[java-identity-provider] branch master updated: IDP-1211 - Interceptor for controlled impersonation to services

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=465e2ed546aa7484ab02c7628866b4c715d0e654

The following commit(s) were added to refs/heads/master by this push:
       new  465e2ed   IDP-1211 - Interceptor for controlled impersonation to services
465e2ed is described below

commit 465e2ed546aa7484ab02c7628866b4c715d0e654
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Oct 9 20:20:51 2017 -0400

    IDP-1211 - Interceptor for controlled impersonation to services
    
    https://issues.shibboleth.net/jira/browse/IDP-1211
    
    Add logging of impersonations and failures.
---
 .../system/flows/intercept/impersonate-beans.xml       |  2 +-
 .../system/flows/intercept/impersonate-flow.xml        | 18 ++++++++++++++----
 .../src/main/resources/views/intercept/impersonate.vm  |  1 -
 3 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/idp-conf/src/main/resources/system/flows/intercept/impersonate-beans.xml b/idp-conf/src/main/resources/system/flows/intercept/impersonate-beans.xml
index d9af0ab..00441a9 100644
--- a/idp-conf/src/main/resources/system/flows/intercept/impersonate-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/intercept/impersonate-beans.xml
@@ -37,7 +37,7 @@
 
     <bean id="FlowScopePrincipalLookup" parent="shibboleth.ContextFunctions.Expression"
         c:outputType="#{T(java.lang.String)}"
-        c:expression="#input.getSubcontext(T(net.shibboleth.idp.profile.context.SpringRequestContext)).getRequestContext().getFlowScope().get('principalToSpoof')" />
+        c:expression="#input.getSubcontext(T(net.shibboleth.idp.profile.context.SpringRequestContext)).getRequestContext().getRequestScope().get('principalToSpoof')" />
         
     <import resource="../../conf/audit-system.xml" />
     
diff --git a/idp-conf/src/main/resources/system/flows/intercept/impersonate-flow.xml b/idp-conf/src/main/resources/system/flows/intercept/impersonate-flow.xml
index f9752cd..b07ff31 100644
--- a/idp-conf/src/main/resources/system/flows/intercept/impersonate-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/intercept/impersonate-flow.xml
@@ -22,8 +22,7 @@
             <evaluate expression="flowRequestContext.getExternalContext().getNativeRequest()" result="viewScope.request" />
             <evaluate expression="flowRequestContext.getExternalContext().getNativeResponse()" result="viewScope.response" />
             <evaluate expression="opensamlProfileRequestContext" result="viewScope.profileRequestContext" />
-            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext))" result="viewScope.authenticationContext" />
-            <evaluate expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.ui.context.RelyingPartyUIContext))" result="viewScope.rpUIContext" />
+            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getSubcontext(T(net.shibboleth.idp.ui.context.RelyingPartyUIContext))" result="viewScope.rpUIContext" />
             <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" result="viewScope.custom" />
         </on-render>
         
@@ -32,7 +31,7 @@
     
     <decision-state id="CheckForImpersonation">
         <on-entry>
-            <evaluate expression="flowRequestContext.getExternalContext().getNativeRequest().getParameter('principal')" result="flowScope.principalToSpoof" />
+            <evaluate expression="flowRequestContext.getExternalContext().getNativeRequest().getParameter('principal')" result="requestScope.principalToSpoof" />
         </on-entry>
         <if test="principalToSpoof == null or principalToSpoof.length() == 0"
             then="proceed" else="CheckAllowed" />
@@ -47,6 +46,10 @@
         <on-entry>
             <!-- Clear existing attribute state. -->
             <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.RelyingPartyContext)).removeSubcontext(T(net.shibboleth.idp.attribute.context.AttributeContext))" />
+            <!-- Log the impersonation. -->
+            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.RelyingPartyContext)).getRelyingPartyId()" result="requestScope.relyingPartyId" />
+            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.SubjectContext)).getPrincipalName()" result="requestScope.principalSpoofer" />
+            <evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.profile.interceptor').info('Impersonation by principal ''{}'' as ''{}'' to relying party ''{}''', principalSpoofer, principalToSpoof, relyingPartyId)" />
         </on-entry>
         
         <evaluate expression="PopulateAuditContext" />
@@ -57,7 +60,14 @@
         <transition on="proceed" to="proceed" />
     </action-state>
 
-    <end-state id="ImpersonationViolation" />
+    <end-state id="ImpersonationViolation">
+        <on-entry>
+            <!-- Log violation. -->
+            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.RelyingPartyContext)).getRelyingPartyId()" result="requestScope.relyingPartyId" />
+            <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.SubjectContext)).getPrincipalName()" result="requestScope.principalSpoofer" />
+            <evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.profile.interceptor').warn('Unauthorized impersonation attempt by principal ''{}'' as ''{}'' to relying party ''{}''', principalSpoofer, principalToSpoof, relyingPartyId)" />
+        </on-entry>
+    </end-state>
 
     <end-state id="proceed" />
 
diff --git a/idp-conf/src/main/resources/views/intercept/impersonate.vm b/idp-conf/src/main/resources/views/intercept/impersonate.vm
index ef3f54a..4fa4e93 100644
--- a/idp-conf/src/main/resources/views/intercept/impersonate.vm
+++ b/idp-conf/src/main/resources/views/intercept/impersonate.vm
@@ -6,7 +6,6 @@
 ## flowRequestContext - the Spring Web Flow RequestContext
 ## flowExecutionKey - the SWF execution key (this is built into the flowExecutionUrl)
 ## profileRequestContext - root of context tree
-## authenticationContext - context with authentication request information
 ## rpUIContext - the context with SP UI information from the metadata
 ## encoder - HTMLEncoder class
 ## request - HttpServletRequest

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.