{"action":"created","issue":{"url":"https://api.github.com/repos/onelogin/python-saml/issues/85","repository_url":"https://api.github.com/repos/onelogin/python-saml","labels_url":"https://api.github.com/repos/onelogin/python-saml/issues/85/labels{/name}","comments_url":"https://api.github.com/repos/onelogin/python-saml/issues/85/comments","events_url":"https://api.github.com/repos/onelogin/python-saml/issues/85/events","html_url":"https://github.com/onelogin/python-saml/issues/85","id":104351790,"number":85,"title":"Supporting Responses that don't have AttributeStatements","user":{"login":"mpaulweeks","id":3580757,"avatar_url":"https://avatars.githubusercontent.com/u/3580757?v=3","gravatar_id":"","url":"https://api.github.com/users/mpaulweeks","html_url":"https://github.com/mpaulweeks","followers_url":"https://api.github.com/users/mpaulweeks/followers","following_url":"https://api.github.com/users/mpaulweeks/following{/other_user}","gists_url":"https://api.github.com/users/mpaulweeks/gists{/gist_id}","starred_url":"https://api.github.com/users/mpaulweeks/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpaulweeks/subscriptions","organizations_url":"https://api.github.com/users/mpaulweeks/orgs","repos_url":"https://api.github.com/users/mpaulweeks/repos","events_url":"https://api.github.com/users/mpaulweeks/events{/privacy}","received_events_url":"https://api.github.com/users/mpaulweeks/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-09-01T20:49:35Z","updated_at":"2016-02-09T14:15:44Z","closed_at":null,"body":"I've been using your library with great success for the last couple months but have recently run into a weird situation. A new client is trying to send us Responses that don't contain any AttributeStatements. Rather than identify the user with one or more AttributeStatements, they instead use the NameID value in the Subject.\r\n\r\nThis would be fine and easy to work with, except that when verifying such a Response with `strict=True`, your library raises an Error if there are no AttributeStatements: https://github.com/onelogin/python-saml/blob/master/src/onelogin/saml2/response.py#L120\r\n\r\nI have forked this library and done some tests locally, and removing that check doesn't seem to interfere with any functionality. Further, I have looked online and can't anything in the SAML2 spec that specifies that an AttributeStatement is necessary.\r\n\r\nI would be happy to create a branch that either:\r\n(1) Conditionally checks for AttributeStatements based on a bool configured in the settings (this would default to expecting them for backwards-compatibility).\r\n(2) To remove the check entirely.\r\nHowever, I want to contact you first and confirm that you would condone/merge such a change before I begin development.\r\n\r\nPlease let me know what you think!"},"comment":{"url":"https://api.github.com/repos/onelogin/python-saml/issues/comments/181881657","html_url":"https://github.com/onelogin/python-saml/issues/85#issuecomment-181881657","issue_url":"https://api.github.com/repos/onelogin/python-saml/issues/85","id":181881657,"user":{"login":"toopy","id":1251906,"avatar_url":"https://avatars.githubusercontent.com/u/1251906?v=3","gravatar_id":"","url":"https://api.github.com/users/toopy","html_url":"https://github.com/toopy","followers_url":"https://api.github.com/users/toopy/followers","following_url":"https://api.github.com/users/toopy/following{/other_user}","gists_url":"https://api.github.com/users/toopy/gists{/gist_id}","starred_url":"https://api.github.com/users/toopy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/toopy/subscriptions","organizations_url":"https://api.github.com/users/toopy/orgs","repos_url":"https://api.github.com/users/toopy/repos","events_url":"https://api.github.com/users/toopy/events{/privacy}","received_events_url":"https://api.github.com/users/toopy/received_events","type":"User","site_admin":false},"created_at":"2016-02-09T14:15:44Z","updated_at":"2016-02-09T14:15:44Z","body":"I think we can close this one ?"}}