PySAML2

https://pysaml2.readthedocs.io/en/latest/
Admin
PySAML2 is a pure Python implementation of SAML2, providing all necessary components for building...
Tokens:11,508
Snippets:175
Trust Score:9.6
Update:3 months ago
Show doc for...
Tokens:
Raw
### Run the SP-WSGI application

Source: https://pysaml2.readthedocs.io/en/latest/examples/sp.html

Commands to navigate to the example directory and start the service provider server.

```bash
cd [your path]/pysaml2/example/sp-wsgi
python sp.py sp_conf
```

--------------------------------

### Initialize sp-wsgi configuration

Source: https://pysaml2.readthedocs.io/en/latest/examples/sp.html

Commands to copy example configuration files for the sp-wsgi setup.

```bash
cd [your path]/pysaml2/example/sp-wsgi
cp service_conf.py.example service_conf.py
cp sp_conf.py.example sp_conf.py
```

--------------------------------

### Install PySAML2 via setup.py

Source: https://pysaml2.readthedocs.io/en/latest/install.html

Standard installation command for the PySAML2 package.

```bash
python setup.py install
```

--------------------------------

### Generate metadata for sp-repoze

Source: https://pysaml2.readthedocs.io/en/latest/examples/sp.html

Generate the SP metadata XML file for the sp-repoze example.

```bash
cd [your path]/pysaml2/example/sp-repoze
make_metadata.py sp_conf.py > sp.xml
```

--------------------------------

### Run the IDP Server

Source: https://pysaml2.readthedocs.io/en/latest/examples/idp.html

Starts the identity provider server using the specified configuration file without the .py extension.

```bash
cd [your path]/pysaml2/example/idp2
python idp.py idp_conf
```

--------------------------------

### Install xmlsec1 on RHEL/CentOS 7

Source: https://pysaml2.readthedocs.io/en/latest/install.html

Required system packages for PySAML2 on RHEL or CentOS 7 distributions.

```bash
yum install xmlsec1 xmlsec1-openssl
```

--------------------------------

### Define Service Endpoints

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Examples of defining service endpoints as URLs, 2-tuples with bindings, or 3-tuples with bindings and indices.

```python
”http://localhost:8088/A"
```

```python
from saml2 import BINDING_HTTP_POST
(”http://localhost:8087/A”, BINDING_HTTP_POST)
```

```python
from saml2 import BINDING_HTTP_POST
(”http://lingon.catalogix.se:8087/A”, BINDING_HTTP_POST, 1)
```

```python
"service":
    "idp": {
        "endpoints": {
            "single_sign_on_service": [
                ("http://localhost:8088/sso", BINDING_HTTP_REDIRECT),
            ],
            "single_logout_service": [
                ("http://localhost:8088/slo", BINDING_HTTP_REDIRECT),
            ],
        },
    },
},
```

--------------------------------

### Run PySAML2 tests

Source: https://pysaml2.readthedocs.io/en/latest/install.html

Commands to install test requirements and execute the test suite using pytest.

```bash
cd tests
pip install -r test-requirements.txt
pytest
```

--------------------------------

### Install build dependencies on RHEL/CentOS 6

Source: https://pysaml2.readthedocs.io/en/latest/install.html

Required development libraries for compiling cffi and cryptography dependencies on older RHEL/CentOS systems.

```bash
yum install libffi-devel openssl-devel
```

--------------------------------

### Generate metadata from configuration

Source: https://pysaml2.readthedocs.io/en/latest/examples/sp.html

Command to generate a metadata XML file from an existing SP configuration.

```bash
make_metadata.py sp_conf.py > metadata.xml
```

--------------------------------

### Configure sp_conf.py settings

Source: https://pysaml2.readthedocs.io/en/latest/examples/sp.html

Configuration parameters for the Service Provider entity.

```python
"service": ["sp"],
```

```python
"entityid" : "urn:mace:example.com:saml:sp",
"service_url" : "http://example.com:8087/",
```

```python
"idp_url" : "https://example.com/saml2/idp/SSOService.php",
```

```python
"my_name" : "My first SP",
```

```python
"debug" : 1,
```

```python
"key_file" : "./mykey.pem",
"cert_file" : "./mycert.pem",
```

```python
"xmlsec_binary" : "/opt/local/bin/xmlsec1",
```

```python
"organization": {
    "name": "Example Co",
    #display_name
    "url":"http://www.example.com/",
},
```

```python
"contact": [{
    "given_name":"John",
    "sur_name": "Smith",
    "email_address": "john.smith@example.com",
    #contact_type
    #company
    #telephone_number
}]
```

--------------------------------

### Configure key_file

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Specifies the PEM formatted file containing the service's private key.

```yaml
key_file: "key.pem"
```

--------------------------------

### Configure tmp_key_file

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Specifies a PEM formatted temporary key file.

```python
“tmp_key_file”: “tmp_key.pem”
```

--------------------------------

### Generate IDP Metadata

Source: https://pysaml2.readthedocs.io/en/latest/examples/idp.html

Creates a metadata XML file from the provided configuration file.

```bash
make_metadata.py idp_conf.py > idp.xml
```

--------------------------------

### Basic Service Provider Configuration

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

A standard configuration dictionary for a Service Provider, including endpoints, certificate paths, and local metadata.

```python
from saml2 import BINDING_HTTP_REDIRECT

CONFIG = {
    "entityid": "http://example.com/sp/metadata.xml",
    "service": {
        "sp": {
            "name": "Example SP",
            "endpoints": {
                "assertion_consumer_service": ["http://example.com/sp"],
                "single_logout_service": [
                    ("http://example.com/sp/slo", BINDING_HTTP_REDIRECT),
                ],
            },
        }
    },
    "key_file": "./mykey.pem",
    "cert_file": "./mycert.pem",
    "xmlsec_binary": "/usr/local/bin/xmlsec1",
    "delete_tmpfiles": True,
    "attribute_map_dir": "./attributemaps",
    "metadata": {
        "local": ["idp.xml"]
    }
    "organization": {
        "display_name": ["Example identities"]
    }
    "contact_person": [
        {
            "givenname": "Roland",
            "surname": "Hedberg",
            "phone": "+46 90510",
            "mail": "roland@example.com",
            "type": "technical",
        },
    ]
}
```

--------------------------------

### Configure Metadata Sources

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Defines local directories, files, remote aggregate URLs, and MDQ service endpoints for metadata discovery.

```json
"metadata": {
    "local": [
        "/opt/metadata"
        "metadata.xml",
        "vo_metadata.xml",
    ],
    "remote": [
        {
            "url": "https://kalmar2.org/simplesaml/module.php/aggregator/?id=kalmarcentral2&set=saml2",
            "cert": "kalmar2.cert",
        },
    ],
    "mdq": [
        {
            "url": "http://mdq.ukfederation.org.uk/",
            "cert": "ukfederation-mdq.pem",
            "freshness_period": "P0Y0M0DT2H0M0S",
        },
        {
            "url": "https://mdq.thaturl.org/",
            "disable_ssl_certificate_validation": True,
            "check_validity": False,
        },
    ],
},
```

--------------------------------

### Configure verify_encrypt_advice

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Specifies whether to verify encrypted assertions in the advice element using a custom verification function.

```python
def verify_encrypt_cert(cert_str):
    osw = OpenSSLWrapper()
    ca_cert_str = osw.read_str_from_file(full_path("root_cert/localhost.ca.crt"))
    valid, mess = osw.verify(ca_cert_str, cert_str)
    return valid
```

```json
"verify_encrypt_cert_advice": verify_encrypt_cert,
```

--------------------------------

### Configure description

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the description string for the PySAML2 entity.

```python
"description": "My IdP",
```

--------------------------------

### Configure logging

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Passes a dictionary directly to the Python logging configuration handler.

```json
"logging": {
    "version": 1,
    "formatters": {
        "simple": {
            "format": "[%(asctime)s] [%(levelname)s] [%(name)s.%(funcName)s] %(message)s",
        },
    },
    "handlers": {
        "stdout": {
            "class": "logging.StreamHandler",
            "stream": "ext://sys.stdout",
            "level": "DEBUG",
            "formatter": "simple",
        },
    },
    "loggers": {
        "saml2": {
            "level": "DEBUG"
        },
    },
    "root": {
        "level": "DEBUG",
        "handlers": [
            "stdout",
        ],
    },
},
```

--------------------------------

### Generate metadata for sp-wsgi

Source: https://pysaml2.readthedocs.io/en/latest/examples/sp.html

Generate the SP metadata XML file using the configuration file.

```bash
cd [your path]/pysaml2/example/sp-wsgi
make_metadata.py sp_conf.py > sp.xml
```

--------------------------------

### Configure Domain

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the domain attribute for the service.

```json
"domain": "umu.se",
```

--------------------------------

### Configure Signing and Digest Algorithms

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Specify the default algorithms for signing and digesting SAML messages.

```python
"service": {
    "sp": {
        "signing_algorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512",
        "digest_algorithm": "http://www.w3.org/2001/04/xmlenc#sha512",
    }
}
```

```python
"service": {
    "idp": {
        "signing_algorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512",
        "digest_algorithm": "http://www.w3.org/2001/04/xmlenc#sha512",
    }
}
```

--------------------------------

### Configure xmlsec_path and binary resolution

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Defines search paths for the xmlsec1 binary or uses a helper function to resolve the path dynamically.

```json
"xmlsec_path": ["/usr/local/bin", "/opt/local/bin"],
```

```python
from saml2.sigver import get_xmlsec_binary

if get_xmlsec_binary:
    xmlsec_path = get_xmlsec_binary(["/opt/local/bin","/usr/local/bin"])
else:
    xmlsec_path = '/usr/bin/xmlsec1'

"xmlsec_binary": xmlsec_path,
```

--------------------------------

### Configure generate_cert_info

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Determines if certificate information should be generated.

```python
"generate_cert_info": False
```

--------------------------------

### Configure who.ini for repoze.who

Source: https://pysaml2.readthedocs.io/en/latest/examples/sp.html

Middleware configuration settings for integrating PySAML2 with repoze.who.

```ini
[plugin:saml2auth]
use = s2repoze.plugins.sp:make_plugin
saml_conf = sp_conf.py
rememberer_name = auth_tkt
debug = 1
path_logout = .*/logout.*
```

```ini
[identifiers]
plugins =
      saml2auth
      auth_tkt

[authenticators]
plugins = saml2auth

[challengers]
plugins = saml2auth

[mdproviders]
plugins = saml2auth
```

--------------------------------

### Configure Preferred Bindings

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the order of preferred SAML bindings for specific service types like single sign-on and logout.

```json
"preferred_binding" = {
    "single_sign_on_service": [
        'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
        'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
        'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
    ],
    "single_logout_service": [
        'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
        'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
        'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
        'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
    ],
}
```

--------------------------------

### Configure tmp_cert_file

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Specifies a PEM formatted temporary certificate file.

```python
“tmp_cert_file”: “tmp_cert.pem”
```

--------------------------------

### Configure SP Force Authentication

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Mandates that the IdP authenticates the user directly.

```python
"service": {
    "sp": {
        "force_authn": True,
    }
}
```

--------------------------------

### Configure Organization Details

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Specifies organization metadata used by make_metadata.py, supporting language-specific tuples for names and URLs.

```json
"organization": {
    "name": [
        ("Example Company", "en"),
        ("Exempel AB", "se")
    ],
    "display_name": ["Exempel AB"],
    "url": [
        ("http://example.com", "en"),
        ("http://exempel.se", "se"),
    ],
}
```

--------------------------------

### Advanced Service Provider Configuration

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

A complex configuration including memcached subject data, virtual organizations, and both local and remote metadata sources.

```python
from saml2 import BINDING_HTTP_REDIRECT

CONFIG = {
    "entityid": "http://sp.example.com/metadata.xml",
    "service": {
        "sp": {
            "name": "Example SP",
            "endpoints": {
                "assertion_consumer_service": ["http://sp.example.com/"],
                "single_logout_service": [
                    ("http://sp.example.com/slo", BINDING_HTTP_REDIRECT),
                ],
            },
            "subject_data": ("memcached", "localhost:12121"),
            "virtual_organization": {
                "urn:mace:example.com:it:tek": {
                    "nameid_format": "urn:oid:1.3.6.1.4.1.1466.115.121.1.15-NameID",
                    "common_identifier": "eduPersonPrincipalName",
                }
            },
        }
    },
    "key_file": "./mykey.pem",
    "cert_file": "./mycert.pem",
    "xmlsec_binary": "/usr/local/bin/xmlsec1",
    "delete_tmpfiles": True,
    "metadata": {
        "local": ["example.xml"],
        "remote": [
            {
                "url":"https://kalmar2.org/simplesaml/module.php/aggregator/?id=kalmarcentral2&set=saml2",
                "cert":"kalmar2.pem",
            }
        ]
    },
    "attribute_maps": "attributemaps",
    "organization": {
        "display_name": ["Example identities"]
    }
    "contact_person": [
        {
            "givenname": "Roland",
            "surname": "Hedberg",
            "phone": "+46 90510",
            "mail": "roland@example.com",
            "type": "technical",
        },
    ]
}
```

--------------------------------

### Configure Subject Data Storage

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Define the database backend for mapping local and distributed identifiers.

```python
"subject_data": "./idp.subject.db",
```

```python
"subject_data": ("memcached", "localhost:12121"),
```

--------------------------------

### Configure Session Storage

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Defines the storage backend and configuration for session management.

```json
"session_storage": ("mongodb", "session")
```

--------------------------------

### Configure name

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the display name of the PySAML2 entity.

```python
"name": "Example IdP"
```

--------------------------------

### Configure SP Response Signing Requirement

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Enforces that incoming SAML Responses must be signed.

```python
"service": {
    "sp": {
        "want_response_signed": True,
    }
}
```

--------------------------------

### Configure verify_ssl_cert

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Determines whether SSL certificates are verified; defaults to False.

```python
"verify_ssl_cert": True
```

--------------------------------

### Simplified Flow Pseudo-code

Source: https://pysaml2.readthedocs.io/en/latest/sp_test/internal.html

This pseudo-code illustrates the high-level logic for executing test sequences, handling flows, and managing IDP responses.

```python
do_sequence_and_test(self, oper, test):
    self.test_sequence(tests["pre"])  # currently no tests defined for sp_test
    for flow in oper:
        self.do_flow(flow)

do_flow(flow):
    if len(flow) >= 3:
        self.wb_send_GET_startpage()  # send start page GET request
        self.intermit(flow[0]._interaction)  # automate human user interface
        self.parse_saml_message()    # read relay state and saml message
    self.send_idp_response(flow[1], flow[2])  # construct, sign & send a nice Response from config, metadata and request
    if len(flow) == 4:
        self.handle_result(flow[3])  # pass optional check class
    else:
        self.handle_result()

send_idp_response(req_flow, resp_flow):
    self.test_sequence(req_flow.tests["mid"])   # execute "mid"-tests (request has "VerifyContent"-test built in; others from config)
    # this line stands for a part that is a bit more involved .. see source

    args.update(resp._response_args)    # set userid, identity

test_sequence(sequence):
    # execute tests in sequence (first invocation usually with check.VerifyContent)
    for test in sequence:
        self.do_check(test, **kwargs)

do_check(test, **kwargs):
    # executes the test class using the __call__ construct

handle_result(response=None):
    if response:
        if isinstance(response(), VerifyEchopageContents):
            if 300 < self.last_response.status_code <= 303:
                self._redirect(self.last_response)
            self.do_check(response)
        elif isinstance(response(), Check):
            self.do_check(response)
        else:
            # A HTTP redirect or HTTP Post (not sure this is ever executed)
            ...
    else:
        if 300 < self.last_response.status_code <= 303:
            self._redirect(self.last_response)

        _txt = self.last_response.content
        if self.last_response.status_code >= 400:
            raise FatalError("Did not expected error")
```

--------------------------------

### Configure ca_certs

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the path to the file containing root CA certificates for SSL validation.

```python
"ca_certs": full_path("cacerts.txt"),
```

--------------------------------

### Configure Virtual Organization

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Define common identifiers and name ID formats for virtual organizations.

```python
"virtual_organization": {
    "urn:mace:example.com:it:tek": {
        "nameid_format": "urn:oid:1.3.6.1.4.1.1466.115.121.1.15-NameID",
        "common_identifier": "umuselin",
    }
},
```

--------------------------------

### Configure cert_file

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Specifies the PEM formatted file containing the service's public certificate.

```yaml
cert_file: "cert.pem"
```

--------------------------------

### Configure contact_person

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Defines contact details for service support, used by make_metadata.py.

```yaml
contact_person: [
    {
        "givenname": "Derek",
        "surname": "Jeter",
        "company": "Example Co.",
        "mail": ["jeter@example.com"],
        "type": "technical",
    },
    {
        "givenname": "Joe",
        "surname": "Girardi",
        "company": "Example Co.",
        "mail": "girardi@example.com",
        "type": "administrative",
    },
]
```

--------------------------------

### Configure SP Authentication Request Signing

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the default signing preference for Authentication Requests sent by the SP.

```python
"service": {
    "sp": {
        "authn_requests_signed": True,
    }
}
```

--------------------------------

### Configure SP Requested Attributes

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Specifies a list of attributes required from the IdP for the eIDAS profile.

```python
"service": {
    "sp": {
        "requested_attributes": [
            {
                "name": "http://eidas.europa.eu/attributes/naturalperson/PersonIdentifier",
            },
            {
                "friendly_name": "DateOfBirth",
                "required": False,
            },
        ],
    }
}
```

--------------------------------

### Configure additional certificate files

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Specifies additional PEM-formatted public certificates for rotation or chain inclusion.

```yaml
additional_cert_files: ["other-cert.pem", "another-cert.pem"]
```

--------------------------------

### Configure xmlsec_binary path

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Defines the absolute path to the xmlsec1 binary used for signing and encryption.

```json
"xmlsec_binary": "/usr/local/bin/xmlsec1",
```

--------------------------------

### Configure encryption_keypairs

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Defines the certificates used for encryption capabilities.

```python
# Encryption
'encryption_keypairs': [
    {
        'key_file': BASE_DIR + '/certificates/private.key',
        'cert_file': BASE_DIR + '/certificates/public.cert',
    },
],
```

--------------------------------

### Configure verify_encrypt_cert_assertion

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Specifies whether to verify encrypted assertions.

```json
"verify_encrypt_cert_assertion": verify_encrypt_cert
```

--------------------------------

### Configure optional attributes

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Defines user-friendly attribute names that the SP would like to receive from IdPs.

```json
"service": {
    "sp": {
        "optional_attributes": ["title"],
    }
}
```

--------------------------------

### Configure UI Information

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Configures the mdui:UIInfo element to define entity display properties like privacy URLs, logos, and localized descriptions.

```json
"ui_info": {
"privacy_statement_url": "http://example.com/saml2/privacyStatement.html",
"information_url": "http://example.com/saml2/info.html",
"logo": {
    "height": "40",
    "width" : "30",
    "text": "http://example.com/logo.jpg"
},
"display_name": "Example Co.",
"description" : {"text":"Exempel Bolag","lang":"se"},
"keywords": {"lang":"en", "text":["foo", "bar"]}
}
```

--------------------------------

### Configure Scope

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the list of string values for the <Scope> element.

```json
"scope": ["example.org", "example.com"],
```

--------------------------------

### Configure HTTP client timeout

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the timeout for HTTP requests in seconds.

```yaml
http_client_timeout: 10
```

--------------------------------

### Configure discovery response endpoints

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Defines discovery response endpoints as either a simple URL or a tuple containing the URL and binding.

```json
"discovery_response":["http://example.com/sp/ds"],
```

```python
from saml2.extension.idpdisc import BINDING_DISCO

"discovery_response": [("http://example.com/sp/ds", BINDING_DISCO)]
```

--------------------------------

### Configure requested attribute name format

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the NameFormat attribute for requested attributes, defaulting to URI format if not specified.

```python
from saml2.saml import NAME_FORMAT_BASIC
```

```json
"requested_attribute_name_format": NAME_FORMAT_BASIC
```

--------------------------------

### Define crypto_backend

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the cryptographic backend for signing and encryption, defaulting to xmlsec1.

```json
"crypto_backend": "xmlsec1",
```

--------------------------------

### Configure requested authentication context

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Defines the RequestedAuthnContext for AuthnRequests, including class references and comparison logic.

```json
"service": {
    "sp": {
        "requested_authn_context": {
            "authn_context_class_ref": [
                "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
                "urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient",
            ],
            "comparison": "minimum",
        }
    }
}
```

--------------------------------

### Configure SP NameID Formats

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Defines a list of allowed NameID formats for the entity metadata.

```python
"service": {
    "sp": {
        "name_id_format": [
            "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
            "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
        ]
    }
}
```

--------------------------------

### Configure Service Provider

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Defines service provider settings including endpoints, required attributes, and trusted identity providers.

```json
"service": {
    "sp": {
        "name": "Rolands SP",
        "endpoints": {
            "assertion_consumer_service": ["http://localhost:8087/"],
            "single_logout_service": [
                (
                    "http://localhost:8087/slo",
                    'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
                ),
            ],
        },
        "required_attributes": [
            "surname",
            "givenname",
            "edupersonaffiliation",
        ],
        "optional_attributes": ["title"],
        "idp": {
            "urn:mace:umu.se:saml:roland:idp": None,
        },
    }
},
```

--------------------------------

### Configure Allowed IdPs for SP

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Restricts the SP to a specific list of allowed IdP entity identifiers.

```python
"service": {
    "sp": {
        "idp": ["urn:mace:umu.se:saml:roland:idp"],
    }
}
```

--------------------------------

### Configure signed response or assertion requirement

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Configures the SP to accept either a signed response or signed assertions by setting specific flags.

```json
"service": {
    "sp": {
        "want_response_signed": False,
        "want_assertions_signed": False,
        "want_assertions_or_response_signed": True,
    }
}
```

--------------------------------

### Configure required attributes

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Defines user-friendly attribute names that the SP demands to receive from IdPs.

```json
"service": {
    "sp": {
        "required_attributes": [
            "surname",
            "givenName",
            "mail",
        ],
    }
}
```

--------------------------------

### Define PySAML2 configuration structure

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

The configuration is defined as a Python dictionary named CONFIG within a module. It includes entity identification, service endpoints, security keys, and metadata paths.

```python
from saml2 import BINDING_HTTP_REDIRECT

CONFIG = {
    "entityid": "http://saml.example.com:saml/idp.xml",
    "name": "Rolands IdP",
    "service": {
        "idp": {
            "endpoints": {
                "single_sign_on_service": [
                    (
                        "http://saml.example.com:saml:8088/sso",
                        BINDING_HTTP_REDIRECT,
                    ),
                ],
                "single_logout_service": [
                    (
                        "http://saml.example.com:saml:8088/slo",
                        BINDING_HTTP_REDIRECT,
                    ),
                ],
            },
            ...
        }
    },
    "key_file": "my.key",
    "cert_file": "ca.pem",
    "xmlsec_binary": "/usr/local/bin/xmlsec1",
    "delete_tmpfiles": True,
    "metadata": {
        "local": [
            "edugain.xml",
        ],
    },
    "attribute_map_dir": "attributemaps",
    ...
}
```

--------------------------------

### Configure ECP client mapping

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Maps ECP client IP addresses to their respective entity IDs.

```json
"ecp": {
    "203.0.113.254": "http://example.com/idp",
}
```

--------------------------------

### Configure SP Unsolicited Response Consumption

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Allows the SP to consume SAML Responses without a preceding Authentication Request.

```python
"service": {
    "sp": {
        "allow_unsolicited": True,
    }
}
```

--------------------------------

### Configure entity_category_support in PySAML2

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Use entity_category_support to include entity categories in the generated SAML metadata.

```python
'debug' : True,
'xmlsec_binary': get_xmlsec_binary([/usr/bin/xmlsec1']),
'entityid': '%s/metadata' % BASE_URL,

# or entity_category: [ ... ]
'entity_category_support': [
    edugain.COCO, # "http://www.geant.net/uri/dataprotection-code-of-conduct/v1"
    refeds.RESEARCH_AND_SCHOLARSHIP,
],

'attribute_map_dir': 'data/attribute-maps',
'description': 'SAML2 IDP',

'service': {
    'idp': {
...
```

--------------------------------

### Configure assurance certification

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Generates an Attribute element with the specified assurance certification values.

```json
"assurance_certification": [
    "https://refeds.org/sirtfi",
]
```

--------------------------------

### Configure assertion signing preference

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the WantAssertionsSigned attribute in the metadata to indicate if the SP requires signed assertions.

```json
"service": {
    "sp": {
        "want_assertions_signed": True,
    }
}
```

--------------------------------

### Configure debug mode

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets whether debug information is sent to the log file.

```yaml
debug: 1
```

--------------------------------

### Configure SP NameID AllowCreate

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the AllowCreate attribute for the NameIDPolicy element.

```python
"service": {
    "sp": {
        "name_id_format_allow_create": True,
    }
}
```

--------------------------------

### Configure Name Qualifier

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the NameQualifier attribute for the <NameIdentifier> element.

```json
"name_qualifier": "http://authentic.example.com/saml/metadata",
```

--------------------------------

### Configure SP NameID Policy Format

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the Format attribute for the NameIDPolicy element.

```python
"service": {
    "sp": {
        "name_id_policy_format": "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
    }
}
```

--------------------------------

### Define an attribute map file

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

A typical map file structure defining identifier formats and conversion mappings.

```python
MAP = {
    "identifier": "urn:oasis:names:tc:SAML:2.0:attrname-format:basic",
    "fro": {
        'urn:mace:dir:attribute-def:aRecord': 'aRecord',
        'urn:mace:dir:attribute-def:aliasedEntryName': 'aliasedEntryName',
        'urn:mace:dir:attribute-def:aliasedObjectName': 'aliasedObjectName',
        'urn:mace:dir:attribute-def:associatedDomain': 'associatedDomain',
        'urn:mace:dir:attribute-def:associatedName': 'associatedName',
        ...
    },
    "to": {
        'aRecord': 'urn:mace:dir:attribute-def:aRecord',
        'aliasedEntryName': 'urn:mace:dir:attribute-def:aliasedEntryName',
        'aliasedObjectName': 'urn:mace:dir:attribute-def:aliasedObjectName',
        'associatedDomain': 'urn:mace:dir:attribute-def:associatedDomain',
        'associatedName': 'urn:mace:dir:attribute-def:associatedName',
        ...
    }
}
```

--------------------------------

### Configure SP Type Metadata Placement

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Determines if the SPType node appears in metadata or within each AuthnRequest.

```python
"service": {
    "sp": {
        "sp_type_in_metadata": True,
    }
}
```

--------------------------------

### Configure metadata_key_usage

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Specifies the cryptographic purpose of the entity's keys, defaulting to both if not provided.

```json
"metadata_key_usage" : "both",
```

--------------------------------

### Configure Logout Response Signing

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Set whether the entity signs Logout Responses during processing.

```python
"service": {
    "sp": {
        "logout_responses_signed": False,
    }
}
```

--------------------------------

### Configure IdP Policy

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Defines service policies based on SP entity identifiers or registration authorities, including lifetime and attribute restrictions.

```json
"service": {
    "idp": {
        "policy": {
            # a policy for a service
            "urn:mace:example.com:saml:roland:sp": {
                "lifetime": {"minutes": 5},
                "attribute_restrictions": {
                    "givenName": None,
                    "surName": None,
                },
            },

            # a policy for a registration authority
            "http://www.swamid.se/": {
                "attribute_restrictions": {
                    "givenName": None,
                },
            },

            # the policy for all other services
            "default": {
                "lifetime": {"minutes":15},
                "attribute_restrictions": None, # means all I have
                "name_form": "urn:oasis:names:tc:SAML:2.0:attrname-format:uri",
                "entity_categories": [
                    "edugain",
                ],
            },
        }
    }
}
```

--------------------------------

### Configure Logout Request Signing

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Set whether the entity signs outgoing Logout Requests.

```python
"service": {
    "sp": {
        "logout_requests_signed": False,
    }
}
```

--------------------------------

### Configure attribute_map_dir

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Specifies the directory containing attribute maps in Python modules.

```python
"attribute_map_dir": "attribute-maps"
```

--------------------------------

### Configure entity attributes

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Adds an Extension element under the EntityAttributes element in the generated metadata.

```json
"entity_attributes": [
  {
    "name_format": "urn:oasis:names:tc:SAML:2.0:attrname-format:uri",
    "name": "urn:oasis:names:tc:SAML:profiles:subject-id:req",
    # "friendly_name" is not set
    "values": ["any"],
  },
]
```

--------------------------------

### Set valid_for duration

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Specifies the duration in hours for which the configuration is considered accurate, primarily used by make_metadata.py.

```json
"valid_for": 24
```

--------------------------------

### SAML Metadata EntityAttributes output

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

The resulting XML structure in the metadata when entity categories are configured.

```xml
<md:Extensions>
  <mdattr:EntityAttributes>
    <saml:Attribute Name="http://macedir.org/entity-category-support" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
      <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">http://www.geant.net/uri/dataprotection-code-of-conduct/v1</saml:AttributeValue>
      <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">http://refeds.org/category/research-and-scholarship</saml:AttributeValue>
    </saml:Attribute>
  </mdattr:EntityAttributes>
```

--------------------------------

### Configure entityid

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the globally unique identifier for the entity.

```yaml
entityid: "http://saml.example.com/sp"
```

--------------------------------

### Configure SP Assertion Consumer Service Hiding

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Prevents the inclusion of AssertionConsumerServiceURL and ProtocolBinding in the AuthnRequest.

```python
"service": {
    "sp": {
        "hide_assertion_consumer_service": True,
    }
}
```

--------------------------------

### Configure AA Attribute Restrictions with Regex

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Restricts attribute values using regular expressions within an AA policy.

```json
"service": {
    "aa": {
        "policy": {
            "urn:mace:umu.se:saml:roland:sp": {
                "lifetime": {"minutes": 5},
                "attribute_restrictions": {
                     "mail": [".*\.umu\.se$"],
                }
            }
        }
    }
}
```

--------------------------------

### Configure SP Type for eIDAS

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Sets the eIDAS SPType node value to public or private.

```python
"service": {
    "sp": {
        "sp_type": "private",
    }
}
```

--------------------------------

### Configure entity_categories in policy

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Use entity_categories within the policy section to filter released attributes based on the SP's compliance.

```json
"policy": {
  "default": {
    "lifetime": {"minutes": 15},
    # if the SP is not conform to entity_categories
    # the attributes will not be released
    "entity_categories": ["refeds",],
```

--------------------------------

### Set RelayState secret

Source: https://pysaml2.readthedocs.io/en/latest/howto/config.html

Defines the string value used during the generation of the RelayState.

```json
"secret": "0123456789",
```
Tokens:
Raw