[java-identity-provider] branch master updated: IDP-1494 - Login flow for proxied authentication
Scott Cantor
cantor.2 at osu.edu
Tue Nov 5 16:53:47 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=372a65d42afb168482298cfa2b5bed8c6ebfe444
The following commit(s) were added to refs/heads/master by this push:
new 372a65d IDP-1494 - Login flow for proxied authentication
372a65d is described below
commit 372a65d42afb168482298cfa2b5bed8c6ebfe444
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Nov 5 16:53:44 2019 -0500
IDP-1494 - Login flow for proxied authentication
https://issues.shibboleth.net/jira/browse/IDP-1494
Wire in some security parameter lookup.
Wire in decryption support.
---
.../system/flows/authn/proxy/saml-proxy-beans.xml | 42 ++++++++++++++++++++++
.../system/flows/authn/proxy/saml-proxy-flow.xml | 11 +++++-
.../profile/impl/ContinueSAMLAuthentication.java | 18 +++++-----
.../profile/impl/ValidateSAMLAuthentication.java | 10 +++++-
4 files changed, 70 insertions(+), 11 deletions(-)
diff --git a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
index 24cb621..ea3db5b 100644
--- a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
@@ -218,6 +218,48 @@
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext" />
+ <bean id="PopulateSignatureValidationParameters" parent="NestedWebFlowProfileActionAdaptor" scope="prototype">
+ <constructor-arg>
+ <bean class="org.opensaml.profile.action.impl.PopulateSignatureValidationParameters"
+ p:configurationLookupStrategy-ref="shibboleth.SignatureValidationConfigurationLookup"
+ p:signatureValidationParametersResolver-ref="shibboleth.SignatureValidationParametersResolver" />
+ </constructor-arg>
+ </bean>
+
+ <bean id="PopulateClientTLSValidationParameters" parent="NestedWebFlowProfileActionAdaptor" scope="prototype">
+ <constructor-arg>
+ <bean class="org.opensaml.profile.action.impl.PopulateClientTLSValidationParameters"
+ p:configurationLookupStrategy-ref="shibboleth.ClientTLSValidationConfigurationLookup"
+ p:clientTLSValidationParametersResolver-ref="shibboleth.ClientTLSValidationParametersResolver" />
+ </constructor-arg>
+ </bean>
+
+ <bean id="PopulateDecryptionParameters" parent="NestedWebFlowProfileActionAdaptor" scope="prototype">
+ <constructor-arg>
+ <bean class="org.opensaml.profile.action.impl.PopulateDecryptionParameters"
+ p:configurationLookupStrategy-ref="shibboleth.DecryptionConfigurationLookup"
+ p:decryptionParametersResolver-ref="shibboleth.DecryptionParametersResolver" />
+ </constructor-arg>
+ </bean>
+
+ <bean id="DecryptAssertions" parent="NestedWebFlowProfileActionAdaptor" scope="prototype">
+ <constructor-arg>
+ <bean class="org.opensaml.saml.saml2.profile.impl.DecryptAssertions" />
+ </constructor-arg>
+ </bean>
+
+ <bean id="DecryptNameIDs" parent="NestedWebFlowProfileActionAdaptor" scope="prototype">
+ <constructor-arg>
+ <bean class="org.opensaml.saml.saml2.profile.impl.DecryptNameIDs" />
+ </constructor-arg>
+ </bean>
+
+ <bean id="DecryptAttributes" parent="NestedWebFlowProfileActionAdaptor" scope="prototype">
+ <constructor-arg>
+ <bean class="org.opensaml.saml.saml2.profile.impl.DecryptAttributes" />
+ </constructor-arg>
+ </bean>
+
<bean id="PostAssertionPopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:fieldExtractors="#{getObject('shibboleth.PostInboundAssertionAuditExtractors') ?: getObject('shibboleth.DefaultPostInboundAssertionAuditExtractors')}" />
diff --git a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-flow.xml b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-flow.xml
index de1b32e..5f88eb0 100644
--- a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-flow.xml
@@ -46,13 +46,22 @@
<action-state id="ProcessResponse">
<evaluate expression="ContinueSAMLAuthentication" />
+ <evaluate expression="PopulateSignatureValidationParameters" />
+ <evaluate expression="PopulateClientTLSValidationParameters" />
+ <evaluate expression="PopulateDecryptionParameters" />
+ <evaluate expression="DecryptAssertions" />
+ <evaluate expression="DecryptNameIDs" />
+ <evaluate expression="DecryptAttributes" />
<evaluate expression="ValidateSAMLAuthentication" />
<evaluate expression="PostAssertionPopulateAuditContext" />
<evaluate expression="PostResponsePopulateAuditContext" />
- <evaluate expression="WriteAuditLog" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="proceed" />
+
+ <on-exit>
+ <evaluate expression="WriteAuditLog" />
+ </on-exit>
</action-state>
<global-transitions>
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ContinueSAMLAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ContinueSAMLAuthentication.java
index 08e21c7..d8ec4c0 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ContinueSAMLAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ContinueSAMLAuthentication.java
@@ -24,7 +24,6 @@ import net.shibboleth.idp.authn.AbstractAuthenticationAction;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.ExternalAuthenticationContext;
-import net.shibboleth.utilities.java.support.logic.Constraint;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
@@ -92,16 +91,17 @@ public class ContinueSAMLAuthentication extends AbstractAuthenticationAction {
ActionSupport.buildEvent(profileRequestContext, EventIds.MESSAGE_PROC_ERROR);
}
- // TODO: this is dummy code to be removed once we have legitimate processing in place.
final Response response = (Response) profileRequestContext.getInboundMessageContext().getMessage();
- if (StatusCode.SUCCESS.equals(response.getStatus().getStatusCode().getValue())) {
- Constraint.isTrue(response.getAssertions().size() == 1, "Wrong assertion count");
- Constraint.isTrue(response.getAssertions().get(0).getAuthnStatements().size() == 1, "Wrong statement count");
- authenticationContext.getSubcontext(SAMLAuthnContext.class)
- .setSubject(response.getAssertions().get(0).getSubject())
- .setAuthnStatement(response.getAssertions().get(0).getAuthnStatements().get(0));
- } else {
+ if (response.getStatus() == null || response.getStatus().getStatusCode() == null ||
+ response.getStatus().getStatusCode().getValue() == null) {
+ log.info("{} SAML response did not contain a StatusCode", getLogPrefix());
authenticationContext.removeSubcontext(SAMLAuthnContext.class);
+ ActionSupport.buildEvent(profileRequestContext, EventIds.MESSAGE_PROC_ERROR);
+ } else if (!StatusCode.SUCCESS.equals(response.getStatus().getStatusCode().getValue())) {
+ log.info("{} SAML response contained error status: {}", getLogPrefix(),
+ response.getStatus().getStatusCode().getValue());
+ authenticationContext.removeSubcontext(SAMLAuthnContext.class);
+ ActionSupport.buildEvent(profileRequestContext, EventIds.MESSAGE_PROC_ERROR);
}
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
index 3545ce0..dfa30c5 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
@@ -47,6 +47,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Live;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.service.ReloadableService;
import net.shibboleth.utilities.java.support.service.ServiceableComponent;
@@ -167,6 +168,13 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
return false;
}
+ // TODO: Dummy code until we have something processing the results properly.
+ final Response response = (Response) profileRequestContext.getInboundMessageContext().getMessage();
+ Constraint.isTrue(response.getAssertions().size() == 1, "Wrong assertion count");
+ Constraint.isTrue(response.getAssertions().get(0).getAuthnStatements().size() == 1, "Wrong statement count");
+ authenticationContext.getSubcontext(SAMLAuthnContext.class)
+ .setSubject(response.getAssertions().get(0).getSubject())
+ .setAuthnStatement(response.getAssertions().get(0).getAuthnStatements().get(0));
return true;
}
@@ -209,8 +217,8 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
proxied.getAuthorities().addAll(
authorities
.stream()
- .filter(aa -> !Strings.isNullOrEmpty(aa.getURI()))
.map(AuthenticatingAuthority::getURI)
+ .filter(aa -> !Strings.isNullOrEmpty(aa))
.collect(Collectors.toUnmodifiableList()));
}
subject.getPrincipals().add(proxied);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list