[java-identity-provider] branch main updated: Factor out filter beans.
Scott Cantor
cantor.2 at osu.edu
Fri Sep 30 13:19:42 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f12eeded7d77feb26aa06a82c67caa45dd2b4ae7
The following commit(s) were added to refs/heads/main by this push:
new f12eeded7 Factor out filter beans.
f12eeded7 is described below
commit f12eeded7d77feb26aa06a82c67caa45dd2b4ae7
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Sep 30 09:19:39 2022 -0400
Factor out filter beans.
---
.../resources/net/shibboleth/idp/conf/filters.xml | 83 ++++++++++++++++++++++
.../net/shibboleth/idp/conf/global-system.xml | 69 +-----------------
2 files changed, 85 insertions(+), 67 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml
new file mode 100644
index 000000000..223e66bbc
--- /dev/null
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/filters.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <!-- Beans related to servlet/filter installation and use. -->
+
+ <bean id="shibboleth.HttpServletRequest" class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestProxy" />
+ <bean id="shibboleth.HttpServletRequestSupplier" class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestSupplier" />
+ <bean id="shibboleth.HttpServletResponse" class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseProxy" />
+ <bean id="shibboleth.HttpServletResponseSupplier" class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseSupplier" />
+
+ <bean id="shibboleth.DefaultResponseHeaderMap"
+ class="org.springframework.beans.factory.config.MapFactoryBean">
+ <property name="sourceMap">
+ <map>
+ <entry key="Strict-Transport-Security" value="%{idp.hsts:max-age=0}" />
+ <entry key="X-Frame-Options" value="%{idp.frameoptions:DENY}" />
+ <entry key="Content-Security-Policy" value="%{idp.csp:frame-ancestors 'none';}"/>
+ </map>
+ </property>
+ </bean>
+
+ <!-- These are stubbed out to emit warnings when not removed from web.xml. -->
+ <bean id="shibboleth.SameSiteCookieFilter" class="net.shibboleth.shared.servlet.impl.StubbedFilter"
+ c:_0="Servlet Filter 'shibboleth.SameSiteCookieFilter'" />
+ <bean id="shibboleth.ResponseHeaderFilter" class="net.shibboleth.shared.servlet.impl.StubbedFilter"
+ c:_0="Servlet Filter 'shibboleth.ResponseHeaderFilter'" />
+
+ <!--
+ This is the chain of our filters installed by a ServletContextListener, via Spring delegating filter.
+ Any filter beans defined that extend ChainableFilter will be auto-wired in.
+ -->
+ <bean id="shibboleth.ChainingFilter" class="net.shibboleth.shared.spring.servlet.impl.ChainingFilter" />
+
+ <!-- These filters will be auto-wired into the chaining filter bean. -->
+
+ <!-- Can't be disabled, runs "LATEST" so that the TLS-stored objects are wrapped by other filters. -->
+ <bean class="net.shibboleth.shared.spring.servlet.impl.RequestResponseContextFilter" />
+
+ <!-- Mapped to all requests but runs conditionally, and runs EARLIEST to ensure a last look at cookies. -->
+ <bean class="net.shibboleth.shared.spring.servlet.impl.SameSiteCookieHeaderFilter"
+ p:activationCondition-ref="#{'%{idp.cookie.sameSiteCondition:shibboleth.Conditions.FALSE}'.trim()}"
+ p:defaultValue="%{idp.cookie.sameSite:None}"
+ p:sameSiteCookies="#{getObject('shibboleth.SameSiteCookieMap')}" />
+
+ <!--
+ This was, Scott thinks, needed for client storage to work, but if it runs, it has to be after the
+ SameSite filter; i.e. it needs to execute on the response before that one does, so runs NEUTRAL.
+ -->
+ <bean class="net.shibboleth.shared.spring.servlet.impl.CookieBufferingFilter"
+ p:activationCondition-ref="#{'%{idp.cookie.bufferingCondition:shibboleth.Conditions.TRUE}'.trim()}" />
+
+ <!-- Handles response header customization so must run conditionally based on path prefix. -->
+ <bean class="net.shibboleth.shared.spring.servlet.impl.DynamicResponseHeaderFilter"
+ p:activationCondition-ref="UserFacingPrefixPredicate"
+ p:headers="#{getObject('shibboleth.ResponseHeaderMap') ?: getObject('shibboleth.DefaultResponseHeaderMap')}"
+ p:callbacks="#{getObject('shibboleth.ResponseHeaderCallbacks')}" />
+
+ <!-- Evaluates auto-wired paths against a requested URL. -->
+ <bean id="UserFacingPrefixPredicate" class="net.shibboleth.shared.spring.servlet.RequestURLPrefixPredicate" />
+
+ <!-- Path prefixes for user-facing non-logout activity. -->
+ <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/admin/" />
+ <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/Shibboleth/SSO" />
+ <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/SAML2/Unsolicited/SSO" />
+ <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/SAML2/Redirect/SSO" />
+ <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/SAML2/POST/SSO" />
+ <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/SAML2/POST-SimpleSign/SSO" />
+ <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/SAML2/Artifact/SSO" />
+ <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/cas/login" />
+ <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/Authn/" />
+
+</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
index 8aeb6cd48..a2c19aca1 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
@@ -12,7 +12,7 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <!-- Needed to allow for auto-wiring of descriptors and other componnents. -->
+ <!-- Needed to allow for auto-wiring of descriptors and other components. -->
<context:annotation-config />
<bean id="shibboleth.PropertySourcesPlaceholderConfigurer"
@@ -160,6 +160,7 @@
<import resource="soap-client.xml" />
<import resource="saml-utilities.xml" />
<import resource="sealer.xml" />
+ <import resource="filters.xml" />
<bean id="systemPrereqs" class="org.springframework.beans.factory.config.MethodInvokingBean"
p:targetObject-ref="systemProperties" p:targetMethod="putAll">
@@ -260,72 +261,6 @@
<value>#{'classpath:' + T(net.shibboleth.idp.saml.xmlobject.ExtensionsConstants).SHIB_MDEXT10_SCHEMA_LOCATION }</value>
</util:list>
- <bean id="shibboleth.HttpServletRequest" class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestProxy" />
- <bean id="shibboleth.HttpServletRequestSupplier" class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestSupplier" />
- <bean id="shibboleth.HttpServletResponse" class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseProxy" />
- <bean id="shibboleth.HttpServletResponseSupplier" class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletResponseSupplier" />
-
- <bean id="shibboleth.DefaultResponseHeaderMap"
- class="org.springframework.beans.factory.config.MapFactoryBean">
- <property name="sourceMap">
- <map>
- <entry key="Strict-Transport-Security" value="%{idp.hsts:max-age=0}" />
- <entry key="X-Frame-Options" value="%{idp.frameoptions:DENY}" />
- <entry key="Content-Security-Policy" value="%{idp.csp:frame-ancestors 'none';}"/>
- </map>
- </property>
- </bean>
-
- <!-- These are stubbed out to emit warnings when not removed from web.xml. -->
- <bean id="shibboleth.SameSiteCookieFilter" class="net.shibboleth.shared.servlet.impl.StubbedFilter"
- c:_0="Servlet Filter 'shibboleth.SameSiteCookieFilter'" />
- <bean id="shibboleth.ResponseHeaderFilter" class="net.shibboleth.shared.servlet.impl.StubbedFilter"
- c:_0="Servlet Filter 'shibboleth.ResponseHeaderFilter'" />
-
- <!--
- This is the chain of our filters installed by a ServletContextListener, via Spring delegating filter.
- Any filter beans defined that extend ChainableFilter will be auto-wired in.
- -->
- <bean id="shibboleth.ChainingFilter" class="net.shibboleth.shared.spring.servlet.impl.ChainingFilter" />
-
- <!-- These filters will be auto-wired into the chaining filter bean. -->
-
- <!-- Mapped to all requests but runs conditionally. -->
- <bean class="net.shibboleth.shared.spring.servlet.impl.SameSiteCookieHeaderFilter"
- p:activationCondition-ref="#{'%{idp.cookie.sameSiteCondition:shibboleth.Conditions.FALSE}'.trim()}"
- p:defaultValue="%{idp.cookie.sameSite:None}"
- p:sameSiteCookies="#{getObject('shibboleth.SameSiteCookieMap')}" />
-
- <!--
- This was, Scott thinks, needed for client storage to work, but if it runs, it
- has to be after the SameSite filter; i.e. it needs to execute on the response
- before that one does, so is later in the chain.
- -->
- <bean class="net.shibboleth.shared.spring.servlet.impl.CookieBufferingFilter"
- p:activationCondition-ref="#{'%{idp.cookie.bufferingCondition:shibboleth.Conditions.TRUE}'.trim()}" />
-
- <!-- Handles response header customization so must run conditionally. -->
- <bean class="net.shibboleth.shared.spring.servlet.impl.DynamicResponseHeaderFilter"
- p:activationCondition-ref="UserFacingPrefixPredicate"
- p:headers="#{getObject('shibboleth.ResponseHeaderMap') ?: getObject('shibboleth.DefaultResponseHeaderMap')}"
- p:callbacks="#{getObject('shibboleth.ResponseHeaderCallbacks')}" />
-
- <bean id="UserFacingPrefixPredicate" class="net.shibboleth.shared.spring.servlet.RequestURLPrefixPredicate" />
-
- <!-- Path prefixes for user-facing non-logout activity. -->
- <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/admin/" />
- <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/Shibboleth/SSO" />
- <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/SAML2/Unsolicited/SSO" />
- <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/SAML2/Redirect/SSO" />
- <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/SAML2/POST/SSO" />
- <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/SAML2/POST-SimpleSign/SSO" />
- <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/SAML2/Artifact/SSO" />
- <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/profile/cas/login" />
- <bean class="net.shibboleth.shared.spring.servlet.URLPrefix" c:_0="/Authn/" />
-
- <!-- Can't be disabled. -->
- <bean class="net.shibboleth.shared.spring.servlet.impl.RequestResponseContextFilter" />
-
<bean id="shibboleth.BuilderFactory" factory-method="getBuilderFactory" class="org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport" depends-on="shibboleth.OpenSAMLConfig" />
<bean id="shibboleth.MarshallerFactory" factory-method="getMarshallerFactory" class="org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport" depends-on="shibboleth.OpenSAMLConfig" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list