[java-identity-provider] branch master updated: IDP-1494 - Login flow for proxied SAML authentication
Scott Cantor
cantor.2 at osu.edu
Fri Nov 15 17:30:31 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d3c2724c48d6725e0a4cdd0bf4fdad6e315ed19e
The following commit(s) were added to refs/heads/master by this push:
new d3c2724 IDP-1494 - Login flow for proxied SAML authentication
d3c2724 is described below
commit d3c2724c48d6725e0a4cdd0bf4fdad6e315ed19e
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Nov 15 17:30:28 2019 -0500
IDP-1494 - Login flow for proxied SAML authentication
https://issues.shibboleth.net/jira/browse/IDP-1494
Add logging.
Bug fix to inbound mapping function.
---
.../MapDrivenAuthnContextTranslationStrategy.java | 37 ++++++++++++++++++----
.../saml/saml2/profile/impl/AddAuthnRequest.java | 17 ++++++++++
.../profile/impl/ValidateSAMLAuthentication.java | 10 ++++--
3 files changed, 56 insertions(+), 8 deletions(-)
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/MapDrivenAuthnContextTranslationStrategy.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/MapDrivenAuthnContextTranslationStrategy.java
index b7f85ec..441ede1 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/MapDrivenAuthnContextTranslationStrategy.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/MapDrivenAuthnContextTranslationStrategy.java
@@ -24,11 +24,14 @@ import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.function.Function;
+import java.util.stream.Collectors;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.saml.saml2.core.AuthnContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
import net.shibboleth.idp.saml.authn.principal.AuthnContextDeclRefPrincipal;
@@ -42,6 +45,9 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElemen
*/
public class MapDrivenAuthnContextTranslationStrategy implements Function<AuthnContext,Collection<Principal>> {
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(MapDrivenAuthnContextTranslationStrategy.class);
+
/** Mappings to transform proxied Principals. */
@Nonnull @NonnullElements private Map<Principal,Collection<Principal>> principalMappings;
@@ -71,15 +77,34 @@ public class MapDrivenAuthnContextTranslationStrategy implements Function<AuthnC
@Nullable public Collection<Principal> apply(@Nullable final AuthnContext input) {
if (input != null) {
- if (input.getAuthnContextClassRef() != null) {
- return principalMappings.get(new AuthnContextClassRefPrincipal(
- input.getAuthnContextClassRef().getAuthnContextClassRef()));
- } else if (input.getAuthnContextDeclRef() != null) {
- return principalMappings.get(new AuthnContextDeclRefPrincipal(
- input.getAuthnContextDeclRef().getAuthnContextDeclRef()));
+ final Principal principal;
+
+ if (input.getAuthnContextClassRef() != null
+ && input.getAuthnContextClassRef().getAuthnContextClassRef() != null) {
+ principal = new AuthnContextClassRefPrincipal(
+ input.getAuthnContextClassRef().getAuthnContextClassRef());
+ } else if (input.getAuthnContextDeclRef() != null
+ && input.getAuthnContextDeclRef().getAuthnContextDeclRef() != null) {
+ principal = new AuthnContextDeclRefPrincipal(input.getAuthnContextDeclRef().getAuthnContextDeclRef());
+ } else {
+ log.trace("Input AuthnContext did not contain a class or decl reference, returning nothing");
+ return null;
+ }
+
+ if (principalMappings.containsKey(principal)) {
+ final Collection<Principal> mapped = principalMappings.get(principal);
+ if (log.isTraceEnabled()) {
+ log.trace("Mapped '{}' to ", principal.getName(),
+ mapped.stream().map(Principal::getName).collect(Collectors.toUnmodifiableList()));
+ }
+ return mapped;
}
+
+ log.trace("Passing unmapped value '{}' through", principal.getName());
+ return Collections.singletonList(principal);
}
+ log.trace("Input AuthnContext was null, returning nothing");
return null;
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
index 676dd3b..185ff8b 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
@@ -272,6 +272,7 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
final AuthnContextComparisonTypeEnumeration operator =
profileConfiguration.getAuthnContextComparison(profileRequestContext);
if (operator != null) {
+ log.debug("{} Setting RequestedAuthnContext comparison to {}", getLogPrefix(), operator);
rac.setComparison(operator);
}
object.setRequestedAuthnContext(rac);
@@ -310,6 +311,14 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
classRefPrincipals.stream()
.map(AuthnContextClassRefPrincipal::getAuthnContextClassRef)
.collect(Collectors.toUnmodifiableList()));
+
+ if (log.isDebugEnabled()) {
+ log.debug("{} Setting RequestedAuthnContext class refs to {}", getLogPrefix(),
+ classRefPrincipals.stream()
+ .map(AuthnContextClassRefPrincipal::getName)
+ .collect(Collectors.toUnmodifiableList()));
+ }
+
return rac;
}
@@ -325,6 +334,14 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
declRefPrincipals.stream()
.map(AuthnContextDeclRefPrincipal::getAuthnContextDeclRef)
.collect(Collectors.toUnmodifiableList()));
+
+ if (log.isDebugEnabled()) {
+ log.debug("{} Setting RequestedAuthnContext decl refs to {}", getLogPrefix(),
+ declRefPrincipals.stream()
+ .map(AuthnContextDeclRefPrincipal::getName)
+ .collect(Collectors.toUnmodifiableList()));
+ }
+
return rac;
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
index 2920c5a..bf221b7 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
@@ -306,11 +306,17 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
final Collection<Principal> translated = authnContextTranslator.apply(authnContext);
if (translated != null) {
subject.getPrincipals().addAll(translated);
+ if (log.isDebugEnabled()) {
+ log.debug("{} Added translated AuthnContext Principals: {}", getLogPrefix(),
+ translated.stream().map(Principal::getName).collect(Collectors.toUnmodifiableList()));
+ }
}
- } else if (authnContext.getAuthnContextClassRef() != null) {
+ } else if (authnContext.getAuthnContextClassRef() != null &&
+ authnContext.getAuthnContextClassRef().getAuthnContextClassRef() != null) {
subject.getPrincipals().add(new AuthnContextClassRefPrincipal(
authnContext.getAuthnContextClassRef().getAuthnContextClassRef()));
- } else if (authnContext.getAuthnContextDeclRef() != null) {
+ } else if (authnContext.getAuthnContextDeclRef() != null
+ && authnContext.getAuthnContextDeclRef().getAuthnContextDeclRef() != null) {
subject.getPrincipals().add(new AuthnContextDeclRefPrincipal(
authnContext.getAuthnContextDeclRef().getAuthnContextDeclRef()));
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list