[java-identity-provider] branch main updated: IDP-1296 - Non-standard extension to discriminate logout endpoints
Scott Cantor
cantor.2 at osu.edu
Wed Jun 9 12:38:38 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=2b3ebbad44bdfb939dc917452e4ce5e6a05617d4
The following commit(s) were added to refs/heads/main by this push:
new 2b3ebbad4 IDP-1296 - Non-standard extension to discriminate logout endpoints
2b3ebbad4 is described below
commit 2b3ebbad44bdfb939dc917452e4ce5e6a05617d4
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jun 9 08:38:31 2021 -0400
IDP-1296 - Non-standard extension to discriminate logout endpoints
https://issues.shibboleth.net/jira/browse/IDP-1296
Wire up logout endpoint resolution to take ACS into account.
---
.../flows/saml/logout/saml2-logoutprop-beans.xml | 9 +++
.../flows/saml/logout/saml2-logoutprop-flow.xml | 2 +-
.../impl/PopulateBindingAndEndpointContexts.java | 24 +++++++
.../impl/BestMatchLocationLookupStrategy.java | 79 ++++++++++++++++++++++
4 files changed, 113 insertions(+), 1 deletion(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml
index 1b7fbd746..996eead6c 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml
@@ -50,6 +50,15 @@
class="org.opensaml.profile.action.impl.StaticMessageChannelSecurity" scope="prototype"
p:confidentialityActive="false" p:integrityActive="false" />
+ <bean id="PopulateLogoutBindingAndEndpointContexts"
+ class="net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts" scope="prototype"
+ p:endpointResolver-ref="shibboleth.EndpointResolver"
+ p:endpointType="#{getObject('shibboleth.EndpointType')}"
+ p:bindingDescriptorsLookupStrategy-ref="shibboleth.OutgoingBindingsLookupStrategy"
+ p:artifactImpliesSecureChannel="%{idp.artifact.secureChannel:true}"
+ p:bestMatchCriterionLookupStrategy-ref="BestMatchCriterionLookupStrategy" />
+ <bean id="BestMatchCriterionLookupStrategy" class="net.shibboleth.idp.saml.session.impl.BestMatchLocationLookupStrategy" />
+
<bean id="AddLogoutRequest"
class="net.shibboleth.idp.saml.session.impl.AddLogoutRequest" scope="prototype"
p:overwriteExisting="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-flow.xml
index 9416d19da..07210d5b1 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-flow.xml
@@ -21,7 +21,7 @@
<evaluate expression="InitializeOutboundMessageContext" />
<evaluate expression="InitializeMessageChannelSecurityContext" />
- <evaluate expression="PopulateBindingAndEndpointContexts" />
+ <evaluate expression="PopulateLogoutBindingAndEndpointContexts" />
<evaluate expression="'proceed'" />
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
index 7a6556916..f7d8e2380 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
@@ -60,6 +60,7 @@ import org.opensaml.saml.common.messaging.context.SAMLEndpointContext;
import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
import org.opensaml.saml.common.profile.SAMLEventIds;
+import org.opensaml.saml.criterion.BestMatchLocationCriterion;
import org.opensaml.saml.criterion.BindingCriterion;
import org.opensaml.saml.criterion.EndpointCriterion;
import org.opensaml.saml.criterion.RoleDescriptorCriterion;
@@ -120,6 +121,9 @@ public class PopulateBindingAndEndpointContexts extends AbstractProfileAction {
/** Strategy function for access to {@link SAMLArtifactContext} to populate. */
@Nonnull private Function<ProfileRequestContext,SAMLArtifactContext> artifactContextLookupStrategy;
+ /** Optional strategy function to obtain a {@link BestMatchLocationCriterion} to inject. */
+ @Nullable private Function<ProfileRequestContext,BestMatchLocationCriterion> bestMatchCriterionLookupStrategy;
+
/** List of possible bindings, in preference order. */
@Nonnull @NonnullElements private List<BindingDescriptor> bindingDescriptors;
@@ -278,6 +282,18 @@ public class PopulateBindingAndEndpointContexts extends AbstractProfileAction {
"SAMLArtifactContext lookup strategy cannot be null");
}
+ /**
+ * Set lookup strategy for {@link BestMatchLocationCriterion} to inject.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setBestMatchCriterionLookupStrategy(
+ @Nullable final Function<ProfileRequestContext,BestMatchLocationCriterion> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ bestMatchCriterionLookupStrategy = strategy;
+ }
+
/**
* Set whether an artifact-based binding implies that the eventual channel for SAML message exchange
* will be secured, overriding the integrity and confidentiality properties of the current channel.
@@ -402,6 +418,14 @@ public class PopulateBindingAndEndpointContexts extends AbstractProfileAction {
// Build criteria for the resolver.
final CriteriaSet criteria = new CriteriaSet(new BindingCriterion(bindings),
buildEndpointCriterion(bindings.get(0)));
+
+ if (bestMatchCriterionLookupStrategy != null) {
+ final BestMatchLocationCriterion bestMatch = bestMatchCriterionLookupStrategy.apply(profileRequestContext);
+ if (bestMatch != null) {
+ criteria.add(bestMatch);
+ }
+ }
+
if (mdContext != null && mdContext.getRoleDescriptor() != null) {
criteria.add(new RoleDescriptorCriterion(mdContext.getRoleDescriptor()));
} else {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/BestMatchLocationLookupStrategy.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/BestMatchLocationLookupStrategy.java
new file mode 100644
index 000000000..b3e0ef973
--- /dev/null
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/BestMatchLocationLookupStrategy.java
@@ -0,0 +1,79 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.session.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.criterion.BestMatchLocationCriterion;
+import org.opensaml.saml.saml2.metadata.AssertionConsumerService;
+
+import net.shibboleth.idp.saml.session.SAML2SPSession;
+import net.shibboleth.idp.session.context.LogoutPropagationContext;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * A strategy function for establishing an appropriate {@link BestMatchLocationCriterion}
+ * based on the {@link AssertionConsumerService} location used to initiate a {@link SAML2SPSession}.
+ *
+ * <p>Used during SAML 2.0 logout propagation to "fuzz" the determination of the best logout
+ * endpoint to use based on the original endpoint used.</p>
+ *
+ * <p>Returns null if not applicable or the ACS is unknown.</p>
+ */
+public class BestMatchLocationLookupStrategy implements Function<ProfileRequestContext,BestMatchLocationCriterion> {
+
+ /** Lookup strategy for context. */
+ @Nonnull private Function<ProfileRequestContext,LogoutPropagationContext> logoutPropagationContextLookupStrategy;
+
+ /** Constructor. */
+ public BestMatchLocationLookupStrategy() {
+ logoutPropagationContextLookupStrategy = new ChildContextLookup<>(LogoutPropagationContext.class);
+ }
+
+ /**
+ * Set the lookup strategy for the {@link LogoutPropagationContext} to access.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setLogoutContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,LogoutPropagationContext> strategy) {
+
+ logoutPropagationContextLookupStrategy = Constraint.isNotNull(strategy,
+ "LogoutPropagationContext lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public BestMatchLocationCriterion apply(@Nullable final ProfileRequestContext input) {
+
+ final LogoutPropagationContext propCtx = logoutPropagationContextLookupStrategy.apply(input);
+ if (propCtx != null && propCtx.getSession() instanceof SAML2SPSession) {
+ final String acsLocation = ((SAML2SPSession) propCtx.getSession()).getACSLocation();
+ if (acsLocation != null) {
+ return new BestMatchLocationCriterion(acsLocation);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list