[java-shib-common COMMIT] in /branches/REL_1: doc/RELEASE-NOTES.txt src/main/java/edu/internet2/middleware/shibboleth...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Mar  4 14:56:29 2013
New Revision: 1059

URL: http://svn.shibboleth.net/view/java-shib-common?rev=1059&view=rev
Log:
SIDP-499 - Allow signed requests to bypass ACS verification

Modified:
    branches/REL_1/doc/RELEASE-NOTES.txt
    branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/common/config/relyingparty/saml/SAML2SSOProfileConfigurationBeanDefinitionParser.java
    branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/common/config/relyingparty/saml/SAML2SSOProfileConfigurationFactoryBean.java
    branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/common/relyingparty/provider/saml2/SSOConfiguration.java
    branches/REL_1/src/main/resources/schema/shibboleth-2.0-relying-party-saml.xsd

Modified: branches/REL_1/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-shib-common/branches/REL_1/doc/RELEASE-NOTES.txt?rev=1059&r1=1058&r2=1059&view=diff
==============================================================================
--- branches/REL_1/doc/RELEASE-NOTES.txt (original)
+++ branches/REL_1/doc/RELEASE-NOTES.txt Mon Mar  4 14:56:29 2013
@@ -3,6 +3,7 @@
 [SC-183] - Inappropriate 'RuleReference elements within an AND rule are not supported' error
 [SC-184] - Trap exceptions during LDAP connector pool inititalization
 [SC-186] -  AttributeInMetadata rule for the attribute filter (copied back from uApprove)
+[SIDP-499] - Allow signed requests to bypass ACS verification
 [SIDP-559] - Attribute queries are ignoring input designators
 [JOST-200] - Reduce memory usage of unit tests
 [JXT-98] -  Add support for configuring PKIX policy checking in the PKIX trust engine 

Modified: branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/common/config/relyingparty/saml/SAML2SSOProfileConfigurationBeanDefinitionParser.java
URL: http://svn.shibboleth.net/view/java-shib-common/branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/common/config/relyingparty/saml/SAML2SSOProfileConfigurationBeanDefinitionParser.java?rev=1059&r1=1058&r2=1059&view=diff
==============================================================================
--- branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/common/config/relyingparty/saml/SAML2SSOProfileConfigurationBeanDefinitionParser.java (original)
+++ branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/common/config/relyingparty/saml/SAML2SSOProfileConfigurationBeanDefinitionParser.java Mon Mar  4 14:56:29 2013
@@ -45,7 +45,8 @@
 
         if (element.hasAttributeNS(null, "includeAttributeStatement")) {
             builder.addPropertyValue("includeAttributeStatement",
-                    XMLHelper.getAttributeValueAsBoolean(element.getAttributeNodeNS(null, "includeAttributeStatement")));
+                    XMLHelper.getAttributeValueAsBoolean(
+                            element.getAttributeNodeNS(null, "includeAttributeStatement")));
         } else {
             builder.addPropertyValue("includeAttributeStatement", true);
         }
@@ -55,6 +56,13 @@
                     "'maximumSPSessionLifetime' on profile configuration of type " + XMLHelper.getXSIType(element),
                     element.getAttributeNS(null, "maximumSPSessionLifetime"), 0);
             builder.addPropertyValue("maximumSPSessionLifetime", lifetime);
+        }
+
+        if (element.hasAttributeNS(null, "skipEndpointValidationWhenSigned")) {
+            builder.addPropertyValue("skipEndpointValidationWhenSigned", XMLHelper.getAttributeValueAsBoolean(
+                    element.getAttributeNodeNS(null, "skipEndpointValidationWhenSigned")));
+        } else {
+            builder.addPropertyValue("skipEndpointValidationWhenSigned", false);
         }
     }
 

Modified: branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/common/config/relyingparty/saml/SAML2SSOProfileConfigurationFactoryBean.java
URL: http://svn.shibboleth.net/view/java-shib-common/branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/common/config/relyingparty/saml/SAML2SSOProfileConfigurationFactoryBean.java?rev=1059&r1=1058&r2=1059&view=diff
==============================================================================
--- branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/common/config/relyingparty/saml/SAML2SSOProfileConfigurationFactoryBean.java (original)
+++ branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/common/config/relyingparty/saml/SAML2SSOProfileConfigurationFactoryBean.java Mon Mar  4 14:56:29 2013
@@ -27,6 +27,9 @@
 
     /** The maximum amount of time, in milliseconds, the service provider should maintain a session for the user. */
     private long maximumSPSessionLifetime;
+    
+    /** Whether to skip response location checks for signed requests. */
+    private boolean skipEndpointValidationWhenSigned;
 
     /** {@inheritDoc} */
     public Class getObjectType() {
@@ -70,6 +73,22 @@
     public void setMaximumSPSessionLifetime(long lifetime) {
         maximumSPSessionLifetime = lifetime;
     }
+    
+    /**

[... 84 lines stripped ...]