[java-identity-provider] branch master updated: IDP-1618 - Generalize the expiring-password interceptor
Scott Cantor
cantor.2 at osu.edu
Tue Jun 16 19:47:22 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=9858fbd6ef3077eb34b58e00b232afa8e4449934
The following commit(s) were added to refs/heads/master by this push:
new 9858fbd6e IDP-1618 - Generalize the expiring-password interceptor
9858fbd6e is described below
commit 9858fbd6ef3077eb34b58e00b232afa8e4449934
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jun 16 15:47:19 2020 -0400
IDP-1618 - Generalize the expiring-password interceptor
https://issues.shibboleth.net/jira/browse/IDP-1618
---
.../resources/conf/intercept/profile-intercept.xml | 2 +
.../conf/intercept/warning-intercept-config.xml | 49 +++++++++++++++++
.../main/resources/system/conf/webflow-config.xml | 1 +
.../system/flows/intercept/warning-beans.xml | 28 ++++++++++
.../system/flows/intercept/warning-flow.xml | 61 ++++++++++++++++++++++
5 files changed, 141 insertions(+)
diff --git a/idp-conf/src/main/resources/conf/intercept/profile-intercept.xml b/idp-conf/src/main/resources/conf/intercept/profile-intercept.xml
index 736e7bf6e..706bbf2ec 100644
--- a/idp-conf/src/main/resources/conf/intercept/profile-intercept.xml
+++ b/idp-conf/src/main/resources/conf/intercept/profile-intercept.xml
@@ -35,6 +35,8 @@
<bean id="intercept/impersonate" parent="shibboleth.InterceptFlow" />
<bean id="intercept/external" parent="shibboleth.InterceptFlow" />
+
+ <bean id="intercept/warning" parent="shibboleth.InterceptFlow" />
</list>
</property>
</bean>
diff --git a/idp-conf/src/main/resources/conf/intercept/warning-intercept-config.xml b/idp-conf/src/main/resources/conf/intercept/warning-intercept-config.xml
new file mode 100644
index 000000000..86cf57f92
--- /dev/null
+++ b/idp-conf/src/main/resources/conf/intercept/warning-intercept-config.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <!--
+ The map keys are the names of view templates to render if the condition evaluates to true.
+
+ The values are of type Pair<Predicate<ProfileRequestContext>,Duration>. The condition determines whether
+ the warning is displayed, and the duration is the interval between warnings.
+ -->
+ <util:map id="shibboleth.warning.ConditionMap">
+ <!--
+ <entry key="warn-one">
+ <bean parent="shibboleth.Pair">
+ <constructor-arg index="0">
+ <bean parent="shibboleth.Conditions.TRUE" />
+ </constructor-arg>
+ <constructor-arg index="1">
+ <bean class="java.time.Duration" factory-method="parse" c:_0="PT8H" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry key="warn-two">
+ <bean parent="shibboleth.Pair">
+ <constructor-arg index="0">
+ <bean parent="shibboleth.Conditions.TRUE" />
+ </constructor-arg>
+ <constructor-arg index="1">
+ <bean class="java.time.Duration" factory-method="parse" c:_0="PT0S" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ -->
+ </util:map>
+
+ <!-- Prefix of cookie name to track when user was last warned. -->
+ <bean id="shibboleth.warning.NotifyCookiePrefix" class="java.lang.String" c:_0="shib_idp_warn_" />
+
+</beans>
diff --git a/idp-conf/src/main/resources/system/conf/webflow-config.xml b/idp-conf/src/main/resources/system/conf/webflow-config.xml
index 01b8c4976..69b5757ea 100644
--- a/idp-conf/src/main/resources/system/conf/webflow-config.xml
+++ b/idp-conf/src/main/resources/system/conf/webflow-config.xml
@@ -129,6 +129,7 @@
<entry key="intercept/attribute-release-query" value="../system/flows/intercept/attribute-release-query-flow.xml" />
<entry key="intercept/impersonate" value="../system/flows/intercept/impersonate-flow.xml" />
<entry key="intercept/external" value="../system/flows/intercept/external-flow.xml" />
+ <entry key="intercept/warning" value="../system/flows/intercept/warning-flow.xml" />
<!-- Inbound security processing of SAML messages, implemented as intercept flows. -->
<entry key="security-policy.abstract" value="../system/flows/saml/security-abstract-flow.xml" />
diff --git a/idp-conf/src/main/resources/system/flows/intercept/warning-beans.xml b/idp-conf/src/main/resources/system/flows/intercept/warning-beans.xml
new file mode 100644
index 000000000..314452cec
--- /dev/null
+++ b/idp-conf/src/main/resources/system/flows/intercept/warning-beans.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"
+ p:placeholderPrefix="%{" p:placeholderSuffix="}" />
+
+ <bean class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" />
+ <bean class="net.shibboleth.idp.profile.impl.ProfileActionBeanPostProcessor" />
+
+ <import resource="../../../conf/intercept/warning-intercept-config.xml" />
+
+ <!-- Simplifies flow definition expressions. -->
+ <alias name="shibboleth.warning.ConditionMap" alias="WarningConditionMap" />
+ <alias name="shibboleth.PersistentCookieManager" alias="WarningCookieManager" />
+ <alias name="shibboleth.warning.NotifyCookiePrefix" alias="WarningCookiePrefix" />
+
+</beans>
diff --git a/idp-conf/src/main/resources/system/flows/intercept/warning-flow.xml b/idp-conf/src/main/resources/system/flows/intercept/warning-flow.xml
new file mode 100644
index 000000000..b5ec18bf2
--- /dev/null
+++ b/idp-conf/src/main/resources/system/flows/intercept/warning-flow.xml
@@ -0,0 +1,61 @@
+ <flow xmlns="http://www.springframework.org/schema/webflow"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
+ parent="intercept.abstract">
+
+ <!-- Rudimentary impediment to direct execution of subflow. -->
+ <input name="calledAsSubflow" type="boolean" required="true" />
+
+ <on-start>
+ <evaluate expression="WarningConditionMap.entrySet().iterator()" result="flowScope.WarningIterator" />
+ </on-start>
+
+ <decision-state id="CheckIterator">
+ <if test="WarningIterator.hasNext()" then="CheckCondition" else="proceed" />
+ </decision-state>
+
+ <!-- If the condition is true, we don't need to notify, otherwise check cookie to see if we do. -->
+ <decision-state id="CheckCondition">
+ <on-entry>
+ <evaluate expression="WarningIterator.next()" result="flowScope.WarningEntry" />
+ <evaluate expression="WarningCookiePrefix + WarningEntry.getKey()" result="flowScope.WarningCookieName" />
+ </on-entry>
+ <if test="WarningEntry.getValue().getFirst().test(opensamlProfileRequestContext)"
+ then="CheckCookie" else="ShouldUnsetCookie" />
+ </decision-state>
+
+ <decision-state id="ShouldUnsetCookie">
+ <if test="WarningCookieManager.getCookieValue(WarningCookieName, null) != null"
+ then="UnsetCookie" else="CheckIterator" />
+ </decision-state>
+
+ <action-state id="UnsetCookie">
+ <evaluate expression="WarningCookieManager.unsetCookie(WarningCookieName)" />
+ <transition to="CheckIterator" />
+ </action-state>
+
+ <decision-state id="CheckCookie">
+ <if test="T(java.lang.System).currentTimeMillis() - T(java.lang.Long).parseLong(WarningCookieManager.getCookieValue(WarningCookieName, '0')) > WarningEntry.getValue().getSecond().toMillis()"
+ then="DisplayWarningView" else="CheckIterator" />
+ </decision-state>
+
+ <view-state id="DisplayWarningView" view="intercept/#{WarningEntry.getKey()}">
+ <attribute name="csrf_excluded" value="true" type="boolean"/>
+ <on-render>
+ <evaluate expression="WarningCookieManager.addCookie(WarningCookieName, T(java.lang.Long).toString(T(java.lang.System).currentTimeMillis()))" />
+ <evaluate expression="environment" result="viewScope.environment" />
+ <evaluate expression="T(net.shibboleth.utilities.java.support.codec.HTMLEncoder)" result="viewScope.encoder" />
+ <evaluate expression="flowRequestContext.getExternalContext().getNativeRequest()" result="viewScope.request" />
+ <evaluate expression="flowRequestContext.getExternalContext().getNativeResponse()" result="viewScope.response" />
+ <evaluate expression="opensamlProfileRequestContext" result="viewScope.profileRequestContext" />
+ <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" result="viewScope.custom" />
+ </on-render>
+
+ <transition to="CheckIterator" />
+ </view-state>
+
+ <end-state id="proceed" />
+
+ <bean-import resource="warning-beans.xml" />
+
+</flow>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list