[java-idp-plugin-oidc-rp] branch main updated: Improve supported principal properties
Phil Smart
philip.smart at jisc.ac.uk
Wed Oct 19 10:17:29 UTC 2022
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=18b6b67a8c1b74d35a156ab6673a25c333356624
The following commit(s) were added to refs/heads/main by this push:
new 18b6b67 Improve supported principal properties
18b6b67 is described below
commit 18b6b67a8c1b74d35a156ab6673a25c333356624
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Oct 19 11:17:17 2022 +0100
Improve supported principal properties
Some Javadoc
---
.../oidc/rp/impl/ValidateOIDCAuthentication.java | 46 +++++++++++++++-------
.../META-INF/net.shibboleth.idp/postconfig.xml | 7 ++++
.../oidc-relying-party-authn-beans.xml | 1 +
.../conf/authn/oidc-providermetadata-resolvers.xml | 1 -
.../authn/oidc/rp/conf/authn/oidc-rp.properties | 6 ++-
5 files changed, 45 insertions(+), 16 deletions(-)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java
index ea84f2a..342c4eb 100644
--- a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/ValidateOIDCAuthentication.java
@@ -81,18 +81,23 @@ import net.shibboleth.utilities.java.support.service.ReloadableService;
import net.shibboleth.utilities.java.support.service.ServiceableComponent;
/**
- * An action that builds an {@link AuthenticationResult} from the subject (sub claim) of the OpenID Connect token.
+ * An action that builds an {@link AuthenticationResult} based on an inbound OIDC authentication response.
*
- * <p>Also builds any OpenID Connect Standard claims as {@link IdPAttributePrincipal}s, and sets them
- * alongside the subject principal for use during attribute resolution.</p>
+ * <p>A {@link EndUserClaimsContext} is used as the basis of the result, which stores the merged id_token and
+ * UserInfo claims set, alongside the raw id_token claims.
*
+ * <p>Actual validation is all upstream of this action, but the use of the ValidationAction
+ * subclass is a convenience for auditing and handling the result.</p>
*
- * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
+ *
+ * @event {@link EventIds#PROCEED_EVENT_ID}
+ * @event {@link EventIds#INVALID_PROFILE_CTX}
+ * @event {@link IdPEventIds#INVALID_RELYING_PARTY_CTX}
+ * @event {@link IdPEventIds#INVALID_PROFILE_CONFIG}
* @event {@link AuthnEventIds#NO_CREDENTIALS}
- * @pre <pre>AuthenticationContext.getSubcontext(OpenIDConnectContext.class, false) != null</pre>
- * @post If AuthenticationContext.getSubcontext(OpenIDConnectContext.class, false).getIDToken()
- * .getJWTClaimsSet().getSubject()!= null, then an {@link net.shibboleth.idp.authn.AuthenticationResult}
- * is saved to the {@link AuthenticationContext}.
+ * @pre <pre>ProfileRequestContext.getSubcontext(AuthenticationContext.class).getAttemptedFlow() != null</pre>
+ * @post If AuthenticationContext.getSubcontext(EndUserClaimsContext.class, false)!= null,
+ * then an {@link net.shibboleth.idp.authn.AuthenticationResult} is saved to the {@link AuthenticationContext}.
*/
public class ValidateOIDCAuthentication extends AbstractValidationAction {
@@ -205,6 +210,12 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
return false;
}
+ if (authenticationContext.getAttemptedFlow() == null) {
+ log.debug("{} No attempted flow within authentication context", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+ return false;
+ }
+
final MessageContext inboundMessageCtx = profileRequestContext.getInboundMessageContext();
if (inboundMessageCtx == null) {
log.error("{} No inbound message context", getLogPrefix());
@@ -256,6 +267,11 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
}
+ if (endUserContext.getUnprocessedIdTokenClaims().getSubject() == null) {
+ log.error("{} id_token did not contain a subject (sub)", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+ return false;
+ }
return true;
}
@@ -274,6 +290,9 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
}
//TODO use an attributeExtractionStrategy if registry not supplied, or in addition?
+ log.info("{} OIDC authentication succeeded for '{}'", getLogPrefix(),
+ endUserContext.getUnprocessedIdTokenClaims().getSubject());
+
acrTranslator =
profileConfiguration.getAuthenticationContextClassReferenceTranslationStrategy(profileRequestContext);
amrTranslator =
@@ -337,11 +356,10 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
}
- // TODO What type of subject? switch on subject_types_supported and subject_type.
- if (endUserContext.getUnprocessedIdTokenClaims().getSubject() != null) {
- subject.getPrincipals().add(
- new OIDCSubjectIdentifierPrincipal(endUserContext.getUnprocessedIdTokenClaims().getSubject()));
- }
+ // TODO What type of subject? switch on subject_types_supported and subject_type.
+ subject.getPrincipals().add(
+ new OIDCSubjectIdentifierPrincipal(endUserContext.getUnprocessedIdTokenClaims().getSubject()));
+
subject.getPrincipals().add(buildProxyPrincipal());
if (attributeContext != null && !attributeContext.getIdPAttributes().isEmpty()) {
@@ -358,7 +376,7 @@ public class ValidateOIDCAuthentication extends AbstractValidationAction {
/**
* Construct a populated {@link ProxyAuthenticationPrincipal} based on the upstream OP (the
- * issuer of the id_token) and the audiences of the token.
+ * issuer of the id_token).
*
* @return a constructed {@link ProxyAuthenticationPrincipal} to include in the {@link Subject}
*/
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 9d5c548..ea3b8c1 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -134,6 +134,13 @@
<bean id="shibboleth.authn.oidc.rp.DefaultIDTokenLookupStrategy"
class="net.shibboleth.idp.plugin.authn.oidc.rp.config.navigate.DefaultIDTokenLookupStrategy" />
+ <bean p:id="OIDCSubjectIdentifier" class="net.shibboleth.idp.authn.principal.GenericPrincipalService"
+ c:claz="net.shibboleth.idp.plugin.authn.oidc.rp.principal.OIDCSubjectIdentifierPrincipal">
+ <constructor-arg name="serializer">
+ <bean class="net.shibboleth.idp.authn.principal.SimplePrincipalSerializer"
+ c:claz="net.shibboleth.idp.plugin.authn.oidc.rp.principal.OIDCSubjectIdentifierPrincipal" c:name="subject" />
+ </constructor-arg>
+ </bean>
<!-- The authentication flow descriptor -->
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index 9444cf7..704417e 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -854,6 +854,7 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.impl.ValidateOIDCAuthentication" scope="prototype"
p:profileContextLookupStrategy-ref="shibboleth.ChildLookup.ProxyProfileRequestContext"
p:authenticationContextLookupStrategy-ref="ParentAuthenticiationContextLookup"
+ p:addDefaultPrincipals="#{getObject('idp.authn.oidc.rp.supportedPrincipals.addDefaultPrincipals') ?: %{idp.authn.oidc.rp.addDefaultPrincipals:false}}"
p:responderLookupStrategy-ref="shibboleth.RelyingPartyIdLookup.Simple"
p:requesterLookupStrategy-ref="shibboleth.ResponderIdLookup.Simple"
p:attributeFilter-ref="shibboleth.AttributeFilterService"
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-providermetadata-resolvers.xml b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-providermetadata-resolvers.xml
index bf31d26..51398a2 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-providermetadata-resolvers.xml
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-providermetadata-resolvers.xml
@@ -8,7 +8,6 @@
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
default-init-method="initialize" default-destroy-method="destroy">
-
<!-- User space config -->
<util:list id="shibboleth.authn.oidc.rp.ProviderMetadataResolvers">
diff --git a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
index 6d92cd6..42c90f7 100644
--- a/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
+++ b/idp-oidc-rp-impl/src/main/resources/net/shibboleth/idp/plugin/authn/oidc/rp/conf/authn/oidc-rp.properties
@@ -27,7 +27,11 @@ idp.authn.oidc.rp.client.redirecturl.allowedOrigins = https://localhost:8443
## Comma seperated list of additional scopes e.g. profile or email. The openid scope is added by default
#idp.authn.oidc.rp.client.scopes =
-idp.authn.oidc.rp.supportedPrincipals = saml2/http://example.org/ac/classes/mfa
+#idp.authn.oidc.rp.addDefaultPrincipal = false
+#idp.authn.oidc.rp.supportedPrincipals = \
+# saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, \
+# saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \
+# saml1/urn:oasis:names:tc:SAML:1.0:am:password
## Inbuilt C14N options for converting a Subject Identifier into a principal name
idp.authn.oidc.rp.c14n.subjectidentifier.lowercase = false
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list