Django SAML MDQ
项目描述
Django SAML MDQ
一个轻量级的SAML2 MDQ服务器，实现了draft-young-md-query实现
- 在pyFF（批处理管道）下载和验证的元数据之上运行
- 具有签名功能（在xmlsec之上）
- 具有ValidUntil定义功能
- 支持以下实体标识符：urlencoded、{sha1}和{base64}
请记住，pyFF是元数据下载所需的，它可以作为守护进程或计划任务（批处理）运行
目录表
要求
apt install build-essential xmlsec1 python3-dev libxml2-dev libxslt1-dev libyaml-dev python3-pip
pip3 install --upgrade pip
pip3 install virtualenv django lxml xmlsec
安装 pyFF
virtualenv -p python3 python-pyff
source python-pyff/bin/activate
pip3 install git+https://github.com/IdentityPython/pyFF.git
配置pyFF
# Create a folder for the configuration
mkdir pyff-configuration
cd pyff-configuration
# create folder for the certificates
mkdir certificates
# create certificates
openssl req -nodes -new -x509 -days 3650 -keyout certificates/private.key -out certificates/public.cert -subj '/CN=your.own.fqdn.com'
# create a pipeline directory
mkdir pipelines
创建一个管道以检索和处理所有Idem + eduGAIN元数据，这将是以下内容类似。命名为 pipelines/garr_batch.fd
# Metadata download and validation
- load xrd garr-loaded.xrd:
- ./pipelines/garr.xrd
# select can even filter entity by IDPSSO or SPSSO Description and things ...
# - select: "!//md:EntityDescriptor[md:SPSSODescriptor]"
- select
- store:
directory: ./garr
- publish:
output: ./garr/garr-loaded.xml
- stats
现在创建XRD文件以配置元数据可以下载的URL。命名为 pipelines/garr.xrd
<?xml version="1.0" encoding="UTF-8"?>
<XRDS xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0">
<XRD>
<Link rel="urn:oasis:names:tc:SAML:2.0:metadata" href="http://md.idem.garr.it/metadata/idem-test-metadata-sha256.xml"/>
</XRD>
<XRD>
<Subject>http://md.idem.garr.it/metadata/edugain2idem-metadata-sha256.xml</Subject>
<Link rel="urn:oasis:names:tc:SAML:2.0:metadata" href="http://md.idem.garr.it/metadata/edugain2idem-metadata-sha256.xml">
<Title>IDEM+eduGAIN</Title>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>
MIIDWzCCAkOgAwIBAgIJALo/EGIq8rgNMA0GCSqGSIb3DQEBCwUAMEQxCzAJBgNV
BAYTAklUMRYwFAYDVQQKDA1JREVNIEdBUlIgQUFJMR0wGwYDVQQDDBRJREVNIE1l
dGFkYXRhIFNpZ25lcjAeFw0xOTAxMjIxNjA5MjBaFw0yMjAxMjExNjA5MjBaMEQx
CzAJBgNVBAYTAklUMRYwFAYDVQQKDA1JREVNIEdBUlIgQUFJMR0wGwYDVQQDDBRJ
REVNIE1ldGFkYXRhIFNpZ25lcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBAMay3N21fswu3AE6hqCPUVjvCyol5OKTHs9CXDIFyAoigP+YSdloLSGwx6n6
ks9aBbJqlzRBIEd3CpByvX7GmBuITl3ElhxMY40Cv/ULok1GbDmQMhPScU6J1f9b
526R9Ks+BbYZYmBRX9gqmpX1R867IES4z+JhXnXr5K8HTPjfaDGh2xORL6msXjww
DJgaJCOpBCctLvCWcmUp0ucpl8VHGjFAAI5Eb6pwQEEPj1yqW52ggM+AHNFY6bAC
9RX7Qv8MonQZwXpNNBNL+UcnGLVBXtBftd4zq7XxPNN9F/Ele3YJGaOVk8cCEJt5
SfTeguzUaAyh8f/BfEs6CwucCSsCAwEAAaNQME4wHQYDVR0OBBYEFCZQVW7g6mc9
3zaJP/p0lGbVQ4O6MB8GA1UdIwQYMBaAFCZQVW7g6mc93zaJP/p0lGbVQ4O6MAwG
A1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAF6OKKdWyeI385ZS5i29mSMA
4BoPCVAhyXDMLMdqTQqvZp3PAL/zjLYRYKgGH53d4uN/EztWM8YBdyzBzdbpFWpd
wRGzwyfXzt6l2luElWb59PacNqHbBkyFO2YZmgqLzgrVX1gA3/3ij9zrLqd1lHVH
MHPUpqv98KYXnttyzhacdYaRGDO/2A28U9QeRq2/HgVScklhJvoySeNyXNspYfte
ePRxeHBj21DgiQb+X1+ovKASM+RULa6cA1TJBCop+VqZMZiRJ3Rj6RML63ckEO8H
Md/XFvxlr+P2JcVKzHaZEEUGGINUCCuDABqKBZOqykGWXDastVw6/I0OIdLmWNI=
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</Link>
</XRD>
</XRDS>
测试管道
pyff pipelines/garr.fd
你应该有类似这样的输出
total size: 6003
selected: 6003
idps: 3257
sps: 2744
配置Django MDQ
如果你需要将 saml2_mdq 集成到一个现有的Django项目中，你可以将其作为应用程序安装
pip install saml2_mdq
然后，将 saml2_mdq 添加到你的 settings.INSTALLED_APPS 中，它不需要迁移。同时，将 django.middleware.http.ConditionalGetMiddleware 添加到 settings.MIDDLEWARE 中以在HttpResponse头中启用 ETag。
如果你只需要一个完整的MDQ服务器，你可以用这种方式复制整个项目
git clone https://github.com/UniversitaDellaCalabria/Django-MDQ.git
cd Django-MDQ
pip install -r requirements
然后
- 将
django_mdq/settingslocal.py.example复制到django_mdq/settingslocal.py并编辑它 - 在
django_mdq/settingslocal.py中进行配置PYFF_METADATA_FOLDER必须指向 pyFF 定期下载元数据 xml 文件的文件夹PYFF_METADATA_LOADED必须指向 pyff 发布的完整元数据 xml，包含所有实体METADATA_SIGNER_KEY和METADATA_SIGNER_CERT用于启用元数据签名功能（可选，非必需）METADATA_CACHE_CONTROL用于设置 Http-Header 缓存控制 max-ageMETADATA_VALID_UNTIL用于设置元数据的 freshness
- 此项目不需要任何数据库配置
- 以开发模式运行
./manage.py runserver 0.0.0.0:8001或在生产模式中（参阅 gunicorn 或 uwsgi 示例来执行此操作）
要创建您的元数据 RSA 密钥，甚至可以使用此示例命令
openssl req -nodes -new -x509 -days 3650 -keyout certificates/private.key -out certificates/public.cert -subj '/CN=your.own.fqdn.com'
Shibboleth IdP配置
这是一个元数据提供程序定义文件，可以包含在 /opt/shibboleth-idp/conf/services.xml 中。在 MetadataProviders 资源中，称为 <util:list id="shibboleth.MetadataResolverResources">，我们可以将其作为子元素 <value>%{idp.home}/conf/metadata-providers-mdq.xml</value>。只需更改生产环境中的 django_mdq.url。
<?xml version="1.0" encoding="UTF-8"?>
<!-- This file is an EXAMPLE metadata configuration file. -->
<MetadataProvider id="ShibbolethMetadataMdq" xsi:type="ChainingMetadataProvider"
xmlns="urn:mace:shibboleth:2.0:metadata"
xmlns:resource="urn:mace:shibboleth:2.0:resource"
xmlns:security="urn:mace:shibboleth:2.0:security"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
urn:mace:shibboleth:2.0:resource http://shibboleth.net/schema/idp/shibboleth-resource.xsd
urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd
urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd">
<MetadataProvider id="DynamicEntityMetadata" xsi:type="DynamicHTTPMetadataProvider"
connectionRequestTimeout="PT5S"
connectionTimeout="PT5S"
socketTimeout="PT3S">
<!-- Enable this if have configured METADATA_SIGNER_KEY and METADATA_SIGNER_CERT in Django-MDQ settingslocal.py
<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="%{idp.home}/credentials/mdq-cert.pem"/>
-->
<!-- Enable this if have configured METADATA_VALID_UNTIL in Django-MDQ settingslocal.py
<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P14D"/>
-->
<MetadataQueryProtocol>https://django_mdq.url/</MetadataQueryProtocol>
</MetadataProvider>
</MetadataProvider>
测试配置
# reload ShibbolethIdP or Metadata Service
touch /opt/jetty/webapps/idp.xml
# do a mdquery
/opt/shibboleth-idp/bin/mdquery.sh -e https://coco.release-check.edugain.org/shibboleth --saml2 -u http://localhost:8080/idp
使用 PySAML2 进行测试
import io
import json
import urllib.request
from saml2.mdstore import MetaDataMDX
def b64(entity_name):
return '{base64}'+base64.b64encode(entity_name.encode()).decode()
# when available
mdq_url = "http://localhost:8001"
mdq_cert = "certificates/public.cert"
entity2check = 'https://idp.unical.it/idp/shibboleth'
cert = open(mdq_cert)
# omit cert if unavailable
mdx = MetaDataMDX(mdq_url, cert=cert)
# base64 entity name trasformation
# mdx = MetaDataMDX(mdq_url, cert=cert, entity_transform=b64)
# certificati
mdx.certs(entity2check, "idpsso", use="encryption")
# get certs from idp
mdx.service(entity2check, 'idpsso_descriptor', 'single_sign_on_service')
mdx.certs(entity2check, "idpsso", use="signing")
作者
Giuseppe De Marco giuseppe.demarco@unical.it
致谢
项目详情
关闭
saml2_mdq-0.6.6.tar.gz 的哈希值
| 算法 | 哈希摘要 | |
|---|---|---|
| SHA256 | aff536c1e242a05f01b60ecdd46ddf26773cb604fb2d82478b39f8713766a2dd |
|
| MD5 | e651d0525725e4debd505e008b18ffe4 |
|
| BLAKE2b-256 | cd9ee9a26b8f1006285b3205ea49ec0e0d9da719b6a60618370742fbeaaa51b8 |