[java-identity-provider] branch master updated: IDP-1494 - Login flow for proxied SAML authentication

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f49d30a6fc3c21baf584222025ec378befe349f1

The following commit(s) were added to refs/heads/master by this push:
       new  f49d30a   IDP-1494 - Login flow for proxied SAML authentication
f49d30a is described below

commit f49d30a6fc3c21baf584222025ec378befe349f1
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Nov 13 17:34:03 2019 -0500

    IDP-1494 - Login flow for proxied SAML authentication
    
    https://issues.shibboleth.net/jira/browse/IDP-1494
    
    Add property-based support for WantAuthnRequestsSigned flag.
---
 .../system/flows/authn/proxy/saml-proxy-beans.xml  |  3 +-
 .../config/logic/SignRequestsPredicate.java        | 62 +++++++++++++++++++++-
 2 files changed, 62 insertions(+), 3 deletions(-)

diff --git a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
index fd9f761..cee5e27 100644
--- a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
@@ -142,7 +142,8 @@
                     p:signatureSigningParametersResolver-ref="shibboleth.SignatureSigningParametersResolver"
                     p:noResultIsError="false">
                 <property name="activationCondition">
-                    <bean class="net.shibboleth.idp.saml.profile.config.logic.SignRequestsPredicate" />
+                    <bean class="net.shibboleth.idp.saml.profile.config.logic.SignRequestsPredicate"
+                        p:honorMetadata="%{idp.signing.honorWantAuthnRequestsSigned:true}" />
                 </property>
             </bean>
         </constructor-arg>
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignRequestsPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignRequestsPredicate.java
index 0539c87..b569053 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignRequestsPredicate.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignRequestsPredicate.java
@@ -17,22 +17,80 @@
 
 package net.shibboleth.idp.saml.profile.config.logic;
 
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.idp.profile.config.ProfileConfiguration;
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
 import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
 import net.shibboleth.idp.saml.profile.config.SAMLProfileConfiguration;
+import net.shibboleth.idp.saml.profile.context.navigate.SAMLMetadataContextLookupFunction;
+import net.shibboleth.utilities.java.support.logic.Constraint;
 
 import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
+import org.opensaml.saml.saml2.metadata.IDPSSODescriptor;
 
-/** A predicate implementation that forwards to 
- * {@link SAMLProfileConfiguration#isSignRequests(ProfileRequestContext)}.
+/**
+ * A predicate implementation that forwards to 
+ * {@link SAMLProfileConfiguration#isSignRequests(ProfileRequestContext)}
+ * or follows {@link IDPSSODescriptor#getWantAuthnRequestsSigned()} if so configured.
  */
 public class SignRequestsPredicate extends AbstractRelyingPartyPredicate {
     
+    /** Whether to override the result based on the WantAuthnRequestsSigned flag in SAML metadata. */
+    private boolean honorMetadata;
+    
+    /** Lookup strategy for {@link SAMLMetadataContext}. */
+    private Function<ProfileRequestContext,SAMLMetadataContext> metadataContextLookupStrategy;
+    
+    /** Constructor. */
+    public SignRequestsPredicate() {
+        metadataContextLookupStrategy = new SAMLMetadataContextLookupFunction();
+    }
+    
+    /**
+     * Set whether to override the result based on the WantAuthnRequestsSigned flag in SAML metadata.
+     * 
+     * <p>Defaults to false.</p>
+     * 
+     * @param flag flag to set
+     * 
+     * @since 4.0.0
+     */
+    public void setHonorMetadata(final boolean flag) {
+        honorMetadata = flag;
+    }
+
+    /**
+     * Set lookup strategy for {@link SAMLMetadataContext}.
+     * 
+     * @param strategy lookup strategy
+     * 
+     * @since 4.0.0
+     */
+    public void setMetadataContextLookupStrategy(
+            @Nonnull final Function<ProfileRequestContext,SAMLMetadataContext> strategy) {
+        metadataContextLookupStrategy = Constraint.isNotNull(strategy,
+                "SAMLMetadataContext lookup strategy cannot be null");
+    }
+    
     /** {@inheritDoc} */
     public boolean test(@Nullable final ProfileRequestContext input) {
+
+        if (honorMetadata) {
+            final SAMLMetadataContext metadataCtx = metadataContextLookupStrategy.apply(input);
+            if (metadataCtx != null && metadataCtx.getRoleDescriptor() != null
+                    && metadataCtx.getRoleDescriptor() instanceof IDPSSODescriptor) {
+                final Boolean flag = ((IDPSSODescriptor) metadataCtx.getRoleDescriptor()).getWantAuthnRequestsSigned();
+                if (flag != null && flag.booleanValue()) {
+                    return true;
+                }
+            }
+        }
+        
         final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
         if (rpc != null) {
             final ProfileConfiguration pc = rpc.getProfileConfig();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.