[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/system/conf/mvc-beans.xml idp-war/src/main/web...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Oct 17 21:08:42 2016
New Revision: 8502

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8502&view=rev
Log:
Support for non-GET/POST in API flows:

- open up WebFlow adaptor to all HTTP methods
- close off "risky" methods by default in web.xml

Modified:
    trunk/idp-conf/src/main/resources/system/conf/mvc-beans.xml
    trunk/idp-war/src/main/webapp/WEB-INF/web.xml

Modified: trunk/idp-conf/src/main/resources/system/conf/mvc-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/mvc-beans.xml?rev=8502&r1=8501&r2=8502&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/mvc-beans.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/conf/mvc-beans.xml	Mon Oct 17 21:08:42 2016
@@ -18,6 +18,7 @@
         <property name="sourceList">
             <list>
                 <value>admin/metrics</value>
+                <value>admin/storage</value>
             </list>
         </property>
     </bean>
@@ -48,7 +49,12 @@
     <!-- HandlerAdapters: These aren't ordered. Add our WebFlow one, then the standard Spring MVC default ones. 
          Have to enumerate them all explicitly b/c we're overriding the built-in defaults. -->
     
-    <bean class="net.shibboleth.idp.profile.support.RethrowingFlowHandlerAdapter" p:flowExecutor-ref="flowExecutor" />
+    <bean class="net.shibboleth.idp.profile.support.RethrowingFlowHandlerAdapter"
+            p:flowExecutor-ref="flowExecutor">
+        <property name="supportedMethods">
+            <null/>
+        </property>
+    </bean>
     
     <bean class="org.springframework.web.servlet.mvc.HttpRequestHandlerAdapter" />
     

Modified: trunk/idp-war/src/main/webapp/WEB-INF/web.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-war/src/main/webapp/WEB-INF/web.xml?rev=8502&r1=8501&r2=8502&view=diff
==============================================================================
--- trunk/idp-war/src/main/webapp/WEB-INF/web.xml	(original)
+++ trunk/idp-war/src/main/webapp/WEB-INF/web.xml	Mon Oct 17 21:08:42 2016
@@ -139,6 +139,29 @@
         <location>/profile/RaiseError</location>
     </error-page>
 
+    <!-- Block commonly flagged methods by using an empty auth-constraint. -->
+    <security-constraint>
+        <web-resource-collection>
+            <web-resource-name>Non-API Content</web-resource-name>
+            <url-pattern>/*</url-pattern>
+            <http-method>PUT</http-method>
+            <http-method>PATCH</http-method>
+            <http-method>DELETE</http-method>
+            <http-method>OPTIONS</http-method>
+            <http-method>TRACE</http-method>
+        </web-resource-collection>
+        <auth-constraint/>
+    </security-constraint>
+
+    <!-- Allow any HTTP methods to the API flows. -->
+    <security-constraint>
+        <web-resource-collection>
+            <web-resource-name>Administrative APIs</web-resource-name>
+            <url-pattern>/profile/admin/*</url-pattern>
+        </web-resource-collection>
+        <!-- no auth-constraint tag here -->
+    </security-constraint>
+
     <!--
     Uncomment to use container managed authentication. The new servlet spec (3.1)
     supports "**" as a wildcard syntax to avoid role usage, which is normally desirable.
@@ -152,7 +175,6 @@
             <web-resource-name>user authentication</web-resource-name>
             <url-pattern>/Authn/RemoteUser</url-pattern>
             <url-pattern>/profile/SAML2/SOAP/ECP</url-pattern>
-            <http-method>GET</http-method>
             <http-method>POST</http-method> 
         </web-resource-collection>
         <auth-constraint>