- Satosa-dev - lists3.sunet.se

IdPY Meetings: You're Invited! Getting the band back together...

by Paglione, Laura

Hi all, Apologies for casting a wide net with this communication; I wanted to ensure I reached the people most interested in this information. There have recently been several meetings to re-engage the community on IdPY work. We invite you to attend an *IdPY Town Hall* where we will share what has been discussed (this meeting will be recorded): *IdPY TOWN HALL MEETING* 17 June 2026 6:00 AM (San Francisco) | 9:00 AM (New York) | 14:00 (London) | 11:00 PM (Sydney) *(No advanced registration required)* https://us06web.zoom.us/j/83349546274?pwd=Hxk7X9wIct6HTXlVmI5yuXmVdwJOXa.1 ADD THIS EVENT TO YOUR CALENDAR: https://www.addevent.com/event/qtmlhpw6jx87 --- *[optional] TECHNICAL TEAM MEETINGS* Additionally, if you are interested in the technical work to develop IdPY tools, we will hold a re-kickoff meeting to plan the next 6 months of work and decide on a day/time and pace for ongoing meetings. Indicate your availability on the following poll if you would like to be involved, even if you can't attend this time. Everyone who responds will be added to future technical team communications. Poll to schedule the IdPY Technical Re-kickoff Meeting during the week of 1 June: https://doodle.com/group-poll/participate/bYYKA5Ob Please reach out to me if you need any additional information. Looking forward to seeing you there. Best, Laura Paglione

6 days, 5 hours

1
1
0 0

Configuration of response and attribute signing, and signing and digest algorithms

by ivan.kanak＠gmail.com

Hello everyone, I have been looking into PR #495 https://github.com/IdentityPython/pysaml2/pull/495 What the user needs is an option to configure the signing algorithm that will be used by the SP to sign an authentication request. This comes in hand with the digest algorithm and in extension what is entity that should be signed. What the proposed one line change does, is allows this value to exist in pysaml2 Config object. By itself, it does not affect anything in the code - it does not set the signing algorithm. It is only a placeholder for a value. Something else is supposed to look at that value, at the right time, and pass it as an argument to the appropriate function/method. This doesn't seem right. If it is in the configuration, then it should actually do something - it should affect the way the library behaves. Looking into this I stumbled upon some commits, made about a year ago, that implement some of this functionality for the IdP part: * 2aedfa0 - make both sign response and assertion configurable adds sign_assertion and sign_response options * bd4303a - Signing signature and digest algorithm configuration adds sign_alg and digest_alg options These are implemented in the SATOSA repository (see satosa/frontends/saml2.py the _handle_authn_response method). However, their configuration lies between the lines of the pysaml2 configuration (under service/idp/policy). This is wrong - each project should be responsible for its own configuration. The code that decides what should be signed and how, should live in pysaml2. If it is handled by SATOSA then it should be part of the SATOSA configuration and an override of the pysaml2 configuration. Moreover, it seems that this functionality was partially already there in pysaml2 in the first place. See the Policy class in saml2/assertion.py and its get_sign method. An option named 'sign' can be defined under the service/idp/policy part of the configuration, that defines an array of values that represent what should be signed, for example: service: idp: policy: sign: - response - assertion So now we have both the above 'sign' option, plus 'sign_assertion' and 'sign_response', which should do the same thing. What I would like to do is move the code introduced by the commits above into pysaml2: this will allow a consistent behaviour whether pysaml2 is used by SATOSA or some other project. Then the same options can be used by the backend too, which would satisfy the user request. Once that is done we can look into making the configuration work in one way. This is bigger than it looks. What happens now is that we define for example, that we want to use SHA512 as a sign_alg. This will be used when a authentication response is formed, but it is ignored when for example a logout request is to be created. This happens because the configuration of what signing algorithm will be used is only implemented for the authentication response. There are two ways to fix this: - we either assume that a configuration option like 'sign_alg' is global, and as such, it affects the signing algorithm of anything that is to be signed - or we assume that it relates to the authentication req/response only (and in that case it shold probably be called authn_sign_alg or alike) and require new options for other kinds of signatures (logout_sign_alg, metadata_sign_alg, etc). The first solution requires that we find all places in the code use signatures and make sure they respect the configuration. I have already noted (a lot of) entry points to pysaml2 that should be looking into the configuration to derive the signing and digest algorithm values. The second option is "easier" to work with, as it allows for an incremental implementation of this request. The second approach is also more flexible for the end user, but at the same time more complex as it requires more configuration values to be set. Ofcourse we can have both, use an option like sign_alg to defined the signing algorithm, and use "suboptions" like authn_sign_alg to override the sign_alg setting where needed. I hope this makes sense (even though it mixes at least four configuration options together). If you have any comments, I'd like to hear. Cheers, -- Ivan c00kiemon5ter Kanakarakis >:3

2 weeks, 3 days

17
22
0 0

Best way to find and stream latest movies easily?

by Elon Peter

I’ve been trying to find a simple and reliable way to watch the latest movies and TV shows without going through too many complicated apps or subscriptions. There are a lot of options out there, but not all of them are easy to use or regularly updated. I personally prefer something that works smoothly on mobile and has a clean interface. Recently I came across https://movieboxapkhub.com/ while searching for streaming options and it seemed pretty useful. Still, I’d love to know what others here are using. Any good recommendations? Thanks 🙂

2 months, 1 week

1
0
0 0

How to handle 3D model optimization and API loading for open-world games?

by ropeherohub .com

Body: Hey everyone 👋 I’m working on a small open-world superhero game project (something like Rope Hero) and trying to figure out the best way to handle 3D model loading and optimization through APIs. I’ve read a bit about using async data fetching for models and textures, but I’m not sure what’s the most efficient approach to keep things lightweight while maintaining quality. Does anyone here have experience with streaming 3D assets dynamically or managing API-based level loading in real time? Any tips or frameworks you’d recommend? Also shared a few related notes on this topic here → https://ropeherohub.com/ Would love to hear your thoughts!

6 months, 1 week

3
2
0 0

Enjoy survival and creative modes on mobile

by krowncrafts01＠gmail.com

Enjoy survival and creative modes on mobile with <a href="https://mynecraftapkpro.com/minecraft-pe-apk/">mcpe apk</a>. Many also prefer minecraft download minecraft download minecraft download for quick setup.

6 months, 2 weeks

1
0
0 0

How to handle 3D model optimization and API loading for open-world games?

by ropeherohub .com

Body: Hey everyone 👋 I’m working on a small open-world superhero game project (something like Rope Hero) and trying to figure out the best way to handle 3D model loading and optimization through APIs. I’ve read a bit about using async data fetching for models and textures, but I’m not sure what’s the most efficient approach to keep things lightweight while maintaining quality. Does anyone here have experience with streaming 3D assets dynamically or managing API-based level loading in real time? Any tips or frameworks you’d recommend? Also shared a few related notes on this topic here → https://ropeherohub.com/ Would love to hear your thoughts!

7 months, 3 weeks

1
0
0 0

oidcop frontend

by giuseppe.demarco＠unical.it

Hi, I developed this during a low-effort sprint of 6 days https://github.com/IdentityPython/SATOSA/pull/378 It's a working draft. Waiting for revisions and contribution from our community I'll go ahead with unit tests and all the tasks described in the PR. Any reaction, idea, suggestion is appreciated by right now, feel free to put your spells on top of my branch :) best regards -- ____________________ Giuseppe De Marco Centro ICT d'Ateneo Università della Calabria 87036 Rende (CS) - Italy Phone: +39 0984 496961 e-mail: giuseppe.demarco at unical.it -- ------------------------------------------------------------------------------------------------------------------ Il banner è generato automaticamente dal servizio di posta elettronica dell'Università della Calabria <http://www.unical.it/5x1000>

4 years, 10 months

1
0
0 0

Vulnerabilities affecting pySAML2 and forthcoming release

by ivan.kanak＠gmail.com

Dear users of IdentityPython, this is a heads-up about two vulnerabilities affecting pySAML2. Software that uses pySAML2 is indirectly affected, too (ie, SATOSA). The issues were reported to the IdentityPython incident-response mailing list and we have been working on a mitigation. A new version of pySAML2 that includes the fixes will be released on Wednesday 20th of January between 13:00 CET and 17:00 CET. We urge everyone to be prepared to update their setup to the latest version. Kind regards, Ivan Kanakarakis on behalf of the incident-response team

5 years, 5 months

1
3
0 0

controlling NameID format and value sent to SP

by skoranda＠sphericalcowgroup.com

Hi, I have been asked off-list the same question by a couple of different people. The question is "how can I get SATOSA to send a specific NameID value and format to the requesting SP?" They usually ask after trying, in vain, to configure the SAML2 frontend and/or the SAML metadata for the SP to specify a particular NameID format (e.g. urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress). My reading of lines 339 to 353 in .../frontends/saml2.py is that there is no way to force, either through configuration of the frontend or in SAML metadata what format is used for NameID, nor what value is used. Rather what happens is that the frontend takes whatever values are set for internal_response.subject_id internal_response.subject_type and creates a NameID element object and passed it to pysaml2 to create the actual response. The only exception to that rule is if internal_response.subject_id is None, then pysaml2 is passed None, and it has code that then defaults to creating a transient NameID (which I argue is the most sensible thing it can do). So to my reading, the only and correct way to affect what the SATOSA SAML frontend sends for the NameID is to have a response microservice that sets internal_response.subject_id internal_response.subject_type before the frontend begins processing the response. The only alternative is to just accept what is passed through from the backend. Is my analysis correct? Thanks, Scott K P.S. I have been using a microservice(s) to set internal_response.subject_id internal_response.subject_type for quite some time and it works just fine.

5 years, 11 months

2
4
0 0

SAMLBackend and discovery initiated flows

by skoranda＠sphericalcowgroup.com

Hi, The current SAMLBackend actually allows "discovery initiated" flows. That is, a browser with no other state can invoke the URL endpoint for the SAMLBackend disco_response() as long as it passes in the entityID for the IdP to use for authentication in the query string. The backend will redirect the user to the IdP and consume the SAMLResponse when the browser returns. Such a flow does not make much sense for most deployments because after consuming the SAMLResponse and passing back to the frontend, the frontend (either SAML or OIDC) will fail because it doesn't know where to redirect the browser, since the flow did not originate or come through the frontend. The SAMLFrontend will fail with the well known but hated "UnknownError". I have a deployment where this is happening fairly regularly. It turns out it is because of users that have either bookmarked the discovery service or are opening/restarting browsers with tabs that were "paused" at discovery. Sigh. We will be (attempting) to educate users, but we also want to not allow "discovery initiated" flows and we want them to fail with a better exception and error message in the log files to assist help desk staff. Unfortunately I can imagine some deployment configurations where a "discovery initiated" flow might make sense and is "doable" (with enough microservices anything is doable). So I don't think we can just make the current behavior disallowed by default. Instead I have submitted PR 322 https://github.com/IdentityPython/SATOSA/pull/322 which adds the configuration option 'allow_discovery_initiated' for the backend. By default it is True to preserve the current (odd) behavior, but when set to False a flow that starts at the disco_response() endpoint will immediately fail with exception SATOSAStateError and message IdP discovery initiated flow not allowed Sorry for the long note, but I thought it better to explain in detail since the code changes themselves might not make the use case (or edge case) clear. Please let me know if you have any questions or concerns. Thanks, Scott

6 years, 2 months

1
0
0 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Satosa-dev