@@ -0,0 +1,2654 @@
+import re,sys,time,splunk.Intersplunk%0Aimport urllib           # urldecoding%0Aimport zlib             # uncompressing%0Aimport base64           # base64 decoding%0Aimport xml.dom.minidom  # XML tidying%0A%0Adef decode_response(response,pretty_xml=False):%0A        return()%0A%0Adef decode_authnrequest(authn_request,pretty_xml=False):%0A        #       AuthnRequest is always deflated, base64 encoded and url-escaped.%0A        #               Parameters%0A        #                       authn_request : deflated, base64 encoded and url-escaped SAML AuthnRequest XML document/string%0A        #                       pretty_xml    : Return pretty/tidy SAMLRequest XML (Multi-line, indented) (Default is False)%0A        #               Return%0A        #                       The decoded AuthnRequest if successful, %22Error decoding SAMLRequest%22 on failure.%0A        #%0A        urldecoded_SAMLRequest   = urllib.unquote(authn_request)%0A        #urldecoded_SAMLRequest  = urldecoded_SAMLRequest.strip('SAMLRequest=')%0A        b64decoded_SAMLRequest   = base64.b64decode(urldecoded_SAMLRequest)%0A        decompressed_SAMLRequest = zlib.decompress(b64decoded_SAMLRequest, -15)%0A%0A        if decompressed_SAMLRequest is None:%0A                return %22Error decoding SAMLRequest%22%0A        else:%0A                if pretty_xml:%0A                        _xml_doc = xml.dom.minidom.parseString(decompressed_SAMLRequest)%0A                        xml_pretty = _xml_doc.toprettyxml(indent='%5Ct')%0A                        return(xml_pretty)%0A                else:%0A                        return decompressed_SAMLRequest%0A                        %0Adef dosaml(results,settings):%0A        try:%0A                fields, argvals = splunk.Intersplunk.getKeywordsAndOptions()%0A                type            = argvals.get(%22type%22, %22authnrequest%22)%0A                pretty_xml      = argvals.get(%22format%22, %22raw%22)%0A    %0A                if type == %22authnrequest%22:%0A                        samlfunct = decode_authnrequest%0A                if type == %22response%22:%0A                        samlfunct = decode_response%0A    %0A                for _result in results:%0A                        for _field in fields:%0A                                if _field in _result:%0A                                        _result%5B_field%5D = samlfunct(_result%5B_field%5D)%0A    %0A                splunk.Intersplunk.outputResults(results)%0A    %0A        except:%0A                import traceback%0A                stack   = traceback.format_exc()%0A                results = splunk.Intersplunk.generateErrorResults(%22Error : Traceback: %22 + str(stack))%0A    %0Aresults, dummyresults, settings = splunk.Intersplunk.getOrganizedResults()%0Aresults = dosaml(results, settings)%0A

Create splunksaml.py