[java-identity-provider] branch main updated: JSSH-8 - Servlet filter that implements its own filter-mapping layer
Scott Cantor
cantor.2 at osu.edu
Thu Sep 29 18:28:52 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f53a3b5726fcc0e2d8ef7982272b41d198a61b51
The following commit(s) were added to refs/heads/main by this push:
new f53a3b572 JSSH-8 - Servlet filter that implements its own filter-mapping layer
f53a3b572 is described below
commit f53a3b5726fcc0e2d8ef7982272b41d198a61b51
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Sep 29 14:28:49 2022 -0400
JSSH-8 - Servlet filter that implements its own filter-mapping layer
https://shibboleth.atlassian.net/browse/JSSH-8
Redo 4 of the original filters using context initializer.
---
.../shibboleth/idp/log/SLF4JMDCServletFilter.java | 2 +-
.../impl/ExtractDuoAuthenticationFromHeaders.java | 2 +-
.../idp/authn/impl/ExtractUserAgentAddress.java | 2 +-
.../impl/StorageBackedAccountLockoutManager.java | 2 +-
.../src/test/resources/spring/test-flow-beans.xml | 8 +--
idp-conf-impl/pom.xml | 5 ++
...gisterFilterChainServletContextInitializer.java | 82 ++++++++++++++++++++++
.../net/shibboleth/idp/conf/impl/package-info.java | 21 ++++++
.../jakarta.servlet.ServletContainerInitializer | 1 +
.../net/shibboleth/idp/conf/global-system.xml | 71 ++++++++++++++++---
.../idp/test/flows/AbstractFlowTest.java | 2 +-
.../idp/profile/audit/impl/WriteAuditLog.java | 2 +-
.../BaseAddAuthenticationStatementToAssertion.java | 2 +-
.../profile/impl/ProcessLogoutRequestTest.java | 2 +-
.../profile/impl/SessionManagerBaseTestCase.java | 6 +-
.../idp/session/impl/PopulateSessionContext.java | 2 +-
.../shibboleth/idp/session/impl/ProcessLogout.java | 2 +-
.../session/impl/StorageBackedSessionManager.java | 2 +-
.../idp/session/impl/DestroySessionsTest.java | 2 +-
.../idp/session/impl/DetectIdentitySwitchTest.java | 2 +-
.../session/impl/PopulateSessionContextTest.java | 2 +-
.../idp/session/impl/ProcessLogoutTest.java | 2 +-
.../session/impl/SessionManagerBaseTestCase.java | 6 +-
.../StorageBackedIdPSessionSerializerTest.java | 4 +-
.../impl/StorageBackedSessionManagerTest.java | 2 +-
.../UpdateSessionWithAuthenticationResultTest.java | 2 +-
.../impl/UpdateSessionWithSPSessionTest.java | 2 +-
idp-war/src/main/webapp/WEB-INF/web.xml | 64 -----------------
28 files changed, 199 insertions(+), 105 deletions(-)
diff --git a/idp-admin-api/src/main/java/net/shibboleth/idp/log/SLF4JMDCServletFilter.java b/idp-admin-api/src/main/java/net/shibboleth/idp/log/SLF4JMDCServletFilter.java
index c2292bb06..fe1519437 100644
--- a/idp-admin-api/src/main/java/net/shibboleth/idp/log/SLF4JMDCServletFilter.java
+++ b/idp-admin-api/src/main/java/net/shibboleth/idp/log/SLF4JMDCServletFilter.java
@@ -33,7 +33,7 @@ import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpSession;
import net.shibboleth.idp.Version;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.net.HttpServletSupport;
+import net.shibboleth.shared.servlet.HttpServletSupport;
/**
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ExtractDuoAuthenticationFromHeaders.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ExtractDuoAuthenticationFromHeaders.java
index 7a96fb5b7..35bc27171 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ExtractDuoAuthenticationFromHeaders.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ExtractDuoAuthenticationFromHeaders.java
@@ -37,8 +37,8 @@ import net.shibboleth.idp.authn.duo.context.DuoAuthenticationContext;
import net.shibboleth.idp.ui.context.RelyingPartyUIContext;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.net.HttpServletSupport;
import net.shibboleth.shared.primitive.StringSupport;
+import net.shibboleth.shared.servlet.HttpServletSupport;
/**
* An action that extracts the Duo factor and device or passcode from HTTP request headers into a
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentAddress.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentAddress.java
index 5a4c56ce2..67ce77c62 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentAddress.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentAddress.java
@@ -24,7 +24,7 @@ import net.shibboleth.idp.authn.AbstractExtractionAction;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.context.UserAgentContext;
-import net.shibboleth.shared.net.HttpServletSupport;
+import net.shibboleth.shared.servlet.HttpServletSupport;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java
index 176920034..67b8c1bea 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java
@@ -45,7 +45,7 @@ import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponen
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.net.HttpServletSupport;
+import net.shibboleth.shared.servlet.HttpServletSupport;
/**
* Implementation of {@link AccountLockoutManager} interface that relies on a {@link StorageService}
diff --git a/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml b/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml
index fb502324f..229835d43 100644
--- a/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml
+++ b/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml
@@ -32,16 +32,16 @@
class="org.opensaml.storage.impl.MemoryStorageService" />
<bean id="shibboleth.HttpServletRequest" destroy-method=""
- class="net.shibboleth.shared.net.impl.ThreadLocalHttpServletRequestProxy" />
+ class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestProxy" />
<bean id="shibboleth.HttpServletResponse" destroy-method=""
- class="net.shibboleth.shared.net.impl.ThreadLocalHttpServletResponseProxy" />
+ class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseProxy" />
<bean id="shibboleth.HttpServletRequestSupplier" destroy-method=""
- class="net.shibboleth.shared.net.impl.ThreadLocalHttpServletRequestSupplier" />
+ class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestSupplier" />
<bean id="shibboleth.HttpServletResponseSupplier" destroy-method=""
- class="net.shibboleth.shared.net.impl.ThreadLocalHttpServletResponseSupplier" />
+ class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseSupplier" />
<bean id="shibboleth.CookieManager"
class="net.shibboleth.shared.net.CookieManager"
diff --git a/idp-conf-impl/pom.xml b/idp-conf-impl/pom.xml
index 11db1e822..fee771f3d 100644
--- a/idp-conf-impl/pom.xml
+++ b/idp-conf-impl/pom.xml
@@ -34,6 +34,11 @@
</dependency>
<!-- Provided Dependencies -->
+ <dependency>
+ <groupId>jakarta.servlet</groupId>
+ <artifactId>jakarta.servlet-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
<!-- Runtime Dependencies -->
<!-- Supports Eclipse class lookup from within flow files. -->
diff --git a/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/RegisterFilterChainServletContextInitializer.java b/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/RegisterFilterChainServletContextInitializer.java
new file mode 100644
index 000000000..331048f68
--- /dev/null
+++ b/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/RegisterFilterChainServletContextInitializer.java
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.conf.impl;
+
+import java.util.Set;
+
+import javax.annotation.Nonnull;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.web.filter.DelegatingFilterProxy;
+
+import jakarta.servlet.FilterRegistration;
+import jakarta.servlet.ServletContainerInitializer;
+import jakarta.servlet.ServletContext;
+import jakarta.servlet.ServletException;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+
+/**
+ * A {@link ServletContainerInitializer} implementation that registers a filter chain embedded in
+ * our Spring configuration.
+ *
+ * The filter registration can be disabled by setting the system property
+ * {@link RegisterFilterChainServletContextInitializer#SYSTEM_PROPERTY_ACTIVATION} to <pre>disabled</pre>.
+ *
+ * The chain is always mapped to all requests because it is expected that any further granularity is
+ * configured via Spring.
+ */
+public class RegisterFilterChainServletContextInitializer implements ServletContainerInitializer {
+
+ /** System property name for the activation of this class. */
+ public static final String SYSTEM_PROPERTY_ACTIVATION =
+ RegisterFilterChainServletContextInitializer.class.getCanonicalName();
+
+ /** The filter name for the embedded filter chain. */
+ @Nonnull @NotEmpty public static final String FILTER_NAME = "ShibbolethFilterChain";
+
+ /** The target bean name for the chain filter. */
+ @Nonnull @NotEmpty public static final String TARGET_BEAN_NAME = "shibboleth.ChainingFilter";
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(RegisterFilterChainServletContextInitializer.class);
+
+ /** {@inheritDoc} */
+ @Override
+ public void onStartup(final Set<Class<?>> c, final ServletContext ctx) throws ServletException {
+
+ if (ctx.getServletRegistration("idp") == null) {
+ log.debug("Ignoring invocation outside IdP context");
+ return;
+ }
+
+ final String flag = System.getProperty(SYSTEM_PROPERTY_ACTIVATION);
+ log.debug("The value of the flag {}: {}", SYSTEM_PROPERTY_ACTIVATION, flag);
+ if ("disabled".equalsIgnoreCase(flag)) {
+ log.info("Filter registration is disabled according to the system properties");
+ return;
+ }
+
+ log.debug("Attempting to register filter '{}'", FILTER_NAME);
+ final FilterRegistration.Dynamic headerFilter = ctx.addFilter(FILTER_NAME, DelegatingFilterProxy.class);
+ headerFilter.addMappingForUrlPatterns(null, false, "/*");
+ headerFilter.setInitParameter("targetBeanName", TARGET_BEAN_NAME);
+ log.info("Registered the filter '{}'.", FILTER_NAME);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/package-info.java b/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/package-info.java
new file mode 100644
index 000000000..4fdabb2a2
--- /dev/null
+++ b/idp-conf-impl/src/main/java/net/shibboleth/idp/conf/impl/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Configuration implementation classes used internally.
+ */
+package net.shibboleth.idp.conf.impl;
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/META-INF/services/jakarta.servlet.ServletContainerInitializer b/idp-conf-impl/src/main/resources/META-INF/services/jakarta.servlet.ServletContainerInitializer
new file mode 100644
index 000000000..d17dfcc80
--- /dev/null
+++ b/idp-conf-impl/src/main/resources/META-INF/services/jakarta.servlet.ServletContainerInitializer
@@ -0,0 +1 @@
+net.shibboleth.idp.conf.impl.RegisterFilterChainServletContextInitializer
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
index 3486b03e9..fc3e3f24e 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
@@ -70,6 +70,11 @@
<entry key="net.shibboleth.utilities.java.support.logic.StrategyIndirectedPredicate"
value="net.shibboleth.shared.logic.StrategyIndirectedPredicate" />
+ <entry key="net.shibboleth.utilities.java.support.net.DynamicResponseHeaderFilter"
+ value="net.shibboleth.shared.net.impl.DynamicResponseHeaderFilter" />
+ <entry key="net.shibboleth.utilities.java.support.net.SameSiteCookieHeaderFilter"
+ value="net.shibboleth.shared.net.impl.SameSiteCookieHeaderFilter" />
+
<entry key="net.shibboleth.utilities.java.support.velocity.Template"
value="net.shibboleth.shared.velocity.Template" />
@@ -255,10 +260,10 @@
<value>#{'classpath:' + T(net.shibboleth.idp.saml.xmlobject.ExtensionsConstants).SHIB_MDEXT10_SCHEMA_LOCATION }</value>
</util:list>
- <bean id="shibboleth.HttpServletRequest" class="net.shibboleth.shared.net.impl.ThreadLocalHttpServletRequestProxy" />
- <bean id="shibboleth.HttpServletRequestSupplier" class="net.shibboleth.shared.net.impl.ThreadLocalHttpServletRequestSupplier" />
- <bean id="shibboleth.HttpServletResponse" class="net.shibboleth.shared.net.impl.ThreadLocalHttpServletResponseProxy" />
- <bean id="shibboleth.HttpServletResponseSupplier" class="net.shibboleth.shared.net.impl.ThreadLocalHttpServletResponseSupplier" />
+ <bean id="shibboleth.HttpServletRequest" class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestProxy" />
+ <bean id="shibboleth.HttpServletRequestSupplier" class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestSupplier" />
+ <bean id="shibboleth.HttpServletResponse" class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseProxy" />
+ <bean id="shibboleth.HttpServletResponseSupplier" class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseSupplier" />
<bean id="shibboleth.DefaultResponseHeaderMap"
class="org.springframework.beans.factory.config.MapFactoryBean">
@@ -271,17 +276,61 @@
</property>
</bean>
- <bean id="shibboleth.ResponseHeaderFilter"
- class="net.shibboleth.utilities.java.support.net.DynamicResponseHeaderFilter"
- p:headers="#{getObject('shibboleth.ResponseHeaderMap') ?: getObject('shibboleth.DefaultResponseHeaderMap')}"
- p:callbacks="#{getObject('shibboleth.ResponseHeaderCallbacks')}" />
-
- <bean id="shibboleth.SameSiteCookieFilter"
- class="net.shibboleth.utilities.java.support.net.SameSiteCookieHeaderFilter"
+ <!-- These are stubbed out to emit warnings when not removed from web.xml. -->
+ <bean id="shibboleth.SameSiteCookieFilter" class="net.shibboleth.shared.servlet.impl.StubbedFilter"
+ c:_0="Servlet Filter 'shibboleth.SameSiteCookieFilter'" />
+ <bean id="shibboleth.ResponseHeaderFilter" class="net.shibboleth.shared.servlet.impl.StubbedFilter"
+ c:_0="Servlet Filter 'shibboleth.ResponseHeaderFilter'" />
+
+ <!-- Default path prefixes for user-facing non-logout activity. -->
+ <util:list id="shibboleth.DefaultUserFacingPrefixes">
+ <value>/profile/admin/</value>
+ <value>/profile/Shibboleth/SSO</value>
+ <value>/profile/SAML2/Unsolicited/SSO</value>
+ <value>/profile/SAML2/Redirect/SSO</value>
+ <value>/profile/SAML2/POST/SSO</value>
+ <value>/profile/SAML2/POST-SimpleSign/SSO</value>
+ <value>/profile/SAML2/Artifact/SSO</value>
+ <value>/profile/cas/login</value>
+ <value>/Authn/</value>
+ </util:list>
+
+ <!--
+ This is the chain of our filters installed by a ServletContextListener, via Spring delegating filter.
+ Any filter beans defined that extend ChainableFilter will be auto-wired in.
+ -->
+ <bean id="shibboleth.ChainingFilter" class="net.shibboleth.shared.spring.servlet.impl.ChainingFilter" />
+
+ <!-- These filters will be auto-wired into the chaining filter bean. -->
+
+ <!-- Mapped to all requests but runs conditionally. -->
+ <bean class="net.shibboleth.shared.spring.servlet.impl.SameSiteCookieHeaderFilter"
p:activationCondition-ref="#{'%{idp.cookie.sameSiteCondition:shibboleth.Conditions.FALSE}'.trim()}"
p:defaultValue="%{idp.cookie.sameSite:None}"
p:sameSiteCookies="#{getObject('shibboleth.SameSiteCookieMap')}" />
+ <!--
+ This was, Scott thinks, needed for client storage to work, but if it runs, it
+ has to be after the SameSite filter; i.e. it needs to execute on the response
+ before that one does, so is later in the chain.
+ -->
+ <bean class="net.shibboleth.shared.spring.servlet.impl.CookieBufferingFilter"
+ p:activationCondition-ref="#{'%{idp.cookie.bufferingCondition:shibboleth.Conditions.TRUE}'.trim()}" />
+
+ <!-- Handles response header customization so must run conditionally. -->
+ <bean class="net.shibboleth.shared.spring.servlet.impl.DynamicResponseHeaderFilter"
+ p:headers="#{getObject('shibboleth.ResponseHeaderMap') ?: getObject('shibboleth.DefaultResponseHeaderMap')}"
+ p:callbacks="#{getObject('shibboleth.ResponseHeaderCallbacks')}">
+ <property name="activationCondition">
+ <bean class="net.shibboleth.shared.servlet.impl.RequestURLPrefixPredicate"
+ p:matchingPrefixes="#{getObject('shibboleth.UserFacingPrefixes') ?: getObject('shibboleth.DefaultUserFacingPrefixes')}" />
+ </property>
+ </bean>
+
+ <!-- Can't be disabled. -->
+ <bean class="net.shibboleth.shared.spring.servlet.impl.RequestResponseContextFilter" />
+
+
<bean id="shibboleth.BuilderFactory" factory-method="getBuilderFactory" class="org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport" depends-on="shibboleth.OpenSAMLConfig" />
<bean id="shibboleth.MarshallerFactory" factory-method="getMarshallerFactory" class="org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport" depends-on="shibboleth.OpenSAMLConfig" />
<bean id="shibboleth.UnmarshallerFactory" factory-method="getUnmarshallerFactory" class="org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport" depends-on="shibboleth.OpenSAMLConfig" />
diff --git a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/AbstractFlowTest.java b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/AbstractFlowTest.java
index 71da6916f..97f40f624 100644
--- a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/AbstractFlowTest.java
+++ b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/AbstractFlowTest.java
@@ -77,9 +77,9 @@ import net.shibboleth.idp.test.PreferFileSystemContextLoader;
import net.shibboleth.idp.test.TestEnvironmentApplicationContextInitializer;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.net.impl.HttpServletRequestResponseContext;
import net.shibboleth.shared.security.IdentifierGenerationStrategy;
import net.shibboleth.shared.security.impl.Type4UUIDIdentifierGenerationStrategy;
+import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
import net.shibboleth.shared.spring.security.factory.X509CertificateFactoryBean;
import net.shibboleth.shared.xml.ParserPool;
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java
index e374cf4e1..77a4ae7a9 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/WriteAuditLog.java
@@ -50,8 +50,8 @@ import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.net.HttpServletSupport;
import net.shibboleth.shared.primitive.StringSupport;
+import net.shibboleth.shared.servlet.HttpServletSupport;
/**
* Action that produces audit log entries based on an {@link AuditContext} and one or more formatting strings.
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAuthenticationStatementToAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAuthenticationStatementToAssertion.java
index 2d78e9e18..6a0006cfa 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAuthenticationStatementToAssertion.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAuthenticationStatementToAssertion.java
@@ -37,8 +37,8 @@ import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.net.HttpServletSupport;
import net.shibboleth.shared.security.IdentifierGenerationStrategy;
+import net.shibboleth.shared.servlet.HttpServletSupport;
/**
* Base class for actions that encode authentication information into a SAML 1 or SAML 2 statement.
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequestTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequestTest.java
index dec0a8cad..bd3f038d6 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequestTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequestTest.java
@@ -45,9 +45,9 @@ import net.shibboleth.idp.session.context.LogoutContext;
import net.shibboleth.idp.session.context.SessionContext;
import net.shibboleth.idp.session.criterion.HttpServletRequestCriterion;
import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.net.impl.HttpServletRequestResponseContext;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
+import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
import org.opensaml.profile.action.EventIds;
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/SessionManagerBaseTestCase.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/SessionManagerBaseTestCase.java
index a56149f24..d2a0bb126 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/SessionManagerBaseTestCase.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/SessionManagerBaseTestCase.java
@@ -29,10 +29,10 @@ import net.shibboleth.idp.session.impl.StorageBackedSessionManager;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.net.CookieManager;
-import net.shibboleth.shared.net.impl.HttpServletRequestResponseContext;
-import net.shibboleth.shared.net.impl.ThreadLocalHttpServletRequestProxy;
-import net.shibboleth.shared.net.impl.ThreadLocalHttpServletResponseProxy;
import net.shibboleth.shared.security.impl.SecureRandomIdentifierGenerationStrategy;
+import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
+import net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestProxy;
+import net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseProxy;
import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
import org.opensaml.storage.impl.MemoryStorageService;
diff --git a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/PopulateSessionContext.java b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/PopulateSessionContext.java
index aa14ec0c4..ef8477576 100644
--- a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/PopulateSessionContext.java
+++ b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/PopulateSessionContext.java
@@ -41,9 +41,9 @@ import net.shibboleth.idp.session.criterion.HttpServletRequestCriterion;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.net.HttpServletSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
+import net.shibboleth.shared.servlet.HttpServletSupport;
/**
* A profile action that populates a {@link SessionContext} with an active, valid
diff --git a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ProcessLogout.java b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ProcessLogout.java
index f26903ba1..031545c20 100644
--- a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ProcessLogout.java
+++ b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/ProcessLogout.java
@@ -44,9 +44,9 @@ import net.shibboleth.idp.session.criterion.HttpServletRequestCriterion;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.net.HttpServletSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
+import net.shibboleth.shared.servlet.HttpServletSupport;
/**
* Profile action that resolves an active session from the profile request, and records it,
diff --git a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedSessionManager.java b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedSessionManager.java
index a9fae1831..441577807 100644
--- a/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedSessionManager.java
+++ b/idp-session-impl/src/main/java/net/shibboleth/idp/session/impl/StorageBackedSessionManager.java
@@ -60,11 +60,11 @@ import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponen
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.net.CookieManager;
-import net.shibboleth.shared.net.HttpServletSupport;
import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
import net.shibboleth.shared.security.IdentifierGenerationStrategy;
+import net.shibboleth.shared.servlet.HttpServletSupport;
/**
* Implementation of {@link SessionManager} and {@link SessionResolver} interfaces that relies on a
diff --git a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/DestroySessionsTest.java b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/DestroySessionsTest.java
index ee9e8af1d..de7010dfe 100644
--- a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/DestroySessionsTest.java
+++ b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/DestroySessionsTest.java
@@ -44,9 +44,9 @@ import net.shibboleth.idp.session.context.SessionContext;
import net.shibboleth.idp.session.criterion.HttpServletRequestCriterion;
import net.shibboleth.idp.session.criterion.SessionIdCriterion;
import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.net.impl.HttpServletRequestResponseContext;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
+import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
/** {@link DestroySessions} unit test. */
public class DestroySessionsTest extends SessionManagerBaseTestCase {
diff --git a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/DetectIdentitySwitchTest.java b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/DetectIdentitySwitchTest.java
index 217861c98..c2a7416f3 100644
--- a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/DetectIdentitySwitchTest.java
+++ b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/DetectIdentitySwitchTest.java
@@ -30,7 +30,7 @@ import net.shibboleth.idp.profile.testing.RequestContextBuilder;
import net.shibboleth.idp.session.SessionException;
import net.shibboleth.idp.session.context.SessionContext;
import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.net.impl.HttpServletRequestResponseContext;
+import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.springframework.mock.web.MockHttpServletRequest;
diff --git a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/PopulateSessionContextTest.java b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/PopulateSessionContextTest.java
index 8455e53fa..037a4757e 100644
--- a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/PopulateSessionContextTest.java
+++ b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/PopulateSessionContextTest.java
@@ -37,7 +37,7 @@ import net.shibboleth.idp.profile.testing.RequestContextBuilder;
import net.shibboleth.idp.session.SessionException;
import net.shibboleth.idp.session.context.SessionContext;
import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.net.impl.HttpServletRequestResponseContext;
+import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
/** {@link PopulateSessionContext} unit test. */
@SuppressWarnings("javadoc")
diff --git a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/ProcessLogoutTest.java b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/ProcessLogoutTest.java
index ccbaa950d..e5ecfa42c 100644
--- a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/ProcessLogoutTest.java
+++ b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/ProcessLogoutTest.java
@@ -47,9 +47,9 @@ import net.shibboleth.idp.session.SessionException;
import net.shibboleth.idp.session.context.LogoutContext;
import net.shibboleth.idp.session.criterion.HttpServletRequestCriterion;
import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.net.impl.HttpServletRequestResponseContext;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
+import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
/** {@link ProcessLogout} unit test. */
@SuppressWarnings("javadoc")
diff --git a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/SessionManagerBaseTestCase.java b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/SessionManagerBaseTestCase.java
index 9f14b7804..97055453a 100644
--- a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/SessionManagerBaseTestCase.java
+++ b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/SessionManagerBaseTestCase.java
@@ -29,10 +29,10 @@ import net.shibboleth.idp.session.impl.StorageBackedSessionManager;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.net.CookieManager;
-import net.shibboleth.shared.net.impl.HttpServletRequestResponseContext;
-import net.shibboleth.shared.net.impl.ThreadLocalHttpServletRequestProxy;
-import net.shibboleth.shared.net.impl.ThreadLocalHttpServletResponseProxy;
import net.shibboleth.shared.security.impl.SecureRandomIdentifierGenerationStrategy;
+import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
+import net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestProxy;
+import net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseProxy;
import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
import org.opensaml.storage.impl.MemoryStorageService;
diff --git a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/StorageBackedIdPSessionSerializerTest.java b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/StorageBackedIdPSessionSerializerTest.java
index a13ae0fd7..3bf0b3097 100644
--- a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/StorageBackedIdPSessionSerializerTest.java
+++ b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/StorageBackedIdPSessionSerializerTest.java
@@ -40,9 +40,9 @@ import net.shibboleth.idp.session.BasicSPSession;
import net.shibboleth.idp.session.SPSessionSerializerRegistry;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.net.CookieManager;
-import net.shibboleth.shared.net.impl.ThreadLocalHttpServletRequestProxy;
-import net.shibboleth.shared.net.impl.ThreadLocalHttpServletResponseProxy;
import net.shibboleth.shared.security.impl.SecureRandomIdentifierGenerationStrategy;
+import net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestProxy;
+import net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseProxy;
/** {@link StorageBackedIdPSessionSerializer} unit test. */
@SuppressWarnings("javadoc")
diff --git a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/StorageBackedSessionManagerTest.java b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/StorageBackedSessionManagerTest.java
index 5f37295fb..6bd46f6e1 100644
--- a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/StorageBackedSessionManagerTest.java
+++ b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/StorageBackedSessionManagerTest.java
@@ -47,9 +47,9 @@ import net.shibboleth.idp.session.criterion.SPSessionCriterion;
import net.shibboleth.idp.session.criterion.SessionIdCriterion;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.net.impl.HttpServletRequestResponseContext;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
+import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
import org.opensaml.storage.StorageSerializer;
import org.slf4j.Logger;
diff --git a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/UpdateSessionWithAuthenticationResultTest.java b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/UpdateSessionWithAuthenticationResultTest.java
index 3a3640cd6..1b21fc30a 100644
--- a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/UpdateSessionWithAuthenticationResultTest.java
+++ b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/UpdateSessionWithAuthenticationResultTest.java
@@ -34,9 +34,9 @@ import net.shibboleth.idp.session.SessionException;
import net.shibboleth.idp.session.context.SessionContext;
import net.shibboleth.idp.session.criterion.SessionIdCriterion;
import net.shibboleth.shared.component.ComponentInitializationException;
-import net.shibboleth.shared.net.impl.HttpServletRequestResponseContext;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
+import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
diff --git a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/UpdateSessionWithSPSessionTest.java b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/UpdateSessionWithSPSessionTest.java
index 3c8c8f643..7a6f8524b 100644
--- a/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/UpdateSessionWithSPSessionTest.java
+++ b/idp-session-impl/src/test/java/net/shibboleth/idp/session/impl/UpdateSessionWithSPSessionTest.java
@@ -33,7 +33,7 @@ import net.shibboleth.idp.session.SessionException;
import net.shibboleth.idp.session.context.SessionContext;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.net.impl.HttpServletRequestResponseContext;
+import net.shibboleth.shared.servlet.impl.HttpServletRequestResponseContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.storage.StorageSerializer;
diff --git a/idp-war/src/main/webapp/WEB-INF/web.xml b/idp-war/src/main/webapp/WEB-INF/web.xml
index 711e149e5..c2de9279f 100644
--- a/idp-war/src/main/webapp/WEB-INF/web.xml
+++ b/idp-war/src/main/webapp/WEB-INF/web.xml
@@ -41,80 +41,16 @@
<param-value>true</param-value>
</init-param>
</filter>
- <!-- Automates SameSite handling until Java API catches up. -->
- <filter>
- <filter-name>SameSiteCookieFilter</filter-name>
- <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
- <init-param>
- <param-name>targetBeanName</param-name>
- <param-value>shibboleth.SameSiteCookieFilter</param-value>
- </init-param>
- </filter>
- <!-- Lets us lump repeated Set-Cookie headers into one, something containers rarely support. -->
- <filter>
- <filter-name>CookieBufferingFilter</filter-name>
- <filter-class>net.shibboleth.utilities.java.support.net.CookieBufferingFilter</filter-class>
- </filter>
- <!-- Allows control of response headers from within Spring beans. -->
- <filter>
- <filter-name>DynamicResponseHeaderFilter</filter-name>
- <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
- <init-param>
- <param-name>targetBeanName</param-name>
- <param-value>shibboleth.ResponseHeaderFilter</param-value>
- </init-param>
- </filter>
- <!-- Automates TLS-based propagation of HttpServletRequest/Response into beans. -->
- <filter>
- <filter-name>RequestResponseContextFilter</filter-name>
- <filter-class>net.shibboleth.utilities.java.support.net.RequestResponseContextFilter</filter-class>
- </filter>
<!-- Manages logging MDC. -->
<filter>
<filter-name>SLF4JMDCServletFilter</filter-name>
<filter-class>net.shibboleth.idp.log.SLF4JMDCServletFilter</filter-class>
</filter>
- <filter-mapping>
- <filter-name>SameSiteCookieFilter</filter-name>
- <url-pattern>/*</url-pattern>
- </filter-mapping>
- <filter-mapping>
- <filter-name>CookieBufferingFilter</filter-name>
- <url-pattern>/profile/admin/*</url-pattern>
- <url-pattern>/profile/Logout</url-pattern>
- <url-pattern>/profile/Shibboleth/SSO</url-pattern>
- <url-pattern>/profile/SAML2/Unsolicited/SSO</url-pattern>
- <url-pattern>/profile/SAML2/Redirect/SSO</url-pattern>
- <url-pattern>/profile/SAML2/POST/SSO</url-pattern>
- <url-pattern>/profile/SAML2/POST-SimpleSign/SSO</url-pattern>
- <url-pattern>/profile/SAML2/Artifact/SSO</url-pattern>
- <url-pattern>/profile/SAML2/Redirect/SLO</url-pattern>
- <url-pattern>/profile/SAML2/POST/SLO</url-pattern>
- <url-pattern>/profile/SAML2/POST-SimpleSign/SLO</url-pattern>
- <url-pattern>/profile/SAML2/Artifact/SLO</url-pattern>
- <url-pattern>/profile/cas/login</url-pattern>
- </filter-mapping>
- <filter-mapping>
- <filter-name>DynamicResponseHeaderFilter</filter-name>
- <url-pattern>/profile/admin/*</url-pattern>
- <url-pattern>/profile/Shibboleth/SSO</url-pattern>
- <url-pattern>/profile/SAML2/Unsolicited/SSO</url-pattern>
- <url-pattern>/profile/SAML2/Redirect/SSO</url-pattern>
- <url-pattern>/profile/SAML2/POST/SSO</url-pattern>
- <url-pattern>/profile/SAML2/POST-SimpleSign/SSO</url-pattern>
- <url-pattern>/profile/SAML2/Artifact/SSO</url-pattern>
- <url-pattern>/profile/cas/login</url-pattern>
- <url-pattern>/Authn/*</url-pattern>
- </filter-mapping>
<filter-mapping>
<filter-name>CharacterEncodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
- <filter-mapping>
- <filter-name>RequestResponseContextFilter</filter-name>
- <url-pattern>/*</url-pattern>
- </filter-mapping>
<filter-mapping>
<filter-name>SLF4JMDCServletFilter</filter-name>
<url-pattern>/*</url-pattern>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list