Pysaml2 and Xmlsec1 compatability
akila122 opened this issue · 4 comments
Add compatibility notes on xmlsec1 and pysaml2
Code Version
OsX 13.4
Xmlsec 1.3
Python 3.7
PySaml2 7.1
Expected Behavior
Verifying the XML document.
Current Behavior
Using this combination of versions results in many KEY-NOT-FOUND xmlsex1 errors while trying to verify the document which ultimately boils down to saml2.sigver.SecurityContext.verify_signature function raising SignatureError due to the --lax-key-search xmlsec1 parameter not being passed by PySaml2 which was a breaking change in xmlsec1's 1.3 release:
(API breaking change) Changed the key search to strict mode: only keys referenced by KeyInfo are used. To restore the old "lax" mode, set XMLSEC_KEYINFO_FLAGS_LAX_KEY_SEARCH flag on xmlSecKeyInfoCtx or use '--lax-key-search' option for XMLSec command line utility.
Possible Solution
Could you please at least put some notes on these compatibility issues between PySaml2 and xmlsec1 versions. My workaround was to manually install xmlsec1 < 1.3 from the source.
Steps to Reproduce
Try verifying any document with a key not referenced in KeyInfo.
The (current) latest release v7.4.2 adds support for xmlsec1 1.3.
You can see the release notes here: https://github.com/IdentityPython/pysaml2/releases
I can add some more notes on the README so that it is more visible.
Yeah would be great if you could explicitly state that pysaml2<7.4.2 is NOT compatible with xmlsec1 >=1.3
Could this be an alternative #913 ?
closed by 023fc4a