[java-identity-provider] branch main updated: Property conversion of SAML proxy flow.
Scott Cantor
cantor.2 at osu.edu
Mon Sep 14 21:11:45 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=68613bd97881cccac4b914ed3b095bd91050c416
The following commit(s) were added to refs/heads/main by this push:
new 68613bd97 Property conversion of SAML proxy flow.
68613bd97 is described below
commit 68613bd97881cccac4b914ed3b095bd91050c416
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Sep 14 17:11:37 2020 -0400
Property conversion of SAML proxy flow.
---
.../idp/flows/authn/saml-authn-beans.xml | 11 ++++---
.../shibboleth/idp/flows/authn/saml-authn-flow.xml | 3 +-
.../idp/module/authn/impl/module.properties | 2 +-
.../src/main/resources/conf/authn/authn.properties | 10 ++++++-
.../resources/conf/authn/saml-authn-config.xml | 35 ----------------------
.../saml2/profile/impl/SAMLAuthnController.java | 2 +-
6 files changed, 18 insertions(+), 45 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
index 921564b91..7cab050ef 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
@@ -17,14 +17,13 @@
<bean class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" />
- <bean id="shibboleth.authn.SAML.externalAuthnPath" class="java.lang.String"
- c:_0="servletRelative:%{idp.authn.saml.externalAuthnPath:/Authn/SAML2/POST/SSO}" />
+ <bean id="PropertyDrivenDiscovery" parent="shibboleth.Functions.Constant"
+ c:target="#{'%{idp.authn.SAML.proxyEntityID:}'.trim()}" />
- <!-- Default strategy function to obtain the external path. -->
<bean id="shibboleth.authn.SAML.externalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
- c:target-ref="shibboleth.authn.SAML.externalAuthnPath" />
+ c:target="#{getObject('shibboleth.authn.SAML.externalAuthnPath') ?: 'servletRelative:%{idp.authn.SAML.externalAuthnPath:/Authn/SAML2/POST/SSO}'.trim()}" />
- <import resource="%{idp.home}/conf/authn/saml-authn-config.xml" />
+ <import resource="conditional:%{idp.home}/conf/authn/saml-authn-config.xml" />
<!-- Parent beans for indirecting into nested PRC. -->
@@ -446,7 +445,7 @@
p:transcoderRegistry-ref="shibboleth.AttributeRegistryService"
p:attributeFilter-ref="shibboleth.AttributeFilterService"
p:metadataResolver-ref="shibboleth.MetadataResolver"
- p:addDefaultPrincipals="#{getObject('shibboleth.authn.SAML.addDefaultPrincipals') ?: false}"
+ p:addDefaultPrincipals="#{getObject('shibboleth.authn.SAML.addDefaultPrincipals') ?: %{idp.authn.SAML.addDefaultPrincipals:false}}"
p:resultCachingPredicate="#{getObject('shibboleth.authn.SAML.resultCachingPredicate')}"
p:attributeExtractionStrategy="#{getObject('shibboleth.authn.SAML.attributeExtractionStrategy')}" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-flow.xml
index f0fdf6ee5..92e1864e4 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-flow.xml
@@ -7,7 +7,8 @@
<on-start>
<!-- If installed, this can bypass discovery. -->
- <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.authn.SAML.discoveryFunction') ? opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).setAuthenticatingAuthority(flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.SAML.discoveryFunction').apply(opensamlProfileRequestContext)) : null" />
+ <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.authn.SAML.discoveryFunction') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.SAML.discoveryFunction') : PropertyDrivenDiscovery" result="flowScope.customDiscovery" />
+ <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).setAuthenticatingAuthority(customDiscovery.apply(opensamlProfileRequestContext))" />
</on-start>
<action-state id="Start">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties
index a9a369839..1f9bb1364 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties
@@ -62,7 +62,7 @@ idp.authn.X509.1.src = /net/shibboleth/idp/module/conf/authn/x509-authn-config.x
idp.authn.X509.1.dest = conf/authn/x509-authn-config.xml
idp.authn.X509.2.src = /net/shibboleth/idp/module/edit-webapp/x509-prompt.jsp
idp.authn.X509.2.dest = edit-webapp/x509-prompt.jsp
-idp.authn.X509.postenable = Customize edit-webapp/x509-prompt.jsp and rebuild war to deploy.
+idp.authn.X509.postenable = Customize edit-webapp/x509-prompt.jsp and rebuild war to deploy.
idp.authn.X509Internal.name = X509Internal Authentication
idp.authn.X509Internal.desc = Login flow for X.509 authentication with no redirects.
diff --git a/idp-conf/src/main/resources/conf/authn/authn.properties b/idp-conf/src/main/resources/conf/authn/authn.properties
index d6db56478..55c92f892 100644
--- a/idp-conf/src/main/resources/conf/authn/authn.properties
+++ b/idp-conf/src/main/resources/conf/authn/authn.properties
@@ -75,7 +75,7 @@ idp.authn.External.externalAuthnPath = contextRelative:external.jsp
#idp.authn.RemoteUserInternal.Trim = true
#idp.authn.RemoteUserInternal.Lowercase = false
#idp.authn.RemoteUserInternal.Uppercase = false
-idp.authn.RemoteUserInternal.allowedUsernames = bar, baz
+#idp.authn.RemoteUserInternal.allowedUsernames =
#idp.authn.RemoteUserInternal.deniedUsernames =
#### SPNEGO ####
@@ -154,7 +154,15 @@ idp.authn.Duo.supportedPrincipals = \
#idp.authn.SAML.passiveAuthenticationSupported = true
#idp.authn.SAML.forcedAuthenticationSupported = true
#idp.authn.SAML.proxyScopingEnforced = true
+# Discovery options:
+# Define shibboleth.authn.SAML.discoveryFunction bean
+# Set proxyEntityID property
+# Fall through to discovery via discoveryRequired property
+#idp.authn.SAML.proxyEntityID = https://idp.example.org/idp/shibboleth
#idp.authn.SAML.discoveryRequired = true
+# Generally left false with bidirectional mappings in
+# conf/authn/authn-comparison.xml across the proxy boundary.
+#idp.authn.SAML.addDefaultPrincipals = false
#### MFA ####
diff --git a/idp-conf/src/main/resources/conf/authn/saml-authn-config.xml b/idp-conf/src/main/resources/conf/authn/saml-authn-config.xml
deleted file mode 100644
index 4ff55f94e..000000000
--- a/idp-conf/src/main/resources/conf/authn/saml-authn-config.xml
+++ /dev/null
@@ -1,35 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <!--
- Optional Function<ProfileRequest,String> to supply name of proxied IdP,
- otherwise flow assumes IdP discovery has been performed already.
- -->
- <!--
- <bean id="shibboleth.authn.SAML.discoveryFunction" parent="shibboleth.Functions.Constant"
- c:target="https://idp.example.org/idp/shibboleth" />
- -->
-
- <!--
- Add authentication flow descriptor's supportedPrincipals collection to the
- resulting Subject? This may be problematic if it happens without regard for
- the information returned in the assertion from the IdP, so changing this is
- likely to lead to violations of intent.
-
- Usually this should be left FALSE, and appropriate bidirectional mappings defined
- via conf/authn/authn-comparison.xml to translate across the proxy boundary.
- -->
- <util:constant id="shibboleth.authn.SAML.addDefaultPrincipals" static-field="java.lang.Boolean.FALSE"/>
-
-</beans>
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
index c214ef287..eb5da9d47 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
@@ -63,7 +63,7 @@ import org.springframework.web.bind.annotation.RequestMapping;
* @since 4.0.0
*/
@Controller
- at RequestMapping("%{idp.authn.saml.externalAuthnPath:/Authn/SAML2}")
+ at RequestMapping("%{idp.authn.SAML.externalAuthnPath:/Authn/SAML2}")
public class SAMLAuthnController extends AbstractInitializableComponent {
/** Class logger. */
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list