[java-identity-provider] branch main updated: Options to omit certificate from public credentials.
Scott Cantor
cantor.2 at osu.edu
Fri Jan 22 00:25:44 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=4cf971c7c514a98c27a07e00ec30db1ccee01e69
The following commit(s) were added to refs/heads/main by this push:
new 4cf971c7c Options to omit certificate from public credentials.
4cf971c7c is described below
commit 4cf971c7c514a98c27a07e00ec30db1ccee01e69
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jan 21 19:25:40 2021 -0500
Options to omit certificate from public credentials.
---
.../idp/authn/impl/ValidateX509Certificate.java | 25 +++++++++++--
.../shibboleth/idp/authn/impl/X509AuthServlet.java | 41 +++++++++++++++++++---
.../idp/flows/authn/x509-internal-authn-beans.xml | 1 +
.../src/main/resources/conf/authn/authn.properties | 1 +
4 files changed, 60 insertions(+), 8 deletions(-)
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateX509Certificate.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateX509Certificate.java
index 44c8efd81..25fadc35a 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateX509Certificate.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateX509Certificate.java
@@ -71,9 +71,13 @@ public class ValidateX509Certificate extends AbstractValidationAction {
/** CertificateContext containing the credentials to validate. */
@Nullable private CertificateContext certContext;
+ /** Whether to save the certificate in the Java Subject's public credentials. */
+ private boolean saveCertificateToCredentialSet;
+
/** Constructor. */
public ValidateX509Certificate() {
setMetricName(DEFAULT_METRIC_NAME);
+ saveCertificateToCredentialSet = true;
}
/**
@@ -87,6 +91,21 @@ public class ValidateX509Certificate extends AbstractValidationAction {
trustEngine = tm;
}
+ /**
+ * Set whether to save the certificate in the Java Subject's public credentials.
+ *
+ * <p>Defaults to true</p>
+ *
+ * @param flag flag to set
+ *
+ * @since 4.1.0
+ */
+ public void setSaveCertificateToCredentialSet(final boolean flag) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ saveCertificateToCredentialSet = flag;
+ }
+
/** {@inheritDoc} */
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@@ -113,7 +132,6 @@ public class ValidateX509Certificate extends AbstractValidationAction {
}
/** {@inheritDoc} */
- // Checkstyle: ReturnCount OFF
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AuthenticationContext authenticationContext) {
@@ -156,13 +174,14 @@ public class ValidateX509Certificate extends AbstractValidationAction {
buildAuthenticationResult(profileRequestContext, authenticationContext);
ActionSupport.buildProceedEvent(profileRequestContext);
}
- // Checkstyle: ReturnCount ON
/** {@inheritDoc} */
@Override
@Nonnull protected Subject populateSubject(@Nonnull final Subject subject) {
subject.getPrincipals().add(((X509Certificate) certContext.getCertificate()).getSubjectX500Principal());
- subject.getPublicCredentials().add(certContext.getCertificate());
+ if (saveCertificateToCredentialSet) {
+ subject.getPublicCredentials().add(certContext.getCertificate());
+ }
return subject;
}
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509AuthServlet.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509AuthServlet.java
index 26dab75d4..ab19a6aa0 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509AuthServlet.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509AuthServlet.java
@@ -58,6 +58,9 @@ public class X509AuthServlet extends HttpServlet {
/** Init parameter identifying optional {@link TrustEngine} bean name. */
@Nonnull @NotEmpty private static final String TRUST_ENGINE_PARAM = "trustEngine";
+ /** Init parameter controlling certificate preservation. */
+ @Nonnull @NotEmpty private static final String SAVECERT_ENGINE_PARAM = "saveCertificateToCredentialSet";
+
/** Parameter/cookie for bypassing prompt page. */
@Nonnull @NotEmpty private static final String PASSTHROUGH_PARAM = "x509passthrough";
@@ -66,7 +69,15 @@ public class X509AuthServlet extends HttpServlet {
/** Trust engine. */
@Nullable private TrustEngine<? super X509Credential> trustEngine;
+
+ /** Whether to save the certificate to the Java Subject's public credentials. */
+ private boolean saveCertificateToCredentialSet;
+ /** Constructor. */
+ public X509AuthServlet() {
+ saveCertificateToCredentialSet = true;
+ }
+
/**
* Set the {@link TrustEngine} to use.
*
@@ -75,7 +86,20 @@ public class X509AuthServlet extends HttpServlet {
public void setTrustEngine(@Nullable final TrustEngine<? super X509Credential> tm) {
trustEngine = tm;
}
-
+
+ /**
+ * Set whether to save the certificate in the Java Subject's public credentials.
+ *
+ * <p>Defaults to true</p>
+ *
+ * @param flag flag to set
+ *
+ * @since 4.1.0
+ */
+ public void setSaveCertificateToCredentialSet(final boolean flag) {
+ saveCertificateToCredentialSet = flag;
+ }
+
/** {@inheritDoc} */
@SuppressWarnings("unchecked")
@Override
@@ -85,7 +109,7 @@ public class X509AuthServlet extends HttpServlet {
final WebApplicationContext springContext =
WebApplicationContextUtils.getRequiredWebApplicationContext(getServletContext());
- final String param = config.getInitParameter(TRUST_ENGINE_PARAM);
+ String param = config.getInitParameter(TRUST_ENGINE_PARAM);
if (param != null) {
log.debug("Looking up TrustEngine bean: {}", param);
final Object bean = springContext.getBean(param);
@@ -95,9 +119,14 @@ public class X509AuthServlet extends HttpServlet {
throw new ServletException("Bean " + param + " was missing, or not a TrustManager");
}
}
+
+ param = config.getInitParameter(SAVECERT_ENGINE_PARAM);
+ if (param != null) {
+ setSaveCertificateToCredentialSet(Boolean.valueOf(param));
+ }
}
-// Checkstyle: CyclomaticComplexity|ReturnCount OFF
+// Checkstyle: CyclomaticComplexity|MethodLength OFF
/** {@inheritDoc} */
@Override
protected void service(final HttpServletRequest httpRequest, final HttpServletResponse httpResponse)
@@ -153,7 +182,9 @@ public class X509AuthServlet extends HttpServlet {
}
final Subject subject = new Subject();
- subject.getPublicCredentials().add(cert);
+ if (saveCertificateToCredentialSet) {
+ subject.getPublicCredentials().add(cert);
+ }
subject.getPrincipals().add(cert.getSubjectX500Principal());
httpRequest.setAttribute(ExternalAuthentication.SUBJECT_KEY, subject);
@@ -170,6 +201,6 @@ public class X509AuthServlet extends HttpServlet {
throw new ServletException("Error processing external authentication request", e);
}
}
-// Checkstyle: CyclomaticComplexity|ReturnCount ON
+// Checkstyle: CyclomaticComplexity|MethodLength ON
}
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml
index 1c52e1490..52ee86c27 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-internal-authn-beans.xml
@@ -27,6 +27,7 @@
<bean id="ValidateX509Certificate"
class="net.shibboleth.idp.authn.impl.ValidateX509Certificate" scope="prototype"
p:trustEngine="#{getObject('shibboleth.authn.X509.TrustEngine')}"
+ p:saveCertificateToCredentialSet="%{idp.authn.X509Internal.saveCertificateToCredentialSet:true}"
p:addDefaultPrincipals="#{getObject('shibboleth.authn.X509.addDefaultPrincipals') ?: %{idp.authn.X509Internal.addDefaultPrincipals:true}}"
p:resultCachingPredicate="#{getObject('shibboleth.authn.X509.resultCachingPredicate')}" />
diff --git a/idp-conf/src/main/resources/conf/authn/authn.properties b/idp-conf/src/main/resources/conf/authn/authn.properties
index c1395b1d7..56111ef58 100644
--- a/idp-conf/src/main/resources/conf/authn/authn.properties
+++ b/idp-conf/src/main/resources/conf/authn/authn.properties
@@ -138,6 +138,7 @@ idp.authn.X509.supportedPrincipals = \
#idp.authn.X509Internal.order = 1000
#idp.authn.X509Internal.nonBrowserSupported = false
+#idp.authn.X509Internal.saveCertificateToCredentialSet = true
idp.authn.X509Internal.supportedPrincipals = \
saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:X509, \
saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient, \
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list