[java-identity-provider] branch main updated: IDP-1974 - Blocking unsigned requests via profile configuration
Scott Cantor
cantor.2 at osu.edu
Mon Aug 22 16:09:25 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d3296dd076147c5a5d733a9e12c27e455b124e18
The following commit(s) were added to refs/heads/main by this push:
new d3296dd07 IDP-1974 - Blocking unsigned requests via profile configuration
d3296dd07 is described below
commit d3296dd076147c5a5d733a9e12c27e455b124e18
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Aug 22 12:08:30 2022 -0400
IDP-1974 - Blocking unsigned requests via profile configuration
https://shibboleth.atlassian.net/browse/IDP-1974
---
.../shibboleth/idp/conf/relying-party-mddriven.xml | 8 +++
.../shibboleth/idp/flows/saml/security-beans.xml | 2 +-
.../config/BrowserSSOProfileConfiguration.java | 39 ++++++++++++
.../SAML2AuthnRequestsSignedSecurityHandler.java | 73 ++++++++++++++++++++++
4 files changed, 121 insertions(+), 1 deletion(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
index d363c8d65..1e77ef1fc 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
@@ -431,6 +431,14 @@
<constructor-arg value="false" />
</bean>
</property>
+ <property name="requireSignedRequestsPredicate">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="requireSignedRequests" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
<property name="authnContextTranslationStrategyLookupStrategy">
<bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="authnContextTranslationStrategy"
p:propertyType="#{T(java.util.function.Function)}">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/security-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/security-beans.xml
index 2a2784ad3..e25b4e03f 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/security-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/security-beans.xml
@@ -196,7 +196,7 @@
class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
c:executionDirection="INBOUND">
<constructor-arg name="messageHandler">
- <bean class="org.opensaml.saml.saml2.binding.security.impl.SAML2AuthnRequestsSignedSecurityHandler" scope="prototype" />
+ <bean class="net.shibboleth.idp.saml.messaging.impl.SAML2AuthnRequestsSignedSecurityHandler" scope="prototype" />
</constructor-arg>
<property name="errorEvent">
<util:constant static-field="org.opensaml.profile.action.EventIds.MESSAGE_AUTHN_ERROR" />
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index b600634c4..d3529ed35 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -94,6 +94,9 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
*/
@Nonnull private Predicate<ProfileRequestContext> suppressAuthenticatingAuthorityPredicate;
+ /** Whether to require requests be signed. */
+ @Nonnull private Predicate<ProfileRequestContext> requireSignedRequestsPredicate;
+
/** Lookup function to supply maximum session lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> maximumSPSessionLifetimeLookupStrategy;
@@ -154,6 +157,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
skipEndpointValidationWhenSignedPredicate = Predicates.alwaysFalse();
proxiedAuthnInstantPredicate = Predicates.alwaysTrue();
suppressAuthenticatingAuthorityPredicate = Predicates.alwaysFalse();
+ requireSignedRequestsPredicate = Predicates.alwaysFalse();
maximumSPSessionLifetimeLookupStrategy = FunctionSupport.constant(null);
maximumTimeSinceAuthnLookupStrategy = FunctionSupport.constant(null);
maximumTokenDelegationChainLengthLookupStrategy = FunctionSupport.constant(DEFAULT_DELEGATION_CHAIN_LENGTH);
@@ -436,6 +440,41 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
proxiedAuthnInstantPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /**
+ * Get whether to require signed requests.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether to require signed requests
+ *
+ * @since 4.3.0
+ */
+ public boolean isRequireSignedRequests(@Nullable final ProfileRequestContext profileRequestContext) {
+ return requireSignedRequestsPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to require signed requests.
+ *
+ * @param flag flag to set
+ *
+ * @since 4.3.0
+ */
+ public void setRequireSignedRequests(final boolean flag) {
+ requireSignedRequestsPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set a condition to determine whether to require signed requests.
+ *
+ * @param condition condition to set
+ *
+ * @since 4.3.0
+ */
+ public void setRequireSignedRequestsPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ requireSignedRequestsPredicate = Constraint.isNotNull(condition, "Signed requests predicate cannot be null");
+ }
+
/**
* Get the maximum amount of time the service provider should maintain a session for the user
* based on the authentication assertion. A null or 0 is interpreted as an unlimited lifetime.
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/SAML2AuthnRequestsSignedSecurityHandler.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/SAML2AuthnRequestsSignedSecurityHandler.java
new file mode 100644
index 000000000..ed1a3f775
--- /dev/null
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/SAML2AuthnRequestsSignedSecurityHandler.java
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.messaging.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
+
+/**
+ * Message handler implementation that enforces the AuthnRequestsSigned flag of
+ * SAML 2 metadata element @{link {@link SPSSODescriptor} and/or a local profile
+ * configuration option.
+ */
+public class SAML2AuthnRequestsSignedSecurityHandler
+ extends org.opensaml.saml.saml2.binding.security.impl.SAML2AuthnRequestsSignedSecurityHandler{
+
+ /** Logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(SAML2AuthnRequestsSignedSecurityHandler.class);
+
+ /** Lookup strategy for relying party context. */
+ @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
+
+ /** Constructor. */
+ public SAML2AuthnRequestsSignedSecurityHandler() {
+ relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected boolean isRequestSigningRequired(@Nonnull final MessageContext messageContext) {
+ if (super.isRequestSigningRequired(messageContext)) {
+ return true;
+ }
+
+ if (messageContext.getParent() instanceof ProfileRequestContext) {
+ final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(
+ (ProfileRequestContext) messageContext.getParent());
+ if (rpCtx != null && rpCtx.getProfileConfig() instanceof BrowserSSOProfileConfiguration) {
+ return ((BrowserSSOProfileConfiguration) rpCtx.getProfileConfig()).isRequireSignedRequests(
+ (ProfileRequestContext) messageContext.getParent());
+ }
+ }
+
+ log.warn("Unable to locate profile configuration in context tree");
+ return false;
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list