Skip to content

Commit 557ecc7

Browse files
📌(pysaml2) pin pysaml2 to avoid double-signing of AuthNRequests
The current version of pysaml2 (7.5.2) has an issue where AuthNRequests are both signed in the XML and with an extra `Signature` queryparam. This was reported initially in 2021: IdentityPython/pysaml2#819 And it was fixed by a changed in SATOSA: IdentityPython/SATOSA#380 But it reappeared apparently and the original reporter has a PR open against pysaml2 that is supposed to fix it: IdentityPython/pysaml2#973 They report that the regression was introduced in pysaml2 by IdentityPython/pysaml2#834 We try here to pin pysaml2 to the last version before this PR was merged. Unfortunately this is quite an old version, but from basic testing it seems to still be compatible with the current SATOSA version. Hopefully this can be temporary.
1 parent 5b03bff commit 557ecc7

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

src/satosa/pyproject.toml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,10 @@ dependencies = [
2828
"redis==5.0.4",
2929
"JSON-log-formatter==1.0",
3030
"WhiteNoise==6.7.0",
31+
# Use the most recent pysaml2 that doesn't have the recurrence of
32+
# https://github.com/IdentityPython/pysaml2/issues/819
33+
# (AuthNRequests signed twice)
34+
"pysaml2==7.1.0",
3135
]
3236

3337
[project.urls]

0 commit comments

Comments
 (0)