Jamie Cockburn

When reading x509 certificates in order to produce metadata, the library assumes that the first and last lines are the begin/end certificate markers, and blindly trims them: https://github.com/IdentityPython/pysaml2/blob/v5.0.0/src/saml2/metadata.py#L832 If you...

Stream parser throws away data if too much read from socket

2

If the socket reads more data than requested (as in the SSL case), then stream parser can get more data than it requested. This means that the `some_bytes` variable [here](https://github.com/Lawouach/WebSocket-for-Python/blob/b2010a5c2af8464894e4ed6d82a7285580815acb/ws4py/streaming.py#L184)...

Cannot specify alternative IDP metadata sources

3

[This change](https://github.com/OTA-Insight/djangosaml2idp/commit/4060fc3e1aabe0a1b1a5478eefe8cd3488db6a4b#diff-01962c3bc56d6968897620f900e707fcR21) introduced model backed Service Providers. This prevents the user from ever specifying a different SP metadata source (for example an MDQ server): ```python SAML_IDP_CONFIG = { "metadata": {...

Users continue to be authenticated past access token expiry

13

I don't know if this is expected behaviour, but it seems wrong. If you authenticate a user using this library, the user will retain a logged in session indefinitely (depending...

re #270 - Added middleware to refresh access tokens

3

This PR addresses #270

String streams

3

In response to #45

added buffered reading to tokenizer

4

In response to #45

`json` in strict mode does not allow literal newlines (or other control characters) in json strings unless `strict` is `False` We should probably mimic this behaviour, and support strict/not-strict modes.

This PR in response to #32 and [this SO answer](https://stackoverflow.com/questions/39339044/how-to-write-large-json-data). For a simple test case like the one presented in the SO answer, this provides around about a 28% performance...

RFC7464 - Multiple JSON docs with record separators

2

There is an RFC https://datatracker.ietf.org/doc/html/rfc7464 for JSON docs delimited by a record separator character. Do we care to support this format with `load_many()`/`visit_many()`?