[java-identity-provider] branch main updated: MFA login module, remove some uninteresting authn.properties.
Scott Cantor
cantor.2 at osu.edu
Mon Sep 14 23:20:19 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=cdca5137a819ce3d6d568296a0e4381980d477b6
The following commit(s) were added to refs/heads/main by this push:
new cdca5137a MFA login module, remove some uninteresting authn.properties.
cdca5137a is described below
commit cdca5137a819ce3d6d568296a0e4381980d477b6
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Sep 14 19:20:11 2020 -0400
MFA login module, remove some uninteresting authn.properties.
---
.../net/shibboleth/idp/module/authn/impl/MFA.java | 41 ++++++++++++++++++++++
.../services/net.shibboleth.idp.module.IdPModule | 1 +
.../shibboleth/idp/flows/authn/mfa-authn-beans.xml | 2 +-
.../idp/module/authn/impl/module.properties | 7 ++++
.../idp/module}/conf/authn/mfa-authn-config.xml | 0
.../src/main/resources/conf/authn/authn.properties | 9 ++---
6 files changed, 52 insertions(+), 8 deletions(-)
diff --git a/idp-conf-impl/src/main/java/net/shibboleth/idp/module/authn/impl/MFA.java b/idp-conf-impl/src/main/java/net/shibboleth/idp/module/authn/impl/MFA.java
new file mode 100644
index 000000000..51db8415d
--- /dev/null
+++ b/idp-conf-impl/src/main/java/net/shibboleth/idp/module/authn/impl/MFA.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.module.authn.impl;
+
+import java.io.IOException;
+
+import net.shibboleth.idp.module.IdPModule;
+import net.shibboleth.idp.module.ModuleException;
+import net.shibboleth.idp.module.PropertyDrivenIdPModule;
+
+/**
+ * {@link IdPModule} implementation.
+ */
+public final class MFA extends PropertyDrivenIdPModule {
+
+ /**
+ * Constructor.
+ *
+ * @throws ModuleException on error
+ * @throws IOException on error
+ */
+ public MFA() throws IOException, ModuleException {
+ super(MFA.class);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule b/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
index 42f2edf09..06926e514 100644
--- a/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
+++ b/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
@@ -2,6 +2,7 @@ net.shibboleth.idp.module.authn.impl.Duo
net.shibboleth.idp.module.authn.impl.External
net.shibboleth.idp.module.authn.impl.Function
net.shibboleth.idp.module.authn.impl.IPAddress
+net.shibboleth.idp.module.authn.impl.MFA
net.shibboleth.idp.module.authn.impl.RemoteUser
net.shibboleth.idp.module.authn.impl.RemoteUserInternal
net.shibboleth.idp.module.authn.impl.SPNEGO
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/mfa-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/mfa-authn-beans.xml
index 09f033831..f1d893da7 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/mfa-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/mfa-authn-beans.xml
@@ -24,7 +24,7 @@
<bean id="shibboleth.authn.MFA.TransitionMapStrategy" parent="shibboleth.Functions.Constant"
c:target-ref="shibboleth.authn.MFA.TransitionMap" />
- <import resource="%{idp.home}/conf/authn/mfa-authn-config.xml" />
+ <import resource="conditional:%{idp.home}/conf/authn/mfa-authn-config.xml" />
<bean id="PopulateMultiFactorAuthenticationContext" scope="prototype"
class="net.shibboleth.idp.authn.impl.PopulateMultiFactorAuthenticationContext"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties
index 1f9bb1364..49710b5d2 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties
@@ -5,6 +5,7 @@ net.shibboleth.idp.module.authn.impl.Duo = idp.authn.Duo
net.shibboleth.idp.module.authn.impl.External = idp.authn.External
net.shibboleth.idp.module.authn.impl.Function = idp.authn.Function
net.shibboleth.idp.module.authn.impl.IPAddress = idp.authn.IPAddress
+net.shibboleth.idp.module.authn.impl.MFA = idp.authn.MFA
net.shibboleth.idp.module.authn.impl.RemoteUser = idp.authn.RemoteUser
net.shibboleth.idp.module.authn.impl.RemoteUserInternal = idp.authn.RemoteUserInternal
net.shibboleth.idp.module.authn.impl.SPNEGO = idp.authn.SPNEGO
@@ -37,6 +38,12 @@ idp.authn.IPAddress.url = https://wiki.shibboleth.net/confluence/display/IDP4/IP
idp.authn.IPAddress.1.src = /net/shibboleth/idp/module/conf/authn/ipaddress-authn-config.xml
idp.authn.IPAddress.1.dest = conf/authn/ipaddress-authn-config.xml
+idp.authn.MFA.name = MFA Authentication
+idp.authn.MFA.desc = Login flow for orchestration of multiple login methods
+idp.authn.MFA.url = https://wiki.shibboleth.net/confluence/display/IDP4/MultiFactorAuthnConfiguration
+idp.authn.MFA.1.src = /net/shibboleth/idp/module/conf/authn/mfa-authn-config.xml
+idp.authn.MFA.1.dest = conf/authn/mfa-authn-config.xml
+
idp.authn.RemoteUser.name = RemoteUser Authentication
idp.authn.RemoteUser.desc = Login flow for container-based authentication with a dedicated protected path.
idp.authn.RemoteUser.url = https://wiki.shibboleth.net/confluence/display/IDP4/RemoteUserAuthnConfiguration
diff --git a/idp-conf/src/main/resources/conf/authn/mfa-authn-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/mfa-authn-config.xml
similarity index 100%
rename from idp-conf/src/main/resources/conf/authn/mfa-authn-config.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/mfa-authn-config.xml
diff --git a/idp-conf/src/main/resources/conf/authn/authn.properties b/idp-conf/src/main/resources/conf/authn/authn.properties
index 55c92f892..ad76f5e19 100644
--- a/idp-conf/src/main/resources/conf/authn/authn.properties
+++ b/idp-conf/src/main/resources/conf/authn/authn.properties
@@ -56,9 +56,9 @@ idp.authn.External.externalAuthnPath = contextRelative:external.jsp
#idp.authn.RemoteUser.order = 1000
#idp.authn.RemoteUser.nonBrowserSupported = false
+# Unset in most cases only if using the authnMethodHeader or
+# subjectAttribute settings
#idp.authn.RemoteUser.addDefaultPrincipals = true
-# Servlet context-relative path to wherever your implementation lives
-#idp.authn.RemoteUser.externalAuthnPath = contextRelative:/Authn/RemoteUser
# Most other settings need to be supplied via web.xml to the servlet
#### RemoteUserInternal ####
@@ -82,8 +82,6 @@ idp.authn.External.externalAuthnPath = contextRelative:external.jsp
#idp.authn.SPNEGO.order = 1000
#idp.authn.SPNEGO.nonBrowserSupported = false
-#idp.authn.SPNEGO.addDefaultPrincipals = true
-#idp.authn.SPNEGO.externalAuthnPath = /Authn/SPNEGO
#idp.authn.SPNEGO.enforceRun = false
#idp.authn.SPNEGO.refreshKrbConfig = false
#idp.authn.SPNEGO.supportedPrincipals = \
@@ -94,7 +92,6 @@ idp.authn.External.externalAuthnPath = contextRelative:external.jsp
#idp.authn.X509.order = 1000
#idp.authn.X509.nonBrowserSupported = false
-#idp.authn.X509.addDefaultPrincipals = true
# Servlet context-relative path to wherever your implementation lives
#idp.authn.X509.externalAuthnPath = contextRelative:x509-prompt.jsp
#idp.authn.X509.supportedPrincipals = \
@@ -106,7 +103,6 @@ idp.authn.External.externalAuthnPath = contextRelative:external.jsp
#idp.authn.X509Internal.order = 1000
#idp.authn.X509Internal.nonBrowserSupported = false
-#idp.authn.X509Internal.addDefaultPrincipals = true
#idp.authn.X509Internal.supportedPrincipals = \
# saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:X509, \
# saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient, \
@@ -118,7 +114,6 @@ idp.authn.External.externalAuthnPath = contextRelative:external.jsp
#idp.authn.IPAddress.passiveAuthenticationSupported = true
#idp.authn.IPAddress.lifetime = PT60S
#idp.authn.IPAddress.inactivityTimeout = PT60S
-#idp.authn.IPAddress.addDefaultPrincipals = true
#idp.authn.IPAddress.supportedPrincipals = \
# saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list