml-metadata - I'd then register this metadata into our federation.

When trying to use it, I found the metadata would always be signed - but for this purpose, I'd rather avoid having the signature embedded (on the EntityDescriptor for a single SP) - so I've added a --no-sign option. And with this option, I made the signing cert and key optional.

I also found the metadata was missing the encryption keys (KeyDescriptor use="encryption") - and I found it was because SATOSA SAML Backend makes changes to the loaded config, but this change was missed by the satosa-saml-metadata tool because of how it was referring to the config - found this was an easy fix to make.

Do these two changes look to you OK to merge?

Thanks a lot in advance for getting back to me.

Cheers, Vlad

All Submissions:

vladimir-mencl-eresearch commented 1 year ago

Hi @c00kiemon5ter ,

Just wondering whether there's anything blocking this PR from being reviewed and merged?

I think these are fairly trivial and backwards compatible changes.

Please let me know if there are any issues to address / points to clarify.

Thanks a lot in advance for getting back to me.

Cheers, Vlad

vladimir-mencl-eresearch commented 1 year ago

Hi @c00kiemon5ter ,

I've just rebased this on master to bring this up to date.

These changes are I think trivial - is there anything you'd like to see changed before merging them?

Cheers, Vlad

vladimir-mencl-eresearch commented 1 year ago

@c00kiemon5ter , can you please let me know if there's anything blocking this PR - or whether you'd be able to review and merge?

It's a fairly trivial fix + improvement...

Thanks a lot in advance for getting back to me.

Cheers, Vlad

c00kiemon5ter commented 1 year ago

Thank you Vlad, and sorry for the poor communication.

vladimir-mencl-eresearch commented 1 year ago

Np - and thanks for accepting this in!