Add error page and fix SAML assertion handling for 0.3.5

- Fix AttributeError when Attribute element has no AttributeValue child
- Log CannotHandleAssertion reason instead of silently swallowing it
- Render user_not_authorized.html on UserNotAuthorized instead of 500
- Add get_login_page_url() to ServiceProvider for configurable back-link
- Bump version to 0.3.5

Author: Diego Nadares

flask_saml2/sp/parser.py

@@ -53,8 +53,11 @@ def nameid_format(self) -> str:
     @cached_property
     def attributes(self) -> Mapping[str, str]:
         attributes = self._xpath(self.assertion, 'saml:AttributeStatement/saml:Attribute')
-        return {el.get('Name'): self._xpath(el, 'saml:AttributeValue')[0].text
-                for el in attributes}
+        result = {}
+        for el in attributes:
+            values = self._xpath(el, 'saml:AttributeValue')
+            result[el.get('Name')] = values[0].text if values else None
+        return result
 
     @cached_property
     def conditions(self) -> Optional[XmlNode]:

flask_saml2/sp/sp.py

@@ -174,6 +174,12 @@ def get_login_return_url(self) -> Optional[str]:
 
         return None
 
+    def get_login_page_url(self) -> str:
+        """The URL of the application login page, used in error pages to let
+        users navigate back. Override in subclasses to point to your login UI.
+        """
+        return '/'
+
     def get_logout_return_url(self) -> Optional[str]:
         """The URL to redirect users to once they have logged out.
         """

flask_saml2/sp/templates/flask_saml2_sp/user_not_authorized.html

@@ -0,0 +1,8 @@
+{% extends 'flask_saml2_sp/base.html' %}
+
+{% block content %}
+<h1>Login failed</h1>
+<p>Access could not be granted. This may be caused by a misconfiguration in your Identity Provider or insufficient permissions.</p>
+<p>Please contact your administrator to verify the SAML configuration. You can also refer to the <a href="https://docs.faradaysec.com/SAML/#saml-single-sign-on-sso">SAML documentation</a> for setup instructions.</p>
+<p><a href="{{ return_url }}">Back to login</a></p>
+{% endblock %}

flask_saml2/sp/views.py

@@ -86,10 +86,22 @@ def post(self):
                 response = handler.get_response_parser(saml_request)
                 auth_data = handler.get_auth_data(response)
                 return self.sp.login_successful(auth_data, relay_state)
-            except CannotHandleAssertion:
+            except CannotHandleAssertion as e:
+                logger.debug("Handler %s cannot handle assertion: %s", handler, e)
                 continue
             except UserNotAuthorized:
-                return self.sp.render_template('flask_saml2_sp/user_not_authorized.html')
+                return self.sp.render_template(
+                    'flask_saml2_sp/user_not_authorized.html',
+                    return_url=self.sp.get_login_page_url(),
+                )
+            except (CannotHandleAssertion, UserNotAuthorized):
+                raise
+            except Exception:
+                logger.exception("Unexpected error handling SAML assertion from handler %s", handler)
+                return self.sp.render_template(
+                    'flask_saml2_sp/user_not_authorized.html',
+                    return_url=self.sp.get_login_page_url(),
+                )
 
 
 class Metadata(SAML2View):

flask_saml2/version.py

@@ -30,5 +30,5 @@ def make_version_string(version_info):
     return version_str
 
 
-version_info = (0, 3, 4)
+version_info = (0, 3, 5)
 version_str = make_version_string(version_info)