[java-identity-provider] branch main updated: IDP-2124 - Allow session cookie to be persistent

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=54e4094aad59815ad9d7f1b67166ab26e26eb119

The following commit(s) were added to refs/heads/main by this push:
     new 54e4094aa IDP-2124 - Allow session cookie to be persistent
54e4094aa is described below

commit 54e4094aad59815ad9d7f1b67166ab26e26eb119
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jun 1 10:50:26 2023 -0400

    IDP-2124 - Allow session cookie to be persistent
    
    https://shibboleth.atlassian.net/browse/IDP-2124
    
    Added idp.session.persistent to adjust defaults wired into
    SessionManager.
---
 .../src/main/resources/net/shibboleth/idp/conf/global-system.xml    | 6 +++---
 .../resources/net/shibboleth/idp/conf/session-manager-system.xml    | 6 ++++--
 .../main/resources/net/shibboleth/idp/module/conf/idp.properties    | 3 +++
 .../test/resources/net/shibboleth/idp/module/conf/idp.properties    | 5 ++++-
 4 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
index f3902dc53..e2d69cdeb 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/global-system.xml
@@ -277,7 +277,7 @@
     <bean id="shibboleth.MarshallerFactory" factory-method="getMarshallerFactory" class="org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport" depends-on="shibboleth.OpenSAMLConfig" />
     <bean id="shibboleth.UnmarshallerFactory" factory-method="getUnmarshallerFactory" class="org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport" depends-on="shibboleth.OpenSAMLConfig" />
 
-    <bean id="shibboleth.CookieManager" class="net.shibboleth.shared.net.CookieManager"
+    <bean id="shibboleth.CookieManager" class="net.shibboleth.shared.net.CookieManager" lazy-init="true"
         p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
         p:httpServletResponseSupplier-ref="shibboleth.HttpServletResponseSupplier"
         p:secure="%{idp.cookie.secure:true}"
@@ -286,7 +286,7 @@
         p:cookiePath="%{idp.cookie.path:/}"
         p:maxAge="-1" />
 
-    <bean id="shibboleth.PersistentCookieManager" class="net.shibboleth.shared.net.CookieManager"
+    <bean id="shibboleth.PersistentCookieManager" class="net.shibboleth.shared.net.CookieManager" lazy-init="true"
         p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
         p:httpServletResponseSupplier-ref="shibboleth.HttpServletResponseSupplier"
         p:secure="%{idp.cookie.secure:true}"
@@ -295,7 +295,7 @@
         p:cookiePath="%{idp.cookie.path:/}"
         p:maxAge="%{idp.cookie.maxAge:31536000}" />
 
-    <bean id="shibboleth.UserPrefsCookieManager" class="net.shibboleth.shared.net.CookieManager"
+    <bean id="shibboleth.UserPrefsCookieManager" class="net.shibboleth.shared.net.CookieManager" lazy-init="true"
         p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
         p:httpServletResponseSupplier-ref="shibboleth.HttpServletResponseSupplier"
         p:secure="%{idp.cookie.secure:true}"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/session-manager-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/session-manager-system.xml
index 872e187fd..690963f0e 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/session-manager-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/session-manager-system.xml
@@ -80,9 +80,11 @@
         depends-on="shibboleth.OpenSAMLConfig"
         p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
         p:authenticationFlowDescriptors="#{@'shibboleth.AuthenticationFlowDescriptorManager'.getComponents()}"
-        p:cookieManager-ref="shibboleth.CookieManager"
         p:cookieName="%{idp.session.cookieName:__Host-shib_idp_session}"
-        p:storageService-ref="#{'%{idp.session.StorageService:shibboleth.ClientSessionStorageService}'.trim()}"
+        p:cookieManager-ref="#{%{idp.session.persistent:false} ? 'shibboleth.PersistentCookieManager' : 'shibboleth.CookieManager'}"
+        p:storageService-ref="#{'%{idp.session.StorageService:}'.isEmpty() ?
+            (%{idp.session.persistent:false} ? 'shibboleth.ClientPersistentStorageService' : 'shibboleth.ClientSessionStorageService')
+                : '%{idp.session.StorageService:}'.trim()}"
         p:consistentAddressCondition="#{getObject('%{idp.session.consistentAddressCondition:}'.trim()) ?:
             T(net.shibboleth.idp.session.impl.StorageBackedSessionManager.DefaultConsistentAddressConditionFactory).getDefaultConsistentAddressCondition(%{idp.session.consistentAddress:true})}"
         p:sessionTimeout="%{idp.session.timeout:PT60M}"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
index ec4833001..1e37c9b71 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
@@ -124,6 +124,9 @@ idp.storage.htmlLocalStorage = true
 # Set to false to disable the IdP session layer
 #idp.session.enabled = true
 
+# Set to true to rely on persistent cookies for session management
+#idp.session.persistent = false
+
 # Set to "shibboleth.StorageService" for server-side storage of user sessions
 #idp.session.StorageService = shibboleth.ClientSessionStorageService
 
diff --git a/idp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/idp.properties b/idp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/idp.properties
index b3dddb8de..2cbe2d6fe 100644
--- a/idp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/idp.properties
+++ b/idp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/idp.properties
@@ -37,7 +37,7 @@ idp.csrf.enabled = true
 #idp.csrf.token.parameter = csrf_token
 
 # HSTS/CSP response headers
-#idp.hsts = max-age=0
+#idp.hsts = max-age=31536000
 # X-Frame-Options value, set to DENY or SAMEORIGIN to block framing
 #idp.frameoptions = DENY
 # Content-Security-Policy value, set to match X-Frame-Options default
@@ -109,6 +109,9 @@ idp.storage.clientPersistentStorageName = __Host-shib_idp_persistent_ss
 # Set to false to disable the IdP session layer
 #idp.session.enabled = true
 
+# Set to true to rely on persistent cookies for session management
+#idp.session.persistent = false
+
 # Set to "shibboleth.StorageService" for server-side storage of user sessions
 #idp.session.StorageService = shibboleth.ClientSessionStorageService
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.