From 138bc431fd4981997fcf3c3a59488f7c4cc9eb80 Mon Sep 17 00:00:00 2001 From: Jonathan Perret Date: Thu, 18 Sep 2025 19:29:54 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=93=8C(pysaml2)=20pin=20pysaml2=20to=20av?= =?UTF-8?q?oid=20double-signing=20of=20AuthNRequests?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The current version of pysaml2 (7.5.2) has an issue where AuthNRequests are both signed in the XML and with an extra `Signature` queryparam. This was reported initially in 2021: https://github.com/IdentityPython/pysaml2/issues/819 And it was fixed by a changed in SATOSA: https://github.com/IdentityPython/SATOSA/pull/380 But it reappeared apparently and the original reporter has a PR open against pysaml2 that is supposed to fix it: https://github.com/IdentityPython/pysaml2/pull/973 They report that the regression was introduced in pysaml2 by https://github.com/IdentityPython/pysaml2/pull/834 We try here to pin pysaml2 to the last version before this PR was merged. Unfortunately this is quite an old version, but from basic testing it seems to still be compatible with the current SATOSA version. This in turn forces us to also pin xmlschema to avoid https://github.com/IdentityPython/pysaml2/issues/947 Hopefully this can be temporary. --- src/satosa/pyproject.toml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/satosa/pyproject.toml b/src/satosa/pyproject.toml index 593c0a0..10aee1f 100644 --- a/src/satosa/pyproject.toml +++ b/src/satosa/pyproject.toml @@ -28,6 +28,13 @@ dependencies = [ "redis==5.0.4", "JSON-log-formatter==1.0", "WhiteNoise==6.7.0", + # Use the most recent pysaml2 that doesn't have the recurrence of + # https://github.com/IdentityPython/pysaml2/issues/819 + # (AuthNRequests signed twice) + "pysaml2==7.1.0", + # Pin xmlschema like pysaml2 did in release 7.5.1, see + # https://github.com/IdentityPython/pysaml2/issues/947#issuecomment-1916767026 + "xmlschema==2.5.1", ] [project.urls]