[java-identity-provider] branch master updated: Migrate proxiedAuthnInstant out of static config into profile config.
Scott Cantor
cantor.2 at osu.edu
Thu Nov 7 18:03:32 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=dedbe6ee5c688f217f038e49b16179a264119678
The following commit(s) were added to refs/heads/master by this push:
new dedbe6e Migrate proxiedAuthnInstant out of static config into profile config.
dedbe6e is described below
commit dedbe6ee5c688f217f038e49b16179a264119678
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Nov 7 15:42:02 2019 -0500
Migrate proxiedAuthnInstant out of static config into profile config.
---
.../conf/authn/proxy/saml-proxy-config.xml | 3 -
.../system/conf/relying-party-mddriven.xml | 8 +++
.../system/flows/authn/proxy/saml-proxy-beans.xml | 1 -
.../config/BrowserSSOProfileConfiguration.java | 44 ++++++++++++++
.../profile/impl/ValidateSAMLAuthentication.java | 68 +++++++++++++++-------
5 files changed, 100 insertions(+), 24 deletions(-)
diff --git a/idp-conf/src/main/resources/conf/authn/proxy/saml-proxy-config.xml b/idp-conf/src/main/resources/conf/authn/proxy/saml-proxy-config.xml
index 17775bf..8503c68 100644
--- a/idp-conf/src/main/resources/conf/authn/proxy/saml-proxy-config.xml
+++ b/idp-conf/src/main/resources/conf/authn/proxy/saml-proxy-config.xml
@@ -13,7 +13,4 @@
default-destroy-method="destroy">
- <!-- Set FALSE to record current time instead of upstream value as time of authentication. -->
- <util:constant id="shibboleth.authn.SAML.proxiedAuthnInstant" static-field="java.lang.Boolean.TRUE" />
-
</beans>
diff --git a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
index e748f29..77ff931 100644
--- a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
+++ b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
@@ -400,6 +400,14 @@
<constructor-arg value="false" />
</bean>
</property>
+ <property name="proxiedAuthnInstantPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="proxiedAuthnInstant" />
+ </constructor-arg>
+ <constructor-arg value="true" />
+ </bean>
+ </property>
<property name="authnContextComparisonLookupStrategy">
<bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="authnContextComparison" />
</property>
diff --git a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
index ae179c8..fd9f761 100644
--- a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
@@ -277,7 +277,6 @@
p:transcoderRegistry-ref="shibboleth.AttributeRegistryService"
p:attributeFilter-ref="shibboleth.AttributeFilterService"
p:metadataResolver-ref="shibboleth.MetadataResolver"
- p:proxiedAuthnInstant="#{getObject('shibboleth.authn.SAML.proxiedAuthnInstant') ?: true}"
p:addDefaultPrincipals="#{getObject('shibboleth.authn.SAML.addDefaultPrincipals') ?: true}"
p:resultCachingPredicate="#{getObject('shibboleth.authn.SAML.resultCachingPredicate')}"
p:attributeExtractionStrategy="#{getObject('shibboleth.authn.SAML.attributeExtractionStrategy')}" />
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index a17181d..c444d88 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -74,6 +74,9 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
/** Whether the response endpoint should be validated if the request is signed. */
@Nonnull private Predicate<ProfileRequestContext> skipEndpointValidationWhenSignedPredicate;
+ /** Whether authentication results should carry the proxied AuthnInstant. */
+ @Nonnull private Predicate<ProfileRequestContext> proxiedAuthnInstantPredicate;
+
/** Lookup function to supply maximum session lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> maximumSPSessionLifetimeLookupStrategy;
@@ -123,6 +126,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
forceAuthnPredicate = Predicates.alwaysFalse();
checkAddressPredicate = Predicates.alwaysTrue();
skipEndpointValidationWhenSignedPredicate = Predicates.alwaysFalse();
+ proxiedAuthnInstantPredicate = Predicates.alwaysTrue();
maximumSPSessionLifetimeLookupStrategy = FunctionSupport.constant(null);
maximumTimeSinceAuthnLookupStrategy = FunctionSupport.constant(null);
maximumTokenDelegationChainLengthLookupStrategy = FunctionSupport.constant(DEFAULT_DELEGATION_CHAIN_LENGTH);
@@ -294,6 +298,46 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
@Nonnull final Predicate<ProfileRequestContext> condition) {
skipEndpointValidationWhenSignedPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+
+ /**
+ * Gets whether authentication results produced by use of this profile should carry the proxied
+ * assertion's AuthnInstant, rather than the current time.
+ *
+ * <p>Defaults to true.</p>
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether to proxy across the inbound AuthnInstant
+ *
+ * @since 4.0.0
+ */
+ public boolean isProxiedAuthnInstant(@Nullable final ProfileRequestContext profileRequestContext) {
+ return proxiedAuthnInstantPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Sets whether authentication results produced by use of this profile should carry the proxied
+ * assertion's AuthnInstant, rather than the current time.
+ *
+ * @param flag flag to set
+ *
+ * @since 4.0.0
+ */
+ public void setProxiedAuthnInstant(final boolean flag) {
+ proxiedAuthnInstantPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Sets condition to determine whether authentication results produced by use of this profile should
+ * carry the proxied assertion's AuthnInstant, rather than the current time.
+ *
+ * @param condition condition to set
+ *
+ * @since 4.0.0
+ */
+ public void setProxiedAuthnInstantPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ proxiedAuthnInstantPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
/**
* Get the maximum amount of time the service provider should maintain a session for the user
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
index 1f23eb4..0b054e7 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
@@ -42,9 +42,11 @@ import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.principal.IdPAttributePrincipal;
import net.shibboleth.idp.authn.principal.ProxyAuthenticationPrincipal;
+import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.saml.authn.principal.NameIDPrincipal;
import net.shibboleth.idp.saml.profile.context.navigate.SAMLMetadataContextLookupFunction;
+import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.Live;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -53,6 +55,7 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.service.ReloadableService;
import net.shibboleth.utilities.java.support.service.ServiceableComponent;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.messaging.context.navigate.RecursiveTypedParentContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
@@ -80,6 +83,8 @@ import com.google.common.collect.Multimap;
*
* @event {@link EventIds#PROCEED_EVENT_ID}
* @event {@link EventIds#INVALID_PROFILE_CTX}
+ * @event {@link IdPEventIds#INVALID_RELYING_PARTY_CTX}
+ * @event {@link IdPEventIds#INVALID_PROFILE_CONFIG}
* @pre <pre>ProfileRequestContext.getSubcontext(AuthenticationContext.class).getAttemptedFlow() != null</pre>
* @post If AuthenticationContext.getSubcontext(SAMLAuthnContext.class) != null, then
* an {@link net.shibboleth.idp.authn.AuthenticationResult} is saved to the {@link AuthenticationContext}.
@@ -100,23 +105,26 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
/** Optional supplemental metadata source for filtering. */
@Nullable private MetadataResolver metadataResolver;
-
+
+ /** Strategy used to look up a {@link RelyingPartyContext} for configuration options. */
+ @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
+
/** Pluggable strategy function for generalized extraction of data. */
@Nullable private Function<ProfileRequestContext,Collection<IdPAttribute>> attributeExtractionStrategy;
- /** Whether the authentication result's timestamp should be set based on the proxied value. */
- private boolean proxiedAuthnInstant;
-
/** Context containing the result to validate. */
@Nullable private SAMLAuthnContext samlAuthnContext;
+ /** Store off profile config. */
+ @Nullable private BrowserSSOProfileConfiguration profileConfiguration;
+
/** Context for externally supplied inbound attributes. */
@Nullable private AttributeContext attributeContext;
/** Constructor. */
public ValidateSAMLAuthentication() {
setMetricName(DEFAULT_METRIC_NAME);
- proxiedAuthnInstant = true;
+ relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
}
/**
@@ -153,30 +161,29 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
}
/**
- * Sets the strategy function to invoke for generalized extraction of data into
- * {@link IdPAttribute} objects for inclusion in the {@link AuthenticationResult}.
+ * Set the strategy used to return the {@link RelyingPartyContext} for configuration options.
*
- * @param strategy extraction strategy
+ * @param strategy lookup strategy
*/
- public void setAttributeExtractionStrategy(
- @Nullable final Function<ProfileRequestContext,Collection<IdPAttribute>> strategy) {
+ public void setRelyingPartyContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,RelyingPartyContext> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- attributeExtractionStrategy = strategy;
+
+ relyingPartyContextLookupStrategy =
+ Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
}
/**
- * Sets whether the creation timestamp for the {@link AuthenticationResult} should be set to
- * the proxied value from the SAML assertion.
- *
- * <p>Defaults to "true"</p>
+ * Sets the strategy function to invoke for generalized extraction of data into
+ * {@link IdPAttribute} objects for inclusion in the {@link AuthenticationResult}.
*
- * @param flag flag to set
+ * @param strategy extraction strategy
*/
- public void setProxiedAuthnInstant(final boolean flag) {
+ public void setAttributeExtractionStrategy(
+ @Nullable final Function<ProfileRequestContext,Collection<IdPAttribute>> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- proxiedAuthnInstant = flag;
+ attributeExtractionStrategy = strategy;
}
/** {@inheritDoc} */
@@ -202,6 +209,26 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
recordFailure();
return false;
}
+
+ final RelyingPartyContext rpContext = relyingPartyContextLookupStrategy.apply(profileRequestContext);
+ if (rpContext == null) {
+ log.error("{} Unable to locate RelyingPartyContext", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
+ recordFailure();
+ return false;
+ } else if (rpContext.getProfileConfig() == null) {
+ log.error("{} Unable to locate profile configuration", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
+ recordFailure();
+ return false;
+ } else if (!(rpContext.getProfileConfig() instanceof BrowserSSOProfileConfiguration)) {
+ log.error("{} Not a SAML 2 profile configuration", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
+ recordFailure();
+ return false;
+ }
+
+ profileConfiguration = (BrowserSSOProfileConfiguration) rpContext.getProfileConfig();
// TODO: Dummy code until we have something processing the results properly.
final Response response = (Response) profileRequestContext.getInboundMessageContext().getMessage();
@@ -245,7 +272,8 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
buildAuthenticationResult(profileRequestContext, authenticationContext);
- if (proxiedAuthnInstant && authenticationContext.getAuthenticationResult() != null) {
+ if (authenticationContext.getAuthenticationResult() != null
+ && profileConfiguration.isProxiedAuthnInstant(profileRequestContext)) {
log.debug("{} Resetting authentication time to proxied value: {}", getLogPrefix(),
samlAuthnContext.getAuthnStatement().getAuthnInstant());
if (samlAuthnContext.getAuthnStatement().getAuthnInstant() != null) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list