[java-identity-provider] branch main updated: IDP-2015 - Review web.xml for improvements via code or annotations
Scott Cantor
cantor.2 at osu.edu
Tue Oct 4 17:26:35 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=7c303d7a1a4e910a33363791581d3a0d1e03e6de
The following commit(s) were added to refs/heads/main by this push:
new 7c303d7a1 IDP-2015 - Review web.xml for improvements via code or annotations
7c303d7a1 is described below
commit 7c303d7a1a4e910a33363791581d3a0d1e03e6de
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Oct 4 13:26:32 2022 -0400
IDP-2015 - Review web.xml for improvements via code or annotations
https://shibboleth.atlassian.net/browse/IDP-2015
Implement dynamic registration of Auth servlets.
Move to proxied beans using Spring configuration.
---
.../ServletConfigServletContextInitializer.java | 14 ++++++------
.../net/shibboleth/idp/conf/authn-system.xml | 20 +++++++++++++++++
.../src/main/resources/conf/authn/authn.properties | 10 ++++++++-
idp-war/src/main/webapp/WEB-INF/web.xml | 25 +---------------------
4 files changed, 37 insertions(+), 32 deletions(-)
diff --git a/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/ServletConfigServletContextInitializer.java b/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/ServletConfigServletContextInitializer.java
index c3f266f67..aaa34df4b 100644
--- a/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/ServletConfigServletContextInitializer.java
+++ b/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/ServletConfigServletContextInitializer.java
@@ -33,6 +33,7 @@ import jakarta.servlet.ServletRegistration;
//import net.shibboleth.idp.authn.impl.X509AuthServlet;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.spring.context.DelimiterAwareApplicationContext;
+import net.shibboleth.shared.spring.servlet.impl.DelegatingServletProxy;
/**
* A {@link ServletContainerInitializer} implementation that registers the servlets used by the IdP.
@@ -80,25 +81,24 @@ public class ServletConfigServletContextInitializer implements ServletContainerI
"classpath*:/META-INF/net/shibboleth/idp/mvc/preconfig.xml,classpath:/net/shibboleth/idp/conf/mvc-beans.xml,classpath:/net/shibboleth/idp/conf/webflow-config.xml,classpath*:/META-INF/net/shibboleth/idp/mvc/postconfig.xml");
}
- /*
if ("true".equalsIgnoreCase(remoteUserFlag)) {
log.info("Registering RemoteUser authentication servlet");
- ServletRegistration.Dynamic registration = ctx.addServlet("RemoteUserAuthHandler", RemoteUserAuthServlet.class);
+ ServletRegistration.Dynamic registration = ctx.addServlet("RemoteUserAuthHandler",
+ new DelegatingServletProxy("shibboleth.RemoteUserAuthServlet"));
registration.addMapping("/Authn/RemoteUser");
- registration.setLoadOnStartup(2);
}
if ("true".equalsIgnoreCase(x509Flag)) {
log.info("Registering X.509 authentication servlet");
- ServletRegistration.Dynamic registration = ctx.addServlet("X509AuthHandler", X509AuthServlet.class);
+ ServletRegistration.Dynamic registration = ctx.addServlet("X509AuthHandler",
+ new DelegatingServletProxy("shibboleth.X509AuthServlet"));
registration.addMapping("/Authn/X509");
- registration.setLoadOnStartup(3);
}
- */
if ("true".equals(metadataFlag)) {
log.info("Registering metadata endpoint servlet");
- final ServletRegistration.Dynamic registration = ctx.addJspFile("MetadataAccessHandler", "/WEB-INF/jsp/metadata.jsp");
+ final ServletRegistration.Dynamic registration =
+ ctx.addJspFile("MetadataAccessHandler", "/WEB-INF/jsp/metadata.jsp");
registration.addMapping("/shibboleth");
}
}
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml
index 59b030c77..665768207 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml
@@ -554,5 +554,25 @@
p:entryExpiration="#{'%{idp.authn.revocation.lifetime:%{idp.authn.defaultLifetime:PT12H}}'}"
p:storage-ref="#{'%{idp.authn.revocation.StorageService:shibboleth.StorageService}'.trim()}"
p:strict="%{idp.authn.revocation.strict:false}" />
+
+ <!-- Servlet beans for RemoteUser and X509 flows. -->
+
+ <bean id="checkAttributes" parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.authn.RemoteUser.checkAttributes:}'.trim()}" />
+
+ <bean id="checkHeaders" parent="shibboleth.CommaDelimStringArray"
+ c:_0="#{'%{idp.authn.RemoteUser.checkHeaders:}'.trim()}" />
+
+ <bean id="shibboleth.RemoteUserAuthServlet" class="net.shibboleth.idp.authn.impl.RemoteUserAuthServlet" lazy-init="true"
+ p:checkRemoteUser="%{idp.authn.RemoteUser.checkRemoteUser:true}"
+ p:checkAttributes="#{getObject('checkAttributes')}"
+ p:checkHeaders="#{getObject('checkHeaders')}"
+ p:subjectAttribute="#{'%{idp.authn.RemoteUser.subjectAttribute:}'.trim()}"
+ p:authnMethodHeader="#{'%{idp.authn.RemoteUser.authnMethodHeader:}'.trim()}"
+ p:authnAuthorityHeader="#{'%{idp.authn.RemoteUser.authnAuthorityHeader:}'.trim()}" />
+
+ <bean id="shibboleth.X509AuthServlet" class="net.shibboleth.idp.authn.impl.X509AuthServlet" lazy-init="true"
+ p:saveCertificateToCredentialSet="%{idp.authn.X509.saveCertificateToCredentialSet:true}"
+ p:trustEngine="#{getObject('shibboleth.authn.X509.TrustEngine')}" />
</beans>
diff --git a/idp-conf/src/main/resources/conf/authn/authn.properties b/idp-conf/src/main/resources/conf/authn/authn.properties
index af2fdbc66..7d5b6fe86 100644
--- a/idp-conf/src/main/resources/conf/authn/authn.properties
+++ b/idp-conf/src/main/resources/conf/authn/authn.properties
@@ -106,7 +106,14 @@ idp.authn.External.externalAuthnPath = contextRelative:external.jsp
# Unset in most cases only if using the authnMethodHeader or
# subjectAttribute settings
#idp.authn.RemoteUser.addDefaultPrincipals = true
-# Most other settings need to be supplied via web.xml to the servlet
+#idp.authn.RemoteUser.checkRemoteUser = true
+# Comma-delimited lists of attributes or headers to pull from
+#idp.authn.RemoteUser.checkAttributes =
+#idp.authn.RemoteUser.checkHeaders =
+# Advanced settings
+#idp.authn.RemoteUser.subjectAttribute =
+#idp.authn.RemoteUser.authnMethodHeader =
+#idp.authn.RemoteUser.authnAuthorityHeader =
#### RemoteUserInternal ####
@@ -141,6 +148,7 @@ idp.authn.SPNEGO.supportedPrincipals = \
#idp.authn.X509.order = 1000
#idp.authn.X509.nonBrowserSupported = false
+#idp.authn.X509.saveCertificateToCredentialSet = true
# Servlet context-relative path to wherever your implementation lives
#idp.authn.X509.externalAuthnPath = contextRelative:x509-prompt.jsp
idp.authn.X509.supportedPrincipals = \
diff --git a/idp-war/src/main/webapp/WEB-INF/web.xml b/idp-war/src/main/webapp/WEB-INF/web.xml
index 1de2085b9..40b171e5d 100644
--- a/idp-war/src/main/webapp/WEB-INF/web.xml
+++ b/idp-war/src/main/webapp/WEB-INF/web.xml
@@ -16,6 +16,7 @@
<param-value>true</param-value>
</context-param>
+ <!-- Registers optional servlets used for RemoteUser and X509 login flows. -->
<context-param>
<param-name>net.shibboleth.idp.registerRemoteUserServlet</param-name>
<param-value>false</param-value>
@@ -36,30 +37,6 @@
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
- <!-- Servlets and servlet mappings -->
-
- <!-- Servlet protected by container used for RemoteUser authentication -->
- <servlet>
- <servlet-name>RemoteUserAuthHandler</servlet-name>
- <servlet-class>net.shibboleth.idp.authn.impl.RemoteUserAuthServlet</servlet-class>
- <load-on-startup>2</load-on-startup>
- </servlet>
- <servlet-mapping>
- <servlet-name>RemoteUserAuthHandler</servlet-name>
- <url-pattern>/Authn/RemoteUser</url-pattern>
- </servlet-mapping>
-
- <!-- Servlet protected by container used for X.509 authentication -->
- <servlet>
- <servlet-name>X509AuthHandler</servlet-name>
- <servlet-class>net.shibboleth.idp.authn.impl.X509AuthServlet</servlet-class>
- <load-on-startup>3</load-on-startup>
- </servlet>
- <servlet-mapping>
- <servlet-name>X509AuthHandler</servlet-name>
- <url-pattern>/Authn/X509</url-pattern>
- </servlet-mapping>
-
<!-- Send servlet errors through the IdP's MVC error handling. -->
<error-page>
<exception-type>net.shibboleth.idp.authn.ExternalAuthenticationException</exception-type>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list