Add missing post authn test

Author: RouganStriker

djangosaml2/tests/__init__.py

@@ -108,6 +108,35 @@ def render_template(self, text):
     def b64_for_post(self, xml_text, encoding='utf-8'):
         return base64.b64encode(xml_text.encode(encoding)).decode('ascii')
 
+    def test_unsigned_post_authn_request(self):
+        """
+        Test that unsigned authentication requests via POST binding
+        does not error.
+
+        https://github.com/knaperek/djangosaml2/issues/168
+        """
+        settings.SAML_CONFIG = conf.create_conf(
+            sp_host='sp.example.com',
+            idp_hosts=['idp.example.com'],
+            metadata_file='remote_metadata_post_binding.xml',
+            authn_requests_signed=False
+        )
+        response = self.client.get(reverse('saml2_login'))
+
+        self.assertEqual(response.status_code, 200)
+
+        # Using POST-binding returns a page with form containing the SAMLRequest
+        response_parser = SAMLPostFormParser()
+        response_parser.feed(response.content.decode('utf-8'))
+        saml_request = response_parser.saml_request_value
+        expected_request = """<samlp:AuthnRequest xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="http://sp.example.com/saml2/acs/" Destination="https://idp.example.com/simplesaml/saml2/idp/SSOService.php" ID="XXXXXXXXXXXXXXXXXXXXXX" IssueInstant="2010-01-01T00:00:00Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"><saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">http://sp.example.com/saml2/metadata/</saml:Issuer><samlp:NameIDPolicy AllowCreate="false" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" /></samlp:AuthnRequest>"""
+
+        self.assertIsNotNone(saml_request)
+        self.assertSAMLRequestsEquals(
+            base64.b64decode(saml_request).decode('utf-8'),
+            expected_request
+        )
+
     def test_login_evil_redirect(self):
         """
         Make sure that if we give an URL other than our own host as the next

djangosaml2/tests/conf.py

@@ -19,7 +19,7 @@
 
 
 def create_conf(sp_host='sp.example.com', idp_hosts=['idp.example.com'],
-                metadata_file='remote_metadata.xml', authn_requests_signed=True):
+                metadata_file='remote_metadata.xml', authn_requests_signed=None):
 
     try:
         from saml2.sigver import get_xmlsec_binary
@@ -55,7 +55,6 @@ def create_conf(sp_host='sp.example.com', idp_hosts=['idp.example.com'],
                 'optional_attributes': ['eduPersonAffiliation'],
                 'idp': {},  # this is filled later
                 'want_response_signed': False,
-                'authn_requests_signed': authn_requests_signed,
                 },
             },
 
@@ -91,6 +90,9 @@ def create_conf(sp_host='sp.example.com', idp_hosts=['idp.example.com'],
         'valid_for': 24,
         }
 
+    if authn_requests_signed is not None:
+        config['service']['sp']['authn_requests_signed'] = authn_requests_signed
+
     for idp in idp_hosts:
         entity_id = 'https://%s/simplesaml/saml2/idp/metadata.php' % idp
         config['service']['sp']['idp'][entity_id] = {