[java-opensaml COMMIT] /trunk/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/HttpServletRequest...

[noreply at shibboleth.net]

Author: scantor
Date: Tue Dec  9 23:40:01 2014
New Revision: 4183

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4183&view=rev
Log:
IDP-76 - Treat port 443 as "insecure" for SAML messaging purposes

Modified:
    trunk/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/HttpServletRequestMessageChannelSecurity.java

Modified: trunk/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/HttpServletRequestMessageChannelSecurity.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/HttpServletRequestMessageChannelSecurity.java?rev=4183&r1=4182&r2=4183&view=diff
==============================================================================
--- trunk/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/HttpServletRequestMessageChannelSecurity.java (original)
+++ trunk/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/HttpServletRequestMessageChannelSecurity.java Tue Dec  9 23:40:01 2014
@@ -17,7 +17,10 @@
 
 package org.opensaml.profile.action.impl;
 
+import javax.servlet.http.HttpServletRequest;
+
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
 
 import org.opensaml.messaging.context.MessageChannelSecurityContext;
 import org.opensaml.profile.context.ProfileRequestContext;
@@ -28,6 +31,32 @@
  */
 public class HttpServletRequestMessageChannelSecurity extends AbstractMessageChannelSecurity {
 
+    /** Flag controlling whether traffic on the default TLS port is "secure". */
+    private boolean defaultPortInsecure;
+    
+    /** Constructor. */
+    public HttpServletRequestMessageChannelSecurity() {
+        defaultPortInsecure = true;
+    }
+    
+    /**
+     * Set whether traffic on the default TLS port is "secure" for the purposes of this action.
+     * 
+     * <p>Defaults to "true"</p>
+     *
+     * <p>Ordinarily TLS is considered a "secure" channel, but traffic to a default port meant
+     * for browser access tends to rely on server certificates that are unsuited to secure messaging
+     * use cases. This flag allows software layers to recognize traffic on this port as "insecure" and
+     * needing additional security measures.</p>
+     * 
+     * @param flag flag to set
+     */
+    public void setDefaultPortInsecure(final boolean flag) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        defaultPortInsecure = flag;
+    }
+    
     /** {@inheritDoc} */
     @Override
     protected void doInitialize() throws ComponentInitializationException {
@@ -42,8 +71,15 @@
     protected void doExecute(ProfileRequestContext profileRequestContext) {
         final MessageChannelSecurityContext channelContext =
                 getParentContext().getSubcontext(MessageChannelSecurityContext.class, true);
-        channelContext.setConfidentialityActive(getHttpServletRequest().isSecure());
-        channelContext.setIntegrityActive(getHttpServletRequest().isSecure());
+        
+        final HttpServletRequest request = getHttpServletRequest();
+        if (request.isSecure() && (!defaultPortInsecure || request.getLocalPort() != 443)) {
+            channelContext.setConfidentialityActive(true);
+            channelContext.setIntegrityActive(true);
+        } else {
+            channelContext.setConfidentialityActive(false);
+            channelContext.setIntegrityActive(false);
+        }
     }
 
 }