SAML2 on Google Appengine

[Handerson Contreras]

Hello!!

Someone has worked with SAML2 on Google Appengine?

I have a question.

I need to build a Service Provider in GAE with Python language, I found that I can build it with pysaml2 library and Flask microframework,  but I have this exception "No module named cryptography.hazmat.bindings._openssl". I don't know what is the problem because I installed in my computer outside appengine and it works well. but when I copy the code inside a Appengine Application

The project doesn't work.

I've found that maybe some libraries used by pysaml2 library use other libraries that are not pure python.

What can you recommend me to build a Service Provider with SAML and appengine?

Thanks.

[Nick (Cloud Platform Support)]

Hey Handerson,

You should read up about the App Engine python runtime in the docs. There are certain limitations around which functionality can be used by code, and pure-python modules are necessary. You can include third-party libraries in your uploaded app by augmenting sys.path in your appengine_config.py. Of course, there are no such limitation in Managed VMs, and I think you might want to look into a Managed VM approach, which will allow you to use OS-level functionality like network interfaces and process control, make full use of C libraries, indeed anything you could run on a normal Compute Engine instance.

I hope this was a helpful starting point to your further investigation.

Best wishes,

Nic

[Handerson Contreras]

Hey Nick, Thanks for your answer, but I was reading the documentation and I saw the Managed VMs is in beta version? What is your opinion if I want to use this service in production environment?

I created my application with enabled billing and I tried upload the application using the next command:  gcloud preview app deploy app.yaml

and now I have the next error:

 Not Found Unexpected HTTP status 404.

 This application does not exist

I don't know if the error is because the documentation says  "While in Beta, United States only. European Union-hosted applications should not deploy Managed VM modules." and I'm in other country.

[Nick (Cloud Platform Support)]

Hey Handerson,

Yes, your reading of the docs is correct. For now, European-based projects can't deploy Managed VMs. While they are reasonably stable, they are still in Beta and that has implications around support and SLAs. I think your best bet is to either perform the authentication through a reverse proxy which you host on Compute Engine, to use Managed VMs outside the EU, or to attempt to do the same work using pure-python modules.