[java-identity-provider] branch main updated: IDP-1819 config for LDAP auth response handlers
Daniel Fisher
dfisher at vt.edu
Fri Sep 3 03:48:40 UTC 2021
This is an automated email from the git hooks/post-receive script.
dfisher pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=4283d8c15c6974e6ff80f866efe840eee9d987bb
The following commit(s) were added to refs/heads/main by this push:
new 4283d8c15 IDP-1819 config for LDAP auth response handlers
4283d8c15 is described below
commit 4283d8c15c6974e6ff80f866efe840eee9d987bb
Author: Daniel Fisher <dfisher at vt.edu>
AuthorDate: Thu Sep 2 23:34:28 2021 -0400
IDP-1819 config for LDAP auth response handlers
https://shibboleth.atlassian.net/browse/IDP-1819
Add StringToPeriodConverter to the spring conversion service.
Add three properties used across various authentication response handlers.
Default those properties so the constructors behave the same as the no-arg constructors.
---
.../config/LDAPAuthenticationFactoryBean.java | 77 +++++++++++++++++++++-
.../net/shibboleth/idp/conf/global-system.xml | 1 +
.../idp/flows/authn/password-authn-beans.xml | 5 +-
3 files changed, 79 insertions(+), 4 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
index a1078a096..39b88de9f 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
@@ -18,8 +18,11 @@
package net.shibboleth.idp.authn.config;
import java.time.Duration;
+import java.time.Period;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+
+import com.google.common.base.MoreObjects;
import net.shibboleth.idp.authn.PooledTemplateSearchDnResolver;
import net.shibboleth.idp.authn.TemplateSearchDnResolver;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -293,6 +296,15 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
/** Whether to use account state data as defined by the EDirectory schema. */
private boolean isEDirectory;
+ /** Authentication handler account state expiration period. */
+ private Period accountStateExpirationPeriod;
+
+ /** Authentication handler account state warning period. */
+ private Period accountStateWarningPeriod;
+
+ /** Authentication handler account state login failures. */
+ private int accountStateLoginFailures;
+
public void setAuthenticatorType(@Nonnull @NotEmpty final String type) {
authenticatorType = AuthenticatorType.fromLabel(type);
if (authenticatorType == null) {
@@ -453,6 +465,18 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
isEDirectory = b;
}
+ public void setAccountStateExpirationPeriod(@Nullable final Period period) {
+ accountStateExpirationPeriod = period;
+ }
+
+ public void setAccountStateWarningPeriod(@Nullable final Period period) {
+ accountStateWarningPeriod = period;
+ }
+
+ public void setAccountStateLoginFailures(final int loginFailures) {
+ accountStateLoginFailures = loginFailures;
+ }
+
/**
* Returns a new SslConfig object derived from the configured {@link #trustType}. Default uses JVM trust.
*
@@ -725,16 +749,63 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
} else if (usePasswordExpiration) {
authenticator.setAuthenticationResponseHandlers(new PasswordExpirationAuthenticationResponseHandler());
} else if (isActiveDirectory) {
- authenticator.setAuthenticationResponseHandlers(new ActiveDirectoryAuthenticationResponseHandler());
+ authenticator.setAuthenticationResponseHandlers(new ActiveDirectoryAuthenticationResponseHandler(accountStateExpirationPeriod, accountStateWarningPeriod));
} else if (isEDirectory) {
- authenticator.setAuthenticationResponseHandlers(new EDirectoryAuthenticationResponseHandler());
+ authenticator.setAuthenticationResponseHandlers(new EDirectoryAuthenticationResponseHandler(accountStateWarningPeriod));
} else if (isFreeIPA) {
- authenticator.setAuthenticationResponseHandlers(new FreeIPAAuthenticationResponseHandler());
+ authenticator.setAuthenticationResponseHandlers(new FreeIPAAuthenticationResponseHandler(accountStateExpirationPeriod, accountStateWarningPeriod, accountStateLoginFailures));
}
+ log.debug("Created {} from {}", authenticator, this);
return authenticator;
}
// Checkstyle: CyclomaticComplexity|MethodLength ON
+ @Override
+ public String toString() {
+ return MoreObjects.toStringHelper(this)
+ .add("authenticatorType", authenticatorType)
+ .add("trustType", trustType)
+ .add("connectionStrategyType", connectionStrategyType)
+ .add("ldapUrl", ldapUrl)
+ .add("useStartTLS", useStartTLS)
+ .add("useSSL", useSSL)
+ .add("disableHostnameVerification", disableHostnameVerification)
+ .add("connectTimeout", connectTimeout)
+ .add("responseTimeout", responseTimeout)
+ .add("trustCertificatesCredentialConfig", trustCertificatesCredentialConfig)
+ .add("truststoreCredentialConfig", truststoreCredentialConfig)
+ .add("disablePooling", disablePooling)
+ .add("blockWaitTime", blockWaitTime)
+ .add("minPoolSize", minPoolSize)
+ .add("maxPoolSize", maxPoolSize)
+ .add("validateOnCheckout", validateOnCheckout)
+ .add("validatePeriodically", validatePeriodically)
+ .add("validatePeriod", validatePeriod)
+ .add("validateDn", validateDn)
+ .add("validateFilter", validateFilter)
+ .add("bindPoolPassivatorType", bindPoolPassivatorType)
+ .add("prunePeriod", prunePeriod)
+ .add("idleTime", idleTime)
+ .add("dnFormat", dnFormat)
+ .add("baseDn", baseDn)
+ .add("userFilter", userFilter)
+ .add("subtreeSearch", subtreeSearch)
+ .add("resolveEntryOnFailure", resolveEntryOnFailure)
+ .add("resolveEntryWithBindDn", resolveEntryWithBindDn)
+ .add("velocityEngine", velocityEngine)
+ .add("bindDn", bindDn)
+ .add("bindDnCredential", bindDnCredential != null ? "suppressed" : null)
+ .add("usePasswordPolicy", usePasswordPolicy)
+ .add("usePasswordExpiration", usePasswordExpiration)
+ .add("isActiveDirectory", isActiveDirectory)
+ .add("isFreeIPA", isFreeIPA)
+ .add("isEDirectory", isEDirectory)
+ .add("accountStateExpirationPeriod", accountStateExpirationPeriod)
+ .add("accountStateWarningPeriod", accountStateWarningPeriod)
+ .add("accountStateLoginFailures", accountStateLoginFailures)
+ .toString();
+ }
+
@Override
public Class<?> getObjectType() {
return Authenticator.class;
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
index 39a5dcbe5..2f405b6e4 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
@@ -30,6 +30,7 @@
<bean class="net.shibboleth.ext.spring.config.FunctionToFunctionConverter" />
<bean class="net.shibboleth.ext.spring.config.PredicateToPredicateConverter" />
<bean class="net.shibboleth.ext.spring.config.StringToDurationConverter" />
+ <bean class="net.shibboleth.ext.spring.config.StringToPeriodConverter" />
</set>
</property>
</bean>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml
index 77ffc193e..2d2517ef4 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml
@@ -177,6 +177,9 @@
p:usePasswordExpiration="%{idp.authn.LDAP.usePasswordExpiration:false}"
p:activeDirectory="%{idp.authn.LDAP.activeDirectory:false}"
p:freeIPA="%{idp.authn.LDAP.freeIPADirectory:false}"
- p:EDirectory="%{idp.authn.LDAP.eDirectory:false}" />
+ p:EDirectory="%{idp.authn.LDAP.eDirectory:false}"
+ p:accountStateExpirationPeriod="%{idp.authn.LDAP.accountStateExpirationPeriod:#{null}}"
+ p:accountStateWarningPeriod="%{idp.authn.LDAP.accountStateWarningPeriod:#{null}}"
+ p:accountStateLoginFailures="%{idp.authn.LDAP.accountStateLoginFailures:0}" />
</beans>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list