[JIRA] (IDP-1907) Enable Spring MVC's CORS-handling features

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *commented* on IDP-1907 ( https://shibboleth.atlassian.net/browse/IDP-1907?atlOrigin=eyJpIjoiNmY5MjJlYTc5NmI4NGZlNjk2M2Q0NTlhOWUwMGMxMTMiLCJwIjoiaiJ9 )

Re: Enable Spring MVC's CORS-handling features ( https://shibboleth.atlassian.net/browse/IDP-1907?atlOrigin=eyJpIjoiNmY5MjJlYTc5NmI4NGZlNjk2M2Q0NTlhOWUwMGMxMTMiLCJwIjoiaiJ9 )

The simplest and so far the best way to enable configurable CORS support seems to be to refer to a configurable map of CorsConfigurations in the FlowHandlerMapping bean:

   <bean class="org.springframework.webflow.mvc.servlet.FlowHandlerMapping" p:order="0"
           p:flowRegistry-ref="flowRegistry" p:corsConfigurations="#{getObject('shibboleth.CorsConfigurations')}">
       <property name="flowUrlHandler">
           <bean class="net.shibboleth.idp.profile.support.PathInfoSupportingFlowUrlHandler"
               p:supportedFlows="#{getObject('shibboleth.RESTFlows') ?: getObject('shibboleth.DefaultRESTFlows')}" />
       </property>
   </bean>

The bean/object shibboleth.CorsConfigurations can be null or undefined. In that case the functionality is the same as without having the property set at all.

The map could then be defined for instance in the global beans in the following way:

   <util:map id="shibboleth.CorsConfigurations" value-type="org.springframework.web.cors.CorsConfiguration">
       <entry key="/oidc/userinfo">
           <bean class="org.springframework.web.cors.CorsConfiguration"
               p:allowedOrigins="http://localhost:8080,http://localhost:8081"
               p:allowedMethods="GET"
               p:allowedHeaders="Authorization"
               p:maxAge="1800" />
       </entry>
   </util:map>

Do we want to support other handlers mapping in addition to the Web Flow handler? So far I’ve only tested this with the web flows: in that case they keys (URLs) in the configuration map seems to refer to the values after /profile -prefix, under the idp context.

( https://shibboleth.atlassian.net/browse/IDP-1907#add-comment?atlOrigin=eyJpIjoiNmY5MjJlYTc5NmI4NGZlNjk2M2Q0NTlhOWUwMGMxMTMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1907#add-comment?atlOrigin=eyJpIjoiNmY5MjJlYTc5NmI4NGZlNjk2M2Q0NTlhOWUwMGMxMTMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100192- sha1:2947bec )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220225/27b1405d/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-ae3ab984-7810-4676-a939-5ce91db0b6ae
Type: image/png
Size: 341 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220225/27b1405d/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-cfedb27d-dbfa-4287-b18d-12113084f5bd
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220225/27b1405d/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-30b9acf3-28b0-4eb8-a0ea-4e315a54471f
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220225/27b1405d/attachment-0005.png>