[java-identity-provider] 01/02: Add SAML Response message handling to SAML authn flow.

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=e5809896a8b001237adf52b26bbe0c3b34340028

commit e5809896a8b001237adf52b26bbe0c3b34340028
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Dec 11 23:00:45 2019 -0500

    Add SAML Response message handling to SAML authn flow.
---
 .../system/flows/authn/saml-authn-beans.xml        | 40 ++++++++++++++++++++++
 .../system/flows/authn/saml-authn-flow.xml         |  1 +
 .../saml2/profile/impl/SAMLAuthnController.java    |  6 +++-
 3 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml
index c935c25..7d5556b 100644
--- a/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml
@@ -232,6 +232,46 @@
         </constructor-arg>
     </bean>
 
+    <bean id="HandleResponse" parent="NestedWebFlowMessageHandlerAdaptor" scope="prototype" c:executionDirection="INBOUND">
+        <constructor-arg>
+            <bean class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
+                <property name="handlers">
+                    <list>
+                        <bean class="org.opensaml.saml.common.binding.impl.CheckMessageVersionHandler" scope="prototype"
+                            p:ignoreMissingOrUnrecognized="true" />
+                        <bean class="org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler" scope="prototype"
+                            p:protocol-ref="shibboleth.MetadataLookup.Protocol"
+                            p:role-ref="shibboleth.MetadataLookup.Role" />
+                        <bean class="org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler" scope="prototype">
+                            <property name="roleDescriptorResolver">
+                                <bean class="org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver"
+                                      c:mdResolver-ref="shibboleth.MetadataResolver" />
+                            </property>
+                        </bean>
+                        <bean class="org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler" scope="prototype"
+                            p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
+                        <bean class="org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler" scope="prototype"
+                            p:replayCache-ref="shibboleth.ReplayCache"
+                            p:expires="%{idp.policy.messageLifetime:PT3M}" />
+                        <bean class="org.opensaml.saml.common.binding.security.impl.MessageLifetimeSecurityHandler" scope="prototype"
+                            p:messageLifetime="%{idp.policy.messageLifetime:PT3M}"
+                            p:clockSkew="%{idp.policy.clockSkew:PT3M}" />
+                        <bean class="org.opensaml.saml.common.binding.security.impl.SAMLProtocolMessageXMLSignatureSecurityHandler" scope="prototype" />
+                        <bean class="org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPPostSimpleSignSecurityHandler" scope="prototype"
+                            p:httpServletRequest-ref="shibboleth.HttpServletRequest"
+                            p:parser-ref="shibboleth.ParserPool"
+                            p:keyInfoResolver-ref="shibboleth.KeyInfoCredentialResolver" />
+                        <bean class="org.opensaml.messaging.handler.impl.CheckMandatoryIssuer" scope="prototype">
+                            <property name="issuerLookupStrategy">
+                                <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLMessageContextIssuerFunction" />
+                            </property>
+                        </bean>
+                    </list>
+                </property>
+		     </bean>
+        </constructor-arg>
+    </bean>
+
     <bean id="PopulateDecryptionParameters" parent="NestedWebFlowProfileActionAdaptor" scope="prototype">
         <constructor-arg>
 		    <bean class="org.opensaml.profile.action.impl.PopulateDecryptionParameters"
diff --git a/idp-conf/src/main/resources/system/flows/authn/saml-authn-flow.xml b/idp-conf/src/main/resources/system/flows/authn/saml-authn-flow.xml
index ea4b579..53d8d5e 100644
--- a/idp-conf/src/main/resources/system/flows/authn/saml-authn-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/saml-authn-flow.xml
@@ -59,6 +59,7 @@
         <evaluate expression="ContinueSAMLAuthentication" />
         <evaluate expression="PopulateSignatureValidationParameters" />
         <evaluate expression="PopulateClientTLSValidationParameters" />
+        <evaluate expression="HandleResponse" />
         <evaluate expression="PopulateDecryptionParameters" />
         <evaluate expression="DecryptAssertions" />
         <evaluate expression="DecryptNameIDs" />
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
index 99326bd..c214ef2 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
@@ -34,6 +34,7 @@ import net.shibboleth.utilities.java.support.component.ComponentInitializationEx
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 
+import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.messaging.decoder.MessageDecoder;
 import org.opensaml.messaging.decoder.MessageDecodingException;
@@ -42,6 +43,7 @@ import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.EventContext;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.saml.common.binding.SAMLBindingSupport;
+import org.opensaml.saml.common.messaging.context.SAMLMessageReceivedEndpointContext;
 import org.opensaml.saml.saml2.core.AuthnRequest;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -224,7 +226,9 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
             try {
                 decoder.initialize();
                 decoder.decode();
-                nestedPRC.setInboundMessageContext(decoder.getMessageContext());
+                final MessageContext messageContext = decoder.getMessageContext();
+                messageContext.addSubcontext(new SAMLMessageReceivedEndpointContext(httpRequest));
+                nestedPRC.setInboundMessageContext(messageContext);
             } finally {
                 decoder.destroy();
             }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.