invalid MDQ response when entityID ends with .xml

pyFF does not return SAML metadata when the entityID in the MDQ query ends with '.xml' and the request includes the header

Accept: application/samlmetadata+xml

The draft MDQ spec can be found at

https://github.com/iay/md-query/blob/master/draft-young-md-query-saml.txt

Code Version

Commit 7705880

Expected Behavior

pyFF should return SAML metadata (XML) in response to an MDQ query for entityIDs that end in ".xml" when the request includes the header

Accept: application/samlmetadata+xml

Current Behavior

When the entityID ends in '.xml' no SAML metadata is returned for the entity with that entityID even when the header is

Accept: application/samlmetadata+xml

Steps to Reproduce

Prepare a pyFF that parses the metadata aggregate at

http://mds.swamid.se/md/swamid-2.0.xml

and then try

curl \
-H 'Accept: application/samlmetadata+xml' \
http://localhost/entities/https%3A%2F%2Flogin.idp.eduid.se%2Fidp.xml

Local changes until upstream patching to support eduID IdP

I believe this was fixed with the content negotiation policy feature yes?

Sorry, I don't have a pyFF deployment anymore with which I can test.

I believe this was fixed with the content negotiation policy feature yes?

You are right. The --content_negotiation_policy will do it.

pyFF/src/pyff/api.py

Lines 218 to 230 in 62fe3e2

    
           # content_negotiation_policy is one of three values: 
        
           # 1. extension - current default, inspect the path and if it ends in 
        
           #    an extension, e.g. .xml or .json, always strip off the extension to 
        
           #    get the entityID and if no accept header or a wildcard header, then 
        
           #    use the extension to determine the return Content-Type. 
        
           # 
        
           # 2. adaptive - only if no accept header or if a wildcard, then inspect 
        
           #    the path and if it ends in an extension strip off the extension to 
        
           #    get the entityID and use the extension to determine the return 
        
           #    Content-Type. 
        
           # 
        
           # 3. header - future default, do not inspect the path for an extension and 
        
           #    use only the Accept header to determine the return Content-Type.

Navigation Menu

Repository navigation

invalid MDQ response when entityID ends with .xml #193

Code Version

Expected Behavior

Current Behavior

Steps to Reproduce

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	# content_negotiation_policy is one of three values:
	# 1. extension - current default, inspect the path and if it ends in
	# an extension, e.g. .xml or .json, always strip off the extension to
	# get the entityID and if no accept header or a wildcard header, then
	# use the extension to determine the return Content-Type.
	#
	# 2. adaptive - only if no accept header or if a wildcard, then inspect
	# the path and if it ends in an extension strip off the extension to
	# get the entityID and use the extension to determine the return
	# Content-Type.
	#
	# 3. header - future default, do not inspect the path for an extension and
	# use only the Accept header to determine the return Content-Type.

invalid MDQ response when entityID ends with .xml #193

Description

Code Version

Expected Behavior

Current Behavior

Steps to Reproduce

Activity

leifj commented on Mar 16, 2023

skoranda commented on Mar 16, 2023

theseal commented on Jun 24, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions