KeyJar throws generic Exception if dance is done w/o SSl about pyoidc

[rohe]

21 aug 2015 kl. 18:38 skrev Gijutsu [email protected]:

For testing purposes, I am doing the Implicit Flow w/o the intermediary browser, instead copy/pasting responses query strings into an interactive session. On top of that, none of the RP or OP are using SSL as of now, which is to be added later in the implementation process.

As this is highly insecure, I expected the lib to throw an error – as it does:

/oic/utils/keyio.pyc in get(self, use, key_type, issuer, kid, **kwargs)
418 _keys = []
419 else:
--> 420 _keys = self.issuer_keys[issuer]
421
422 lst = []

Exception AttributeError: "'NoneType' object has no attribute 'path'" in <function _remove at 0x10063daa0> ignored

But due to this quite cryptic Exception I am unsure if this is related to the lack of SSL keys in the KeyJar. Or something else.

Agree that the exception is cryptic, it must be constructed by a function higher up in the chain.
Since I can’t see the chain of calls I don’t know which one is the culprit.

Check in an update that allows no issuer keys.

— Roland
'Look, that's why there's rules, understand? So that you think before you break ’em.’ - Terry Pratchett

[psolbach]

Check in an update that allows no issuer keys.

I should PR? Would do. With the project I'm working on I had to manually disable verification of tokens and also ran into problems with urllib2 not providing a SNI and thus failing with ssl23_get_server_hello unknown protocol. The former directly concerns pyoidc, because although the spec says always to verify, you clearly designed it to be a kwarg.

[rohe]

2 sep 2015 kl. 10:23 skrev Paul Solbach [email protected]:

Check in an update that allows no issuer keys.
I should PR? Would do.

Please do !

With the project I'm working on I had to manually disable verification of tokens and also ran into problems with urllib2 not providing a SNI and thus failing with ssl23_get_server_hello unknown protocol. The former directly concerns pyoidc, because although the spec says always to verify, you clearly designed it to be a kwarg.

Well, that is because being the maintainer of the OIDC test tool and often finding myself in a
situation where I need to debug what people are doing. I needed a toolbox that allows me to do
un-standard things.

— Roland
'Look, that's why there's rules, understand? So that you think before you break ’em.’ - Terry Pratchett