[java-shib-idp2 COMMIT] in /branches/REL_2: doc/RELEASE-NOTES.txt src/main/java/edu/internet2/middleware/shibboleth/i...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Mar  4 14:57:09 2013
New Revision: 3143

URL: http://svn.shibboleth.net/view/java-shib-idp2?rev=3143&view=rev
Log:
SIDP-499 - Allow signed requests to bypass ACS verification

Modified:
    branches/REL_2/doc/RELEASE-NOTES.txt
    branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/profile/saml2/SSOProfileHandler.java

Modified: branches/REL_2/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-shib-idp2/branches/REL_2/doc/RELEASE-NOTES.txt?rev=3143&r1=3142&r2=3143&view=diff
==============================================================================
--- branches/REL_2/doc/RELEASE-NOTES.txt (original)
+++ branches/REL_2/doc/RELEASE-NOTES.txt Mon Mar  4 14:57:09 2013
@@ -1,6 +1,7 @@
 Changes in Release 2.4.0
 =============================================
 [JOST-162] - Globally enabling schema validation breaks the Signature metadata filter
+[SIDP-499] - Allow signed requests to bypass ACS verification
 [SIDP-545] - Automatic reloading of relying-party.xml results in errors
 [SIDP-557] - aacli.sh Exception (again)
 [SIDP-559] - Attribute queries are ignoring input designators

Modified: branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/profile/saml2/SSOProfileHandler.java
URL: http://svn.shibboleth.net/view/java-shib-idp2/branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/profile/saml2/SSOProfileHandler.java?rev=3143&r1=3142&r2=3143&view=diff
==============================================================================
--- branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/profile/saml2/SSOProfileHandler.java (original)
+++ branches/REL_2/src/main/java/edu/internet2/middleware/shibboleth/idp/profile/saml2/SSOProfileHandler.java Mon Mar  4 14:57:09 2013
@@ -112,7 +112,7 @@
 
     /** URL of the authentication manager Servlet. */
     private String authenticationManagerPath;
-
+    
     /**
      * Constructor.
      * 
@@ -707,7 +707,8 @@
         AuthnRequest authnRequest = ((SSORequestContext) requestContext).getInboundSAMLMessage();
 
         Endpoint endpoint = null;
-        if (requestContext.getRelyingPartyConfiguration().getRelyingPartyId() == SAMLMDRelyingPartyConfigurationManager.ANONYMOUS_RP_NAME) {
+        if (requestContext.getRelyingPartyConfiguration().getRelyingPartyId() ==
+                SAMLMDRelyingPartyConfigurationManager.ANONYMOUS_RP_NAME) {
             if (authnRequest.getAssertionConsumerServiceURL() != null) {
                 endpoint = endpointBuilder.buildObject();
                 endpoint.setLocation(authnRequest.getAssertionConsumerServiceURL());
@@ -716,13 +717,23 @@
                 } else {
                     endpoint.setBinding(getSupportedOutboundBindings().get(0));
                 }
-                log.warn(
+                log.debug(
                         "Generating endpoint for anonymous relying party self-identified as '{}', ACS url '{}' and binding '{}'",
                         new Object[] { requestContext.getInboundMessageIssuer(), endpoint.getLocation(),
                                 endpoint.getBinding(), });
             } else {
-                log.warn("Unable to generate endpoint for anonymous party.  No ACS URL provided.");
-            }
+                log.warn("Unable to generate endpoint for anonymous party. No ACS URL provided.");
+            }
+        } else if (requestContext.isInboundSAMLMessageAuthenticated()
+                && ((SSOConfiguration) requestContext.getProfileConfiguration()).skipEndpointValidationWhenSigned()
+                && authnRequest.getAssertionConsumerServiceURL() != null && authnRequest.getProtocolBinding() != null) {
+            
+            endpoint = endpointBuilder.buildObject();
+            endpoint.setLocation(authnRequest.getAssertionConsumerServiceURL());
+            endpoint.setBinding(authnRequest.getProtocolBinding());
+            log.debug("Using endpoint specified in signed request from '{}' with ACS url '{}' and binding '{}'",
+                    new Object[] { requestContext.getInboundMessageIssuer(), endpoint.getLocation(),
+                        endpoint.getBinding(), });
         } else {
             AuthnResponseEndpointSelector endpointSelector = new AuthnResponseEndpointSelector();
             endpointSelector.setEndpointType(AssertionConsumerService.DEFAULT_ELEMENT_NAME);