[java-identity-provider] branch main updated: IDP-2076 - Implement new SAML profile settings
Scott Cantor
cantor.2 at osu.edu
Tue Feb 28 16:38:26 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=56d8bd1647d00bb0abeccdbab0811d1b6879e62c
The following commit(s) were added to refs/heads/main by this push:
new 56d8bd164 IDP-2076 - Implement new SAML profile settings
56d8bd164 is described below
commit 56d8bd1647d00bb0abeccdbab0811d1b6879e62c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Feb 28 11:37:37 2023 -0500
IDP-2076 - Implement new SAML profile settings
https://shibboleth.atlassian.net/browse/IDP-2076
Implement SAML-wide message handler hook via profile config.
---
idp-conf-impl/pom.xml | 5 +++
.../net/shibboleth/idp/conf/global-system.xml | 4 ++-
.../shibboleth/idp/conf/relying-party-mddriven.xml | 8 ++---
.../idp/flows/authn/saml-authn-beans.xml | 14 +++++---
.../shibboleth/idp/flows/authn/saml-authn-flow.xml | 4 +--
.../flows/saml/logout/saml2-logoutprop-beans.xml | 5 +++
.../flows/saml/saml1/artifact-resolution-beans.xml | 5 +++
.../idp/flows/saml/saml1/attribute-query-beans.xml | 5 +++
.../idp/flows/saml/saml1/sso-abstract-beans.xml | 5 +++
.../idp/flows/saml/saml1/sso-security-flow.xml | 1 +
.../flows/saml/saml2/artifact-resolution-beans.xml | 5 +++
.../idp/flows/saml/saml2/attribute-query-beans.xml | 5 +++
.../idp/flows/saml/saml2/ecp-security-flow.xml | 1 +
.../idp/flows/saml/saml2/slo-back-beans.xml | 5 +++
.../flows/saml/saml2/slo-front-abstract-beans.xml | 5 +++
.../idp/flows/saml/saml2/slo-security-flow.xml | 1 +
.../idp/flows/saml/saml2/sso-abstract-beans.xml | 5 +++
.../idp/flows/saml/saml2/sso-security-flow.xml | 1 +
.../shibboleth/idp/flows/saml/security-beans.xml | 12 +++++++
.../idp/flows/saml/soap-security-flow.xml | 1 +
.../impl/AbstractSAMLProfileConfiguration.java | 37 +++++++++++++++++++
.../impl/AbstractSAML2ProfileConfiguration.java | 41 ----------------------
22 files changed, 123 insertions(+), 52 deletions(-)
diff --git a/idp-conf-impl/pom.xml b/idp-conf-impl/pom.xml
index e3d9ff210..00a4ad883 100644
--- a/idp-conf-impl/pom.xml
+++ b/idp-conf-impl/pom.xml
@@ -107,6 +107,11 @@
<artifactId>opensaml-messaging-impl</artifactId>
<scope>runtime</scope>
</dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-profile-impl</artifactId>
+ <scope>runtime</scope>
+ </dependency>
<dependency>
<groupId>${shib-shared.groupId}</groupId>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
index 943dd85e5..b3afb3fc5 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
@@ -190,12 +190,14 @@
</property>
<property name="deadProperties">
<list>
- <value>idp.service.attribute.resolver.suppressDisplayInfo</value>
<value>idp.authn.flows.initial</value>
<value>idp.authn.resolveAttribute</value>
+ <value>idp.authn.SAML.inboundMessageHandlerFunction</value>
+ <value>idp.authn.SAML.outboundMessageHandlerFunction</value>
<value>idp.nameid.saml1.legacyGenerator</value>
<value>idp.nameid.saml2.legacyGenerator</value>
<value>idp.service.attribute.registry.namingRegistry</value>
+ <value>idp.service.attribute.resolver.suppressDisplayInfo</value>
</list>
</property>
</bean>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
index 1bc575c17..446269697 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
@@ -149,6 +149,10 @@
<constructor-arg value="false" />
</bean>
</property>
+ <property name="messageHandlerLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="messageHandler"
+ p:propertyType="#{T(java.util.function.Function)}" />
+ </property>
</bean>
<bean id="AbstractMDDrivenSAML1AssertionProducingProfile" parent="AbstractMDDrivenSAMLProfile" abstract="true">
@@ -206,10 +210,6 @@
<constructor-arg value="false" />
</bean>
</property>
- <property name="requestDecoratorLookupStrategy">
- <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="requestDecorator"
- p:propertyType="#{T(java.util.function.BiConsumer)}" />
- </property>
</bean>
<bean id="AbstractMDDrivenSAML2AssertionProducingProfile" parent="AbstractMDDrivenSAML2Profile" abstract="true">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
index c0976bf9b..cf9e7b2fa 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
@@ -179,9 +179,12 @@
<property name="handlers">
<list>
<bean class="org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler" scope="prototype"/>
+ <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
+ <property name="functionLookupStrategy">
+ <bean class="net.shibboleth.saml.profile.config.navigate.messaging.MessageHandlerLookupFunction" />
+ </property>
+ </bean>
<bean class="org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler" scope="prototype"/>
- <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype"
- p:function="#{getObject('%{idp.authn.SAML.outboundMessageHandlerFunction:}'.trim())}" />
<bean class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler" scope="prototype"
p:signErrorResponses="%{idp.errors.signed:true}">
<property name="activationCondition">
@@ -305,6 +308,11 @@
<bean class="org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler" scope="prototype"
p:roleDescriptorResolver-ref="shibboleth.RoleDescriptorResolver"
p:copyContextStrategy-ref="OutboundSAMLMetadataContextLookup" />
+ <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
+ <property name="functionLookupStrategy">
+ <bean class="net.shibboleth.saml.profile.config.navigate.messaging.MessageHandlerLookupFunction" />
+ </property>
+ </bean>
<bean class="org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler" scope="prototype"
p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
<bean class="org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler" scope="prototype"
@@ -323,8 +331,6 @@
<bean class="org.opensaml.messaging.handler.impl.CheckExpectedIssuer" scope="prototype"
p:issuerLookupStrategy-ref="InboundEntityIDLookup"
p:expectedIssuerLookupStrategy-ref="OutboundEntityIDLookup" />
- <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype"
- p:function="#{getObject('%{idp.authn.SAML.inboundMessageHandlerFunction:}'.trim())}" />
</list>
</property>
</bean>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-flow.xml
index c62159315..953bdede9 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-flow.xml
@@ -48,8 +48,8 @@
<view-state id="EncodeSAMLRequest" view="externalRedirect:#{T(net.shibboleth.idp.authn.ExternalAuthentication).getExternalRedirect(flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.SAML.externalAuthnPathStrategy').apply(opensamlProfileRequestContext) + '/start', flowExecutionContext.getKey().toString())}">
<attribute name="csrf_excluded" value="true" type="boolean"/>
<on-render>
- <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).addSubcontext(new net.shibboleth.idp.authn.context.ExternalAuthenticationContext(new net.shibboleth.idp.authn.impl.ExternalAuthenticationImpl(false)), true).setFlowExecutionUrl(flowExecutionUrl + '&_eventId_proceed=1')" />
- <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).addSubcontext(new net.shibboleth.idp.saml.saml2.profile.impl.SAMLAuthnContext(EncodeMessage, messageDecoderFactory), true)" result="flowScope.samlContext" />
+ <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).addOrCreateSubcontext(new net.shibboleth.idp.authn.context.ExternalAuthenticationContext(new net.shibboleth.idp.authn.impl.ExternalAuthenticationImpl(false))).setFlowExecutionUrl(flowExecutionUrl + '&_eventId_proceed=1')" />
+ <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).addOrCreateSubcontext(new net.shibboleth.idp.saml.saml2.profile.impl.SAMLAuthnContext(EncodeMessage, messageDecoderFactory))" result="flowScope.samlContext" />
<evaluate expression="flowScope.samlContext.setOutboundMessageHandler(PreEncodeMessageHandler)" />
</on-render>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml
index 150274607..8e9b4ad73 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/logout/saml2-logoutprop-beans.xml
@@ -109,6 +109,11 @@
<property name="handlers">
<list>
<bean class="org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler" scope="prototype"/>
+ <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
+ <property name="functionLookupStrategy">
+ <bean class="net.shibboleth.saml.profile.config.navigate.messaging.MessageHandlerLookupFunction" />
+ </property>
+ </bean>
<bean class="org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler" scope="prototype"/>
<bean class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler" scope="prototype"
p:signErrorResponses="%{idp.errors.signed:true}">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-beans.xml
index 57e9f8b4a..296b56570 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-beans.xml
@@ -48,6 +48,11 @@
class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain" scope="prototype">
<property name="handlers">
<list>
+ <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
+ <property name="functionLookupStrategy">
+ <bean class="net.shibboleth.saml.profile.config.navigate.messaging.MessageHandlerLookupFunction" />
+ </property>
+ </bean>
<bean class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler" scope="prototype"
p:signErrorResponses="%{idp.errors.signed:true}">
<property name="activationCondition">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-beans.xml
index f8c5f8a65..4ecad29f0 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-beans.xml
@@ -55,6 +55,11 @@
class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain" scope="prototype">
<property name="handlers">
<list>
+ <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
+ <property name="functionLookupStrategy">
+ <bean class="net.shibboleth.saml.profile.config.navigate.messaging.MessageHandlerLookupFunction" />
+ </property>
+ </bean>
<bean class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler" scope="prototype"
p:signErrorResponses="%{idp.errors.signed:true}">
<property name="activationCondition">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-abstract-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-abstract-beans.xml
index cbb561595..df2e16ca6 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-abstract-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-abstract-beans.xml
@@ -64,6 +64,11 @@
<property name="handlers">
<list>
<bean class="org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler" scope="prototype"/>
+ <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
+ <property name="functionLookupStrategy">
+ <bean class="net.shibboleth.saml.profile.config.navigate.messaging.MessageHandlerLookupFunction" />
+ </property>
+ </bean>
<bean class="org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler" scope="prototype"/>
<bean class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler" scope="prototype"
p:signErrorResponses="%{idp.errors.signed:true}">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-security-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-security-flow.xml
index 18b011144..7488238b0 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-security-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-security-flow.xml
@@ -6,6 +6,7 @@
<!-- Default inbound security processing for Shibboleth SSO profile. -->
<action-state id="ShibbolethSSOSecurityPolicy">
+ <evaluate expression="FunctionMessageHandler" />
<evaluate expression="OptionalMessageReplaySecurityHandler" />
<evaluate expression="OptionalMessageLifetimeSecurityHandler" />
<evaluate expression="CheckMandatoryIssuer" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-beans.xml
index dd42cf1e7..9b537ee82 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-beans.xml
@@ -57,6 +57,11 @@
class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain" scope="prototype">
<property name="handlers">
<list>
+ <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
+ <property name="functionLookupStrategy">
+ <bean class="net.shibboleth.saml.profile.config.navigate.messaging.MessageHandlerLookupFunction" />
+ </property>
+ </bean>
<bean class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler" scope="prototype"
p:signErrorResponses="%{idp.errors.signed:true}">
<property name="activationCondition">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-beans.xml
index 0ca4b7988..30f2cbb24 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-beans.xml
@@ -60,6 +60,11 @@
class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain" scope="prototype">
<property name="handlers">
<list>
+ <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
+ <property name="functionLookupStrategy">
+ <bean class="net.shibboleth.saml.profile.config.navigate.messaging.MessageHandlerLookupFunction" />
+ </property>
+ </bean>
<bean class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler" scope="prototype"
p:signErrorResponses="%{idp.errors.signed:true}">
<property name="activationCondition">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/ecp-security-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/ecp-security-flow.xml
index e7abc7b31..5dfbe86ef 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/ecp-security-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/ecp-security-flow.xml
@@ -6,6 +6,7 @@
<!-- Default inbound security processing for SAML 2 ECP profile. -->
<action-state id="SAML2ECPSecurityPolicy">
+ <evaluate expression="FunctionMessageHandler" />
<evaluate expression="ReceivedEndpointSecurityHandler" />
<evaluate expression="MessageReplaySecurityHandler" />
<evaluate expression="MessageLifetimeSecurityHandler" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-beans.xml
index fa4c15588..3349f7637 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-beans.xml
@@ -100,6 +100,11 @@
class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain" scope="prototype">
<property name="handlers">
<util:list>
+ <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
+ <property name="functionLookupStrategy">
+ <bean class="net.shibboleth.saml.profile.config.navigate.messaging.MessageHandlerLookupFunction" />
+ </property>
+ </bean>
<bean class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler"
scope="prototype" p:signErrorResponses="%{idp.errors.signed:true}" />
</util:list>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-front-abstract-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-front-abstract-beans.xml
index bee74d745..f3e72a884 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-front-abstract-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-front-abstract-beans.xml
@@ -147,6 +147,11 @@
<property name="handlers">
<list>
<bean class="org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler" scope="prototype"/>
+ <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
+ <property name="functionLookupStrategy">
+ <bean class="net.shibboleth.saml.profile.config.navigate.messaging.MessageHandlerLookupFunction" />
+ </property>
+ </bean>
<bean class="org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler" scope="prototype"/>
<bean class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler" scope="prototype"
p:signErrorResponses="%{idp.errors.signed:true}">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-security-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-security-flow.xml
index e7ae170d8..4f85ca099 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-security-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-security-flow.xml
@@ -6,6 +6,7 @@
<!-- Default inbound security processing for SAML 2 SLO profile. -->
<action-state id="SAML2SLOSecurityPolicy">
+ <evaluate expression="FunctionMessageHandler" />
<evaluate expression="ReceivedEndpointSecurityHandler" />
<evaluate expression="MessageReplaySecurityHandler" />
<evaluate expression="MessageLifetimeSecurityHandler" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-beans.xml
index 2f1e0b28a..23d253acb 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-beans.xml
@@ -120,6 +120,11 @@
<property name="handlers">
<list>
<bean class="org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler" scope="prototype"/>
+ <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
+ <property name="functionLookupStrategy">
+ <bean class="net.shibboleth.saml.profile.config.navigate.messaging.MessageHandlerLookupFunction" />
+ </property>
+ </bean>
<bean class="org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler" scope="prototype"/>
<bean class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler" scope="prototype"
p:signErrorResponses="%{idp.errors.signed:true}">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-security-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-security-flow.xml
index cac9dd656..a721b02e6 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-security-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-security-flow.xml
@@ -6,6 +6,7 @@
<!-- Default inbound security processing for SAML 2 SSO profile. -->
<action-state id="SAML2SSOSecurityPolicy">
+ <evaluate expression="FunctionMessageHandler" />
<evaluate expression="ReceivedEndpointSecurityHandler" />
<evaluate expression="MessageReplaySecurityHandler" />
<evaluate expression="MessageLifetimeSecurityHandler" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/security-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/security-beans.xml
index bfeeb5abd..91a23c497 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/security-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/security-beans.xml
@@ -219,4 +219,16 @@
</constructor-arg>
</bean>
+ <bean id="FunctionMessageHandler"
+ class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
+ c:executionDirection="INBOUND">
+ <constructor-arg name="messageHandler">
+ <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype">
+ <property name="functionLookupStrategy">
+ <bean class="net.shibboleth.saml.profile.config.navigate.messaging.MessageHandlerLookupFunction" />
+ </property>
+ </bean>
+ </constructor-arg>
+ </bean>
+
</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/soap-security-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/soap-security-flow.xml
index 0e40e5f47..56cbf8f97 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/soap-security-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/soap-security-flow.xml
@@ -6,6 +6,7 @@
<!-- Default inbound security processing for SOAP-bound profiles. -->
<action-state id="SOAPSecurityPolicy">
+ <evaluate expression="FunctionMessageHandler" />
<evaluate expression="ReceivedEndpointSecurityHandler" />
<evaluate expression="MessageReplaySecurityHandler" />
<evaluate expression="MessageLifetimeSecurityHandler" />
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/config/impl/AbstractSAMLProfileConfiguration.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/config/impl/AbstractSAMLProfileConfiguration.java
index 379fe196c..591b8371b 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/config/impl/AbstractSAMLProfileConfiguration.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/config/impl/AbstractSAMLProfileConfiguration.java
@@ -17,6 +17,7 @@
package net.shibboleth.idp.saml.profile.config.impl;
+import java.util.function.Function;
import java.util.function.Predicate;
import javax.annotation.Nonnull;
@@ -26,8 +27,10 @@ import net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfigur
import net.shibboleth.idp.saml.profile.config.SAMLProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.logic.PredicateSupport;
+import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
/** Base class for SAML profile configurations. */
@@ -40,6 +43,9 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractIntercept
/** Predicate used to determine if the generated response should be signed. Default returns false. */
@Nonnull private Predicate<ProfileRequestContext> signResponsesPredicate;
+ /** Lookup strategy for message decorator. */
+ @Nonnull private Function<MessageContext,Function<MessageContext,Exception>> messageHandlerLookupStrategy;
+
/**
* Constructor.
*
@@ -50,6 +56,8 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractIntercept
signRequestsPredicate = PredicateSupport.alwaysFalse();
signResponsesPredicate = PredicateSupport.alwaysFalse();
+
+ messageHandlerLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
@@ -102,4 +110,33 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractIntercept
signResponsesPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
}
+ /** {@inheritDoc} */
+ @Nullable
+ public Function<MessageContext,Exception> getMessageHandler(@Nullable final MessageContext messageContext) {
+ return messageHandlerLookupStrategy.apply(messageContext);
+ }
+
+ /**
+ * Set a handler for the SAML message.
+ *
+ * @param handler message handler
+ *
+ * @since 5.0.0
+ */
+ public void setMessageDecorator(@Nullable final Function<MessageContext,Exception> handler) {
+ messageHandlerLookupStrategy = FunctionSupport.constant(handler);
+ }
+
+ /**
+ * Set a lookup strategy for the handler for the SAML message.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 5.0.0
+ */
+ public void setMessageHandlerLookupStrategy(
+ @Nonnull final Function<MessageContext,Function<MessageContext,Exception>> strategy) {
+ messageHandlerLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AbstractSAML2ProfileConfiguration.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AbstractSAML2ProfileConfiguration.java
index 61ab4b3f6..b2153d9dc 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AbstractSAML2ProfileConfiguration.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AbstractSAML2ProfileConfiguration.java
@@ -17,8 +17,6 @@
package net.shibboleth.idp.saml.saml2.profile.config.impl;
-import java.util.function.BiConsumer;
-import java.util.function.Function;
import java.util.function.Predicate;
import javax.annotation.Nonnull;
@@ -28,11 +26,9 @@ import net.shibboleth.idp.saml.profile.config.impl.AbstractSAMLProfileConfigurat
import net.shibboleth.saml.saml2.profile.config.SAML2ProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.logic.PredicateSupport;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.RequestAbstractType;
/** Base class for SAML 2 profile configurations. */
public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProfileConfiguration implements
@@ -46,10 +42,6 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
/** Predicate used to determine if name identifiers should be encrypted. */
@Nonnull private Predicate<ProfileRequestContext> encryptNameIDsPredicate;
-
- /** Lookup strategy for request decorator. */
- @Nonnull Function<ProfileRequestContext,BiConsumer<ProfileRequestContext,? extends RequestAbstractType>>
- requestDecoratorLookupStrategy;
/**
* Constructor.
@@ -62,8 +54,6 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
ignoreRequestSignaturesPredicate = PredicateSupport.alwaysFalse();
encryptionOptionalPredicate = PredicateSupport.alwaysFalse();
encryptNameIDsPredicate = PredicateSupport.alwaysFalse();
-
- requestDecoratorLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
@@ -143,35 +133,4 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
encryptNameIDsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
}
- /** {@inheritDoc} */
- @Nullable public BiConsumer<ProfileRequestContext,? extends RequestAbstractType> getRequestDecorator(
- @Nullable final ProfileRequestContext profileRequestContext) {
- return requestDecoratorLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set a decorator for the SAML request.
- *
- * @param decorator request decorator
- *
- * @since 5.0.0
- */
- public void setRequestDecorator(
- @Nullable BiConsumer<ProfileRequestContext,? extends RequestAbstractType> decorator) {
- requestDecoratorLookupStrategy = FunctionSupport.constant(decorator);
- }
-
- /**
- * Set a lookup strategy decorator for the SAML request.
- *
- * @param strategy lookup strategy
- *
- * @since 5.0.0
- */
- public void setRequestDecoratorLookupStrategy(
- @Nonnull Function<ProfileRequestContext,BiConsumer<ProfileRequestContext,? extends RequestAbstractType>>
- strategy) {
- requestDecoratorLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list