[java-identity-provider] branch main updated: IDP-1834 - Move inbound security flow outside inbound interceptor loop
Scott Cantor
cantor.2 at osu.edu
Thu Mar 24 18:47:00 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=45a849f5693b6a79d931ec5744ffa586f27a93ca
The following commit(s) were added to refs/heads/main by this push:
new 45a849f56 IDP-1834 - Move inbound security flow outside inbound interceptor loop
45a849f56 is described below
commit 45a849f5693b6a79d931ec5744ffa586f27a93ca
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Mar 24 14:46:57 2022 -0400
IDP-1834 - Move inbound security flow outside inbound interceptor loop
https://shibboleth.atlassian.net/browse/IDP-1834
---
.../shibboleth/idp/conf/relying-party-mddriven.xml | 33 +++++++++----------
.../shibboleth/idp/conf/relying-party-system.xml | 15 ++-------
.../idp/flows/saml/saml-abstract-flow.xml | 8 ++++-
.../flows/saml/saml1/artifact-resolution-flow.xml | 3 ++
.../idp/flows/saml/saml1/attribute-query-flow.xml | 3 ++
.../idp/flows/saml/saml1/sso-abstract-flow.xml | 3 ++
.../flows/saml/saml2/artifact-resolution-flow.xml | 3 ++
.../idp/flows/saml/saml2/attribute-query-flow.xml | 3 ++
.../idp/flows/saml/saml2/idwsf-ssos-flow.xml | 1 +
.../idp/flows/saml/saml2/slo-back-flow.xml | 3 ++
.../flows/saml/saml2/slo-front-abstract-flow.xml | 5 ++-
.../idp/flows/saml/saml2/sso-abstract-flow.xml | 3 ++
.../idp/flows/saml/saml2/sso-ecp-flow.xml | 7 ++++
.../config/AbstractProfileConfiguration.java | 38 +++++++++++++++++++++-
.../config/AbstractSAMLProfileConfiguration.java | 14 --------
15 files changed, 95 insertions(+), 47 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
index ada8951cc..1cb8e566a 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
@@ -112,6 +112,12 @@
</property>
</bean>
</property>
+ <property name="inboundInterceptorFlowsLookupStrategy">
+ <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="inboundInterceptorFlows" />
+ </property>
+ <property name="outboundInterceptorFlowsLookupStrategy">
+ <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="outboundInterceptorFlows" />
+ </property>
</bean>
<bean id="AbstractMDDrivenSAMLProfile" parent="AbstractMDDrivenProfile" abstract="true">
@@ -232,8 +238,7 @@
<bean id="Shibboleth.SSO.MDDriven" parent="AbstractMDDrivenSAMLProfile" lazy-init="true"
class="net.shibboleth.idp.saml.saml1.profile.config.BrowserSSOProfileConfiguration"
- p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration"
- p:inboundInterceptorFlows="security-policy/shibboleth-sso">
+ p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration">
<property name="artifactConfigurationLookupStrategy">
<bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="artifactConfiguration"
p:propertyType="#{T(net.shibboleth.idp.saml.profile.config.SAMLArtifactConfiguration)}" />
@@ -286,8 +291,7 @@
</bean>
<bean id="SAML1.AttributeQuery.MDDriven" parent="AbstractMDDrivenSAMLProfile" lazy-init="true"
- class="net.shibboleth.idp.saml.saml1.profile.config.AttributeQueryProfileConfiguration"
- p:inboundInterceptorFlows="security-policy/saml-soap">
+ class="net.shibboleth.idp.saml.saml1.profile.config.AttributeQueryProfileConfiguration">
<property name="signResponsesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
@@ -301,8 +305,7 @@
</bean>
<bean id="SAML1.ArtifactResolution.MDDriven" parent="AbstractMDDrivenSAMLProfile" lazy-init="true"
- class="net.shibboleth.idp.saml.saml1.profile.config.ArtifactResolutionProfileConfiguration"
- p:inboundInterceptorFlows="security-policy/saml-soap">
+ class="net.shibboleth.idp.saml.saml1.profile.config.ArtifactResolutionProfileConfiguration">
<property name="signResponsesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
@@ -317,8 +320,7 @@
<bean id="SAML2.SSO.MDDriven" parent="AbstractMDDrivenSAML2Profile" lazy-init="true"
class="net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration"
- p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration"
- p:inboundInterceptorFlows="security-policy/saml2-sso">
+ p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration">
<property name="artifactConfigurationLookupStrategy">
<bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="artifactConfiguration"
p:propertyType="#{T(net.shibboleth.idp.saml.profile.config.SAMLArtifactConfiguration)}" />
@@ -490,8 +492,7 @@
</bean>
<bean id="SAML2.ECP.MDDriven" parent="SAML2.SSO.MDDriven" lazy-init="true"
- class="net.shibboleth.idp.saml.saml2.profile.config.ECPProfileConfiguration"
- p:inboundInterceptorFlows="security-policy/saml2-ecp">
+ class="net.shibboleth.idp.saml.saml2.profile.config.ECPProfileConfiguration">
<property name="localEventsLookupStrategy">
<bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="localEvents" />
</property>
@@ -499,8 +500,7 @@
<bean id="SAML2.Logout.MDDriven" parent="AbstractMDDrivenSAML2Profile" lazy-init="true"
class="net.shibboleth.idp.saml.saml2.profile.config.SingleLogoutProfileConfiguration"
- p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration"
- p:inboundInterceptorFlows="security-policy/saml2-slo">
+ p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration">
<property name="artifactConfigurationLookupStrategy">
<bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="artifactConfiguration"
p:propertyType="#{T(net.shibboleth.idp.saml.profile.config.SAMLArtifactConfiguration)}" />
@@ -589,8 +589,7 @@
</bean>
<bean id="SAML2.AttributeQuery.MDDriven" parent="AbstractMDDrivenSAML2Profile" lazy-init="true"
- class="net.shibboleth.idp.saml.saml2.profile.config.AttributeQueryProfileConfiguration"
- p:inboundInterceptorFlows="security-policy/saml-soap">
+ class="net.shibboleth.idp.saml.saml2.profile.config.AttributeQueryProfileConfiguration">
<property name="signResponsesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
@@ -614,8 +613,7 @@
</bean>
<bean id="SAML2.ArtifactResolution.MDDriven" parent="AbstractMDDrivenSAML2Profile" lazy-init="true"
- class="net.shibboleth.idp.saml.saml2.profile.config.ArtifactResolutionProfileConfiguration"
- p:inboundInterceptorFlows="security-policy/saml-soap">
+ class="net.shibboleth.idp.saml.saml2.profile.config.ArtifactResolutionProfileConfiguration">
<property name="signResponsesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
@@ -639,8 +637,7 @@
</bean>
<bean id="Liberty.SSOS.MDDriven" parent="SAML2.SSO.MDDriven" lazy-init="true"
- class="net.shibboleth.idp.saml.idwsf.profile.config.SSOSProfileConfiguration"
- p:inboundInterceptorFlows="security-policy/saml2-idwsf-ssos">
+ class="net.shibboleth.idp.saml.idwsf.profile.config.SSOSProfileConfiguration">
<property name="delegationPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml
index ff51df832..c4b2261a8 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-system.xml
@@ -82,21 +82,17 @@
<bean id="Shibboleth.SSO" lazy-init="true"
class="net.shibboleth.idp.saml.saml1.profile.config.BrowserSSOProfileConfiguration"
- p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration"
- p:inboundInterceptorFlows="security-policy/shibboleth-sso" />
+ p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration" />
<bean id="SAML1.AttributeQuery" lazy-init="true"
- class="net.shibboleth.idp.saml.saml1.profile.config.AttributeQueryProfileConfiguration"
- p:inboundInterceptorFlows="security-policy/saml-soap" />
+ class="net.shibboleth.idp.saml.saml1.profile.config.AttributeQueryProfileConfiguration" />
<bean id="SAML1.ArtifactResolution" lazy-init="true"
- class="net.shibboleth.idp.saml.saml1.profile.config.ArtifactResolutionProfileConfiguration"
- p:inboundInterceptorFlows="security-policy/saml-soap" />
+ class="net.shibboleth.idp.saml.saml1.profile.config.ArtifactResolutionProfileConfiguration" />
<bean id="SAML2.SSO" lazy-init="true"
class="net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration"
p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration"
- p:inboundInterceptorFlows="security-policy/saml2-sso"
p:encryptionOptionalPredicate="%{idp.encryption.optional:false}">
<property name="defaultAuthenticationMethodsLookupStrategy">
<bean class="net.shibboleth.idp.saml.saml2.profile.config.navigate.ProxyAwareDefaultAuthenticationMethodsLookupFunction"
@@ -116,28 +112,23 @@
<bean id="SAML2.ECP" lazy-init="true"
class="net.shibboleth.idp.saml.saml2.profile.config.ECPProfileConfiguration"
- p:inboundInterceptorFlows="security-policy/saml2-ecp"
p:encryptionOptionalPredicate="%{idp.encryption.optional:false}" />
<bean id="SAML2.Logout" lazy-init="true"
class="net.shibboleth.idp.saml.saml2.profile.config.SingleLogoutProfileConfiguration"
p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration"
- p:inboundInterceptorFlows="security-policy/saml2-slo"
p:encryptionOptionalPredicate="%{idp.encryption.optional:false}" />
<bean id="SAML2.AttributeQuery" lazy-init="true"
class="net.shibboleth.idp.saml.saml2.profile.config.AttributeQueryProfileConfiguration"
- p:inboundInterceptorFlows="security-policy/saml-soap"
p:encryptionOptionalPredicate="%{idp.encryption.optional:false}" />
<bean id="SAML2.ArtifactResolution" lazy-init="true"
class="net.shibboleth.idp.saml.saml2.profile.config.ArtifactResolutionProfileConfiguration"
- p:inboundInterceptorFlows="security-policy/saml-soap"
p:encryptionOptionalPredicate="%{idp.encryption.optional:false}" />
<bean id="Liberty.SSOS" lazy-init="true"
class="net.shibboleth.idp.saml.idwsf.profile.config.SSOSProfileConfiguration"
- p:inboundInterceptorFlows="security-policy/saml2-idwsf-ssos"
p:encryptionOptionalPredicate="%{idp.encryption.optional:false}" />
<bean id="CAS.LoginConfiguration" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml
index 4535aef22..8092c6141 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml
@@ -39,10 +39,16 @@
<decision-state id="CheckInboundInterceptContext">
<if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).getAvailableFlows().isEmpty()"
- then="OutboundContextsAndSecurityParameters" else="DoInboundInterceptSubflow" />
+ then="DoInboundSecuritySubflow" else="DoInboundInterceptSubflow" />
</decision-state>
<subflow-state id="DoInboundInterceptSubflow" subflow="intercept">
+ <input name="calledAsSubflow" value="true" />
+ <transition on="proceed" to="DoInboundSecuritySubflow" />
+ </subflow-state>
+
+ <!-- Each SAML flow has a dedicated subflow for applying message handlers inbound. -->
+ <subflow-state id="DoInboundSecuritySubflow" subflow="#{flowScope.inboundSecuritySubflow}">
<input name="calledAsSubflow" value="true" />
<transition on="proceed" to="OutboundContextsAndSecurityParameters" />
</subflow-state>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-flow.xml
index eff489447..1b9f30f6d 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-flow.xml
@@ -6,6 +6,9 @@
<!-- Bootstrap action has to be at the "top" of the flow after this flow prepends itself to parent. -->
<action-state id="InitializeProfileRequestContext">
+ <on-entry>
+ <set name="flowScope.inboundSecuritySubflow" value="'intercept/security-policy/saml-soap'" />
+ </on-entry>
<evaluate expression="InitializeProfileRequestContext" />
<evaluate expression="FlowStartPopulateAuditContext" />
<evaluate expression="'proceed'" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-flow.xml
index b51a10d40..451bd1899 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-flow.xml
@@ -6,6 +6,9 @@
<!-- Bootstrap action has to be at the "top" of the flow after this flow prepends itself to parent. -->
<action-state id="InitializeProfileRequestContext">
+ <on-entry>
+ <set name="flowScope.inboundSecuritySubflow" value="'intercept/security-policy/saml-soap'" />
+ </on-entry>
<evaluate expression="InitializeProfileRequestContext" />
<evaluate expression="FlowStartPopulateAuditContext" />
<evaluate expression="'proceed'" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-abstract-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-abstract-flow.xml
index cc0c9b077..6238f8ebf 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-abstract-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-abstract-flow.xml
@@ -6,6 +6,9 @@
<!-- Bootstrap action has to be at the "top" of the flow after this flow prepends itself to parent. -->
<action-state id="InitializeProfileRequestContext">
+ <on-entry>
+ <set name="flowScope.inboundSecuritySubflow" value="'intercept/security-policy/shibboleth-sso'" />
+ </on-entry>
<evaluate expression="InitializeProfileRequestContext" />
<evaluate expression="FlowStartPopulateAuditContext" />
<evaluate expression="'proceed'" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-flow.xml
index face40b3b..fdbf14891 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-flow.xml
@@ -6,6 +6,9 @@
<!-- Bootstrap action has to be at the "top" of the flow after this flow prepends itself to parent. -->
<action-state id="InitializeProfileRequestContext">
+ <on-entry>
+ <set name="flowScope.inboundSecuritySubflow" value="'intercept/security-policy/saml-soap'" />
+ </on-entry>
<evaluate expression="InitializeProfileRequestContext" />
<evaluate expression="FlowStartPopulateAuditContext" />
<evaluate expression="'proceed'" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-flow.xml
index c32534bce..0f9b1df94 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-flow.xml
@@ -6,6 +6,9 @@
<!-- Bootstrap action has to be at the "top" of the flow after this flow prepends itself to parent. -->
<action-state id="InitializeProfileRequestContext">
+ <on-entry>
+ <set name="flowScope.inboundSecuritySubflow" value="'intercept/security-policy/saml-soap'" />
+ </on-entry>
<evaluate expression="InitializeProfileRequestContext" />
<evaluate expression="FlowStartPopulateAuditContext" />
<evaluate expression="'proceed'" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-flow.xml
index c858ae9bb..19f93b20b 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-flow.xml
@@ -8,6 +8,7 @@
<action-state id="InitializeProfileRequestContext">
<on-entry>
<evaluate expression="T(net.shibboleth.utilities.java.support.primitive.DeprecationSupport).warnOnce(T(net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType).WEBFLOW, 'SAML delegation flow', null, null)" />
+ <set name="flowScope.inboundSecuritySubflow" value="'intercept/security-policy/saml2-idwsf-ssos'" />
</on-entry>
<evaluate expression="InitializeProfileRequestContext" />
<evaluate expression="FlowStartPopulateAuditContext" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-flow.xml
index 8f075f3c8..8e9829516 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-flow.xml
@@ -10,6 +10,9 @@
</on-start>
<action-state id="InitializeProfileRequestContext">
+ <on-entry>
+ <set name="flowScope.inboundSecuritySubflow" value="'intercept/security-policy/saml2-slo'" />
+ </on-entry>
<evaluate expression="InitializeProfileRequestContext" />
<evaluate expression="FlowStartPopulateAuditContext" />
<evaluate expression="'proceed'" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-front-abstract-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-front-abstract-flow.xml
index 95813d4d6..162b340ee 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-front-abstract-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-front-abstract-flow.xml
@@ -6,6 +6,9 @@
<!-- Bootstrap action has to be at the "top" of the flow after this flow prepends itself to parent. -->
<action-state id="InitializeProfileRequestContext">
+ <on-entry>
+ <set name="flowScope.inboundSecuritySubflow" value="'intercept/security-policy/saml2-slo'" />
+ </on-entry>
<evaluate expression="InitializeProfileRequestContext" />
<evaluate expression="FlowStartPopulateAuditContext" />
<evaluate expression="'proceed'" />
@@ -24,7 +27,7 @@
after the inbound message subflow runs, to bypass the rest of the parent flow. Anything else
passes control back to the next parent state.
-->
- <subflow-state id="DoInboundInterceptSubflow">
+ <subflow-state id="DoInboundSecuritySubflow">
<transition on="proceed" to="PreProcessLogoutMessage" />
</subflow-state>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-flow.xml
index 67e8d2b44..bdf6664fa 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-flow.xml
@@ -6,6 +6,9 @@
<!-- Bootstrap action has to be at the "top" of the flow after this flow prepends itself to parent. -->
<action-state id="InitializeProfileRequestContext">
+ <on-entry>
+ <set name="flowScope.inboundSecuritySubflow" value="'intercept/security-policy/saml2-sso'" />
+ </on-entry>
<evaluate expression="InitializeProfileRequestContext" />
<evaluate expression="FlowStartPopulateAuditContext" />
<evaluate expression="'proceed'" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-ecp-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-ecp-flow.xml
index 58a6660e9..442bef730 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-ecp-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-ecp-flow.xml
@@ -3,6 +3,13 @@
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
parent="saml2.sso.abstract">
+ <!-- This adds the <set> element to the end of the parent flow's initial state, which overrides the subflow value. -->
+ <action-state id="InitializeProfileRequestContext" parent="saml2.sso.abstract#InitializeProfileRequestContext">
+ <on-entry>
+ <set name="flowScope.inboundSecuritySubflow" value="'intercept/security-policy/saml2-ecp'" />
+ </on-entry>
+ </action-state>
+
<bean-import resource="sso-ecp-beans.xml" />
</flow>
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/AbstractProfileConfiguration.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/AbstractProfileConfiguration.java
index 25493b24d..a5ff3a52d 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/AbstractProfileConfiguration.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/AbstractProfileConfiguration.java
@@ -34,6 +34,8 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
import net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
@@ -131,12 +133,29 @@ public abstract class AbstractProfileConfiguration extends AbstractIdentifiableI
* @param strategy lookup strategy
*
* @since 3.3.0
+ *
+ * @deprecated
*/
+ @Deprecated(since="4.2.0", forRemoval=true)
public void setInboundFlowsLookupStrategy(@Nonnull final Function<ProfileRequestContext,List<String>> strategy) {
- inboundFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ DeprecationSupport.warn(ObjectType.METHOD, "setInboundFlowsLookupStrategy", "relying-party.xml",
+ "setInboundInterceptorFlowsLookupStrategy");
+ setInboundInterceptorFlowsLookupStrategy(strategy);
}
+ /**
+ * Set a lookup strategy for the inbound interceptor flows to enable.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 4.2.0
+ */
+ public void setInboundInterceptorFlowsLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,List<String>> strategy) {
+ inboundFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
/** {@inheritDoc} */
@Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getOutboundInterceptorFlows(
@Nullable final ProfileRequestContext profileRequestContext) {
@@ -167,8 +186,25 @@ public abstract class AbstractProfileConfiguration extends AbstractIdentifiableI
* @param strategy lookup strategy
*
* @since 3.3.0
+ *
+ * @deprecated
*/
+ @Deprecated(since="4.2.0", forRemoval=true)
public void setOutboundFlowsLookupStrategy(@Nonnull final Function<ProfileRequestContext,List<String>> strategy) {
+ DeprecationSupport.warn(ObjectType.METHOD, "setOutboundFlowsLookupStrategy", "relying-party.xml",
+ "setOutboundInterceptorFlowsLookupStrategy");
+ outboundFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
+ * Set a lookup strategy for the outbound interceptor flows to enable.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 4.2.0
+ */
+ public void setOutboundInterceptorFlowsLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,List<String>> strategy) {
outboundFlowsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java
index 4519c5ad5..74da3096f 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java
@@ -20,7 +20,6 @@ package net.shibboleth.idp.saml.profile.config;
import java.time.Duration;
import java.util.Collection;
import java.util.Collections;
-import java.util.List;
import java.util.Set;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -32,7 +31,6 @@ import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
@@ -86,18 +84,6 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractCondition
assertionLifetimeLookupStrategy = FunctionSupport.constant(DEFAULT_ASSERTION_LIFETIME);
assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
}
-
- /** {@inheritDoc} */
- @Override
- @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getInboundInterceptorFlows(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final List<String> flows = super.getInboundInterceptorFlows(profileRequestContext);
- if (flows.isEmpty()) {
- log.warn("Inbound interceptor collection is empty, this disables default inbound message security checks");
- }
- return flows;
- }
/** {@inheritDoc} */
public boolean isSignAssertions(@Nullable final ProfileRequestContext profileRequestContext) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list