def _authn_statement(self, authn_class=None, authn_auth=None,
                      authn_decl=None, authn_decl_ref=None):
     """
     Construct the AuthnStatement
     :param authn_class: Authentication Context Class reference
     :param authn_auth: Authenticating Authority
     :param authn_decl: Authentication Context Declaration
     :param authn_decl_ref: Authentication Context Declaration reference
     :return: An AuthnContext instance
     """
     if authn_class:
         return factory(
             saml.AuthnStatement,
             authn_instant=instant(),
             session_index=sid(),
             authn_context=self._authn_context_class_ref(
                 authn_class, authn_auth))
     elif authn_decl:
         return factory(
             saml.AuthnStatement,
             authn_instant=instant(),
             session_index=sid(),
             authn_context=self._authn_context_decl(authn_decl, authn_auth))
     elif authn_decl_ref:
         return factory(
             saml.AuthnStatement,
             authn_instant=instant(),
             session_index=sid(),
             authn_context=self._authn_context_decl_ref(authn_decl_ref,
                                                        authn_auth))
     else:
         return factory(
             saml.AuthnStatement,
             authn_instant=instant(),
             session_index=sid())

def authn_statement(authn_class=None, authn_auth=None,
                    authn_decl=None, authn_decl_ref=None, authn_instant="",
                    subject_locality="", session_not_on_or_after=None):
    """
    Construct the AuthnStatement
    :param authn_class: Authentication Context Class reference
    :param authn_auth: Authenticating Authority
    :param authn_decl: Authentication Context Declaration
    :param authn_decl_ref: Authentication Context Declaration reference
    :param authn_instant: When the Authentication was performed.
        Assumed to be seconds since the Epoch.
    :param subject_locality: Specifies the DNS domain name and IP address
        for the system from which the assertion subject was apparently
        authenticated.
    :return: An AuthnContext instance
    """
    if authn_instant:
        _instant = instant(time_stamp=authn_instant)
    else:
        _instant = instant()

    if authn_class:
        res = factory(
            saml.AuthnStatement,
            authn_instant=_instant,
            session_index=sid(),
            session_not_on_or_after=session_not_on_or_after,
            authn_context=_authn_context_class_ref(
                authn_class, authn_auth))
    elif authn_decl:
        res = factory(
            saml.AuthnStatement,
            authn_instant=_instant,
            session_index=sid(),
            session_not_on_or_after=session_not_on_or_after,
            authn_context=_authn_context_decl(authn_decl, authn_auth))
    elif authn_decl_ref:
        res = factory(
            saml.AuthnStatement,
            authn_instant=_instant,
            session_index=sid(),
            session_not_on_or_after=session_not_on_or_after,
            authn_context=_authn_context_decl_ref(authn_decl_ref,
                                                  authn_auth))
    else:
        res = factory(
            saml.AuthnStatement,
            authn_instant=_instant,
            session_index=sid(),
            session_not_on_or_after=session_not_on_or_after)

    if subject_locality:
        res.subject_locality = saml.SubjectLocality(text=subject_locality)

    return res

    def make_logout_response(self, idp_entity_id, request_id, status_code, binding=BINDING_HTTP_REDIRECT):
        """ Constructs a LogoutResponse

        :param idp_entity_id: The entityid of the IdP that want to do the
            logout
        :param request_id: The Id of the request we are replying to
        :param status_code: The status code of the response
        :param binding: The type of binding that will be used for the response
        :return: A LogoutResponse instance
        """

        destination = self.config.single_logout_services(idp_entity_id, binding)[0]

        status = samlp.Status(status_code=samlp.StatusCode(value=status_code))

        response = samlp.LogoutResponse(
            id=sid(),
            version=VERSION,
            issue_instant=instant(),
            destination=destination,
            issuer=self.issuer(),
            in_response_to=request_id,
            status=status,
        )

        return response, destination

    def construct_logout_request(self, subject_id, destination, issuer_entity_id, reason=None, expire=None):
        """ Constructs a LogoutRequest
        
        :param subject_id: The identifier of the subject
        :param destination:
        :param issuer_entity_id: The entity ID of the IdP the request is
            target at.
        :param reason: An indication of the reason for the logout, in the
            form of a URI reference.
        :param expire: The time at which the request expires,
            after which the recipient may discard the message.
        :return: A LogoutRequest instance
        """

        session_id = sid()
        # create NameID from subject_id
        name_id = saml.NameID(text=self.users.get_entityid(subject_id, issuer_entity_id, False))

        request = samlp.LogoutRequest(
            id=session_id,
            version=VERSION,
            issue_instant=instant(),
            destination=destination,
            issuer=self.issuer(),
            name_id=name_id,
        )

        if reason:
            request.reason = reason

        if expire:
            request.not_on_or_after = expire

        return request

    def _status_response(self, response_class, issuer, status, sign=False,
                         **kwargs):
        """ Create a StatusResponse.

        :param response_class: Which subclass of StatusResponse that should be
            used
        :param issuer: The issuer of the response message
        :param status: The return status of the response operation
        :param sign: Whether the response should be signed or not
        :param kwargs: Extra arguments to the response class
        :return: Class instance or string representation of the instance
        """

        mid = sid()

        for key in ["destination", "binding"]:
            try:
                del kwargs[key]
            except KeyError:
                pass

        if not status:
            status = success_status_factory()

        response = response_class(issuer=issuer, id=mid, version=VERSION,
                                  issue_instant=instant(),
                                  status=status, **kwargs)

        if sign:
            return self.sign(response, mid)
        else:
            return response

    def authz_decision_query(self, entityid, action,
                                evidence=None, resource=None, subject=None,
                                binding=saml2.BINDING_HTTP_REDIRECT, sign=None):
        """ Creates an authz decision query.

        :param entityid: The entity ID of the IdP to send the request to
        :param action: The action you want to perform (has to be at least one)
        :param evidence: Why you should be able to perform the action
        :param resource: The resource you want to perform the action on
        :param subject: Who wants to do the thing
        :param binding: Which binding to use for sending the request
        :param sign: Whether the request should be signed or not.
        :return: AuthzDecisionQuery instance
        """

        spentityid = self._issuer()
        service_url = self.service_url()
        my_name = self._my_name()

        logger.info("spentityid: %s\nservice_url: %s\nmy_name: %s" % (
                            spentityid, service_url, my_name))

#        authen_req = self.authn_request(session_id, location,
#                                service_url, spentityid, my_name, vorg,
#                                scoping, sign)
        
        request = samlp.AuthzDecisionQuery(action, evidence, resource,
                                           subject=subject,
                                           issuer=spentityid,
                                           id=sid(),
                                           issue_instant=instant(),
                                           version=VERSION,
                                           destination=entityid)

        return request

 def _expiration(self, timeout, tformat="%a, %d-%b-%Y %H:%M:%S GMT"):
     if timeout == "now":
         return time_util.instant(tformat)
     elif timeout == "dawn":
         return time.strftime(tformat, time.gmtime(0))
     else:
         # validity time should match lifetime of assertions
         return time_util.in_a_while(minutes=timeout, format=tformat)

def test_valid():
    assert valid("2000-01-12T00:00:00Z") == False
    current_year = datetime.datetime.today().year
    assert valid("%d-01-12T00:00:00Z" % (current_year + 1)) == True
    this_instance = instant()
    time.sleep(1)
    assert valid(this_instance) == False  # unless on a very fast machine :-)
    soon = in_a_while(seconds=10)
    assert valid(soon) == True

def _expiration(timeout, tformat=None):
    # Wed, 06-Jun-2012 01:34:34 GMT
    if not tformat:
        tformat = '%a, %d-%b-%Y %T GMT'

    if timeout == "now":
        return time_util.instant(tformat)
    else:
        # validity time should match lifetime of assertions
        return time_util.in_a_while(minutes=timeout, format=tformat)

 def create_attribute_query(self, session_id, subject_id, destination,
         issuer_id=None, attribute=None, sp_name_qualifier=None,
         name_qualifier=None, nameid_format=None, sign=False):
     """ Constructs an AttributeQuery
     
     :param session_id: The identifier of the session
     :param subject_id: The identifier of the subject
     :param destination: To whom the query should be sent
     :param issuer_id: Identifier of the issuer
     :param attribute: A dictionary of attributes and values that is
         asked for. The key are one of 4 variants:
         3-tuple of name_format,name and friendly_name,
         2-tuple of name_format and name,
         1-tuple with name or
         just the name as a string.
     :param sp_name_qualifier: The unique identifier of the
         service provider or affiliation of providers for whom the
         identifier was generated.
     :param name_qualifier: The unique identifier of the identity
         provider that generated the identifier.
     :param nameid_format: The format of the name ID
     :param sign: Whether the query should be signed or not.
     :return: An AttributeQuery instance
     """
 
     
     subject = saml.Subject(
                 name_id = saml.NameID(
                             text=subject_id, 
                             format=nameid_format,
                             sp_name_qualifier=sp_name_qualifier,
                             name_qualifier=name_qualifier),
                 )
                 
     query = samlp.AttributeQuery(
         id=session_id,
         version=VERSION,
         issue_instant=instant(),
         destination=destination,
         issuer=self._issuer(issuer_id),
         subject=subject,
     )
     
     if sign:
         query.signature = pre_signature_part(query.id, self.sec.my_cert, 1)
     
     if attribute:
         query.attribute = do_attributes(attribute)
     
     if sign:
         signed_query = self.sec.sign_attribute_query_using_xmlsec(
                                                             "%s" % query)
         return samlp.attribute_query_from_string(signed_query)
     else:
         return query

def response_factory(sign=False, encrypt=False, **kwargs):
    response = samlp.Response(id=sid(), version=VERSION,
                              issue_instant=instant())

    if sign:
        response.signature = pre_signature_part(kwargs["id"])
    if encrypt:
        pass

    for key, val in kwargs.items():
        setattr(response, key, val)

    return response

 def conditions(self, sp_entity_id):
     """ Return a saml.Condition instance
     
     :param sp_entity_id: The SP entity ID
     :return: A saml.Condition instance
     """
     return factory( saml.Conditions,
                     not_before=instant(),
                     # How long might depend on who's getting it
                     not_on_or_after=self.not_on_or_after(sp_entity_id),
                     audience_restriction=[factory( saml.AudienceRestriction,
                             audience=factory(saml.Audience, 
                                             text=sp_entity_id))])

def _expiration(timeout, tformat="%a, %d-%b-%Y %H:%M:%S GMT"):
    """

    :param timeout:
    :param tformat:
    :return:
    """
    if timeout == "now":
        return instant(tformat)
    elif timeout == "dawn":
        return strftime(tformat, gmtime(0))
    else:
        # validity time should match lifetime of assertions
        return in_a_while(minutes=timeout, format=tformat)

    def create_logout_response(self, request, binding, status=None,
                               sign=False, issuer=None):
        """ Create a LogoutResponse. What is returned depends on which binding
        is used.
        
        :param request: The request this is a response to
        :param binding: Which binding the request came in over
        :param status: The return status of the response operation
        :param issuer: The issuer of the message
        :return: A logout message.
        """
        mid = sid()

        if not status:
            status = success_status_factory()

        # response and packaging differs depending on binding
        response = ""
        if binding in [BINDING_SOAP, BINDING_HTTP_POST]:
            response = logoutresponse_factory(sign=sign, id = mid,
                                              in_response_to = request.id,
                                              status = status)
        elif binding == BINDING_HTTP_REDIRECT:
            sp_entity_id = request.issuer.text.strip()
            srvs = self.metadata.single_logout_service(sp_entity_id, "spsso")
            if not srvs:
                raise Exception("Nowhere to send the response")

            destination = destinations(srvs)[0]

            _issuer = self.issuer(issuer)
            response = logoutresponse_factory(sign=sign, id = mid,
                                              in_response_to = request.id,
                                              status = status,
                                              issuer = _issuer,
                                              destination = destination,
                                              sp_entity_id = sp_entity_id,
                                              instant=instant())
        if sign:
            to_sign = [(class_name(response), mid)]
            response = signed_instance_factory(response, self.sec, to_sign)

        logger.info("Response: %s" % (response,))

        return response

    def _message(self, request_cls, destination=None, id=0,
                 consent=None, extensions=None, sign=False, **kwargs):
        """
        Some parameters appear in all requests so simplify by doing
        it in one place

        :param request_cls: The specific request type
        :param destination: The recipient
        :param id: A message identifier
        :param consent: Whether the principal have given her consent
        :param extensions: Possible extensions
        :param kwargs: Key word arguments specific to one request type
        :return: An instance of the request_cls
        """
        if not id:
            id = sid(self.seed)

        req = request_cls(id=id, version=VERSION, issue_instant=instant(),
                          issuer=self._issuer(), **kwargs)

        if destination:
            req.destination = destination

        if consent:
            req.consent = consent

        if extensions:
            req.extensions = extensions

        if sign:
            req.signature = pre_signature_part(req.id, self.sec.my_cert, 1)
            to_sign = [(class_name(req), req.id)]
        else:
            to_sign = []

        logger.info("REQUEST: %s" % req)

        return signed_instance_factory(req, self.sec, to_sign)

    def make_logout_response(self, idp_entity_id, request_id,
                             status_code, binding=BINDING_HTTP_REDIRECT):
        """ 
        XXX There were issues with an explicit closing tag on 
        StatusCode. Check wether we still need this. XXX
        Constructs a LogoutResponse

        :param idp_entity_id: The entityid of the IdP that want to do the
            logout
        :param request_id: The Id of the request we are replying to
        :param status_code: The status code of the response
        :param binding: The type of binding that will be used for the response
        :return: A LogoutResponse instance
        """
        srvs = self.metadata.single_logout_service(idp_entity_id, binding, "idpsso")

        destination = destinations(srvs)[0]
        logger.info("destination to provider: %s" % destination)

        status = samlp.Status(
            status_code=samlp.StatusCode(value=status_code, text='\n'),
            status_message=samlp.StatusMessage(text='logout success')
            )

        response = samlp.LogoutResponse(
            id=sid(),
            version=VERSION,
            issue_instant=instant(),
            destination=destination,
            issuer=saml.Issuer(text=self.config.entityid,
                                format=saml.NAMEID_FORMAT_ENTITY),
            in_response_to=request_id,
            status=status,
            )

        return response, destination

def assertion_factory(**kwargs):
    assertion = saml.Assertion(version=VERSION, id=sid(),
                               issue_instant=instant())
    for key, val in kwargs.items():
        setattr(assertion, key, val)
    return assertion

def _expiration(timeout, time_format=None):
    if timeout == "now":
        return time_util.instant(time_format)
    else:
        # validity time should match lifetime of assertions
        return time_util.in_a_while(minutes=timeout, format=time_format)

    def logout_response(self, request, bindings, status=None, sign=False, issuer=None):
        """ Create a LogoutResponse. What is returned depends on which binding
        is used.
        
        :param request: The request this is a response to
        :param bindings: Which bindings that can be used to send the response
        :param status: The return status of the response operation
        :param issuer: The issuer of the message
        :return: A 3-tuple consisting of HTTP return code, HTTP headers and 
            possibly a message.
        """
        sp_entity_id = request.issuer.text.strip()

        binding = None
        destinations = []
        for binding in bindings:
            destinations = self.conf.single_logout_services(sp_entity_id, binding)
            if destinations:
                break

        if not destinations:
            if self.log:
                self.log.error("Not way to return a response !!!")
            return ("412 Precondition Failed", [("Content-type", "text/html")], ["No return way defined"])

        # Pick the first
        destination = destinations[0]

        if self.log:
            self.log.info("Logout Destination: %s, binding: %s" % (destination, binding))
        if not status:
            status = success_status_factory()

        mid = sid()
        rcode = "200 OK"

        # response and packaging differs depending on binding

        if binding == BINDING_SOAP:
            response = logoutresponse_factory(sign=sign, id=mid, in_response_to=request.id, status=status)
            if sign:
                to_sign = [(class_name(response), mid)]
                response = signed_instance_factory(response, self.sec, to_sign)

            (headers, message) = http_soap_message(response)
        else:
            _issuer = self.issuer(issuer)
            response = logoutresponse_factory(
                sign=sign,
                id=mid,
                in_response_to=request.id,
                status=status,
                issuer=_issuer,
                destination=destination,
                sp_entity_id=sp_entity_id,
                instant=instant(),
            )
            if sign:
                to_sign = [(class_name(response), mid)]
                response = signed_instance_factory(response, self.sec, to_sign)

            if self.log:
                self.log.info("Response: %s" % (response,))
            if binding == BINDING_HTTP_REDIRECT:
                (headers, message) = http_redirect_message(response, destination, typ="SAMLResponse")
                rcode = "302 Found"
            else:
                (headers, message) = http_post_message(response, destination, typ="SAMLResponse")

        return rcode, headers, message

 def _init_request(self, request, destination):
     # request.id = sid()
     request.version = VERSION
     request.issue_instant = instant()
     request.destination = destination
     return request