memocong
commented
2 years ago Encountered the same issue and it only happens when the SAMLResponse is encrypted. The issue can be mitigated by patching the code:
from onelogin.saml2.xmlparser import tostring, fromstring
self.decrypted_document = fromstring(tostring(self.decrypted_document))Reproduced the issue with the code in demo-django and dockerfile added (reference this repo)
-
folder structure
demo-django ├── Dockerfile ├── demo │ ├── __init__.py │ ├── settings.py │ ├── urls.py │ ├── views.py │ └── wsgi.py ├── docker-compose.yml ├── manage.py ├── requirements.txt ├── saml │ ├── advanced_settings.json │ ├── certs │ │ ├── README │ │ ├── sp.crt │ │ └── sp.key │ └── settings.json └── templates ├── attrs.html ├── base.html └── index.html -
Dockerfile
FROM python:3.8
RUN apt-get update && apt-get install -y \
libffi-dev libxmlsec1-dev libxmlsec1-openssl xmlsec1
ADD . /code
WORKDIR /code
ADD requirements.txt /requirements.txt
RUN pip install -r /requirements.txt-
requirements.txt
Django==3.2 python3-saml -
docker-compose.yml
version: '3'
services: web: restart: always build: . command: sh -c "python manage.py runserver 0.0.0.0:9000" volumes:
- .:/code ports:
- "9000:9000"
- installed packages
Package Version ------------ ------- asgiref 3.4.1 Django 3.2 isodate 0.6.1 lxml 4.7.1 pip 21.2.4 python3-saml 1.12.0 pytz 2021.3 setuptools 57.5.0 six 1.16.0 sqlparse 0.4.2 wheel 0.37.0 xmlsec 1.3.12
nijel
mredaelli
MattiasLevlin
AvnerCohen
SilviaAmAm
AndrewGrossman
bofeng
nosnilmot
jeffsawatzky
We recently upgraded our lxml from 4.6.4 to 4.7.1 and suddenly there were some SSO issues:
OneLogin works fine, but when a client logs in from an ADFS instance, they get the message that "A valid SubjectConfirmation was not found on this Response".
Moving back to 4.6.4 resolves this issue.
The configuration: