authentik.providers.saml.tests.test_metadata

  1"""Test Service-Provider Metadata Parser"""
  2
  3import xmlsec
  4from defusedxml.lxml import fromstring
  5from django.test import RequestFactory, TestCase
  6from lxml import etree  # nosec
  7
  8from authentik.common.saml.constants import ECDSA_SHA256, NS_MAP, NS_SAML_METADATA
  9from authentik.core.models import Application
 10from authentik.core.tests.utils import create_test_cert, create_test_flow
 11from authentik.crypto.builder import PrivateKeyAlg
 12from authentik.lib.generators import generate_id
 13from authentik.lib.tests.utils import load_fixture
 14from authentik.lib.xml import lxml_from_string
 15from authentik.providers.saml.models import SAMLBindings, SAMLPropertyMapping, SAMLProvider
 16from authentik.providers.saml.processors.metadata import MetadataProcessor
 17from authentik.providers.saml.processors.metadata_parser import ServiceProviderMetadataParser
 18from authentik.sources.saml.models import SAMLNameIDPolicy
 19
 20
 21class TestServiceProviderMetadataParser(TestCase):
 22    """Test ServiceProviderMetadataParser parsing and creation of SAML Provider"""
 23
 24    def setUp(self) -> None:
 25        self.flow = create_test_flow()
 26        self.factory = RequestFactory()
 27
 28    def test_consistent(self):
 29        """Test that metadata generation is consistent"""
 30        provider = SAMLProvider.objects.create(
 31            name=generate_id(),
 32            authorization_flow=self.flow,
 33        )
 34        Application.objects.create(
 35            name=generate_id(),
 36            slug=generate_id(),
 37            provider=provider,
 38        )
 39        request = self.factory.get("/")
 40        metadata_a = MetadataProcessor(provider, request).build_entity_descriptor()
 41        metadata_b = MetadataProcessor(provider, request).build_entity_descriptor()
 42        self.assertEqual(metadata_a, metadata_b)
 43
 44    def test_schema(self):
 45        """Test that metadata generation is consistent"""
 46        provider = SAMLProvider.objects.create(
 47            name=generate_id(),
 48            authorization_flow=self.flow,
 49        )
 50        Application.objects.create(
 51            name=generate_id(),
 52            slug=generate_id(),
 53            provider=provider,
 54        )
 55        request = self.factory.get("/")
 56        metadata = lxml_from_string(MetadataProcessor(provider, request).build_entity_descriptor())
 57
 58        schema = etree.XMLSchema(
 59            etree.parse(
 60                source="schemas/saml-schema-metadata-2.0.xsd", parser=etree.XMLParser()
 61            )  # nosec
 62        )
 63        self.assertTrue(schema.validate(metadata))
 64
 65    def test_schema_want_authn_requests_signed(self):
 66        """Test metadata generation with WantAuthnRequestsSigned"""
 67        cert = create_test_cert()
 68        provider = SAMLProvider.objects.create(
 69            name=generate_id(),
 70            authorization_flow=self.flow,
 71            verification_kp=cert,
 72        )
 73        Application.objects.create(
 74            name=generate_id(),
 75            slug=generate_id(),
 76            provider=provider,
 77        )
 78        request = self.factory.get("/")
 79        metadata = lxml_from_string(MetadataProcessor(provider, request).build_entity_descriptor())
 80        idp_sso_descriptor = metadata.findall(f"{{{NS_SAML_METADATA}}}IDPSSODescriptor")[0]
 81        self.assertEqual(idp_sso_descriptor.attrib["WantAuthnRequestsSigned"], "true")
 82
 83    def test_simple(self):
 84        """Test simple metadata without Signing"""
 85        metadata = ServiceProviderMetadataParser().parse(load_fixture("fixtures/simple.xml"))
 86        provider = metadata.to_provider("test", self.flow, self.flow)
 87        self.assertEqual(provider.acs_url, "http://localhost:8080/saml/acs")
 88        self.assertEqual(provider.sp_binding, SAMLBindings.POST)
 89        self.assertEqual(provider.default_name_id_policy, SAMLNameIDPolicy.EMAIL)
 90        self.assertEqual(
 91            len(provider.property_mappings.all()),
 92            len(SAMLPropertyMapping.objects.exclude(managed__isnull=True)),
 93        )
 94
 95    def test_with_signing_cert(self):
 96        """Test Metadata with signing cert"""
 97        create_test_cert()
 98        metadata = ServiceProviderMetadataParser().parse(load_fixture("fixtures/cert.xml"))
 99        provider = metadata.to_provider("test", self.flow, self.flow)
100        self.assertEqual(provider.acs_url, "http://localhost:8080/apps/user_saml/saml/acs")
101        self.assertEqual(provider.sp_binding, SAMLBindings.POST)
102        self.assertEqual(
103            provider.verification_kp.certificate_data, load_fixture("fixtures/cert.pem")
104        )
105        self.assertIsNotNone(provider.signing_kp)
106        self.assertEqual(provider.audience, "http://localhost:8080/apps/user_saml/saml/metadata")
107
108    def test_with_signing_cert_invalid_signature(self):
109        """Test Metadata with signing cert (invalid signature)"""
110        with self.assertRaises(ValueError):
111            ServiceProviderMetadataParser().parse(
112                load_fixture("fixtures/cert.xml").replace("/apps/user_saml", "")
113            )
114
115    def test_signature_rsa(self):
116        """Test signature validation (RSA)"""
117        provider = SAMLProvider.objects.create(
118            name=generate_id(),
119            authorization_flow=self.flow,
120            signing_kp=create_test_cert(PrivateKeyAlg.RSA),
121        )
122        Application.objects.create(
123            name=generate_id(),
124            slug=generate_id(),
125            provider=provider,
126        )
127        request = self.factory.get("/")
128        metadata = MetadataProcessor(provider, request).build_entity_descriptor()
129
130        root = fromstring(metadata.encode())
131        xmlsec.tree.add_ids(root, ["ID"])
132        signature_nodes = root.xpath("/md:EntityDescriptor/ds:Signature", namespaces=NS_MAP)
133        signature_node = signature_nodes[0]
134        ctx = xmlsec.SignatureContext()
135        key = xmlsec.Key.from_memory(
136            provider.signing_kp.certificate_data,
137            xmlsec.constants.KeyDataFormatCertPem,
138            None,
139        )
140        ctx.key = key
141        ctx.verify(signature_node)
142
143    def test_signature_ecdsa(self):
144        """Test signature validation (ECDSA)"""
145        provider = SAMLProvider.objects.create(
146            name=generate_id(),
147            authorization_flow=self.flow,
148            signing_kp=create_test_cert(PrivateKeyAlg.ECDSA),
149            signature_algorithm=ECDSA_SHA256,
150        )
151        Application.objects.create(
152            name=generate_id(),
153            slug=generate_id(),
154            provider=provider,
155        )
156        request = self.factory.get("/")
157        metadata = MetadataProcessor(provider, request).build_entity_descriptor()
158
159        root = fromstring(metadata.encode())
160        xmlsec.tree.add_ids(root, ["ID"])
161        signature_nodes = root.xpath("/md:EntityDescriptor/ds:Signature", namespaces=NS_MAP)
162        signature_node = signature_nodes[0]
163        ctx = xmlsec.SignatureContext()
164        key = xmlsec.Key.from_memory(
165            provider.signing_kp.certificate_data,
166            xmlsec.constants.KeyDataFormatCertPem,
167            None,
168        )
169        ctx.key = key
170        ctx.verify(signature_node)