[java-identity-provider] branch master updated: IDP-1494 - Login flow for proxied SAML authentication
Scott Cantor
cantor.2 at osu.edu
Wed Nov 13 16:47:47 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=3ced1e90e4053f03aa8d18f0ff4d0a938406320a
The following commit(s) were added to refs/heads/master by this push:
new 3ced1e9 IDP-1494 - Login flow for proxied SAML authentication
3ced1e9 is described below
commit 3ced1e90e4053f03aa8d18f0ff4d0a938406320a
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Nov 13 16:47:43 2019 -0500
IDP-1494 - Login flow for proxied SAML authentication
https://issues.shibboleth.net/jira/browse/IDP-1494
Implement overrideable passthrough of ForceAuthn via
default profile configuration.
---
.../navigate/ForceAuthnProfileConfigPredicate.java | 5 +-
.../system/conf/relying-party-mddriven.xml | 4 +-
.../logic/ProxyAwareForceAuthnPredicate.java | 55 ++++++++++++++++++++++
.../config/BrowserSSOProfileConfiguration.java | 3 +-
.../saml/saml2/profile/impl/AddAuthnRequest.java | 5 +-
5 files changed, 64 insertions(+), 8 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/ForceAuthnProfileConfigPredicate.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/ForceAuthnProfileConfigPredicate.java
index bbdb224..c59f6a5 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/ForceAuthnProfileConfigPredicate.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/ForceAuthnProfileConfigPredicate.java
@@ -27,10 +27,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
/**
* A predicate that evaluates a {@link ProfileRequestContext} and determines whether forced
- * authentication should be set.
- *
- * <p>For SAML 1 and SAML 2 SSO profiles, the "forceAuthn" flag is the setting governing
- * this decision. For other profiles, false is returned.</p>
+ * authentication should be set based on the associated {@link AuthenticationProfileConfiguration}.
*
* @since 3.4.0
*/
diff --git a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
index 77ff931..3a1ce24 100644
--- a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
+++ b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
@@ -381,7 +381,9 @@
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="forceAuthn" />
</constructor-arg>
- <constructor-arg value="false" />
+ <constructor-arg>
+ <bean class="net.shibboleth.idp.saml.profile.config.logic.ProxyAwareForceAuthnPredicate" />
+ </constructor-arg>
</bean>
</property>
<property name="checkAddressPredicate">
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/ProxyAwareForceAuthnPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/ProxyAwareForceAuthnPredicate.java
new file mode 100644
index 0000000..6ea6f2c
--- /dev/null
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/ProxyAwareForceAuthnPredicate.java
@@ -0,0 +1,55 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.profile.config.logic;
+
+import java.util.function.Predicate;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+
+/**
+ * Implements a set of default logic for determining whether ForceAuthn should be applied.
+ *
+ * <p>This operates in two different scenarios: ordinary use and proxy SAML authentication use, detectable
+ * by whether the input context is parent-less (the former), or the child of an {@link AuthenticationContext}.</p>
+ *
+ * <p>In normal use, the value returned is false, requiring it to be explicitly superceded.</p>
+ *
+ * <p>In proxy use, the value returned is false unless the parent context itself indicates the use of forced
+ * authentication, which was itself established in most cases from this function running previously or
+ * being overridden by a default. In other words, the proxy default is "passthrough" of the value.</p>
+ *
+ * @since 4.0.0
+ */
+public class ProxyAwareForceAuthnPredicate implements Predicate<ProfileRequestContext> {
+
+
+ /** {@inheritDoc} */
+ public boolean test(@Nullable final ProfileRequestContext input) {
+
+ if (input != null && input.getParent() instanceof AuthenticationContext) {
+ return ((AuthenticationContext) input.getParent()).isForceAuthn();
+ }
+
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index c444d88..3f9765d 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -31,6 +31,7 @@ import javax.annotation.Nullable;
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
+import net.shibboleth.idp.saml.profile.config.logic.ProxyAwareForceAuthnPredicate;
import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -123,7 +124,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
setEncryptAssertions(true);
resolveAttributesPredicate = Predicates.alwaysTrue();
includeAttributeStatementPredicate = Predicates.alwaysTrue();
- forceAuthnPredicate = Predicates.alwaysFalse();
+ forceAuthnPredicate = new ProxyAwareForceAuthnPredicate();
checkAddressPredicate = Predicates.alwaysTrue();
skipEndpointValidationWhenSignedPredicate = Predicates.alwaysFalse();
proxiedAuthnInstantPredicate = Predicates.alwaysTrue();
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
index 7201449..32777eb 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
@@ -233,8 +233,9 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
log.debug("{} No issuer value available, leaving Issuer unset", getLogPrefix());
}
- // ForceAuthn may come from request or config.
- if (authenticationContext.isForceAuthn() || profileConfiguration.isForceAuthn(profileRequestContext)) {
+ // ForceAuthn comes from configuration, which by default will take into account the
+ // AuthenticationContext parent's state (but may be overridden by deployer).
+ if (profileConfiguration.isForceAuthn(profileRequestContext)) {
log.debug("{} Setting ForceAuthn for SAML AuthnRequest", getLogPrefix());
object.setForceAuthn(true);
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list