[java-idp-plugin-oidc-rp] branch main updated: JOIDCRP-35 - Add support for passive inbound requests
Phil Smart
philip.smart at jisc.ac.uk
Mon Jun 5 15:49:08 UTC 2023
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=df8422ac5ce8ef1ba65ba0ddf288972ae47014e9
The following commit(s) were added to refs/heads/main by this push:
new df8422a JOIDCRP-35 - Add support for passive inbound requests
df8422a is described below
commit df8422ac5ce8ef1ba65ba0ddf288972ae47014e9
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Jun 5 16:49:03 2023 +0100
JOIDCRP-35 - Add support for passive inbound requests
- prompt=none is set iff the inbound request requested passive
authentication. Runs after forced authentication is evaluated such that
prompt=login will be replaced with prompt=none but max_age=0 will be
left in the request.
https://shibboleth.atlassian.net/browse/JOIDCRP-35
---
.../impl/AddPassiveAuthenticationHandler.java | 63 +++++++++++++++
.../oidc-relying-party-authn-beans.xml | 6 ++
.../impl/AddPassiveAuthenticationHandlerTest.java | 91 ++++++++++++++++++++++
3 files changed, 160 insertions(+)
diff --git a/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddPassiveAuthenticationHandler.java b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddPassiveAuthenticationHandler.java
new file mode 100644
index 0000000..0dc3ccd
--- /dev/null
+++ b/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddPassiveAuthenticationHandler.java
@@ -0,0 +1,63 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.handler.MessageHandlerException;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.openid.connect.sdk.Prompt;
+
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+
+/**
+ * An action that sets the 'prompt' parameter to 'none' if passive authentication has been requested by the
+ * SP.
+ */
+public class AddPassiveAuthenticationHandler extends AbstractOIDCAuthenticationRequestActionMessageHandler {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AddPassiveAuthenticationHandler.class);
+
+ @Override protected void doInvoke(@Nonnull final MessageContext messageContext)
+ throws MessageHandlerException {
+
+ final ProfileRequestContext prc = lookupProfileRequestContext(messageContext);
+ boolean isPassive = false;
+ if (prc != null && prc.getParent() instanceof AuthenticationContext) {
+ isPassive = ((AuthenticationContext) prc.getParent()).isPassive();
+ }
+ if (isPassive) {
+ log.trace("{} Setting 'prompt=none' for OIDC AuthnRequest", getLogPrefix());
+ try {
+ getAuthenticationRequest().setPrompt(Prompt.parse(Prompt.Type.NONE.toString()));
+ } catch (final ParseException e) {
+ // This should never happen
+ throw new MessageHandlerException("Unable to honour passive authentication requirement, "
+ + "setting prompt to 'none' has failed", e);
+ }
+ } else {
+ log.trace("{} No passive authentication requirement, so prompt=none has not been set", getLogPrefix());
+ }
+ }
+}
diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index e0d3b69..05042c1 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -133,6 +133,12 @@
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddAuthenticationContextClassReferencesHandler"/>
<bean id="AddForceAuthentication" scope="prototype"
class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddForceAuthenticationHandler" />
+ <!--
+ Set passive authentication, prompt=none. Run after forced authentication (prompt=login) so this will take precedence
+ but the max_age value will be left (if forced authentication is used).
+ -->
+ <bean id="AddPassiveAuthentication" scope="prototype"
+ class="net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl.AddPassiveAuthenticationHandler" />
</list>
</property>
</bean>
diff --git a/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddPassiveAuthenticationHandlerTest.java b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddPassiveAuthenticationHandlerTest.java
new file mode 100644
index 0000000..1ffac74
--- /dev/null
+++ b/idp-oidc-rp-impl/src/test/java/net/shibboleth/idp/plugin/authn/oidc/rp/messaging/impl/AddPassiveAuthenticationHandlerTest.java
@@ -0,0 +1,91 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.authn.oidc.rp.messaging.impl;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNull;
+
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.openid.connect.sdk.Prompt;
+
+import net.shibboleth.idp.plugin.authn.oidc.rp.impl.AbstractOIDCTest;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.oidc.profile.config.impl.DefaultOIDCAuthorizationConfiguration;
+
+/** Tests for {@link AddPassiveAuthenticationHandlerTest}.*/
+public class AddPassiveAuthenticationHandlerTest extends AbstractOIDCTest {
+
+ /** The action to test.*/
+ private AddPassiveAuthenticationHandler handler;
+
+ /** The RPC.*/
+ private RelyingPartyContext rpc;
+
+ /** The profile config.*/
+ private DefaultOIDCAuthorizationConfiguration oidcAuthzConfig;
+
+ @Override
+ @BeforeMethod
+ public void setup() throws Exception {
+ super.setup();
+ handler = new AddPassiveAuthenticationHandler();
+
+ rpc = prc.getSubcontext(RelyingPartyContext.class, true);
+ oidcAuthzConfig = new DefaultOIDCAuthorizationConfiguration();
+ rpc.setProfileConfig(oidcAuthzConfig);
+
+ }
+
+ /**
+ * Test LOGIN prompt is added when force authn is enabled.
+ *
+ * @throws Exception on error
+ */
+ @Test
+ public void testSuccess() throws Exception {
+
+ ac.setIsPassive(true);
+
+ handler.initialize();
+ handler.invoke(prc.getOutboundMessageContext());
+
+ assertEquals(authnRequest.getPrompt().size(), 1);
+ assertEquals(authnRequest.getPrompt().iterator().next(), Prompt.Type.NONE);
+ }
+
+ /**
+ * Test no prompt=none is added when passive authn is not requested.
+ *
+ * @throws Exception on error
+ */
+ @Test
+ public void testPassiveNotRequired() throws Exception {
+
+ ac.setIsPassive(false);
+
+ handler.initialize();
+ handler.invoke(prc.getOutboundMessageContext());
+
+ assertNull(authnRequest.getPrompt());
+
+
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list