def test_start_auth_no_request_info(self, sp_conf):
        """
        Performs a complete test for the module satosa.backends.saml2. The flow should be accepted.
        """
        disco_srv = "https://my.dicso.com/role/idp.ds"
        samlbackend = SamlBackend(None, INTERNAL_ATTRIBUTES, {"config": sp_conf,
                                                              "disco_srv": disco_srv,
                                                              "state_id": "saml_backend_test_id"})
        internal_data = InternalRequest(None, None)

        state = State()
        context = Context()
        context.state = state
        resp = samlbackend.start_auth(context, internal_data)
        assert resp.status == "303 See Other", "Must be a redirect to the discovery server."
        assert resp.message.startswith("https://my.dicso.com/role/idp.ds"), \
            "Redirect to wrong URL."

        # create_name_id_policy_transient()
        state = State()
        context = Context()
        context.state = state
        user_id_hash_type = UserIdHashType.transient
        internal_data = InternalRequest(user_id_hash_type, None)
        resp = samlbackend.start_auth(context, internal_data)
        assert resp.status == "303 See Other", "Must be a redirect to the discovery server."

    def setup_for_authn_req(self, idp_conf, sp_conf, nameid_format):
        base = self.construct_base_url_from_entity_id(idp_conf["entityid"])
        config = {"idp_config": idp_conf, "endpoints": ENDPOINTS, "base": base,
                  "state_id": "state_id"}
        sp_metadata_str = create_metadata_from_config_dict(sp_conf)
        idp_conf["metadata"]["inline"] = [sp_metadata_str]

        samlfrontend = SamlFrontend(lambda context, internal_req: (context, internal_req),
                                    INTERNAL_ATTRIBUTES, config)
        samlfrontend.register_endpoints(["saml"])

        idp_metadata_str = create_metadata_from_config_dict(samlfrontend.config)
        sp_conf["metadata"]["inline"].append(idp_metadata_str)

        fakesp = FakeSP(None, config=SPConfig().load(sp_conf, metadata_construction=False))
        context = Context()
        context.state = State()
        context.request = parse.parse_qs(
                urlparse(fakesp.make_auth_req(samlfrontend.config["entityid"], nameid_format)).query)
        tmp_dict = {}
        for val in context.request:
            if isinstance(context.request[val], list):
                tmp_dict[val] = context.request[val][0]
            else:
                tmp_dict[val] = context.request[val]
        context.request = tmp_dict

        return context, samlfrontend

    def test_consent_not_given(self, internal_response, internal_request,
                               consent_verify_endpoint_regex, consent_registration_endpoint_regex):
        consent_config = SATOSAConfig(self.satosa_config)
        consent_module = ConsentModule(consent_config, identity_callback)
        expected_ticket = "my_ticket"

        responses.add(responses.GET, consent_verify_endpoint_regex, status=401)
        responses.add(responses.GET, consent_registration_endpoint_regex, status=200,
                      body=expected_ticket)

        context = Context()
        state = State()
        context.state = state
        consent_module.save_state(internal_request, state)

        resp = consent_module.manage_consent(context, internal_response)

        self.assert_redirect(resp, expected_ticket)
        self.assert_registstration_req(responses.calls[1].request,
                                       consent_config.CONSENT["sign_key"])

        context = Context()
        context.state = state
        # Verify endpoint of consent service still gives 401 (no consent given)
        context, internal_response = consent_module._handle_consent_response(context)
        assert not internal_response.get_attributes()

    def test_start_auth_name_id_policy(self, sp_conf):
        """
        Performs a complete test for the module satosa.backends.saml2. The flow should be accepted.
        """
        samlbackend = SamlBackend(None, INTERNAL_ATTRIBUTES, {"config": sp_conf,
                                                              "disco_srv": "https://my.dicso.com/role/idp.ds",
                                                              "state_id": "saml_backend_test_id"})
        test_state_key = "sauyghj34589fdh"

        state = State()
        state.add(test_state_key, "my_state")
        context = Context()
        context.state = state

        internal_req = InternalRequest(UserIdHashType.transient, None)
        resp = samlbackend.start_auth(context, internal_req)

        assert resp.status == "303 See Other", "Must be a redirect to the discovery server."

        disco_resp = parse_qs(urlparse(resp.message).query)
        sp_disco_resp = \
            sp_conf["service"]["sp"]["endpoints"]["discovery_response"][0][0]
        assert "return" in disco_resp and disco_resp["return"][0].startswith(sp_disco_resp), \
            "Not a valid return url in the call to the discovery server"
        assert "entityID" in disco_resp and disco_resp["entityID"][0] == sp_conf["entityid"], \
            "Not a valid entity id in the call to the discovery server"

        request_info_tmp = context.state
        assert request_info_tmp.get(test_state_key) == "my_state", "Wrong state!"

    def test_with_pyoidc(self):
        responses.add(responses.POST,
                      "https://graph.facebook.com/v2.5/oauth/access_token",
                      body=json.dumps({"access_token": "qwerty",
                                       "token_type": "bearer",
                                       "expires_in": 9999999999999}),
                      adding_headers={"set-cookie": "TEST=testing; path=/"},
                      status=200,
                      content_type='application/json')
        responses.add(responses.GET,
                      "https://graph.facebook.com/v2.5/me",
                      match_querystring=False,
                      body=json.dumps(FB_RESPONSE),
                      status=200,
                      content_type='application/json')

        context = Context()
        context.path = 'facebook/sso/redirect'
        context.state = State()
        internal_request = InternalRequest(UserIdHashType.transient, 'http://localhost:8087/sp.xml')
        get_state = Mock()
        get_state.return_value = STATE
        resp = self.fb_backend.start_auth(context, internal_request, get_state)
        context.cookie = resp.headers[0][1]
        context.request = {
            "code": FB_RESPONSE_CODE,
            "state": STATE
        }
        self.fb_backend.auth_callback_func = self.verify_callback
        self.fb_backend.authn_response(context)

    def run_server(self, environ, start_response, debug=False):
        path = environ.get('PATH_INFO', '').lstrip('/')
        if ".." in path:
            resp = Unauthorized()
            return resp(environ, start_response)

        context = Context()
        context.path = path

        # copy wsgi.input stream to allow it to be re-read later by satosa plugins
        # see: http://stackoverflow.com/questions/1783383/how-do-i-copy-wsgi-input-if-i-want-to-process-post-data-more-than-once
        content_length = int(environ.get('CONTENT_LENGTH', '0') or '0')
        body = io.BytesIO(environ['wsgi.input'].read(content_length))
        environ['wsgi.input'] = body
        context.request = unpack_either(environ)
        environ['wsgi.input'].seek(0)

        context.wsgi_environ = environ
        context.cookie = environ.get("HTTP_COOKIE", "")

        try:
            resp = self.run(context)
            if isinstance(resp, Exception):
                raise resp
            return resp(environ, start_response)
        except SATOSANoBoundEndpointError:
            resp = NotFound("Couldn't find the side you asked for!")
            return resp(environ, start_response)
        except Exception as err:
            logger.exception("%s" % err)
            if debug:
                raise

            resp = ServiceError("%s" % err)
            return resp(environ, start_response)

    def test_consent_full_flow(self, internal_response, internal_request,
                               consent_verify_endpoint_regex, consent_registration_endpoint_regex):
        consent_config = SATOSAConfig(self.satosa_config)
        consent_module = ConsentModule(consent_config, identity_callback)
        expected_ticket = "my_ticket"

        context = Context()
        state = State()
        context.state = state
        consent_module.save_state(internal_request, state)

        with responses.RequestsMock() as rsps:
            rsps.add(responses.GET, consent_verify_endpoint_regex, status=401)
            rsps.add(responses.GET, consent_registration_endpoint_regex, status=200,
                     body=expected_ticket)
            resp = consent_module.manage_consent(context, internal_response)

            self.assert_redirect(resp, expected_ticket)
            self.assert_registstration_req(rsps.calls[1].request,
                                           consent_config.CONSENT["sign_key"])

        with responses.RequestsMock() as rsps:
            # Now consent has been given, consent service returns 200 OK
            rsps.add(responses.GET, consent_verify_endpoint_regex, status=200,
                     body=json.dumps(FILTER))

            context = Context()
            context.state = state
            context, internal_response = consent_module._handle_consent_response(context)

        assert internal_response.get_attributes()["displayName"] == ["Test"]
        assert internal_response.get_attributes()["co"] == ["example"]
        assert "sn" not in internal_response.get_attributes()  # 'sn' should be filtered

 def test_backend(path, provider, endpoint):
     context = Context()
     context.path = path
     spec = router.endpoint_routing(context)
     assert spec[0] == provider
     assert spec[1] == endpoint
     assert context.target_backend == provider
     assert context.target_frontend is None

 def test_redirect_to_login_at_auth_endpoint(self):
     self.fake_op.setup_webfinger_endpoint()
     self.fake_op.setup_opienid_config_endpoint()
     self.fake_op.setup_client_registration_endpoint()
     context = Context()
     context.state = State()
     auth_response = self.openid_backend.start_auth(context, None)
     assert auth_response._status == Redirect._status

 def test_endpoint_routing_to_microservice(self, url_path, expected_micro_service):
     context = Context()
     context.path = url_path
     microservice_callable = self.router.endpoint_routing(context)
     assert context.target_micro_service == expected_micro_service
     assert microservice_callable == self.router.micro_services[expected_micro_service]["instance"].callback
     assert context.target_backend is None
     assert context.target_frontend is None

 def test_set_state_in_start_auth_and_use_in_redirect_endpoint(self):
     self.fake_op.setup_webfinger_endpoint()
     self.fake_op.setup_opienid_config_endpoint()
     self.fake_op.setup_client_registration_endpoint()
     context = Context()
     context.state = State()
     self.openid_backend.start_auth(context, None)
     context = self.setup_fake_op_endpoints(FakeOP.STATE)
     self.openid_backend.redirect_endpoint(context)

def test_path():
    context = Context()
    with pytest.raises(ValueError):
        context.path = None

    with pytest.raises(ValueError):
        context.path = "/babal"

    valid_path = "Saml2/sso/redirect"
    context.path = valid_path
    assert context.path == valid_path

 def test_test_restore_state_with_separate_backends(self):
     openid_backend_1 = OpenIdBackend(MagicMock, INTERNAL_ATTRIBUTES, TestConfiguration.get_instance().config)
     openid_backend_2 = OpenIdBackend(MagicMock, INTERNAL_ATTRIBUTES, TestConfiguration.get_instance().config)
     self.fake_op.setup_webfinger_endpoint()
     self.fake_op.setup_opienid_config_endpoint()
     self.fake_op.setup_client_registration_endpoint()
     context = Context()
     context.state = State()
     openid_backend_1.start_auth(context, None)
     context = self.setup_fake_op_endpoints(FakeOP.STATE)
     openid_backend_2.redirect_endpoint(context)

    def test_routing(path, provider, receiver, _):
        context = Context()
        context.path = path
        context.state = state
        router.endpoint_routing(context)

        backend = router.backend_routing(context)
        assert backend == backends[provider]

        frontend = router.frontend_routing(context)
        assert frontend == frontends[receiver]
        assert context.target_frontend == receiver

 def setup_authentication_response(self, state=None):
     context = Context()
     context.path = 'openid/authz_cb'
     op_base = TestConfiguration.get_instance().rp_config.OP_URL
     if not state:
         state = rndstr()
     context.request = {
         'code': 'F+R4uWbN46U+Bq9moQPC4lEvRd2De4o=',
         'scope': 'openid profile email address phone',
         'state': state}
     context.state = self.generate_state(op_base)
     return context

 def test_register_client_with_wrong_response_type(self):
     redirect_uri = "https://client.example.com"
     registration_request = RegistrationRequest(redirect_uris=[redirect_uri],
                                                response_types=["code"])
     context = Context()
     context.request = registration_request.to_dict()
     registration_response = self.instance._register_client(context)
     assert registration_response.status == "400 Bad Request"
     error_response = ClientRegistrationErrorResponse().deserialize(
             registration_response.message, "json")
     assert error_response["error"] == "invalid_request"
     assert "response_type" in error_response["error_description"]

    def _handle_satosa_authentication_error(self, error):
        """
        Sends a response to the requestor about the error

        :type error: satosa.exception.SATOSAAuthenticationError
        :rtype: satosa.response.Response

        :param error: The exception
        :return: response
        """
        context = Context()
        context.state = error.state
        frontend = self.module_router.frontend_routing(context)
        return frontend.handle_backend_error(error)

    def test_consent_prev_given(self, internal_response, internal_request,
                                consent_verify_endpoint_regex):
        consent_config = SATOSAConfig(self.satosa_config)
        consent_module = ConsentModule(consent_config, identity_callback)

        responses.add(responses.GET, consent_verify_endpoint_regex, status=200,
                      body=json.dumps(FILTER))

        context = Context()
        state = State()
        context.state = state
        consent_module.save_state(internal_request, state)
        context, internal_response = consent_module.manage_consent(context, internal_response)
        assert context
        assert "displayName" in internal_response.get_attributes()

 def test_generate_static(self):
     synthetic_attributes = {
        "": { "default": {"a0": "value1;value2" }}
     }
     authz_service = self.create_syn_service(synthetic_attributes)
     resp = InternalData(auth_info=AuthenticationInformation())
     resp.attributes = {
         "a1": ["[email protected]"],
     }
     ctx = Context()
     ctx.state = dict()
     authz_service.process(ctx, resp)
     assert("value1" in resp.attributes['a0'])
     assert("value2" in resp.attributes['a0'])
     assert("[email protected]" in resp.attributes['a1'])

    def setup_for_authn_response(self, auth_req):
        context = Context()
        context.state = self.create_state(auth_req)

        auth_info = AuthenticationInformation(PASSWORD, "2015-09-30T12:21:37Z", "unittest_idp.xml")
        internal_response = InternalResponse(auth_info=auth_info)
        internal_response.add_attributes(
                DataConverter(INTERNAL_ATTRIBUTES).to_internal("saml", USERS["testuser1"]))
        internal_response.set_user_id(USERS["testuser1"]["eduPersonTargetedID"][0])

        self.instance.provider.cdb = {
            "client1": {"response_types": ["id_token"],
                        "redirect_uris": [(auth_req["redirect_uri"], None)],
                        "client_salt": "salt"}}

        return context, internal_response