SignatureError at /saml2/login/ (failed to load external entity)

I'm using DjangoSaml2 on windows which use pysaml2, i download xmlsec1 and the needed dlls, below error is received when running

Traceback (most recent call last):
  File "C:\Program Files\Python310\lib\site-packages\saml2\sigver.py", line 860, in sign_statement
    (stdout, stderr, output) = self._run_xmlsec(com_list, [tmp.name])
  File "C:\Program Files\Python310\lib\site-packages\saml2\sigver.py", line 933, in _run_xmlsec
    raise XmlsecError(errmsg)

During handling of the above exception (returncode=1
error=I/O error : Permission denied
I/O error : Permission denied
I/O warning : failed to load external entity "C:\Users\u\AppData\Local\Temp\tmpi9vlw7gi.xml"
Error: failed to parse xml file "C:\Users\u\AppData\Local\Temp\tmpi9vlw7gi.xml"
Error: failed to load template "C:\Users\u\AppData\Local\Temp\tmpi9vlw7gi.xml"
Error: failed to sign file "C:\Users\u\AppData\Local\Temp\tmpi9vlw7gi.xml"

output=), another exception occurred:
  File "C:\Program Files\Python310\lib\site-packages\django\core\handlers\exception.py", line 47, in inner
    response = get_response(request)
  File "C:\Program Files\Python310\lib\site-packages\django\core\handlers\base.py", line 181, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "C:\Program Files\Python310\lib\site-packages\django\views\generic\base.py", line 70, in view
    return self.dispatch(request, *args, **kwargs)
  File "C:\Program Files\Python310\lib\site-packages\django\views\generic\base.py", line 98, in dispatch
    return handler(request, *args, **kwargs)
  File "C:\Program Files\Python310\lib\site-packages\djangosaml2\views.py", line 348, in get
    session_id, request_xml = client.create_authn_request(
  File "C:\Program Files\Python310\lib\site-packages\saml2\client_base.py", line 481, in create_authn_request
    msg = self._message(
  File "C:\Program Files\Python310\lib\site-packages\saml2\entity.py", line 606, in _message
    signed_req = self.sign(
  File "C:\Program Files\Python310\lib\site-packages\saml2\entity.py", line 542, in sign
    return signed_instance_factory(msg, self.sec, to_sign)
  File "C:\Program Files\Python310\lib\site-packages\saml2\sigver.py", line 344, in signed_instance_factory
    signed_xml = seccont.sign_statement(
  File "C:\Program Files\Python310\lib\site-packages\saml2\sigver.py", line 1786, in sign_statement
    return self.crypto.sign_statement(
  File "C:\Program Files\Python310\lib\site-packages\saml2\sigver.py", line 862, in sign_statement
    raise SignatureError(com_list)

Exception Type: SignatureError at /saml2/login/
Exception Value: ['xmlsec1.exe', '--sign', '--privkey-pem', 'key.pem', '--id-attr:ID', 'urn:oasis:names:tc:SAML:2.0:protocol:AuthnRequest', '--node-id', 'id-Dihqjb9ADFOjG3mvp', '--output', 'C:\\Users\\u\\AppData\\Local\\Temp\\tmpz91m2e_u.xml', 'C:\\Users\\u\\AppData\\Local\\Temp\\tmpi9vlw7gi.xml']

hello, as with IdentityPython/pyXMLSecurity#71 it looks as if the process is not allowed to read files from temporary storage

error=I/O error : Permission denied
I/O error : Permission denied

PermissionError: [Errno 13] Permission denied: 'C:\\Users\\Amr\\AppData\\Local\\Temp\\tmps_abq_kj.pem'
XML parse error: [Errno 13] Permission denied: 'C:\\Users\\Amr\\AppData\\Local\\Temp\\tmps_abq_kj.pem'

Is the process allowed to read/write to the filesystem?

@c00kiemon5ter

@c00kiemon5ter it can write to the temp directory, as I can see the file is created but it can't open it for read, when I copy this file from temp dir to another dir I can open it, i tried to run as admin but still same problem

ok, I think this goes back to the generic issue of the NamedTemporaryFile in Python on Windows.
Related MR and discussion: #665

I can confirm that I have the same problem "SignatureError" when running djangosaml2 on Windows server 2016.

I see two problems, a general problem is that installing xmlsec1.exe in windows is a bit complex as there are very few builds.

The second problem is that the NamedTemporaryFile function only works in Windows when the temporary files are used by the current Python program and not when calling external programs such as xmlsec1.exe with Popen. This is due to file locks in Windows.

Has anyone come up with a good solution to get this working under Windows?

I am guessing everything should work within WSL2 (Windows Subsystem for Linux)

WSL is not always an option, specifically for embedded python in windows applications.

Until a solution is found, I have monkey patched the _run_xmlsec method to avoid the current issue:

from saml2.sigver import CryptoBackendXmlSec1, XmlsecError, logger
from tempfile import NamedTemporaryFile
from subprocess import Popen
from subprocess import PIPE

def _run_xmlsec(self, com_list, extra_args):
    """
    Common code to invoke xmlsec and parse the output.
    :param com_list: Key-value parameter list for xmlsec
    :param extra_args: Positional parameters to be appended after all
        key-value parameters
    :result: Whatever xmlsec wrote to an --output temporary file
    """
    with NamedTemporaryFile(suffix='.xml', delete=False) as ntf:
        com_list.extend(['--output', ntf.name])
        com_list += extra_args

        logger.debug('xmlsec command: %s', ' '.join(com_list))

        pof = Popen(com_list, stderr=PIPE, stdout=PIPE)
        p_out, p_err = pof.communicate()
        p_out = p_out.decode()
        p_err = p_err.decode()

        if pof.returncode != 0:
            errmsg = "returncode={code}\nerror={err}\noutput={out}".format(
                code=pof.returncode, err=p_err, out=p_out
            )
            logger.error(errmsg)
            raise XmlsecError(errmsg)

        ntf.seek(0)
        return p_out, p_err, ntf.read()

CryptoBackendXmlSec1._run_xmlsec = _run_xmlsec

Is it possible to get PR #931 and #933 merged so it can be included in the next release?

@henrikek

Hi , i was trying to integrate sso using djangosaml2 that uses pysaml2 under the hood and getting similar error after authenticating from the idp and getting 403 on the /saml2/acs url
`error=Error: xmlSecCryptoAppKeyLoadEx failed: file=C:\Windows\TEMP\tmp3vs3l6v5.pem

Error: failed to load public key from "C:\Windows\TEMP\tmp3vs3l6v5.pem".

Error: keys manager creation failed
`
is above issue related @henrikek @talebi1 ??

Navigation Menu

Repository navigation

SignatureError at /saml2/login/ (failed to load external entity) #863

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

SignatureError at /saml2/login/ (failed to load external entity) #863

Description

Activity

c00kiemon5ter commented on Jul 18, 2022

Amr-Es commented on Jul 18, 2022

c00kiemon5ter commented on Jul 18, 2022

henrikek commented on Oct 4, 2022

c00kiemon5ter commented on Oct 4, 2022

talebi1 commented on Feb 14, 2023

henrikek commented on Aug 13, 2025

SayeedKhan21 commented on Sep 30, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions