Skip to content

Commit 324656e

Browse files
c00kiemon5terc00kiemon5ter
committed
Merge branch 'feature-add-metadata-freshness'
Define a period for which the metadata fetched from an MDQ are considered valid. Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
2 parents b3635ec + 9030d03 commit 324656e

File tree

5 files changed

+282
-137
lines changed

5 files changed

+282
-137
lines changed

‎docs/howto/config.rst‎

Lines changed: 141 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -16,29 +16,37 @@ The basic structure of the configuration file is therefore like this::
1616
from saml2 import BINDING_HTTP_REDIRECT
1717

1818
CONFIG = {
19-
"entityid" : "http://saml.example.com:saml/idp.xml",
20-
"name" : "Rolands IdP",
19+
"entityid": "http://saml.example.com:saml/idp.xml",
20+
"name": "Rolands IdP",
2121
"service": {
2222
"idp": {
23-
"endpoints" : {
24-
"single_sign_on_service" : [
25-
("http://saml.example.com:saml:8088/sso",
26-
BINDING_HTTP_REDIRECT)],
23+
"endpoints": {
24+
"single_sign_on_service": [
25+
(
26+
"http://saml.example.com:saml:8088/sso",
27+
BINDING_HTTP_REDIRECT,
28+
),
29+
],
2730
"single_logout_service": [
28-
("http://saml.example.com:saml:8088/slo",
29-
BINDING_HTTP_REDIRECT)]
31+
(
32+
"http://saml.example.com:saml:8088/slo",
33+
BINDING_HTTP_REDIRECT,
34+
),
35+
],
3036
},
3137
...
3238
}
3339
},
34-
"key_file" : "my.key",
35-
"cert_file" : "ca.pem",
36-
"xmlsec_binary" : "/usr/local/bin/xmlsec1",
40+
"key_file": "my.key",
41+
"cert_file": "ca.pem",
42+
"xmlsec_binary": "/usr/local/bin/xmlsec1",
3743
"delete_tmpfiles": True,
3844
"metadata": {
39-
"local": ["edugain.xml"],
45+
"local": [
46+
"edugain.xml",
47+
],
4048
},
41-
"attribute_map_dir" : "attributemaps",
49+
"attribute_map_dir": "attributemaps",
4250
...
4351
}
4452

@@ -93,7 +101,7 @@ A typical map file will look like this::
93101
'urn:mace:dir:attribute-def:associatedDomain': 'associatedDomain',
94102
'urn:mace:dir:attribute-def:associatedName': 'associatedName',
95103
...
96-
},
104+
},
97105
"to": {
98106
'aRecord': 'urn:mace:dir:attribute-def:aRecord',
99107
'aliasedEntryName': 'urn:mace:dir:attribute-def:aliasedEntryName',
@@ -135,19 +143,22 @@ about the service or if support is needed. The possible types are according to
135143
the standard **technical**, **support**, **administrative**, **billing**
136144
and **other**.::
137145

138-
contact_person: [{
139-
"givenname": "Derek",
140-
"surname": "Jeter",
141-
"company": "Example Co.",
142-
"mail": ["jeter@example.com"],
143-
"type": "technical",
144-
},{
145-
"givenname": "Joe",
146-
"surname": "Girardi",
147-
"company": "Example Co.",
148-
"mail": "girardi@example.com",
149-
"type": "administrative",
150-
}]
146+
contact_person: [
147+
{
148+
"givenname": "Derek",
149+
"surname": "Jeter",
150+
"company": "Example Co.",
151+
"mail": ["jeter@example.com"],
152+
"type": "technical",
153+
},
154+
{
155+
"givenname": "Joe",
156+
"surname": "Girardi",
157+
"company": "Example Co.",
158+
"mail": "girardi@example.com",
159+
"type": "administrative",
160+
},
161+
]
151162

152163
debug
153164
^^^^^
@@ -193,7 +204,7 @@ Contains a list of places where metadata can be found. This can be
193204

194205
For example::
195206

196-
"metadata" : {
207+
"metadata": {
197208
"local": [
198209
"/opt/metadata"
199210
"metadata.xml",
@@ -209,6 +220,7 @@ For example::
209220
{
210221
"url": "http://mdq.ukfederation.org.uk/",
211222
"cert": "ukfederation-mdq.pem",
223+
"freshness_period": "P0Y0M0DT2H0M0S",
212224
},
213225
],
214226
},
@@ -221,16 +233,33 @@ metadata signing certificates should be used. These public keys must be
221233
acquired by some secure out-of-band method before being placed on the local
222234
file system.
223235

236+
When using MDQ, the `freshness_period` option can be set to define a period for
237+
which the metadata fetched from the the MDQ server are considered fresh. After
238+
that period has passed the metadata are not valid anymore and must be fetched
239+
again. The period must be in the format defined in
240+
`ISO 8601 <https://www.iso.org/iso-8601-date-and-time-format.html>`_
241+
or `RFC3999 <https://tools.ietf.org/html/rfc3339#appendix-A>`_.
242+
243+
By default, if `freshness_period` is not defined, the metadata are refreshed
244+
every 12 hours (`P0Y0M0DT12H0M0S`).
245+
246+
224247
organization
225248
^^^^^^^^^^^^
226249

227250
Only used by *make_metadata.py*.
228251
Where you describe the organization responsible for the service.::
229252

230253
"organization": {
231-
"name": [("Example Company","en"), ("Exempel AB","se")],
254+
"name": [
255+
("Example Company", "en"),
256+
("Exempel AB", "se")
257+
],
232258
"display_name": ["Exempel AB"],
233-
"url": [("http://example.com","en"),("http://exempel.se","se")],
259+
"url": [
260+
("http://example.com", "en"),
261+
("http://exempel.se", "se"),
262+
],
234263
}
235264

236265
.. note:: You can specify the language of the name, or the language used on
@@ -280,14 +309,22 @@ So if a server is a Service Provider (SP) then the configuration
280309
could look something like this::
281310

282311
"service": {
283-
"sp":{
284-
"name" : "Rolands SP",
285-
"endpoints":{
312+
"sp": {
313+
"name": "Rolands SP",
314+
"endpoints": {
286315
"assertion_consumer_service": ["http://localhost:8087/"],
287-
"single_logout_service" : [("http://localhost:8087/slo",
288-
'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect')],
316+
"single_logout_service": [
317+
(
318+
"http://localhost:8087/slo",
319+
'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
320+
),
321+
],
289322
},
290-
"required_attributes": ["surname", "givenname", "edupersonaffiliation"],
323+
"required_attributes": [
324+
"surname",
325+
"givenname",
326+
"edupersonaffiliation",
327+
],
291328
"optional_attributes": ["title"],
292329
"idp": {
293330
"urn:mace:umu.se:saml:roland:idp": None,
@@ -384,7 +421,7 @@ An example might be::
384421
},
385422
"urn:mace:example.com:saml:roland:sp": {
386423
"lifetime": {"minutes": 5},
387-
"attribute_restrictions":{
424+
"attribute_restrictions": {
388425
"givenName": None,
389426
"surName": None,
390427
}
@@ -420,7 +457,7 @@ regular expressions.::
420457
"policy": {
421458
"urn:mace:umu.se:saml:roland:sp": {
422459
"lifetime": {"minutes": 5},
423-
"attribute_restrictions":{
460+
"attribute_restrictions": {
424461
"mail": [".*\.umu\.se$"],
425462
}
426463
}
@@ -661,7 +698,11 @@ Example::
661698

662699
"service": {
663700
"sp": {
664-
"required_attributes": ["surname", "givenName", "mail"],
701+
"required_attributes": [
702+
"surname",
703+
"givenName",
704+
"mail",
705+
],
665706
}
666707
}
667708

@@ -708,7 +749,7 @@ Example::
708749
"sp": {
709750
"want_response_signed": False,
710751
"want_assertions_signed": False,
711-
"want_assertions_or_response_signed": True
752+
"want_assertions_or_response_signed": True,
712753
}
713754
}
714755

@@ -757,11 +798,13 @@ Example::
757798

758799
"service":
759800
"idp": {
760-
"endpoints" : {
761-
"single_sign_on_service" : [
762-
("http://localhost:8088/sso", BINDING_HTTP_REDIRECT)],
801+
"endpoints": {
802+
"single_sign_on_service": [
803+
("http://localhost:8088/sso", BINDING_HTTP_REDIRECT),
804+
],
763805
"single_logout_service": [
764-
("http://localhost:8088/slo", BINDING_HTTP_REDIRECT)]
806+
("http://localhost:8088/slo", BINDING_HTTP_REDIRECT),
807+
],
765808
},
766809
},
767810
},
@@ -810,9 +853,9 @@ virtual_organization
810853

811854
Gives information about common identifiers for virtual_organizations::
812855

813-
"virtual_organization" : {
814-
"urn:mace:example.com:it:tek":{
815-
"nameid_format" : "urn:oid:1.3.6.1.4.1.1466.115.121.1.15-NameID",
856+
"virtual_organization": {
857+
"urn:mace:example.com:it:tek": {
858+
"nameid_format": "urn:oid:1.3.6.1.4.1.1466.115.121.1.15-NameID",
816859
"common_identifier": "umuselin",
817860
}
818861
},
@@ -830,35 +873,38 @@ We start with a simple but fairly complete Service provider configuration::
830873
from saml2 import BINDING_HTTP_REDIRECT
831874

832875
CONFIG = {
833-
"entityid" : "http://example.com/sp/metadata.xml",
876+
"entityid": "http://example.com/sp/metadata.xml",
834877
"service": {
835-
"sp":{
836-
"name" : "Example SP",
837-
"endpoints":{
878+
"sp": {
879+
"name": "Example SP",
880+
"endpoints": {
838881
"assertion_consumer_service": ["http://example.com/sp"],
839-
"single_logout_service" : [("http://example.com/sp/slo",
840-
BINDING_HTTP_REDIRECT)],
882+
"single_logout_service": [
883+
("http://example.com/sp/slo", BINDING_HTTP_REDIRECT),
884+
],
841885
},
842886
}
843887
},
844-
"key_file" : "./mykey.pem",
845-
"cert_file" : "./mycert.pem",
846-
"xmlsec_binary" : "/usr/local/bin/xmlsec1",
888+
"key_file": "./mykey.pem",
889+
"cert_file": "./mycert.pem",
890+
"xmlsec_binary": "/usr/local/bin/xmlsec1",
847891
"delete_tmpfiles": True,
848892
"attribute_map_dir": "./attributemaps",
849893
"metadata": {
850894
"local": ["idp.xml"]
851895
}
852896
"organization": {
853-
"display_name":["Example identities"]
897+
"display_name": ["Example identities"]
854898
}
855-
"contact_person": [{
856-
"givenname": "Roland",
857-
"surname": "Hedberg",
858-
"phone": "+46 90510",
859-
"mail": "roland@example.com",
860-
"type": "technical",
861-
}]
899+
"contact_person": [
900+
{
901+
"givenname": "Roland",
902+
"surname": "Hedberg",
903+
"phone": "+46 90510",
904+
"mail": "roland@example.com",
905+
"type": "technical",
906+
},
907+
]
862908
}
863909

864910
This is the typical setup for an SP.
@@ -872,45 +918,51 @@ A slightly more complex configuration::
872918
from saml2 import BINDING_HTTP_REDIRECT
873919

874920
CONFIG = {
875-
"entityid" : "http://sp.example.com/metadata.xml",
921+
"entityid": "http://sp.example.com/metadata.xml",
876922
"service": {
877-
"sp":{
878-
"name" : "Example SP",
879-
"endpoints":{
923+
"sp": {
924+
"name": "Example SP",
925+
"endpoints": {
880926
"assertion_consumer_service": ["http://sp.example.com/"],
881-
"single_logout_service" : [("http://sp.example.com/slo",
882-
BINDING_HTTP_REDIRECT)],
927+
"single_logout_service": [
928+
("http://sp.example.com/slo", BINDING_HTTP_REDIRECT),
929+
],
883930
},
884931
"subject_data": ("memcached", "localhost:12121"),
885-
"virtual_organization" : {
886-
"urn:mace:example.com:it:tek":{
887-
"nameid_format" : "urn:oid:1.3.6.1.4.1.1466.115.121.1.15-NameID",
932+
"virtual_organization": {
933+
"urn:mace:example.com:it:tek": {
934+
"nameid_format": "urn:oid:1.3.6.1.4.1.1466.115.121.1.15-NameID",
888935
"common_identifier": "eduPersonPrincipalName",
889936
}
890937
},
891938
}
892939
},
893-
"key_file" : "./mykey.pem",
894-
"cert_file" : "./mycert.pem",
895-
"xmlsec_binary" : "/usr/local/bin/xmlsec1",
940+
"key_file": "./mykey.pem",
941+
"cert_file": "./mycert.pem",
942+
"xmlsec_binary": "/usr/local/bin/xmlsec1",
896943
"delete_tmpfiles": True,
897-
"metadata" : {
944+
"metadata": {
898945
"local": ["example.xml"],
899-
"remote": [{
900-
"url":"https://kalmar2.org/simplesaml/module.php/aggregator/?id=kalmarcentral2&set=saml2",
901-
"cert":"kalmar2.pem"}]
946+
"remote": [
947+
{
948+
"url":"https://kalmar2.org/simplesaml/module.php/aggregator/?id=kalmarcentral2&set=saml2",
949+
"cert":"kalmar2.pem",
950+
}
951+
]
902952
},
903-
"attribute_maps" : "attributemaps",
953+
"attribute_maps": "attributemaps",
904954
"organization": {
905-
"display_name":["Example identities"]
955+
"display_name": ["Example identities"]
906956
}
907-
"contact_person": [{
908-
"givenname": "Roland",
909-
"surname": "Hedberg",
910-
"phone": "+46 90510",
911-
"mail": "roland@example.com",
912-
"type": "technical",
913-
}]
957+
"contact_person": [
958+
{
959+
"givenname": "Roland",
960+
"surname": "Hedberg",
961+
"phone": "+46 90510",
962+
"mail": "roland@example.com",
963+
"type": "technical",
964+
},
965+
]
914966
}
915967

916968
Uses metadata files, both local and remote, and will talk to whatever

0 commit comments

Comments
 (0)