[java-identity-provider] branch master updated: IDP-1238 - Changing signing credentials mid-flow
Scott Cantor
cantor.2 at osu.edu
Fri Dec 13 12:21:07 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=7ab274bba398babb15e4a58bd0c753fb6adb2b8d
The following commit(s) were added to refs/heads/master by this push:
new 7ab274b IDP-1238 - Changing signing credentials mid-flow
7ab274b is described below
commit 7ab274bba398babb15e4a58bd0c753fb6adb2b8d
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Dec 13 08:54:34 2019 -0600
IDP-1238 - Changing signing credentials mid-flow
https://issues.shibboleth.net/jira/browse/IDP-1238
Add UpdateSecurityParameters event and handling.
---
.../src/main/resources/system/flows/cas/login/login-flow.xml | 1 +
.../system/flows/intercept/intercept-abstract-flow.xml | 2 ++
.../main/resources/system/flows/intercept/intercept-flow.xml | 10 ++++++++--
.../resources/system/flows/logout/propagation/saml2-beans.xml | 10 ++++++++++
.../main/resources/system/flows/saml/saml-abstract-beans.xml | 10 ----------
.../resources/system/flows/saml/saml1/sso-abstract-flow.xml | 9 +++++++++
.../resources/system/flows/saml/saml2/sso-abstract-flow.xml | 11 +++++++++++
.../src/main/java/net/shibboleth/idp/profile/IdPEventIds.java | 3 +++
8 files changed, 44 insertions(+), 12 deletions(-)
diff --git a/idp-conf/src/main/resources/system/flows/cas/login/login-flow.xml b/idp-conf/src/main/resources/system/flows/cas/login/login-flow.xml
index fae5464..f213786 100644
--- a/idp-conf/src/main/resources/system/flows/cas/login/login-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/cas/login/login-flow.xml
@@ -118,6 +118,7 @@
<subflow-state id="DoPostAuthnInterceptSubflow" subflow="intercept">
<input name="calledAsSubflow" value="true" />
<transition on="proceed" to="GrantServiceTicket" />
+ <transition on="UpdateSecurityParameters" to="GrantServiceTicket" />
<transition on="RestartAuthentication" to="AuthenticationSetup" />
</subflow-state>
diff --git a/idp-conf/src/main/resources/system/flows/intercept/intercept-abstract-flow.xml b/idp-conf/src/main/resources/system/flows/intercept/intercept-abstract-flow.xml
index b683de7..c417975 100644
--- a/idp-conf/src/main/resources/system/flows/intercept/intercept-abstract-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/intercept/intercept-abstract-flow.xml
@@ -25,6 +25,7 @@
<end-state id="RuntimeException" />
<end-state id="NoPassive" />
<end-state id="InvalidCSRFToken" />
+ <end-state id="UpdateSecurityParameters" />
<action-state id="LogRuntimeException">
<evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.profile.interceptor').error('Uncaught runtime exception', flowExecutionException.getCause() ?: flowExecutionException)" />
@@ -46,6 +47,7 @@
<transition on="RestartAuthentication" to="RestartAuthentication" />
<transition on="RuntimeException" to="RuntimeException" />
<transition on="NoPassive" to="NoPassive" />
+ <transition on="UpdateSecurityParameters" to="UpdateSecurityParameters" />
</global-transitions>
</flow>
diff --git a/idp-conf/src/main/resources/system/flows/intercept/intercept-flow.xml b/idp-conf/src/main/resources/system/flows/intercept/intercept-flow.xml
index ab1b808..ae58467 100644
--- a/idp-conf/src/main/resources/system/flows/intercept/intercept-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/intercept/intercept-flow.xml
@@ -7,13 +7,19 @@
before returning control to the calling (profile) flow.
-->
+ <action-state id="FilterFlowsByNonBrowserSupport">
+ <evaluate expression="FilterFlowsByNonBrowserSupport" />
+ <evaluate expression="'proceed'" />
+
+ <transition on="proceed" to="SelectInterceptFlow" />
+ </action-state>
+
<!--
The select action is the "dispatching" step. Anything starting with "intercept/"
is a flow descriptor that we send control to. If there are no flows available or
remaining to be executed, control passes back to the calling (profile) flow.
-->
<action-state id="SelectInterceptFlow">
- <evaluate expression="FilterFlowsByNonBrowserSupport" />
<evaluate expression="SelectInterceptFlow" />
<evaluate expression="'proceed'" />
@@ -24,7 +30,7 @@
</action-state>
<!--
- This invokes a flow. Anything but proceed is an error, otherwise control passes
+ This invokes a flow. Anything but proceed is a terminating state, otherwise control passes
back to this flow to select another flow to be executed.
-->
<subflow-state id="CallInterceptFlow" subflow="#{currentEvent.id}">
diff --git a/idp-conf/src/main/resources/system/flows/logout/propagation/saml2-beans.xml b/idp-conf/src/main/resources/system/flows/logout/propagation/saml2-beans.xml
index 11f5684..a832e90 100644
--- a/idp-conf/src/main/resources/system/flows/logout/propagation/saml2-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/logout/propagation/saml2-beans.xml
@@ -103,6 +103,16 @@
</property>
</bean>
+ <bean id="PopulateRequestSignatureSigningParameters"
+ class="org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters" scope="prototype"
+ p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
+ p:signatureSigningParametersResolver-ref="shibboleth.SignatureSigningParametersResolver"
+ p:noResultIsError="true">
+ <property name="activationCondition">
+ <bean class="net.shibboleth.idp.saml.profile.config.logic.SignRequestsPredicate" />
+ </property>
+ </bean>
+
<bean id="SOAPLogoutRequest"
class="net.shibboleth.idp.saml.saml2.profile.impl.SOAPLogoutRequest" scope="prototype"
p:SOAPClient-ref="shibboleth.SOAPClient.SAML"
diff --git a/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml b/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
index 5fbbdbf..861baa8 100644
--- a/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
@@ -145,16 +145,6 @@
</property>
</bean>
- <bean id="PopulateRequestSignatureSigningParameters"
- class="org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters" scope="prototype"
- p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
- p:signatureSigningParametersResolver-ref="shibboleth.SignatureSigningParametersResolver"
- p:noResultIsError="true">
- <property name="activationCondition">
- <bean class="net.shibboleth.idp.saml.profile.config.logic.SignRequestsPredicate" />
- </property>
- </bean>
-
<bean id="PopulateAssertionSignatureSigningParameters"
class="org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters" scope="prototype"
p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
diff --git a/idp-conf/src/main/resources/system/flows/saml/saml1/sso-abstract-flow.xml b/idp-conf/src/main/resources/system/flows/saml/saml1/sso-abstract-flow.xml
index 75d4617..1719a5e 100644
--- a/idp-conf/src/main/resources/system/flows/saml/saml1/sso-abstract-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/saml/saml1/sso-abstract-flow.xml
@@ -67,8 +67,17 @@
<input name="calledAsSubflow" value="true" />
<transition on="proceed" to="BuildResponse" />
<transition on="RestartAuthentication" to="AuthenticationSetup" />
+ <transition on="UpdateSecurityParameters" to="UpdateSecurityParameters" />
</subflow-state>
+ <action-state id="UpdateSecurityParameters">
+ <evaluate expression="PopulateResponseSignatureSigningParameters" />
+ <evaluate expression="PopulateAssertionSignatureSigningParameters" />
+ <evaluate expression="'proceed'" />
+
+ <transition on="proceed" to="BuildResponse" />
+ </action-state>
+
<action-state id="BuildResponse">
<evaluate expression="AddResponseShell" />
<evaluate expression="AddInResponseToToResponse" />
diff --git a/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-flow.xml b/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-flow.xml
index a0becfe..f556566 100644
--- a/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-flow.xml
@@ -73,8 +73,19 @@
<input name="calledAsSubflow" value="true" />
<transition on="proceed" to="BuildResponse" />
<transition on="RestartAuthentication" to="AuthenticationSetup" />
+ <transition on="UpdateSecurityParameters" to="UpdateSecurityParameters" />
</subflow-state>
+ <action-state id="UpdateSecurityParameters">
+ <evaluate expression="PopulateResponseSignatureSigningParameters" />
+ <evaluate expression="PopulateAssertionSignatureSigningParameters" />
+ <evaluate expression="PopulateEncryptionParameters" />
+ <evaluate expression="PopulateDecryptionParameters" />
+ <evaluate expression="'proceed'" />
+
+ <transition on="proceed" to="BuildResponse" />
+ </action-state>
+
<action-state id="BuildResponse">
<evaluate expression="AddResponseShell" />
<evaluate expression="AddInResponseToToResponse" />
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPEventIds.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPEventIds.java
index 02f44ed..c6826bc 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPEventIds.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPEventIds.java
@@ -68,6 +68,9 @@ public final class IdPEventIds {
/** ID of the event returned if some attributes cannot be encoded. */
@Nonnull @NotEmpty public static final String UNABLE_ENCODE_ATTRIBUTE = "UnableToEncodeAttribute";
+ /** ID of the event returned by a flow to signal the need to re-derive parameters. */
+ @Nonnull @NotEmpty public static final String UPDATE_SECURITY_PARAMETERS = "UpdateSecurityParameters";
+
/** Constructor. */
private IdPEventIds() {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list