[java-identity-provider] branch master updated: IDP-1494 - Login flow for proxied authentication
Scott Cantor
cantor.2 at osu.edu
Fri Oct 18 12:46:25 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=fb5b2bb8e5a4e5d92fc3c1938da328cecff9a849
The following commit(s) were added to refs/heads/master by this push:
new fb5b2bb IDP-1494 - Login flow for proxied authentication
fb5b2bb is described below
commit fb5b2bb8e5a4e5d92fc3c1938da328cecff9a849
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Oct 18 12:46:22 2019 -0400
IDP-1494 - Login flow for proxied authentication
https://issues.shibboleth.net/jira/browse/IDP-1494
Add some profile settings needed for SP side.
---
.../system/conf/relying-party-mddriven.xml | 11 +++
.../config/BrowserSSOProfileConfiguration.java | 94 +++++++++++++++++++++-
2 files changed, 104 insertions(+), 1 deletion(-)
diff --git a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
index fa60b06..e748f29 100644
--- a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
+++ b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
@@ -384,6 +384,14 @@
<constructor-arg value="false" />
</bean>
</property>
+ <property name="checkAddressPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="checkAddress" />
+ </constructor-arg>
+ <constructor-arg value="true" />
+ </bean>
+ </property>
<property name="skipEndpointValidationWhenSignedPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
@@ -408,6 +416,9 @@
<property name="maximumSPSessionLifetimeLookupStrategy">
<bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="maximumSPSessionLifetime" />
</property>
+ <property name="maximumTimeSinceAuthnLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="maximumTimeSinceAuthn" />
+ </property>
<property name="allowDelegationPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index 8e79e42..439f645 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -69,13 +69,19 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
/** Whether to mandate forced authentication for the request. */
@Nonnull private Predicate<ProfileRequestContext> forceAuthnPredicate;
-
+
+ /** Whether to compare client and assertion addresses on inbound SSO. */
+ @Nonnull private Predicate<ProfileRequestContext> checkAddressPredicate;
+
/** Whether the response endpoint should be validated if the request is signed. */
@Nonnull private Predicate<ProfileRequestContext> skipEndpointValidationWhenSignedPredicate;
/** Lookup function to supply maximum session lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> maximumSPSessionLifetimeLookupStrategy;
+ /** Lookup function to supply maximum time since inbound AuthnInstant. */
+ @Nonnull private Function<ProfileRequestContext,Duration> maximumTimeSinceAuthnLookupStrategy;
+
/**
* The predicate used to determine if produced assertions may be delegated.
*/
@@ -117,8 +123,10 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
resolveAttributesPredicate = Predicates.alwaysTrue();
includeAttributeStatementPredicate = Predicates.alwaysTrue();
forceAuthnPredicate = Predicates.alwaysFalse();
+ checkAddressPredicate = Predicates.alwaysTrue();
skipEndpointValidationWhenSignedPredicate = Predicates.alwaysFalse();
maximumSPSessionLifetimeLookupStrategy = FunctionSupport.constant(null);
+ maximumTimeSinceAuthnLookupStrategy = FunctionSupport.constant(null);
maximumTokenDelegationChainLengthLookupStrategy = FunctionSupport.constant(DEFAULT_DELEGATION_CHAIN_LENGTH);
allowDelegationPredicate = Predicates.alwaysFalse();
authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
@@ -214,6 +222,44 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
public void setForceAuthnPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
forceAuthnPredicate = Constraint.isNotNull(condition, "Forced authentication predicate cannot be null");
}
+
+ /**
+ * Get whether the client's address must match the address in an inbound {@link SubjectLocality}
+ * element during inbound SSO.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether to compare addresses
+ *
+ * @since 4.0.0
+ */
+ public boolean isCheckAddress(@Nullable final ProfileRequestContext profileRequestContext) {
+ return checkAddressPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether the client's address must match the address in an inbound {@link SubjectLocality}
+ * element during inbound SSO.
+ *
+ * @param flag flag to set
+ *
+ * @since 4.0.0
+ */
+ public void setCheckAddress(final boolean flag) {
+ checkAddressPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set a condition to determine whether the client's address must match the address in an inbound
+ * {@link SubjectLocality} element during inbound SSO.
+ *
+ * @param condition condition to set
+ *
+ * @since 4.0.0
+ */
+ public void setCheckAddressPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ checkAddressPredicate = Constraint.isNotNull(condition, "Address checking predicate cannot be null");
+ }
/**
* Get condition to determine whether the response endpoint should be validated if the request is signed.
@@ -292,6 +338,52 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
}
/**
+ * Get the maximum amount of time allowed to have elapsed since an incoming AuthnInstant.
+ *
+ * <p>A null or 0 is interpreted as an unlimited amount.</p>
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return max time since inbound AuthnInstant
+ *
+ * @since 4.0.0
+ */
+ @Nullable public Duration getMaximumTimeSinceAuthn(@Nullable final ProfileRequestContext profileRequestContext) {
+ final Duration amount = maximumTimeSinceAuthnLookupStrategy.apply(profileRequestContext);
+ Constraint.isFalse(amount != null && amount.isNegative(),
+ "Maximum time since authentication must be greater than or equal to 0");
+ return amount;
+ }
+
+ /**
+ * Set the maximum amount of time allowed to have elapsed since an incoming AuthnInstant.
+ *
+ * <p>A null or 0 is interpreted as an unlimited amount.</p>
+ *
+ * @param amount max time to allow
+ *
+ * @since 4.0.0
+ */
+ public void setMaximumTimeSinceAuthn(@Nullable final Duration amount) {
+ Constraint.isFalse(amount != null && amount.isNegative(),
+ "Maximum time since authentication must be greater than or equal to 0");
+
+ maximumTimeSinceAuthnLookupStrategy = FunctionSupport.constant(amount);
+ }
+
+ /**
+ * Set a lookup strategy for the maximum amount of time allowed to have elapsed since an incoming AuthnInstant.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 4.0.0
+ */
+ public void setMaximumTimeSinceAuthnLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Duration> strategy) {
+ maximumTimeSinceAuthnLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
* Get the predicate used to determine if produced assertions may be delegated.
*
* @param profileRequestContext current profile request context
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list