[java-identity-provider] branch main updated: IDP-2100 - Eliminate unnecessary message mapping for simpler login flows
Scott Cantor
cantor.2 at osu.edu
Mon May 8 13:30:36 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=833903efe375195b54a74a8b51e0821e544cac69
The following commit(s) were added to refs/heads/main by this push:
new 833903efe IDP-2100 - Eliminate unnecessary message mapping for simpler login flows
833903efe is described below
commit 833903efe375195b54a74a8b51e0821e544cac69
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon May 8 09:30:33 2023 -0400
IDP-2100 - Eliminate unnecessary message mapping for simpler login flows
https://shibboleth.atlassian.net/browse/IDP-2100
Eliminate RemoteUser config file and module.
Embed NoCredentials -> ReselectFlow mapping inside flow.
---
.../idp/authn/impl/SelectAuthenticationFlow.java | 3 +-
.../authn/impl/ValidateExternalAuthentication.java | 1 +
.../idp/module/authn/impl/RemoteUser.java | 41 ---------------
.../services/net.shibboleth.idp.module.IdPModule | 1 -
.../idp/flows/authn/remoteuser-authn-beans.xml | 3 +-
.../idp/flows/authn/remoteuser-authn-flow.xml | 1 +
.../idp/module/authn/impl/module.properties | 7 ---
.../module/conf/authn/remoteuser-authn-config.xml | 61 ----------------------
.../conf/authn/remoteuser-authn-config.xml | 61 ----------------------
9 files changed, 6 insertions(+), 173 deletions(-)
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java
index fef0155d3..119e90c10 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java
@@ -120,7 +120,8 @@ public class SelectAuthenticationFlow extends AbstractAuthenticationAction {
noProxying = authenticationContext.getProxyCount() != null && authenticationContext.getProxyCount() == 0;
- final RequestedPrincipalContext rpc = requestedPrincipalCtx = authenticationContext.getSubcontext(RequestedPrincipalContext.class);
+ final RequestedPrincipalContext rpc = requestedPrincipalCtx =
+ authenticationContext.getSubcontext(RequestedPrincipalContext.class);
if (rpc != null) {
if (rpc.getOperator() == null || rpc.getRequestedPrincipals().isEmpty()) {
requestedPrincipalCtx = null;
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java
index 362f3b020..c5a0a9f54 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java
@@ -203,6 +203,7 @@ public class ValidateExternalAuthentication extends AbstractAuditingValidationAc
getLogPrefix());
handleError(profileRequestContext, authenticationContext, AuthnEventIds.NO_CREDENTIALS,
AuthnEventIds.NO_CREDENTIALS);
+ recordFailure(profileRequestContext);
return;
}
final Subject subject = extContext.getSubject();
diff --git a/idp-conf-impl/src/main/java/net/shibboleth/idp/module/authn/impl/RemoteUser.java b/idp-conf-impl/src/main/java/net/shibboleth/idp/module/authn/impl/RemoteUser.java
deleted file mode 100644
index 773384911..000000000
--- a/idp-conf-impl/src/main/java/net/shibboleth/idp/module/authn/impl/RemoteUser.java
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.module.authn.impl;
-
-import java.io.IOException;
-
-import net.shibboleth.idp.module.IdPModule;
-import net.shibboleth.idp.module.ModuleException;
-import net.shibboleth.idp.module.impl.CoreIdPModule;
-
-/**
- * {@link IdPModule} implementation.
- */
-public final class RemoteUser extends CoreIdPModule {
-
- /**
- * Constructor.
- *
- * @throws ModuleException on error
- * @throws IOException on error
- */
- public RemoteUser() throws IOException, ModuleException {
- super(RemoteUser.class);
- }
-
-}
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule b/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
index 512c6350c..eab251f99 100644
--- a/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
+++ b/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
@@ -4,7 +4,6 @@ net.shibboleth.idp.module.authn.impl.Function
net.shibboleth.idp.module.authn.impl.IPAddress
net.shibboleth.idp.module.authn.impl.MFA
net.shibboleth.idp.module.authn.impl.Password
-net.shibboleth.idp.module.authn.impl.RemoteUser
net.shibboleth.idp.module.authn.impl.RemoteUserInternal
net.shibboleth.idp.module.authn.impl.SPNEGO
net.shibboleth.idp.module.authn.impl.X509
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml
index 07c453f0d..4ba13389a 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml
@@ -21,7 +21,8 @@
<!-- Default strategy function to obtain the external path. -->
<bean id="shibboleth.authn.RemoteUser.externalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
c:target="#{getObject('shibboleth.authn.RemoteUser.externalAuthnPath') ?: '%{idp.authn.RemoteUser.externalAuthnPath:contextRelative:/Authn/RemoteUser}'.trim()}" />
-
+
+ <!-- Legacy compatibility. -->
<import resource="conditional:%{idp.home}/conf/authn/remoteuser-authn-config.xml" />
<bean id="ValidateExternalAuthentication"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-flow.xml
index 6a35d003f..de4fc42a9 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-flow.xml
@@ -30,6 +30,7 @@
<evaluate expression="'proceed'" />
<transition on="proceed" to="CallSubjectCanonicalization" />
+ <transition on="NoCredentials" to="ReselectFlow" />
</action-state>
<!-- This runs a c14n step on the result of the authentication. -->
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties
index 94bfb27c9..d4baacbc3 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/authn/impl/module.properties
@@ -7,7 +7,6 @@ net.shibboleth.idp.module.authn.impl.Function = idp.authn.Function
net.shibboleth.idp.module.authn.impl.IPAddress = idp.authn.IPAddress
net.shibboleth.idp.module.authn.impl.MFA = idp.authn.MFA
net.shibboleth.idp.module.authn.impl.Password = idp.authn.Password
-net.shibboleth.idp.module.authn.impl.RemoteUser = idp.authn.RemoteUser
net.shibboleth.idp.module.authn.impl.RemoteUserInternal = idp.authn.RemoteUserInternal
net.shibboleth.idp.module.authn.impl.SPNEGO = idp.authn.SPNEGO
net.shibboleth.idp.module.authn.impl.X509 = idp.authn.X509
@@ -65,12 +64,6 @@ idp.authn.Demo.1.dest = credentials/demo.htpasswd
idp.authn.Demo.postenable = To use the demo account, adjust the shibboleth.authn.Password.Validators \
bean in conf/authn/password-authn-config.xml
-idp.authn.RemoteUser.name = RemoteUser Authentication
-idp.authn.RemoteUser.desc = Login flow for container-based authentication with a dedicated protected path.
-idp.authn.RemoteUser.url = /RemoteUserAuthnConfiguration
-idp.authn.RemoteUser.1.src = /net/shibboleth/idp/module/conf/authn/remoteuser-authn-config.xml
-idp.authn.RemoteUser.1.dest = conf/authn/remoteuser-authn-config.xml
-
idp.authn.RemoteUserInternal.name = RemoteUserInternal Authentication
idp.authn.RemoteUserInternal.desc = Login flow for container-based authentication with no redirects.
idp.authn.RemoteUserInternal.url = /RemoteUserInternalAuthnConfiguration
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/remoteuser-authn-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/remoteuser-authn-config.xml
deleted file mode 100644
index 3c718bcb4..000000000
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/authn/remoteuser-authn-config.xml
+++ /dev/null
@@ -1,61 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <!-- Most settings are controlled with authn.properties -->
-
- <!--
- The idp.authn.RemoteUser.externalAuthnPath property controls the default location to use.
- For advanced cases, define a bean called "shibboleth.authn.RemoteUser.externalAuthnPathStrategy"
- of type Function<ProfileRequestContext,String> that returns the path to use.
- -->
-
- <!--
- Define entries here to map error messages returned by external modules and classify them as particular
- kinds of errors for use in your templates and as events in flows.
-
- Keys are events to signal, values are error codes.
-
- The examples here just allow external signaling of an exact condition.
-
- If you want to "fall-through" to other login flows, include a mapping to "ReselectFlow".
- -->
- <util:map id="shibboleth.authn.RemoteUser.ClassifiedMessageMap">
- <entry key="ReselectFlow">
- <list>
- <value>NoCredentials</value>
- </list>
- </entry>
- <entry key="UnknownUsername">
- <list>
- <value>UnknownUsername</value>
- </list>
- </entry>
- <entry key="InvalidCredentials">
- <list>
- <value>InvalidCredentials</value>
- </list>
- </entry>
- <entry key="ExpiredPassword">
- <list>
- <value>ExpiredPassword</value>
- </list>
- </entry>
- <entry key="ExpiringPassword">
- <list>
- <value>ExpiringPassword</value>
- </list>
- </entry>
- </util:map>
-
-</beans>
diff --git a/idp-conf/src/test/resources/conf/authn/remoteuser-authn-config.xml b/idp-conf/src/test/resources/conf/authn/remoteuser-authn-config.xml
deleted file mode 100644
index 3c718bcb4..000000000
--- a/idp-conf/src/test/resources/conf/authn/remoteuser-authn-config.xml
+++ /dev/null
@@ -1,61 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <!-- Most settings are controlled with authn.properties -->
-
- <!--
- The idp.authn.RemoteUser.externalAuthnPath property controls the default location to use.
- For advanced cases, define a bean called "shibboleth.authn.RemoteUser.externalAuthnPathStrategy"
- of type Function<ProfileRequestContext,String> that returns the path to use.
- -->
-
- <!--
- Define entries here to map error messages returned by external modules and classify them as particular
- kinds of errors for use in your templates and as events in flows.
-
- Keys are events to signal, values are error codes.
-
- The examples here just allow external signaling of an exact condition.
-
- If you want to "fall-through" to other login flows, include a mapping to "ReselectFlow".
- -->
- <util:map id="shibboleth.authn.RemoteUser.ClassifiedMessageMap">
- <entry key="ReselectFlow">
- <list>
- <value>NoCredentials</value>
- </list>
- </entry>
- <entry key="UnknownUsername">
- <list>
- <value>UnknownUsername</value>
- </list>
- </entry>
- <entry key="InvalidCredentials">
- <list>
- <value>InvalidCredentials</value>
- </list>
- </entry>
- <entry key="ExpiredPassword">
- <list>
- <value>ExpiredPassword</value>
- </list>
- </entry>
- <entry key="ExpiringPassword">
- <list>
- <value>ExpiringPassword</value>
- </list>
- </entry>
- </util:map>
-
-</beans>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list