[java-identity-provider] branch master updated: IDP-1494 - Login flow for proxied authentication
Scott Cantor
cantor.2 at osu.edu
Thu Oct 31 15:39:07 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=db947f7d14f8219ed57d0f19c3cc790033314c9b
The following commit(s) were added to refs/heads/master by this push:
new db947f7 IDP-1494 - Login flow for proxied authentication
db947f7 is described below
commit db947f7d14f8219ed57d0f19c3cc790033314c9b
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Oct 31 15:39:03 2019 -0400
IDP-1494 - Login flow for proxied authentication
https://issues.shibboleth.net/jira/browse/IDP-1494
Add proxy NameID c14n machinery.
---
.../ProxyAuthenticationLookupFunction.java | 50 ++++++++++++++++++
...nonicalizationContextSubjectLookupFunction.java | 40 +++++++++++++++
.../src/main/resources/conf/c14n/subject-c14n.xml | 60 +++++++++++++++++++---
.../resources/system/conf/subject-c14n-system.xml | 14 +++++
.../src/main/resources/system/conf/utilities.xml | 22 ++++++++
.../main/resources/system/conf/webflow-config.xml | 1 +
.../flows/c14n/subject-c14n-saml-default-beans.xml | 8 +++
7 files changed, 189 insertions(+), 6 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/ProxyAuthenticationLookupFunction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/ProxyAuthenticationLookupFunction.java
new file mode 100644
index 0000000..ddf1435
--- /dev/null
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/ProxyAuthenticationLookupFunction.java
@@ -0,0 +1,50 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.authn.context.navigate;
+
+import java.util.Collection;
+import java.util.Set;
+import java.util.function.Function;
+
+import javax.annotation.Nullable;
+import javax.security.auth.Subject;
+
+import net.shibboleth.idp.authn.principal.ProxyAuthenticationPrincipal;
+
+/**
+ * A function that returns the first value stored in a {@link ProxyAuthenticationPrincipal}
+ * contained in a {@link Subject}.
+ */
+public class ProxyAuthenticationLookupFunction implements Function<Subject,String> {
+
+ /** {@inheritDoc} */
+ @Nullable public String apply(@Nullable final Subject input) {
+
+ if (input != null) {
+ final Set<ProxyAuthenticationPrincipal> paps = input.getPrincipals(ProxyAuthenticationPrincipal.class);
+ if (!paps.isEmpty()) {
+ final Collection<String> idps = paps.iterator().next().getAuthorities();
+ if (!idps.isEmpty()) {
+ return idps.iterator().next();
+ }
+ }
+ }
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/SubjectCanonicalizationContextSubjectLookupFunction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/SubjectCanonicalizationContextSubjectLookupFunction.java
new file mode 100644
index 0000000..ee9a4b4
--- /dev/null
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/SubjectCanonicalizationContextSubjectLookupFunction.java
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.authn.context.navigate;
+
+import javax.annotation.Nullable;
+import javax.security.auth.Subject;
+
+import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
+
+import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
+
+/** A function that returns the {@link Subject} from a {@link SubjectCanonicalizationContext}. */
+public class SubjectCanonicalizationContextSubjectLookupFunction
+ implements ContextDataLookupFunction<SubjectCanonicalizationContext,Subject> {
+
+ /** {@inheritDoc} */
+ @Nullable public Subject apply(@Nullable final SubjectCanonicalizationContext input) {
+
+ if (input != null) {
+ return input.getSubject();
+ }
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-conf/src/main/resources/conf/c14n/subject-c14n.xml b/idp-conf/src/main/resources/conf/c14n/subject-c14n.xml
index dcc7e3a..e4b772f 100644
--- a/idp-conf/src/main/resources/conf/c14n/subject-c14n.xml
+++ b/idp-conf/src/main/resources/conf/c14n/subject-c14n.xml
@@ -16,12 +16,18 @@
<!--
These are lists of Subject Canonicalization flows that turn complex Subject data into a string-based
- principal name that the rest of the IdP can operate on. They're used both after authentication and
- during operations like SAML attribute queries, to map the SAML Subject into a principal name.
+ principal name that the rest of the IdP can operate on. They're used primarily after authentication
+ and also during less common operations like SAML attribute queries, to map the SAML Subject into a
+ principal name.
+
Flows are identified with an ID that corresponds to a Spring Web Flow subflow name.
-->
- <!-- Flows used after authentication to produce canonical principal name. -->
+ <!--
+ ====================================================================
+ Flows used after authentication to produce canonical principal name.
+ ====================================================================
+ -->
<util:list id="shibboleth.PostLoginSubjectCanonicalizationFlows">
<!--
This is an advanced post-login step that performs attribute resolution and then produces a username
@@ -32,6 +38,14 @@
<!-- <bean id="c14n/attribute" parent="shibboleth.PostLoginSubjectCanonicalizationFlow" /> -->
<!--
+ This is an advanced option for use with SAML 2 proxy authentication to a second IdP that
+ derives the principal name semi-directly from the incoming NameID value. It is functionally
+ akin to the c14n/SAML2Transform flow for SAML Request scenarios, but separately defined so
+ a suitably restrictive format list and/or condition can be applied to it.
+ -->
+ <!-- <ref bean="c14n/SAML2ProxyTransform" /> -->
+
+ <!--
This is an alternative that handles Subjects containing an X500Principal object and
allows extraction from the DN.
-->
@@ -45,9 +59,43 @@
<ref bean="c14n/simple" />
</util:list>
+ <!-- What SAML NameID formats do you want to support direct transformations for while proxying? -->
+ <util:list id="shibboleth.ProxyNameTransformFormats">
+ <value>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</value>
+ <value>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</value>
+ <value>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</value>
+ <value>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</value>
+ <value>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</value>
+ </util:list>
+
+ <!--
+ Under what conditions should direct NameID mapping during proxying be allowed? By default, never.
+ Any condition can be used here; the example is suitable for enumerating a number of IdPs to allow.
+ -->
+ <bean id="shibboleth.ProxyNameTransformPredicate" parent="shibboleth.Conditions.ProxyAuthentication">
+ <constructor-arg name="collection">
+ <list>
+ <!-- <value>https://idp-proxy.example.org</value> -->
+ </list>
+ </constructor-arg>
+ </bean>
+
+ <!--
+ Regular expression transforms to apply to incoming proxied subject names. The default empty list just
+ echoes the name through unmodified.
+ -->
+ <util:list id="shibboleth.ProxyNameTransforms">
+ <!--
+ <bean parent="shibboleth.Pair" p:first="^(.+)@example\.org$" p:second="$1" />
+ -->
+ </util:list>
+
+
<!--
- Flows used during SAML requests to reverse-map NameIdentifiers/NameIDs. The actual beans defining these
- flows are in a system file. Below the list are some settings that might be useful to adjust.
+ =======================================================================
+ Flows used during SAML requests to reverse-map NameIdentifiers/NameIDs.
+ Below the list are some settings that might be useful to adjust.
+ =======================================================================
-->
<util:list id="shibboleth.SAMLSubjectCanonicalizationFlows">
@@ -95,7 +143,7 @@
-->
<util:list id="shibboleth.NameTransforms">
<!--
- <bean parent="shibboleth.Pair" p:first="^(.+)@example\.edu$" p:second="$1" />
+ <bean parent="shibboleth.Pair" p:first="^(.+)@example\.org$" p:second="$1" />
-->
</util:list>
diff --git a/idp-conf/src/main/resources/system/conf/subject-c14n-system.xml b/idp-conf/src/main/resources/system/conf/subject-c14n-system.xml
index bdb63e4..36ee036 100644
--- a/idp-conf/src/main/resources/system/conf/subject-c14n-system.xml
+++ b/idp-conf/src/main/resources/system/conf/subject-c14n-system.xml
@@ -75,6 +75,20 @@
</bean>
</property>
</bean>
+
+ <bean id="c14n/SAML2ProxyTransform" parent="shibboleth.AbstractSAML2C14NFlowBean"
+ p:formats-ref="shibboleth.ProxyNameTransformFormats">
+ <property name="activationCondition">
+ <bean parent="shibboleth.Conditions.AND">
+ <constructor-arg>
+ <list>
+ <bean class="net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization.ActivationCondition" />
+ <ref bean="shibboleth.ProxyNameTransformPredicate" />
+ </list>
+ </constructor-arg>
+ </bean>
+ </property>
+ </bean>
<bean id="c14n/SAML1Transform" parent="shibboleth.AbstractSAML1C14NFlowBean"
p:formats-ref="shibboleth.NameTransformFormats">
diff --git a/idp-conf/src/main/resources/system/conf/utilities.xml b/idp-conf/src/main/resources/system/conf/utilities.xml
index 41d962f..ba7afe0 100644
--- a/idp-conf/src/main/resources/system/conf/utilities.xml
+++ b/idp-conf/src/main/resources/system/conf/utilities.xml
@@ -82,6 +82,28 @@
class="net.shibboleth.utilities.java.support.logic.StrategyIndirectedPredicate"
c:objectStrategy-ref="shibboleth.EntityDescriptorLookup.RelyingParty" />
+ <!-- Parent bean for building predicates acting over a candidate c14n Subject based on proxy authn. -->
+ <bean id="shibboleth.Conditions.ProxyAuthentication" abstract="true"
+ class="net.shibboleth.utilities.java.support.logic.StrategyIndirectedPredicate">
+ <constructor-arg name="objectStrategy">
+ <bean parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="net.shibboleth.idp.authn.context.navigate.ProxyAuthenticationLookupFunction" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <bean parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="net.shibboleth.idp.authn.context.navigate.SubjectCanonicalizationContextSubjectLookupFunction" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <ref bean="shibboleth.ChildLookup.SubjectCanonicalizationContext" />
+ </constructor-arg>
+ </bean>
+ </constructor-arg>
+ </bean>
+ </constructor-arg>
+ </bean>
+
<!-- Parent bean for building custom predicates that act on the principal name of the Subject. -->
<bean id="shibboleth.Conditions.SubjectName" abstract="true"
class="net.shibboleth.utilities.java.support.logic.StrategyIndirectedPredicate">
diff --git a/idp-conf/src/main/resources/system/conf/webflow-config.xml b/idp-conf/src/main/resources/system/conf/webflow-config.xml
index d3f5c66..b886ab1 100644
--- a/idp-conf/src/main/resources/system/conf/webflow-config.xml
+++ b/idp-conf/src/main/resources/system/conf/webflow-config.xml
@@ -110,6 +110,7 @@
<entry key="c14n/SAML2CryptoTransient" value="../system/flows/c14n/subject-c14n-saml-default-flow.xml" />
<entry key="c14n/SAML2Persistent" value="../system/flows/c14n/subject-c14n-saml-default-flow.xml" />
<entry key="c14n/SAML2Transform" value="../system/flows/c14n/subject-c14n-saml-default-flow.xml" />
+ <entry key="c14n/SAML2ProxyTransform" value="../system/flows/c14n/subject-c14n-saml-default-flow.xml" />
<entry key="c14n/SAML1Transient" value="../system/flows/c14n/subject-c14n-saml-default-flow.xml" />
<entry key="c14n/SAML1CryptoTransient" value="../system/flows/c14n/subject-c14n-saml-default-flow.xml" />
<entry key="c14n/SAML1Transform" value="../system/flows/c14n/subject-c14n-saml-default-flow.xml" />
diff --git a/idp-conf/src/main/resources/system/flows/c14n/subject-c14n-saml-default-beans.xml b/idp-conf/src/main/resources/system/flows/c14n/subject-c14n-saml-default-beans.xml
index 9767a64..b56206c 100644
--- a/idp-conf/src/main/resources/system/flows/c14n/subject-c14n-saml-default-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/c14n/subject-c14n-saml-default-beans.xml
@@ -48,6 +48,14 @@
</property>
</bean>
+ <bean id="Shibboleth.C14N.SAML2ProxyTransform"
+ class="net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization" scope="prototype">
+ <property name="decoder">
+ <bean class="net.shibboleth.idp.saml.nameid.impl.TransformingNameIDDecoder"
+ p:transforms-ref="shibboleth.ProxyNameTransforms" />
+ </property>
+ </bean>
+
<bean id="Shibboleth.C14N.SAML1Transient"
class="net.shibboleth.idp.saml.nameid.impl.NameIdentifierCanonicalization" scope="prototype">
<property name="decoder">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list