[java-identity-provider] branch master updated: IDP-701 Use CAS-specific endpoint binding URIs.
Marvin S. Addison
marvin.addison at gmail.com
Wed Jun 20 12:36:46 EDT 2018
This is an automated email from the git hooks/post-receive script.
serac pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=b90991490881714028d9b1a5b81fee976712df35
The following commit(s) were added to refs/heads/master by this push:
new b909914 IDP-701 Use CAS-specific endpoint binding URIs.
b909914 is described below
commit b90991490881714028d9b1a5b81fee976712df35
Author: Marvin S. Addison <serac at vt.edu>
AuthorDate: Wed Jun 20 12:17:35 2018 -0400
IDP-701 Use CAS-specific endpoint binding URIs.
Avoid SAML-specific bindings for CAS enpoints but instead use existing
vocabulary for CAS profile URIs as binding URIs:
1. https://www.apereo.org/cas/protocol/login
2. https://www.apereo.org/cas/protocol/logout
See https://issues.shibboleth.net/jira/browse/IDP-701
---
.../cas/service/impl/MetadataServiceRegistry.java | 34 ++++++++++++++++------
.../test/resources/metadata/cas-test-metadata.xml | 14 ++++-----
2 files changed, 32 insertions(+), 16 deletions(-)
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistry.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistry.java
index 63a2c96..562247f 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistry.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistry.java
@@ -28,6 +28,7 @@ import javax.annotation.Nullable;
import com.google.common.collect.Lists;
import net.shibboleth.idp.cas.config.impl.AbstractProtocolConfiguration;
+import net.shibboleth.idp.cas.config.impl.LoginConfiguration;
import net.shibboleth.idp.cas.service.Service;
import net.shibboleth.idp.cas.service.ServiceRegistry;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
@@ -39,6 +40,7 @@ import org.opensaml.saml.criterion.ProtocolCriterion;
import org.opensaml.saml.criterion.StartsWithLocationCriterion;
import org.opensaml.saml.metadata.resolver.MetadataResolver;
import org.opensaml.saml.saml2.metadata.AssertionConsumerService;
+import org.opensaml.saml.saml2.metadata.Endpoint;
import org.opensaml.saml.saml2.metadata.EntitiesDescriptor;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
import org.opensaml.saml.saml2.metadata.KeyDescriptor;
@@ -51,13 +53,16 @@ import org.slf4j.LoggerFactory;
/**
* CAS service registry implementation that queries SAML metadata for a CAS service given a CAS service URL using
- * the following strategy. A {@link MetadataResolver} is queried for an {@link EntityDescriptor} that contains at
- * least one <code>AssertionConsumerService</code> endpoint that meets the following criteria:
+ * the following strategy. A {@link MetadataResolver} is queried for an {@link EntityDescriptor} that meets the
+ * following criteria:
*
* <ol>
- * <li>Defines <code>https://www.apereo.org/cas/protocol</code> in its <code>protocolSupportEnumeration</code>
- * attribute.</li>
- * <li>Defines a <code>Location</code> URL where the given service URL starts with the ACS URL.</li>
+ * <li>Defines <code>{@value AbstractProtocolConfiguration#PROTOCOL_URI}</code> in the
+ * <code>protocolSupportEnumeration</code> attribute of an <code>SPSSODescriptor</code> element.</li>
+ * <li>Defines an <code>AssertionConsumerService</code> element where the <code>Binding</code> URI is
+ * {@value #LOGIN_BINDING}.</li>
+ * <li>Matching <code>AssertionConsumerService</code> element also defines a <code>Location</code> attribute
+ * where the given service URL starts with the ACS location.</li>
* </ol>
*
* If a single match is found, it is converted to a {@link Service} and returned; if more than result is found, a
@@ -67,6 +72,12 @@ import org.slf4j.LoggerFactory;
*/
public class MetadataServiceRegistry implements ServiceRegistry {
+ /** URI identifying an ACS endpoint that requests CAS service tickets. */
+ public static final String LOGIN_BINDING = LoginConfiguration.PROTOCOL_URI;
+
+ /** URI identifying a CAS SLO endpoint. */
+ public static final String LOGOUT_BINDING = AbstractProtocolConfiguration.PROTOCOL_URI + "/logout";
+
/** Class logger. */
private final Logger log = LoggerFactory.getLogger(MetadataServiceRegistry.class);
@@ -109,11 +120,12 @@ public class MetadataServiceRegistry implements ServiceRegistry {
*/
@Nonnull
protected CriteriaSet criteria(@Nonnull final String serviceURL) {
- final AssertionConsumerService acs = new AssertionConsumerServiceBuilder().buildObject();
- acs.setLocation(serviceURL);
+ final AssertionConsumerService loginACS = new AssertionConsumerServiceBuilder().buildObject();
+ loginACS.setBinding(LOGIN_BINDING);
+ loginACS.setLocation(serviceURL);
return new CriteriaSet(
new EntityRoleCriterion(SPSSODescriptor.DEFAULT_ELEMENT_NAME),
- new EndpointCriterion<>(acs),
+ new EndpointCriterion<>(loginACS),
new ProtocolCriterion(AbstractProtocolConfiguration.PROTOCOL_URI),
new StartsWithLocationCriterion());
}
@@ -159,7 +171,11 @@ public class MetadataServiceRegistry implements ServiceRegistry {
private boolean hasSingleLogoutService(@Nonnull final SPSSODescriptor descriptor) {
if (descriptor != null) {
- return descriptor.getEndpoints(SingleLogoutService.DEFAULT_ELEMENT_NAME).size() > 0;
+ for (Endpoint endpoint : descriptor.getEndpoints(SingleLogoutService.DEFAULT_ELEMENT_NAME)) {
+ if (LOGOUT_BINDING.equals(endpoint.getBinding())) {
+ return true;
+ }
+ }
}
return false;
}
diff --git a/idp-cas-impl/src/test/resources/metadata/cas-test-metadata.xml b/idp-cas-impl/src/test/resources/metadata/cas-test-metadata.xml
index 02489e2..2a9a76a 100644
--- a/idp-cas-impl/src/test/resources/metadata/cas-test-metadata.xml
+++ b/idp-cas-impl/src/test/resources/metadata/cas-test-metadata.xml
@@ -196,19 +196,19 @@
</ds:KeyInfo>
</KeyDescriptor>
<AssertionConsumerService
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
+ Binding="https://www.apereo.org/cas/protocol/login"
Location="https://alpha.example.org/"
index="1"/>
<AssertionConsumerService
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
+ Binding="https://www.apereo.org/cas/protocol/login"
Location="https://alpha.dev.example.org/"
index="2"/>
<AssertionConsumerService
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
+ Binding="https://www.apereo.org/cas/protocol/login"
Location="https://alpha.test.example.org/"
index="3"/>
<SingleLogoutService
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
+ Binding="https://www.apereo.org/cas/protocol/logout"
Location="https://not.used.invalid/"/>
</SPSSODescriptor>
</EntityDescriptor>
@@ -219,15 +219,15 @@
<EntityDescriptor entityID="https://beta.example.org/">
<SPSSODescriptor protocolSupportEnumeration="https://www.apereo.org/cas/protocol">
<AssertionConsumerService
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
+ Binding="https://www.apereo.org/cas/protocol/login"
Location="https://beta.example.org/"
index="1"/>
<AssertionConsumerService
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
+ Binding="https://www.apereo.org/cas/protocol/login"
Location="https://betatest.example.org/"
index="2"/>
<AssertionConsumerService
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
+ Binding="https://www.apereo.org/cas/protocol/login"
Location="https://betatest.example.org:8443/"
index="3"/>
</SPSSODescriptor>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list