[java-identity-provider] branch master updated: IDP-1494 - Login flow for proxied SAML authentication
Scott Cantor
cantor.2 at osu.edu
Wed Nov 20 17:48:13 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=2c02bc89ce2b30cbe48eecb7348a0049fff58520
The following commit(s) were added to refs/heads/master by this push:
new 2c02bc8 IDP-1494 - Login flow for proxied SAML authentication
2c02bc8 is described below
commit 2c02bc89ce2b30cbe48eecb7348a0049fff58520
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Nov 20 17:48:09 2019 -0500
IDP-1494 - Login flow for proxied SAML authentication
https://issues.shibboleth.net/jira/browse/IDP-1494
Add automatic support for proxy restrictions on reuse.
---
.../idp/authn/AuthenticationFlowDescriptor.java | 42 ++++++++++++++++++++--
.../shibboleth/idp/authn/AuthenticationResult.java | 27 ++++++++++++++
.../resources/system/conf/general-authn-system.xml | 1 +
3 files changed, 68 insertions(+), 2 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationFlowDescriptor.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationFlowDescriptor.java
index 965085f..067b39a 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationFlowDescriptor.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationFlowDescriptor.java
@@ -42,6 +42,7 @@ import net.shibboleth.utilities.java.support.component.AbstractIdentifiableIniti
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.PredicateSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.storage.StorageSerializer;
@@ -77,6 +78,9 @@ public class AuthenticationFlowDescriptor extends AbstractIdentifiableInitializa
/** Whether this flow supports forced authentication. */
private boolean supportsForced;
+ /** Whether this flow should honor proxy restrictions. */
+ private boolean proxyRestrictionsEnforced;
+
/** Whether this flow allows reuse of its results. */
@Nonnull private Predicate<ProfileRequestContext> reuseCondition;
@@ -104,6 +108,7 @@ public class AuthenticationFlowDescriptor extends AbstractIdentifiableInitializa
/** Constructor. */
public AuthenticationFlowDescriptor() {
supportsNonBrowser = true;
+ proxyRestrictionsEnforced = true;
reuseCondition = Predicates.alwaysTrue();
supportedPrincipals = new Subject();
activationCondition = Predicates.alwaysTrue();
@@ -172,6 +177,30 @@ public class AuthenticationFlowDescriptor extends AbstractIdentifiableInitializa
}
/**
+ * Gets whether this flow's results should honor restrictions on proxying.
+ *
+ * @return true iff upstream proxying restrictions should be honored
+ *
+ * @since 4.0.0
+ */
+ public boolean isProxyRestrictionsEnforced() {
+ return proxyRestrictionsEnforced;
+ }
+
+ /**
+ * Sets whether this flow's results should honor restrictions on proxying.
+ *
+ * <p>Defaults to true.</p>
+ *
+ * @param flag flag to set
+ *
+ * @since 4.0.0
+ */
+ public void setProxyRestrictionsEnforced(final boolean flag) {
+ proxyRestrictionsEnforced = flag;
+ }
+
+ /**
* Set condition controlling whether results from this flow should be reused for SSO.
*
* <p>Defaults to {@link Predicates#alwaysTrue()}.</p>
@@ -352,7 +381,12 @@ public class AuthenticationFlowDescriptor extends AbstractIdentifiableInitializa
*/
@Nonnull public AuthenticationResult newAuthenticationResult(@Nonnull final Subject subject) {
final AuthenticationResult result = new AuthenticationResult(getId(), subject);
- result.setReuseCondition(reuseCondition);
+
+ if (proxyRestrictionsEnforced) {
+ result.setReuseCondition(PredicateSupport.and(reuseCondition, result.new ProxyRestrictionReusePredicate()));
+ } else {
+ result.setReuseCondition(reuseCondition);
+ }
return result;
}
@@ -376,7 +410,11 @@ public class AuthenticationFlowDescriptor extends AbstractIdentifiableInitializa
(expiration != null) ?
expiration - inactivityTimeout.toMillis() - STORAGE_EXPIRATION_OFFSET.toMillis() :
null);
- result.setReuseCondition(reuseCondition);
+ if (proxyRestrictionsEnforced) {
+ result.setReuseCondition(PredicateSupport.and(reuseCondition, result.new ProxyRestrictionReusePredicate()));
+ } else {
+ result.setReuseCondition(reuseCondition);
+ }
return result;
}
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationResult.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationResult.java
index bc22854..0f97e3d 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationResult.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationResult.java
@@ -33,6 +33,7 @@ import javax.security.auth.Subject;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.authn.principal.PrincipalSupportingComponent;
+import net.shibboleth.idp.authn.principal.ProxyAuthenticationPrincipal;
import net.shibboleth.idp.authn.principal.UsernamePrincipal;
import net.shibboleth.utilities.java.support.annotation.constraint.Live;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
@@ -289,4 +290,30 @@ public class AuthenticationResult implements PrincipalSupportingComponent {
return null;
}
+ /**
+ * Inner class implementing a predicate that checks for contained {@link ProxyAuthenticationPrincipal}
+ * objects and enforces any restrictions on reuse based on the current request.
+ */
+ class ProxyRestrictionReusePredicate implements Predicate<ProfileRequestContext> {
+
+ /** {@inheritDoc} */
+ public boolean test(@Nullable final ProfileRequestContext input) {
+
+ final Set<ProxyAuthenticationPrincipal> proxieds =
+ subject.getPrincipals(ProxyAuthenticationPrincipal.class);
+
+ if (proxieds == null || proxieds.isEmpty()) {
+ return true;
+ }
+
+ for (final ProxyAuthenticationPrincipal proxied : proxieds) {
+ if (!proxied.test(input)) {
+ return false;
+ }
+ }
+
+ return true;
+ }
+ }
+
}
\ No newline at end of file
diff --git a/idp-conf/src/main/resources/system/conf/general-authn-system.xml b/idp-conf/src/main/resources/system/conf/general-authn-system.xml
index affb4a0..c788b81 100644
--- a/idp-conf/src/main/resources/system/conf/general-authn-system.xml
+++ b/idp-conf/src/main/resources/system/conf/general-authn-system.xml
@@ -23,6 +23,7 @@
p:passiveAuthenticationSupported="false"
p:forcedAuthenticationSupported="false"
p:nonBrowserSupported="true"
+ p:proxyRestrictionsEnforced="%{idp.authn.proxyRestrictionsEnforced:true}"
p:lifetime="%{idp.authn.defaultLifetime:PT60M}"
p:inactivityTimeout="%{idp.authn.defaultTimeout:PT30M}"
p:principalWeightMap="#{getObject('shibboleth.AuthenticationPrincipalWeightMap')}">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list