[java-identity-provider] branch master updated: IDP-1484 - Rationalize relying party ID usage with CAS + metadata

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=2471bc926a3412bde730dd92d3c3ad9ae73d4cae

The following commit(s) were added to refs/heads/master by this push:
       new  2471bc9   IDP-1484 - Rationalize relying party ID usage with CAS + metadata
2471bc9 is described below

commit 2471bc926a3412bde730dd92d3c3ad9ae73d4cae
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Nov 4 15:26:53 2019 -0500

    IDP-1484 - Rationalize relying party ID usage with CAS + metadata
    
    https://issues.shibboleth.net/jira/browse/IDP-1484
    
    Defaults to current behavior.
---
 .../flow/impl/BuildSAMLMetadataContextAction.java  | 22 ++++++++++++++++++++++
 idp-conf/src/main/resources/conf/idp.properties    |  3 +++
 .../system/flows/cas/cas-abstract-beans.xml        |  3 ++-
 3 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSAMLMetadataContextAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSAMLMetadataContextAction.java
index aa9b380..8064169 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSAMLMetadataContextAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSAMLMetadataContextAction.java
@@ -25,6 +25,7 @@ import net.shibboleth.idp.cas.service.Service;
 import net.shibboleth.idp.cas.service.impl.ServiceEntityDescriptor;
 import net.shibboleth.idp.profile.IdPEventIds;
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
 
 import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.action.EventException;
@@ -48,12 +49,29 @@ import org.opensaml.saml.saml2.metadata.EntityDescriptor;
 public class BuildSAMLMetadataContextAction<RequestType,ResponseType>
         extends AbstractCASProtocolAction<RequestType,ResponseType> {
 
+    /** Whether to overwrite the relying party ID based on metadata. */
+    private boolean relyingPartyIdFromMetadata;
+    
     /** CAS service. */
     @Nullable private Service service;
     
     /** RelyingPartyContext. */
     @Nullable private RelyingPartyContext rpCtx;
     
+    /**
+     * Sets whether the {@link RelyingPartyContext#getRelyingPartyId()} method should return an entityID
+     * established from SAML metadata instead of the service URL.
+     * 
+     * <p>Defaults to false for compatibility.<.p>
+     * 
+     * @param flag flag to set
+     */
+    public void setRelyingPartyIdFromMetadata(final boolean flag) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        relyingPartyIdFromMetadata = flag;
+    }
+    
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         if (!super.doPreExecute(profileRequestContext)) {
@@ -86,6 +104,10 @@ public class BuildSAMLMetadataContextAction<RequestType,ResponseType>
         mdCtx.setEntityDescriptor(entity);
         mdCtx.setRoleDescriptor(service.getRoleDescriptor());
         
+        if (relyingPartyIdFromMetadata) {
+            rpCtx.setRelyingPartyId(entity.getEntityID());
+        }
+        
         rpCtx.setRelyingPartyIdContextTree(mdCtx);
     }
 
diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index 07c3c66..479fbd8 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -207,6 +207,9 @@ idp.ui.fallbackLanguages=en,fr,de
 # CAS service registry implementation class
 #idp.cas.serviceRegistryClass=net.shibboleth.idp.cas.service.PatternServiceRegistry
 
+# If true, CAS services provisioned with SAML metadata are identified via entityID
+#idp.cas.relyingPartyIdFromMetadata=false
+
 # F-TICKS auditing - set a salt to include hashed username
 #idp.fticks.federation=MyFederation
 #idp.fticks.algorithm=SHA-256
diff --git a/idp-conf/src/main/resources/system/flows/cas/cas-abstract-beans.xml b/idp-conf/src/main/resources/system/flows/cas/cas-abstract-beans.xml
index ec50f98..3964d28 100644
--- a/idp-conf/src/main/resources/system/flows/cas/cas-abstract-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/cas/cas-abstract-beans.xml
@@ -33,7 +33,8 @@
           c:registries="#{getObject('shibboleth.CASServiceRegistries') ?: getObject('shibboleth.DefaultCASServiceRegistries')}" />
 
     <bean id="BuildSAMLMetadataContext" scope="prototype"
-          class="net.shibboleth.idp.cas.flow.impl.BuildSAMLMetadataContextAction" />
+          class="net.shibboleth.idp.cas.flow.impl.BuildSAMLMetadataContextAction"
+          p:relyingPartyIdFromMetadata="%{idp.cas.relyingPartyIdFromMetadata:false}" />
 
     <bean id="PopulateInboundInterceptContext"
           class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.