[java-identity-provider] branch master updated: IDP-1391 - Add a service layer for password validators.
Scott Cantor
cantor.2 at osu.edu
Mon Aug 12 09:48:29 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=66d435bf0517dba985d8c84b4deaa5c25c47091f
The following commit(s) were added to refs/heads/master by this push:
new 66d435b IDP-1391 - Add a service layer for password validators.
66d435b is described below
commit 66d435bf0517dba985d8c84b4deaa5c25c47091f
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Aug 12 09:46:24 2019 -0400
IDP-1391 - Add a service layer for password validators.
https://issues.shibboleth.net/jira/browse/IDP-1391
Update config/wiring for new and upgraded use.
---
.../idp/authn/impl/ValidateCredentials.java | 6 +++++-
.../resources/conf/authn/jaas-authn-config.xml | 2 --
.../resources/conf/authn/krb5-authn-config.xml | 2 --
.../resources/conf/authn/ldap-authn-config.xml | 2 --
.../resources/conf/authn/password-authn-config.xml | 20 ++++++++++++++----
.../system/flows/authn/password-authn-beans.xml | 24 +++++++++++++++-------
6 files changed, 38 insertions(+), 18 deletions(-)
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateCredentials.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateCredentials.java
index 10647c5..5046b42 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateCredentials.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateCredentials.java
@@ -218,7 +218,11 @@ public class ValidateCredentials extends AbstractValidationAction implements War
}
} catch (final Exception e) {
recordFailure();
- if (!errorSignaled) {
+ if (requireAll) {
+ super.handleError(profileRequestContext, authenticationContext, e, AuthnEventIds.AUTHN_EXCEPTION);
+ errorSignaled = true;
+ break;
+ } else if (!errorSignaled) {
super.handleError(profileRequestContext, authenticationContext, e, AuthnEventIds.AUTHN_EXCEPTION);
errorSignaled = true;
}
diff --git a/idp-conf/src/main/resources/conf/authn/jaas-authn-config.xml b/idp-conf/src/main/resources/conf/authn/jaas-authn-config.xml
index daef4d2..7edd41c 100644
--- a/idp-conf/src/main/resources/conf/authn/jaas-authn-config.xml
+++ b/idp-conf/src/main/resources/conf/authn/jaas-authn-config.xml
@@ -22,6 +22,4 @@
<value>ShibUserPassAuth</value>
</util:list>
- <alias name="ValidateUsernamePasswordAgainstJAAS" alias="ValidateUsernamePassword"/>
-
</beans>
diff --git a/idp-conf/src/main/resources/conf/authn/krb5-authn-config.xml b/idp-conf/src/main/resources/conf/authn/krb5-authn-config.xml
index d3590a2..f826f30 100644
--- a/idp-conf/src/main/resources/conf/authn/krb5-authn-config.xml
+++ b/idp-conf/src/main/resources/conf/authn/krb5-authn-config.xml
@@ -25,7 +25,5 @@
<bean id="shibboleth.authn.Krb5.ServicePrincipal" class="java.lang.String" c:_0="SERVICE/principal" />
<bean id="shibboleth.authn.Krb5.Keytab" class="java.lang.String" c:_0="%{idp.home}/credentials/keytab" />
-->
-
- <alias name="ValidateUsernamePasswordAgainstKerberos" alias="ValidateUsernamePassword"/>
</beans>
diff --git a/idp-conf/src/main/resources/conf/authn/ldap-authn-config.xml b/idp-conf/src/main/resources/conf/authn/ldap-authn-config.xml
index 56d1bc7..5e7c5b1 100644
--- a/idp-conf/src/main/resources/conf/authn/ldap-authn-config.xml
+++ b/idp-conf/src/main/resources/conf/authn/ldap-authn-config.xml
@@ -15,8 +15,6 @@
<constructor-arg type="java.lang.String" value="%{idp.authn.LDAP.returnAttributes:1.1}" />
</bean>
- <alias name="ValidateUsernamePasswordAgainstLDAP" alias="ValidateUsernamePassword" />
-
<!-- Connection Configuration -->
<bean id="connectionConfig" class="org.ldaptive.ConnectionConfig" abstract="true" p:ldapUrl="%{idp.authn.LDAP.ldapURL}"
p:useStartTLS="%{idp.authn.LDAP.useStartTLS:true}"
diff --git a/idp-conf/src/main/resources/conf/authn/password-authn-config.xml b/idp-conf/src/main/resources/conf/authn/password-authn-config.xml
index f27051b..3b8e3bb 100644
--- a/idp-conf/src/main/resources/conf/authn/password-authn-config.xml
+++ b/idp-conf/src/main/resources/conf/authn/password-authn-config.xml
@@ -12,12 +12,11 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <!-- Choose an import based on the back-end you want to use. -->
- <!-- <import resource="jaas-authn-config.xml" /> -->
- <!-- <import resource="krb5-authn-config.xml" /> -->
+ <!-- You can optionally comment out anything you don't need. -->
+ <import resource="jaas-authn-config.xml" />
+ <import resource="krb5-authn-config.xml" />
<import resource="ldap-authn-config.xml" />
-
<!-- Names of form fields to pull username and password from. -->
<bean id="shibboleth.authn.Password.UsernameFieldName" class="java.lang.String" c:_0="j_username" />
<bean id="shibboleth.authn.Password.PasswordFieldName" class="java.lang.String" c:_0="j_password" />
@@ -37,6 +36,14 @@
<bean parent="shibboleth.Pair" p:first="^(.+)@example\.edu$" p:second="$1" />
-->
</util:list>
+
+ <!-- Ordered list of CredentialValidators to apply to a request. -->
+ <util:list id="shibboleth.authn.Password.Validators">
+ <ref bean="shibboleth.LDAPValidator" />
+ </util:list>
+
+ <!-- Controls whether all validators in the above bean have to succeed, or just one. -->
+ <util:constant id="shibboleth.authn.Password.RequireAll" static-field="java.lang.Boolean.FALSE"/>
<!-- Uncomment to configure account lockout backed by in-memory storage. -->
<!--
@@ -87,6 +94,11 @@
<value>ACCOUNT_WARNING</value>
</list>
</entry>
+ <entry key="RequestUnsupported">
+ <list>
+ <value>RequestUnsupported</value>
+ </list>
+ </entry>
</util:map>
<!--
diff --git a/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
index d0627f5..d0dd086 100644
--- a/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
@@ -18,6 +18,8 @@
<bean class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" />
<bean class="net.shibboleth.idp.profile.impl.ProfileActionBeanPostProcessor" />
+
+
<import resource="../../../conf/authn/password-authn-config.xml" />
<bean id="ExtractUsernamePasswordFromBasicAuth"
@@ -51,6 +53,7 @@
<!-- New action bean that uses CredentialValidator chains. -->
<bean id="ValidateCredentials"
class="net.shibboleth.idp.authn.impl.ValidateCredentials" scope="prototype"
+ p:requireAll="#{getObject('shibboleth.authn.Password.RequireAll') ?: false}"
p:validators="#{getObject('shibboleth.authn.Password.Validators') ?: getObject('ValidateUsernamePassword')}"
p:addDefaultPrincipals="#{getObject('shibboleth.authn.Password.addDefaultPrincipals') ?:
(getObject('shibboleth.authn.Password.PrincipalOverride') == null
@@ -66,7 +69,13 @@
p:savePasswordToCredentialSet="#{getObject('shibboleth.authn.Password.RetainAsPrivateCredential') ?: false}"
p:removeContextAfterValidation="#{getObject('shibboleth.authn.Password.RemoveAfterValidation') ?: true}"
p:matchExpression="#{getObject('shibboleth.authn.Password.matchExpression')}" />
-
+
+ <!-- Alias the legacy names into "officially" supported parent bean names. -->
+
+ <alias alias="shibboleth.JAASValidator" name="ValidateUsernamePasswordAgainstJAAS" />
+ <alias alias="shibboleth.KerberosValidator" name="ValidateUsernamePasswordAgainstKerberos" />
+ <alias alias="shibboleth.LDAPValidator" name="ValidateUsernamePasswordAgainstLDAP" />
+
<!-- Legacy validators defined under V3 action bean names. -->
<bean id="ValidateUsernamePasswordAgainstJAAS" parent="shibboleth.CredentialValidator" lazy-init="true"
@@ -91,16 +100,17 @@
p:servicePrincipal="#{getObject('shibboleth.authn.Krb5.ServicePrincipal')}"
p:keytabPath="#{getObject('shibboleth.authn.Krb5.Keytab')}" />
- <!-- Parent beans for custom ldaptive CredentialConfig types. -->
- <bean id="shibboleth.X509ResourceCredentialConfig"
- class="net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig" abstract="true" />
- <bean id="shibboleth.KeystoreResourceCredentialConfig"
- class="net.shibboleth.idp.authn.impl.KeystoreResourceCredentialConfig" abstract="true" />
-
<bean id="ValidateUsernamePasswordAgainstLDAP" parent="shibboleth.CredentialValidator" lazy-init="true"
class="net.shibboleth.idp.authn.impl.LDAPCredentialValidator"
p:id="ldap"
p:authenticator-ref="shibboleth.authn.LDAP.authenticator"
p:returnAttributes-ref="shibboleth.authn.LDAP.returnAttributes" />
+ <!-- Parent beans for custom ldaptive CredentialConfig types. -->
+
+ <bean id="shibboleth.X509ResourceCredentialConfig"
+ class="net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig" abstract="true" />
+ <bean id="shibboleth.KeystoreResourceCredentialConfig"
+ class="net.shibboleth.idp.authn.impl.KeystoreResourceCredentialConfig" abstract="true" />
+
</beans>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list