Package: python3-saml-django
Django SAML ToolkitQuickly and easily add SAML Single Sign-On to your Django projects.
This package is designed to be very simple for initial setup while also being easily customizable to meet all of your needs.InstallationDependencies (Linux)The package xmlsec1 is required for this to work.Debian / Ubuntu:sudo apt-get install libxml2-dev libxmlsec1-dev libxmlsec1-opensslRed Hat / CentOs:sudo yum install libxml2-devel xmlsec1-devel xmlsec1-openssl-devel libtool-ltdl-develDependencies (Windows)The python-xmlsec package on Windows is having some issues with hosting, so you can install it manually here:pip install https://github.com/mehcode/python-xmlsec/releases/download/1.3.5/xmlsec-1.3.52.dev0-cp36-cp36m-win_amd64.whlFor more informationhere is the related issue.Pippip install python3-saml-djangoDjangoNote: Django 1.11 support was dropped in1.2.0. If you need Django 1.11 support, please use version1.1.4. Django 2.x support was dropped in1.3.0. If you need Django 2.x support, please use version1.2.2.settings.pyINSTALLED_APPS=[...,'django_saml']AUTHENTICATION_BACKENDS=['django_saml.backends.SamlUserBackend',...]urls.pyurlpatterns=[path('saml/',include('django_saml.urls')),...]ConfigurationRequired SettingsSP InformationYou must provide information about your site to be published as metadata.SAML_SP={"entityId":"https://<your_site>/saml/metadata/","assertionConsumerService":{"url":"https://<your_site>/saml/acs/",# DO NOT CHANGE THIS"binding":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"},"singleLogoutService":{"url":"https://<your_site>/saml/sls/",# DO NOT CHANGE THIS"binding":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"},"NameIDFormat":"urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified","x509cert":"<can also be loaded by file, see SAML_BASE_DIRECTORY>","privateKey":"<can also be loaded by file, see SAML_BASE_DIRECTORY>"}IdP InformationYou must provide information about the IdP you will be using through one of the following means:SAML_IDP={"entityId":"https://example.com/saml/metadata/","singleSignOnService":{"url":"https://example.com/trust/saml2/http-post/sso/","binding":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"},"singleLogoutService":{"url":"https://example.com/trust/saml2/http-redirect/slo/","binding":"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"},"x509cert":"<cert here>"}SAML_IDP_FILE=os.path.join(BASE_DIR,'idp_meta.xml')SAML_IDP_URL='https://example.com/saml/metadata/'Optional SettingsSettingDescriptionDefaultExampleSAML_STRICTIncorrect SAML responses should be rejected.Should be True in production.TrueSAML_DEBUGSAML warnings are displayedFalseSAML_CREATE_USERNew users are created on login if they don't existTrueSAML_UPDATE_USERExisting users are updated with information from SAML on loginFalseSAML_IDP_METADATA_TIMEOUTIf using SAML_IDP_URL, the result will be cached for this many seconds before checking again.3600SAML_SECURITYAdvanced security settingsSee belowSee belowSAML_CONTACTContact information for site maintainersNoneSee belowSAML_ORGANIZATIONOrganization informationNoneSee belowSAML_LOGIN_REDIRECTPath to redirect users after a successful login'/'SAML_LOGOUT_REDIRECTPath to redirect users after a successful logout'/logged-out'SAML_NO_USER_REDIRECTPath to redirect users if SAML_CREATE_USER = False and the user doesn't existNone (Raises PermissionDenied)'/permission-error'SAML_USERNAME_ATTRSAML attribute to use to look up users (name, not friendly name)'uid''email'SAML_ATTR_MAPList of 2-tuples to map SAML attributes to Django user attributes (indexed by name, not friendly name)[][('givenName', 'first_name')]SAML_ATTR_DEFAULTSDictionary of default values to use if an attribute is not present in the SAML response. If no default exists, then aMissingAttributeExceptionwill be thrown.{}{'first_name': ''}SAML_ATTR_UPDATE_IGNOREList of Django user attributes to only set on first login, and ignore in future logins (only used if SAML_UPDATE_USER isTrue)[][('email', 'first_name')]SAML_BASE_DIRECTORYFile path to load SP certificates.Must contain a 'certs' folder with 'sp.key' and 'sp.crt' inside.Noneos.path.join(BASE_DIR, 'saml')SAML_DESTINATION_HOSTStatic value to compare with the SAML Destination attribute instead of reading from the request.  Useful for load balancers.None'example.com'SAML_DESTINATION_HTTPSCompanion for SAML_DESTINATION_HOST. Set to True if the destination will be over HTTPS but the final request will not be.NoneTrueSAML_DESTINATION_PORTCompanion for SAML_DESTINATION_HOST. Set to a STRING of a number if you use a non-standard port that does not match SAML_DESTINATION_HTTPS.None'8080'SAML_SECURITYDefault and ExampleSAML_SECURITY={"nameIdEncrypted":False,"authnRequestsSigned":False,"logoutRequestSigned":False,"logoutResponseSigned":False,"signMetadata":False,"wantMessagesSigned":False,"wantAssertionsSigned":False,"wantNameId":True,"wantNameIdEncrypted":False,"wantAssertionsEncrypted":False,"signatureAlgorithm":"http://www.w3.org/2000/09/xmldsig#rsa-sha1","digestAlgorithm":"http://www.w3.org/2000/09/xmldsig#sha1"}SAML_CONTACTExampleSAML_CONTACT={"technical":{"givenName":"Technology Director","emailAddress":"technology@thon.org"},"support":{"givenName":"Lead Systems Admin","emailAddress":"systems@thon.org"}}SAML_ORGANIZATIONExampleSAML_ORGANIZATION={'en-US':{'name':'thon','displayname':'THON','url':'thon.org'}}A Note About AttributesAll SAML attributes must have a name, but sometimes they may have aFriendlyName. All of the configuration settings in this library rely on the normal name, not friendly name. Please reference your IdP's attribute settings or analyze a SAML response to see the attributes available.Some IdPs use obscure names likeurn:oid:2.5.4.42while others usefirstName; just because the docs use a friendly-looking name does not mean it is theFriendlyName.Advanced Configuration (Custom Backend)For situations like advanced attribute mapping with groups, transforming SAML attributes, etc, you can create custom backends to use instead of the default.Example:fromdjango.contrib.auth.modelsimportGroupfromdjango_saml.backendsimportSamlUserBackendclassCustomSamlBackend(SamlUserBackend):defclean_username(self,username):"""Return the first part of the email address.Example: test@example.com -> test."""returnusername.split('@')[0]defconfigure_user(self,session_data,user,ignore_fields=None):"""Custom attribute mapping with groups.NOTE: ALL SAML attributes in session_data are arrays, even if there is only one element."""# Call super() to take care of the simple attribute mapping in SAML_ATTR_MAPuser=super(CustomSamlBackend,self).configure_user(session_data,user,ignore_fields=ignore_fields)forgroup_nameinsession_data['psMemberOf']:group_name=group_name[5:]g=Group.objects.get(name=group_name)g.user_set.add(user)returnuserCreditThis project is a wrapper aroundOneLogin's python3-saml library.SupportIf you would like to support the development of this package, please considerdonating to THONand supporting our mission.