Django SAML security settings - django

Question

I am in the process of authenticating my application users using djangosaml2.
Using NAMEID_FORMAT_TRANSIENT in my SAML_CONFIG dict like this:
'service': {
# My SP SP
'sp': {
'name': 'My local SP',
'name_id_format': NAMEID_FORMAT_TRANSIENT,
'endpoints': { ... }
The user is authenticated, but the user name is received encrypted. This is a requirement from the SP. I see in the documentation for pysaml(https://github.com/onelogin/python-saml) that there is a "security" set of settings and one of the parameters there is
"nameIdEncrypted": False
My question:
How to include the "security" parameters in the SAML_CONFIG dictionary in settings.py?
The following does not seem to work:
'service': {
'sp': { ... }
}
'metadata': {
....
}
'security': {
# The nameID of the <saml:logoutRequest> sent by the SP will be encrypted
"nameIdEncrypted": True,
# Indicates whether the <samlp:AuthnRequest> messages sent by this SP
# will be signed. [Metadata of the SP will offer this info]
"authnRequestsSigned": False
}
Edit: Correcting myself: Working with my SP i have made sure that metadata and certificates are correct and my user can authenticate if security is turned off on the SP side. However, when they correctly activate security for my site I see the following in my logs when the initial SAML request goes over:
INFO 2015-10-13 10:00:43,478 response status_ok 3188 Not successful operation:
Signature required
ERROR 2015-10-13 10:00:43,478 client_base parse_authn_request_response 3188 SAML status error: Signature required from urn:oasis:names:tc:SAML:2.0:status:Requester
Still the problem remains how to pass the security settings in the SAML_CONFIG dictionary. I have tried to put them at root level, or under 'sp' to no avail. Another way could be putting them in a separate json file and have djangosaml2 use that file somehow, but I do not see how to do that either.

Answer 1

Take a look on this specific django-saml-extension(https://github.com/KristianOellegaard/django-saml-service-provider).
But at python-saml you can find a django-demo that show you how handle that settings:
https://github.com/onelogin/python-saml/tree/master/demo-django
You can see how settings are read from the saml folder.
nameIdEncrypted false means that the NameID sent from the SP is not sent encrypted.
If you want to throw an exception if a NameID received is from IdP is not encrypted you may set wantNameIdEncrypted to true.
Please read the documentation:
https://github.com/onelogin/python-saml#settings
And if you find any issue, please report it at github :)

Answer 2

as smartin
mentioned, you are looking at the wrong package documentation.
pySAML2 documentation here.
To answer your question:
"service": {
"sp": {
"authn_assertions_signed": "true",
}
}
You need to set authn_assertions_signed to true/false so the IDP knows this sp preference.