def test_authn_context():
    accr = utils.factory(
        saml.AuthnContext,
        text="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified")
    a = utils.factory(saml.AuthnContext, authn_context_class_ref=accr)

    assert a.keyswv() == ["authn_context_class_ref"]

    def test_assertion(self):
        assertion = s_utils.assertion_factory(
            subject=factory(
                saml.Subject, text="_aaa", name_id=factory(saml.NameID, format=saml.NAMEID_FORMAT_TRANSIENT)
            ),
            attribute_statement=do_attribute_statement(
                {("", "", "surName"): ("Jeter", ""), ("", "", "givenName"): ("Derek", "")}
            ),
            issuer=self.server._issuer(),
        )

        assert _eq(assertion.keyswv(), ["attribute_statement", "issuer", "id", "subject", "issue_instant", "version"])
        assert assertion.version == "2.0"
        assert assertion.issuer.text == "urn:mace:example.com:saml:roland:idp"
        #
        assert assertion.attribute_statement
        attribute_statement = assertion.attribute_statement
        assert len(attribute_statement.attribute) == 2
        attr0 = attribute_statement.attribute[0]
        attr1 = attribute_statement.attribute[1]
        if attr0.attribute_value[0].text == "Derek":
            assert attr0.friendly_name == "givenName"
            assert attr1.friendly_name == "surName"
            assert attr1.attribute_value[0].text == "Jeter"
        else:
            assert attr1.friendly_name == "givenName"
            assert attr1.attribute_value[0].text == "Derek"
            assert attr0.friendly_name == "surName"
            assert attr0.attribute_value[0].text == "Jeter"
        #
        subject = assertion.subject
        assert _eq(subject.keyswv(), ["text", "name_id"])
        assert subject.text == "_aaa"
        assert subject.name_id.format == saml.NAMEID_FORMAT_TRANSIENT

 def _authn_statement(self, authn_class=None, authn_auth=None,
                      authn_decl=None, authn_decl_ref=None):
     """
     Construct the AuthnStatement
     :param authn_class: Authentication Context Class reference
     :param authn_auth: Authenticating Authority
     :param authn_decl: Authentication Context Declaration
     :param authn_decl_ref: Authentication Context Declaration reference
     :return: An AuthnContext instance
     """
     if authn_class:
         return factory(
             saml.AuthnStatement,
             authn_instant=instant(),
             session_index=sid(),
             authn_context=self._authn_context_class_ref(
                 authn_class, authn_auth))
     elif authn_decl:
         return factory(
             saml.AuthnStatement,
             authn_instant=instant(),
             session_index=sid(),
             authn_context=self._authn_context_decl(authn_decl, authn_auth))
     elif authn_decl_ref:
         return factory(
             saml.AuthnStatement,
             authn_instant=instant(),
             session_index=sid(),
             authn_context=self._authn_context_decl_ref(authn_decl_ref,
                                                        authn_auth))
     else:
         return factory(
             saml.AuthnStatement,
             authn_instant=instant(),
             session_index=sid())

def test_audience():
    aud_restr = utils.factory(saml.AudienceRestriction,
                              audience=utils.factory(saml.Audience,
                                                     text="urn:foo:bar"))

    assert aud_restr.keyswv() == ["audience"]
    assert aud_restr.audience.text == "urn:foo:bar"

    def test_sign_response_2(self):
        assertion2 = factory( saml.Assertion,
            version= "2.0",
            id= "11122",
            issue_instant= "2009-10-30T13:20:28Z",
            signature= sigver.pre_signature_part("11122", self.sec.my_cert),
            attribute_statement=do_attribute_statement({
                    ("","","surName"): ("Fox",""),
                    ("","","givenName") :("Bear",""),
                })
            )
        response = factory(samlp.Response,
                assertion=assertion2,
                id="22233",
                signature=sigver.pre_signature_part("22233", self.sec.my_cert))

        to_sign = [(class_name(assertion2), assertion2.id),
                    (class_name(response), response.id)]

        s_response = sigver.signed_instance_factory(response, self.sec, to_sign)

        assert s_response is not None
        response2 = response_from_string(s_response)

        sass = response2.assertion[0]
        assert _eq(sass.keyswv(), ['attribute_statement', 'issue_instant',
                                'version', 'signature', 'id'])
        assert sass.version == "2.0"
        assert sass.id == "11122"

        item = self.sec.check_signature(response2, class_name(response),
                                        s_response)

        assert isinstance(item, samlp.Response)

    def to_(self, attrvals):
        """ Create a list of Attribute instances.

        :param attrvals: A dictionary of attributes and values
        :return: A list of Attribute instances
        """
        attributes = []
        for key, value in attrvals.items():
            name = self._to.get(key.lower())
            if name:
                if name == "urn:oid:1.3.6.1.4.1.5923.1.1.1.10":
                    # special case for eduPersonTargetedID
                    attr_value = []
                    for v in value:
                        extension_element = ExtensionElement("NameID", NAMESPACE,
                                                             attributes={'Format': NAMEID_FORMAT_PERSISTENT}, text=v)
                        attrval = saml.AttributeValue(extension_elements=[extension_element])
                        attr_value.append(attrval)
                else:
                    attr_value = do_ava(value)
                attributes.append(factory(saml.Attribute,
                                          name=name,
                                          name_format=self.name_format,
                                          friendly_name=key,
                                          attribute_value=attr_value))
            else:
                attributes.append(factory(saml.Attribute,
                                          name=key,
                                          attribute_value=do_ava(value)))

        return attributes

    def test_exception_sign_verify_with_cert_from_instance(self):
        assertion = factory(saml.Assertion,
                            version="2.0",
                            id="11100",
                            issue_instant="2009-10-30T13:20:28Z",
                            #signature= sigver.pre_signature_part("11100",
                            # self.sec.my_cert),
                            attribute_statement=do_attribute_statement({
                                ("", "", "surName"): ("Foo", ""),
                                ("", "", "givenName"): ("Bar", ""),
                            })
        )

        response = factory(samlp.Response,
                           assertion=assertion,
                           id="22222",
                           signature=sigver.pre_signature_part("22222",
                                                               self.sec
                                                               .my_cert))

        to_sign = [(class_name(response), response.id)]

        s_response = sigver.signed_instance_factory(response, self.sec, to_sign)

        response2 = response_from_string(s_response)
        # Change something that should make everything fail
        response2.id = "23456"
        raises(sigver.SignatureError, self.sec._check_signature,
               s_response, response2, class_name(response2))

def test_value_4():
    attribute = utils.factory(
        saml.Attribute, attribute_value=[utils.factory(saml.AttributeValue, text="Derek")], friendly_name="givenName"
    )

    assert _eq(attribute.keyswv(), ["friendly_name", "attribute_value", "name_format"])
    assert attribute.friendly_name == "givenName"
    assert len(attribute.attribute_value) == 1
    assert attribute.attribute_value[0].text == "Derek"

def authn_statement(authn_class=None, authn_auth=None,
                    authn_decl=None, authn_decl_ref=None, authn_instant="",
                    subject_locality="", session_not_on_or_after=None):
    """
    Construct the AuthnStatement
    :param authn_class: Authentication Context Class reference
    :param authn_auth: Authenticating Authority
    :param authn_decl: Authentication Context Declaration
    :param authn_decl_ref: Authentication Context Declaration reference
    :param authn_instant: When the Authentication was performed.
        Assumed to be seconds since the Epoch.
    :param subject_locality: Specifies the DNS domain name and IP address
        for the system from which the assertion subject was apparently
        authenticated.
    :return: An AuthnContext instance
    """
    if authn_instant:
        _instant = instant(time_stamp=authn_instant)
    else:
        _instant = instant()

    if authn_class:
        res = factory(
            saml.AuthnStatement,
            authn_instant=_instant,
            session_index=sid(),
            session_not_on_or_after=session_not_on_or_after,
            authn_context=_authn_context_class_ref(
                authn_class, authn_auth))
    elif authn_decl:
        res = factory(
            saml.AuthnStatement,
            authn_instant=_instant,
            session_index=sid(),
            session_not_on_or_after=session_not_on_or_after,
            authn_context=_authn_context_decl(authn_decl, authn_auth))
    elif authn_decl_ref:
        res = factory(
            saml.AuthnStatement,
            authn_instant=_instant,
            session_index=sid(),
            session_not_on_or_after=session_not_on_or_after,
            authn_context=_authn_context_decl_ref(authn_decl_ref,
                                                  authn_auth))
    else:
        res = factory(
            saml.AuthnStatement,
            authn_instant=_instant,
            session_index=sid(),
            session_not_on_or_after=session_not_on_or_after)

    if subject_locality:
        res.subject_locality = saml.SubjectLocality(text=subject_locality)

    return res

    def construct(self, sp_entity_id, in_response_to, consumer_url,
                    name_id, attrconvs, policy, issuer, authn_class=None, 
                    authn_auth=None, authn_decl=None, encrypt=None,
                    sec_context=None):
        """ Construct the Assertion 
        
        :param sp_entity_id: The entityid of the SP
        :param in_response_to: An identifier of the message, this message is 
            a response to
        :param consumer_url: The intended consumer of the assertion
        :param name_id: An NameID instance
        :param attrconvs: AttributeConverters
        :param policy: The policy that should be adhered to when replying
        :param issuer: Who is issuing the statement
        :param authn_class: The authentication class
        :param authn_auth: The authentication instance
        :param authn_decl:
        :param encrypt: Whether to encrypt parts or all of the Assertion
        :param sec_context: The security context used when encrypting
        :return: An Assertion instance
        """
        attr_statement = saml.AttributeStatement(attribute=from_local(
                                attrconvs, self, 
                                policy.get_name_form(sp_entity_id)))

        if encrypt == "attributes":
            for attr in attr_statement.attribute:
                enc = sec_context.encrypt(text="%s" % attr)

                encd = xmlenc.encrypted_data_from_string(enc)
                encattr = saml.EncryptedAttribute(encrypted_data=encd)
                attr_statement.encrypted_attribute.append(encattr)

            attr_statement.attribute = []

        # start using now and for some time
        conds = policy.conditions(sp_entity_id)
        
        return assertion_factory(
            issuer=issuer,
            attribute_statement = attr_statement,
            authn_statement = self._authn_statement(authn_class, authn_auth, 
                                                    authn_decl),
            conditions = conds,
            subject=factory( saml.Subject,
                name_id=name_id,
                subject_confirmation=factory( saml.SubjectConfirmation,
                                method=saml.SUBJECT_CONFIRMATION_METHOD_BEARER,
                                subject_confirmation_data=factory(
                                    saml.SubjectConfirmationData,
                                    in_response_to=in_response_to,
                                    recipient=consumer_url,
                                    not_on_or_after=policy.not_on_or_after(
                                                            sp_entity_id)))),
            )

 def _authn_context_decl_ref(self, decl_ref, authn_auth=None):
     """
     Construct the authn context with a authn context declaration reference
     :param decl_ref: The authn context declaration reference
     :param authn_auth: Authenticating Authority
     :return: An AuthnContext instance
     """
     return factory(saml.AuthnContext,
                    authn_context_decl_ref=decl_ref,
                    authenticating_authority=factory(
                        saml.AuthenticatingAuthority, text=authn_auth))

def _authn_context_decl(decl, authn_auth=None):
    """
    Construct the authn context with a authn context declaration
    :param decl: The authn context declaration
    :param authn_auth: Authenticating Authority
    :return: An AuthnContext instance
    """
    return factory(saml.AuthnContext,
                   authn_context_decl=decl,
                   authenticating_authority=factory(
                       saml.AuthenticatingAuthority, text=authn_auth))

def test_authn_statement():
    accr = utils.factory(saml.AuthnContextClassRef, text="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified")
    ac = utils.factory(saml.AuthnContext, authn_context_class_ref=accr)
    ast = utils.factory(
        saml.AuthnStatement,
        authn_instant="2010-03-10T12:33:00Z",
        session_index="_12345",
        session_not_on_or_after="2010-03-11T12:00:00Z",
        authn_context=ac,
    )
    assert _eq(ast.keyswv(), ["authn_instant", "session_index", "session_not_on_or_after", "authn_context"])

def test_subject_confirmation():
    s = utils.factory(saml.SubjectConfirmation,
                      method="urn:oasis:names:tc:SAML:2.0:profiles:SSO:browser",
                      base_id="1234",
                      name_id="abcd",
                      subject_confirmation_data=utils.factory(
                          saml.SubjectConfirmationData,
                          in_response_to="_1234567890",
                          recipient="http://example.com/sp/"))

    assert _eq(s.keyswv(),
               ["method", "base_id", "name_id", "subject_confirmation_data"])
    assert s.method == "urn:oasis:names:tc:SAML:2.0:profiles:SSO:browser"

 def conditions(self, sp_entity_id):
     """ Return a saml.Condition instance
     
     :param sp_entity_id: The SP entity ID
     :return: A saml.Condition instance
     """
     return factory( saml.Conditions,
                     not_before=instant(),
                     # How long might depend on who's getting it
                     not_on_or_after=self.not_on_or_after(sp_entity_id),
                     audience_restriction=[factory( saml.AudienceRestriction,
                             audience=factory(saml.Audience, 
                                             text=sp_entity_id))])

def test_conditions():
    conditions = utils.factory( saml.Conditions,
                    not_before="2009-10-30T07:58:10.852Z",
                    not_on_or_after="2009-10-30T08:03:10.852Z", 
                    audience_restriction=[utils.factory(saml.AudienceRestriction,
                                        audience=utils.factory(saml.Audience,
                                                        text="urn:foo:bar"))])
                    
    assert _eq(conditions.keyswv(), ["not_before", "not_on_or_after",
                                "audience_restriction"])
    assert conditions.not_before == "2009-10-30T07:58:10.852Z" 
    assert conditions.not_on_or_after == "2009-10-30T08:03:10.852Z"
    assert conditions.audience_restriction[0].audience.text == "urn:foo:bar"

    def to_format(self, attr):
        """ Creates an Attribute instance with name, name_format and
        friendly_name

        :param attr: The local name of the attribute
        :return: An Attribute instance
        """
        try:
            return factory(saml.Attribute,
                           name=self._to[attr],
                           name_format=self.name_format,
                           friendly_name=attr)
        except KeyError:
            return factory(saml.Attribute, name=attr)

def test_value_3():
    attribute = utils.factory(saml.Attribute,
                              attribute_value=[utils.factory(
                                  saml.AttributeValue, text="Derek")],
                              name="urn:oid:2.5.4.42",
                              name_format=NAME_FORMAT_URI,
                              friendly_name="givenName")

    assert _eq(attribute.keyswv(), ["name", "name_format",
                                    "friendly_name", "attribute_value"])
    assert attribute.name == "urn:oid:2.5.4.42"
    assert attribute.name_format == NAME_FORMAT_URI
    assert attribute.friendly_name == "givenName"
    assert len(attribute.attribute_value) == 1
    assert attribute.attribute_value[0].text == "Derek"

def test_attribute():
    a = utils.factory(saml.Attribute,
                friendly_name="eduPersonScopedAffiliation",
                name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9",
                name_format="urn:oasis:names:tc:SAML:2.0:attrname-format:uri")
        
    assert _eq(a.keyswv(), ["friendly_name","name", "name_format"])

    a = utils.factory(saml.Attribute,
        friendly_name="eduPersonScopedAffiliation",    
        name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9",
        name_format="urn:oasis:names:tc:SAML:2.0:attrname-format:uri",
        attribute_value=[saml.AttributeValue(text="[email protected]")])
        
    assert _eq(a.keyswv(), ["friendly_name","name", "name_format",
                            "attribute_value"])

def test_xmlsec_err():
    conf = config.SPConfig()
    conf.load_file("server_conf")
    md = MetadataStore([saml, samlp], None, conf)
    md.load("local", full_path("idp_example.xml"))

    conf.metadata = md
    conf.only_use_keys_in_metadata = False
    sec = sigver.security_context(conf)

    assertion = factory(
        saml.Assertion, version="2.0", id="11111",
        issue_instant="2009-10-30T13:20:28Z",
        signature=sigver.pre_signature_part("11111", sec.my_cert, 1),
        attribute_statement=do_attribute_statement(
            {("", "", "surName"): ("Foo", ""),
             ("", "", "givenName"): ("Bar", ""), })
    )

    try:
        sec.sign_statement(assertion, class_name(assertion),
                           key_file=full_path("tes.key"),
                           node_id=assertion.id)
    except (XmlsecError, SigverError) as err:  # should throw an exception
        pass
    else:
        assert False