Skip to content

Conversation

@Nyefan
Copy link

@Nyefan Nyefan commented Oct 29, 2025

Currently, any code base depending on both the python3-saml and onelogin packages are not able to use the latest versions of both packages. In particular, it is not possible to use python3-saml>1.14.0 or onelogin>3.1.6 because of the conflicting onelogin.saml2.auth package and the import of onelogin.api in onelogin's top level __init__.py.

This can be mitigated by users by installing one or both in their own separate prefixes and manipulating the order of these prefixes in the PYTHONPATH at the beginning of any files which depend on either (but not both) package. However, this is clunky and error prone and can be fixed upstream by changing the import path of python3-saml from onelogin.<package> to python3_saml.<package>.

Also, there is a HIGH CVE in xmlsec and lxml that requires updating python3-saml to 1.16.0 to mitigate unless we want to build them from source every time we build a container.

This PR migrates all packages. tests, demos, build files, and the readme to use python3_saml. The docs directory has been ignored since that is (maybe?) autogenerated from some other source, but I can update the docs as well if you are amenable to this change. It would be a breaking change for all consumers requiring a 2.0.0 release, but I suspect it would be a welcome one.

Nyefan and others added 2 commits October 29, 2025 17:56
…to avoid conflicting with onelogin

BREAKING CHANGE: imports will need to be changed from `from onelogin.<path> import ...` to `from python3_saml.<path> import ...`
chore(INFRA-831): move application to a new namespace (python3_saml) to avoid conflicting with onelogin
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant