[java-identity-provider] branch main updated: IDP-1642 - Migrate configuration into jars where feasible
Scott Cantor
cantor.2 at osu.edu
Tue Sep 22 19:05:02 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=6d7edbd504b15de40e1859d28c16bd6c72fbf01d
The following commit(s) were added to refs/heads/main by this push:
new 6d7edbd50 IDP-1642 - Migrate configuration into jars where feasible
6d7edbd50 is described below
commit 6d7edbd504b15de40e1859d28c16bd6c72fbf01d
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Sep 22 15:04:59 2020 -0400
IDP-1642 - Migrate configuration into jars where feasible
https://issues.shibboleth.net/jira/browse/IDP-1642
Convert context-check and impersonate flows into modules.
Replace impersonation config with properties.
---
.../idp/module/intercept/impl/ContextCheck.java | 41 ++++++++++++++++++++++
.../idp/module/intercept/impl/Impersonate.java | 41 ++++++++++++++++++++++
.../services/net.shibboleth.idp.module.IdPModule | 5 +++
.../idp/flows/intercept/context-check-beans.xml | 5 ++-
.../idp/flows/intercept/impersonate-beans.xml | 7 ++--
.../intercept/context-check-intercept-config.xml | 0
.../idp/module/intercept/impl/module.properties | 14 ++++++++
.../idp/module}/views/intercept/impersonate.vm | 0
idp-conf/src/main/resources/conf/idp.properties | 7 ++++
.../intercept/impersonate-intercept-config.xml | 25 -------------
10 files changed, 116 insertions(+), 29 deletions(-)
diff --git a/idp-conf-impl/src/main/java/net/shibboleth/idp/module/intercept/impl/ContextCheck.java b/idp-conf-impl/src/main/java/net/shibboleth/idp/module/intercept/impl/ContextCheck.java
new file mode 100644
index 000000000..52925d6a0
--- /dev/null
+++ b/idp-conf-impl/src/main/java/net/shibboleth/idp/module/intercept/impl/ContextCheck.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.module.intercept.impl;
+
+import java.io.IOException;
+
+import net.shibboleth.idp.module.IdPModule;
+import net.shibboleth.idp.module.ModuleException;
+import net.shibboleth.idp.module.PropertyDrivenIdPModule;
+
+/**
+ * {@link IdPModule} implementation.
+ */
+public final class ContextCheck extends PropertyDrivenIdPModule {
+
+ /**
+ * Constructor.
+ *
+ * @throws ModuleException on error
+ * @throws IOException on error
+ */
+ public ContextCheck() throws IOException, ModuleException {
+ super(ContextCheck.class);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/java/net/shibboleth/idp/module/intercept/impl/Impersonate.java b/idp-conf-impl/src/main/java/net/shibboleth/idp/module/intercept/impl/Impersonate.java
new file mode 100644
index 000000000..b00880f60
--- /dev/null
+++ b/idp-conf-impl/src/main/java/net/shibboleth/idp/module/intercept/impl/Impersonate.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.module.intercept.impl;
+
+import java.io.IOException;
+
+import net.shibboleth.idp.module.IdPModule;
+import net.shibboleth.idp.module.ModuleException;
+import net.shibboleth.idp.module.PropertyDrivenIdPModule;
+
+/**
+ * {@link IdPModule} implementation.
+ */
+public final class Impersonate extends PropertyDrivenIdPModule {
+
+ /**
+ * Constructor.
+ *
+ * @throws ModuleException on error
+ * @throws IOException on error
+ */
+ public Impersonate() throws IOException, ModuleException {
+ super(Impersonate.class);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule b/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
index 548fae3ae..1a1736798 100644
--- a/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
+++ b/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
@@ -11,3 +11,8 @@ net.shibboleth.idp.module.authn.impl.X509
net.shibboleth.idp.module.admin.impl.Hello
net.shibboleth.idp.module.admin.impl.UnlockKeys
+
+net.shibboleth.idp.module.intercept.impl.ContextCheck
+net.shibboleth.idp.module.intercept.impl.ExpiringPassword
+net.shibboleth.idp.module.intercept.impl.Impersonate
+net.shibboleth.idp.module.intercept.impl.Warning
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/context-check-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/context-check-beans.xml
index 585aafc60..d4ce6da39 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/context-check-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/context-check-beans.xml
@@ -18,6 +18,9 @@
<bean class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" />
<bean class="net.shibboleth.idp.profile.impl.ProfileActionBeanPostProcessor" />
- <import resource="%{idp.home}/conf/intercept/context-check-intercept-config.xml" />
+ <!-- Default to be overridden by config. -->
+ <bean id="shibboleth.context-check.Condition" parent="shibboleth.Conditions.TRUE" />
+
+ <import resource="conditional:%{idp.home}/conf/intercept/context-check-intercept-config.xml" />
</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/impersonate-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/impersonate-beans.xml
index 2f1993aea..b36031fec 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/impersonate-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/impersonate-beans.xml
@@ -18,20 +18,21 @@
<bean class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" />
<bean class="net.shibboleth.idp.profile.impl.ProfileActionBeanPostProcessor" />
- <import resource="%{idp.home}/conf/intercept/impersonate-intercept-config.xml" />
+ <!-- Legacy config. -->
+ <import resource="conditional:%{idp.home}/conf/intercept/impersonate-intercept-config.xml" />
<bean id="CheckGeneralAccess"
class="org.opensaml.profile.action.impl.CheckAccess" scope="prototype"
p:httpServletRequest-ref="shibboleth.HttpServletRequest"
p:accessControlService-ref="shibboleth.AccessControlService"
- p:policyName-ref="shibboleth.impersonate.GeneralPolicy"
+ p:policyName="#{getObject('shibboleth.impersonate.GeneralPolicy') ?: '%{idp.impersonate.generalPolicy:GeneralImpersonationPolicy}'.trim()}"
p:operation="impersonate" />
<bean id="CheckSpecificAccess"
class="org.opensaml.profile.action.impl.CheckAccess" scope="prototype"
p:httpServletRequest-ref="shibboleth.HttpServletRequest"
p:accessControlService-ref="shibboleth.AccessControlService"
- p:policyName-ref="shibboleth.impersonate.SpecificPolicy"
+ p:policyName="#{getObject('shibboleth.impersonate.SpecificPolicy') ?: '%{idp.impersonate.specificPolicy:SpecificImpersonationPolicy}'.trim()}"
p:operation="impersonate"
p:resourceLookupStrategy-ref="FlowScopePrincipalLookup" />
diff --git a/idp-conf/src/main/resources/conf/intercept/context-check-intercept-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/context-check-intercept-config.xml
similarity index 100%
rename from idp-conf/src/main/resources/conf/intercept/context-check-intercept-config.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/context-check-intercept-config.xml
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/intercept/impl/module.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/intercept/impl/module.properties
index c2a43eb9b..839f693d3 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/intercept/impl/module.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/intercept/impl/module.properties
@@ -1,9 +1,17 @@
# Properties defining interceptor modules
# Class to Module ID mappings
+net.shibboleth.idp.module.intercept.impl.ContextCheck = idp.intercept.ContextCheck
net.shibboleth.idp.module.intercept.impl.ExpiringPassword = idp.intercept.ExpiringPassword
+net.shibboleth.idp.module.intercept.impl.Impersonate = idp.intercept.Impersonate
net.shibboleth.idp.module.intercept.impl.Warning = idp.intercept.Warning
+idp.intercept.ContextCheck.name = Context Checking Interceptor
+idp.intercept.ContextCheck.desc = Interceptor flow for authorization based on request state
+idp.intercept.ContextCheck.url = https://wiki.shibboleth.net/confluence/display/IDP4/ContextCheckInterceptConfiguration
+idp.intercept.ContextCheck.1.src = /net/shibboleth/idp/module/conf/intercept/context-check-intercept-config.xml
+idp.intercept.ContextCheck.1.dest = conf/intercept/context-check-intercept-config.xml
+
idp.intercept.ExpiringPassword.name = Expiring Password Interceptor
idp.intercept.ExpiringPassword.desc = Interceptor flow for warning about an expired password
idp.intercept.ExpiringPassword.url = https://wiki.shibboleth.net/confluence/display/IDP4/ExpiringPasswordInterceptConfiguration
@@ -12,6 +20,12 @@ idp.intercept.ExpiringPassword.1.dest = conf/intercept/expiring-password-interce
idp.intercept.ExpiringPassword.2.src = /net/shibboleth/idp/module/views/intercept/expiring-password.vm
idp.intercept.ExpiringPassword.2.dest = views/intercept/expiring-password.vm
+idp.intercept.Impersonate.name = Impersonation Interceptor
+idp.intercept.Impersonate.desc = Interceptor flow for subject impersonation
+idp.intercept.Impersonate.url = https://wiki.shibboleth.net/confluence/display/IDP4/ImpersonateInterceptConfiguration
+idp.intercept.Impersonate.1.src = /net/shibboleth/idp/module/views/intercept/impersonate.vm
+idp.intercept.Impersonate.1.dest = views/intercept/impersonate.vm
+
idp.intercept.Warning.name = Warning Interceptor
idp.intercept.Warning.desc = Interceptor flow for generic warning conditions
idp.intercept.Warning.url = https://wiki.shibboleth.net/confluence/display/IDP4/WarningInterceptConfiguration
diff --git a/idp-conf/src/main/resources/views/intercept/impersonate.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/impersonate.vm
similarity index 100%
rename from idp-conf/src/main/resources/views/intercept/impersonate.vm
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/impersonate.vm
diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index d8310bb89..2f5c04d2c 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -156,6 +156,13 @@ idp.session.secondaryServiceIndex = true
# Time in milliseconds to expire consent storage records.
#idp.consent.storageRecordLifetime = P1Y
+# Path to use with External interceptor flow
+#idp.intercept.External.externalPath = contextRelative:intercept.jsp
+
+# Policies to use with Impersonate interceptor flow
+#idp.impersonate.generalPolicy = GeneralImpersonationPolicy
+#idp.impersonate.specificPolicy = SpecificImpersonationPolicy
+
# Whether to lookup metadata, etc. for every SP involved in a logout
# for use by user interface logic; adds overhead so off by default.
#idp.logout.elaboration = false
diff --git a/idp-conf/src/main/resources/conf/intercept/impersonate-intercept-config.xml b/idp-conf/src/main/resources/conf/intercept/impersonate-intercept-config.xml
deleted file mode 100644
index 7dfda2b91..000000000
--- a/idp-conf/src/main/resources/conf/intercept/impersonate-intercept-config.xml
+++ /dev/null
@@ -1,25 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <!--
- Names of access control policies defined in access-control.xml to control impersonation.
- The general policy runs first and determines whether to offer the impersonation option.
- The specific policy runs second and determines whether to allow the requested impersonation.
- -->
-
- <bean id="shibboleth.impersonate.GeneralPolicy" class="java.lang.String" c:_0="GeneralImpersonationPolicy" />
-
- <bean id="shibboleth.impersonate.SpecificPolicy" class="java.lang.String" c:_0="SpecificImpersonationPolicy" />
-
-</beans>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list