Merge lp:~roadmr/canonical-identity-provider/revert-r1586 into lp:canonical-identity-provider/release

[Daniel Manrique]

Revert r1586 because it broke non-Canonical logins to support.canonical.com

Mechanical revert by bzr merge -r 1586..1585 ./

Revert r1586 because it broke non-Canonical logins to support.canonical.com.

Mechanical revert by bzr merge -r 1586..1585 ./

[Ricardo Kirkner (ricardokirkner)]

review: Approve

[Otto Co-Pilot (otto-copilot)]

Running landing tests failed
https://jenkins.ols.canonical.com/online-services/job/canonical-identity-provider/30/

=== modified file 'src/ubuntu_sso_saml/processors.py'
--- src/ubuntu_sso_saml/processors.py	2017-11-10 23:02:24 +0000
+++ src/ubuntu_sso_saml/processors.py	2017-12-04 16:27:44 +0000
@@ -30,7 +30,7 @@
         user, _ = email.split('@')
         return '.' in user and '+' not in user
 
-    def _get_preferred_email(self, account):
+    def _get_canonical_email(self, account):
         preferred = account.preferredemail.email
         if (self._is_canonical_email(preferred) and
                 self._is_long_form_email(preferred)):
@@ -59,7 +59,7 @@
         if trust_root is not None:
             rpconfig = OpenIDRPConfig.objects.for_url(trust_root)
             if rpconfig is not None and rpconfig.prefer_canonical_email:
-                canonical_email = self._get_preferred_email(account)
+                canonical_email = self._get_canonical_email(account)
                 if canonical_email is not None:
                     preferred = canonical_email
 
@@ -105,12 +105,12 @@
             'saml_url',
             'https://saml.salesforce.com')
 
-    def _get_preferred_email(self, account):
+    def _get_canonical_email(self, account):
         """
         For the SalesForce portal, use [e-mail].
         """
         email = super(SalesForceAttributeProcessor,
-                      self)._get_preferred_email(account)
+                      self)._get_canonical_email(account)
         if email is not None:
             username, domain = email.split('@')
             pattern = self._sp_config.get('email_pattern',
@@ -269,40 +269,15 @@
         acs_url = self._request_params.get('ACS_URL')
         return get_config_for_acs(acs_url)
 
-    def _get_preferred_email(self, account):
-        """Return the user's preferred email, with some overrides.
-
-        Note we don't always honor the account's "preferred" address.
-
-        From CanonicalOverrides, whichever matches first of:
-        1- If the account's preferred address is @canonical.com and in
-           long-form, use that.
-        2- If the account has *any* long-form @canonical.com address, use that.
-        3- If the account's preferred e-mail is any @canonical.com, use that.
-           (but note we don't override-prefer non-long-form @canonical.com)
-
-        And from this method, if none of the previous ones matched:
-        4- If the account has a preferred email address, use that.
-
-        Rules 3 and 4 overlap because 3 is a subset of 4 (if you don't have a
-        long-form email address, we honor whichever address is preferred,
-        canonical.com or not)
-
-        """
-        # get possible @canonical.com address
-        email = super(CanonicalProcessor, self)._get_preferred_email(account)
-        if email is None:
-            # user did not have a @canonical.com address
-            email = account.preferredemail.email
+    def _get_canonical_email(self, account):
+        email = super(CanonicalProcessor, self)._get_canonical_email(account)
+        if email is not None:
+            sp_config = self.get_config()
+            username, domain = email.split('@')
+            email = sp_config.email_pattern.format(
+                username=username, domain=domain)
         return email
 
-    def _format_email(self, email):
-        sp_config = self.get_config()
-        username, domain = email.split('@')
-        mangled_email = sp_config.email_pattern.format(
-            username=username, domain=domain)
-        return mangled_email
-
     # saml2idp.base.Processor interface
 
     def _build_assertion(self):
@@ -333,11 +308,11 @@
         sp_config = self.get_config()
         if sp_config is not None:
             if sp_config.prefer_canonical_email:
-                canonical_email = self._get_preferred_email(account)
+                canonical_email = self._get_canonical_email(account)
                 if canonical_email is not None:
                     preferred = canonical_email
 
-        self._subject = self._format_email(preferred)
+        self._subject = preferred
 
     def _format_assertion(self):
         sp_config = self.get_config()

=== modified file 'src/ubuntu_sso_saml/tests/test_processors.py'
--- src/ubuntu_sso_saml/tests/test_processors.py	2017-11-21 23:11:27 +0000
+++ src/ubuntu_sso_saml/tests/test_processors.py	2017-12-04 16:27:44 +0000
@@ -129,16 +129,6 @@
     def get_request_data(self):
         return self.REQUEST_DATA
 
-    def assert_email_in(self, email, response):
-        # This is defined as an assertion to allow classes to override it
-        # in order to check for possibly postprocessed e-mail.
-        self.assertIn(email, response)
-
-    def assert_email_not_in(self, email, response):
-        # This is defined as an assertion to allow classes to override it
-        # in order to check for possibly postprocessed e-mail.
-        self.assertNotIn(email, response)
-
 
 class CanonicalProcessorBaseTestCase(BaseProcessorTestCase):
 
@@ -239,7 +229,7 @@
         samlresponse = get_saml_response(response)
 
         # Assert:
-        self.assert_email_in(self.login_email, samlresponse)
+        self.assertIn(self.login_email, samlresponse)
 
     def test_user_has_different_preferred_email(self):
         """ User's preferred email is not being passed as SAML identifier. """
@@ -273,7 +263,7 @@
         samlresponse = get_saml_response(response)
 
         # Assert:
-        self.assert_email_in(alternate_email, samlresponse)
+        self.assertIn(alternate_email, samlresponse)
 
     def test_user_not_2f_but_no_rpconfig(self):
         data = self.get_request_data()
@@ -326,7 +316,7 @@
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is returned despite it's not the
         # preferredemail
-        self.assert_email_in('[e-mail]', samlresponse)
+        self.assertIn('[e-mail]', samlresponse)
         self.assertNotEqual('[e-mail]', preferred)
 
     def test_canonical_email_is_preferred_despite_case(self):
@@ -336,7 +326,7 @@
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is returned despite it's not the
         # preferredemail
-        self.assert_email_in(email, samlresponse)
+        self.assertIn(email, samlresponse)
         self.assertNotEqual(email, preferred)
 
     def test_only_long_form_canonical_email_is_preferred(self):
@@ -353,8 +343,8 @@
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is returned despite it's not the
         # preferredemail
-        self.assert_email_in('[e-mail]', samlresponse)
-        self.assert_email_not_in(email, samlresponse)
+        self.assertIn('[e-mail]', samlresponse)
+        self.assertNotIn(email, samlresponse)
 
     def test_canonical_email_is_not_preferred(self):
         self.setup_saml_sp(prefer_canonical_email=False)
@@ -362,7 +352,7 @@
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is *not* returned despite because
         # the flag was not set
-        self.assert_email_in(preferred, samlresponse)
+        self.assertIn(preferred, samlresponse)
         self.assertNotEqual('[e-mail]', preferred)
 
     def test_canonical_email_without_rpconfig(self):
@@ -374,7 +364,7 @@
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is *not* returned despite because
         # the flag was not set
-        self.assert_email_in(preferred, samlresponse)
+        self.assertIn(preferred, samlresponse)
         self.assertNotEqual('[e-mail]', preferred)
 
     def test_short_form_canonical_email_ignored(self):
@@ -397,7 +387,7 @@
 
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is *not* returned
-        self.assert_email_in(preferred, samlresponse)
+        self.assertIn(preferred, samlresponse)
         self.assertNotEqual('[e-mail]', preferred)
         self.assertNotEqual('[e-mail]', preferred)
 
@@ -417,7 +407,7 @@
             username=preferred, password=DEFAULT_USER_PASSWORD)
 
         samlresponse = self.do_saml_request()
-        self.assert_email_in(preferred, samlresponse)
+        self.assertIn(preferred, samlresponse)
 
     def test_multiple_long_form_canonical_emails(self):
         self.setup_saml_sp(prefer_canonical_email=True)
@@ -436,8 +426,8 @@
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is returned despite it's not the
         # preferredemail
-        self.assert_email_in('[e-mail]', samlresponse)
-        self.assert_email_not_in('[e-mail]', samlresponse)
+        self.assertIn('[e-mail]', samlresponse)
+        self.assertNotIn('[e-mail]', samlresponse)
 
 
 class GoogleAppsAssertionCanonicalProcessorTestCase(
@@ -464,17 +454,6 @@
     REQUEST_DATA = salesforce.REQUEST_DATA
     PROCESSOR = 'ubuntu_sso_saml.processors.SalesForceAttributeProcessor'
 
-    # These are used only for asserting the expected address appears in the
-    # final saml response.  They contain the mangling (+portal, .hr) because
-    # our assert_email_in doesn't apply that, and also because the e-mail
-    # pattern doesn't change so we know it a priori.
-    long_form_canonical_email = '[e-mail]'
-    long_form_canonical_email_uppercase = '[e-mail]'
-    short_form_canonical_email = "[e-mail]"
-    alternative_canonical_email = "[e-mail]"
-    short_form_canonical_email_custom_pattern = "[e-mail]"
-    long_form_canonical_email_custom_pattern = "[e-mail]"
-
     def setUp(self, *args, **kwargs):
         super(SalesForcePortalAssertionTestCase, self).setUp(*args, **kwargs)
         target = 'https://somesite.salesforce.com/%(target)s'
@@ -503,23 +482,23 @@
         self.setup_saml_sp(prefer_canonical_email=True)
         preferred = self.setup_saml_emails()
         samlresponse = self.do_saml_request()
-        self.assert_email_in(self.long_form_canonical_email, samlresponse)
+        self.assertIn('[e-mail]', samlresponse)
         self.assertNotEqual('[e-mail]', preferred)
 
     def test_canonical_email_is_preferred_despite_case(self):
         email = '[e-mail]'
+        portal_email = '[e-mail]'
         self.setup_saml_sp(prefer_canonical_email=True)
         preferred = self.setup_saml_emails(email=email)
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is returned despite it's not the
         # preferredemail
-        self.assert_email_in(
-            self.long_form_canonical_email_uppercase, samlresponse)
-        self.assertNotEqual(
-            self.long_form_canonical_email_uppercase, preferred)
+        self.assertIn(portal_email, samlresponse)
+        self.assertNotEqual(portal_email, preferred)
 
     def test_only_long_form_canonical_email_is_preferred(self):
         email = self.login_email
+        portal_email = '[e-mail]'
         # add non-preferred long form email address
         EmailAddress.objects.create(
             account=self.account, email='[e-mail]',
@@ -532,32 +511,28 @@
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is returned despite it's not the
         # preferredemail
-        self.assert_email_in(self.long_form_canonical_email, samlresponse)
-        self.assertNotEqual(self.long_form_canonical_email, preferred)
+        self.assertIn(portal_email, samlresponse)
+        self.assertNotEqual(portal_email, preferred)
 
     def test_non_canonical_email(self):
-        samlresponse = self._test_non_canonical_email()
+        # prepare account for SAML
+        account = self.factory.make_account()
+        preferred = account.preferredemail.email
+        self.factory.add_account_to_team(account, self.saml2team)
+        self.setup_saml_sp(prefer_canonical_email=True)
+
+        # make sure account has only one email
+        assert account.emailaddress_set.count() == 1
+        # and it's not a @canonical.com one
+        assert '@canonical.com' not in preferred
+
+        assert self.client.login(
+            username=preferred, password=DEFAULT_USER_PASSWORD)
+
+        samlresponse = self.do_saml_request()
+        self.assertIn(preferred, samlresponse)
         self.assertNotIn('+portal@', samlresponse)
 
-    def _test_non_canonical_email(self):
-        # prepare account for SAML
-        account = self.factory.make_account()
-        preferred = account.preferredemail.email
-        self.factory.add_account_to_team(account, self.saml2team)
-        self.setup_saml_sp(prefer_canonical_email=True)
-
-        # make sure account has only one email
-        assert account.emailaddress_set.count() == 1
-        # and it's not a @canonical.com one
-        assert '@canonical.com' not in preferred
-
-        assert self.client.login(
-            username=preferred, password=DEFAULT_USER_PASSWORD)
-
-        samlresponse = self.do_saml_request()
-        self.assert_email_in(preferred, samlresponse)
-        return samlresponse
-
     def test_multiple_long_form_canonical_emails(self):
         self.setup_saml_sp(prefer_canonical_email=True)
         self.setup_saml_emails()
@@ -575,9 +550,8 @@
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is returned despite it's not the
         # preferredemail
-        self.assert_email_in(self.alternative_canonical_email, samlresponse)
-        self.assert_email_not_in(
-            '[e-mail]', samlresponse)
+        self.assertIn('[e-mail]', samlresponse)
+        self.assertNotIn('[e-mail]', samlresponse)
 
     def test_portal_deeplink(self):
         """Unable to produce a valid Portal Assertion.
@@ -611,7 +585,7 @@
         port_val = port_attr[0].find('attributevalue')
 
         # Assert:
-        self.assert_email_in(self.login_email, samlresponse)
+        self.assertIn(self.login_email, samlresponse)
         self.assertEqual(relaystate,
                          'https://somesite.salesforce.com/SOMETARGETID')
         self.assertEqual(org_val.text, 'SAMPLE_ORG_ID')
@@ -653,7 +627,7 @@
         assert len(port_attr) == 0
 
         # Assert:
-        self.assert_email_in(self.login_email, samlresponse)
+        self.assertIn(self.login_email, samlresponse)
         self.assertEqual(relaystate,
                          'https://somesite.salesforce.com/SOMETARGETID')
         self.assertEqual(org_val.text, 'SAMPLE_ORG_ID')
@@ -678,8 +652,7 @@
 
         samlresponse = self.do_saml_request()
         # make sure the login email was transformed
-        self.assert_email_in(
-            self.long_form_canonical_email_custom_pattern, samlresponse)
+        self.assertIn('[e-mail]', samlresponse)
 
     def test_custom_email_pattern_with_short_form_canonical_email(self):
         # patch remote config
@@ -706,8 +679,7 @@
 
         samlresponse = self.do_saml_request()
         # make sure the login email was transformed
-        self.assert_email_in(
-            self.short_form_canonical_email_custom_pattern, samlresponse)
+        self.assertIn('[e-mail]', samlresponse)
 
     def make_saml_request(self, acs_url=None, saml_url=None):
         saml_request = self.REQUEST_DATA['SAMLRequest']
@@ -776,15 +748,6 @@
 class SalesForcePortalAssertionCanonicalProcessorTestCase(
         CanonicalProcessorBaseTestCase, SalesForcePortalAssertionTestCase):
 
-    # The e-mail addresses to verify don't need the e-mail pattern pre-applied
-    # because it's applied consistently and checked by assert_email_in.
-    long_form_canonical_email = '[e-mail]'
-    long_form_canonical_email_uppercase = '[e-mail]'
-    short_form_canonical_email = "[e-mail]"
-    alternative_canonical_email = "[e-mail]"
-    short_form_canonical_email_custom_pattern = "[e-mail]"
-    long_form_canonical_email_custom_pattern = "[e-mail]"
-
     def setup_saml_sp(self, **kwargs):
         # define a default value for the email pattern if none is given
         kwargs.setdefault('email_pattern', '{username}+portal@{domain}')
@@ -804,38 +767,6 @@
             SalesForcePortalAssertionCanonicalProcessorTestCase,
             self).setup_saml_sp(**kwargs)
 
-    def assert_email_in(self, email, response):
-        # Since this uses CanonicalProcessor, the email_pattern is applied
-        # to all users, @canonical.com or not.
-
-        # We always use the same remote.
-        # This logic replicates what the CanonicalProcessor has in
-        # _format_email.
-        pattern = saml2idp_metadata.SAML2IDP_REMOTES['foobar']['email_pattern']
-        username, domain = email.split('@')
-        mangled_email = pattern.format(
-            username=username, domain=domain)
-
-        self.assertIn(mangled_email, response)
-
-    def assert_email_not_in(self, email, response):
-        # Since this uses CanonicalProcessor, the email_pattern is applied
-        # to all users, @canonical.com or not.
-
-        # We always use the same remote.
-        # This logic replicates what the CanonicalProcessor has in
-        # _format_email.
-        pattern = saml2idp_metadata.SAML2IDP_REMOTES['foobar']['email_pattern']
-        username, domain = email.split('@')
-        mangled_email = pattern.format(
-            username=username, domain=domain)
-
-        self.assertNotIn(mangled_email, response)
-
-    def test_non_canonical_email(self):
-        self._test_non_canonical_email()
-        # No need to check for absence of +portal@
-
 
 class ExpensifyAssertionTestCase(GoogleAppsAssertionTestCase):
     """Test SAML Assertions for an Expensify Service Point."""
@@ -1268,7 +1199,7 @@
         self.assertNotIn('<saml:AudienceRestriction>', samlresponse)
 
     def assert_saml_response_email(self, samlresponse, email):
-        self.assert_email_in(email, samlresponse)
+        self.assertIn(email, samlresponse)
 
     def get_request_data(self, compressed=True):
         data = dict(**self.REQUEST_DATA)
@@ -1353,39 +1284,6 @@
         self.assert_saml_response_email(
             samlresponse, '[e-mail]')
 
-    def test_email_pattern_applied_canonical_email(self):
-        # This simply tests application of the pattern for @canonical.com
-        # addresses. This account has two of those.
-        self.setup_saml_sp(email_pattern='{username}+test@{domain}',
-                           prefer_canonical_email=True, enabled=True)
-        self.setup_saml_emails(email="[e-mail]")
-
-        samlresponse = self.do_saml_request()
-        self.assert_successful_saml_response(samlresponse)
-        self.assert_saml_response_email(
-            samlresponse, '[e-mail]')
-
-    def test_email_pattern_applied_non_canonical_email_only(self):
-        # Tests application of the pattern for [e-mail].
-        # This account has 2 addresses, we also indirectly check that
-        # when no @canonical.com addresses exist, the preferred one
-        # is used. Scenario 4 of _get_preferred_email.
-        self.setup_saml_sp(email_pattern='{username}+test@{domain}',
-                           prefer_canonical_email=True, enabled=True)
-        self.login_email = '[e-mail]'
-        EmailAddress.objects.create(
-            account=self.account, email=self.login_email,
-            status=EmailStatus.PREFERRED)
-        # Set up an additional non-canonical address
-        self.setup_saml_emails(email="[e-mail]")
-
-        samlresponse = self.do_saml_request()
-        self.assert_successful_saml_response(samlresponse)
-        # Must get the preferred non-canonical email with the email_pattern
-        # applied
-        self.assert_saml_response_email(
-            samlresponse, '[e-mail]')
-
     def test_disabled_db_spconfig_falls_back_to_settings(self):
         # make sure there is an "old/custom" processor handling this request
         self.ACS_URL = google_apps.GOOGLE_APPS_ACS
@@ -1418,34 +1316,13 @@
         response = client.post('/+saml', data=data, follow=False)
         self.assertEqual(response.status_code, 302)
 
-    def test_long_canonical_email_is_used_when_preferred(self):
-        # This account has 2 addresses, both @canonical.com, with the
-        # long-form one being preferred.
-        # This is scenario 1 of _get_preferred_email.
-        self.setup_saml_sp(prefer_canonical_email=True)
-        self.setup_saml_emails()
-        # Flip preferredness
-        short_email = EmailAddress.objects.get(
-            account=self.account, email='[e-mail]')
-        short_email.status = EmailStatus.VALIDATED
-        short_email.save()
-        long_email = EmailAddress.objects.get(
-            account=self.account, email='[e-mail]')
-        long_email.status = EmailStatus.PREFERRED
-        long_email.save()
-        samlresponse = self.do_saml_request()
-        self.assert_email_in('[e-mail]', samlresponse)
-
     def test_canonical_email_is_preferred(self):
-        # This account has 2 addresses, both @canonical.com. The short
-        # one is marked as preferred, the long-form one is not.
-        # This is scenario 2 of _get_preferred_email.
         self.setup_saml_sp(prefer_canonical_email=True)
         preferred = self.setup_saml_emails()
         samlresponse = self.do_saml_request()
-        # verify [e-mail] email address is returned despite it's
-        # not the preferredemail
-        self.assert_email_in('[e-mail]', samlresponse)
+        # verify @canonical.com email address is returned despite it's not the
+        # preferredemail
+        self.assertIn('[e-mail]', samlresponse)
         self.assertNotEqual('[e-mail]', preferred)
 
     def test_canonical_email_is_preferred_despite_case(self):
@@ -1455,7 +1332,7 @@
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is returned despite it's not the
         # preferredemail
-        self.assert_email_in(email, samlresponse)
+        self.assertIn(email, samlresponse)
         self.assertNotEqual(email, preferred)
 
     def test_only_long_form_canonical_email_is_preferred(self):
@@ -1472,8 +1349,8 @@
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is returned despite it's not the
         # preferredemail
-        self.assert_email_in('[e-mail]', samlresponse)
-        self.assert_email_not_in(email, samlresponse)
+        self.assertIn('[e-mail]', samlresponse)
+        self.assertNotIn(email, samlresponse)
 
     def test_canonical_email_is_not_preferred(self):
         self.setup_saml_sp(prefer_canonical_email=False)
@@ -1481,7 +1358,7 @@
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is *not* returned despite because
         # the flag was not set
-        self.assert_email_in(preferred, samlresponse)
+        self.assertIn(preferred, samlresponse)
         self.assertNotEqual('[e-mail]', preferred)
 
     def test_non_preferred_short_form_canonical_email_ignored(self):
@@ -1504,7 +1381,7 @@
 
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is *not* returned
-        self.assert_email_in(preferred, samlresponse)
+        self.assertIn(preferred, samlresponse)
         self.assertNotEqual('[e-mail]', preferred)
         self.assertNotEqual('[e-mail]', preferred)
 
@@ -1528,31 +1405,12 @@
 
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is *not* returned
-        self.assert_email_in(preferred, samlresponse)
+        self.assertIn(preferred, samlresponse)
         self.assertEqual('[e-mail]', preferred)
         self.assertNotEqual('[e-mail]', preferred)
         self.assertNotEqual('[e-mail]', preferred)
 
-    def test_short_form_canonical_email_used_if_preferred(self):
-        # This covers scenario 3 of _get_preferred_email. If the account has a
-        # @canonical.com preferred address and no long-form @canonical.com, we
-        # use the preferred @canonical.com address.
-        # make sure the short email is the preferred address
-        self.setup_saml_sp(prefer_canonical_email=True)
-        preferred = self.setup_saml_emails('[e-mail]')
-        assert preferred == '[e-mail]'
-        # Now the account has:
-        # [e-mail]    PREFERRED, created by default by test setup
-        # [e-mail]   VALIDATED
-
-        samlresponse = self.do_saml_request()
-        self.assert_email_in('[e-mail]', samlresponse)
-        self.assert_email_not_in('[e-mail]', samlresponse)
-
     def test_non_canonical_email(self):
-        # This covers scenario 4 of _get_preferred_email. If the account
-        # has no @canonical.com address, we return whichever one
-        # is marked as preferred.
         # prepare account for SAML
         account = self.factory.make_account()
         preferred = account.preferredemail.email
@@ -1568,7 +1426,7 @@
             username=preferred, password=DEFAULT_USER_PASSWORD)
 
         samlresponse = self.do_saml_request()
-        self.assert_email_in(preferred, samlresponse)
+        self.assertIn(preferred, samlresponse)
 
     def test_multiple_long_form_canonical_emails(self):
         self.setup_saml_sp(prefer_canonical_email=True)
@@ -1587,8 +1445,8 @@
         samlresponse = self.do_saml_request()
         # verify @canonical.com email address is returned despite it's not the
         # preferredemail
-        self.assert_email_in('[e-mail]', samlresponse)
-        self.assert_email_not_in('[e-mail]', samlresponse)
+        self.assertIn('[e-mail]', samlresponse)
+        self.assertNotIn('[e-mail]', samlresponse)
 
     def test_validate_bogus_acs_domain(self):
         self.setup_saml_sp(acs_domain='bogus.domain')