[java-identity-provider] branch master updated: IDP-1494 - Login flow for proxied authentication
Scott Cantor
cantor.2 at osu.edu
Wed Oct 30 20:39:08 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=98d4a5dc510cc1e440d7c196fdfb3c34824e1992
The following commit(s) were added to refs/heads/master by this push:
new 98d4a5d IDP-1494 - Login flow for proxied authentication
98d4a5d is described below
commit 98d4a5dc510cc1e440d7c196fdfb3c34824e1992
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Oct 30 20:39:05 2019 -0400
IDP-1494 - Login flow for proxied authentication
https://issues.shibboleth.net/jira/browse/IDP-1494
Some cleanup, audit additions.
---
.../idp/authn/AbstractValidationAction.java | 24 ++-
.../impl/InitializeProxyProfileRequestContext.java | 7 +-
.../main/resources/system/conf/audit-system.xml | 200 +++++++++++++++++++++
.../system/flows/authn/proxy/saml-proxy-beans.xml | 8 +
.../system/flows/authn/proxy/saml-proxy-flow.xml | 3 +
.../audit/impl/AttributesAuditExtractor.java | 1 -
.../profile/impl/ValidateSAMLAuthentication.java | 59 +++---
7 files changed, 263 insertions(+), 39 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
index aca455e..0bd0999 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
@@ -206,6 +206,17 @@ public abstract class AbstractValidationAction extends AbstractAuthenticationAct
resultCachingPredicate = predicate;
}
+
+ /**
+ * Get the strategy used to locate the requester ID for canonicalization.
+ *
+ * @return lookup strategy
+ *
+ * @since 4.0.0
+ */
+ @Nullable public Function<ProfileRequestContext,String> getRequesterLookupStrategy() {
+ return requesterLookupStrategy;
+ }
/**
* Set the strategy used to locate the requester ID for canonicalization.
@@ -217,6 +228,17 @@ public abstract class AbstractValidationAction extends AbstractAuthenticationAct
requesterLookupStrategy = strategy;
}
+
+ /**
+ * Get the strategy used to locate the responder ID for canonicalization.
+ *
+ * @return lookup strategy
+ *
+ * @since 4.0.0
+ */
+ @Nullable public Function<ProfileRequestContext,String> getResponderLookupStrategy() {
+ return responderLookupStrategy;
+ }
/**
* Set the strategy used to locate the responder ID for canonicalization.
@@ -363,7 +385,7 @@ public abstract class AbstractValidationAction extends AbstractAuthenticationAct
if (responderLookupStrategy != null) {
c14n.setResponderId(responderLookupStrategy.apply(profileRequestContext));
}
- profileRequestContext.addSubcontext(c14n, true);
+ authenticationContext.getParent().addSubcontext(c14n, true);
}
/**
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/proxy/impl/InitializeProxyProfileRequestContext.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/proxy/impl/InitializeProxyProfileRequestContext.java
index 1473d2a..3ecc156 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/proxy/impl/InitializeProxyProfileRequestContext.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/proxy/impl/InitializeProxyProfileRequestContext.java
@@ -26,7 +26,6 @@ import javax.annotation.concurrent.ThreadSafe;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -66,9 +65,9 @@ public final class InitializeProxyProfileRequestContext extends AbstractProfileA
public InitializeProxyProfileRequestContext() {
// Defaults to PRC -> AuthenticationContext -> PRC
- profileRequestContextCreationStrategy =
- new ChildContextLookup<>(ProfileRequestContext.class, true).compose(
- new ChildContextLookup<>(AuthenticationContext.class));
+ profileRequestContextCreationStrategy = input ->
+ (ProfileRequestContext) input.getSubcontext(AuthenticationContext.class).addSubcontext(
+ new ProfileRequestContext(), true);
}
/**
diff --git a/idp-conf/src/main/resources/system/conf/audit-system.xml b/idp-conf/src/main/resources/system/conf/audit-system.xml
index 3002f17..fdbb1a2 100644
--- a/idp-conf/src/main/resources/system/conf/audit-system.xml
+++ b/idp-conf/src/main/resources/system/conf/audit-system.xml
@@ -461,6 +461,98 @@
</map>
</property>
</bean>
+
+ <bean id="shibboleth.DefaultPostInboundAssertionAuditExtractors" lazy-init="true"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.ASSERTION_ID"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.AssertionIDAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.ASSERTION_ISSUE_INSTANT"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.AssertionInstantAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.AUTHN_INSTANT"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.AuthnInstantAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SESSION_INDEX"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.SessionIndexAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.AUTHN_CONTEXT"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.AuthnContextAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEID"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.NameIDAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEID_FORMAT"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.NameIDFormatAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ </map>
+ </property>
+ </bean>
<bean id="shibboleth.DefaultPostResponseAuditExtractors" lazy-init="true"
class="org.springframework.beans.factory.config.MapFactoryBean">
@@ -670,6 +762,114 @@
</map>
</property>
</bean>
+
+ <bean id="shibboleth.DefaultPostInboundResponseAuditExtractors" lazy-init="true"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.ATTRIBUTES"/>
+ </key>
+ <bean class="net.shibboleth.idp.profile.audit.impl.AttributesAuditExtractor" />
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.RESPONSE_BINDING"/>
+ </key>
+ <bean parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLBindingContextBindingFunction"
+ p:useShortName="%{idp.audit.shortenBindings:false}" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.ChildLookup.SAMLBindingContext"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.RESPONSE_ID"/>
+ </key>
+ <bean parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLMessageInfoContextIDFunction" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.ChildLookupOrCreate.SAMLMessageInfoContext"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.RESPONSE_ISSUE_INSTANT"/>
+ </key>
+ <bean parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLMessageInfoContextIssueInstantFunction" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.ChildLookupOrCreate.SAMLMessageInfoContext"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.IN_RESPONSE_TO"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.InResponseToAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.STATUS_CODE"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.StatusCodeAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SUBSTATUS_CODE"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.SubStatusCodeAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.STATUS_MESSAGE"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.StatusMessageAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ </map>
+ </property>
+ </bean>
<bean id="shibboleth.DefaultLogoutRequestAuditExtractors" lazy-init="true"
class="org.springframework.beans.factory.config.MapFactoryBean">
diff --git a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
index 6c81b89..24cb621 100644
--- a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
@@ -218,6 +218,14 @@
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext" />
+ <bean id="PostAssertionPopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
+ p:fieldExtractors="#{getObject('shibboleth.PostInboundAssertionAuditExtractors') ?: getObject('shibboleth.DefaultPostInboundAssertionAuditExtractors')}" />
+
+ <bean id="PostResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
+ p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
+ p:fieldExtractors="#{getObject('shibboleth.PostInboundResponseAuditExtractors') ?: getObject('shibboleth.DefaultPostInboundResponseAuditExtractors')}" />
+
<bean id="ValidateSAMLAuthentication"
class="net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication" scope="prototype"
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
diff --git a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-flow.xml b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-flow.xml
index 4803cba..de1b32e 100644
--- a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-flow.xml
@@ -47,6 +47,9 @@
<action-state id="ProcessResponse">
<evaluate expression="ContinueSAMLAuthentication" />
<evaluate expression="ValidateSAMLAuthentication" />
+ <evaluate expression="PostAssertionPopulateAuditContext" />
+ <evaluate expression="PostResponsePopulateAuditContext" />
+ <evaluate expression="WriteAuditLog" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="proceed" />
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/AttributesAuditExtractor.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/AttributesAuditExtractor.java
index 0bf04d1..c50fe9e 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/AttributesAuditExtractor.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/AttributesAuditExtractor.java
@@ -83,7 +83,6 @@ public class AttributesAuditExtractor implements Function<ProfileRequestContext,
}
/** {@inheritDoc} */
- @Override
@Nullable public Collection<String> apply(@Nullable final ProfileRequestContext input) {
if (activationCondition != null && !activationCondition.test(input)) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
index 67e008d..3545ce0 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
@@ -18,7 +18,6 @@
package net.shibboleth.idp.saml.saml2.profile.impl;
import java.util.Collection;
-import java.util.function.Function;
import java.util.stream.Collectors;
import javax.annotation.Nonnull;
@@ -41,7 +40,8 @@ import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.principal.IdPAttributePrincipal;
import net.shibboleth.idp.authn.principal.ProxyAuthenticationPrincipal;
-import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.saml.authn.principal.NameIDPrincipal;
import net.shibboleth.idp.saml.profile.context.navigate.SAMLMetadataContextLookupFunction;
import net.shibboleth.utilities.java.support.annotation.constraint.Live;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
@@ -95,22 +95,18 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
/** Service used to get the engine used to filter attributes. */
@Nullable private ReloadableService<AttributeFilter> attributeFilterService;
- /** Strategy used to obtain our identity. */
- @Nullable private Function<ProfileRequestContext,String> recipientIdLookupStrategy;
-
/** Optional supplemental metadata source for filtering. */
@Nullable private MetadataResolver metadataResolver;
/** Context containing the result to validate. */
@Nullable private SAMLAuthnContext samlAuthnContext;
- /** Free-standing context for externally supplied inbound attributes. */
+ /** Context for externally supplied inbound attributes. */
@Nullable private AttributeContext attributeContext;
/** Constructor. */
public ValidateSAMLAuthentication() {
setMetricName(DEFAULT_METRIC_NAME);
- recipientIdLookupStrategy = new ResponderIdLookupFunction();
}
/**
@@ -146,17 +142,6 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
metadataResolver = resolver;
}
-
- /**
- * Set the strategy used to locate the attribute recipient value to use.
- *
- * @param strategy lookup strategy
- */
- public void setRecipientIdLookupStrategy(@Nullable final Function<ProfileRequestContext,String> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- recipientIdLookupStrategy = strategy;
- }
/** {@inheritDoc} */
@Override
@@ -210,17 +195,25 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
@Override
@Nonnull protected Subject populateSubject(@Nonnull final Subject subject) {
+ if (samlAuthnContext.getSubject() != null && samlAuthnContext.getSubject().getNameID() != null) {
+ subject.getPrincipals().add(new NameIDPrincipal(samlAuthnContext.getSubject().getNameID()));
+ }
+
+ final ProxyAuthenticationPrincipal proxied = new ProxyAuthenticationPrincipal();
+ proxied.getAuthorities().add(
+ ((Assertion) samlAuthnContext.getAuthnStatement().getParent()).getIssuer().getValue());
+
final Collection<AuthenticatingAuthority> authorities =
samlAuthnContext.getAuthnStatement().getAuthnContext().getAuthenticatingAuthorities();
if (!authorities.isEmpty()) {
- final ProxyAuthenticationPrincipal proxied = new ProxyAuthenticationPrincipal(
- authorities
- .stream()
- .filter(aa -> !Strings.isNullOrEmpty(aa.getURI()))
- .map(AuthenticatingAuthority::getURI)
- .collect(Collectors.toUnmodifiableList()));
- subject.getPrincipals().add(proxied);
+ proxied.getAuthorities().addAll(
+ authorities
+ .stream()
+ .filter(aa -> !Strings.isNullOrEmpty(aa.getURI()))
+ .map(AuthenticatingAuthority::getURI)
+ .collect(Collectors.toUnmodifiableList()));
}
+ subject.getPrincipals().add(proxied);
if (attributeContext != null && !attributeContext.getIdPAttributes().isEmpty()) {
log.debug("{} Adding filtered inbound attributes to Subject", getLogPrefix());
@@ -274,8 +267,11 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
log.debug("{} Incoming SAML Attributes mapped to attribute IDs: {}", getLogPrefix(), mapped.keySet());
if (!mapped.isEmpty()) {
- attributeContext = new AttributeContext();
+ attributeContext = profileRequestContext
+ .getSubcontext(RelyingPartyContext.class)
+ .getSubcontext(AttributeContext.class, true);
attributeContext.setUnfilteredIdPAttributes(mapped.values());
+ attributeContext.setIdPAttributes(null);
filterAttributes(profileRequestContext);
}
}
@@ -318,12 +314,12 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
private void filterAttributes(@Nonnull final ProfileRequestContext profileRequestContext) {
if (attributeFilterService == null) {
log.warn("{} No AttributeFilter service provided", getLogPrefix());
- attributeContext.setIdPAttributes(null);
return;
}
- final AttributeFilterContext filterContext = samlAuthnContext.getSubcontext(AttributeFilterContext.class, true);
+ final AttributeFilterContext filterContext =
+ profileRequestContext.getSubcontext(AttributeFilterContext.class, true);
populateFilterContext(profileRequestContext, filterContext);
@@ -334,7 +330,6 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
if (null == component) {
log.error("{} Error while filtering inbound attributes: Invalid Attribute Filter configuration",
getLogPrefix());
- attributeContext.setIdPAttributes(null);
} else {
final AttributeFilter filter = component.getComponent();
filter.filterAttributes(filterContext);
@@ -343,7 +338,6 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
}
} catch (final AttributeFilterException e) {
log.error("{} Error while filtering inbound attributes", getLogPrefix(), e);
- attributeContext.setIdPAttributes(null);
} finally {
if (null != component) {
component.unpinComponent();
@@ -368,9 +362,8 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
new SAMLMetadataContextLookupFunction().compose(
new RecursiveTypedParentContextLookup<>(ProfileRequestContext.class)))
.setProxiedRequesterContextLookupStrategy(null)
- .setAttributeIssuerID(
- ((Assertion) samlAuthnContext.getAuthnStatement().getParent()).getIssuer().getValue())
- .setAttributeRecipientID(recipientIdLookupStrategy.apply(profileRequestContext));
+ .setAttributeIssuerID(getResponderLookupStrategy().apply(profileRequestContext))
+ .setAttributeRecipientID(getRequesterLookupStrategy().apply(profileRequestContext));
}
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list