[java-identity-provider] branch main updated: IDP-2015 - Review web.xml for improvements via code or annotations
Scott Cantor
cantor.2 at osu.edu
Mon Oct 3 17:39:18 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=8b7337e401ea1529a5ed0e4395d8e6db0eb8d3f7
The following commit(s) were added to refs/heads/main by this push:
new 8b7337e40 IDP-2015 - Review web.xml for improvements via code or annotations
8b7337e40 is described below
commit 8b7337e401ea1529a5ed0e4395d8e6db0eb8d3f7
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Oct 3 13:39:15 2022 -0400
IDP-2015 - Review web.xml for improvements via code or annotations
https://shibboleth.atlassian.net/browse/IDP-2015
Revised approach to handling filter enablement.
Add initializers for Spring set up and servlet installation.
---
...gisterFilterChainServletContextInitializer.java | 24 ++---
.../ServletConfigServletContextInitializer.java | 106 +++++++++++++++++++++
.../SpringConfigServletContextInitializer.java | 72 ++++++++++++++
.../jakarta.servlet.ServletContainerInitializer | 4 +-
idp-conf/src/main/resources/conf/idp.properties | 4 -
idp-war/src/main/webapp/WEB-INF/web.xml | 54 ++++-------
6 files changed, 205 insertions(+), 59 deletions(-)
diff --git a/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/RegisterFilterChainServletContextInitializer.java b/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/RegisterFilterChainServletContextInitializer.java
index e749b0bed..b45a4a3fe 100644
--- a/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/RegisterFilterChainServletContextInitializer.java
+++ b/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/RegisterFilterChainServletContextInitializer.java
@@ -30,28 +30,21 @@ import jakarta.servlet.ServletContainerInitializer;
import jakarta.servlet.ServletContext;
import jakarta.servlet.ServletException;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.primitive.StringSupport;
/**
* A {@link ServletContainerInitializer} implementation that registers a filter chain embedded in
* our Spring configuration.
*
- * The filter registration can be disabled by setting the system property
- * {@link RegisterFilterChainServletContextInitializer#SYSTEM_PROPERTY_ACTIVATION} to <pre>disabled</pre>.
+ * <p>The filter registration is on by default but can be disabled by setting the context init-param
+ * {@link RegisterFilterChainServletContextInitializer#INIT_PARAMETER_ACTIVATION} to <pre>false</pre>.</p>
*
- * The chain is always mapped to all requests because it is expected that any further granularity is
- * configured via Spring.
+ * <p>The chain is always mapped to all requests because it is expected that any further granularity is
+ * configured via Spring.</p>
*/
public class RegisterFilterChainServletContextInitializer implements ServletContainerInitializer {
/** System property name for the activation of this class. */
- @Nonnull @NotEmpty public static final String SYSTEM_PROPERTY_ACTIVATION = "idp.autoRegisterFilterChain";
-
- /** System property name for the activation of this class. */
- @Nonnull @NotEmpty public static final String SYSTEM_PROPERTY_SERVLET = SYSTEM_PROPERTY_ACTIVATION + ".servlet";
-
- /** Name of servlet that MUST be registered for us to run. */
- @Nonnull @NotEmpty public static final String DEFAULT_SERVLET_TO_CHECK = "idp";
+ @Nonnull @NotEmpty public static final String INIT_PARAMETER_ACTIVATION = "net.shibboleth.idp.registerFilterChain";
/** The filter name for the embedded filter chain. */
@Nonnull @NotEmpty public static final String FILTER_NAME = "ShibbolethFilterChain";
@@ -66,15 +59,10 @@ public class RegisterFilterChainServletContextInitializer implements ServletCont
@Override
public void onStartup(final Set<Class<?>> c, final ServletContext ctx) throws ServletException {
- final String flag = System.getProperty(SYSTEM_PROPERTY_ACTIVATION);
- log.debug("The value of the flag {}: {}", SYSTEM_PROPERTY_ACTIVATION, flag);
+ final String flag = ctx.getInitParameter(INIT_PARAMETER_ACTIVATION);
if ("false".equalsIgnoreCase(flag)) {
log.info("Filter registration is disabled");
return;
- } else if (ctx.getServletRegistration(StringSupport.trimOrNull(
- System.getProperty(SYSTEM_PROPERTY_SERVLET, DEFAULT_SERVLET_TO_CHECK))) == null) {
- log.debug("Ignoring invocation outside IdP context");
- return;
}
log.debug("Attempting to register filter '{}'", FILTER_NAME);
diff --git a/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/ServletConfigServletContextInitializer.java b/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/ServletConfigServletContextInitializer.java
new file mode 100644
index 000000000..c3f266f67
--- /dev/null
+++ b/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/ServletConfigServletContextInitializer.java
@@ -0,0 +1,106 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.conf.impl;
+
+import java.util.Set;
+
+import javax.annotation.Nonnull;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.web.servlet.DispatcherServlet;
+
+import jakarta.servlet.ServletContainerInitializer;
+import jakarta.servlet.ServletContext;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRegistration;
+//import net.shibboleth.idp.authn.impl.RemoteUserAuthServlet;
+//import net.shibboleth.idp.authn.impl.X509AuthServlet;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.spring.context.DelimiterAwareApplicationContext;
+
+/**
+ * A {@link ServletContainerInitializer} implementation that registers the servlets used by the IdP.
+ *
+ * <p>Registration of each servlet must be enabled by adding specific servlet init-params and is
+ * therefore off by default for backward compatibility with old web.xml files.</p>
+ */
+public class ServletConfigServletContextInitializer implements ServletContainerInitializer {
+
+ /** Context parameter name for the installation of the IdP servlet. */
+ @Nonnull @NotEmpty public static final String INIT_PARAMETER_IDP_ACTIVATION =
+ "net.shibboleth.idp.registerIdPServlet";
+
+ /** Context parameter name for the installation of the IdP servlet. */
+ @Nonnull @NotEmpty public static final String INIT_PARAMETER_REMOTEUSER_ACTIVATION =
+ "net.shibboleth.idp.registerRemoteUserServlet";
+
+ /** Context parameter name for the installation of the IdP servlet. */
+ @Nonnull @NotEmpty public static final String INIT_PARAMETER_X509_ACTIVATION =
+ "net.shibboleth.idp.registerX509Servlet";
+
+ /** Context parameter name for the installation of the IdP servlet. */
+ @Nonnull @NotEmpty public static final String INIT_PARAMETER_METADATA_ACTIVATION =
+ "net.shibboleth.idp.registerMetadataServlet";
+
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ServletConfigServletContextInitializer.class);
+
+ /** {@inheritDoc} */
+ @Override
+ public void onStartup(final Set<Class<?>> c, final ServletContext ctx) throws ServletException {
+
+ final String idpFlag = ctx.getInitParameter(INIT_PARAMETER_IDP_ACTIVATION);
+ final String remoteUserFlag = ctx.getInitParameter(INIT_PARAMETER_REMOTEUSER_ACTIVATION);
+ final String x509Flag = ctx.getInitParameter(INIT_PARAMETER_X509_ACTIVATION);
+ final String metadataFlag = ctx.getInitParameter(INIT_PARAMETER_METADATA_ACTIVATION);
+
+ if ("true".equalsIgnoreCase(idpFlag)) {
+ log.info("Registering primary IdP servlet");
+ final ServletRegistration.Dynamic registration = ctx.addServlet("idp", DispatcherServlet.class);
+ registration.addMapping("/status", "/profile/*");
+ registration.setInitParameter("contextClass", DelimiterAwareApplicationContext.class.getName());
+ registration.setInitParameter("contextConfigLocation",
+ "classpath*:/META-INF/net/shibboleth/idp/mvc/preconfig.xml,classpath:/net/shibboleth/idp/conf/mvc-beans.xml,classpath:/net/shibboleth/idp/conf/webflow-config.xml,classpath*:/META-INF/net/shibboleth/idp/mvc/postconfig.xml");
+ }
+
+ /*
+ if ("true".equalsIgnoreCase(remoteUserFlag)) {
+ log.info("Registering RemoteUser authentication servlet");
+ ServletRegistration.Dynamic registration = ctx.addServlet("RemoteUserAuthHandler", RemoteUserAuthServlet.class);
+ registration.addMapping("/Authn/RemoteUser");
+ registration.setLoadOnStartup(2);
+ }
+
+ if ("true".equalsIgnoreCase(x509Flag)) {
+ log.info("Registering X.509 authentication servlet");
+ ServletRegistration.Dynamic registration = ctx.addServlet("X509AuthHandler", X509AuthServlet.class);
+ registration.addMapping("/Authn/X509");
+ registration.setLoadOnStartup(3);
+ }
+ */
+
+ if ("true".equals(metadataFlag)) {
+ log.info("Registering metadata endpoint servlet");
+ final ServletRegistration.Dynamic registration = ctx.addJspFile("MetadataAccessHandler", "/WEB-INF/jsp/metadata.jsp");
+ registration.addMapping("/shibboleth");
+ }
+ }
+
+}
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/SpringConfigServletContextInitializer.java b/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/SpringConfigServletContextInitializer.java
new file mode 100644
index 000000000..4e196f580
--- /dev/null
+++ b/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/SpringConfigServletContextInitializer.java
@@ -0,0 +1,72 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.conf.impl;
+
+import java.util.Set;
+
+import javax.annotation.Nonnull;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import jakarta.servlet.ServletContainerInitializer;
+import jakarta.servlet.ServletContext;
+import jakarta.servlet.ServletException;
+import net.shibboleth.idp.spring.IdPPropertiesApplicationContextInitializer;
+import net.shibboleth.shared.spring.context.DelimiterAwareApplicationContext;
+
+/**
+ * A {@link ServletContainerInitializer} implementation that sets core parameters used to
+ * install Spring support into the context.
+ */
+public class SpringConfigServletContextInitializer implements ServletContainerInitializer {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(SpringConfigServletContextInitializer.class);
+
+ /** {@inheritDoc} */
+ @Override
+ public void onStartup(final Set<Class<?>> c, final ServletContext ctx) throws ServletException {
+
+ String param = ctx.getInitParameter("contextClass");
+ if (param == null) {
+ log.info("Setting init parameter contextClass");
+ ctx.setInitParameter("contextClass", DelimiterAwareApplicationContext.class.getName());
+ } else {
+ log.info("Init parameter contextClass already set to {}", param);
+ }
+
+ param = ctx.getInitParameter("contextInitializerClasses");
+ if (param == null) {
+ log.info("Setting init parameter contextInitializerClasses");
+ ctx.setInitParameter("contextInitializerClasses", IdPPropertiesApplicationContextInitializer.class.getName());
+ } else {
+ log.info("Init parameter contextInitializerClasses already set to {}", param);
+ }
+
+ param = ctx.getInitParameter("contextConfigLocation");
+ if (param == null) {
+ log.info("Setting init parameter contextConfigLocation");
+ ctx.setInitParameter("contextConfigLocation",
+ "classpath*:/META-INF/net.shibboleth.idp/preconfig.xml,classpath:/net/shibboleth/idp/conf/global-system.xml,classpath*:/META-INF/net.shibboleth.idp/postconfig.xml");
+ } else {
+ log.info("Init parameter contextConfigLocation already set to {}", param);
+ }
+ }
+
+}
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/META-INF/services/jakarta.servlet.ServletContainerInitializer b/idp-conf-impl/src/main/resources/META-INF/services/jakarta.servlet.ServletContainerInitializer
index d17dfcc80..0dfc5549b 100644
--- a/idp-conf-impl/src/main/resources/META-INF/services/jakarta.servlet.ServletContainerInitializer
+++ b/idp-conf-impl/src/main/resources/META-INF/services/jakarta.servlet.ServletContainerInitializer
@@ -1 +1,3 @@
-net.shibboleth.idp.conf.impl.RegisterFilterChainServletContextInitializer
\ No newline at end of file
+net.shibboleth.idp.conf.impl.SpringConfigServletContextInitializer
+net.shibboleth.idp.conf.impl.ServletConfigServletContextInitializer
+net.shibboleth.idp.conf.impl.RegisterFilterChainServletContextInitializer
diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index f1ec2f520..ceaac7563 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -31,10 +31,6 @@ idp.scope = example.org
#idp.cookie.sameSite = None
#idp.cookie.sameSiteCondition = shibboleth.Conditions.FALSE
-# Auto-register standard Java filter chain
-# "false" disables in favor of manual web.xml control, not recommended
-#idp.autoRegisterFilterChain = true
-
# Enable cross-site request forgery mitigation for views.
idp.csrf.enabled = true
# Name of the HTTP parameter that stores the CSRF token.
diff --git a/idp-war/src/main/webapp/WEB-INF/web.xml b/idp-war/src/main/webapp/WEB-INF/web.xml
index b155a8806..1de2085b9 100644
--- a/idp-war/src/main/webapp/WEB-INF/web.xml
+++ b/idp-war/src/main/webapp/WEB-INF/web.xml
@@ -4,21 +4,31 @@
<display-name>Shibboleth Identity Provider</display-name>
- <!-- Spring application context files. Files are loaded in the order they appear with subsequent files overwriting
- same named beans in previous files. -->
+ <!-- Auto-registers Java filter chain required by IdP. -->
<context-param>
- <param-name>contextConfigLocation</param-name>
- <param-value>classpath*:/META-INF/net.shibboleth.idp/preconfig.xml,classpath:/net/shibboleth/idp/conf/global-system.xml,classpath*:/META-INF/net.shibboleth.idp/postconfig.xml</param-value>
+ <param-name>net.shibboleth.idp.registerFilterChain</param-name>
+ <param-value>true</param-value>
+ </context-param>
+
+ <!-- Auto-registers IdP dispatcher servlet. -->
+ <context-param>
+ <param-name>net.shibboleth.idp.registerIdPServlet</param-name>
+ <param-value>true</param-value>
</context-param>
<context-param>
- <param-name>contextClass</param-name>
- <param-value>net.shibboleth.shared.spring.context.DelimiterAwareApplicationContext</param-value>
+ <param-name>net.shibboleth.idp.registerRemoteUserServlet</param-name>
+ <param-value>false</param-value>
+ </context-param>
+ <context-param>
+ <param-name>net.shibboleth.idp.registerX509Servlet</param-name>
+ <param-value>false</param-value>
</context-param>
+ <!-- Registers /shibboleth to return metadata file. -->
<context-param>
- <param-name>contextInitializerClasses</param-name>
- <param-value>net.shibboleth.idp.spring.IdPPropertiesApplicationContextInitializer</param-value>
+ <param-name>net.shibboleth.idp.registerMetadataServlet</param-name>
+ <param-value>true</param-value>
</context-param>
<!-- Spring listener used to load up the configuration -->
@@ -27,24 +37,6 @@
</listener>
<!-- Servlets and servlet mappings -->
- <servlet>
- <servlet-name>idp</servlet-name>
- <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
- <init-param>
- <param-name>contextConfigLocation</param-name>
- <param-value>classpath*:/META-INF/net/shibboleth/idp/mvc/preconfig.xml,classpath:/net/shibboleth/idp/conf/mvc-beans.xml,classpath:/net/shibboleth/idp/conf/webflow-config.xml,classpath*:/META-INF/net/shibboleth/idp/mvc/postconfig.xml</param-value>
- </init-param>
- <init-param>
- <param-name>contextClass</param-name>
- <param-value>net.shibboleth.shared.spring.context.DelimiterAwareApplicationContext</param-value>
- </init-param>
- <load-on-startup>1</load-on-startup>
- </servlet>
- <servlet-mapping>
- <servlet-name>idp</servlet-name>
- <url-pattern>/status</url-pattern>
- <url-pattern>/profile/*</url-pattern>
- </servlet-mapping>
<!-- Servlet protected by container used for RemoteUser authentication -->
<servlet>
@@ -68,16 +60,6 @@
<url-pattern>/Authn/X509</url-pattern>
</servlet-mapping>
- <!-- Send request for the EntityID to the SAML metadata echoing JSP. -->
- <servlet>
- <servlet-name>shibboleth_jsp</servlet-name>
- <jsp-file>/WEB-INF/jsp/metadata.jsp</jsp-file>
- </servlet>
- <servlet-mapping>
- <servlet-name>shibboleth_jsp</servlet-name>
- <url-pattern>/shibboleth</url-pattern>
- </servlet-mapping>
-
<!-- Send servlet errors through the IdP's MVC error handling. -->
<error-page>
<exception-type>net.shibboleth.idp.authn.ExternalAuthenticationException</exception-type>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list