#NEWLINE# def verify( self , request , cookie , path , requrl , end_point_index = None , **kwargs ) : #NEWLINE# #INDENT# '\n            Verifies if the authentication was successful.\n\n            :rtype : Response\n            :param request: Contains the request parameters.\n            :param cookie: Cookies sent with the request.\n            :param kwargs: Any other parameters.\n            :return: If the authentication was successful: a redirect to the\n            return_to url. Otherwise a unauthorized response.\n            :raise: ValueError\n            ' #NEWLINE# if isinstance ( request , six . string_types ) : #NEWLINE# #INDENT# request = parse_qs ( request ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if isinstance ( request , dict ) : #NEWLINE# #INDENT# pass #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# raise ValueError ( 'Wrong type of input' ) #NEWLINE# #UNINDENT# #UNINDENT# acs = self . sp . config . getattr ( 'endpoints' , 'sp' ) [ 'assertion_consumer_service' ] #NEWLINE# acs_endpoints = [ ( ep [ 0 ] . rsplit ( '/' , 1 ) [ 1 ] , ep [ 1 ] ) for ep in acs ] #NEWLINE# binding = None #NEWLINE# path = path [ 1 : ] #NEWLINE# for endp in acs_endpoints : #NEWLINE# #INDENT# if ( path == endp [ 0 ] ) : #NEWLINE# #INDENT# binding = endp [ 1 ] #NEWLINE# break #NEWLINE# #UNINDENT# #UNINDENT# ( saml_cookie , _ts , _typ ) = self . getCookieValue ( cookie , self . CONST_SAML_COOKIE ) #NEWLINE# data = json . loads ( saml_cookie ) #NEWLINE# rp_query_cookie = self . get_multi_auth_cookie ( cookie ) #NEWLINE# query = rp_query_cookie #NEWLINE# if ( not query ) : #NEWLINE# #INDENT# query = base64 . b64decode ( data [ self . CONST_QUERY ] ) . decode ( 'ascii' ) #NEWLINE# #UNINDENT# if ( data [ self . CONST_HASIDP ] == 'False' ) : #NEWLINE# #INDENT# ( done , response ) = self . _pick_idp ( request , end_point_index ) #NEWLINE# if ( done == 0 ) : #NEWLINE# #INDENT# entity_id = response #NEWLINE# resp = self . _redirect_to_auth ( self . sp , entity_id , query , end_point_index ) #NEWLINE# return ( resp , False ) #NEWLINE# #UNINDENT# return ( response , False ) #NEWLINE# #UNINDENT# if ( not request ) : #NEWLINE# #INDENT# logger . info ( 'Missing Response' ) #NEWLINE# return ( Unauthorized ( 'You are not authorized!' ) , False ) #NEWLINE# #UNINDENT# try : #NEWLINE# #INDENT# response = self . sp . parse_authn_request_response ( request [ 'SAMLResponse' ] [ 0 ] , binding , self . cache_outstanding_queries ) #NEWLINE# #UNINDENT# except UnknownPrincipal as excp : #NEWLINE# #INDENT# logger . error ( ( 'UnknownPrincipal: %s' % ( excp , ) ) ) #NEWLINE# return ( Unauthorized ( self . not_authorized ) , False ) #NEWLINE# #UNINDENT# except UnsupportedBinding as excp : #NEWLINE# #INDENT# logger . error ( ( 'UnsupportedBinding: %s' % ( excp , ) ) ) #NEWLINE# return ( Unauthorized ( self . not_authorized ) , False ) #NEWLINE# #UNINDENT# except VerificationError as err : #NEWLINE# #INDENT# logger . error ( ( 'Verification error: %s' % ( err , ) ) ) #NEWLINE# return ( Unauthorized ( self . not_authorized ) , False ) #NEWLINE# #UNINDENT# except Exception as err : #NEWLINE# #INDENT# logger . error ( ( 'Other error: %s' % ( err , ) ) ) #NEWLINE# return ( Unauthorized ( self . not_authorized ) , False ) #NEWLINE# #UNINDENT# if ( self . sp_conf . VALID_ATTRIBUTE_RESPONSE is not None ) : #NEWLINE# #INDENT# for ( k , v ) in six . iteritems ( self . sp_conf . VALID_ATTRIBUTE_RESPONSE ) : #NEWLINE# #INDENT# if ( k not in response . ava ) : #NEWLINE# #INDENT# return ( Unauthorized ( self . not_authorized ) , False ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# allowed = False #NEWLINE# for allowed_attr_value in v : #NEWLINE# #INDENT# if isinstance ( response . ava [ k ] , list ) : #NEWLINE# #INDENT# for resp_value in response . ava [ k ] : #NEWLINE# #INDENT# if ( allowed_attr_value in resp_value ) : #NEWLINE# #INDENT# allowed = True #NEWLINE# break #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# else : #NEWLINE# #INDENT# if ( allowed_attr_value in response . ava [ k ] ) : #NEWLINE# #INDENT# allowed = True #NEWLINE# break #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# if ( not allowed ) : #NEWLINE# #INDENT# return ( Unauthorized ( self . not_authorized ) , False ) #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# #UNINDENT# uid = response . assertion . subject . name_id . text #NEWLINE# if ( self . userinfo == 'AA' ) : #NEWLINE# #INDENT# if ( ( response . entity_id is not None ) and ( self . samlcache is not None ) ) : #NEWLINE# #INDENT# self . samlcache [ 'AA_ENTITYID' ] = response . entity_id #NEWLINE# #UNINDENT# #UNINDENT# self . setup_userdb ( uid , response . ava ) #NEWLINE# return_to = create_return_url ( self . return_to , uid , ** { #NEWLINE# #INDENT# self . query_param : 'true' , #NEWLINE# #UNINDENT# } ) #NEWLINE# if ( '?' in return_to ) : #NEWLINE# #INDENT# return_to += '&' #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# return_to += '?' #NEWLINE# #UNINDENT# return_to += query #NEWLINE# auth_cookie = self . create_cookie ( uid , 'samlm' ) #NEWLINE# resp = SeeOther ( str ( return_to ) , headers = [ auth_cookie ] ) #NEWLINE# return ( resp , True )