tPj:keySAML_IDP_METADATA_VALIDATE_CERTT) validate_certtimeoutidpzKCould not parse an IdP entityID/SSO URL/certificate from the SAML metadata.rwvaluettl)rGrNrrrArhashlibsha256encode hexdigest get_cache isinstancedictrraobjectasyncio to_threadr parse_remoter\r"parsegetHTTP_502_BAD_GATEWAY set_cacher )rs metadata_url metadata_xmlsource cache_keycachedparsed idp_settingss rD_load_idp_settingsz"SAMLAuthHandler._load_idp_settingss]-223JK -223JK $4  >";;h  >>av}}@_@i@i@k?lm I6 fd #S&[)62 2  #",,0==-778Y[_`< F6;;DlC 1 .0>>{LYYrC post_datactj|}|jd\}}}|jddd}|dk(rdnd|dtzt |j |xsidS) Nz://r`rrgrXoff)rg http_host script_nameget_datar)rGre partitionsplitrr query_params)r]rrdscheme_ host_parthosts rD_prepare_request_dataz%SAMLAuthHandler._prepare_request_datass%//8#~~e49ooc1-a0#w.TE!44W112"b   rCrc:Kts ttj|d{}tj ||}tj ||} t ||S7>#t$r#}ttjd|d}~wwxYww)N) old_settingszInvalid SAML configuration: r>) SAML_AVAILABLErErGrrrr ExceptionrrHTTP_500_INTERNAL_SERVER_ERROR)r]rsrrsettings request_dataes rD _build_authzSAMLAuthHandler._build_auths )+ +$3$F$Fu$MM )99'<P-CCGYW  &|(K K N  "AA5aS9  s3)BA*0B A,)B, B5BBB relay_statecKtj||d{}tt|j |}t |d}ttdz|j }|Y|jtd|dttj|}|jt|td||rdnd |S7w) N) return_toi/)rr?rurVr|Tnonelax)rwr}max_agehttponlysecuresamesite) rGrrraloginr get_last_request_idrrrrj set_cookier)r]rsrauth redirect_urlresponse request_idrs rDbuild_login_redirectz$SAMLAuthHandler.build_login_redirects,77GG"3 [ (IJ *|M tT-E-E-GH  ! OO78*F3   ,55g>F   , 7#)u  'HsCC B0CcKts ttj|d{}tj ||}t |d}t t|j}t tt|j|}|r-ttjddj||S7w)NT)sp_validation_onlyzInvalid SP metadata: , r>)rrErGrrrrraget_sp_metadatalistvalidate_metadatarrrjoin)r]rsrr saml_settingsmetadataerrorss rDbuild_sp_metadataz!SAMLAuthHandler.build_sp_metadata s)+ +$3$F$Fu$MM )99'<P6xTXY sM$A$A$CDT#Y (G(G(QR "AA.tyy/@.AB Ns)C CBC cK|jjd}|=|jr-t|tkDrt t jdt}|j23d{}||z }t|tkDs!t t jd776tt|jddSw)zRead the ACS POST form under a hard size cap before any base64/XML decoding. Bounds both Content-Length-declared and chunked requests so an unauthenticated caller cannot force unbounded buffering while decoding the SAMLResponse.zcontent-lengthNz/SAML response exceeds the maximum allowed size.r>zutf-8replace)headersrisdigitintr#rrHTTP_413_CONTENT_TOO_LARGE bytearraystreamlenrrdecode)r]declaredbodychunks rDread_acs_post_dataz"SAMLAuthHandler.read_acs_post_datas "//--.>?  H$4$4$63x=K_;_"==H  {">>+  % EMD4y//# & A AL +Idkk'9=>??s0A5C7B5;B3<B5?CC3B55%CclKtj|||d{}|jjt} |j |ttt|j}|s|jsA|j}ttjd|xsdj!|tj#|||d{tj%|S7#t $r#}ttjd|d}~wwxYw7Jw)N)r)rz!Could not process SAML response: r>zSAML authentication failed: r)rGrcookiesrrprocess_responserrrHTTP_401_UNAUTHORIZEDrrra get_errorsis_authenticatedget_last_error_reasonr_enforce_response_binding_result_from_auth)r]rsrrbrowser_request_idrrreasons rD handle_acszSAMLAuthHandler.handle_acs3s+77R[7\\$+OO$7$78P$Q   ! !-? ! @T#Y(9: ..0 668F"885f6Q &@Q5RS  77eEWXXX0066'] "88:1#>   Ys@D4D#D4DBD4'D2(D4 D/ D**D//D4rc|j}t|tstS|tt jz }t t |ttSrK)"get_last_assertion_not_on_or_afterrrr$timeminmaxr%)rnot_on_or_after remainings rD_replay_guard_ttlz!SAMLAuthHandler._replay_guard_ttlJsP!%!H!H!J/3/9 9*S-==   A B .  rCcFttdz|j}|r|Sttdz|j }|syt j |}t j|dD]*}ttdz|jd}|s(|cSy)a The request id this response answers, read from the Response element or, when the IdP only stamps it on the bearer SubjectConfirmationData, from there. A non-None value marks the response as solicited (SP-initiated) and so requiring browser binding.Nz-//saml:SubjectConfirmationData[@InResponseTo] InResponseTo) rra get_last_response_in_response_tobytesget_last_response_xmlrto_etreequeryr)rr}xmlrootnodeirts rD_response_in_response_toz(SAMLAuthHandler._response_in_response_toUs C$J(M(M(OP L%$,(B(B(DE(11#6&,,T3bc DsTz488N#;z;SAML response is not bound to this browser's login request.SAML_ALLOW_UNSOLICITEDFz8Unsolicited (IdP-initiated) SAML responses are disabled.z|Unsolicited (IdP-initiated) SAML responses require a shared Redis cache so the replay guard is enforced across every worker.z4SAML assertion is missing the required ID attribute.rr|z7SAML assertion has already been used (replay detected).)rGrrrrrrsecretscompare_digestr\ redis_cacherraget_last_assertion_idrasync_increment_cacher)rrsrin_response_to authn_key assertion_id consumed_keyconsumed_counts rDrz)SAMLAuthHandler._enforce_response_bindinggs !0 H H N  %"B!C1^DTUI9-5# & < <_")1G1GHZ\j1k# & < <X +"88T !**+CUK"88Q    &"88K #3:t/I/I/KL  "88M "G GqW &+&A&AA?+L+LT+R'B' !   %.1*<"88P += %! sE+F-F.)Fc tttttf|j }ttdz|j }t j|dt}||d|vr|}|0t jdttjdt j|ddxs|xs|}|ttjdt j|d t}t j|d t}t j|d t}t j!|d t"}d j%d||fDxs|} t'j(d||t|j+ t-||||| dd||rt/| Sd S#t0$r#} ttjd| d} ~ wwxYw)NSAML_ATTRIBUTE_EMAIL@ALLOWED_EMAIL_DOMAINSzmSAML assertion did not contain an email address, but ALLOWED_EMAIL_DOMAINS restricts sign-in by email domain.r>SAML_ATTRIBUTE_USER_IDrBzBSAML assertion did not contain a usable subject (NameID) or email.SAML_ATTRIBUTE_FIRST_NAMESAML_ATTRIBUTE_LAST_NAMESAML_ATTRIBUTE_ROLESAML_ATTRIBUTE_TEAM_IDS c3&K|] }|s| ywrKrB).0parts rD z4SAMLAuthHandler._result_from_auth..s&XSWt&Xsz/SAML login: subject=%s, email=%s, attributes=%ssaml) idr&r,r1 display_namepictureproviderr9 user_rolez6SAML assertion contained an invalid subject or email: )rrrarget_attributes get_nameidrG_attribute_valuer*rNrrrr.r3r7_attribute_valuesr;rr infokeysr rr ) r attributesname_idr&user_idr,r1 role_valuer9r,rs rDrz!SAMLAuthHandler._result_from_auths c49n!5t7J7J7LM cDj$//*;<00=SUpq =W0SG^E =_112IJV"889 )99*F^`bcwgnwrw ?"88[  ,<< 35U +;; 24S %55jBWYst );; 13Q "hh&XY8O&XXa\a !! =wtT^TcTcTeOf  %#)!?I/ ;  PT   "88OPQsS  s!GG G3G..G3r6 env_override candidates.cBtj|||}|r|dSdS)Nr)rGr3)r6r:r;valuess rDr2z SAMLAuthHandler._attribute_values* (99*lT^_"vay,,rCctj|}|r|g|n|}|D]*}|j|}|s|Dcgc]}|s| c}cSgScc}wrK)rGrNr)r6r:r;overrider5rwr=vs rDr3z!SAMLAuthHandler._attribute_valuessd *..|<19x-*-z 0C^^C(F#)/aQ// 0 0s AArK)&__name__ __module__ __qualname____doc__ staticmethodrarNrRrSr\rrerjrlrorrr rrrrrrr rrrr rrrrrrrtupler2r3rBrCrDrGrGmsO@(3(t(sTz((tttAAdAtAA :7:s::F7FtFFH'HcHHHwH3HHcwc3cc  d3;6G  DZZS&[8IZdSVX^S^N_ZZ4  w  4S>D;P  \`adflal\m    ,0S>D(  $FJ!*9rVsW 0  "22.$10X.7S?;N+%*0U00U0"6%6)<<*> %>/H%uH),,(,,.0$e0-e-15&4,1"E1&U+ %*%FEE(GG  BByNsDD  D