I need to validate SAML2 assertion (as password replacement) in Python. (Big picture: Shibboleth Idp <-> SOGo SP passing assertion response to my module (based on pam-script)) I'm trying to keep things secure, but as simple/managable as possible. SIGNXML Python library seems to be a very good starting point, but AFAIK there some missing pieces of jigsaw puzzle... P.S. I'm not at all new to any of following topics, but also not a day-to-day workhorse programmer... So I would appreciate any further ("general") suggestions to take the right direction from the beginning... So my questions are: Recommended way/library to (simply( handle/decrypt encrypted assertion reply from IdP? How to extend assertion validity time-frame (by defined grace/skew time period) adn/or disable time validity checking at all (for use in non-production environment)? Preferred way to parse SAML2 assertion for attributes like 'uid', EntityId of SP, etc. (lxml.etree seems to right way to me but...) Any further consideration to take in account to ensure integrity/security during validation process? Thank you very much in advance for any help/suggestion/examples! Best regards, Lubos Continue reading...
