[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources: conf/idp.properties system/flows/saml/saml2/sl...

[noreply at shibboleth.net]

Author: scantor
Date: Mon May 11 16:38:27 2015
New Revision: 7512

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7512&view=rev
Log:
IDP-702 - create a property that toggles signing requirement for received LogoutRequest

Modified:
    trunk/idp-conf/src/main/resources/conf/idp.properties
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-security-flow.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/security-beans.xml

Modified: trunk/idp-conf/src/main/resources/conf/idp.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/idp.properties?rev=7512&r1=7511&r2=7512&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/idp.properties	(original)
+++ trunk/idp-conf/src/main/resources/conf/idp.properties	Mon May 11 16:38:27 2015
@@ -140,6 +140,9 @@
 # for use by user interface logic; adds overhead so off by default.
 #idp.logout.elaboration = false
 
+# Whether to require logout requests be signed/authenticated.
+#idp.logout.authenticated = true
+
 # Message freshness and replay cache tuning
 #idp.policy.messageLifetime = PT3M
 #idp.policy.clockSkew = PT3M

Modified: trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-security-flow.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-security-flow.xml?rev=7512&r1=7511&r2=7512&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-security-flow.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-security-flow.xml	Mon May 11 16:38:27 2015
@@ -3,7 +3,7 @@
     xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
     parent="security-policy.abstract">
 
-    <!-- Default inbound security processing for front-channel SAML 2 SLO profile. -->
+    <!-- Default inbound security processing for SAML 2 SLO profile. -->
 
     <action-state id="SAML2SLOSecurityPolicy">
         <evaluate expression="ReceivedEndpointSecurityHandler" />
@@ -14,7 +14,7 @@
         <evaluate expression="SAML2HTTPRedirectDeflateSignatureSecurityHandler" />
         <evaluate expression="SAML2HTTPPostSimpleSignSecurityHandler" />
         <evaluate expression="CheckMandatoryIssuer" />
-        <evaluate expression="CheckMandatoryAuthentication" />
+        <evaluate expression="OptionalCheckMandatoryAuthentication" />
         <evaluate expression="ExtractChannelBindingsExtensionsHandler" />
         <evaluate expression="'proceed'" />
 

Modified: trunk/idp-conf/src/main/resources/system/flows/saml/security-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/saml/security-beans.xml?rev=7512&r1=7511&r2=7512&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/saml/security-beans.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/saml/security-beans.xml	Mon May 11 16:38:27 2015
@@ -166,6 +166,22 @@
         </property>
     </bean>
 
+    <bean id="OptionalCheckMandatoryAuthentication"
+            class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
+            c:executionDirection="INBOUND"
+            p:activationCondition="%{idp.logout.authenticated:true}">
+        <constructor-arg name="messageHandler">
+            <bean class="org.opensaml.messaging.handler.impl.CheckMandatoryAuthentication" scope="prototype">
+                <property name="authenticationLookupStrategy">
+                    <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLMessageContextAuthenticationFunction" />
+                </property>
+            </bean>
+        </constructor-arg>
+        <property name="errorEvent">
+            <util:constant static-field="org.opensaml.profile.action.EventIds.MESSAGE_AUTHN_ERROR" />
+        </property>
+    </bean>
+
     <bean id="SAML2AuthnRequestsSignedSecurityHandler"
             class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
             c:executionDirection="INBOUND">