
    f                         d dl mZ d dlmZ d dlmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d Zd Zd Zd Zd Zd Zd Zd Zy)    )urlparse)cache)ImproperlyConfigured)Http404)reverse	urlencode)OneLogin_Saml2_Auth)OneLogin_Saml2_Constants) OneLogin_Saml2_IdPMetadataParser)get_adapter)	SocialApp)SAMLProviderc                     t               }	 |j                  | t        j                  |      S # t        j
                  $ r t        d|       w xY w)N)provider	client_idz"no SocialApp found with client_id=)r   get_appr   idr   DoesNotExistr   )requestorganization_slugadapters      e/var/www/cs2snipe.com/venv/lib/python3.12/site-packages/allauth/socialaccount/providers/saml/utils.pyget_app_or_404r      s_    mGPloo9J  
 	
 !! P:;L:MNOOPs	   !. "Ac                     | j                         rdnd| j                  d   | j                  d   | j                  j                         | j                  j                         d}|S )Nonoff	HTTP_HOST	PATH_INFO)https	http_hostscript_nameget_data	post_data)	is_secureMETAGETcopyPOST)r   results     r   prepare_django_requestr+      sX     **,%\\+.||K0KK$$&\\&&(F M    c                 >   | j                  t        d|g            }| j                  t        d|g            }| j                  t        d|g            }|j                  di       }|j                  d      }|xs ||t        j                  d|t        j
                  dd}|j                  d	i       }	|	j                  d
      |	d
   |d
<   |	j                  d      r|	d   |d<   |	j                  d      |	d   |d<   |	j                  d      |	d   |d<   |S )Nsaml_acs)argssaml_slssaml_metadatasp	entity_id)urlbinding)entityIdassertionConsumerServicesingleLogoutServiceadvancedx509certx509cert_newx509certNewprivate_key
privateKeyname_id_formatNameIDFormat)build_absolute_urir   getr   BINDING_HTTP_POSTBINDING_HTTP_REDIRECT)
r   provider_configorgacs_urlsls_urlmetadata_url
_sp_configsp_entity_id	sp_configavds
             r   build_sp_configrN   (   s2   ((3%)HIG((3%)HIG--goSE.RSL !$$T2.J>>+.L 0L/AA%

 /EE 

I 

j"
-C
wwz& #J	*
ww~#&~#6	- 
ww})"%m"4	,
ww ,$'(8$9	.!r,   c                     | d   }| d   }d| d| }t        j                  |      }|Ot        j                  ||| j                  dd            }t        j                  ||| j                  dd	             |S )
NrI   r3   zsaml.metadata..metadata_request_timeout
   )r3   timeoutmetadata_cache_timeouti@8  )r   rB   r   parse_remoteset)
idp_configrI   r3   	cache_keysaml_configs        r   fetch_metadata_url_configrZ   L   s    n-L;'I a	{;I))I&K6CCNN#=rB

 			NN3[A	

 r,   c                 b   |j                  di       }i d|j                  dd      d|j                  dt        j                        d|j                  dd      d	|j                  d
d      ddd|j                  dt        j                        d|j                  dd      d|j                  dd      d|j                  dd      d|j                  dd      d|j                  dd      d|j                  dd      d|j                  dd      d|j                  dd      d|j                  d d      d!|j                  d"d      d#|j                  d$d      }|j                  d%d      |d&}|j                  d'      }|r||d(<   |j                  d)      }|r||d)<   |j                  d*      }|t	        d+      |j                  d,      }	|	rt        |      }
|
d*   |d*<   n1|d-   |d.   d/|d0   id1|d*<   |j                  d2      }|r
d/|i|d*   d3<   t        | ||      |d4<   |S )5Nr9   authnRequestsSignedauthn_request_signedFdigestAlgorithmdigest_algorithmlogoutRequestSignedlogout_request_signedlogoutResponseSignedlogout_response_signedrequestedAuthnContextsignatureAlgorithmsignature_algorithmsignMetadatametadata_signedwantAssertionsEncryptedwant_assertion_encryptedwantAssertionsSignedwant_assertion_signedwantMessagesSignedwant_message_signednameIdEncryptedname_id_encryptedwantNameIdEncryptedwant_name_id_encryptedallowSingleLabelDomainsallow_single_label_domainsrejectDeprecatedAlgorithmreject_deprecated_algorithmT
wantNameIdwant_name_idwantAttributeStatementwant_attribute_statementallowRepeatAttributeNameallow_repeat_attribute_namestrict)r}   securitycontact_personcontactPersonorganizationidpz`idp` missingrI   r3   r:   r4   sso_url)r6   r:   singleSignOnServiceslo_urlr8   r2   )rB   r   SHA256
RSA_SHA256r   rZ   rN   )r   rE   rF   rM   security_configrY   r   r   r   rI   meta_configr   s               r   build_saml_configr   _   s   


j"
-Csww'=uE377#57O7V7VW 	sww'>F 	(@% H	
 	  	cgg!#;#F#F
 	 159 	"377+Eu#M 	(? G 	cgg&;UC 	377#6> 	sww'?G 	"377+G#O  	$SWW-JD%Q!" 	cggne4#$ 	!#''*Dd"K%& 	#CGG,I4$P'O, ''(D)#K
 %(()9:N'5O$"&&~6L&2N#


e
$C
{"?3377>*L/4(/E K(J$)3y>#:
E
 '')$9>8HK45'#FKr,   c                      d| i}t        |      S )Nstater   )r   paramss     r   encode_relay_stater      s    uFVr,   c                     d}| rLt        |       }|j                  s3|j                  s'|j                  r|j                  j	                  d      r| }|S )zAccording to the spec, RelayState need not be a URL, yet,
    ``onelogin.saml2` exposes it as ``return_to -- The target URL the user
    should be redirected to after login``. Also, for an IdP initiated login
    sometimes a URL is used.
    N/)r   schemenetlocpath
startswith)relay_statenext_urlpartss      r   decode_relay_stater      sE     H%<<5<<EJJ5::;P;PQT;U"HOr,   c                     t        |       }t        | |j                  j                  |j                  j                        }t        ||      }|S )N)r+   r   appsettingsr   r
   )r   r   reqconfigauths        r   
build_authr      s?    
 
)Cw(=(=x||?U?UVFsF+DKr,   N) urllib.parser   django.core.cacher   django.core.exceptionsr   django.httpr   django.urlsr   django.utils.httpr	   onelogin.saml2.authr
   onelogin.saml2.constantsr   "onelogin.saml2.idp_metadata_parserr   allauth.socialaccount.adapterr   allauth.socialaccount.modelsr   -allauth.socialaccount.providers.saml.providerr   r   r+   rN   rZ   r   r   r   r    r,   r   <module>r      sT    ! # 7   ' 3 = O 5 2 FP	!H&6r
r,   