def create_authn_response(self, identity, in_response_to, destination,
                              sp_entity_id, name_id_policy=None, userid=None,
                              name_id=None, authn=None, issuer=None,
                              sign_response=None, sign_assertion=None,
                              encrypt_cert=None, encrypt_assertion=None,
                              **kwargs):
        """ Constructs an AuthenticationResponse

        :param identity: Information about an user
        :param in_response_to: The identifier of the authentication request
            this response is an answer to.
        :param destination: Where the response should be sent
        :param sp_entity_id: The entity identifier of the Service Provider
        :param name_id_policy: How the NameID should be constructed
        :param userid: The subject identifier
        :param authn: Dictionary with information about the authentication
            context
        :param issuer: Issuer of the response
        :param sign_assertion: Whether the assertion should be signed or not.
        :param sign_response: Whether the response should be signed or not.
        :return: A response instance
        """

        try:
            policy = kwargs["release_policy"]
        except KeyError:
            policy = self.config.getattr("policy", "idp")

        try:
            best_effort = kwargs["best_effort"]
        except KeyError:
            best_effort = False

        if sign_assertion is None:
            sign_assertion = self.config.getattr("sign_assertion", "idp")
        if sign_assertion is None:
            sign_assertion = False

        if sign_response is None:
            sign_response = self.config.getattr("sign_response", "idp")
        if sign_response is None:
            sign_response = False

        if encrypt_assertion is None:
            encrypt_assertion = self.config.getattr("encrypt_assertion", "idp")
        if encrypt_assertion is None:
            encrypt_assertion = False

        if encrypt_assertion:
            if encrypt_cert is not None:
                verify_encrypt_cert = self.config.getattr("verify_encrypt_cert", "idp")
                if verify_encrypt_cert is not None:
                    if not verify_encrypt_cert(encrypt_cert):
                        raise CertificateError("Invalid certificate for encryption!")
            else:
                raise CertificateError("No SPCertEncType certificate for encryption contained in authentication "
                                       "request.")
        else:
            encrypt_assertion = False

        if not name_id:
            try:
                nid_formats = []
                for _sp in self.metadata[sp_entity_id]["spsso_descriptor"]:
                    if "name_id_format" in _sp:
                        nid_formats.extend([n["text"] for n in
                                            _sp["name_id_format"]])
                try:
                    snq = name_id_policy.sp_name_qualifier
                except AttributeError:
                    snq = sp_entity_id

                if not snq:
                    snq = sp_entity_id

                kwa = {"sp_name_qualifier": snq}

                try:
                    kwa["format"] = name_id_policy.format
                except __HOLE__:
                    pass

                _nids = self.ident.find_nameid(userid, **kwa)
                # either none or one
                if _nids:
                    name_id = _nids[0]
                else:
                    name_id = self.ident.construct_nameid(userid, policy,
                                                          sp_entity_id,
                                                          name_id_policy)
                    logger.debug("construct_nameid: %s => %s" % (userid,
                                                                 name_id))
            except IOError, exc:
                response = self.create_error_response(in_response_to,
                                                      destination,
                                                      sp_entity_id,
                                                      exc, name_id)
                return ("%s" % response).split("\n")

        try:
            _authn = authn
            if (sign_assertion or sign_response) and self.sec.cert_handler.generate_cert():
                with self.lock:
                    self.sec.cert_handler.update_cert(True)
                    return self._authn_response(in_response_to,  # in_response_to
                                                destination,  # consumer_url
                                                sp_entity_id,  # sp_entity_id
                                                identity,  # identity as dictionary
                                                name_id,
                                                authn=_authn,
                                                issuer=issuer,
                                                policy=policy,
                                                sign_assertion=sign_assertion,
                                                sign_response=sign_response,
                                                best_effort=best_effort,
                                                encrypt_assertion=encrypt_assertion,
                                                encrypt_cert=encrypt_cert)
            return self._authn_response(in_response_to,  # in_response_to
                                        destination,  # consumer_url
                                        sp_entity_id,  # sp_entity_id
                                        identity,  # identity as dictionary
                                        name_id,
                                        authn=_authn,
                                        issuer=issuer,
                                        policy=policy,
                                        sign_assertion=sign_assertion,
                                        sign_response=sign_response,
                                        best_effort=best_effort,
                                        encrypt_assertion=encrypt_assertion,
                                        encrypt_cert=encrypt_cert)

        except MissingValue, exc:
            return self.create_error_response(in_response_to, destination,
                                              sp_entity_id, exc, name_id)
dataset/ETHPy150Open cloudera/hue/desktop/core/ext-py/pysaml2-2.4.0/src/saml2/server.py/Server.create_authn_response