-
Notifications
You must be signed in to change notification settings - Fork 59
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add ENCRYPTION_KEYPAIRS to settings #216
Add ENCRYPTION_KEYPAIRS to settings #216
Conversation
…t automatically if both key_file and cert_file are provided
|
Tagging @mostafa for review. Thanks! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@gregorywong
Thanks for your contribution! LGTM, but please consider fixing the comment before I merge.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎉
This PR introduces a new configuration variable
ENCRYPTION_KEYPAIRS
to the settings.In addition to allowing the user to set it, this enhancement will automatically set it for them if both
KEY_FILE
andCERT_FILE
are defined.When handling encrypted assertions, encryption_keypairs must be set in order for saml2 to properly decrypt them. Unfortunately, this is not fully documented, but it is a known issue noted by other users of pysaml2 (or libraries requiring it):
IdentityPython/pysaml2#346
IdentityPython/djangosaml2#22
This enhancement ensures that encrypted assertions can be handled successfully, while keeping the configuration settings DRY (i.e., no need to include
CERT_FILE
andKEY_FILE
twice).