[java-identity-provider] branch master updated: IDP-1265 Conform CAS ticket IDs to protocol spec.

[Marvin S. Addison]

This is an automated email from the git hooks/post-receive script.

serac pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=83d4d88e84b21159d7f5cf8c28ea31ffb354d234

The following commit(s) were added to refs/heads/master by this push:
       new  83d4d88   IDP-1265 Conform CAS ticket IDs to protocol spec.
83d4d88 is described below

commit 83d4d88e84b21159d7f5cf8c28ea31ffb354d234
Author: Marvin S. Addison <serac at vt.edu>
AuthorDate: Wed Jun 13 16:07:00 2018 -0400

    IDP-1265 Conform CAS ticket IDs to protocol spec.
    
    Use base-32 encoding with '-' padding character to constrain ticket
    identifiers to the range [A-Za-z0-9-]+ per section 3.7 of the CAS 2.0
    protocol spec.
---
 .../idp/cas/ticket/impl/EncodingTicketService.java      |  4 ++--
 .../idp/cas/ticket/impl/EncodingTicketServiceTest.java  |  8 ++++++--
 .../main/resources/system/conf/cas-protocol-system.xml  | 17 +++++++++++------
 3 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketService.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketService.java
index 36e1029..7c0627c 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketService.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketService.java
@@ -65,7 +65,7 @@ public class EncodingTicketService extends AbstractTicketService {
     /** Default proxy ticket prefix. */
     public static final String PROXY_TICKET_PREFIX = "PT";
 
-    /** Non-null marker value for unused ServiceTicket#id field. */
+    /** Non-null marker value for unused ServiceTicket#id field and storage context name. */
     private static final String NOT_USED = "na";
 
     /** Class logger. */
@@ -196,7 +196,7 @@ public class EncodingTicketService extends AbstractTicketService {
     private <T extends Ticket> T decode(final Class<T> ticketClass, final String id, final String prefix) {
         try {
             final String decrypted = dataSealer.unwrap(id.substring(prefix.length() + 1));
-            return serializer(ticketClass).deserialize(0, null, id, decrypted, 0L);
+            return serializer(ticketClass).deserialize(0, NOT_USED, id, decrypted, 0L);
         } catch (final Exception e) {
             log.warn("Ticket decoding failed with error: " + e.getMessage());
             log.debug("Ticket decoding failed", e);
diff --git a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketServiceTest.java b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketServiceTest.java
index 6fa20ed..27316a0 100644
--- a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketServiceTest.java
+++ b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketServiceTest.java
@@ -29,6 +29,7 @@ import net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy;
 import net.shibboleth.utilities.java.support.security.DataSealer;
 import net.shibboleth.utilities.java.support.security.IdentifierGenerationStrategy;
 import net.shibboleth.utilities.java.support.security.RandomIdentifierGenerationStrategy;
+import org.apache.commons.codec.binary.Base32;
 import org.joda.time.Instant;
 import org.opensaml.storage.impl.MemoryStorageService;
 import org.springframework.core.io.ClassPathResource;
@@ -70,9 +71,12 @@ public class EncodingTicketServiceTest {
         strategy.setKeyAlias("secret");
         strategy.setKeyPassword("password");
         strategy.initialize();
+        final Base32 codec = new Base32(0, null, false, (byte) '-');
         final DataSealer sealer = new DataSealer();
         sealer.setKeyStrategy(strategy);
         sealer.setRandom(secureRandom);
+        sealer.setEncoder(codec);
+        sealer.setDecoder(codec);
         sealer.initialize();
         ticketService = new EncodingTicketService(new MemoryStorageService(), sealer);
     }
@@ -122,8 +126,8 @@ public class EncodingTicketServiceTest {
         final String id = String.valueOf(System.currentTimeMillis());
         final ServiceTicket st1 = ticketService.createServiceTicket(id, expiry, service, state, true);
         assertNotNull(st1);
-        assertTrue(st1.getId().startsWith("ST-"));
-        assertTrue(st1.getId().length() < 500);
+        assertTrue(st1.getId().matches("ST-[A-Za-z0-9]+-*"));
+        assertTrue(st1.getId().length() < 600);
     }
 
     @Test
diff --git a/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml b/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml
index 13523ef..30f21b7 100644
--- a/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml
+++ b/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml
@@ -21,13 +21,18 @@
     <bean id="encodedTicketSealer" lazy-init="true"
           class="net.shibboleth.utilities.java.support.security.DataSealer"
           p:keyStrategy-ref="shibboleth.DataSealerKeyStrategy"
-          p:encoder-ref="base64Codec"
-          p:decoder-ref="base64Codec" />
-
-    <bean id="base64Codec" class="org.apache.commons.codec.binary.Base64"
+          p:encoder-ref="codec"
+          p:decoder-ref="codec" />
+
+    <!--
+       | For EncodingTicketService use base-32 encoding with '-' as the padding character
+       |to get tickets in the required character set: [A-Za-z0-9-]+
+       -->
+    <bean id="codec" class="org.apache.commons.codec.binary.Base32"
           c:lineLength="0"
-          c:lineSeparator="#{new byte[] {10} }"
-          c:urlSafe="true" />
+          c:lineSeparator="#{null}"
+          c:useHex="false"
+          c:pad="#{ T(java.lang.Integer).valueOf(45).byteValue() }" />
 
     <alias name="simpleTicketService" alias="shibboleth.DefaultCASTicketService" />
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.