[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-beans.xml i...

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Oct 23 21:32:52 2015
New Revision: 7869

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7869&view=rev
Log:
IDP-677: Port delegation "user authentication" of request based on presentation of SAML 2 Assertion WS-Security token

Split token processing into a populate action and a pre-c14n processing action,
b/c need to do NameID decryption in between.
Implement NameID decryption on inbound delegated Assertion token. 

Added:
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/DelegatedAssertionLookupStrategy.java   (with props)
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateLibertyContext.java   (with props)
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessDelegatedAssertion.java
      - copied, changed from r7868, trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessSAML20AssertionWSSToken.java
Modified:
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-flow.xml
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/FinalizeSAMLTokenProcessing.java
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessSAML20AssertionWSSToken.java

Modified: trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-beans.xml?rev=7869&r1=7868&r2=7869&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-beans.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-beans.xml	Fri Oct 23 21:32:52 2015
@@ -159,7 +159,15 @@
     
     <bean id="LibertyOutboundContexts" class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateOutboundMessageContext" scope="prototype" />
     
-    <bean id="ProcessSAML20AssertionWSSToken" class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.ProcessSAML20AssertionWSSToken" scope="prototype" />
+    <bean id="PopulateLibertyContext" class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateLibertyContext" scope="prototype" />
+    
+    <bean id="DecryptDelegatedAssertionNameID" class="org.opensaml.saml.saml2.profile.impl.DecryptNameIDs" scope="prototype">
+        <property name="messageLookupStrategy">
+            <bean class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.DelegatedAssertionLookupStrategy" />
+        </property>
+    </bean>
+    
+    <bean id="ProcessDelegatedAssertion" class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.ProcessDelegatedAssertion" scope="prototype" />
     
     <bean id="FinalizeSAMLTokenProcessing" class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.FinalizeSAMLTokenProcessing" scope="prototype" />
 

Modified: trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-flow.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-flow.xml?rev=7869&r1=7868&r2=7869&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-flow.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-flow.xml	Fri Oct 23 21:32:52 2015
@@ -57,7 +57,9 @@
     </action-state>
     
     <action-state id="ProcessSAMLToken">
-        <evaluate expression="ProcessSAML20AssertionWSSToken" />
+        <evaluate expression="PopulateLibertyContext" />
+        <evaluate expression="DecryptDelegatedAssertionNameID" />
+        <evaluate expression="ProcessDelegatedAssertion" />
         
         <evaluate expression="'proceed'" />
         

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/FinalizeSAMLTokenProcessing.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/FinalizeSAMLTokenProcessing.java?rev=7869&r1=7868&r2=7869&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/FinalizeSAMLTokenProcessing.java	(original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/FinalizeSAMLTokenProcessing.java	Fri Oct 23 21:32:52 2015
@@ -41,17 +41,8 @@
                 profileRequestContext.getSubcontext(SubjectCanonicalizationContext.class);
         profileRequestContext.removeSubcontext(SubjectCanonicalizationContext.class);
         
-        //TODO seems that without populating SubjectContext authenticationResults, there's nothing

[... 171 lines stripped ...]