[java-identity-provider] branch master updated: IDP-1338 - More control over session cache address binding
Scott Cantor
cantor.2 at osu.edu
Tue Sep 25 12:31:18 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=e4a3295741b8807d8803a7dbe23247c08e86fb8f
The following commit(s) were added to refs/heads/master by this push:
new e4a3295 IDP-1338 - More control over session cache address binding
e4a3295 is described below
commit e4a3295741b8807d8803a7dbe23247c08e86fb8f
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Sep 25 12:31:15 2018 -0400
IDP-1338 - More control over session cache address binding
https://issues.shibboleth.net/jira/browse/IDP-1338
---
.../resources/system/flows/authn/authn-beans.xml | 3 +-
.../resources/system/flows/logout/logout-beans.xml | 3 +-
.../idp/session/impl/PopulateSessionContext.java | 39 ++++++++++++++---
.../shibboleth/idp/session/impl/ProcessLogout.java | 50 ++++++++++++++++------
4 files changed, 73 insertions(+), 22 deletions(-)
diff --git a/idp-conf/src/main/resources/system/flows/authn/authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/authn-beans.xml
index fc470d4..578e8f5 100644
--- a/idp-conf/src/main/resources/system/flows/authn/authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/authn-beans.xml
@@ -35,7 +35,8 @@
class="net.shibboleth.idp.session.impl.PopulateSessionContext" scope="prototype"
p:activationCondition="%{idp.session.enabled:true}"
p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:sessionResolver-ref="shibboleth.SessionManager" />
+ p:sessionResolver-ref="shibboleth.SessionManager"
+ p:checkAddressCondition="#{getObject('%{idp.session.consistentAddressCondition:null}'.trim()) ?: %{idp.session.consistentAddress:true}}" />
<bean id="SetRPUIInformation"
class="net.shibboleth.idp.ui.impl.SetRPUIInformation" scope="prototype"
diff --git a/idp-conf/src/main/resources/system/flows/logout/logout-beans.xml b/idp-conf/src/main/resources/system/flows/logout/logout-beans.xml
index 854ec0c..6417a19 100644
--- a/idp-conf/src/main/resources/system/flows/logout/logout-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/logout/logout-beans.xml
@@ -44,7 +44,8 @@
p:httpServletRequest-ref="shibboleth.HttpServletRequest"
p:httpServletResponse-ref="shibboleth.HttpServletResponse"
p:sessionManager-ref="shibboleth.SessionManager"
- p:sessionResolver-ref="shibboleth.SessionManager" />
+ p:sessionResolver-ref="shibboleth.SessionManager"
+ p:checkAddressCondition="#{getObject('%{idp.session.consistentAddressCondition:null}'.trim()) ?: %{idp.session.consistentAddress:true}}" />
<bean id="PopulateClientStorageSaveContext"
class="org.opensaml.storage.impl.client.PopulateClientStorageSaveContext" scope="prototype"
diff --git a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/PopulateSessionContext.java b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/PopulateSessionContext.java
index b2db0eb..9bb01fe 100644
--- a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/PopulateSessionContext.java
+++ b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/PopulateSessionContext.java
@@ -41,6 +41,7 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.google.common.base.Function;
+import com.google.common.base.Predicate;
import com.google.common.base.Predicates;
/**
@@ -59,14 +60,19 @@ public class PopulateSessionContext extends AbstractProfileAction {
/** Session resolver. */
@NonnullAfterInit private SessionResolver sessionResolver;
+ /** Condition to determine whether to enforce address binding on the session. */
+ @Nonnull private Predicate<ProfileRequestContext> checkAddressCondition;
+
/** Creation/lookup function for SessionContext. */
@Nonnull private Function<ProfileRequestContext,SessionContext> sessionContextCreationStrategy;
/** Function to return {@link CriteriaSet} to give to session resolver. */
@Nonnull private Function<ProfileRequestContext,CriteriaSet> sessionResolverCriteriaStrategy;
-
+
/** Constructor. */
public PopulateSessionContext() {
+ checkAddressCondition = Predicates.alwaysTrue();
+
sessionContextCreationStrategy = new ChildContextLookup<>(SessionContext.class, true);
sessionResolverCriteriaStrategy = new Function<ProfileRequestContext,CriteriaSet>() {
@@ -78,6 +84,21 @@ public class PopulateSessionContext extends AbstractProfileAction {
}
/**
+ * Set condition to determine whether to perform address binding check before use of session.
+ *
+ * <p>Defaults to true insofar as the decision is then delegated back to the resolver.</p>
+ *
+ * @param condition condition to apply
+ *
+ * @since 3.4.0
+ */
+ public void setCheckAddressCondition(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ checkAddressCondition = Constraint.isNotNull(condition, "Address checking condition cannot be null");
+ }
+
+ /**
* Set the {@link SessionResolver} to use.
*
* @param resolver session resolver to use
@@ -137,14 +158,18 @@ public class PopulateSessionContext extends AbstractProfileAction {
return;
}
- final HttpServletRequest request = getHttpServletRequest();
- if (request != null && request.getRemoteAddr() != null) {
- if (!session.checkAddress(request.getRemoteAddr())) {
- return;
+ if (checkAddressCondition.apply(profileRequestContext)) {
+ final HttpServletRequest request = getHttpServletRequest();
+ if (request != null && request.getRemoteAddr() != null) {
+ if (!session.checkAddress(request.getRemoteAddr())) {
+ return;
+ }
+ } else {
+ log.info("{} No servlet request or client address available, skipping address check for session {}",
+ getLogPrefix(), session.getId());
}
} else {
- log.info("{} No servlet request or client address available, skipping address check for session {}",
- getLogPrefix(), session.getId());
+ log.debug("{} Bypassing address check for session {}", getLogPrefix(), session.getId());
}
final SessionContext sessionCtx = sessionContextCreationStrategy.apply(profileRequestContext);
diff --git a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ProcessLogout.java b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ProcessLogout.java
index 0747560..743df36 100644
--- a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ProcessLogout.java
+++ b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ProcessLogout.java
@@ -45,6 +45,7 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.google.common.base.Function;
+import com.google.common.base.Predicate;
import com.google.common.base.Predicates;
/**
@@ -72,7 +73,10 @@ public class ProcessLogout extends AbstractProfileAction {
/** Session manager. */
@NonnullAfterInit private SessionManager sessionManager;
-
+
+ /** Condition to determine whether to enforce address binding on the session. */
+ @Nonnull private Predicate<ProfileRequestContext> checkAddressCondition;
+
/** Creation/lookup function for SubjectContext. */
@Nonnull private Function<ProfileRequestContext,SubjectContext> subjectContextCreationStrategy;
@@ -87,6 +91,7 @@ public class ProcessLogout extends AbstractProfileAction {
/** Constructor. */
public ProcessLogout() {
+ checkAddressCondition = Predicates.alwaysTrue();
subjectContextCreationStrategy = new ChildContextLookup<>(SubjectContext.class, true);
sessionContextCreationStrategy = new ChildContextLookup<>(SessionContext.class, true);
logoutContextCreationStrategy = new ChildContextLookup<>(LogoutContext.class, true);
@@ -100,6 +105,21 @@ public class ProcessLogout extends AbstractProfileAction {
}
/**
+ * Set condition to determine whether to perform address binding check before use of session.
+ *
+ * <p>Defaults to true insofar as the decision is then delegated back to the resolver.</p>
+ *
+ * @param condition condition to apply
+ *
+ * @since 3.4.0
+ */
+ public void setCheckAddressCondition(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ checkAddressCondition = Constraint.isNotNull(condition, "Address checking condition cannot be null");
+ }
+
+ /**
* Set the {@link SessionResolver} to use.
*
* @param resolver session resolver to use
@@ -197,20 +217,24 @@ public class ProcessLogout extends AbstractProfileAction {
return;
}
- final HttpServletRequest request = getHttpServletRequest();
- if (request != null && request.getRemoteAddr() != null) {
- try {
- if (!session.checkAddress(request.getRemoteAddr())) {
+ if (checkAddressCondition.apply(profileRequestContext)) {
+ final HttpServletRequest request = getHttpServletRequest();
+ if (request != null && request.getRemoteAddr() != null) {
+ try {
+ if (!session.checkAddress(request.getRemoteAddr())) {
+ return;
+ }
+ } catch (final SessionException e) {
+ log.error("{} Error binding session to client address", getLogPrefix(), e);
+ ActionSupport.buildEvent(profileRequestContext, EventIds.IO_ERROR);
return;
- }
- } catch (final SessionException e) {
- log.error("{} Error binding session to client address", getLogPrefix(), e);
- ActionSupport.buildEvent(profileRequestContext, EventIds.IO_ERROR);
- return;
- }
+ }
+ } else {
+ log.info("{} No servlet request or client address available, skipping address check for sessions",
+ getLogPrefix());
+ }
} else {
- log.info("{} No servlet request or client address available, skipping address check for sessions",
- getLogPrefix());
+ log.debug("{} Bypassing address check for session {}", getLogPrefix(), session.getId());
}
final SubjectContext subjectCtx = subjectContextCreationStrategy.apply(profileRequestContext);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list