search

SAML-Toolkits / python3-saml

MIT License
704 stars 309 forks source link

Fetch IDP metadata using requests to support custom server certificates root CAs #415

Closed sergei-maertens closed 1 month ago

sergei-maertens commented 4 months ago

Closes #403

Using requests allows us to easily customize the CA_BUNDLE to use when verifying the server certificate, instead of having to disable SSL certificate verification alltogether.

sergei-maertens commented 4 months ago

@pitbulk I didn't realize that requests is not a dependency yet, but IMO this is the easiest way to support this. Happy to discuss alternatives though, if you feel that adding the library is too much.

pitbulk commented 4 months ago

@sergei-maertens if I'm not wrong, urllib.request.urlopen accepts cafile and capath parameters, now that we are forcing in the new release to use python3 > 3.7, you can adapt your PR to keep using urllib.request.urlopen and accept in the method those new parameters.

Test it and let me know if works as well as requests.

sergei-maertens commented 4 months ago

I'll look into it asap, thanks for the feedback!

edit: what would your approach be to provide the cafile/capath parameters. An envvar, or something in the settings dict? I'm leaning towards the former. not relevant, doesn't seem like this code is called interally in many places

pitbulk commented 1 month ago

@sergei-maertens do you plan to rework on the PR?

sergei-maertens commented 1 month ago

I had completely forgotten about it, sorry! I can still pick it up

sergei-maertens commented 1 month ago

@pitbulk I've updated the PR with the suggested changes, now only the stdlib is used :)