[java-identity-provider] branch main updated: IDP-1849 - Apply outbound interceptors to logout propagation messages
Scott Cantor
cantor.2 at osu.edu
Thu Nov 4 18:08:49 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=530e25d69aa24e4a8d5c9eb7c5956c173cd2ec1c
The following commit(s) were added to refs/heads/main by this push:
new 530e25d69 IDP-1849 - Apply outbound interceptors to logout propagation messages
530e25d69 is described below
commit 530e25d69aa24e4a8d5c9eb7c5956c173cd2ec1c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Nov 4 14:08:45 2021 -0400
IDP-1849 - Apply outbound interceptors to logout propagation messages
https://shibboleth.atlassian.net/browse/IDP-1849
---
.../idp/flows/cas/cas-abstract-beans.xml | 6 +++--
.../net/shibboleth/idp/flows/cas/login-beans.xml | 3 ++-
.../flows/saml/logout/saml2-logoutprop-beans.xml | 9 +++++++
.../flows/saml/logout/saml2-logoutprop-flow.xml | 18 ++++++++-----
.../idp/flows/saml/saml-abstract-beans.xml | 9 ++++---
.../impl/PopulateProfileInterceptorContext.java | 30 +++++++++++++++++++---
6 files changed, 60 insertions(+), 15 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/cas-abstract-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/cas-abstract-beans.xml
index 42c8ff730..86c0ea389 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/cas-abstract-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/cas-abstract-beans.xml
@@ -35,7 +35,8 @@
<bean id="PopulateInboundInterceptContext"
class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"
- p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}">
+ p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}"
+ p:loggingLabel="inbound">
<property name="activeFlowsLookupStrategy">
<bean class="net.shibboleth.idp.profile.config.navigate.InboundFlowsLookupFunction" />
</property>
@@ -43,7 +44,8 @@
<bean id="PopulateOutboundInterceptContext"
class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"
- p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}">
+ p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}"
+ p:loggingLabel="outbound">
<property name="activeFlowsLookupStrategy">
<bean class="net.shibboleth.idp.profile.config.navigate.OutboundFlowsLookupFunction" />
</property>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/login-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/login-beans.xml
index 1fab7270f..3dd664070 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/login-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/cas/login-beans.xml
@@ -43,7 +43,8 @@
<bean id="PopulatePostAuthnInterceptContext"
class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"
- p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}">
+ p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}"
+ p:loggingLabel="post-authn">
<property name="activeFlowsLookupStrategy">
<bean class="net.shibboleth.idp.authn.config.navigate.PostAuthenticationFlowsLookupFunction" />
</property>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml
index 9d2b6eddd..f47b5a000 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml
@@ -92,6 +92,15 @@
<bean id="PostResponsePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:fieldExtractors="#{getObject('shibboleth.PostResponseAuditExtractors') ?: getObject('shibboleth.DefaultPostResponseAuditExtractors')}" />
+ <bean id="PopulateOutboundInterceptContext"
+ class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"
+ p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}"
+ p:loggingLabel="outbound">
+ <property name="activeFlowsLookupStrategy">
+ <bean class="net.shibboleth.idp.profile.config.navigate.OutboundFlowsLookupFunction" />
+ </property>
+ </bean>
+
<bean id="PostDecodePopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:fieldExtractors="#{getObject('shibboleth.PostDecodeAuditExtractors') ?: getObject('shibboleth.DefaultPostDecodeAuditExtractors')}" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-flow.xml
index abb663818..d3f8d308b 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-flow.xml
@@ -43,20 +43,26 @@
<action-state id="PrepareRequest">
<evaluate expression="PopulateEncryptionParameters" />
-
<evaluate expression="AddLogoutRequest" />
-
<evaluate expression="LogoutPopulateAuditContext" />
-
<evaluate expression="EncryptNameIDs" />
-
<evaluate expression="PostResponsePopulateAuditContext" />
-
+ <evaluate expression="PopulateOutboundInterceptContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="CheckForSynchronousBinding2" />
+ <transition on="proceed" to="CheckOutboundInterceptContext" />
</action-state>
+ <decision-state id="CheckOutboundInterceptContext">
+ <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).getAvailableFlows().isEmpty()"
+ then="CheckForSynchronousBinding2" else="DoOutboundInterceptSubflow" />
+ </decision-state>
+
+ <subflow-state id="DoOutboundInterceptSubflow" subflow="intercept">
+ <input name="calledAsSubflow" value="true" />
+ <transition on="proceed" to="CheckForSynchronousBinding2" />
+ </subflow-state>
+
<decision-state id="CheckForSynchronousBinding2">
<if test="opensamlProfileRequestContext.getOutboundMessageContext().getSubcontext('org.opensaml.saml.common.messaging.context.SAMLBindingContext').getBindingDescriptor().isSynchronous()"
then="HandleBackChannelMessage"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml
index 20f49b109..bf6156ad9 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml
@@ -111,7 +111,8 @@
<bean id="PopulateInboundInterceptContext"
class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"
- p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}">
+ p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}"
+ p:loggingLabel="inbound">
<property name="activeFlowsLookupStrategy">
<bean class="net.shibboleth.idp.profile.config.navigate.InboundFlowsLookupFunction" />
</property>
@@ -229,7 +230,8 @@
<bean id="PopulatePostAuthnInterceptContext"
class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"
- p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}">
+ p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}"
+ p:loggingLabel="post-authn">
<property name="activeFlowsLookupStrategy">
<bean class="net.shibboleth.idp.authn.config.navigate.PostAuthenticationFlowsLookupFunction" />
</property>
@@ -288,7 +290,8 @@
<bean id="PopulateOutboundInterceptContext"
class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"
- p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}">
+ p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}"
+ p:loggingLabel="outbound">
<property name="activeFlowsLookupStrategy">
<bean class="net.shibboleth.idp.profile.config.navigate.OutboundFlowsLookupFunction" />
</property>
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/interceptor/impl/PopulateProfileInterceptorContext.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/interceptor/impl/PopulateProfileInterceptorContext.java
index 7e4dfbd7c..1799ec505 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/interceptor/impl/PopulateProfileInterceptorContext.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/interceptor/impl/PopulateProfileInterceptorContext.java
@@ -24,6 +24,7 @@ import java.util.Optional;
import java.util.function.Function;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.profile.context.ProfileInterceptorContext;
@@ -31,9 +32,11 @@ import net.shibboleth.idp.profile.interceptor.AbstractProfileInterceptorAction;
import net.shibboleth.idp.profile.interceptor.ProfileInterceptorFlowDescriptor;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -61,6 +64,9 @@ public class PopulateProfileInterceptorContext extends AbstractProfileIntercepto
/** Lookup function for the flow IDs to activate from within the available set. */
@NonnullAfterInit private Function<ProfileRequestContext,Collection<String>> activeFlowsLookupStrategy;
+ /** A label for logging activity indicating what type of flows are being handled. */
+ @Nullable private String loggingLabel;
+
/** Constructor. */
public PopulateProfileInterceptorContext() {
availableFlows = Collections.emptyList();
@@ -85,9 +91,23 @@ public class PopulateProfileInterceptorContext extends AbstractProfileIntercepto
public void setActiveFlowsLookupStrategy(
@Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
activeFlowsLookupStrategy = Constraint.isNotNull(strategy, "Flow lookup strategy cannot be null");
}
+ /**
+ * Set a label for logging indicating which "type" of interceptors are being handled.
+ *
+ * @param label logging label
+ *
+ * @since 4.2.0
+ */
+ public void setLoggingLabel(@Nullable @NotEmpty final String label) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ loggingLabel = StringSupport.trimOrNull(label);
+ }
+
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
@@ -106,21 +126,25 @@ public class PopulateProfileInterceptorContext extends AbstractProfileIntercepto
interceptorContext.setAttemptedFlow(null);
final Collection<String> activeFlows = activeFlowsLookupStrategy.apply(profileRequestContext);
- if (activeFlows != null) {
+ if (activeFlows != null && !activeFlows.isEmpty()) {
for (final String id : activeFlows) {
final String flowId = ProfileInterceptorFlowDescriptor.FLOW_ID_PREFIX + id;
final Optional<ProfileInterceptorFlowDescriptor> flow =
availableFlows.stream().filter(fd -> fd.getId().equals(flowId)).findFirst();
if (flow.isPresent()) {
- log.debug("{} Installing flow {} into interceptor context", getLogPrefix(), flowId);
+ log.debug("{} Installing {} flow {} into interceptor context", getLogPrefix(), loggingLabel,
+ flowId);
interceptorContext.getAvailableFlows().put(flow.orElseThrow().getId(), flow.orElseThrow());
} else {
- log.error("{} Configured interceptor flow {} not available for use", getLogPrefix(), flowId);
+ log.error("{} Configured {} interceptor flow {} not available for use", getLogPrefix(),
+ loggingLabel, flowId);
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
return;
}
}
+ } else {
+ log.debug("{} No {} interceptor flows active for this request", getLogPrefix(), loggingLabel);
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list