[java-identity-provider] branch master updated: Move proxy/SAML flow up to top-level authn flow.
Scott Cantor
cantor.2 at osu.edu
Mon Dec 2 15:48:58 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f1477ff2ea5f720b5b32dd93d66315c1507adc1d
The following commit(s) were added to refs/heads/master by this push:
new f1477ff Move proxy/SAML flow up to top-level authn flow.
f1477ff is described below
commit f1477ff2ea5f720b5b32dd93d66315c1507adc1d
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Dec 2 15:48:55 2019 -0500
Move proxy/SAML flow up to top-level authn flow.
---
.../saml-proxy-config.xml => saml-authn-config.xml} | 0
.../main/resources/system/conf/webflow-config.xml | 4 +---
.../system/flows/authn/proxy-authn-beans.xml | 4 ----
.../system/flows/authn/proxy-authn-flow.xml | 20 ++------------------
.../saml-proxy-beans.xml => saml-authn-beans.xml} | 8 ++++++--
.../saml-proxy-flow.xml => saml-authn-flow.xml} | 14 ++++++++++++--
6 files changed, 21 insertions(+), 29 deletions(-)
diff --git a/idp-conf/src/main/resources/conf/authn/proxy/saml-proxy-config.xml b/idp-conf/src/main/resources/conf/authn/saml-authn-config.xml
similarity index 100%
rename from idp-conf/src/main/resources/conf/authn/proxy/saml-proxy-config.xml
rename to idp-conf/src/main/resources/conf/authn/saml-authn-config.xml
diff --git a/idp-conf/src/main/resources/system/conf/webflow-config.xml b/idp-conf/src/main/resources/system/conf/webflow-config.xml
index 09a6282..5f65c3c 100644
--- a/idp-conf/src/main/resources/system/conf/webflow-config.xml
+++ b/idp-conf/src/main/resources/system/conf/webflow-config.xml
@@ -87,9 +87,7 @@
<entry key="authn/MFA" value="../system/flows/authn/mfa-authn-flow.xml" />
<entry key="authn/Function" value="../system/flows/authn/function-authn-flow.xml" />
<entry key="authn/Proxy" value="../system/flows/authn/proxy-authn-flow.xml" />
-
- <!-- Proxied login methods. -->
- <entry key="proxy/SAML" value="../system/flows/authn/proxy/saml-proxy-flow.xml" />
+ <entry key="authn/SAML" value="../system/flows/authn/saml-authn-flow.xml" />
<!-- Master flow for subject c14n. -->
<entry key="c14n.events" value="../conf/c14n/subject-c14n-events-flow.xml" />
diff --git a/idp-conf/src/main/resources/system/flows/authn/proxy-authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/proxy-authn-beans.xml
index 57d35e2..32396bb 100644
--- a/idp-conf/src/main/resources/system/flows/authn/proxy-authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/proxy-authn-beans.xml
@@ -36,8 +36,4 @@
class="net.shibboleth.idp.authn.proxy.impl.ExtractDiscoveryResponse" scope="prototype"
p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
- <bean id="PopulateSubjectCanonicalizationContext"
- class="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext" scope="prototype"
- p:availableFlows-ref="shibboleth.PostLoginSubjectCanonicalizationFlows" />
-
</beans>
diff --git a/idp-conf/src/main/resources/system/flows/authn/proxy-authn-flow.xml b/idp-conf/src/main/resources/system/flows/authn/proxy-authn-flow.xml
index 7a82969..94de98c 100644
--- a/idp-conf/src/main/resources/system/flows/authn/proxy-authn-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/proxy-authn-flow.xml
@@ -33,26 +33,10 @@
<if test="protocolIterator.hasNext()" then="CallProxyFlow" else="ReselectFlow" />
</decision-state>
- <subflow-state id="CallProxyFlow" subflow="proxy/#{protocolIterator.next()}">
- <input name="calledAsSubflow" value="true" />
- <transition on="proceed" to="ContinueSuccessfulAuthentication" />
- <transition on="ReselectFlow" to="SelectProxyFlow" />
- </subflow-state>
-
- <action-state id="ContinueSuccessfulAuthentication">
- <evaluate expression="PopulateSubjectCanonicalizationContext" />
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="CallSubjectCanonicalization" />
- </action-state>
-
- <!-- This runs a c14n step on the result of the authentication. -->
- <subflow-state id="CallSubjectCanonicalization" subflow="c14n">
+ <subflow-state id="CallProxyFlow" subflow="authn/#{protocolIterator.next()}">
<input name="calledAsSubflow" value="true" />
<transition on="proceed" to="proceed" />
-
- <!-- This shouldn't generally happen, but if c14n fails, it's allowable to fall through. -->
- <transition on="SubjectCanonicalizationError" to="ReselectFlow" />
+ <transition on="ReselectFlow" to="SelectProxyFlow" />
</subflow-state>
<bean-import resource="proxy-authn-beans.xml" />
diff --git a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml b/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml
similarity index 97%
rename from idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
rename to idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml
index d508137..e4835e6 100644
--- a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml
@@ -24,7 +24,7 @@
<bean id="shibboleth.authn.SAML.externalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
c:target-ref="shibboleth.authn.SAML.externalAuthnPath" />
- <import resource="../../../../conf/authn/proxy/saml-proxy-config.xml" />
+ <import resource="../../../conf/authn/saml-authn-config.xml" />
<!-- Parent beans for indirecting into nested PRC. -->
@@ -53,7 +53,7 @@
p:fieldExtractors="#{getObject('shibboleth.FlowStartAuditExtractors') ?: getObject('shibboleth.DefaultFlowStartAuditExtractors')}" />
<!-- Declares audit field extractor functions injected into beans that populate the audit context. -->
- <import resource="../../../conf/audit-system.xml" />
+ <import resource="../../conf/audit-system.xml" />
<bean id="PrepareInboundMessageContext"
class="net.shibboleth.idp.saml.session.impl.PrepareInboundMessageContext" scope="prototype"
@@ -282,4 +282,8 @@
p:resultCachingPredicate="#{getObject('shibboleth.authn.SAML.resultCachingPredicate')}"
p:attributeExtractionStrategy="#{getObject('shibboleth.authn.SAML.attributeExtractionStrategy')}" />
+ <bean id="PopulateSubjectCanonicalizationContext"
+ class="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext" scope="prototype"
+ p:availableFlows-ref="shibboleth.PostLoginSubjectCanonicalizationFlows" />
+
</beans>
diff --git a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-flow.xml b/idp-conf/src/main/resources/system/flows/authn/saml-authn-flow.xml
similarity index 87%
rename from idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-flow.xml
rename to idp-conf/src/main/resources/system/flows/authn/saml-authn-flow.xml
index 7aebad9..239594a 100644
--- a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/saml-authn-flow.xml
@@ -56,19 +56,29 @@
<evaluate expression="ValidateSAMLAuthentication" />
<evaluate expression="PostAssertionPopulateAuditContext" />
<evaluate expression="PostResponsePopulateAuditContext" />
+ <evaluate expression="PopulateSubjectCanonicalizationContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="proceed" />
+ <transition on="proceed" to="CallSubjectCanonicalization" />
<on-exit>
<evaluate expression="WriteAuditLog" />
</on-exit>
</action-state>
+ <!-- This runs a c14n step on the result of the authentication. -->
+ <subflow-state id="CallSubjectCanonicalization" subflow="c14n">
+ <input name="calledAsSubflow" value="true" />
+ <transition on="proceed" to="proceed" />
+
+ <!-- This shouldn't generally happen, but if c14n fails, it's allowable to fall through. -->
+ <transition on="SubjectCanonicalizationError" to="ReselectFlow" />
+ </subflow-state>
+
<global-transitions>
<!-- Route everything out as a graceful failure to allow subsequent options to run. -->
<transition on="#{!'proceed'.equals(currentEvent.id)}" to="ReselectFlow" />
</global-transitions>
- <bean-import resource="saml-proxy-beans.xml" />
+ <bean-import resource="saml-authn-beans.xml" />
</flow>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list