[java-identity-provider] branch master updated: IDP-1494 - Login flow for proxied SAML authentication
Scott Cantor
cantor.2 at osu.edu
Fri Nov 22 09:59:32 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=bfd4097078a9f8531ee78e5fe9f8f7e42ea1fc91
The following commit(s) were added to refs/heads/master by this push:
new bfd4097 IDP-1494 - Login flow for proxied SAML authentication
bfd4097 is described below
commit bfd4097078a9f8531ee78e5fe9f8f7e42ea1fc91
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Nov 22 09:59:28 2019 -0500
IDP-1494 - Login flow for proxied SAML authentication
https://issues.shibboleth.net/jira/browse/IDP-1494
Adjust return type for proxy audiences to Set.
Add outbound ProxyRestriction based on local config and upstream values.
---
.../idp/authn/context/SubjectContext.java | 13 +--
.../principal/ProxyAuthenticationPrincipal.java | 17 ++-
.../system/flows/saml/saml2/sso-abstract-beans.xml | 7 +-
.../config/AbstractSAMLProfileConfiguration.java | 6 +-
.../navigate/ProxyRestrictionLookupFunction.java | 121 +++++++++++++++++++++
.../profile/config/SAML2ProfileConfiguration.java | 4 +-
6 files changed, 144 insertions(+), 24 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectContext.java
index d4422aa..2ac4125 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectContext.java
@@ -17,10 +17,10 @@
package net.shibboleth.idp.authn.context;
-import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
+import java.util.stream.Collectors;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -34,8 +34,6 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
import org.opensaml.messaging.context.BaseContext;
-import com.google.common.collect.ImmutableList;
-
/**
* A context that holds information about the subject of a request.
*
@@ -132,11 +130,10 @@ public final class SubjectContext extends BaseContext {
* @return immutable list of Subjects
*/
@Nonnull @NonnullElements @Unmodifiable @NotLive public List<Subject> getSubjects() {
- final List<Subject> composite = new ArrayList<>();
- for (final AuthenticationResult e : getAuthenticationResults().values()) {
- composite.add(e.getSubject());
- }
- return ImmutableList.copyOf(composite);
+ return authenticationResults.values()
+ .stream()
+ .map(AuthenticationResult::getSubject)
+ .collect(Collectors.toUnmodifiableList());
}
}
\ No newline at end of file
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/ProxyAuthenticationPrincipal.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/ProxyAuthenticationPrincipal.java
index 77087ef..15b0eb5 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/ProxyAuthenticationPrincipal.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/ProxyAuthenticationPrincipal.java
@@ -20,7 +20,10 @@ package net.shibboleth.idp.authn.principal;
import java.security.Principal;
import java.util.ArrayList;
import java.util.Collection;
+import java.util.HashSet;
import java.util.List;
+import java.util.Objects;
+import java.util.Set;
import java.util.function.Predicate;
import javax.annotation.Nonnull;
@@ -53,7 +56,7 @@ public class ProxyAuthenticationPrincipal implements Principal, Predicate<Profil
@Nonnull @NonnullElements private Collection<String> authorities;
/** The audiences. */
- @Nonnull @NonnullElements private Collection<String> audiences;
+ @Nonnull @NonnullElements private Set<String> audiences;
/** Constrains additional proxy hops. */
@Nullable private Integer proxyCount;
@@ -61,7 +64,7 @@ public class ProxyAuthenticationPrincipal implements Principal, Predicate<Profil
/** Constructor. */
public ProxyAuthenticationPrincipal() {
authorities = new ArrayList<>();
- audiences = new ArrayList<>();
+ audiences = new HashSet<>();
}
/**
@@ -73,7 +76,7 @@ public class ProxyAuthenticationPrincipal implements Principal, Predicate<Profil
Constraint.isNotNull(proxiedAuthorities, "Proxied authority collection cannot be null");
authorities = new ArrayList<>(List.copyOf(proxiedAuthorities));
- audiences = new ArrayList<>();
+ audiences = new HashSet<>();
}
/** {@inheritDoc} */
@@ -91,12 +94,12 @@ public class ProxyAuthenticationPrincipal implements Principal, Predicate<Profil
}
/**
- * Get the mutable audience collection, the set of relying parties for which proxying
+ * Get the mutable audience set, the set of relying parties for which proxying
* is permissable.
*
* @return the audiences
*/
- @Nonnull @NonnullElements @Live public Collection<String> getAudiences() {
+ @Nonnull @NonnullElements @Live public Set<String> getAudiences() {
return audiences;
}
@@ -166,7 +169,9 @@ public class ProxyAuthenticationPrincipal implements Principal, Predicate<Profil
}
if (other instanceof ProxyAuthenticationPrincipal) {
- return authorities.equals(((ProxyAuthenticationPrincipal) other).getAuthorities());
+ return authorities.equals(((ProxyAuthenticationPrincipal) other).getAuthorities()) &&
+ Objects.equals(proxyCount, ((ProxyAuthenticationPrincipal) other).getProxyCount()) &&
+ audiences.equals(((ProxyAuthenticationPrincipal) other).getAudiences());
}
return false;
diff --git a/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-beans.xml b/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-beans.xml
index a57b3f5..c3ebffe 100644
--- a/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-beans.xml
@@ -91,11 +91,8 @@
<bean id="AddProxyRestrictionToAssertions"
class="org.opensaml.saml.saml2.profile.impl.AddProxyRestrictionToAssertions" scope="prototype">
- <property name="proxyAudiencesLookupStrategy">
- <bean class="net.shibboleth.idp.saml.profile.config.navigate.ProxyAudienceRestrictionsLookupFunction" />
- </property>
- <property name="proxyCountLookupStrategy">
- <bean class="net.shibboleth.idp.saml.profile.config.navigate.ProxyCountLookupFunction" />
+ <property name="proxyRestrictionLookupStrategy">
+ <bean class="net.shibboleth.idp.saml.profile.config.navigate.ProxyRestrictionLookupFunction" />
</property>
</bean>
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java
index c87cb75..4519c5a 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java
@@ -69,7 +69,7 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractCondition
@Nonnull private Function<ProfileRequestContext,Duration> assertionLifetimeLookupStrategy;
/** Lookup function to supply assertionAudiences property. */
- @Nonnull private Function<ProfileRequestContext,Collection<String>> assertionAudiencesLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext,Set<String>> assertionAudiencesLookupStrategy;
/**
* Constructor.
@@ -235,7 +235,7 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractCondition
@Nonnull @NonnullElements @NotLive public Set<String> getAdditionalAudiencesForAssertion(
@Nullable final ProfileRequestContext profileRequestContext) {
- final Collection<String> audiences = assertionAudiencesLookupStrategy.apply(profileRequestContext);
+ final Set<String> audiences = assertionAudiencesLookupStrategy.apply(profileRequestContext);
if (audiences != null) {
return Set.copyOf(audiences);
}
@@ -267,7 +267,7 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractCondition
* @since 4.0.0
*/
public void setAdditionalAudiencesForAssertionLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
+ @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
assertionAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/ProxyRestrictionLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/ProxyRestrictionLookupFunction.java
new file mode 100644
index 0000000..456f616
--- /dev/null
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/ProxyRestrictionLookupFunction.java
@@ -0,0 +1,121 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.profile.config.navigate;
+
+import java.util.HashSet;
+import java.util.Set;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.idp.authn.context.SubjectContext;
+import net.shibboleth.idp.authn.principal.ProxyAuthenticationPrincipal;
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.idp.saml.saml2.profile.config.SAML2ProfileConfiguration;
+import net.shibboleth.utilities.java.support.collection.Pair;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * A function that returns the allowable proxy count and audiences to include in assertions,
+ * based on the results of lookup functions for local configuration merged with upstream
+ * proxy restrictions to compute a final result in accordance with the standard.
+ */
+public class ProxyRestrictionLookupFunction extends AbstractRelyingPartyLookupFunction<Pair<Integer,Set<String>>> {
+
+ /** SubjectContext lookup strategy. */
+ @Nonnull private Function<ProfileRequestContext,SubjectContext> subjectContextLookupStrategy;
+
+ /** Constructor. */
+ public ProxyRestrictionLookupFunction() {
+ subjectContextLookupStrategy = new ChildContextLookup<>(SubjectContext.class);
+ }
+
+ /**
+ * Set the lookup strategy to locate the {@link SubjectContext}.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setSubjectContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,SubjectContext> strategy) {
+ subjectContextLookupStrategy = Constraint.isNotNull(strategy, "SubjectContext lookup strategy cannot be null");
+ }
+
+// Checkstyle: CyclomaticComplexity OFF
+ /** {@inheritDoc} */
+ @Nullable public Pair<Integer,Set<String>> apply(@Nullable final ProfileRequestContext input) {
+
+ Integer proxyCount = null;
+ final Set<String> audiences = new HashSet<>();
+
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null && pc instanceof SAML2ProfileConfiguration) {
+ proxyCount = ((SAML2ProfileConfiguration) pc).getProxyCount(input);
+ final Set<String> configAudiences = ((SAML2ProfileConfiguration) pc).getProxyAudiences(input);
+ if (configAudiences != null) {
+ audiences.addAll(configAudiences);
+ }
+ }
+ }
+
+ final SubjectContext sc = subjectContextLookupStrategy.apply(input);
+
+ if (sc == null) {
+ if (proxyCount != null) {
+ proxyCount = Integer.max(0, proxyCount - 1);
+ }
+ return new Pair<>(proxyCount, audiences);
+ }
+
+ final Set<ProxyAuthenticationPrincipal> proxieds =
+ sc.getSubjects().stream()
+ .map(s -> s.getPrincipals(ProxyAuthenticationPrincipal.class))
+ .flatMap(Set::stream)
+ .collect(Collectors.toUnmodifiableSet());
+ for (final ProxyAuthenticationPrincipal p : proxieds) {
+ if (p.getProxyCount() != null) {
+ if (proxyCount != null) {
+ proxyCount = Integer.min(proxyCount, Integer.max(0, p.getProxyCount() - 1));
+ } else {
+ proxyCount = Integer.max(0, p.getProxyCount() - 1);
+ }
+ }
+
+ final Set<String> upstreamAudiences = p.getAudiences();
+ if (upstreamAudiences != null && !upstreamAudiences.isEmpty()) {
+ if (audiences.isEmpty()) {
+ audiences.addAll(upstreamAudiences);
+ } else {
+ audiences.retainAll(upstreamAudiences);
+ }
+ }
+ }
+
+ return new Pair<>(proxyCount, audiences);
+ }
+// Checkstyle: CyclomaticComplexity ON
+
+}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
index fed1d7f..45ad1a1 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
@@ -17,7 +17,7 @@
package net.shibboleth.idp.saml.saml2.profile.config;
-import java.util.Collection;
+import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -50,7 +50,7 @@ public interface SAML2ProfileConfiguration {
*
* @return audiences for a proxied assertion
*/
- @Nonnull @NonnullElements @NotLive @Unmodifiable Collection<String> getProxyAudiences(
+ @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getProxyAudiences(
@Nullable final ProfileRequestContext profileRequestContext);
/**
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list