[cpp-sp] branch master updated: SSPCPP-883 - Allow blocking of unsolicited SSO

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=7b289cb81cff431d3feb0641acf501b979d065cc

The following commit(s) were added to refs/heads/master by this push:
       new  7b289cb   SSPCPP-883 - Allow blocking of unsolicited SSO
7b289cb is described below

commit 7b289cb81cff431d3feb0641acf501b979d065cc
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Feb 14 16:48:29 2020 -0500

    SSPCPP-883 - Allow blocking of unsolicited SSO
    
    https://issues.shibboleth.net/jira/browse/SSPCPP-883
    
    Add second policy to block unsolicited SSO.
---
 configs/security-policy.xml    | 2 +-
 shibsp/impl/XMLApplication.cpp | 8 --------
 2 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/configs/security-policy.xml b/configs/security-policy.xml
index 0ff8558..066eb1c 100644
--- a/configs/security-policy.xml
+++ b/configs/security-policy.xml
@@ -26,7 +26,7 @@
         <PolicyRule type="ClientCertAuth" errorFatal="true"/>
         <PolicyRule type="XMLSigning" errorFatal="true"/>
         <PolicyRule type="SimpleSigning" errorFatal="true"/>
-        <PolicyRule type="Bearer"/>
+        <PolicyRule type="Bearer" blockUnsolicited="true"/>
     </Policy>
 
   <!--
diff --git a/shibsp/impl/XMLApplication.cpp b/shibsp/impl/XMLApplication.cpp
index 20a9d6d..f2a2154 100644
--- a/shibsp/impl/XMLApplication.cpp
+++ b/shibsp/impl/XMLApplication.cpp
@@ -83,7 +83,6 @@ namespace {
     static const XMLCh _Audience[] =            UNICODE_LITERAL_8(A,u,d,i,e,n,c,e);
     static const XMLCh Binding[] =              UNICODE_LITERAL_7(B,i,n,d,i,n,g);
     static const XMLCh Channel[]=               UNICODE_LITERAL_7(C,h,a,n,n,e,l);
-    static const XMLCh checkCorrelation[] =     UNICODE_LITERAL_16(c,h,e,c,k,C,o,r,r,e,l,a,t,i,o,n);
     static const XMLCh _CredentialResolver[] =  UNICODE_LITERAL_18(C,r,e,d,e,n,t,i,a,l,R,e,s,o,l,v,e,r);
     static const XMLCh _default[] =             UNICODE_LITERAL_7(d,e,f,a,u,l,t);
     static const XMLCh ExternalApplicationOverrides[] = UNICODE_LITERAL_28(E,x,t,e,r,n,a,l,A,p,p,l,i,c,a,t,i,o,n,O,v,e,r,r,i,d,e,s);
@@ -558,9 +557,6 @@ void XMLApplication::doHandlers(const ProtocolProvider* pp, const DOMElement* e,
                     child = XMLHelper::getNextSiblingElement(child);
                     continue;
                 }
-                // Somewhat icky; we disable request/response correlation by default by injecting an attribute
-                // to be picked up by the auto-added BEARER policy rule that's wrapped around this same element.
-                child->setAttributeNS(nullptr, checkCorrelation, xmlconstants::XML_ZERO);
                 handler.reset(
                     conf.AssertionConsumerServiceManager.newPlugin(bindprop.c_str(), pair<const DOMElement*,const char*>(child, getId()), m_deprecationSupport)
                     );
@@ -760,10 +756,6 @@ void XMLApplication::doSSO(const ProtocolProvider& pp, set<string>& protocols, D
                 if (idprop.first && pathprop.first) {
                     DOMElement* acsdom = e->getOwnerDocument()->createElementNS(samlconstants::SAML20MD_NS, _AssertionConsumerService);
 
-                    // Somewhat icky; we disable request/response correlation by default by injecting an attribute
-                    // to be picked up by the auto-added BEARER policy rule that's wrapped around this same element.
-                    acsdom->setAttributeNS(nullptr, checkCorrelation, xmlconstants::XML_ZERO);
-
                     // Copy in any attributes from the <SSO> element so they can be accessed as properties in the ACS handler,
                     // since the handlers aren't attached to the SSO element.
                     for (XMLSize_t p = 0; p < ssopropslen; ++p) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.