def redirect_to_auth(self, _cli, entity_id, came_from):
     try:
         # Picks a binding to use for sending the Request to the IDP
         _binding, destination = _cli.pick_binding(
             "single_sign_on_service", self.bindings, "idpsso",
             entity_id=entity_id)
         logger.debug("binding: %s, destination: %s" % (_binding,
                                                        destination))
         # Binding here is the response binding that is which binding the
         # IDP should use to return the response.
         acs = _cli.config.getattr("endpoints", "sp")[
             "assertion_consumer_service"]
         # just pick one
         endp, return_binding = acs[0]
         req_id, req = _cli.create_authn_request(destination,
                                                 binding=return_binding)
         _rstate = rndstr()
         self.cache.relay_state[_rstate] = came_from
         ht_args = _cli.apply_binding(_binding, "%s" % req, destination,
                                      relay_state=_rstate)
         _sid = req_id
     except Exception, exc:
         logger.exception(exc)
         resp = ServiceError(
             "Failed to construct the AuthnRequest: %s" % exc)
         return resp

    def _redirect_to_auth(self, _cli, entity_id, query, vorg_name=""):
        try:
            binding, destination = _cli.pick_binding(
                "single_sign_on_service", self.bindings, "idpsso",
                entity_id=entity_id)
            logger.debug("binding: %s, destination: %s" % (binding, destination))

            extensions = None

            if _cli.authn_requests_signed:
                _sid = saml2.s_utils.sid(_cli.seed)
                req_id, msg_str = _cli.create_authn_request(destination, vorg=vorg_name,
                                                            sign=_cli.authn_requests_signed,
                                                            message_id=_sid, extensions=extensions)
                _sid = req_id
            else:
                req_id, req = _cli.create_authn_request(destination, vorg=vorg_name, sign=False)
                msg_str = "%s" % req
                _sid = req_id

            _rstate = rndstr()
            #self.cache.relay_state[_rstate] = came_from
            ht_args = _cli.apply_binding(binding, msg_str, destination,
                                         relay_state=_rstate)

            logger.debug("ht_args: %s" % ht_args)
        except Exception, exc:
            logger.exception(exc)
            raise ServiceErrorException(
                "Failed to construct the AuthnRequest: %s" % exc)

def do_verify(environ, start_response, _, session):
    query = parse_qs(get_post(environ))

    logger.debug("do_verify: %s" % query)

    try:
        _ok, user = verify_username_and_password(query)
    except KeyError:
        _ok = False
        user = None

    if not _ok:
        resp = Unauthorized("Unknown user or wrong password")
    else:
        uid = rndstr(24)
        IDP.cache.uid2user[uid] = user
        IDP.cache.user2uid[user] = uid
        logger.debug("Register %s under '%s'" % (user, uid))

        cval = {"uid": user, "authn_ref": query["authn_reference"][0]}
        headers = [CookieHandler.create_cookie("%s" % (cval,), "sso",
                                               COOKIE_NAME)]

        lox = "%s?id=%s&key=%s" % (query["redirect_uri"][0], uid,
                                   query["key"][0])
        logger.debug("Redirect => %s" % lox)
        resp = Redirect(lox, content="text/html", headers=headers)

    return resp(environ, start_response)

    def _redirect_to_auth(self, _cli, entity_id, came_from, vorg_name=""):
        try:
            _binding, destination = _cli.pick_binding(
                "single_sign_on_service", self.bindings, "idpsso",
                entity_id=entity_id)
            self.logger.debug("binding: %s, destination: %s" % (_binding,
                                                                destination))
            if _cli.authn_requests_signed:
                req_id, req = _cli.create_authn_request(destination, vorg=vorg_name,
                                                            sign=_cli.authn_requests_signed)
            else:
                req_id, req = _cli.create_authn_request(destination, vorg=vorg_name, sign=False)
                msg_str = "%s" % req

            _rstate = rndstr()
            self.cache.relay_state[_rstate] = came_from
            ht_args = _cli.apply_binding(_binding, "%s" % req, destination,
                                         relay_state=_rstate)
            _sid = req_id
            self.logger.debug("ht_args: %s" % ht_args)
        except Exception, exc:
            self.logger.exception(exc)
            resp = ServiceError(
                "Failed to construct the AuthnRequest: %s" % exc)
            return resp(self.environ, self.start_response)

    def _redirect_to_auth(self, _cli, entity_id, came_from, vorg_name="", cert_str=None, cert_key_str=None):
        try:
            _binding, destination = _cli.pick_binding(
                "single_sign_on_service", self.bindings, "idpsso",
                entity_id=entity_id)
            self.logger.debug("binding: %s, destination: %s" % (_binding,
                                                                destination))

            extensions = None
            if cert_key_str is not None:
                spcertenc = SPCertEnc(x509_data=ds.X509Data(x509_certificate=ds.X509Certificate(text=cert_key_str)))
                extensions = Extensions(extension_elements=[element_to_extension_element(spcertenc)])

            if _cli.authn_requests_signed:
                _sid = saml2.s_utils.sid(_cli.seed)
                req_id, msg_str = _cli.create_authn_request(destination, vorg=vorg_name, sign=_cli.authn_requests_signed,
                                                    message_id=_sid, client_crt=cert_str, extensions=extensions)
                _sid = req_id
            else:
                req_id, req = _cli.create_authn_request(destination, vorg=vorg_name, sign=False)
                msg_str = "%s" % req
                _sid = req_id

            _rstate = rndstr()
            self.cache.relay_state[_rstate] = came_from
            ht_args = _cli.apply_binding(_binding, msg_str, destination,
                                         relay_state=_rstate)

            self.logger.debug("ht_args: %s" % ht_args)
        except Exception, exc:
            self.logger.exception(exc)
            raise ServiceErrorException(
                "Failed to construct the AuthnRequest: %s" % exc)

    def _redirect_to_auth(self, _cli, entity_id, came_from, vorg_name="",
                          dont_send=False):
        try:
            _binding, destination = _cli.pick_binding(
                "single_sign_on_service", self.bindings, "idpsso",
                entity_id=entity_id)
            logger.debug("binding: %s, destination: %s" % (_binding,
                                                           destination))
            if "accr" in self.kwargs:
                kwargs = {
                    "requested_authn_context": RequestedAuthnContext(
                        authn_context_class_ref=AuthnContextClassRef(
                            text=self.kwargs["accr"]
                        )
                    )
                }
            else:
                kwargs = {}

            req = _cli.create_authn_request(destination, vorg=vorg_name,
                                            **kwargs)

            _rstate = rndstr()
            self.cache.relay_state[_rstate] = came_from
            ht_args = _cli.apply_binding(_binding, "%s" % req, destination,
                                         relay_state=_rstate)
            _sid = req.id
            SESSIONDB[_sid] = self.kwargs
            logger.debug("ht_args: %s" % ht_args)
        except Exception, exc:
            logger.exception(exc)
            resp = ServiceError(
                "Failed to construct the AuthnRequest: %s" % exc)
            return resp(self.environ, self.start_response)

def do_verify(environ, start_response, _):
    query = parse_qs(get_post(environ))

    logger.debug("do_verify: %s" % query)

    try:
        _ok, user = verify_username_and_password(query)
    except KeyError:
        _ok = False
        user = None

    if not _ok:
        resp = Unauthorized("Unknown user or wrong password")
    else:
        uid = rndstr(24)
        IDP.cache.uid2user[uid] = user
        IDP.cache.user2uid[user] = uid
        logger.debug("Register %s under '%s'" % (user, uid))

        kaka = set_cookie("idpauthn", "/", uid, query["authn_reference"][0])

        lox = "%s?id=%s&key=%s" % (query["redirect_uri"][0], uid,
                                   query["key"][0])
        logger.debug("Redirect => %s" % lox)
        resp = Redirect(lox, headers=[kaka], content="text/html")

    return resp(environ, start_response)

 def _create_id(self, nformat, name_qualifier="", sp_name_qualifier=""):
     _id = sha256(rndstr(32))
     _id.update(nformat)
     if name_qualifier:
         _id.update(name_qualifier)
     if sp_name_qualifier:
         _id.update(sp_name_qualifier)
     return _id.hexdigest()

 def user2kaka(self, user):
     uid = rndstr(32)
     self.uid2user[uid] = user
     cookie = SimpleCookie()
     cookie[self.cookie_name] = uid
     cookie[self.cookie_name]['path'] = "/"
     cookie[self.cookie_name]["expires"] = _expiration(480)
     logger.debug("Cookie expires: %s" % cookie[self.cookie_name]["expires"])
     return tuple(cookie.output().split(": ", 1))

    def __init__(self, config=None, identity_cache=None, state_cache=None,
                 virtual_organization="",config_file=""):
        """
        :param config: A saml2.config.Config instance
        :param identity_cache: Where the class should store identity information
        :param state_cache: Where the class should keep state information
        :param virtual_organization: A specific virtual organization
        """

        self.users = Population(identity_cache)

        # for server state storage
        if state_cache is None:
            self.state = {} # in memory storage
        else:
            self.state = state_cache

        if config:
            self.config = config
        elif config_file:
            self.config = config_factory("sp", config_file)
        else:
            raise Exception("Missing configuration")

        if self.config.vorg:
            for vo in self.config.vorg.values():
                vo.sp = self

        self.metadata = self.config.metadata
        self.config.setup_logger()

        # we copy the config.debug variable in an internal
        # field for convenience and because we may need to
        # change it during the tests
        self.debug = self.config.debug

        self.sec = security_context(self.config)

        if virtual_organization:
            if isinstance(virtual_organization, basestring):
                self.vorg = self.config.vorg[virtual_organization]
            elif isinstance(virtual_organization, VirtualOrg):
                self.vorg = virtual_organization
        else:
            self.vorg = {}

        for foo in ["allow_unsolicited", "authn_requests_signed",
                   "logout_requests_signed"]:
            if self.config.getattr("sp", foo) == 'true':
                setattr(self, foo, True)
            else:
                setattr(self, foo, False)

        # extra randomness
        self.seed = rndstr(32)
        self.logout_requests_signed_default = True
        self.allow_unsolicited = self.config.getattr("allow_unsolicited", "sp")

 def set_cookie(self, user):
     uid = rndstr(32)
     self.uid2user[uid] = user
     cookie = SimpleCookie()
     cookie[self.cookie_name] = uid
     cookie[self.cookie_name]['path'] = "/"
     cookie[self.cookie_name]["expires"] = _expiration(480)
     logger.debug("Cookie expires: %s", cookie[self.cookie_name]["expires"])
     return cookie.output().encode("UTF-8").split(": ", 1)

    def redirect_to_auth(self, _cli, entity_id, came_from, sigalg=None):
        try:
            # Picks a binding to use for sending the Request to the IDP
            _binding, destination = _cli.pick_binding(
                    "single_sign_on_service", self.bindings, "idpsso",
                    entity_id=entity_id)
            logger.debug("binding: %s, destination: %s", _binding,
                         destination)
            # Binding here is the response binding that is which binding the
            # IDP should use to return the response.
            acs = _cli.config.getattr("endpoints", "sp")[
                "assertion_consumer_service"]
            # just pick one
            endp, return_binding = acs[0]
            logger.debug("Binding response to: {}, {}".format(return_binding, endp))

            extensions = None
            cert = None
            logger.debug("cli config: {}".format(dir(_cli.config)))
            if _cli.config.generate_cert_func is not None:
                cert_str, req_key_str = _cli.config.generate_cert_func()
                cert = {
                    "cert": cert_str,
                    "key": req_key_str
                }
                spcertenc = SPCertEnc(x509_data=ds.X509Data(
                        x509_certificate=ds.X509Certificate(text=cert_str)))
                extensions = Extensions(extension_elements=[
                    element_to_extension_element(spcertenc)])

            req_id, req = _cli.create_authn_request(destination,
                                                    binding=return_binding,
                                                    extensions=extensions,
                                                    nameid_format=NAMEID_FORMAT_PERSISTENT)
            _rstate = rndstr()
            self.cache.relay_state[_rstate] = came_from
            apply_binding_kwargs = dict(relay_state=_rstate)
            if sigalg:
                apply_binding_kwargs['sigalg'] = sigalg
            ht_args = _cli.apply_binding(_binding,
                                         "%s" % req, destination,
                                         **apply_binding_kwargs)
            _sid = req_id

            if cert is not None:
                self.cache.outstanding_certs[_sid] = cert

        except Exception as exc:
            logger.exception(exc)
            resp = ServiceError(
                    "Failed to construct the AuthnRequest: %s" % exc)
            return resp

        # remember the request
        self.cache.outstanding_queries[_sid] = came_from
        return self.response(_binding, ht_args, do_not_start_response=True)

 def setup_idp(self, user, reference, redirect_uri, key):
     uid = rndstr(24)
     self.idphandler.idp_server.cache.uid2user[uid] = user
     self.idphandler.idp_server.cache.user2uid[user] = uid
     logger.debug("Register %s under '%s'" % (user, uid))
     cookie = self.idphandler.set_authorization_cookie(uid, reference)
     lox = "%s?id=%s&key=%s" % (redirect_uri, uid,
                                key)
     logger.debug("Redirect => %s" % lox)
     resp = Redirect(lox, headers=[cookie], content="text/html")
     return resp

    def __init__(self, entity_type, config=None, config_file="",
                 virtual_organization=""):
        self.entity_type = entity_type
        self.users = None

        if config:
            self.config = config
        elif config_file:
            self.config = config_factory(entity_type, config_file)
        else:
            raise SAMLError("Missing configuration")

        for item in ["cert_file", "key_file", "ca_certs"]:
            _val = getattr(self.config, item, None)
            if not _val:
                continue

            if _val.startswith("http"):
                r = requests.request("GET", _val)
                if r.status_code == 200:
                    _, filename = make_temp(r.text, ".pem", False)
                    setattr(self.config, item, filename)
                else:
                    raise Exception(
                        "Could not fetch certificate from %s" % _val)

        HTTPBase.__init__(self, self.config.verify_ssl_cert,
                          self.config.ca_certs, self.config.key_file,
                          self.config.cert_file)

        if self.config.vorg:
            for vo in self.config.vorg.values():
                vo.sp = self

        self.metadata = self.config.metadata
        self.config.setup_logger()
        self.debug = self.config.debug
        self.seed = rndstr(32)

        self.sec = security_context(self.config)

        if virtual_organization:
            if isinstance(virtual_organization, basestring):
                self.vorg = self.config.vorg[virtual_organization]
            elif isinstance(virtual_organization, VirtualOrg):
                self.vorg = virtual_organization
        else:
            self.vorg = None

        self.artifact = {}
        if self.metadata:
            self.sourceid = self.metadata.construct_source_id()
        else:
            self.sourceid = {}

 def __init__(self, config_file="", config=None, cache=None, stype="idp",
              symkey=""):
     Entity.__init__(self, stype, config, config_file)
     self.init_config(stype)
     self.cache = cache
     self.ticket = {}
     #
     self.session_db = self.choose_session_storage()
     # Needed for
     self.symkey = symkey
     self.seed = rndstr()
     self.iv = os.urandom(16)
     self.eptid = None

    def use_artifact(self, message, endpoint_index=0):
        """

        :param message:
        :param endpoint_index:
        :return:
        """
        message_handle = sha1("%s" % message)
        message_handle.update(rndstr())
        mhd = message_handle.digest()
        saml_art = create_artifact(self.config.entityid, mhd, endpoint_index)
        self.artifact[saml_art] = message
        return saml_art

    def do(self):
        _cli = self.sp

        # Which page was accessed to get here
        came_from = geturl(self.environ)
        logger.debug("[sp.challenge] RelayState >> '%s'" % came_from)

        # Am I part of a virtual organization or more than one ?
        try:
            vorg_name = _cli.vorg._name
        except AttributeError:
            vorg_name = ""

        logger.info("[sp.challenge] VO: %s" % vorg_name)

        # If more than one idp and if none is selected, I have to do wayf
        (done, response) = self._pick_idp(came_from)
        # Three cases: -1 something went wrong or Discovery service used
        #               0 I've got an IdP to send a request to
        #               >0 ECP in progress
        logger.debug("_idp_pick returned: %s" % done)
        if done == -1:
            return response
        elif done > 0:
            self.cache.outstanding_queries[done] = came_from
            return ECP_response(response)
        else:
            entity_id = response
            # Do the AuthnRequest
            try:
                _binding, destination = _cli.pick_binding(
                    "single_sign_on_service", self.bindings, "idpsso",
                    entity_id=entity_id)
                logger.debug("binding: %s, destination: %s" % (_binding,
                                                               destination))
                req = _cli.create_authn_request(destination, vorg=vorg_name)
                _rstate = rndstr()
                self.cache.relay_state[_rstate] = came_from
                ht_args = _cli.apply_binding(_binding, "%s" % req, destination,
                                             relay_state=_rstate)
                _sid = req.id
                logger.debug("ht_args: %s" % ht_args)
            except Exception, exc:
                logger.exception(exc)
                resp = ServiceError(
                    "Failed to construct the AuthnRequest: %s" % exc)
                return resp(self.environ, self.start_response)

            # remember the request
            self.cache.outstanding_queries[_sid] = came_from
            return self.response(_binding, ht_args)

    def create_authn_request(self):
        try:
            #sid_ = sid()
            #self.outstanding_queries[sid_] = came_from
            idps = self.sp.metadata.with_descriptor("idpsso")
            if len(idps) == 1:
                self.entity_id = idps.keys()[0]
            elif len(idps) > 1:
                raise Exception("TestSp only supports 1 idp in the metadata!")
            else:
                Exception("No IdP metadata found!")

            _binding, destination = self.sp.pick_binding("single_sign_on_service", self.bindings, "idpsso",
                                                         entity_id=self.entity_id)

            self.cert_str, self.cert_key_str = self.generate_cert()
            cert = {
                        "cert": self.cert_str,
                        "key": self.cert_key_str
                    }
            spcertenc = SPCertEnc(
                x509_data=xmldsig.X509Data(x509_certificate=xmldsig.X509Certificate(text=self.cert_str)))
            extensions = Extensions(extension_elements=[element_to_extension_element(spcertenc)])

            try:
                vorg_name = self.sp.vorg._name
            except AttributeError:
                vorg_name = ""

            if self.sp.authn_requests_signed:
                self.sid = s_utils.sid()
                req_id, self.msg_str = self.sp.create_authn_request(destination, vorg=vorg_name,
                                                                    sign=self.sp.authn_requests_signed,
                                                                    message_id=self.sid,
                                                                    extensions=extensions)
                self.sid = req_id
            else:
                req_id, req = self.sp.create_authn_request(destination, vorg=vorg_name, sign=False)
                self.msg_str = "%s" % req
                self.sid = req_id

            if cert is not None:
                self.outstanding_certs[self.sid] = cert

            self.rstate = rndstr()
            self.ht_args = self.sp.apply_binding(_binding, self.msg_str, destination, relay_state=self.rstate)
            url = self.ht_args["headers"][0][1]

        except Exception, exc:
            raise Exception("Failed to construct the AuthnRequest: %s" % exc)

    def redirect_to_auth(self, _cli, entity_id, came_from):
        try:
            # Picks a binding to use for sending the Request to the IDP
            _binding, destination = _cli.pick_binding(
                "single_sign_on_service", self.bindings, "idpsso",
                entity_id=entity_id)
            logger.debug("binding: %s, destination: %s" % (_binding,
                                                           destination))
            # Binding here is the response binding that is which binding the
            # IDP should use to return the response.
            acs = _cli.config.getattr("endpoints", "sp")[
                "assertion_consumer_service"]
            # just pick one
            endp, return_binding = acs[0]

            extensions = None
            cert = None
            if _cli.config.generate_cert_func is not None:
                    cert_str, req_key_str = _cli.config.generate_cert_func()
                    cert = {
                        "cert": cert_str,
                        "key": req_key_str
                    }
                    spcertenc = SPCertEnc(x509_data=ds.X509Data(
                        x509_certificate=ds.X509Certificate(text=cert_str)))
                    extensions = Extensions(extension_elements=[
                        element_to_extension_element(spcertenc)])

            req_id, req = _cli.create_authn_request(destination,
                                                    binding=return_binding, extensions=extensions)
            _rstate = rndstr()
            self.cache.relay_state[_rstate] = came_from
            ht_args = _cli.apply_binding(_binding, "%s" % req, destination,
                                         relay_state=_rstate)
            _sid = req_id

            if cert is not None:
                self.cache.outstanding_certs[_sid] = cert

        except Exception, exc:
            logger.exception(exc)
            resp = ServiceError(
                "Failed to construct the AuthnRequest: %s" % exc)
            return resp

 def _redirect_to_auth(self, _cli, entity_id, came_from, vorg_name=""):
     try:
         _binding, destination = _cli.pick_binding(
             "single_sign_on_service", self.bindings, "idpsso",
             entity_id=entity_id)
         logger.debug("binding: %s, destination: %s" % (_binding,
                                                        destination))
         id, req = _cli.create_authn_request(destination, vorg=vorg_name)
         _rstate = rndstr()
         self.cache.relay_state[_rstate] = came_from
         ht_args = _cli.apply_binding(_binding, "%s" % (req,), destination,
                                      relay_state=_rstate)
         _sid = req.id
         logger.debug("ht_args: %s" % ht_args)
     except Exception, exc:
         logger.exception(exc)
         resp = ServiceError(
             "Failed to construct the AuthnRequest: %s" % exc)
         return resp