[java-identity-provider] branch main updated: IDP-1893 - Log results and principal for SAML proxy flow

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=09f47ff6e19f3f2fdeb1f1f868f5e8691abb0486

The following commit(s) were added to refs/heads/main by this push:
     new 09f47ff6e IDP-1893 - Log results and principal for SAML proxy flow
09f47ff6e is described below

commit 09f47ff6e19f3f2fdeb1f1f868f5e8691abb0486
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Mar 8 15:45:51 2022 -0500

    IDP-1893 - Log results and principal for SAML proxy flow
    
    https://shibboleth.atlassian.net/browse/IDP-1893
    
    Logs with NameID unless idp.authn.SAML.loggedAttributeId is set.
---
 .../idp/flows/authn/saml-authn-beans.xml           |  3 +-
 .../profile/impl/ValidateSAMLAuthentication.java   | 43 +++++++++++++++++++++-
 2 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
index 7b6728de5..a82d5c1f7 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
@@ -454,7 +454,8 @@
         p:metadataResolver-ref="shibboleth.MetadataResolver"
         p:addDefaultPrincipals="#{getObject('shibboleth.authn.SAML.addDefaultPrincipals') ?: %{idp.authn.SAML.addDefaultPrincipals:false}}"
         p:resultCachingPredicate="#{getObject('shibboleth.authn.SAML.resultCachingPredicate')}"        
-        p:attributeExtractionStrategy="#{getObject('shibboleth.authn.SAML.attributeExtractionStrategy')}" />
+        p:attributeExtractionStrategy="#{getObject('shibboleth.authn.SAML.attributeExtractionStrategy')}"
+        p:loggedAttributeId="%{idp.authn.SAML.loggedAttributeId:}" />
 
     <bean id="PopulateSubjectCanonicalizationContext"
         class="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext" scope="prototype"
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
index ca7512b4b..645809abe 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
@@ -55,6 +55,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElemen
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
 import net.shibboleth.utilities.java.support.service.ReloadableService;
 import net.shibboleth.utilities.java.support.service.ServiceableComponent;
 
@@ -117,7 +118,10 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
 
     /** Pluggable strategy function for generalized extraction of data. */
     @Nullable private Function<ProfileRequestContext,Collection<IdPAttribute>> attributeExtractionStrategy;
-    
+
+    /** An IdPAttribute ID to log as a "name" in place of the NameID for "info" purposes. */
+    @Nullable @NotEmpty private String loggedAttributeId;
+
     /** Context containing the result to validate. */
     @Nullable private SAMLAuthnContext samlAuthnContext;
     
@@ -129,7 +133,7 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
 
     /** Incoming context extended translation function. */
     @Nullable private Function<ProfileRequestContext,Collection<Principal>> authnContextTranslatorEx;
-
+    
     /** Context for externally supplied inbound attributes. */
     @Nullable private AttributeContext attributeContext;
         
@@ -198,6 +202,19 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
         
         attributeExtractionStrategy = strategy;
     }
+    
+    /**
+     * An attribute ID to pull a "name" from for logging purposes.
+     * 
+     * @param id attribute ID
+     * 
+     * @since 4.2.0
+     */
+    public void setLoggedAttributeId(@Nullable @NotEmpty final String id) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        loggedAttributeId = StringSupport.trimOrNull(id);
+    }
 
     /** {@inheritDoc} */
     @Override
@@ -270,6 +287,8 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
                 attributeContext.setIdPAttributes(attributes);
             }
         }
+
+        logSuccess();
         
         authnContextTranslator = profileConfiguration.getAuthnContextTranslationStrategy(profileRequestContext);
         authnContextTranslatorEx = profileConfiguration.getAuthnContextTranslationStrategyEx(profileRequestContext);
@@ -286,6 +305,26 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
             }
         }
     }
+    
+    /**
+     * Log a successful authentication based on a designated attribute ID or the NameID value.
+     */
+    protected void logSuccess() {
+        String nameToLog = null;
+        if (loggedAttributeId != null && attributeContext != null) {
+            final IdPAttribute attrToLog = attributeContext.getIdPAttributes().get(loggedAttributeId);
+            if (attrToLog != null && !attrToLog.getValues().isEmpty()) {
+                nameToLog = attrToLog.getValues().get(0).getDisplayValue();
+            }
+        }
+        
+        if (nameToLog == null && samlAuthnContext.getSubject() != null
+                && samlAuthnContext.getSubject().getNameID() != null) {
+            nameToLog = samlAuthnContext.getSubject().getNameID().getValue();
+        }
+
+        log.info("{} SAML authentication succeeded for '{}'", getLogPrefix(), nameToLog);
+    }
         
 // Checkstyle: CyclomaticComplexity|MethodLength OFF
     /** {@inheritDoc} */

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.