Skip to content

Commit

Permalink
✨ [#403] Support cafile and capath parameters
Browse files Browse the repository at this point in the history
When retrieving the IDP metadata, you can now optionally specify the the
capath or cafile to use for certificate verification, rather than just
enabling/disabling it.

This allows TLS verification of server certificates that are not in the
system root store (such as when using private CAs).
  • Loading branch information
sergei-maertens committed Oct 3, 2024
1 parent 27372ce commit f3d61ae
Showing 1 changed file with 21 additions and 12 deletions.
33 changes: 21 additions & 12 deletions src/onelogin/saml2/idp_metadata_parser.py
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,7 @@


from copy import deepcopy

try:
import urllib.request as urllib2
except ImportError:
import urllib2
from urllib.request import Request, urlopen

import ssl

Expand All @@ -27,7 +23,15 @@ class OneLogin_Saml2_IdPMetadataParser(object):
"""

@classmethod
def get_metadata(cls, url, validate_cert=True, timeout=None, headers=None):
def get_metadata(
cls,
url,
validate_cert=True,
cafile=None,
capath=None,
timeout=None,
headers=None,
):
"""
Gets the metadata XML from the provided URL
:param url: Url where the XML of the Identity Provider Metadata is published.
Expand All @@ -46,15 +50,20 @@ def get_metadata(cls, url, validate_cert=True, timeout=None, headers=None):
"""
valid = False

request = urllib2.Request(url, headers=headers or {})

if validate_cert:
response = urllib2.urlopen(request, timeout=timeout)
else:
# Respect the no-TLS-certificate validation option
ctx = None
if not validate_cert:
if cafile or capath:
raise ValueError(
"Specifying 'cafile' or 'capath' while disabling certificate "
"validation is contradictory."
)
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
response = urllib2.urlopen(request, context=ctx, timeout=timeout)

request = Request(url, headers=headers or {})
response = urlopen(request, timeout=timeout, cafile=cafile, capath=capath, context=ctx)
xml = response.read()

if xml:
Expand Down

0 comments on commit f3d61ae

Please sign in to comment.