def is_valid(self, request_data, request_id=None, raise_exceptions=False):
self.__error = None<EOL>try:<EOL><INDENT>if self.document.get('<STR_LIT>', None) != '<STR_LIT>':<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.UNSUPPORTED_SAML_VERSION<EOL>)<EOL><DEDENT>if self.document.get('<STR_LIT>', None) is None:<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.MISSING_ID<EOL>)<EOL><DEDENT>self.check_status()<EOL>if not self.validate_num_assertions():<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.WRONG_NUMBER_OF_ASSERTIONS<EOL>)<EOL><DEDENT>idp_data = self.__settings.get_idp_data()<EOL>idp_entity_id = idp_data.get('<STR_LIT>', '<STR_LIT>')<EOL>sp_data = self.__settings.get_sp_data()<EOL>sp_entity_id = sp_data.get('<STR_LIT>', '<STR_LIT>')<EOL>signed_elements = self.process_signed_elements()<EOL>has_signed_response = '<STR_LIT>' % OneLogin_Saml2_Constants.NS_SAMLP in signed_elements<EOL>has_signed_assertion = '<STR_LIT>' % OneLogin_Saml2_Constants.NS_SAML in signed_elements<EOL>if self.__settings.is_strict():<EOL><INDENT>no_valid_xml_msg = '<STR_LIT>'<EOL>res = OneLogin_Saml2_Utils.validate_xml(<EOL>tostring(self.document),<EOL>'<STR_LIT>',<EOL>self.__settings.is_debug_active()<EOL>)<EOL>if not isinstance(res, Document):<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>no_valid_xml_msg,<EOL>OneLogin_Saml2_ValidationError.INVALID_XML_FORMAT<EOL>)<EOL><DEDENT>if self.encrypted:<EOL><INDENT>res = OneLogin_Saml2_Utils.validate_xml(<EOL>tostring(self.decrypted_document),<EOL>'<STR_LIT>',<EOL>self.__settings.is_debug_active()<EOL>)<EOL>if not isinstance(res, Document):<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>no_valid_xml_msg,<EOL>OneLogin_Saml2_ValidationError.INVALID_XML_FORMAT<EOL>)<EOL><DEDENT><DEDENT>security = self.__settings.get_security_data()<EOL>current_url = OneLogin_Saml2_Utils.get_self_url_no_query(request_data)<EOL>in_response_to = self.document.get('<STR_LIT>', None)<EOL>if request_id is None and in_response_to is not None and security.get('<STR_LIT>', False):<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>' % in_response_to,<EOL>OneLogin_Saml2_ValidationError.WRONG_INRESPONSETO<EOL>)<EOL><DEDENT>if request_id is not None and in_response_to != request_id:<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>' % (in_response_to, request_id),<EOL>OneLogin_Saml2_ValidationError.WRONG_INRESPONSETO<EOL>)<EOL><DEDENT>if not self.encrypted and security.get('<STR_LIT>', False):<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.NO_ENCRYPTED_ASSERTION<EOL>)<EOL><DEDENT>if security.get('<STR_LIT>', False):<EOL><INDENT>encrypted_nameid_nodes = self.__query_assertion('<STR_LIT>')<EOL>if len(encrypted_nameid_nodes) != <NUM_LIT:1>:<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.NO_ENCRYPTED_NAMEID<EOL>)<EOL><DEDENT><DEDENT>if not self.check_one_condition():<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.MISSING_CONDITIONS<EOL>)<EOL><DEDENT>self.validate_timestamps(raise_exceptions=True)<EOL>if not self.check_one_authnstatement():<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.WRONG_NUMBER_OF_AUTHSTATEMENTS<EOL>)<EOL><DEDENT>requested_authn_contexts = security.get('<STR_LIT>', True)<EOL>if security.get('<STR_LIT>', False) and requested_authn_contexts and requested_authn_contexts is not True:<EOL><INDENT>authn_contexts = self.get_authn_contexts()<EOL>unmatched_contexts = set(requested_authn_contexts).difference(authn_contexts)<EOL>if unmatched_contexts:<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>' % ('<STR_LIT:U+002CU+0020>'.join(authn_contexts), '<STR_LIT:U+002CU+0020>'.join(unmatched_contexts)),<EOL>OneLogin_Saml2_ValidationError.AUTHN_CONTEXT_MISMATCH<EOL>)<EOL><DEDENT><DEDENT>attribute_statement_nodes = self.__query_assertion('<STR_LIT>')<EOL>if security.get('<STR_LIT>', True) and not attribute_statement_nodes:<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.NO_ATTRIBUTESTATEMENT<EOL>)<EOL><DEDENT>encrypted_attributes_nodes = self.__query_assertion('<STR_LIT>')<EOL>if encrypted_attributes_nodes:<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.ENCRYPTED_ATTRIBUTES<EOL>)<EOL><DEDENT>destination = self.document.get('<STR_LIT>', None)<EOL>if destination:<EOL><INDENT>if not destination.startswith(current_url):<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>' % (current_url, destination),<EOL>OneLogin_Saml2_ValidationError.WRONG_DESTINATION<EOL>)<EOL><DEDENT><DEDENT>elif destination == '<STR_LIT>':<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.EMPTY_DESTINATION<EOL>)<EOL><DEDENT>valid_audiences = self.get_audiences()<EOL>if valid_audiences and sp_entity_id not in valid_audiences:<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>' % sp_entity_id,<EOL>OneLogin_Saml2_ValidationError.WRONG_AUDIENCE<EOL>)<EOL><DEDENT>issuers = self.get_issuers()<EOL>for issuer in issuers:<EOL><INDENT>if issuer is None or issuer != idp_entity_id:<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>' %<EOL>{<EOL>'<STR_LIT>': idp_entity_id,<EOL>'<STR_LIT>': issuer<EOL>},<EOL>OneLogin_Saml2_ValidationError.WRONG_ISSUER<EOL>)<EOL><DEDENT><DEDENT>session_expiration = self.get_session_not_on_or_after()<EOL>if session_expiration and session_expiration <= OneLogin_Saml2_Utils.now():<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.SESSION_EXPIRED<EOL>)<EOL><DEDENT>any_subject_confirmation = False<EOL>subject_confirmation_nodes = self.__query_assertion('<STR_LIT>')<EOL>for scn in subject_confirmation_nodes:<EOL><INDENT>method = scn.get('<STR_LIT>', None)<EOL>if method and method != OneLogin_Saml2_Constants.CM_BEARER:<EOL><INDENT>continue<EOL><DEDENT>sc_data = scn.find('<STR_LIT>', namespaces=OneLogin_Saml2_Constants.NSMAP)<EOL>if sc_data is None:<EOL><INDENT>continue<EOL><DEDENT>else:<EOL><INDENT>irt = sc_data.get('<STR_LIT>', None)<EOL>if (in_response_to is None and irt is not None and<EOL>security.get('<STR_LIT>', False)) orin_response_to and irt and irt != in_response_to:<EOL><INDENT>continue<EOL><DEDENT>recipient = sc_data.get('<STR_LIT>', None)<EOL>if recipient and current_url not in recipient:<EOL><INDENT>continue<EOL><DEDENT>nooa = sc_data.get('<STR_LIT>', None)<EOL>if nooa:<EOL><INDENT>parsed_nooa = OneLogin_Saml2_Utils.parse_SAML_to_time(nooa)<EOL>if parsed_nooa <= OneLogin_Saml2_Utils.now():<EOL><INDENT>continue<EOL><DEDENT><DEDENT>nb = sc_data.get('<STR_LIT>', None)<EOL>if nb:<EOL><INDENT>parsed_nb = OneLogin_Saml2_Utils.parse_SAML_to_time(nb)<EOL>if parsed_nb > OneLogin_Saml2_Utils.now():<EOL><INDENT>continue<EOL><DEDENT><DEDENT>if nooa:<EOL><INDENT>self.valid_scd_not_on_or_after = OneLogin_Saml2_Utils.parse_SAML_to_time(nooa)<EOL><DEDENT>any_subject_confirmation = True<EOL>break<EOL><DEDENT><DEDENT>if not any_subject_confirmation:<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.WRONG_SUBJECTCONFIRMATION<EOL>)<EOL><DEDENT>if security.get('<STR_LIT>', False) and not has_signed_assertion:<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.NO_SIGNED_ASSERTION<EOL>)<EOL><DEDENT>if security.get('<STR_LIT>', False) and not has_signed_response:<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.NO_SIGNED_MESSAGE<EOL>)<EOL><DEDENT><DEDENT>if not signed_elements or (not has_signed_response and not has_signed_assertion):<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.NO_SIGNATURE_FOUND<EOL>)<EOL><DEDENT>else:<EOL><INDENT>cert = idp_data.get('<STR_LIT>', None)<EOL>fingerprint = idp_data.get('<STR_LIT>', None)<EOL>fingerprintalg = idp_data.get('<STR_LIT>', None)<EOL>multicerts = None<EOL>if '<STR_LIT>' in idp_data and '<STR_LIT>' in idp_data['<STR_LIT>'] and idp_data['<STR_LIT>']['<STR_LIT>']:<EOL><INDENT>multicerts = idp_data['<STR_LIT>']['<STR_LIT>']<EOL><DEDENT>if has_signed_response and not OneLogin_Saml2_Utils.validate_sign(self.document, cert, fingerprint, fingerprintalg, xpath=OneLogin_Saml2_Utils.RESPONSE_SIGNATURE_XPATH, multicerts=multicerts, raise_exceptions=False):<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.INVALID_SIGNATURE<EOL>)<EOL><DEDENT>document_check_assertion = self.decrypted_document if self.encrypted else self.document<EOL>if has_signed_assertion and not OneLogin_Saml2_Utils.validate_sign(document_check_assertion, cert, fingerprint, fingerprintalg, xpath=OneLogin_Saml2_Utils.ASSERTION_SIGNATURE_XPATH, multicerts=multicerts, raise_exceptions=False):<EOL><INDENT>raise OneLogin_Saml2_ValidationError(<EOL>'<STR_LIT>',<EOL>OneLogin_Saml2_ValidationError.INVALID_SIGNATURE<EOL>)<EOL><DEDENT><DEDENT>return True<EOL><DEDENT>except Exception as err:<EOL><INDENT>self.__error = err.__str__()<EOL>debug = self.__settings.is_debug_active()<EOL>if debug:<EOL><INDENT>print(err.__str__())<EOL><DEDENT>if raise_exceptions:<EOL><INDENT>raise err<EOL><DEDENT>return False<EOL><DEDENT>
Validates the response object.

:param request_data: Request Data
:type request_data: dict

:param request_id: Optional argument. The ID of the AuthNRequest sent by this SP to the IdP
:type request_id: string

:param raise_exceptions: Whether to return false on failure or raise an exception
:type raise_exceptions: Boolean

:returns: True if the SAML Response is valid, False if not
:rtype: bool