[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/conf/authn/external-authn-config.xml idp-conf/...

[noreply at shibboleth.net]

Author: scantor
Date: Tue May 27 12:30:24 2014
New Revision: 5970

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=5970&view=rev
Log:
More web.xml cleanup, indirect location of external login.

Modified:
    trunk/idp-conf/src/main/resources/conf/authn/external-authn-config.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/external-authn-flow.xml
    trunk/idp-war/src/main/webapp/WEB-INF/web.xml

Modified: trunk/idp-conf/src/main/resources/conf/authn/external-authn-config.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/authn/external-authn-config.xml?rev=5970&r1=5969&r2=5970&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/authn/external-authn-config.xml (original)
+++ trunk/idp-conf/src/main/resources/conf/authn/external-authn-config.xml Tue May 27 12:30:24 2014
@@ -14,7 +14,7 @@
 
     <!-- Servlet context-relative path to wherever your implementation lives. -->
     <bean id="shibboleth.authn.External.externalAuthnPath" class="java.lang.String"
-        c:_0="/resources/external-authn/container.jsp" />
+        c:_0="contextRelative:Authn/RemoteUser" />
 
     <!--
     Define entries here to map error messages returned by external modules and classify them as particular

Modified: trunk/idp-conf/src/main/resources/system/flows/authn/external-authn-flow.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/authn/external-authn-flow.xml?rev=5970&r1=5969&r2=5970&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/authn/external-authn-flow.xml (original)
+++ trunk/idp-conf/src/main/resources/system/flows/authn/external-authn-flow.xml Tue May 27 12:30:24 2014
@@ -5,7 +5,7 @@
 
     <!-- This is a login flow for external authentication handled outside the webflow engine. -->
     
-    <view-state id="ExternalTransfer" view="externalRedirect:contextRelative:Authn/RemoteUser?conversation=#{flowExecutionContext.getKey().toString()}">
+    <view-state id="ExternalTransfer" view="externalRedirect:#{flowExecutionContext.getActiveSession().getDefinition().getApplicationContext().getBean('shibboleth.authn.External.externalAuthnPath')}?conversation=#{flowExecutionContext.getKey().toString()}">
         <on-render>
             <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getSubcontext(T(net.shibboleth.idp.authn.context.ExternalAuthenticationContext), true).setFlowExecutionUrl(flowExecutionUrl + '&amp;_eventId_proceed=1')" />
             <evaluate expression="externalContext.getNativeRequest().getSession().setAttribute('conversation' + flowExecutionContext.getKey().toString(), new net.shibboleth.idp.authn.impl.ExternalAuthenticationImpl(opensamlProfileRequestContext))" />

Modified: trunk/idp-war/src/main/webapp/WEB-INF/web.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-war/src/main/webapp/WEB-INF/web.xml?rev=5970&r1=5969&r2=5970&view=diff
==============================================================================
--- trunk/idp-war/src/main/webapp/WEB-INF/web.xml (original)
+++ trunk/idp-war/src/main/webapp/WEB-INF/web.xml Tue May 27 12:30:24 2014
@@ -112,17 +112,47 @@
         <location>/WEB-INF/jsp/error-404.jsp</location>
     </error-page>
 
-    <!-- Uncomment to use container managed authentication -->
-    <!-- <security-constraint> <display-name>Shibboleth IdP</display-name> <web-resource-collection> <web-resource-name>user 
-        authentication</web-resource-name> <url-pattern>/Authn/RemoteUser</url-pattern> <http-method>GET</http-method> <http-method>POST</http-method> 
-        </web-resource-collection> <auth-constraint> <role-name>user</role-name> </auth-constraint> <user-data-constraint> <transport-guarantee>CONFIDENTIAL</transport-guarantee> 
-        </user-data-constraint> </security-constraint> <security-role> <role-name>user</role-name> </security-role> -->
+    <!--
+    Uncomment to use container managed authentication. The new servlet spec (3.1)
+    supports "**" as a wildcard syntax to avoid role usage, which is normally desirable.
+    Older containers usually support "*" when proprietary options are used.
+    -->
+    <!--
+    <security-constraint>
+        <display-name>Web Login Service</display-name>
+        <web-resource-collection>
+            <web-resource-name>user authentication</web-resource-name>
+            <url-pattern>/Authn/RemoteUser</url-pattern>
+            <http-method>GET</http-method>
+            <http-method>POST</http-method> 
+        </web-resource-collection>
+        <auth-constraint>
+            <role-name>**</role-name>
+        </auth-constraint>
+        <user-data-constraint>
+            <transport-guarantee>CONFIDENTIAL</transport-guarantee> 
+        </user-data-constraint>
+    </security-constraint>
+    -->
 

[... 27 lines stripped ...]