# onelogin.saml2 package

## Submodules

## onelogin.saml2.auth module

OneLogin_Saml2_Auth class

MIT License

Main class of Python Toolkit.

Initializes the SP SAML instance

class `onelogin.saml2.auth.``OneLogin_Saml2_Auth`(request_data, old_settings=None, custom_base_path=None)

  Bases: `object`

  This class implements the SP SAML instance.

  Defines the methods that you can invoke in your application in order to add SAML support (initiates SSO, initiates SLO, processes a SAML Response, a Logout Request or a Logout Response).

  `build_request_signature`(saml_request, relay_state, sign_algorithm='http://www.w3.org/2000/09/xmldsig#rsa-sha1')

    Builds the Signature of the SAML Request.

    Parameters: | saml_request (string) – The SAML Request relay_state (string) – The target URL the user should be redirected to sign_algorithm (string) – Signature algorithm method

  `build_response_signature`(saml_response, relay_state, sign_algorithm='http://www.w3.org/2000/09/xmldsig#rsa-sha1')

    Builds the Signature of the SAML Response. :param saml_request: The SAML Response :type saml_request: string

    Parameters: | relay_state (string) – The target URL the user should be redirected to sign_algorithm (string) – Signature algorithm method

  `get_attribute`(name)

    Returns the requested SAML attribute.

    Parameters: | name (string) – Name of the attribute
    Returns: | Attribute value(s) if exists or None
    Return type: | list

  `get_attributes`()

    Returns the set of SAML attributes.

    Returns: | SAML attributes
    Return type: | dict

  `get_errors`()

    Returns a list with code errors if something went wrong

    Returns: | List of errors
    Return type: | list

  `get_friendlyname_attribute`(friendlyname)

    Returns the requested SAML attribute searched by FriendlyName.

    Parameters: | friendlyname (string) – FriendlyName of the attribute
    Returns: | Attribute value(s) if exists or None
    Return type: | list

  `get_friendlyname_attributes`()

    Returns the set of SAML attributes indexed by FiendlyName.

    Returns: | SAML attributes
    Return type: | dict

  `get_last_assertion_id`()

    Returns: | The ID of the last assertion processed.
    Return type: | string

  `get_last_assertion_not_on_or_after`()

    The NotOnOrAfter value of the valid SubjectConfirmationData node (if any) of the last assertion processed

  `get_last_authn_contexts`()

    Returns: | The list of authentication contexts sent in the last SAML Response.
    Return type: | list

  `get_last_error_reason`()

    Returns the reason for the last error

    Returns: | Reason of the last error
    Return type: | None | string

  `get_last_message_id`()

    Returns: | The ID of the last Response SAML message processed.
    Return type: | string

  `get_last_request_id`()

    Returns: | The ID of the last Request SAML message generated.
    Return type: | string

  `get_last_request_xml`()

    Retrieves the raw XML sent in the last SAML request

    Returns: | SAML request XML
    Return type: | string|None

  `get_last_response_xml`(pretty_print_if_possible=False)

    Retrieves the raw XML (decrypted) of the last SAML response, or the last Logout Response generated or processed

    Returns: | SAML response XML
    Return type: | string|None

  `get_nameid`()

    Returns the nameID.

    Returns: | NameID
    Return type: | string|None

  `get_nameid_format`()

    Returns the nameID Format.

    Returns: | NameID Format
    Return type: | string|None

  `get_nameid_nq`()

    Returns the nameID NameQualifier of the Assertion.

    Returns: | NameID NameQualifier
    Return type: | string|None

  `get_nameid_spnq`()

    Returns the nameID SP NameQualifier of the Assertion.

    Returns: | NameID SP NameQualifier
    Return type: | string|None

  `get_session_expiration`()

    Returns the SessionNotOnOrAfter from the AuthnStatement. :returns: The SessionNotOnOrAfter of the assertion :rtype: unix/posix timestamp|None

  `get_session_index`()

    Returns the SessionIndex from the AuthnStatement. :returns: The SessionIndex of the assertion :rtype: string

  `get_settings`()

    Returns the settings info :return: Setting info :rtype: OneLogin_Saml2_Setting object

  `get_slo_response_url`()

    Gets the SLO return URL for IdP-initiated logout.

    Returns: | an URL, the SLO return endpoint of the IdP
    Return type: | string

  `get_slo_url`()

    Gets the IdP SLO URL.

    Returns: | An URL, the SLO endpoint of the IdP
    Return type: | string

  `get_sso_url`()

    Gets the IdP SSO URL.

    Returns: | An URL, the SSO endpoint of the IdP
    Return type: | string

  `is_authenticated`()

    Checks if the user is authenticated or not.

    Returns: | True if is authenticated, False if not
    Return type: | bool

  `login`(return_to=None, force_authn=False, is_passive=False, set_nameid_policy=True, name_id_value_req=None)

    Initiates the SSO process.

    Parameters: | return_to (string) – Optional argument. The target URL the user should be redirected to after login. force_authn (bool) – Optional argument. When true the AuthNRequest will set the ForceAuthn=’true’. is_passive (bool) – Optional argument. When true the AuthNRequest will set the Ispassive=’true’. set_nameid_policy (bool) – Optional argument. When true the AuthNRequest will set a nameIdPolicy element. name_id_value_req (string) – Optional argument. Indicates to the IdP the subject that should be authenticated
    Returns: | Redirection URL
    Return type: | string

  `logout`(return_to=None, name_id=None, session_index=None, nq=None, name_id_format=None, spnq=None)

    Initiates the SLO process.

    Parameters: | return_to (string) – Optional argument. The target URL the user should be redirected to after logout. name_id (string) – The NameID that will be set in the LogoutRequest. session_index (string) – SessionIndex that identifies the session of the user. nq – IDP Name Qualifier name_id_format – The NameID Format that will be set in the LogoutRequest. spnq – SP Name Qualifier
    Type: | string
    Type: | string
    Type: | string
    Returns: | Redirection url

  `process_response`(request_id=None)

    Process the SAML Response sent by the IdP.

    Parameters: | request_id (string) – Is an optional argument. Is the ID of the AuthNRequest sent by this SP to the IdP.
    Raises: | OneLogin_Saml2_Error.SAML_RESPONSE_NOT_FOUND, when a POST with a SAMLResponse is not found

  `process_slo`(keep_local_session=False, request_id=None, delete_session_cb=None)

    Process the SAML Logout Response / Logout Request sent by the IdP.

    Parameters: | keep_local_session (bool) – When false will destroy the local session, otherwise will destroy it request_id (string) – The ID of the LogoutRequest sent by this SP to the IdP
    Returns: | Redirection URL

  `redirect_to`(url=None, parameters={})

    Redirects the user to the URL passed by parameter or to the URL that we defined in our SSO Request.

    Parameters: | url (string) – The target URL to redirect the user parameters (dict) – Extra parameters to be passed as part of the URL
    Returns: | Redirection URL

  `set_strict`(value)

    Set the strict mode active/disable

    Parameters: | value (bool) –

## onelogin.saml2.authn_request module

OneLogin_Saml2_Authn_Request class

MIT License

AuthNRequest class of Python Toolkit.

class `onelogin.saml2.authn_request.``OneLogin_Saml2_Authn_Request`(settings, force_authn=False, is_passive=False, set_nameid_policy=True, name_id_value_req=None)

  Bases: `object`

  This class handles an AuthNRequest. It builds an AuthNRequest object.

  `get_id`()

    Returns the AuthNRequest ID. :return: AuthNRequest ID :rtype: string

  `get_request`(deflate=True)

    Returns unsigned AuthnRequest. :param deflate: It makes the deflate process optional :type: bool :return: AuthnRequest maybe deflated and base64 encoded :rtype: str object

  `get_xml`()

    Returns the XML that will be sent as part of the request :return: XML request body :rtype: string

## onelogin.saml2.constants module

OneLogin_Saml2_Constants class

MIT License

Constants class of Python Toolkit.

class `onelogin.saml2.constants.``OneLogin_Saml2_Constants`

  Bases: `object`

  This class defines all the constants that will be used in the Python Toolkit.

  `AC_KERBEROS` = 'urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos'
  `AC_PASSWORD` = 'urn:oasis:names:tc:SAML:2.0:ac:classes:Password'
  `AC_PASSWORD_PROTECTED` = 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
  `AC_SMARTCARD` = 'urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard'
  `AC_UNSPECIFIED` = 'urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified'
  `AC_X509` = 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509'
  `AES128_CBC` = 'http://www.w3.org/2001/04/xmlenc#aes128-cbc'
  `AES192_CBC` = 'http://www.w3.org/2001/04/xmlenc#aes192-cbc'
  `AES256_CBC` = 'http://www.w3.org/2001/04/xmlenc#aes256-cbc'
  `ALLOWED_CLOCK_DRIFT` = 300
  `ATTRNAME_FORMAT_BASIC` = 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
  `ATTRNAME_FORMAT_UNSPECIFIED` = 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified'
  `ATTRNAME_FORMAT_URI` = 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
  `BINDING_DEFLATE` = 'urn:oasis:names:tc:SAML:2.0:bindings:URL-Encoding:DEFLATE'
  `BINDING_HTTP_ARTIFACT` = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact'
  `BINDING_HTTP_POST` = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
  `BINDING_HTTP_REDIRECT` = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
  `BINDING_SOAP` = 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP'
  `CM_BEARER` = 'urn:oasis:names:tc:SAML:2.0:cm:bearer'
  `CM_HOLDER_KEY` = 'urn:oasis:names:tc:SAML:2.0:cm:holder-of-key'
  `CM_SENDER_VOUCHES` = 'urn:oasis:names:tc:SAML:2.0:cm:sender-vouches'
  `DEPRECATED_ALGORITHMS` = ['http://www.w3.org/2000/09/xmldsig#dsa-sha1', 'http://www.w3.org/2000/09/xmldsig#rsa-sha1', 'http://www.w3.org/2000/09/xmldsig#sha1']
  `DSA_SHA1` = 'http://www.w3.org/2000/09/xmldsig#dsa-sha1'
  `NAMEID_EMAIL_ADDRESS` = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
  `NAMEID_ENCRYPTED` = 'urn:oasis:names:tc:SAML:2.0:nameid-format:encrypted'
  `NAMEID_ENTITY` = 'urn:oasis:names:tc:SAML:2.0:nameid-format:entity'
  `NAMEID_KERBEROS` = 'urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos'
  `NAMEID_PERSISTENT` = 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
  `NAMEID_TRANSIENT` = 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
  `NAMEID_UNSPECIFIED` = 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'
  `NAMEID_WINDOWS_DOMAIN_QUALIFIED_NAME` = 'urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName'
  `NAMEID_X509_SUBJECT_NAME` = 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName'
  `NSMAP` = {'ds': 'http://www.w3.org/2000/09/xmldsig#', 'md': 'urn:oasis:names:tc:SAML:2.0:metadata', 'saml': 'urn:oasis:names:tc:SAML:2.0:assertion', 'samlp': 'urn:oasis:names:tc:SAML:2.0:protocol', 'xenc': 'http://www.w3.org/2001/04/xmlenc#'}
  `NS_DS` = 'http://www.w3.org/2000/09/xmldsig#'
  `NS_MD` = 'urn:oasis:names:tc:SAML:2.0:metadata'
  `NS_PREFIX_DS` = 'ds'
  `NS_PREFIX_MD` = 'md'
  `NS_PREFIX_SAML` = 'saml'
  `NS_PREFIX_SAMLP` = 'samlp'
  `NS_PREFIX_XENC` = 'xenc'
  `NS_PREFIX_XS` = 'xs'
  `NS_PREFIX_XSI` = 'xsi'
  `NS_SAML` = 'urn:oasis:names:tc:SAML:2.0:assertion'
  `NS_SAMLP` = 'urn:oasis:names:tc:SAML:2.0:protocol'
  `NS_SOAP` = 'http://schemas.xmlsoap.org/soap/envelope/'
  `NS_XENC` = 'http://www.w3.org/2001/04/xmlenc#'
  `NS_XS` = 'http://www.w3.org/2001/XMLSchema'
  `NS_XSI` = 'http://www.w3.org/2001/XMLSchema-instance'
  `RSA_1_5` = 'http://www.w3.org/2001/04/xmlenc#rsa-1_5'
  `RSA_OAEP_MGF1P` = 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p'
  `RSA_SHA1` = 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'
  `RSA_SHA256` = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
  `RSA_SHA384` = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384'
  `RSA_SHA512` = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'
  `SHA1` = 'http://www.w3.org/2000/09/xmldsig#sha1'
  `SHA256` = 'http://www.w3.org/2001/04/xmlenc#sha256'
  `SHA384` = 'http://www.w3.org/2001/04/xmldsig-more#sha384'
  `SHA512` = 'http://www.w3.org/2001/04/xmlenc#sha512'
  `STATUS_NO_PASSIVE` = 'urn:oasis:names:tc:SAML:2.0:status:NoPassive'
  `STATUS_PARTIAL_LOGOUT` = 'urn:oasis:names:tc:SAML:2.0:status:PartialLogout'
  `STATUS_PROXY_COUNT_EXCEEDED` = 'urn:oasis:names:tc:SAML:2.0:status:ProxyCountExceeded'
  `STATUS_REQUESTER` = 'urn:oasis:names:tc:SAML:2.0:status:Requester'
  `STATUS_RESPONDER` = 'urn:oasis:names:tc:SAML:2.0:status:Responder'
  `STATUS_SUCCESS` = 'urn:oasis:names:tc:SAML:2.0:status:Success'
  `STATUS_VERSION_MISMATCH` = 'urn:oasis:names:tc:SAML:2.0:status:VersionMismatch'
  `TRIPLEDES_CBC` = 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc'
  `XML` = 'http://www.w3.org/XML/1998/namespace'
  `XSI` = 'http://www.w3.org/2001/XMLSchema-instance'

## onelogin.saml2.errors module

OneLogin_Saml2_Error class

MIT License

Error class of Python Toolkit.

Defines common Error codes and has a custom initializator.

exception `onelogin.saml2.errors.``OneLogin_Saml2_Error`(message, code=0, errors=None)

  Bases: `exceptions.Exception`

  This class implements a custom Exception handler. Defines custom error codes.

  `CERT_NOT_FOUND` = 4
  `METADATA_SP_INVALID` = 3
  `PRIVATE_KEY_FILE_NOT_FOUND` = 7
  `PRIVATE_KEY_NOT_FOUND` = 13
  `PUBLIC_CERT_FILE_NOT_FOUND` = 6
  `REDIRECT_INVALID_URL` = 5
  `SAML_LOGOUTMESSAGE_NOT_FOUND` = 9
  `SAML_LOGOUTREQUEST_INVALID` = 10
  `SAML_LOGOUTRESPONSE_INVALID` = 11
  `SAML_RESPONSE_NOT_FOUND` = 8
  `SAML_SINGLE_LOGOUT_NOT_SUPPORTED` = 12
  `SETTINGS_FILE_NOT_FOUND` = 0
  `SETTINGS_INVALID` = 2
  `SETTINGS_INVALID_SYNTAX` = 1
  `SP_CERTS_NOT_FOUND` = 4
  `UNSUPPORTED_SETTINGS_OBJECT` = 14

exception `onelogin.saml2.errors.``OneLogin_Saml2_ValidationError`(message, code=0, errors=None)

  Bases: `exceptions.Exception`

  This class implements another custom Exception handler, related to exceptions that happens during validation process. Defines custom error codes .

  `ASSERTION_EXPIRED` = 20
  `ASSERTION_TOO_EARLY` = 19
  `AUTHN_CONTEXT_MISMATCH` = 45
  `CHILDREN_NODE_NOT_FOUND_IN_KEYINFO` = 36
  `DEPRECATED_DIGEST_METHOD` = 47
  `DEPRECATED_SIGNATURE_METHOD` = 46
  `DUPLICATED_ATTRIBUTE_NAME_FOUND` = 41
  `DUPLICATED_ID_IN_SIGNED_ELEMENTS` = 8
  `DUPLICATED_REFERENCE_IN_SIGNED_ELEMENTS` = 10
  `EMPTY_DESTINATION` = 25
  `EMPTY_NAMEID` = 39
  `ENCRYPTED_ATTRIBUTES` = 23
  `ID_NOT_FOUND_IN_SIGNED_ELEMENT` = 7
  `INVALID_SIGNATURE` = 42
  `INVALID_SIGNED_ELEMENT` = 9
  `INVALID_XML_FORMAT` = 14
  `ISSUER_MULTIPLE_IN_RESPONSE` = 27
  `ISSUER_NOT_FOUND_IN_ASSERTION` = 28
  `KEYINFO_NOT_FOUND_IN_ENCRYPTED_DATA` = 35
  `MISSING_CONDITIONS` = 18
  `MISSING_ID` = 1
  `MISSING_STATUS` = 3
  `MISSING_STATUS_CODE` = 4
  `NO_ATTRIBUTESTATEMENT` = 22
  `NO_ENCRYPTED_ASSERTION` = 16
  `NO_ENCRYPTED_NAMEID` = 17
  `NO_NAMEID` = 38
  `NO_SIGNATURE_FOUND` = 34
  `NO_SIGNED_ASSERTION` = 33
  `NO_SIGNED_MESSAGE` = 32
  `RESPONSE_EXPIRED` = 44
  `SESSION_EXPIRED` = 30
  `SP_NAME_QUALIFIER_NAME_MISMATCH` = 40
  `STATUS_CODE_IS_NOT_SUCCESS` = 5
  `UNEXPECTED_SIGNED_ELEMENTS` = 11
  `UNSUPPORTED_RETRIEVAL_METHOD` = 37
  `UNSUPPORTED_SAML_VERSION` = 0
  `WRONG_AUDIENCE` = 26
  `WRONG_DESTINATION` = 24
  `WRONG_INRESPONSETO` = 15
  `WRONG_ISSUER` = 29
  `WRONG_NUMBER_OF_ASSERTIONS` = 2
  `WRONG_NUMBER_OF_AUTHSTATEMENTS` = 21
  `WRONG_NUMBER_OF_SIGNATURES` = 43
  `WRONG_NUMBER_OF_SIGNATURES_IN_ASSERTION` = 13
  `WRONG_NUMBER_OF_SIGNATURES_IN_RESPONSE` = 12
  `WRONG_SIGNED_ELEMENT` = 6
  `WRONG_SUBJECTCONFIRMATION` = 31

## onelogin.saml2.idp_metadata_parser module

OneLogin_Saml2_IdPMetadataParser class

MIT License

Metadata class of Python Toolkit.

class `onelogin.saml2.idp_metadata_parser.``OneLogin_Saml2_IdPMetadataParser`

  Bases: `object`

  A class that contain methods related to obtaining and parsing metadata from IdP

  This class does not validate in any way the URL that is introduced, make sure to validate it properly before use it in a get_metadata method.

  static `get_metadata`(url, validate_cert=True)

    Gets the metadata XML from the provided URL

    Parameters: | url (string) – Url where the XML of the Identity Provider Metadata is published. validate_cert (bool) – If the url uses https schema, that flag enables or not the verification of the associated certificate.
    Returns: | metadata XML
    Return type: | string

  static `merge_settings`(settings, new_metadata_settings)

    Will update the settings with the provided new settings data extracted from the IdP metadata

    Parameters: | settings (dict) – Current settings dict data new_metadata_settings (dict) – Settings to be merged (extracted from IdP metadata after parsing)
    Returns: | merged settings
    Return type: | dict

  static `parse`(idp_metadata, required_sso_binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect', required_slo_binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect', entity_id=None)

    Parse the Identity Provider metadata and return a dict with extracted data.

    If there are multiple <IDPSSODescriptor> tags, parse only the first.

    Parse only those SSO endpoints with the same binding as given by the required_sso_binding parameter.

    Parse only those SLO endpoints with the same binding as given by the required_slo_binding parameter.

    If the metadata specifies multiple SSO endpoints with the required binding, extract only the first (the same holds true for SLO endpoints).

    Parameters: | idp_metadata (string) – XML of the Identity Provider Metadata. required_sso_binding (one of OneLogin_Saml2_Constants.BINDING_HTTP_REDIRECT or OneLogin_Saml2_Constants.BINDING_HTTP_POST) – Parse only POST or REDIRECT SSO endpoints. required_slo_binding (one of OneLogin_Saml2_Constants.BINDING_HTTP_REDIRECT or OneLogin_Saml2_Constants.BINDING_HTTP_POST) – Parse only POST or REDIRECT SLO endpoints. entity_id (string) – Specify the entity_id of the EntityDescriptor that you want to parse a XML that contains multiple EntityDescriptor.
    Returns: | settings dict with extracted data
    Return type: | dict

  static `parse_remote`(url, validate_cert=True, entity_id=None, **kwargs)

    Gets the metadata XML from the provided URL and parse it, returning a dict with extracted data

    Parameters: | url (string) – Url where the XML of the Identity Provider Metadata is published. validate_cert (bool) – If the url uses https schema, that flag enables or not the verification of the associated certificate. entity_id (string) – Specify the entity_id of the EntityDescriptor that you want to parse a XML that contains multiple EntityDescriptor.
    Returns: | settings dict with extracted data
    Return type: | dict

`onelogin.saml2.idp_metadata_parser.``dict_deep_merge`(lhs, rhs)

  Deep-merge dictionary rhs into dictionary lhs.

## onelogin.saml2.logout_request module

OneLogin_Saml2_Logout_Request class

MIT License

Logout Request class of Python Toolkit.

class `onelogin.saml2.logout_request.``OneLogin_Saml2_Logout_Request`(settings, request=None, name_id=None, session_index=None, nq=None, name_id_format=None, spnq=None)

  Bases: `object`

  This class handles a Logout Request.

  Builds a Logout Response object and validates it.

  `get_error`()

    After executing a validation process, if it fails this method returns the cause

  static `get_id`(request)

    Returns the ID of the Logout Request :param request: Logout Request Message :type request: string|DOMDocument :return: string ID :rtype: str object

  static `get_issuer`(request)

    Gets the Issuer of the Logout Request Message :param request: Logout Request Message :type request: string|DOMDocument :return: The Issuer :rtype: string

  static `get_nameid`(request, key=None)

    Gets the NameID of the Logout Request Message :param request: Logout Request Message :type request: string|DOMDocument :param key: The SP key :type key: string :return: Name ID Value :rtype: string

  static `get_nameid_data`(request, key=None)

    Gets the NameID Data of the the Logout Request :param request: Logout Request Message :type request: string|DOMDocument :param key: The SP key :type key: string :return: Name ID Data (Value, Format, NameQualifier, SPNameQualifier) :rtype: dict

  static `get_nameid_format`(request, key=None)

    Gets the NameID Format of the Logout Request Message :param request: Logout Request Message :type request: string|DOMDocument :param key: The SP key :type key: string :return: Name ID Value :rtype: string

  `get_request`(deflate=True)

    Returns the Logout Request deflated, base64encoded :param deflate: It makes the deflate process optional :type: bool :return: Logout Request maybe deflated and base64 encoded :rtype: str object

  static `get_session_indexes`(request)

    Gets the SessionIndexes from the Logout Request :param request: Logout Request Message :type request: string|DOMDocument :return: The SessionIndex value :rtype: list

  `get_xml`()

    Returns the XML that will be sent as part of the request or that was received at the SP :return: XML request body :rtype: string

  `is_valid`(request_data, raise_exceptions=False)

    Checks if the Logout Request received is valid :param request_data: Request Data :type request_data: dict :param raise_exceptions: Whether to return false on failure or raise an exception :type raise_exceptions: Boolean :return: If the Logout Request is or not valid :rtype: boolean

## onelogin.saml2.logout_response module

OneLogin_Saml2_Logout_Response class

MIT License

Logout Response class of Python Toolkit.

class `onelogin.saml2.logout_response.``OneLogin_Saml2_Logout_Response`(settings, response=None)

  Bases: `object`

  This class handles a Logout Response. It Builds or parses a Logout Response object and validates it.

  `build`(in_response_to)

    Creates a Logout Response object. :param in_response_to: InResponseTo value for the Logout Response. :type in_response_to: string

  `get_error`()

    After executing a validation process, if it fails this method returns the cause

  `get_in_response_to`()

    Gets the ID of the LogoutRequest which this response is in response to :returns: ID of LogoutRequest this LogoutResponse is in response to or None if it is not present :rtype: str

  `get_issuer`()

    Gets the Issuer of the Logout Response Message :return: The Issuer :rtype: string

  `get_response`(deflate=True)

    Returns the Logout Response defated, base64encoded :param deflate: It makes the deflate process optional :type: bool :return: Logout Response maybe deflated and base64 encoded :rtype: string

  `get_status`()

    Gets the Status :return: The Status :rtype: string

  `get_xml`()

    Returns the XML that will be sent as part of the response or that was received at the SP :return: XML response body :rtype: string

  `is_valid`(request_data, request_id=None, raise_exceptions=False)

    Determines if the SAML LogoutResponse is valid :param request_id: The ID of the LogoutRequest sent by this SP to the IdP :type request_id: string :param raise_exceptions: Whether to return false on failure or raise an exception :type raise_exceptions: Boolean :return: Returns if the SAML LogoutResponse is or not valid :rtype: boolean

## onelogin.saml2.metadata module

OneLogin_Saml2_Metadata class

MIT License

Metadata class of Python Toolkit.

class `onelogin.saml2.metadata.``OneLogin_Saml2_Metadata`

  Bases: `object`

  A class that contains methods related to the metadata of the SP

  `TIME_CACHED` = 604800
  `TIME_VALID` = 172800
  static `add_x509_key_descriptors`(metadata, cert=None, add_encryption=True)

    Adds the x509 descriptors (sign/encryption) to the metadata The same cert will be used for sign/encrypt

    Parameters: | metadata (string) – SAML Metadata XML cert (string) – x509 cert add_encryption (boolean) – Determines if the KeyDescriptor[use=”encryption”] should be added.
    Returns: | Metadata with KeyDescriptors
    Return type: | string

  static `builder`(sp, authnsign=False, wsign=False, valid_until=None, cache_duration=None, contacts=None, organization=None)

    Builds the metadata of the SP

    Parameters: | sp (string) – The SP data authnsign (string) – authnRequestsSigned attribute wsign (string) – wantAssertionsSigned attribute valid_until (string|DateTime|Timestamp) – Metadata’s expiry date cache_duration (int|string) – Duration of the cache in seconds contacts (dict) – Contacts info organization (dict) – Organization info

  static `sign_metadata`(metadata, key, cert, sign_algorithm='http://www.w3.org/2001/04/xmldsig-more#rsa-sha256', digest_algorithm='http://www.w3.org/2001/04/xmlenc#sha256')

    Signs the metadata with the key/cert provided

    Parameters: | metadata (string) – SAML Metadata XML key (string) – x509 key cert (string) – x509 cert sign_algorithm (string) – Signature algorithm method digest_algorithm (string) – Digest algorithm method
    Returns: | Signed Metadata
    Return type: | string

## onelogin.saml2.response module

OneLogin_Saml2_Response class

MIT License

SAML Response class of Python Toolkit.

class `onelogin.saml2.response.``OneLogin_Saml2_Response`(settings, response)

  Bases: `object`

  This class handles a SAML Response. It parses or validates a Logout Response object.

  `check_one_authnstatement`()

    Checks that the samlp:Response/saml:Assertion/saml:AuthnStatement element exists and is unique.

  `check_one_condition`()

    Checks that the samlp:Response/saml:Assertion/saml:Conditions element exists and is unique.

  `check_status`()

    Check if the status of the response is success or not

    Raises: | Exception. If the status is not success

  `get_assertion_id`()

    Returns: | the ID of the assertion in the response
    Return type: | string

  `get_assertion_not_on_or_after`()

    Returns the NotOnOrAfter value of the valid SubjectConfirmationData node if any

  `get_attributes`()

    Gets the Attributes from the AttributeStatement element. EncryptedAttributes are not supported

  `get_audiences`()

    Gets the audiences

    Returns: | The valid audiences for the SAML Response
    Return type: | list

  `get_authn_contexts`()
    Gets the authentication contexts

      returns: | The authentication classes for the SAML Response

    Return type: | list

  `get_error`()

    After executing a validation process, if it fails this method returns the cause

  `get_friendlyname_attributes`()

    Gets the Attributes from the AttributeStatement element indexed by FiendlyName. EncryptedAttributes are not supported

  `get_id`()

    Returns: | the ID of the response
    Return type: | string

  `get_in_response_to`()

    Gets the ID of the request which this response is in response to :returns: ID of AuthNRequest this Response is in response to or None if it is not present :rtype: str

  `get_issuers`()

    Gets the issuers (from message and from assertion)

    Returns: | The issuers
    Return type: | list

  `get_nameid`()

    Gets the NameID provided by the SAML Response from the IdP

    Returns: | NameID (value)
    Return type: | string|None

  `get_nameid_data`()

    Gets the NameID Data provided by the SAML Response from the IdP

    Returns: | Name ID Data (Value, Format, NameQualifier, SPNameQualifier)
    Return type: | dict

  `get_nameid_format`()

    Gets the NameID Format provided by the SAML Response from the IdP

    Returns: | NameID Format
    Return type: | string|None

  `get_nameid_nq`()

    Gets the NameID NameQualifier provided by the SAML Response from the IdP

    Returns: | NameID NameQualifier
    Return type: | string|None

  `get_nameid_spnq`()

    Gets the NameID SP NameQualifier provided by the SAML response from the IdP.

    Returns: | NameID SP NameQualifier
    Return type: | string|None

  `get_session_index`()

    Gets the SessionIndex from the AuthnStatement Could be used to be stored in the local session in order to be used in a future Logout Request that the SP could send to the SP, to set what specific session must be deleted

    Returns: | The SessionIndex value
    Return type: | string|None

  `get_session_not_on_or_after`()

    Gets the SessionNotOnOrAfter from the AuthnStatement Could be used to set the local session expiration

    Returns: | The SessionNotOnOrAfter value
    Return type: | time|None

  `get_xml_document`()

    Returns the SAML Response document (If contains an encrypted assertion, decrypts it)

    Returns: | Decrypted XML response document
    Return type: | DOMDocument

  `is_valid`(request_data, request_id=None, raise_exceptions=False)

    Validates the response object.

    Parameters: | request_data (dict) – Request Data request_id (string) – Optional argument. The ID of the AuthNRequest sent by this SP to the IdP raise_exceptions (Boolean) – Whether to return false on failure or raise an exception
    Returns: | True if the SAML Response is valid, False if not
    Return type: | bool

  `process_signed_elements`()
    Verifies the signature nodes:
      - Checks that are Response or Assertion
      - Check that IDs and reference URI are unique and consistent.

    Returns: | The signed elements tag names
    Return type: | list

  `validate_num_assertions`()

    Verifies that the document only contains a single Assertion (encrypted or not)

    Returns: | True if only 1 assertion encrypted or not
    Return type: | bool

  `validate_signed_elements`(**kwargs)

    Verifies that the document has the expected signed nodes.

    Parameters: | signed_elements (list) – The signed elements to be checked raise_exceptions (Boolean) – Whether to return false on failure or raise an exception

  `validate_timestamps`(**kwargs)

    Verifies that the document is valid according to Conditions Element

    Parameters: | raise_exceptions (Boolean) – Whether to return false on failure or raise an exception
    Returns: | True if the condition is valid, False otherwise
    Return type: | bool

## onelogin.saml2.settings module

OneLogin_Saml2_Settings class

MIT License

Setting class of Python Toolkit.

class `onelogin.saml2.settings.``OneLogin_Saml2_Settings`(settings=None, custom_base_path=None, sp_validation_only=False)

  Bases: `object`

  Handles the settings of the Python toolkits.

  `check_idp_settings`(settings)

    Checks the IdP settings info.

    Parameters: | settings (dict) – Dict with settings data
    Returns: | Errors found on the IdP settings data
    Return type: | list

  `check_settings`(settings)

    Checks the settings info.

    Parameters: | settings (dict) – Dict with settings data
    Returns: | Errors found on the settings data
    Return type: | list

  `check_sp_certs`()

    Checks if the x509 certs of the SP exists and are valid.

    Returns: | If the x509 certs of the SP exists and are valid
    Return type: | boolean

  `check_sp_settings`(settings)

    Checks the SP settings info.

    Parameters: | settings (dict) – Dict with settings data
    Returns: | Errors found on the SP settings data
    Return type: | list

  `format_idp_cert`()

    Formats the IdP cert.

  `format_idp_cert_multi`()

    Formats the Multple IdP certs.

  `format_sp_cert`()

    Formats the SP cert.

  `format_sp_cert_new`()

    Formats the SP cert.

  `format_sp_key`()

    Formats the private key.

  `get_base_path`()

    Returns base path

    Returns: | The base toolkit folder path
    Return type: | string

  `get_cert_path`()

    Returns cert path

    Returns: | The cert folder path
    Return type: | string

  `get_contacts`()

    Gets contact data.

    Returns: | Contacts info
    Return type: | dict

  `get_errors`()

    Returns an array with the errors, the array is empty when the settings is ok.

    Returns: | Errors
    Return type: | list

  `get_idp_cert`()

    Returns the x509 public cert of the IdP.

    Returns: | IdP public cert
    Return type: | string

  `get_idp_data`()

    Gets the IdP data.

    Returns: | IdP info
    Return type: | dict

  `get_idp_slo_response_url`()

    Gets the IdP SLO return URL for IdP-initiated logout.

    Returns: | an URL, the SLO return endpoint of the IdP
    Return type: | string

  `get_idp_slo_url`()

    Gets the IdP SLO URL.

    Returns: | An URL, the SLO endpoint of the IdP
    Return type: | string

  `get_idp_sso_url`()

    Gets the IdP SSO URL.

    Returns: | An URL, the SSO endpoint of the IdP
    Return type: | string

  `get_lib_path`()

    Returns lib path

    Returns: | The library folder path
    Return type: | string

  `get_organization`()

    Gets organization data.

    Returns: | Organization info
    Return type: | dict

  `get_schemas_path`()

    Returns schema path

    Returns: | The schema folder path
    Return type: | string

  `get_security_data`()

    Gets security data.

    Returns: | Security info
    Return type: | dict

  `get_sp_cert`()

    Returns the x509 public cert of the SP.

    Returns: | SP public cert
    Return type: | string or None

  `get_sp_cert_new`()

    Returns the x509 public of the SP planned to be used soon instead the other public cert

    Returns: | SP public cert new
    Return type: | string or None

  `get_sp_data`()

    Gets the SP data.

    Returns: | SP info
    Return type: | dict

  `get_sp_key`()

    Returns the x509 private key of the SP.

    Returns: | SP private key
    Return type: | string or None

  `get_sp_metadata`()

    Gets the SP metadata. The XML representation.

    Returns: | SP metadata (xml)
    Return type: | string

  `is_debug_active`()

    Returns if the debug is active.

    Returns: | Debug parameter
    Return type: | boolean

  `is_strict`()

    Returns if the ‘strict’ mode is active.

    Returns: | Strict parameter
    Return type: | boolean

  `set_cert_path`(path)

    Set a new cert path

  `set_strict`(value)

    Activates or deactivates the strict mode.

    Parameters: | value – Strict parameter

  `validate_metadata`(xml)

    Validates an XML SP Metadata.

    Parameters: | xml (string) – Metadata’s XML that will be validate
    Returns: | The list of found errors
    Return type: | list

`onelogin.saml2.settings.``validate_url`(url, allow_single_label_domain=False)

  Auxiliary method to validate an urllib :param url: An url to be validated :type url: string :param allow_single_label_domain: In order to allow or not single label domain :type url: bool :returns: True if the url is valid :rtype: bool

## onelogin.saml2.utils module

OneLogin_Saml2_Utils class

MIT License

Auxiliary class of Python Toolkit.

class `onelogin.saml2.utils.``OneLogin_Saml2_Utils`

  Bases: `object`

  Auxiliary class that contains several utility methods to parse time, urls, add sign, encrypt, decrypt, sign validation, handle xml …

  `ASSERTION_SIGNATURE_XPATH` = '/samlp:Response/saml:Assertion/ds:Signature'
  `RESPONSE_SIGNATURE_XPATH` = '/samlp:Response/ds:Signature'
  `TIME_FORMAT` = '%Y-%m-%dT%H:%M:%SZ'
  `TIME_FORMAT_2` = '%Y-%m-%dT%H:%M:%S.%fZ'
  `TIME_FORMAT_WITH_FRAGMENT` = <_sre.SRE_Pattern object>
  static `add_sign`(xml, key, cert, debug=False, sign_algorithm='http://www.w3.org/2001/04/xmldsig-more#rsa-sha256', digest_algorithm='http://www.w3.org/2001/04/xmlenc#sha256')

    Adds signature key and senders certificate to an element (Message or Assertion).

    Parameters: | xml – The element we should sign key – The private key cert – The public debug – Activate the xmlsec debug sign_algorithm (string) – Signature algorithm method digest_algorithm (string) – Digest algorithm method
    Type: | string | Document
    Type: | string
    Type: | string
    Type: | bool
    Returns: | Signed XML
    Return type: | string

  static `calculate_x509_fingerprint`(x509_cert, alg='sha1')

    Calculates the fingerprint of a formatted x509cert.

    Parameters: | x509_cert – x509 cert formatted alg – The algorithm to build the fingerprint
    Type: | string
    Type: | string
    Returns: | fingerprint
    Return type: | string

  static `case_sensitive_urlencode`(to_encode, lowercase=False)
  static `decode_base64_and_inflate`(value)

    base64 decodes and then inflates according to RFC1951 :param value: a deflated and encoded string :type value: string :returns: the string after decoding and inflating :rtype: string

  static `decrypt_element`(encrypted_data, key, debug=False, inplace=False)

    Decrypts an encrypted element.

    Parameters: | encrypted_data – The encrypted data. key – The key. debug – Activate the xmlsec debug inplace – update passed data with decrypted result
    Type: | lxml.etree.Element | DOMElement | basestring
    Type: | string
    Type: | bool
    Type: | bool
    Returns: | The decrypted element.
    Return type: | lxml.etree.Element

  static `deflate_and_base64_encode`(value)

    Deflates and then base64 encodes a string :param value: The string to deflate and encode :type value: string :returns: The deflated and encoded string :rtype: string

  static `delete_local_session`(callback=None)

    Deletes the local session.

  static `element_text`(node)
  static `extract_raw_query_parameter`(query_string, parameter, default='')
  static `format_cert`(cert, heads=True)

    Returns a x509 cert (adding header & footer if required).

    Parameters: | cert – A x509 unformatted cert heads – True if we want to include head and footer
    Type: | string
    Type: | boolean
    Returns: | Formatted cert
    Return type: | string

  static `format_finger_print`(fingerprint)

    Formats a fingerprint.

    Parameters: | fingerprint – fingerprint
    Type: | string
    Returns: | Formatted fingerprint
    Return type: | string

  static `format_private_key`(key, heads=True)

    Returns a private key (adding header & footer if required).

    :param key A private key :type: string

    Parameters: | heads – True if we want to include head and footer
    Type: | boolean
    Returns: | Formatted private key
    Return type: | string

  static `generate_name_id`(value, sp_nq, sp_format=None, cert=None, debug=False, nq=None)

    Generates a nameID.

    Parameters: | value – fingerprint sp_nq – SP Name Qualifier sp_format – SP Format cert – IdP Public Cert to encrypt the nameID debug – Activate the xmlsec debug nq – IDP Name Qualifier
    Type: | string
    Type: | string
    Type: | string
    Type: | string
    Type: | bool
    Type: | string
    Returns: | DOMElement | XMLSec nameID
    Return type: | string

  static `generate_unique_id`()

    Generates an unique string (used for example as ID for assertions).

    Returns: | A unique string
    Return type: | string

  static `get_encoded_parameter`(get_data, name, default=None, lowercase_urlencoding=False)

    Return a URL encoded get parameter value Prefer to extract the original encoded value directly from query_string since URL encoding is not canonical. The encoding used by ADFS 3.0 is not compatible with python’s quote_plus (ADFS produces lower case hex numbers and quote_plus produces upper case hex numbers)

  static `get_expire_time`(cache_duration=None, valid_until=None)

    Compares 2 dates and returns the earliest.

    Parameters: | cache_duration – The duration, as a string. valid_until – The valid until date, as a string or as a timestamp
    Type: | string
    Type: | string
    Returns: | The expiration time.
    Return type: | int

  static `get_self_host`(request_data)

    Returns the current host.

    Parameters: | request_data – The request as a dict
    Type: | dict
    Returns: | The current host
    Return type: | string

  static `get_self_routed_url_no_query`(request_data)

    Returns the routed URL of the current host + current view.

    Parameters: | request_data – The request as a dict
    Type: | dict
    Returns: | The url of current host + current view
    Return type: | string

  static `get_self_url`(request_data)

    Returns the URL of the current host + current view + query.

    Parameters: | request_data – The request as a dict
    Type: | dict
    Returns: | The url of current host + current view + query
    Return type: | string

  static `get_self_url_host`(request_data)

    Returns the protocol + the current host + the port (if different than common ports).

    Parameters: | request_data – The request as a dict
    Type: | dict
    Returns: | Url
    Return type: | string

  static `get_self_url_no_query`(request_data)

    Returns the URL of the current host + current view.

    Parameters: | request_data – The request as a dict
    Type: | dict
    Returns: | The url of current host + current view
    Return type: | string

  static `get_status`(dom)

    Gets Status from a Response.

    Parameters: | dom – The Response as XML
    Type: | Document
    Returns: | The Status, an array with the code and a message.
    Return type: | dict

  static `is_https`(request_data)

    Checks if https or http.

    Parameters: | request_data – The request as a dict
    Type: | dict
    Returns: | False if https is not active
    Return type: | boolean

  static `normalize_url`(url)

    Returns normalized URL for comparison. This method converts the netloc to lowercase, as it should be case-insensitive (per RFC 4343, RFC 7617) If standardization fails, the original URL is returned Python documentation indicates that URL split also normalizes query strings if empty query fields are present

    Parameters: | url (String) – URL
    Returns: | A normalized URL, or the given URL string if parsing fails
    Return type: | String

  static `now`()

    Returns: | unix timestamp of actual time.
    Return type: | int

  static `parse_SAML_to_time`(timestr)

    Converts a SAML2 timestamp on the form yyyy-mm-ddThh:mm:ss(.s+)?Z to a UNIX timestamp. The sub-second part is ignored.

    Parameters: | time – The time we should convert (SAML Timestamp).
    Type: | string
    Returns: | Converted to a unix timestamp.
    Return type: | int

  static `parse_duration`(duration, timestamp=None)

    Interprets a ISO8601 duration value relative to a given timestamp.

    Parameters: | duration – The duration, as a string. timestamp – The unix timestamp we should apply the duration to. Optional, default to the current time.
    Type: | string
    Type: | string
    Returns: | The new timestamp, after the duration is applied.
    Return type: | int

  static `parse_time_to_SAML`(time)

    Converts a UNIX timestamp to SAML2 timestamp on the form yyyy-mm-ddThh:mm:ss(.s+)?Z.

    Parameters: | time – The time we should convert (DateTime).
    Type: | string
    Returns: | SAML2 timestamp.
    Return type: | string

  static `query`(dom, query, context=None, tagid=None)

    Extracts nodes that match the query from the Element

    Parameters: | dom – The root of the lxml objet query – Xpath Expresion context – Context Node tagid – Tag ID
    Type: | Element
    Type: | string
    Type: | DOMElement
    Type: | string
    Returns: | The queried nodes
    Return type: | list

  static `redirect`(url, parameters={}, request_data={})

    Executes a redirection to the provided url (or return the target url).

    Parameters: | url – The target url parameters – Extra parameters to be passed as part of the url request_data – The request as a dict
    Type: | string
    Type: | dict
    Type: | dict
    Returns: | Url
    Return type: | string

  static `validate_binary_sign`(*args, **kwargs)

    Validates signed binary data (Used to validate GET Signature).

    Parameters: | signed_query – The element we should validate signature – The signature that will be validate cert – The public cert algorithm – Signature algorithm debug – Activate the xmlsec debug raise_exceptions (Boolean) – Whether to return false on failure or raise an exception
    Type: | string
    Type: | string
    Type: | string
    Type: | string
    Type: | bool

  static `validate_metadata_sign`(*args, **kwargs)

    Validates a signature of a EntityDescriptor.

    Parameters: | xml – The element we should validate cert – The pubic cert fingerprint – The fingerprint of the public cert fingerprintalg – The algorithm used to build the fingerprint validatecert – If true, will verify the signature and if the cert is valid. debug – Activate the xmlsec debug raise_exceptions (Boolean) – Whether to return false on failure or raise an exception
    Type: | string | Document
    Type: | string
    Type: | string
    Type: | string
    Type: | bool
    Type: | bool

  static `validate_node_sign`(*args, **kwargs)

    Validates a signature node.

    Parameters: | signature_node – The signature node xml – The element we should validate cert – The public cert fingerprint – The fingerprint of the public cert fingerprintalg – The algorithm used to build the fingerprint validatecert – If true, will verify the signature and if the cert is valid. debug – Activate the xmlsec debug raise_exceptions (Boolean) – Whether to return false on failure or raise an exception
    Type: | Node
    Type: | Document
    Type: | string
    Type: | string
    Type: | string
    Type: | bool
    Type: | bool

  static `validate_sign`(*args, **kwargs)

    Validates a signature (Message or Assertion).

    Parameters: | xml – The element we should validate cert – The pubic cert fingerprint – The fingerprint of the public cert fingerprintalg – The algorithm used to build the fingerprint validatecert – If true, will verify the signature and if the cert is valid. debug – Activate the xmlsec debug xpath – The xpath of the signed element multicerts – Multiple public certs raise_exceptions (Boolean) – Whether to return false on failure or raise an exception
    Type: | string | Document
    Type: | string
    Type: | string
    Type: | string
    Type: | bool
    Type: | bool
    Type: | string
    Type: | list

  static `validate_xml`(xml, schema, debug=False)

    Validates a xml against a schema :param xml: The xml that will be validated :type: string|DomDocument :param schema: The schema :type: string :param debug: If debug is active, the parse-errors will be showed :type: bool :returns: Error code or the DomDocument of the xml :rtype: string

  static `write_temp_file`(content)

    Writes some content into a temporary file and returns it.

    Parameters: | content – The file content
    Type: | string
    Returns: | The temporary file
    Return type: | file-like object

`onelogin.saml2.utils.``print_xmlsec_errors`(filename, line, func, error_object, error_subject, reason, msg)

  Auxiliary method. It overrides the default xmlsec debug message.

`onelogin.saml2.utils.``return_false_on_exception`(func)

  Decorator. When applied to a function, it will, by default, suppress any exceptions raised by that function and return False. It may be overridden by passing a “raise_exceptions” keyword argument when calling the wrapped function.

## onelogin.saml2.xmlparser module

lxml.etree protection

class `onelogin.saml2.xmlparser.``GlobalParserTLS`

  Bases: `thread._local`

  Thread local context for custom parser instances

  `createDefaultParser`()
  `element_class`

    alias of `RestrictedElement`

  `getDefaultParser`()
  `parser_config` = {'huge_tree': False, 'no_network': True, 'remove_comments': True, 'remove_pis': True, 'resolve_entities': False}
  `setDefaultParser`(parser)

class `onelogin.saml2.xmlparser.``RestrictedElement`

  Bases: `lxml.etree.ElementBase`

  A restricted Element class that filters out instances of some classes

  `blacklist` = (<type 'lxml.etree._Entity'>, <type 'lxml.etree._ProcessingInstruction'>, <type 'lxml.etree._Comment'>)
  `getchildren`(self)

    Returns all direct children. The elements are returned in document order.

    Deprecated: | Note that this method has been deprecated as of ElementTree 1.3 and lxml 2.0. New code should use `list(element)` or simply iterate over elements.

  `getiterator`(self, tag=None, *tags)

    Returns a sequence or iterator of all elements in the subtree in document order (depth first pre-order), starting with this element.

    Can be restricted to find only elements with specific tags, see iter.

    Deprecated: | Note that this method is deprecated as of ElementTree 1.3 and lxml 2.0. It returns an iterator in lxml, which diverges from the original ElementTree behaviour. If you want an efficient iterator, use the `element.iter()` method instead. You should only use this method in new code if you require backwards compatibility with older versions of lxml or ElementTree.

  `iter`(self, tag=None, *tags)

    Iterate over all elements in the subtree in document order (depth first pre-order), starting with this element.

    Can be restricted to find only elements with specific tags: pass `"{ns}localname"` as tag. Either or both of `ns` and `localname` can be `*` for a wildcard; `ns` can be empty for no namespace. `"localname"` is equivalent to `"{}localname"` (i.e. no namespace) but `"*"` is `"{*}*"` (any or no namespace), not `"{}*"`.

    You can also pass the Element, Comment, ProcessingInstruction and Entity factory functions to look only for the specific element type.

    Passing multiple tags (or a sequence of tags) instead of a single tag will let the iterator return all elements matching any of these tags, in document order.

  `iterchildren`(self, tag=None, *tags, reversed=False)

    Iterate over the children of this element.

    As opposed to using normal iteration on this element, the returned elements can be reversed with the ‘reversed’ keyword and restricted to find only elements with specific tags, see iter.

  `iterdescendants`(self, tag=None, *tags)

    Iterate over the descendants of this element in document order.

    As opposed to `el.iter()`, this iterator does not yield the element itself. The returned elements can be restricted to find only elements with specific tags, see iter.

  `itersiblings`(self, tag=None, *tags, preceding=False)

    Iterate over the following or preceding siblings of this element.

    The direction is determined by the ‘preceding’ keyword which defaults to False, i.e. forward iteration over the following siblings. When True, the iterator yields the preceding siblings in reverse document order, i.e. starting right before the current element and going backwards.

    Can be restricted to find only elements with specific tags, see iter.

`onelogin.saml2.xmlparser.``XML`(text, parser=None, base_url=None, forbid_dtd=True, forbid_entities=True)

`onelogin.saml2.xmlparser.``check_docinfo`(elementtree, forbid_dtd=False, forbid_entities=True)

  Check docinfo of an element tree for DTD and entity declarations The check for entity declarations needs lxml 3 or newer. lxml 2.x does not support dtd.iterentities().

`onelogin.saml2.xmlparser.``fromstring`(text, parser=None, base_url=None, forbid_dtd=True, forbid_entities=True)

`onelogin.saml2.xmlparser.``iterparse`(*args, **kwargs)

`onelogin.saml2.xmlparser.``parse`(source, parser=None, base_url=None, forbid_dtd=True, forbid_entities=True)

## Module contents

Copyright (c) 2010-2022 OneLogin, Inc. Copyright (c) 2023 IAM Digital Services, SL.

MIT License

Add SAML support to your Python softwares using this library. Forget those complicated libraries and use that open source library.

SAML Python toolkit let you build a SP (Service Provider) over your Python application and connect it to any IdP (Identity Provider).

Supports:

- SSO and SLO (SP-Initiated and IdP-Initiated).
- Assertion and nameId encryption.
- Assertion signature.
- Message signature: AuthNRequest, LogoutRequest, LogoutResponses.
- Enable an Assertion Consumer Service endpoint.
- Enable a Single Logout Service endpoint.
- Publish the SP metadata (which can be signed).