|
| 1 | +# OneLogin's SAML Python Toolkit |
| 2 | + |
| 3 | +Add SAML support to your Python softwares using this library. |
| 4 | +Forget those complicated libraries and use that open source library provided |
| 5 | +and supported by OneLogin Inc. |
| 6 | + |
| 7 | + |
| 8 | +Why add SAML support to my software? |
| 9 | +------------------------------------ |
| 10 | + |
| 11 | +SAML is an XML-based standard for web browser single sign-on and is defined by |
| 12 | +the OASIS Security Services Technical Committee. The standard has been around |
| 13 | +since 2002, but lately it is becoming popular due its advantages: |
| 14 | + |
| 15 | + * **Usability** - One-click access from portals or intranets, deep linking, |
| 16 | + password elimination and automatically renewing sessions make life |
| 17 | + easier for the user. |
| 18 | + * **Security** - Based on strong digital signatures for authentication and |
| 19 | + integrity, SAML is a secure single sign-on protocol that the largest |
| 20 | + and most security conscious enterprises in the world rely on. |
| 21 | + * **Speed** - SAML is fast. One browser redirect is all it takes to securely |
| 22 | + sign a user into an application. |
| 23 | + * **Phishing Prevention** - If you don’t have a password for an app, you |
| 24 | + can’t be tricked into entering it on a fake login page. |
| 25 | + * **IT Friendly** - SAML simplifies life for IT because it centralizes |
| 26 | + authentication, provides greater visibility and makes directory |
| 27 | + integration easier. |
| 28 | + * **Opportunity** - B2B cloud vendor should support SAML to facilitate the |
| 29 | + integration of their product. |
| 30 | + |
| 31 | +General description |
| 32 | +------------------- |
| 33 | + |
| 34 | +OneLogin's SAML Python toolkit let you build a SP (Service Provider) over |
| 35 | +your Python application and connect it to any IdP (Identity Provider). |
| 36 | + |
| 37 | +Supports: |
| 38 | + |
| 39 | + * SSO and SLO (SP-Initiated and IdP-Initiated). |
| 40 | + * Assertion and nameId encryption. |
| 41 | + * Assertion signature. |
| 42 | + * Message signature: AuthNRequest, LogoutRequest, LogoutResponses. |
| 43 | + * Enable an Assertion Consumer Service endpoint. |
| 44 | + * Enable a Single Logout Service endpoint. |
| 45 | + * Publish the SP metadata (which can be signed). |
| 46 | + |
| 47 | +Key features: |
| 48 | + |
| 49 | + * **saml2int** - Implements the SAML 2.0 Web Browser SSO Profile. |
| 50 | + * **Session-less** - Forget those common conflicts between the SP and |
| 51 | + the final app, the toolkit delegate session in the final app. |
| 52 | + * **Easy to use** - Programmer will be allowed to code high-level and |
| 53 | + low-level programming, 2 easy to use APIs are available. |
| 54 | + * **Tested** - Thoroughly tested. |
| 55 | + * **Popular** - OneLogin's customers use it. Add easy support to your django/flask web projects. |
| 56 | + |
| 57 | + |
| 58 | +Installation |
| 59 | +------------ |
| 60 | + |
| 61 | +### Dependences ### |
| 62 | + |
| 63 | + * python 2.7 |
| 64 | + * M2Crypto A Python crypto and SSL toolkit |
| 65 | + * dm.xmlsec.binding Cython/lxml based binding for the XML security library |
| 66 | + * isodate An ISO 8601 date/time/duration parser and formater |
| 67 | + * defusedxml XML bomb protection for Python stdlib modules |
| 68 | + |
| 69 | +Review the setup.py file to know the version of the library that python-saml is using |
| 70 | + |
| 71 | +### Code ### |
| 72 | + |
| 73 | +#### Option 1. Download from github #### |
| 74 | + |
| 75 | +The toolkit is hosted on github. You can download it from: |
| 76 | + |
| 77 | + * Lastest release: https://github.com/onelogin/python-saml/releases/latest |
| 78 | + * Master repo: https://github.com/onelogin/python-saml/tree/master |
| 79 | + |
| 80 | +Copy the core of the library (src/onelogin/saml2 folder) and merge the setup.py inside the python application. (each application has its structure so take your time to locate the Python SAML toolkit in the best place). |
| 81 | + |
| 82 | +#### Option 2. Download from pypi #### |
| 83 | + |
| 84 | +The toolkit is hosted in pypi, you can find the python-sam package at https://pypi.python.org/pypi/python-saml |
| 85 | + |
| 86 | +You can install it executing: |
| 87 | +``` |
| 88 | + pip install python-saml |
| 89 | +``` |
| 90 | + |
| 91 | +If you want to know how a project can handle python packages review this [guide](https://packaging.python.org/en/latest/tutorial.html) and review this [sampleproject](https://github.com/pypa/sampleproject) |
| 92 | + |
| 93 | + |
| 94 | +Getting started |
| 95 | +--------------- |
| 96 | + |
| 97 | +### Knowing the toolkit ### |
| 98 | + |
| 99 | +The new OneLogin SAML Toolkit contains different folders (certs, lib, demo-django, demo-flask and tests) and some files. |
| 100 | + |
| 101 | +Let's start describing them: |
| 102 | + |
| 103 | +#### certs #### |
| 104 | + |
| 105 | +SAML requires a x.509 cert to sign and encrypt elements like NameID, Message, |
| 106 | +Assertion, Metadata. |
| 107 | + |
| 108 | +If our environment requires sign or encrypt support, this folder may contain |
| 109 | +the x509 cert and the private key that the SP will use: |
| 110 | + |
| 111 | + * **sp.crt** The public cert of the SP |
| 112 | + * **sp.key** The privake key of the SP |
| 113 | + |
| 114 | +Or also we can provide those data in the setting file at the $settings['sp']['x509cert'] |
| 115 | +and the $settings['sp']['privateKey']. |
| 116 | + |
| 117 | +Sometimes we could need a signature on the metadata published by the SP, in |
| 118 | +this case we could use the x.509 cert previously mentioned or use a new x.509 |
| 119 | +cert: **metadata.crt** and **metadata.key**. |
| 120 | + |
| 121 | + |
| 122 | +#### src #### |
| 123 | + |
| 124 | +This folder contains the heart of the toolkit, **onelogin/saml2** folder contains the new version of |
| 125 | +the classes and methods that are described in a later section |
| 126 | + |
| 127 | +#### demo-django #### |
| 128 | + |
| 129 | +TODO: Explain structure and how works |
| 130 | + |
| 131 | +#### demo-flask #### |
| 132 | + |
| 133 | +TODO: Explain structure and how works |
| 134 | + |
| 135 | +#### setup.py #### |
| 136 | + |
| 137 | +Setup script is the centre of all activity in building, distributing, and installing modules. |
| 138 | +Read more at https://pythonhosted.org/an_example_pypi_project/setuptools.html |
| 139 | + |
| 140 | +### How it works ### |
| 141 | + |
| 142 | +#### Settings #### |
| 143 | + |
| 144 | +TODO |
| 145 | + |
| 146 | +#### How load the library #### |
| 147 | + |
| 148 | +TODO |
| 149 | +from onelogin.saml2.auth import OneLogin_Saml2_Auth |
| 150 | +from onelogin.saml2.utils import OneLogin_Saml2_Utils |
| 151 | + |
| 152 | +#### Initiate SSO #### |
| 153 | + |
| 154 | +TODO |
| 155 | + |
| 156 | +#### The SP Endpoints #### |
| 157 | + |
| 158 | +TODO |
| 159 | + |
| 160 | +#### Initiate SLO #### |
| 161 | + |
| 162 | +TODO |
| 163 | + |
| 164 | +### Main classes and methods ### |
| 165 | + |
| 166 | +TODO |
| 167 | + |
| 168 | + |
| 169 | +Demos and test |
| 170 | +-------------- |
| 171 | + |
| 172 | +### Getting Started ### |
| 173 | + |
| 174 | +We said that this toolkit includes a django application demo and a flask applicacion demo, |
| 175 | +lets see how fast is deploy them. |
| 176 | + |
| 177 | +** Virtualenv ** |
| 178 | + |
| 179 | +The use of a [virtualenv](http://virtualenv.readthedocs.org/en/latest/) is |
| 180 | +highly recommended. |
| 181 | + |
| 182 | +Virtualenv helps isolating the python enviroment used to run the toolkit. You |
| 183 | +can find more details and an installation guide in the |
| 184 | +[official documentation](http://virtualenv.readthedocs.org/en/latest/). |
| 185 | + |
| 186 | +Once you have your virtualenv ready and loaded, then you can install the |
| 187 | +toolkit on it in development mode executing this: |
| 188 | +``` |
| 189 | + python setup.py develop |
| 190 | +``` |
| 191 | + |
| 192 | +Using this method of deployment the toolkit files will be linked instead of |
| 193 | +copied, so if you make changes on them you won't need to reinstall the toolkit. |
| 194 | + |
| 195 | +If you want install it in a nomal mode, execute: |
| 196 | +``` |
| 197 | + python setup.py install |
| 198 | +``` |
| 199 | + |
| 200 | +#### Demo Flask #### |
| 201 | + |
| 202 | +You'll need a virtualenv with the toolkit installed on it. |
| 203 | + |
| 204 | +To run the demo you need to install the requirements first. Load your |
| 205 | +virtualenv and execute: |
| 206 | + |
| 207 | +``` |
| 208 | + pip install -r demo-flask/requirements.txt |
| 209 | +``` |
| 210 | + |
| 211 | +This will install flask and its dependences. Once it has finished, you have to complete the configuration |
| 212 | +of the toolkit. You'll find it at `demo-flask/settings.json` |
| 213 | + |
| 214 | +Now, with the virtualenv loaded, you can run the demo like this: |
| 215 | +``` |
| 216 | + cd demo-flask |
| 217 | + python index.py |
| 218 | +``` |
| 219 | + |
| 220 | +You'll have the demo running at http://localhost:8000 |
| 221 | + |
| 222 | +#### Demo Django #### |
| 223 | + |
| 224 | +You'll need a virtualenv with the toolkit installed on it. |
| 225 | + |
| 226 | +To run the demo you need to install the requirements first. Load your |
| 227 | +virtualenv and execute: |
| 228 | +``` |
| 229 | + pip install -r demo-django/requirements.txt |
| 230 | +``` |
| 231 | +This will install django and its dependences. Once it has finished, you have to complete |
| 232 | +the configuration of the toolkit. You'll find it at `demo-django/settings.json` |
| 233 | + |
| 234 | +Now, with the virtualenv loaded, you can run the demo like this: |
| 235 | +``` |
| 236 | + cd demo-django |
| 237 | + python manage.py runserver 0.0.0.0:8000 |
| 238 | +``` |
| 239 | + |
| 240 | +You'll have the demo running at http://localhost:8000 |
| 241 | + |
| 242 | +#### Tests Suite #### |
| 243 | + |
| 244 | +To run the test you only need to load the virtualenv with the toolkit installed |
| 245 | +on it and execute: |
| 246 | +``` |
| 247 | + python setup.py test |
| 248 | +``` |
| 249 | + |
| 250 | +The previous line will run the tests for the whole toolkit. You can also run |
| 251 | +the tests for a specific module. To do so for the `auth` module you would |
| 252 | +have to execute this: |
| 253 | +``` |
| 254 | + python setup.py test --test-suite tests.src.OneLogin.saml2_tests.auth_test.OneLogin_Saml2_Auth_Test |
| 255 | +``` |
| 256 | + |
| 257 | +With the `--test-suite` parameter you can specify the module to test. You'll |
| 258 | +find all the module available and their class names at |
| 259 | +`tests/src/OneLogin/saml2_tests/` |
| 260 | + |
| 261 | + |
| 262 | +### How it works ### |
| 263 | + |
| 264 | +#### Demo Django #### |
| 265 | + |
| 266 | +TODO |
| 267 | + |
| 268 | +#### Demo Django #### |
| 269 | + |
| 270 | +TODO |
0 commit comments