[java-identity-provider COMMIT] in /trunk/idp-cas-impl/src: main/java/net/shibboleth/idp/cas/config/ValidateConfigura...

[noreply at shibboleth.net]

Author: serac
Date: Wed Mar 18 16:09:17 2015
New Revision: 7429

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7429&view=rev
Log:
IDP-614 Add option to ignore URI path params in CAS ticket validation.

Allow configuration of ignored path parameters in relying party config
(ValidationConfiguration). Ignore jsessionid parameter by default.

Added:
    trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/DefaultServiceComparator.java
    trunk/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/service/DefaultServiceComparatorTest.java
Modified:
    trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/config/ValidateConfiguration.java
    trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/ValidateTicketAction.java
    trunk/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/ValidateTicketActionTest.java

Modified: trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/config/ValidateConfiguration.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/config/ValidateConfiguration.java?rev=7429&r1=7428&r2=7429&view=diff
==============================================================================
--- trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/config/ValidateConfiguration.java (original)
+++ trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/config/ValidateConfiguration.java Wed Mar 18 16:09:17 2015
@@ -17,11 +17,13 @@
 
 package net.shibboleth.idp.cas.config;
 
+import net.shibboleth.idp.cas.service.DefaultServiceComparator;
 import net.shibboleth.idp.cas.ticket.TicketIdentifierGenerationStrategy;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.security.IdentifierGenerationStrategy;
 
 import javax.annotation.Nonnull;
+import java.util.Comparator;
 
 /**
  * CAS protocol configuration that applies to the following ticket validation URIs:
@@ -49,6 +51,10 @@
     @Nonnull
     private IdentifierGenerationStrategy pgtIOUGenerator = new TicketIdentifierGenerationStrategy("PGTIOU", 50);
 
+    /** Component responsible for enforcing ticket requestor matches ticket validator. */
+    @Nonnull
+    private Comparator<String> serviceComparator = new DefaultServiceComparator();
+
 
     /** Creates a new instance. */
     public ValidateConfiguration() {
@@ -72,6 +78,15 @@
         this.pgtIOUGenerator = Constraint.isNotNull(generator, "PGTIOU generator cannot be null");
     }
 
+    @Nonnull
+    public Comparator<String> getServiceComparator() {
+        return serviceComparator;
+    }
+
+    public void setServiceComparator(@Nonnull Comparator<String> serviceComparator) {
+        this.serviceComparator = serviceComparator;
+    }
+
     @Override
     @Nonnull
     protected String getDefaultTicketPrefix() {

Modified: trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/ValidateTicketAction.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/ValidateTicketAction.java?rev=7429&r1=7428&r2=7429&view=diff
==============================================================================
--- trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/ValidateTicketAction.java (original)
+++ trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/ValidateTicketAction.java Wed Mar 18 16:09:17 2015
@@ -17,8 +17,10 @@
 
 package net.shibboleth.idp.cas.flow;
 
+import net.shibboleth.idp.cas.config.ConfigLookupFunction;
 import net.shibboleth.idp.cas.config.LoginConfiguration;
 import net.shibboleth.idp.cas.config.ProxyConfiguration;
+import net.shibboleth.idp.cas.config.ValidateConfiguration;
 import net.shibboleth.idp.cas.protocol.ProtocolError;
 import net.shibboleth.idp.cas.protocol.TicketValidationRequest;
 import net.shibboleth.idp.cas.protocol.TicketValidationResponse;
@@ -53,6 +55,10 @@
     /** Class logger. */
     private final Logger log = LoggerFactory.getLogger(ValidateTicketAction.class);
 
+    /** Profile configuration lookup function. */
+    private final ConfigLookupFunction<ValidateConfiguration> configLookupFunction =
+            new ConfigLookupFunction<>(ValidateConfiguration.class);
+
     /** Manages CAS tickets. */
     @Nonnull
     private final TicketService ticketService;
@@ -72,6 +78,12 @@
     protected Event doExecute(
             final @Nonnull RequestContext springRequestContext,
             final @Nonnull ProfileRequestContext profileRequestContext) {
+
+        final ValidateConfiguration config = configLookupFunction.apply(profileRequestContext);
+        if (config == null) {
+            log.info("Ticket validation configuration undefined");
+            return ProtocolError.IllegalState.event(this);
+        }
 
         final TicketValidationRequest request = getCASRequest(profileRequestContext);
         final Ticket ticket;
@@ -97,7 +109,7 @@
             return ProtocolError.TicketExpired.event(this);
         }
 
-        if (!ticket.getService().equalsIgnoreCase(request.getService())) {

[... 102 lines stripped ...]