[java-identity-provider] branch master updated: IDP-701 CAS metadata changes based on code review.
Marvin S. Addison
marvin.addison at gmail.com
Thu Jun 28 11:24:30 EDT 2018
This is an automated email from the git hooks/post-receive script.
serac pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=421e0aaae26b6624438b82cc9ab4b97371837263
The following commit(s) were added to refs/heads/master by this push:
new 421e0aa IDP-701 CAS metadata changes based on code review.
421e0aa is described below
commit 421e0aaae26b6624438b82cc9ab4b97371837263
Author: Marvin S. Addison <serac at vt.edu>
AuthorDate: Thu Jun 28 11:22:36 2018 -0400
IDP-701 CAS metadata changes based on code review.
1. Use spec-defined URN for dynamic SLO location.
2. Use SPSSODescriptor with ACS endpoint to indicate proxy support.
---
.../cas/service/impl/MetadataServiceRegistry.java | 43 +++++++++++++++-------
.../service/impl/MetadataServiceRegistryTest.java | 3 +-
.../test/resources/metadata/cas-test-metadata.xml | 39 ++++++++++----------
3 files changed, 50 insertions(+), 35 deletions(-)
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistry.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistry.java
index 31fe5d3..a525909 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistry.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistry.java
@@ -22,6 +22,7 @@ import java.util.List;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import com.google.common.base.Predicate;
import com.google.common.collect.Lists;
import net.shibboleth.idp.cas.config.impl.AbstractProtocolConfiguration;
import net.shibboleth.idp.cas.config.impl.LoginConfiguration;
@@ -37,8 +38,6 @@ import org.opensaml.saml.criterion.ProtocolCriterion;
import org.opensaml.saml.criterion.StartsWithLocationCriterion;
import org.opensaml.saml.metadata.resolver.MetadataResolver;
import org.opensaml.saml.saml2.metadata.AssertionConsumerService;
-import org.opensaml.saml.saml2.metadata.AttributeAuthorityDescriptor;
-import org.opensaml.saml.saml2.metadata.AttributeService;
import org.opensaml.saml.saml2.metadata.Endpoint;
import org.opensaml.saml.saml2.metadata.EntitiesDescriptor;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
@@ -65,13 +64,16 @@ import org.slf4j.LoggerFactory;
* If a single match is found, it is converted to a {@link Service} and returned; if more than result is found, a
* {@link ResolverException} is raised, otherwise null is returned.
* <p>
- * The presence of an <code>AttributeAuthorityDescriptor</code> element that advertises protocol support for
- * <code>{@value AbstractProtocolConfiguration#PROTOCOL_URI}</code> signals a CAS proxy endpoint. If at least one
- * <code>AttributeService</code> with a binding of <code>{@value #PROXY_BINDING}</code> is defined, the service is
- * authorized to request proxy granting tickets.
- * <p>
- * See the <a href="https://wiki.shibboleth.net/confluence/x/BQfKAg">SAML metadata profile for CAS</a> for further
- * details.
+ * Two additional aspects of a CAS service may be specified in metadata:
+ * <ol>
+ * <li><code>allowedToProxy</code> - True if there is an code>AssertionConsumerService</code> element with a
+ * binding of <code>{@value #PROXY_BINDING}</code>, false otherwise.</li>
+ * <li><code>singleLogoutParticipant</code> - True if there is a <code>SingleLogoutService</code> element with a
+ * binding of <code>{@value #LOGOUT_BINDING}</code> and a location of <code>{@value #LOGOUT_LOCATION}</code>,
+ * false otherwise.</li>
+ * </ol>
+ * See the <a href="https://wiki.shibboleth.net/confluence/x/BQfKAg">SAML metadata profile for CAS</a> for the full
+ * specification.
*
* @author Marvin S. Addison
*/
@@ -83,6 +85,9 @@ public class MetadataServiceRegistry implements ServiceRegistry {
/** URI identifying a CAS SLO endpoint. */
public static final String LOGOUT_BINDING = AbstractProtocolConfiguration.PROTOCOL_URI + "/logout";
+ /** URN marking that SLO endpoint is dynamic based on service ticket URL. */
+ public static final String LOGOUT_LOCATION= "urn:mace:shibboleth:profile:CAS:logout";
+
/** URI identifying a CAS proxy callback endoint. */
public static final String PROXY_BINDING = ProxyConfiguration.PROFILE_ID;
@@ -160,11 +165,10 @@ public class MetadataServiceRegistry implements ServiceRegistry {
}
private boolean isAuthorizedToProxy(@Nonnull final EntityDescriptor entity) {
- final AttributeAuthorityDescriptor descriptor = entity.getAttributeAuthorityDescriptor(
- AbstractProtocolConfiguration.PROTOCOL_URI);
+ final SPSSODescriptor descriptor = entity.getSPSSODescriptor(AbstractProtocolConfiguration.PROTOCOL_URI);
if (descriptor != null) {
- for (AttributeService as : descriptor.getAttributeServices()) {
- if (PROXY_BINDING.equals(as.getBinding())) {
+ for (AssertionConsumerService acs : descriptor.getAssertionConsumerServices()) {
+ if (PROXY_BINDING.equals(acs.getBinding())) {
return true;
}
}
@@ -176,11 +180,22 @@ public class MetadataServiceRegistry implements ServiceRegistry {
final SPSSODescriptor descriptor = entity.getSPSSODescriptor(AbstractProtocolConfiguration.PROTOCOL_URI);
if (descriptor != null) {
for (Endpoint endpoint : descriptor.getEndpoints(SingleLogoutService.DEFAULT_ELEMENT_NAME)) {
- if (LOGOUT_BINDING.equals(endpoint.getBinding())) {
+ if (LOGOUT_BINDING.equals(endpoint.getBinding()) && LOGOUT_LOCATION.equals(endpoint.getLocation())) {
return true;
}
}
}
return false;
}
+
+ /**
+ * Predicate defines CAS login endpoints so that the metadata index on endpoints can be scoped to the smallest
+ * set needed to support CAS entities in SAML metadata.
+ */
+ public static class LoginEndpointPredicate implements Predicate<Endpoint> {
+ @Override
+ public boolean apply(@Nullable final Endpoint endpoint) {
+ return LOGIN_BINDING.equals(endpoint.getBinding());
+ }
+ }
}
diff --git a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistryTest.java b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistryTest.java
index e2d5dad..da2d7bf 100644
--- a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistryTest.java
+++ b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistryTest.java
@@ -81,7 +81,8 @@ public class MetadataServiceRegistryTest {
metadataResolver.setParserPool(XMLObjectProviderRegistrySupport.getParserPool());
metadataResolver.setMaxRefreshDelay(500000);
metadataResolver.setId("cas");
- metadataResolver.setIndexes(Collections.<MetadataIndex>singleton(new EndpointMetadataIndex()));
+ metadataResolver.setIndexes(Collections.<MetadataIndex>singleton(new EndpointMetadataIndex(
+ new MetadataServiceRegistry.LoginEndpointPredicate())));
metadataResolver.initialize();
}
diff --git a/idp-cas-impl/src/test/resources/metadata/cas-test-metadata.xml b/idp-cas-impl/src/test/resources/metadata/cas-test-metadata.xml
index aca6004..908a785 100644
--- a/idp-cas-impl/src/test/resources/metadata/cas-test-metadata.xml
+++ b/idp-cas-impl/src/test/resources/metadata/cas-test-metadata.xml
@@ -123,23 +123,6 @@
-->
<EntityDescriptor entityID="https://alpha.example.org/">
<SPSSODescriptor protocolSupportEnumeration="https://www.apereo.org/cas/protocol">
- <AssertionConsumerService
- Binding="https://www.apereo.org/cas/protocol/login"
- Location="https://alpha.example.org/"
- index="1"/>
- <AssertionConsumerService
- Binding="https://www.apereo.org/cas/protocol/login"
- Location="https://alpha.dev.example.org/"
- index="2"/>
- <AssertionConsumerService
- Binding="https://www.apereo.org/cas/protocol/login"
- Location="https://alpha.test.example.org/"
- index="3"/>
- <SingleLogoutService
- Binding="https://www.apereo.org/cas/protocol/logout"
- Location="https://not.used.invalid/"/>
- </SPSSODescriptor>
- <AttributeAuthorityDescriptor protocolSupportEnumeration="https://www.apereo.org/cas/protocol">
<KeyDescriptor use="signing">
<ds:KeyInfo>
<ds:X509Data>
@@ -210,10 +193,26 @@
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
- <AttributeService
+ <AssertionConsumerService
+ Binding="https://www.apereo.org/cas/protocol/login"
+ Location="https://alpha.example.org/"
+ index="1"/>
+ <AssertionConsumerService
+ Binding="https://www.apereo.org/cas/protocol/login"
+ Location="https://alpha.dev.example.org/"
+ index="2"/>
+ <AssertionConsumerService
+ Binding="https://www.apereo.org/cas/protocol/login"
+ Location="https://alpha.test.example.org/"
+ index="3"/>
+ <AssertionConsumerService
Binding="https://www.apereo.org/cas/protocol/proxy"
- Location="https://alpha.example.org/proxy_receptor" />
- </AttributeAuthorityDescriptor>
+ Location="https://alpha.example.org/proxy_receptor"
+ index="3"/>
+ <SingleLogoutService
+ Binding="https://www.apereo.org/cas/protocol/logout"
+ Location="urn:mace:shibboleth:profile:CAS:logout"/>
+ </SPSSODescriptor>
</EntityDescriptor>
<!--
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list