[java-identity-provider] branch main updated: IDP-1653 - Include ProtocolBinding in proxied SAML AuthnRequest

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=cb768b4b53a2c2f56454b38052cb57312b751698

The following commit(s) were added to refs/heads/main by this push:
       new  cb768b4b5 IDP-1653 - Include ProtocolBinding in proxied SAML AuthnRequest
cb768b4b5 is described below

commit cb768b4b53a2c2f56454b38052cb57312b751698
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jan 4 15:47:48 2021 -0500

    IDP-1653 - Include ProtocolBinding in proxied SAML AuthnRequest
    
    https://issues.shibboleth.net/jira/browse/IDP-1653
---
 .../net/shibboleth/idp/conf/mvc-beans.xml          |  3 +-
 .../saml2/profile/impl/SAMLAuthnController.java    | 35 +++++++++++++++++++++-
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/mvc-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/mvc-beans.xml
index 9b5e68e6d..00119bd4c 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/mvc-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/mvc-beans.xml
@@ -56,7 +56,8 @@
     <!-- Additional MVC controllers scanned for annotations. -->
     
     <bean id="shibboleth.SPNEGOAuthnController" class="net.shibboleth.idp.authn.spnego.impl.SPNEGOAuthnController" />
-    <bean id="shibboleth.SAMLAuthnPOSTController" class="net.shibboleth.idp.saml.saml2.profile.impl.SAMLAuthnController" />
+    <bean id="shibboleth.SAMLAuthnPOSTController" class="net.shibboleth.idp.saml.saml2.profile.impl.SAMLAuthnController"
+        p:inboundBindings-ref="shibboleth.OutgoingSAML2SSOBindings" />
     <bean id="shibboleth.RaiseErrorController" class="net.shibboleth.ext.spring.error.ErrorRaisingController" />
 
     <!-- Exception handling -->
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
index eb5da9d47..4c2f29df5 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
@@ -18,6 +18,10 @@
 package net.shibboleth.idp.saml.saml2.profile.impl;
 
 import java.io.IOException;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
 import java.util.function.Function;
 
 import javax.annotation.Nonnull;
@@ -28,6 +32,7 @@ import javax.servlet.http.HttpServletResponse;
 import net.shibboleth.idp.authn.ExternalAuthentication;
 import net.shibboleth.idp.authn.ExternalAuthenticationException;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 import net.shibboleth.utilities.java.support.component.AbstractInitializableComponent;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -42,6 +47,7 @@ import org.opensaml.messaging.handler.MessageHandlerException;
 import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.EventContext;
 import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.binding.BindingDescriptor;
 import org.opensaml.saml.common.binding.SAMLBindingSupport;
 import org.opensaml.saml.common.messaging.context.SAMLMessageReceivedEndpointContext;
 import org.opensaml.saml.saml2.core.AuthnRequest;
@@ -75,6 +81,9 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
     /** Lookup strategy to locate the SAML context. */
     @Nonnull private Function<ProfileRequestContext,SAMLAuthnContext> samlContextLookupStrategy;
     
+    /** Map of binding short names to deduce inbound binding constant. */
+    @Nonnull @NonnullElements private Map<String,BindingDescriptor> bindingMap;
+    
     /** Constructor. */
     public SAMLAuthnController() {
         // PRC -> AC -> nested PRC
@@ -84,6 +93,8 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
         // PRC -> AC -> SAMLAuthnContext
         samlContextLookupStrategy = new ChildContextLookup<>(SAMLAuthnContext.class).compose(
                 new ChildContextLookup<>(AuthenticationContext.class));
+        
+        bindingMap = Collections.emptyMap();
     }
     
     /**
@@ -110,7 +121,24 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
         
         samlContextLookupStrategy = Constraint.isNotNull(strategy, "SAMLAuthnContext lookup strategy cannot be null");
     }
+    
+    /**
+     * Set inbound bindings to use to deduce ProtocolBinding attribute.
+     * 
+     * @param bindings
+     */
+    public void setInboundBindings(@Nullable @NonnullElements final Collection<BindingDescriptor> bindings) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        if (bindings != null) {
+            bindingMap = new HashMap<>(bindings.size());
+            bindings.forEach(b -> bindingMap.put(b.getShortName(), b));
+        } else {
+            bindingMap = Collections.emptyMap();
+        }
+    }
 
+// Checkstyle: CyclomaticComplexity OFF
     /**
      * Outbound initiation of the process, triggered with a fixed addition to the path.
      * 
@@ -152,6 +180,10 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
             final StringBuffer url = httpRequest.getRequestURL();
             ((AuthnRequest) nestedPRC.getOutboundMessageContext().getMessage()).setAssertionConsumerServiceURL(
                     url.substring(0, url.lastIndexOf("/start")));
+            final BindingDescriptor bd = bindingMap.get(binding);
+            if (bd != null) {
+                ((AuthnRequest) nestedPRC.getOutboundMessageContext().getMessage()).setProtocolBinding(bd.getId());
+            }
         } else {
             log.error("Outbound AuthnContext message not found");
             httpRequest.setAttribute(ExternalAuthentication.AUTHENTICATION_ERROR_KEY, EventIds.INVALID_MESSAGE);
@@ -180,7 +212,8 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
             ExternalAuthentication.finishExternalAuthentication(key, httpRequest, httpResponse);
         }
     }
-
+// Checkstyle: CyclomaticComplexity ON
+    
     /**
      * Inbound completion of the process, triggered by default for any methods.
      * 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.