[java-identity-provider] branch master updated: Add configurable handling of proxied SAML AuthnInstant.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=c211963a6db46465e463bae143829cbeadaaa4c8

The following commit(s) were added to refs/heads/master by this push:
       new  c211963   Add configurable handling of proxied SAML AuthnInstant.
c211963 is described below

commit c211963a6db46465e463bae143829cbeadaaa4c8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Nov 7 13:11:32 2019 -0500

    Add configurable handling of proxied SAML AuthnInstant.
---
 .../conf/authn/proxy/saml-proxy-config.xml         | 19 +++++++++++++++++++
 .../system/flows/authn/proxy/saml-proxy-beans.xml  |  5 ++++-
 .../profile/impl/ValidateSAMLAuthentication.java   | 22 +++++++++++++++++++++-
 3 files changed, 44 insertions(+), 2 deletions(-)

diff --git a/idp-conf/src/main/resources/conf/authn/proxy/saml-proxy-config.xml b/idp-conf/src/main/resources/conf/authn/proxy/saml-proxy-config.xml
new file mode 100644
index 0000000..17775bf
--- /dev/null
+++ b/idp-conf/src/main/resources/conf/authn/proxy/saml-proxy-config.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+       xmlns:context="http://www.springframework.org/schema/context"
+       xmlns:util="http://www.springframework.org/schema/util"
+       xmlns:p="http://www.springframework.org/schema/p"
+       xmlns:c="http://www.springframework.org/schema/c"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+                           
+       default-init-method="initialize"
+       default-destroy-method="destroy">
+
+
+    <!-- Set FALSE to record current time instead of upstream value as time of authentication. -->
+    <util:constant id="shibboleth.authn.SAML.proxiedAuthnInstant" static-field="java.lang.Boolean.TRUE" />
+ 
+</beans>
diff --git a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
index 5a8c1d3..ae179c8 100644
--- a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
@@ -24,7 +24,7 @@
     <bean id="shibboleth.authn.SAML.externalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
         c:target-ref="shibboleth.authn.SAML.externalAuthnPath" />
 
-<!--     <import resource="../../../../conf/authn/proxy/saml-proxy-config.xml" /> -->
+    <import resource="../../../../conf/authn/proxy/saml-proxy-config.xml" />
     
     <!-- Parent beans for indirecting into nested PRC. -->
     
@@ -277,6 +277,9 @@
         p:transcoderRegistry-ref="shibboleth.AttributeRegistryService"
         p:attributeFilter-ref="shibboleth.AttributeFilterService"
         p:metadataResolver-ref="shibboleth.MetadataResolver"
+        p:proxiedAuthnInstant="#{getObject('shibboleth.authn.SAML.proxiedAuthnInstant') ?: true}"
+        p:addDefaultPrincipals="#{getObject('shibboleth.authn.SAML.addDefaultPrincipals') ?: true}"
+        p:resultCachingPredicate="#{getObject('shibboleth.authn.SAML.resultCachingPredicate')}"        
         p:attributeExtractionStrategy="#{getObject('shibboleth.authn.SAML.attributeExtractionStrategy')}" />
 
 </beans>
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
index 4cb2938..1f23eb4 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
@@ -104,6 +104,9 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
     /** Pluggable strategy function for generalized extraction of data. */
     @Nullable private Function<ProfileRequestContext,Collection<IdPAttribute>> attributeExtractionStrategy;
     
+    /** Whether the authentication result's timestamp should be set based on the proxied value. */
+    private boolean proxiedAuthnInstant;
+    
     /** Context containing the result to validate. */
     @Nullable private SAMLAuthnContext samlAuthnContext;
     
@@ -113,6 +116,7 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
     /** Constructor. */
     public ValidateSAMLAuthentication() {
         setMetricName(DEFAULT_METRIC_NAME);
+        proxiedAuthnInstant = true;
     }
 
     /**
@@ -160,6 +164,20 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
         
         attributeExtractionStrategy = strategy;
     }
+    
+    /**
+     * Sets whether the creation timestamp for the {@link AuthenticationResult} should be set to
+     * the proxied value from the SAML assertion.
+     * 
+     * <p>Defaults to "true"</p>
+     * 
+     * @param flag flag to set
+     */
+    public void setProxiedAuthnInstant(final boolean flag) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        proxiedAuthnInstant = flag;
+    }
 
     /** {@inheritDoc} */
     @Override
@@ -227,7 +245,9 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
         
         buildAuthenticationResult(profileRequestContext, authenticationContext);
         
-        if (authenticationContext.getAuthenticationResult() != null) {
+        if (proxiedAuthnInstant && authenticationContext.getAuthenticationResult() != null) {
+            log.debug("{} Resetting authentication time to proxied value: {}", getLogPrefix(),
+                    samlAuthnContext.getAuthnStatement().getAuthnInstant());
             if (samlAuthnContext.getAuthnStatement().getAuthnInstant() != null) {
                 authenticationContext.getAuthenticationResult().setAuthenticationInstant(
                         samlAuthnContext.getAuthnStatement().getAuthnInstant());

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.