[java-identity-provider] branch main updated: IDP-1878 - Administrative flows should support post-authn interceptors
Scott Cantor
cantor.2 at osu.edu
Fri Nov 5 13:11:53 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=13206da398fd28b45770cc1d5a3cfae1144d4f8c
The following commit(s) were added to refs/heads/main by this push:
new 13206da39 IDP-1878 - Administrative flows should support post-authn interceptors
13206da39 is described below
commit 13206da398fd28b45770cc1d5a3cfae1144d4f8c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Nov 5 09:11:49 2021 -0400
IDP-1878 - Administrative flows should support post-authn interceptors
https://shibboleth.atlassian.net/browse/IDP-1878
---
...InitializeAdministrativeProfileContextTree.java | 4 +-
.../net/shibboleth/idp/conf/admin-system.xml | 178 +++++++++++++--------
.../idp/flows/admin/admin-abstract-beans.xml | 9 ++
.../idp/flows/admin/admin-abstract-flow.xml | 14 +-
.../src/main/resources/conf/admin/admin.properties | 9 ++
5 files changed, 147 insertions(+), 67 deletions(-)
diff --git a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/InitializeAdministrativeProfileContextTree.java b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/InitializeAdministrativeProfileContextTree.java
index 2d226f82c..f90b71b2e 100644
--- a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/InitializeAdministrativeProfileContextTree.java
+++ b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/InitializeAdministrativeProfileContextTree.java
@@ -43,8 +43,8 @@ import net.shibboleth.utilities.java.support.net.ThreadLocalHttpServletRequestPr
* An action that processes settings from a supplied {@link AdministrativeFlowDescriptor} to prepare
* the profile context tree for subsequent use by an administrative profile flow.
*
- * <p>This action finalizes settings like non-browser compatibility, and if instructed to do so,
- * decorates the context tree with a mocked up {@link RelyingPartyContext} and {@link RelyingPartyUIContext}.</p>
+ * <p>This action finalizes settings like non-browser compatibility, and decorates the context tree with
+ * a mocked up {@link RelyingPartyContext} and {@link RelyingPartyUIContext}.</p>
*
* @pre The injected {@link AdministrativeFlowDescriptor}'s ID must match {@link ProfileRequestContext#getProfileId()}
* @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/admin-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/admin-system.xml
index 4df932c6b..5c6aecb41 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/admin-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/admin-system.xml
@@ -25,94 +25,144 @@
<!-- Built-in flow descriptors. -->
<bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/status"
- p:loggingId="%{idp.status.logging:Status}"
- p:policyName="%{idp.status.accessPolicy:AccessByIPAddress}"
- p:nonBrowserSupported="%{idp.status.nonBrowserSupported:false}"
- p:authenticated="%{idp.status.authenticated:false}"
- p:resolveAttributes="%{idp.status.resolveAttributes:false}" />
+ c:id="http://shibboleth.net/ns/profiles/status"
+ p:loggingId="%{idp.status.logging:Status}"
+ p:policyName="%{idp.status.accessPolicy:AccessByIPAddress}"
+ p:nonBrowserSupported="%{idp.status.nonBrowserSupported:false}"
+ p:authenticated="%{idp.status.authenticated:false}"
+ p:resolveAttributes="%{idp.status.resolveAttributes:false}">
+ <property name="postAuthenticationFlows">
+ <bean parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.status.postAuthenticationFlows:}'.trim()}" />
+ </property>
+ </bean>
<bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/reload-service-configuration"
- p:loggingId="%{idp.reload.logging:Reload}"
- p:policyName="%{idp.reload.accessPolicy:AccessByIPAddress}"
- p:nonBrowserSupported="%{idp.reload.nonBrowserSupported:false}"
- p:authenticated="%{idp.reload.authenticated:false}"
- p:resolveAttributes="%{idp.reload.resolveAttributes:false}" />
+ c:id="http://shibboleth.net/ns/profiles/reload-service-configuration"
+ p:loggingId="%{idp.reload.logging:Reload}"
+ p:policyName="%{idp.reload.accessPolicy:AccessByIPAddress}"
+ p:nonBrowserSupported="%{idp.reload.nonBrowserSupported:false}"
+ p:authenticated="%{idp.reload.authenticated:false}"
+ p:resolveAttributes="%{idp.reload.resolveAttributes:false}">
+ <property name="postAuthenticationFlows">
+ <bean parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.reload.postAuthenticationFlows:}'.trim()}" />
+ </property>
+ </bean>
<bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/reload-metadata"
- p:loggingId="%{idp.reload.logging:Reload}"
- p:policyName="%{idp.reload.accessPolicy:AccessByIPAddress}"
- p:nonBrowserSupported="%{idp.reload.nonBrowserSupported:false}"
- p:authenticated="%{idp.reload.authenticated:false}"
- p:resolveAttributes="%{idp.reload.resolveAttributes:false}" />
+ c:id="http://shibboleth.net/ns/profiles/reload-metadata"
+ p:loggingId="%{idp.reload.logging:Reload}"
+ p:policyName="%{idp.reload.accessPolicy:AccessByIPAddress}"
+ p:nonBrowserSupported="%{idp.reload.nonBrowserSupported:false}"
+ p:authenticated="%{idp.reload.authenticated:false}"
+ p:resolveAttributes="%{idp.reload.resolveAttributes:false}">
+ <property name="postAuthenticationFlows">
+ <bean parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.reload.postAuthenticationFlows:}'.trim()}" />
+ </property>
+ </bean>
<bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/resolvertest"
- p:loggingId="%{idp.resolvertest.logging:ResolverTest}"
- p:policyName="%{idp.resolvertest.accessPolicy:AccessByIPAddress}"
- p:nonBrowserSupported="%{idp.resolvertest.nonBrowserSupported:false}"
- p:authenticated="%{idp.resolvertest.authenticated:false}"
- p:resolveAttributes="%{idp.resolvertest.resolveAttributes:false}" />
+ c:id="http://shibboleth.net/ns/profiles/resolvertest"
+ p:loggingId="%{idp.resolvertest.logging:ResolverTest}"
+ p:policyName="%{idp.resolvertest.accessPolicy:AccessByIPAddress}"
+ p:nonBrowserSupported="%{idp.resolvertest.nonBrowserSupported:false}"
+ p:authenticated="%{idp.resolvertest.authenticated:false}"
+ p:resolveAttributes="%{idp.resolvertest.resolveAttributes:false}">
+ <property name="postAuthenticationFlows">
+ <bean parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.resolvertest.postAuthenticationFlows:}'.trim()}" />
+ </property>
+ </bean>
<bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/mdquery"
- p:loggingId="%{idp.mdquery.logging:MetadataQuery}"
- p:policyName="%{idp.mdquery.accessPolicy:AccessByIPAddress}"
- p:nonBrowserSupported="%{idp.mdquery.nonBrowserSupported:false}"
- p:authenticated="%{idp.mdquery.authenticated:false}"
- p:resolveAttributes="%{idp.mdquery.resolveAttributes:false}" />
+ c:id="http://shibboleth.net/ns/profiles/mdquery"
+ p:loggingId="%{idp.mdquery.logging:MetadataQuery}"
+ p:policyName="%{idp.mdquery.accessPolicy:AccessByIPAddress}"
+ p:nonBrowserSupported="%{idp.mdquery.nonBrowserSupported:false}"
+ p:authenticated="%{idp.mdquery.authenticated:false}"
+ p:resolveAttributes="%{idp.mdquery.resolveAttributes:false}">
+ <property name="postAuthenticationFlows">
+ <bean parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.mdquery.postAuthenticationFlows:}'.trim()}" />
+ </property>
+ </bean>
<bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/metrics"
- p:loggingId="%{idp.metrics.logging:Metrics}"
- p:policyNameLookupStrategy-ref="shibboleth.metrics.AccessPolicyStrategy"
- p:nonBrowserSupported="%{idp.metrics.nonBrowserSupported:false}"
- p:authenticated="%{idp.metrics.authenticated:false}"
- p:resolveAttributes="%{idp.metrics.resolveAttributes:false}" />
+ c:id="http://shibboleth.net/ns/profiles/metrics"
+ p:loggingId="%{idp.metrics.logging:Metrics}"
+ p:policyNameLookupStrategy-ref="shibboleth.metrics.AccessPolicyStrategy"
+ p:nonBrowserSupported="%{idp.metrics.nonBrowserSupported:false}"
+ p:authenticated="%{idp.metrics.authenticated:false}"
+ p:resolveAttributes="%{idp.metrics.resolveAttributes:false}">
+ <property name="postAuthenticationFlows">
+ <bean parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.metrics.postAuthenticationFlows:}'.trim()}" />
+ </property>
+ </bean>
<bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/hello"
- p:loggingId="%{idp.hello.logging:Hello}"
- p:policyName="%{idp.hello.accessPolicy:AccessByAdminUser}"
- p:nonBrowserSupported="%{idp.hello.nonBrowserSupported:false}"
- p:authenticated="%{idp.hello.authenticated:true}"
- p:resolveAttributes="%{idp.hello.resolveAttributes:true}" />
+ c:id="http://shibboleth.net/ns/profiles/hello"
+ p:loggingId="%{idp.hello.logging:Hello}"
+ p:policyName="%{idp.hello.accessPolicy:AccessByAdminUser}"
+ p:nonBrowserSupported="%{idp.hello.nonBrowserSupported:false}"
+ p:authenticated="%{idp.hello.authenticated:true}"
+ p:resolveAttributes="%{idp.hello.resolveAttributes:true}">
+ <property name="postAuthenticationFlows">
+ <bean parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.hello.postAuthenticationFlows:}'.trim()}" />
+ </property>
+ </bean>
<bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/lockout-manager"
- p:loggingId="%{idp.lockout.logging:Lockout}"
- p:policyName="%{idp.lockout.accessPolicy:AccessDenied}"
- p:nonBrowserSupported="%{idp.lockout.nonBrowserSupported:false}"
- p:authenticated="%{idp.lockout.authenticated:false}"
- p:resolveAttributes="%{idp.lockout.resolveAttributes:false}" />
+ c:id="http://shibboleth.net/ns/profiles/lockout-manager"
+ p:loggingId="%{idp.lockout.logging:Lockout}"
+ p:policyName="%{idp.lockout.accessPolicy:AccessDenied}"
+ p:nonBrowserSupported="%{idp.lockout.nonBrowserSupported:false}"
+ p:authenticated="%{idp.lockout.authenticated:false}"
+ p:resolveAttributes="%{idp.lockout.resolveAttributes:false}">
+ <property name="postAuthenticationFlows">
+ <bean parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.lockout.postAuthenticationFlows:}'.trim()}" />
+ </property>
+ </bean>
<bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/storage"
- p:loggingId="%{idp.storage.logging:Storage}"
- p:policyName="%{idp.storage.accessPolicy:AccessDenied}"
- p:nonBrowserSupported="%{idp.storage.nonBrowserSupported:false}"
- p:authenticated="%{idp.storage.authenticated:false}"
- p:resolveAttributes="%{idp.storage.resolveAttributes:false}" />
+ c:id="http://shibboleth.net/ns/profiles/storage"
+ p:loggingId="%{idp.storage.logging:Storage}"
+ p:policyName="%{idp.storage.accessPolicy:AccessDenied}"
+ p:nonBrowserSupported="%{idp.storage.nonBrowserSupported:false}"
+ p:authenticated="%{idp.storage.authenticated:false}"
+ p:resolveAttributes="%{idp.storage.resolveAttributes:false}">
+ <property name="postAuthenticationFlows">
+ <bean parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.storage.postAuthenticationFlows:}'.trim()}" />
+ </property>
+ </bean>
<bean parent="shibboleth.OneTimeAdminFlow"
- c:id="http://shibboleth.net/ns/profiles/unlock-keys"
- p:loggingId="%{idp.unlock-keys.logging:UnlockKeys}"
- p:policyName="%{idp.unlock-keys.accessPolicy:AccessDenied}"
- p:nonBrowserSupported="%{idp.unlock-keys.nonBrowserSupported:false}"
- p:authenticated="%{idp.unlock-keys.authenticated:true}"
- p:resolveAttributes="%{idp.unlock-keys.resolveAttributes:false}" />
+ c:id="http://shibboleth.net/ns/profiles/unlock-keys"
+ p:loggingId="%{idp.unlock-keys.logging:UnlockKeys}"
+ p:policyName="%{idp.unlock-keys.accessPolicy:AccessDenied}"
+ p:nonBrowserSupported="%{idp.unlock-keys.nonBrowserSupported:false}"
+ p:authenticated="%{idp.unlock-keys.authenticated:true}"
+ p:resolveAttributes="%{idp.unlock-keys.resolveAttributes:false}">
+ <property name="postAuthenticationFlows">
+ <bean parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.unlock-keys.postAuthenticationFlows:}'.trim()}" />
+ </property>
+ </bean>
<!-- Parent beans to default some of the flow boilerplate. -->
<bean id="shibboleth.AdminFlow" abstract="true"
- class="net.shibboleth.idp.admin.BasicAdministrativeFlowDescriptor"
- p:nonBrowserSupported="false" />
+ class="net.shibboleth.idp.admin.BasicAdministrativeFlowDescriptor"
+ p:nonBrowserSupported="false" />
<bean id="shibboleth.OneTimeAdminFlow" abstract="true"
- class="net.shibboleth.idp.admin.OneTimeAdministrativeFlowDescriptor"
- p:nonBrowserSupported="false" />
+ class="net.shibboleth.idp.admin.OneTimeAdministrativeFlowDescriptor"
+ p:nonBrowserSupported="false" />
<!-- Function for returning custom access control policies for access to metrics. -->
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/admin-abstract-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/admin-abstract-beans.xml
index c6fb9bd4b..adb77cbff 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/admin-abstract-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/admin-abstract-beans.xml
@@ -59,6 +59,15 @@
p:transcoderRegistry-ref="shibboleth.AttributeRegistryService"
p:maskFailures="%{idp.service.attribute.resolver.maskFailures:true}" />
+ <bean id="PopulatePostAuthnInterceptContext"
+ class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"
+ p:availableFlows="#{@'shibboleth.ProfileInterceptorFlowDescriptorManager'.getComponents()}"
+ p:loggingLabel="post-authn">
+ <property name="activeFlowsLookupStrategy">
+ <bean class="net.shibboleth.idp.authn.config.navigate.PostAuthenticationFlowsLookupFunction" />
+ </property>
+ </bean>
+
<bean id="PopulateClientStorageSaveContext"
class="org.opensaml.storage.impl.client.PopulateClientStorageSaveContext" scope="prototype"
p:storageServices="#{ getObject('shibboleth.ClientStorageServices') ?: getObject('shibboleth.DefaultClientStorageServices') }" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/admin-abstract-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/admin-abstract-flow.xml
index 6b12f3cda..27b096cb3 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/admin-abstract-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/admin-abstract-flow.xml
@@ -65,11 +65,23 @@
<action-state id="AttributeResolution">
<evaluate expression="ResolveAttributes" />
+ <evaluate expression="PopulatePostAuthnInterceptContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="PopulateClientStorageSaveContext" />
+ <transition on="proceed" to="CheckPostAuthnInterceptContext" />
</action-state>
+ <decision-state id="CheckPostAuthnInterceptContext">
+ <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).getAvailableFlows().isEmpty()"
+ then="PopulateClientStorageSaveContext" else="DoPostAuthnInterceptSubflow" />
+ </decision-state>
+
+ <subflow-state id="DoPostAuthnInterceptSubflow" subflow="intercept">
+ <input name="calledAsSubflow" value="true" />
+ <transition on="proceed" to="PopulateClientStorageSaveContext" />
+ <transition on="RestartAuthentication" to="AuthenticationSetup" />
+ </subflow-state>
+
<action-state id="PopulateClientStorageSaveContext">
<evaluate expression="AdminPopulateAuditContext" />
<evaluate expression="PopulateClientStorageSaveContext" />
diff --git a/idp-conf/src/main/resources/conf/admin/admin.properties b/idp-conf/src/main/resources/conf/admin/admin.properties
index 7f14b566f..9831ba4b9 100644
--- a/idp-conf/src/main/resources/conf/admin/admin.properties
+++ b/idp-conf/src/main/resources/conf/admin/admin.properties
@@ -5,29 +5,34 @@
#idp.status.authenticated = false
#idp.status.nonBrowserSupported = false
#idp.status.resolveAttributes = false
+#idp.status.postAuthenticationFlows =
#idp.reload.logging = Reload
#idp.reload.accessPolicy = AccessByIPAddress
#idp.reload.authenticated = false
#idp.reload.nonBrowserSupported = false
#idp.reload.resolveAttributes = false
+#idp.reload.postAuthenticationFlows =
#idp.resolvertest.logging = ResolverTest
#idp.resolvertest.accessPolicy = AccessByIPAddress
#idp.resolvertest.authenticated = false
#idp.resolvertest.nonBrowserSupported = false
#idp.resolvertest.resolveAttributes = false
+#idp.resolvertest.postAuthenticationFlows =
#idp.mdquery.logging = MetadataQuery
#idp.mdquery.accessPolicy = AccessByIPAddress
#idp.mdquery.authenticated = false
#idp.mdquery.nonBrowserSupported = false
#idp.mdquery.resolveAttributes = false
+#idp.mdquery.postAuthenticationFlows =
#idp.metrics.logging = Metrics
#idp.metrics.authenticated = false
#idp.metrics.nonBrowserSupported = false
#idp.metrics.resolveAttributes = false
+#idp.metrics.postAuthenticationFlows =
# See admin/metrics.xml for other configuration
#idp.hello.logging = Hello
@@ -35,21 +40,25 @@
#idp.hello.authenticated = true
#idp.hello.nonBrowserSupported = false
#idp.hello.resolveAttributes = true
+#idp.hello.postAuthenticationFlows =
#idp.lockout.logging = Lockout
#idp.lockout.accessPolicy = AccessDenied
#idp.lockout.authenticated = false
#idp.lockout.nonBrowserSupported = false
#idp.lockout.resolveAttributes = false
+#idp.lockout.postAuthenticationFlows =
#idp.storage.logging = Storage
#idp.storage.accessPolicy = AccessDenied
#idp.storage.authenticated = false
#idp.storage.nonBrowserSupported = false
#idp.storage.resolveAttributes = false
+#idp.storage.postAuthenticationFlows =
#idp.unlock-keys.logging = UnlockKeys
#idp.unlock-keys.accessPolicy = AccessDenied
#idp.unlock-keys.authenticated = true
#idp.unlock-keys.nonBrowserSupported = false
#idp.unlock-keys.resolveAttributes = false
+#idp.unlock-keys.postAuthenticationFlows =
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list