[java-identity-provider] branch master updated: IDP-1238 - Support for changing ResponderId and signing credentials
Scott Cantor
cantor.2 at osu.edu
Mon Dec 16 11:33:39 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=fe24ae391eda565e1496865fe3b44e8554b3a3bd
The following commit(s) were added to refs/heads/master by this push:
new fe24ae3 IDP-1238 - Support for changing ResponderId and signing credentials
fe24ae3 is described below
commit fe24ae391eda565e1496865fe3b44e8554b3a3bd
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Dec 16 10:33:36 2019 -0600
IDP-1238 - Support for changing ResponderId and signing credentials
https://issues.shibboleth.net/jira/browse/IDP-1238
Add action to SSO flows to check for changed ID.
---
.../system/flows/saml/saml-abstract-beans.xml | 3 +
.../system/flows/saml/saml1/sso-abstract-flow.xml | 1 +
.../system/flows/saml/saml2/sso-abstract-flow.xml | 1 +
.../impl/InitializeOutboundMessageContext.java | 6 +-
.../profile/impl/UpdateSAMLSelfEntityContext.java | 109 +++++++++++++++++++++
5 files changed, 119 insertions(+), 1 deletion(-)
diff --git a/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml b/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
index 861baa8..b6658e8 100644
--- a/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
@@ -237,6 +237,9 @@
<bean class="net.shibboleth.idp.authn.config.navigate.PostAuthenticationFlowsLookupFunction" />
</property>
</bean>
+
+ <bean id="UpdateSAMLSelfEntityContext"
+ class="net.shibboleth.idp.saml.profile.impl.UpdateSAMLSelfEntityContext" scope="prototype" />
<bean id="AddInResponseToToResponse"
class="org.opensaml.saml.common.profile.impl.AddInResponseToToResponse" scope="prototype">
diff --git a/idp-conf/src/main/resources/system/flows/saml/saml1/sso-abstract-flow.xml b/idp-conf/src/main/resources/system/flows/saml/saml1/sso-abstract-flow.xml
index 1719a5e..edc9096 100644
--- a/idp-conf/src/main/resources/system/flows/saml/saml1/sso-abstract-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/saml/saml1/sso-abstract-flow.xml
@@ -79,6 +79,7 @@
</action-state>
<action-state id="BuildResponse">
+ <evaluate expression="UpdateSAMLSelfEntityContext" />
<evaluate expression="AddResponseShell" />
<evaluate expression="AddInResponseToToResponse" />
diff --git a/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-flow.xml b/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-flow.xml
index f556566..6037d77 100644
--- a/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-flow.xml
@@ -87,6 +87,7 @@
</action-state>
<action-state id="BuildResponse">
+ <evaluate expression="UpdateSAMLSelfEntityContext" />
<evaluate expression="AddResponseShell" />
<evaluate expression="AddInResponseToToResponse" />
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContext.java
index fbe95dc..160eb3b 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContext.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContext.java
@@ -102,6 +102,10 @@ public class InitializeOutboundMessageContext extends AbstractProfileAction {
/** {@inheritDoc} */
@Override protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ if (!super.doPreExecute(profileRequestContext)) {
+ return false;
+ }
+
final RelyingPartyContext relyingPartyCtx = relyingPartyContextLookupStrategy.apply(profileRequestContext);
if (relyingPartyCtx == null) {
log.debug("{} No relying party context", getLogPrefix());
@@ -118,7 +122,7 @@ public class InitializeOutboundMessageContext extends AbstractProfileAction {
peerEntityCtx = (SAMLPeerEntityContext) identifyingCtx;
- return super.doPreExecute(profileRequestContext);
+ return true;
}
/** {@inheritDoc} */
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/UpdateSAMLSelfEntityContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/UpdateSAMLSelfEntityContext.java
new file mode 100644
index 0000000..57828bb
--- /dev/null
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/UpdateSAMLSelfEntityContext.java
@@ -0,0 +1,109 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.profile.impl;
+
+import java.util.Objects;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.messaging.context.SAMLSelfEntityContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Action that updates inbound and/or outbound instances of {@link SAMLSelfEntityContext}
+ * based on the identity of a relying party accessed via a lookup strategy,
+ * by default an immediate child of the profile request context.
+ *
+ * <p>This action handles mid-request updates to the IdP's own entityID in advanced
+ * scenarios such as interceptors that cause the value to change, and updates one
+ * of the persistent records of the value.</p>
+ *
+ * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
+ */
+public class UpdateSAMLSelfEntityContext extends AbstractProfileAction {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(UpdateSAMLSelfEntityContext.class);
+
+ /** Strategy used to obtain the self identity value. */
+ @Nullable private Function<ProfileRequestContext,String> selfIdentityLookupStrategy;
+
+ /** Result of strategy function. */
+ @Nullable private String selfIdentity;
+
+ /** Constructor. */
+ public UpdateSAMLSelfEntityContext() {
+ selfIdentityLookupStrategy = new ResponderIdLookupFunction();
+ }
+
+ /**
+ * Set the strategy used to locate the self identity value to use.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setSelfIdentityLookupStrategy(@Nonnull final Function<ProfileRequestContext, String> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ selfIdentityLookupStrategy = Constraint.isNotNull(strategy, "Self identity lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+ if (!super.doPreExecute(profileRequestContext)) {
+ return false;
+ }
+
+ selfIdentity = selfIdentityLookupStrategy.apply(profileRequestContext);
+ return true;
+ }
+
+ /** {@inheritDoc} */
+ @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+ if (profileRequestContext.getInboundMessageContext() != null) {
+ final SAMLSelfEntityContext context =
+ profileRequestContext.getInboundMessageContext().getSubcontext(SAMLSelfEntityContext.class);
+ if (context != null && !Objects.equals(context.getEntityId(), selfIdentity)) {
+ log.debug("{} Updating inbound SAMLSelfEntityContext, '{}' to '{}'", getLogPrefix(),
+ context.getEntityId(), selfIdentity);
+ context.setEntityId(selfIdentity);
+ }
+ }
+
+ if (profileRequestContext.getOutboundMessageContext() != null) {
+ final SAMLSelfEntityContext context =
+ profileRequestContext.getOutboundMessageContext().getSubcontext(SAMLSelfEntityContext.class);
+ if (context != null && !Objects.equals(context.getEntityId(), selfIdentity)) {
+ log.debug("{} Updating outbound SAMLSelfEntityContext, '{}' to '{}'", getLogPrefix(),
+ context.getEntityId(), selfIdentity);
+ context.setEntityId(selfIdentity);
+ }
+ }
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list