[java-identity-provider] branch main updated: IDP-2187 - Authn-related beans defined in global.xml not always honored
Scott Cantor
cantor.2 at osu.edu
Thu Oct 19 17:32:11 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=2f9f062f17485089443fa7418e07d326c6332f94
The following commit(s) were added to refs/heads/main by this push:
new 2f9f062f1 IDP-2187 - Authn-related beans defined in global.xml not always honored
2f9f062f1 is described below
commit 2f9f062f17485089443fa7418e07d326c6332f94
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Oct 19 13:32:08 2023 -0400
IDP-2187 - Authn-related beans defined in global.xml not always honored
https://shibboleth.atlassian.net/browse/IDP-2187
---
.../resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml | 2 +-
.../resources/net/shibboleth/idp/flows/authn/external-authn-flow.xml | 2 +-
.../net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml | 2 +-
.../resources/net/shibboleth/idp/flows/authn/remoteuser-authn-flow.xml | 2 +-
.../main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml | 3 ++-
.../main/resources/net/shibboleth/idp/flows/authn/saml-authn-flow.xml | 2 +-
.../resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml | 2 +-
.../resources/net/shibboleth/idp/flows/authn/spnego-authn-flow.xml | 2 +-
.../main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml | 3 ++-
.../main/resources/net/shibboleth/idp/flows/authn/x509-authn-flow.xml | 2 +-
10 files changed, 12 insertions(+), 10 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml
index 471e05530..7b07647a1 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-beans.xml
@@ -13,7 +13,7 @@
default-destroy-method="destroy">
<!-- Default strategy function to obtain the external path. -->
- <bean id="shibboleth.authn.External.externalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
+ <bean id="DefaultExternalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
c:target="#{getObject('shibboleth.authn.External.externalAuthnPath') ?: '%{idp.authn.External.externalAuthnPath:contextRelative:external.jsp}'.trim()}" />
<import resource="conditional:%{idp.home}/conf/authn/external-authn-config.xml" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-flow.xml
index 9c8346fb8..a89fa2965 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/external-authn-flow.xml
@@ -15,7 +15,7 @@
<transition on="proceed" to="DoDiscovery" />
</action-state>
- <view-state id="PostDiscovery" view="externalRedirect:#{T(net.shibboleth.idp.authn.ExternalAuthentication).getExternalRedirect(flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.External.externalAuthnPathStrategy').apply(opensamlProfileRequestContext), flowExecutionContext.getKey().toString())}">
+ <view-state id="PostDiscovery" view="externalRedirect:#{T(net.shibboleth.idp.authn.ExternalAuthentication).getExternalRedirect((flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.authn.External.externalAuthnPathStrategy') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.External.externalAuthnPathStrategy') : flowRequestContext.getActiveFlow().getApplicationContext().getBean('DefaultExternalAuthnPathStrategy')).app [...]
<attribute name="csrf_excluded" value="true" type="boolean"/>
<on-render>
<evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).addSubcontext(new net.shibboleth.idp.authn.context.ExternalAuthenticationContext(new net.shibboleth.idp.authn.impl.ExternalAuthenticationImpl(calledAsExtendedFlow?:false)), true).setFlowExecutionUrl(flowExecutionUrl + '&_eventId_proceed=1')" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml
index badfad1a4..807eb9c49 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-beans.xml
@@ -13,7 +13,7 @@
default-destroy-method="destroy">
<!-- Default strategy function to obtain the external path. -->
- <bean id="shibboleth.authn.RemoteUser.externalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
+ <bean id="DefaultExternalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
c:target="#{getObject('shibboleth.authn.RemoteUser.externalAuthnPath') ?: '%{idp.authn.RemoteUser.externalAuthnPath:contextRelative:/Authn/RemoteUser}'.trim()}" />
<!-- Legacy compatibility. -->
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-flow.xml
index 4ce75ebcc..d93e769d6 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/remoteuser-authn-flow.xml
@@ -15,7 +15,7 @@
<transition on="proceed" to="DoDiscovery" />
</action-state>
- <view-state id="PostDiscovery" view="externalRedirect:#{T(net.shibboleth.idp.authn.ExternalAuthentication).getExternalRedirect(flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.RemoteUser.externalAuthnPathStrategy').apply(opensamlProfileRequestContext), flowExecutionContext.getKey().toString())}">
+ <view-state id="PostDiscovery" view="externalRedirect:#{T(net.shibboleth.idp.authn.ExternalAuthentication).getExternalRedirect((flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.authn.RemoteUser.externalAuthnPathStrategy') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.RemoteUser.externalAuthnPathStrategy') : flowRequestContext.getActiveFlow().getApplicationContext().getBean('DefaultExternalAuthnPathStrategy')) [...]
<attribute name="csrf_excluded" value="true" type="boolean"/>
<on-render>
<evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).addSubcontext(new net.shibboleth.idp.authn.context.ExternalAuthenticationContext(new net.shibboleth.idp.authn.impl.ExternalAuthenticationImpl(calledAsExtendedFlow?:false)), true).setFlowExecutionUrl(flowExecutionUrl + '&_eventId_proceed=1')" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
index bf78628bf..277e3e92b 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
@@ -15,9 +15,10 @@
<bean id="PropertyDrivenDiscovery" parent="shibboleth.Functions.Constant"
c:target="#{'%{idp.authn.SAML.proxyEntityID:}'.trim()}" />
- <bean id="shibboleth.authn.SAML.externalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
+ <bean id="DefaultExternalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
c:target="#{getObject('shibboleth.authn.SAML.externalAuthnPath') ?: 'servletRelative:%{idp.authn.SAML.externalAuthnPath:/Authn/SAML2/POST/SSO}'.trim()}" />
+ <!-- Legacy compatibility. -->
<import resource="conditional:%{idp.home}/conf/authn/saml-authn-config.xml" />
<!-- Parent beans for indirecting into nested PRC. -->
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-flow.xml
index c62159315..0ce275fe8 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-flow.xml
@@ -45,7 +45,7 @@
<transition on="proceed" to="EncodeSAMLRequest" />
</action-state>
- <view-state id="EncodeSAMLRequest" view="externalRedirect:#{T(net.shibboleth.idp.authn.ExternalAuthentication).getExternalRedirect(flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.SAML.externalAuthnPathStrategy').apply(opensamlProfileRequestContext) + '/start', flowExecutionContext.getKey().toString())}">
+ <view-state id="EncodeSAMLRequest" view="externalRedirect:#{T(net.shibboleth.idp.authn.ExternalAuthentication).getExternalRedirect((flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.authn.SAML.externalAuthnPathStrategy') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.SAML.externalAuthnPathStrategy') : flowRequestContext.getActiveFlow().getApplicationContext().getBean('DefaultExternalAuthnPathStrategy') ).apply( [...]
<attribute name="csrf_excluded" value="true" type="boolean"/>
<on-render>
<evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).addSubcontext(new net.shibboleth.idp.authn.context.ExternalAuthenticationContext(new net.shibboleth.idp.authn.impl.ExternalAuthenticationImpl(false)), true).setFlowExecutionUrl(flowExecutionUrl + '&_eventId_proceed=1')" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml
index dfed5d630..c6d9e6273 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-beans.xml
@@ -19,7 +19,7 @@
c:_0="servletRelative:%{idp.authn.SPNEGO.externalAuthnPath:%{idp.authn.spnego.externalAuthnPath:/Authn/SPNEGO}}" />
<!-- Default strategy function to obtain the external path. -->
- <bean id="shibboleth.authn.SPNEGO.externalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
+ <bean id="DefaultExternalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
c:target-ref="shibboleth.authn.SPNEGO.externalAuthnPath" />
<!-- Legacy approach to this setting, needed to allow override and aliasing below. -->
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-flow.xml
index f636d402a..a5a7b54c1 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/spnego-authn-flow.xml
@@ -51,7 +51,7 @@
<transition to="RunSPNEGO" />
</action-state>
- <view-state id="RunSPNEGO" view="externalRedirect:#{flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.SPNEGO.externalAuthnPathStrategy').apply(opensamlProfileRequestContext)}/#{flowExecutionContext.getKey().toString()}?conversation=#{flowExecutionContext.getKey().toString()}">
+ <view-state id="RunSPNEGO" view="externalRedirect:#{(flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.authn.SPNEGO.externalAuthnPathStrategy') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.SPNEGO.externalAuthnPathStrategy') : flowRequestContext.getActiveFlow().getApplicationContext().getBean('DefaultExternalAuthnPathStrategy')).apply(opensamlProfileRequestContext)}/#{flowExecutionContext.getKey().toString()}? [...]
<attribute name="csrf_excluded" value="true" type="boolean"/>
<on-render>
<evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).addSubcontext(new net.shibboleth.idp.authn.spnego.impl.SPNEGOContext(), true).setKerberosSettings(flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.SPNEGO.Krb5.Settings'))" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml
index 16d8f6848..b901c8917 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-beans.xml
@@ -13,9 +13,10 @@
default-destroy-method="destroy">
<!-- Default strategy function to obtain the external path. -->
- <bean id="shibboleth.authn.X509.externalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
+ <bean id="DefaultExternalAuthnPathStrategy" parent="shibboleth.Functions.Constant"
c:target="#{getObject('shibboleth.authn.X509.externalAuthnPath') ?: '%{idp.authn.X509.externalAuthnPath:contextRelative:x509-prompt.jsp}'.trim()}" />
+ <!-- Legacy compatibility. -->
<import resource="conditional:%{idp.home}/conf/authn/x509-authn-config.xml" />
<bean id="DefaultCleanupHook" class="net.shibboleth.idp.authn.impl.ValidateExternalAuthentication.CertificateCleanupHook" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-flow.xml
index a5d00c3f8..3e690f9c2 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/x509-authn-flow.xml
@@ -8,7 +8,7 @@
implemented via external authentication.
-->
- <view-state id="ExternalTransfer" view="externalRedirect:#{T(net.shibboleth.idp.authn.ExternalAuthentication).getExternalRedirect(flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.X509.externalAuthnPathStrategy').apply(opensamlProfileRequestContext), flowExecutionContext.getKey().toString())}">
+ <view-state id="ExternalTransfer" view="externalRedirect:#{T(net.shibboleth.idp.authn.ExternalAuthentication).getExternalRedirect((flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.authn.X509.externalAuthnPathStrategy') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.X509.externalAuthnPathStrategy') : flowRequestContext.getActiveFlow().getApplicationContext().getBean('DefaultExternalAuthnPathStrategy')).apply(op [...]
<attribute name="csrf_excluded" value="true" type="boolean"/>
<on-render>
<evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).addSubcontext(new net.shibboleth.idp.authn.context.ExternalAuthenticationContext(new net.shibboleth.idp.authn.impl.ExternalAuthenticationImpl(calledAsExtendedFlow?:false)), true).setFlowExecutionUrl(flowExecutionUrl + '&_eventId_proceed=1')" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list