[java-identity-provider] branch master updated: IDP-1442 - Allow request signatures to be ignored
Scott Cantor
cantor.2 at osu.edu
Tue Apr 23 15:27:53 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=735a7f26a3d3e8120fd4066411dce4b8053ddd08
The following commit(s) were added to refs/heads/master by this push:
new 735a7f2 IDP-1442 - Allow request signatures to be ignored
735a7f2 is described below
commit 735a7f26a3d3e8120fd4066411dce4b8053ddd08
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Apr 23 15:27:02 2019 -0400
IDP-1442 - Allow request signatures to be ignored
https://issues.shibboleth.net/jira/browse/IDP-1442
---
.../system/conf/relying-party-mddriven.xml | 8 ++++
.../resources/system/flows/saml/security-beans.xml | 15 ++++--
.../config/AbstractSAML2ProfileConfiguration.java | 31 ++++++++++++
.../profile/config/SAML2ProfileConfiguration.java | 38 ++++++++++-----
.../logic/IgnoreRequestSignaturesPredicate.java | 55 ++++++++++++++++++++++
.../impl/PopulateBindingAndEndpointContexts.java | 8 ++--
6 files changed, 137 insertions(+), 18 deletions(-)
diff --git a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
index f1377c0..6fd4ac4 100644
--- a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
+++ b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
@@ -151,6 +151,14 @@
</bean>
<bean id="AbstractMDDrivenSAML2Profile" parent="AbstractMDDrivenSAMLProfile" abstract="true">
+ <property name="ignoreRequestSignaturesPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="ignoreRequestSignatures" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
<property name="encryptionOptionalPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
diff --git a/idp-conf/src/main/resources/system/flows/saml/security-beans.xml b/idp-conf/src/main/resources/system/flows/saml/security-beans.xml
index cb39b8d..c1b2a20 100644
--- a/idp-conf/src/main/resources/system/flows/saml/security-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/saml/security-beans.xml
@@ -115,9 +115,16 @@
</property>
</bean>
+ <bean id="NotIgnoreRequestSignaturesPredicate" parent="shibboleth.Conditions.NOT">
+ <constructor-arg>
+ <bean class="net.shibboleth.idp.saml.saml2.profile.config.logic.IgnoreRequestSignaturesPredicate" />
+ </constructor-arg>
+ </bean>
+
<bean id="SAMLProtocolMessageXMLSignatureSecurityHandler"
class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND">
+ c:executionDirection="INBOUND"
+ p:activationCondition-ref="NotIgnoreRequestSignaturesPredicate">
<constructor-arg name="messageHandler">
<bean class="org.opensaml.saml.common.binding.security.impl.SAMLProtocolMessageXMLSignatureSecurityHandler" scope="prototype" />
</constructor-arg>
@@ -128,7 +135,8 @@
<bean id="SAML2HTTPRedirectDeflateSignatureSecurityHandler"
class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND">
+ c:executionDirection="INBOUND"
+ p:activationCondition-ref="NotIgnoreRequestSignaturesPredicate">
<constructor-arg name="messageHandler">
<bean class="org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPRedirectDeflateSignatureSecurityHandler" scope="prototype"
p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
@@ -140,7 +148,8 @@
<bean id="SAML2HTTPPostSimpleSignSecurityHandler"
class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND">
+ c:executionDirection="INBOUND"
+ p:activationCondition-ref="NotIgnoreRequestSignaturesPredicate">
<constructor-arg name="messageHandler">
<bean class="org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPPostSimpleSignSecurityHandler" scope="prototype"
p:httpServletRequest-ref="shibboleth.HttpServletRequest"
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java
index 97b2c01..46754e4 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java
@@ -46,6 +46,9 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
/** Default proxy count. */
@Nonnull public static final Long DEFAULT_PROXY_COUNT = 0L;
+ /** Whether to ignore signatures in requests. */
+ @Nonnull private Predicate<ProfileRequestContext> ignoreRequestSignaturesPredicate;
+
/** Whether encryption is optional in the face of no key, etc. */
@Nonnull private Predicate<ProfileRequestContext> encryptionOptionalPredicate;
@@ -72,6 +75,7 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
public AbstractSAML2ProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
+ ignoreRequestSignaturesPredicate = Predicates.alwaysFalse();
encryptionOptionalPredicate = Predicates.alwaysFalse();
encryptAssertionsPredicate = Predicates.alwaysFalse();
encryptNameIDsPredicate = Predicates.alwaysFalse();
@@ -139,6 +143,33 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
@Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
proxyAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+
+ /** {@inheritDoc} */
+ public boolean isIgnoreRequestSignatures(@Nonnull final ProfileRequestContext profileRequestContext) {
+ return ignoreRequestSignaturesPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Sets whether to bypass verification of request signatures.
+ *
+ * @param flag flag to set
+ *
+ * @since 4.0.0
+ */
+ public void setIgnoreRequestSignatures(final boolean flag) {
+ ignoreRequestSignaturesPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Sets a condition to determine whether to bypass verification of request signatures.
+ *
+ * @param condition condition to set
+ *
+ * @since 4.0.0
+ */
+ public void setIgnoreRequestSignaturesPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ ignoreRequestSignaturesPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
/** {@inheritDoc} */
public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
index d31ddcb..122fd81 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
@@ -35,26 +35,40 @@ import org.opensaml.profile.context.ProfileRequestContext;
public interface SAML2ProfileConfiguration {
/**
- * Get the maximum number of times an assertion may be proxied.
+ * Gets the maximum number of times an assertion may be proxied.
*
- * @param profileRequestContext profileRequestContext
+ * @param profileRequestContext current profile request context
*
* @return maximum number of times an assertion may be proxied
*/
@NonNegative long getProxyCount(@Nullable final ProfileRequestContext profileRequestContext);
/**
- * Get the unmodifiable collection of audiences for a proxied assertion.
+ * Gets the unmodifiable collection of audiences for a proxied assertion.
*
- * @param profileRequestContext profileRequestContext
+ * @param profileRequestContext current profile request context
*
* @return audiences for a proxied assertion
*/
@Nonnull @NonnullElements @NotLive @Unmodifiable Collection<String> getProxyAudiences(
@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Gets whether to bypass verification of request signatures.
+ *
+ * <p>This is typically of use to deal with broken services or to allow a
+ * signer's key to be bypassed in the event that it is managed improperly.</p>
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return true iff request signatures should be ignored
+ *
+ * @since 4.0.0
+ */
+ boolean isIgnoreRequestSignatures(@Nonnull final ProfileRequestContext profileRequestContext);
/**
- * Get whether to ignore an inability to encrypt due to external factors.
+ * Gets whether to ignore an inability to encrypt due to external factors.
*
* <p>This allows a deployer to signal that encryption is "best effort" and
* can be omitted if a relying party doesn't possess a key, support a compatible
@@ -62,34 +76,34 @@ public interface SAML2ProfileConfiguration {
*
* <p>Defaults to false.</p>
*
- * @param profileRequestContext profileRequestContext
+ * @param profileRequestContext current profile request context
*
* @return true iff encryption should be treated as optional
*/
boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext);
/**
- * Get the predicate used to determine if assertions should be encrypted.
+ * Gets the predicate used to determine if assertions should be encrypted.
*
- * @param profileRequestContext profileRequestContext
+ * @param profileRequestContext current profile request context
*
* @return predicate used to determine if assertions should be encrypted
*/
boolean isEncryptAssertions(@Nullable final ProfileRequestContext profileRequestContext);
/**
- * Get the predicate used to determine if name identifiers should be encrypted.
+ * Gets the predicate used to determine if name identifiers should be encrypted.
*
- * @param profileRequestContext profileRequestContext
+ * @param profileRequestContext current profile request context
*
* @return predicate used to determine if name identifiers should be encrypted
*/
boolean isEncryptNameIDs(@Nullable final ProfileRequestContext profileRequestContext);
/**
- * Get the predicate used to determine if attributes should be encrypted.
+ * Gets the predicate used to determine if attributes should be encrypted.
*
- * @param profileRequestContext profileRequestContext
+ * @param profileRequestContext current profile request context
*
* @return predicate used to determine if attributes should be encrypted
*/
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/IgnoreRequestSignaturesPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/IgnoreRequestSignaturesPredicate.java
new file mode 100644
index 0000000..ae7e062
--- /dev/null
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/IgnoreRequestSignaturesPredicate.java
@@ -0,0 +1,55 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.saml2.profile.config.logic;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.idp.saml.saml2.profile.config.SAML2ProfileConfiguration;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/** Predicate that decides whether to ignore a request signature. */
+public class IgnoreRequestSignaturesPredicate extends AbstractRelyingPartyPredicate {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(IgnoreRequestSignaturesPredicate.class);
+
+ /** {@inheritDoc} */
+ public boolean test(@Nullable final ProfileRequestContext input) {
+
+ final RelyingPartyContext rpCtx = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpCtx == null) {
+ log.debug("No RelyingPartyContext found, assuming signatures should be checked");
+ return false;
+ }
+
+ if (rpCtx.getProfileConfig() == null || !(rpCtx.getProfileConfig() instanceof SAML2ProfileConfiguration)) {
+ log.debug("No SAML 2 profile configuration found, assuming signatures should be checked");
+ return false;
+ }
+
+ return ((SAML2ProfileConfiguration) rpCtx.getProfileConfig()).isIgnoreRequestSignatures(input);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
index 3c16256..105d50e 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
@@ -347,10 +347,12 @@ public class PopulateBindingAndEndpointContexts extends AbstractProfileAction {
profileRequestContext);
}
if (profileConfiguration instanceof BrowserSSOProfileConfiguration) {
+ final BrowserSSOProfileConfiguration ssoConfig =
+ (BrowserSSOProfileConfiguration) profileConfiguration;
skipValidationSinceSigned =
- ((BrowserSSOProfileConfiguration) profileConfiguration).isSkipEndpointValidationWhenSigned(
- profileRequestContext)
- && inboundMessage instanceof AuthnRequest
+ inboundMessage instanceof AuthnRequest
+ && ssoConfig.isSkipEndpointValidationWhenSigned(profileRequestContext)
+ && !ssoConfig.isIgnoreRequestSignatures(profileRequestContext)
&& SAMLBindingSupport.isMessageSigned(profileRequestContext.getInboundMessageContext());
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list