o
    &zh,                     @   s   d dl mZ d dlmZ d dlmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ dd Zdd Zdd Zdd Zdd Zdd Zdd Zdd ZdS )    )urlparse)cache)ImproperlyConfigured)Http404)reverse	urlencode)OneLogin_Saml2_Auth)OneLogin_Saml2_Constants) OneLogin_Saml2_IdPMetadataParser)get_adapter)	SocialApp)SAMLProviderc                 C   s:   t  }z
|j| tj|dW S  tjy   td| w )N)provider	client_idz"no SocialApp found with client_id=)r   get_appr   idr   DoesNotExistr   )requestorganization_slugadapter r   e/var/www/html/kangema/venv/lib/python3.10/site-packages/allauth/socialaccount/providers/saml/utils.pyget_app_or_404   s   r   c                 C   s8   |   rdnd| jd | jd | j | j d}|S )Nonoff	HTTP_HOST	PATH_INFO)https	http_hostscript_nameget_data	post_data)	is_secureMETAGETcopyPOST)r   resultr   r   r   prepare_django_request   s   r)   c           
      C   s   |  td|gd}|  td|gd}|  td|gd}|di }|d}|p,||tjd|tjdd}|d	i }	|	d
d urL|	d
 |d
< |	drW|	d |d< |	dd urd|	d |d< |	dd urq|	d |d< |S )Nsaml_acs)argssaml_slssaml_metadatasp	entity_id)urlbinding)entityIdassertionConsumerServicesingleLogoutServiceadvancedx509certx509cert_newx509certNewprivate_key
privateKeyname_id_formatNameIDFormat)build_absolute_urir   getr
   BINDING_HTTP_POSTBINDING_HTTP_REDIRECT)
r   provider_configorgacs_urlsls_urlmetadata_url
_sp_configsp_entity_id	sp_configavdr   r   r   build_sp_config(   s.   

rJ   c                 C   sd   | d }| d }d| d| }t |}|d u r0tj||| ddd}t ||| dd	 |S )
NrE   r/   zsaml.metadata..metadata_request_timeout
   )r/   timeoutmetadata_cache_timeouti@8  )r   r>   r   parse_remoteset)
idp_configrE   r/   	cache_keysaml_configr   r   r   fetch_metadata_url_configL   s    


rU   c                 C   s  | di }i d| ddd| dtjd| ddd	| d
dddd| dtjd| ddd| ddd| ddd| ddd| ddd| ddd| ddd| ddd| d dd!| d"dd#| d$d| d%d | d&d d'}| d(d|d)}| d*}|r||d+< | d,}|r||d,< | d-}|d u rtd.| d/}	|	rt|}
|
d- |d-< n|d0 |d1 d2|d3 id4|d-< | d5}|rd2|i|d- d6< t| |||d7< |S )8Nr5   authnRequestsSignedauthn_request_signedFdigestAlgorithmdigest_algorithmlogoutRequestSignedlogout_request_signedlogoutResponseSignedlogout_response_signedrequestedAuthnContextsignatureAlgorithmsignature_algorithmsignMetadatametadata_signedwantAssertionsEncryptedwant_assertion_encryptedwantAssertionsSignedwant_assertion_signedwantMessagesSignedwant_message_signednameIdEncryptedname_id_encryptedwantNameIdEncryptedwant_name_id_encryptedallowSingleLabelDomainsallow_single_label_domainsrejectDeprecatedAlgorithmreject_deprecated_algorithmT
wantNameIdwant_name_idwantAttributeStatementwant_attribute_statementallowRepeatAttributeNameallow_repeat_attribute_namemetadata_valid_untilmetadata_cache_duration)metadataValidUntilmetadataCacheDurationstrict)r{   securitycontact_personcontactPersonorganizationidpz`idp` missingrE   r/   r6   r0   sso_url)r2   r6   singleSignOnServiceslo_urlr4   r.   )r>   r
   SHA256
RSA_SHA256r   rU   rJ   )r   rA   rB   rI   security_configrT   r}   r   r   rE   meta_configr   r   r   r   build_saml_config_   s   	










r   c                 C   s   d| i}t |S )Nstater   )r   paramsr   r   r   encode_relay_state   s   r   c                 C   s6   d}| rt | }|js|js|jr|jdr| }|S )zAccording to the spec, RelayState need not be a URL, yet,
    ``onelogin.saml2` exposes it as ``return_to -- The target URL the user
    should be redirected to after login``. Also, for an IdP initiated login
    sometimes a URL is used.
    N/)r   schemenetlocpath
startswith)relay_statenext_urlpartsr   r   r   decode_relay_state   s   r   c                 C   s*   t | }t| |jj|jj}t||}|S )N)r)   r   appsettingsr   r	   )r   r   reqconfigauthr   r   r   
build_auth   s   
r   N) urllib.parser   django.core.cacher   django.core.exceptionsr   django.httpr   django.urlsr   django.utils.httpr   onelogin.saml2.authr	   onelogin.saml2.constantsr
   "onelogin.saml2.idp_metadata_parserr   allauth.socialaccount.adapterr   allauth.socialaccount.modelsr   -allauth.socialaccount.providers.saml.providerr   r   r)   rJ   rU   r   r   r   r   r   r   r   r   <module>   s(    
$;