[java-identity-provider] branch master updated: Bug fix for IDP-1602.
Daniel Fisher
dfisher at vt.edu
Fri May 22 02:49:43 UTC 2020
This is an automated email from the git hooks/post-receive script.
dfisher pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=ec1b0e85701e748357463c360c9cba4ce2913d19
The following commit(s) were added to refs/heads/master by this push:
new ec1b0e857 Bug fix for IDP-1602.
ec1b0e857 is described below
commit ec1b0e85701e748357463c360c9cba4ce2913d19
Author: Daniel Fisher <dfisher at vt.edu>
AuthorDate: Thu May 21 22:45:38 2020 -0400
Bug fix for IDP-1602.
In cases where a SASLConfig is defined without a principal, make sure the connection initializer is added.
Emit log warning for unsupported mechanisms instead of throwing.
Add additional test coverage.
---
.../dc/ldap/impl/LDAPDataConnectorParser.java | 37 ++++++++++---
.../dc/ldap/LDAPDataConnectorParserTest.java | 61 ++++++++++++++++++++++
...ap-attribute-resolver-v2-authenticationType.xml | 19 +++++++
.../ldap-attribute-resolver-v2-external.xml | 17 ++++++
.../schema/shibboleth-attribute-resolver.xsd | 3 +-
5 files changed, 130 insertions(+), 7 deletions(-)
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
index f44f878b4..ad1f07848 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
@@ -288,20 +288,32 @@ public class LDAPDataConnectorParser extends AbstractDataConnectorParser {
credential.addConstructorArgValue(principalCredential);
connectionInitializer.addPropertyValue("bindCredential", credential.getBeanDefinition());
}
+ BeanDefinition saslConfig = null;
if (authenticationType != null) {
// V4 Deprecation
DeprecationSupport.warn(ObjectType.ATTRIBUTE, "authenticationType", "<LDAPDirectory>",
"<SaslConfig>");
final Mechanism mechanism = Mechanism.valueOf(authenticationType);
- if (mechanism != null) {
- final SaslConfig config = new SaslConfig();
- config.setMechanism(mechanism);
- connectionInitializer.addPropertyValue("bindSaslConfig", config);
+ if ("ANONYMOUS".equals(authenticationType)) {
+ log.warn("{} Ignoring unsupported authenticationType {}. " +
+ "Do not set bind credentials for anonymous authentication", getLogPrefix(), mechanism);
+ } else if ("STRONG".equals(authenticationType)) {
+ log.warn("{} Ignoring unsupported authenticationType {}.", getLogPrefix(), mechanism);
+ } else if ("SIMPLE".equals(authenticationType)) {
+ log.warn("{} Ignoring unsupported authenticationType {}. " +
+ "Set bind credentials for simple authentication", getLogPrefix(), mechanism);
+ } else {
+ final BeanDefinitionBuilder saslConfigBuilder =
+ BeanDefinitionBuilder.rootBeanDefinition(V2Parser.class, "buildSaslConfig");
+ saslConfigBuilder.addConstructorArgValue(authenticationType);
+ saslConfig = saslConfigBuilder.getBeanDefinition();
+ connectionInitializer.addPropertyValue("bindSaslConfig", saslConfig);
}
} else {
- connectionInitializer.addPropertyValue("bindSaslConfig", createSaslConfig());
+ saslConfig = createSaslConfig();
+ connectionInitializer.addPropertyValue("bindSaslConfig", saslConfig);
}
- if (principal != null || principalCredential != null || authenticationType != null) {
+ if (principal != null || principalCredential != null || saslConfig != null) {
connectionConfig.addPropertyValue("connectionInitializer", connectionInitializer.getBeanDefinition());
}
final String connectionStrategy = AttributeSupport.getAttributeValue(
@@ -903,5 +915,18 @@ public class LDAPDataConnectorParser extends AbstractDataConnectorParser {
}
return null;
}
+
+ /**
+ * Returns a SASL configuration for the supplied mechanism.
+ *
+ * @param mechanism SASL mechanism
+ *
+ * @return SASL config
+ */
+ @Nonnull public static SaslConfig buildSaslConfig(@Nonnull final String mechanism) {
+ final SaslConfig config = new SaslConfig();
+ config.setMechanism(Mechanism.valueOf(mechanism));
+ return config;
+ }
}
}
\ No newline at end of file
diff --git a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java
index 4dc943636..2d6a4a441 100644
--- a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java
+++ b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java
@@ -40,6 +40,7 @@ import com.unboundid.ldap.sdk.LDAPResult;
import com.unboundid.ldap.sdk.ResultCode;
import org.ldaptive.BindConnectionInitializer;
import org.ldaptive.ConnectionConfig;
+import org.ldaptive.Credential;
import org.ldaptive.DefaultConnectionFactory;
import org.ldaptive.SearchExecutor;
import org.ldaptive.pool.BlockingConnectionPool;
@@ -142,6 +143,20 @@ public class LDAPDataConnectorParserTest {
return new BindResult(new LDAPResult(messageID, ResultCode.SUCCESS));
}
});
+ config.addSASLBindHandler(new InMemorySASLBindHandler() {
+ @Override
+ public String getSASLMechanismName() {
+ return "EXTERNAL";
+ }
+
+ @Override
+ public BindResult processSASLBind(final InMemoryRequestHandler handler, final int messageID,
+ final DN bindDN, final ASN1OctetString credentials,
+ final List<Control> controls) {
+ // return success for all EXTERNAL bind requests
+ return new BindResult(new LDAPResult(messageID, ResultCode.SUCCESS));
+ }
+ });
directoryServer = new InMemoryDirectoryServer(config);
directoryServer.importFromLDIF(true,
"src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/ldapDataConnectorTest.ldif");
@@ -366,6 +381,8 @@ public class LDAPDataConnectorParserTest {
assertNotNull(connConfig);
final BindConnectionInitializer connInitializer = (BindConnectionInitializer) connConfig.getConnectionInitializer();
assertNotNull(connInitializer);
+ assertEquals(connInitializer.getBindDn(), "manager at shibboleth.net");
+ assertEquals(connInitializer.getBindCredential().getString(), "password");
final SaslConfig saslConfig = connInitializer.getBindSaslConfig();
assertNotNull(saslConfig);
assertEquals(saslConfig.getMechanism(), Mechanism.DIGEST_MD5);
@@ -376,6 +393,30 @@ public class LDAPDataConnectorParserTest {
assertEquals(((DigestMd5Config) saslConfig).getRealm(), "shibboleth.net");
}
+ @Test public void v2AuthenticationTypeConfig() throws Exception {
+ final LDAPDataConnector dataConnector =
+ getLdapDataConnector(new String[] {"net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-authenticationType.xml"});
+ assertNotNull(dataConnector);
+ assertTrue(dataConnector.isFailFastInitialize());
+ assertEquals(dataConnector.getNoRetryDelay(), Duration.ZERO);
+
+ final DefaultConnectionFactory connFactory = (DefaultConnectionFactory) dataConnector.getConnectionFactory();
+ assertNotNull(connFactory);
+ final ConnectionConfig connConfig = connFactory.getConnectionConfig();
+ assertNotNull(connConfig);
+ final BindConnectionInitializer connInitializer = (BindConnectionInitializer) connConfig.getConnectionInitializer();
+ assertNotNull(connInitializer);
+ assertEquals(connInitializer.getBindDn(), "manager at shibboleth.net");
+ assertEquals(connInitializer.getBindCredential().getString(), "password");
+ final SaslConfig saslConfig = connInitializer.getBindSaslConfig();
+ assertNotNull(saslConfig);
+ assertEquals(saslConfig.getMechanism(), Mechanism.DIGEST_MD5);
+ assertEquals(saslConfig.getAuthorizationId(), "");
+ assertNull(saslConfig.getMutualAuthentication());
+ assertNull(saslConfig.getQualityOfProtection());
+ assertNull(saslConfig.getSecurityStrength());
+ }
+
@Test public void v2ReferralConfig() throws Exception {
final LDAPDataConnector dataConnector =
getLdapDataConnector(new String[] {"net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-referral.xml"});
@@ -401,6 +442,26 @@ public class LDAPDataConnectorParserTest {
assertNotNull(referralHandler);
}
+ @Test public void v2SaslExternalConfig() throws Exception {
+ final LDAPDataConnector dataConnector =
+ getLdapDataConnector(new String[] {"net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-external.xml"});
+ assertNotNull(dataConnector);
+ assertTrue(dataConnector.isFailFastInitialize());
+ assertEquals(dataConnector.getNoRetryDelay(), Duration.ZERO);
+
+ final DefaultConnectionFactory connFactory = (DefaultConnectionFactory) dataConnector.getConnectionFactory();
+ assertNotNull(connFactory);
+ final ConnectionConfig connConfig = connFactory.getConnectionConfig();
+ assertNotNull(connConfig);
+ final BindConnectionInitializer connInitializer = (BindConnectionInitializer) connConfig.getConnectionInitializer();
+ assertNotNull(connInitializer);
+ assertNull(connInitializer.getBindDn());
+ assertNull(connInitializer.getBindCredential());
+ final SaslConfig saslConfig = connInitializer.getBindSaslConfig();
+ assertNotNull(saslConfig);
+ assertEquals(saslConfig.getMechanism(), Mechanism.EXTERNAL);
+ }
+
@Test public void springConfig() throws Exception {
final LDAPDataConnector dataConnector =
getLdapDataConnector(new String[] {"net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-spring.xml"});
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-authenticationType.xml b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-authenticationType.xml
new file mode 100644
index 000000000..01ba1c5b1
--- /dev/null
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-authenticationType.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<AttributeResolver
+ xmlns="urn:mace:shibboleth:2.0:resolver" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd">
+
+ <DataConnector id="myLDAP" xsi:type="LDAPDirectory"
+ ldapURL="ldap://localhost:10389"
+ principal="manager at shibboleth.net"
+ failFastInitialize="true"
+ principalCredential="password"
+ authenticationType="DIGEST_MD5">
+ <FilterTemplate>
+ <![CDATA[
+ (uid=${resolutionContext.principal})
+ ]]>
+ </FilterTemplate>
+ </DataConnector>
+
+</AttributeResolver>
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-external.xml b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-external.xml
new file mode 100644
index 000000000..2725a345c
--- /dev/null
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-external.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<AttributeResolver
+ xmlns="urn:mace:shibboleth:2.0:resolver" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd">
+
+ <DataConnector id="myLDAP" xsi:type="LDAPDirectory"
+ ldapURL="ldap://localhost:10389"
+ failFastInitialize="true">
+ <FilterTemplate>
+ <![CDATA[
+ (uid=${resolutionContext.principal})
+ ]]>
+ </FilterTemplate>
+ <SaslConfig mechanism="EXTERNAL" />
+ </DataConnector>
+
+</AttributeResolver>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
index 61e180174..53fd30562 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
@@ -851,6 +851,7 @@
<attribute name="authenticationType" type="resolver:AuthenticationType">
<annotation>
<documentation>
+ DEPRECATED
The LDAP authentication type. Acceptable values are ANONYMOUS, SIMPLE, STRONG, EXTERNAL, DIGEST_MD5, CRAM_MD5, GSSAPI.
Default value is SIMPLE.
</documentation>
@@ -1760,7 +1761,7 @@
<annotation>
<documentation>
Ldap compare filter to use for connection validation.
- Used in conjuction with validateDN to perform a compare.
+ Used in conjunction with validateDN to perform a compare.
Default value is (objectClass=*).
</documentation>
</annotation>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list