[java-plugin-shibd] branch main updated: Redo implementation of authentication caching on the back-end.
Scott Cantor
cantor.2 at osu.edu
Thu Jun 6 19:51:16 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=5b345b4162ca00e653fdf4460cfd04449afd5ca4
The following commit(s) were added to refs/heads/main by this push:
new 5b345b4 Redo implementation of authentication caching on the back-end.
5b345b4 is described below
commit 5b345b4162ca00e653fdf4460cfd04449afd5ca4
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jun 6 15:51:09 2024 -0400
Redo implementation of authentication caching on the back-end.
---
.../idp/flows/sp/abstract/sp-abstract-beans.xml | 6 +-
.../shibboleth/idp/module/conf/sp/sp.properties | 3 +-
.../sp/authn/impl/ValidateAgentCredentials.java | 71 ++++++----------------
.../authn/impl/ValidateCachedAuthentication.java | 1 +
4 files changed, 23 insertions(+), 58 deletions(-)
diff --git a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml
index e4e9add..2940a52 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml
@@ -25,8 +25,8 @@
</bean>
<bean id="ExtractUsernamePasswordFromBasicAuth"
- class="net.shibboleth.idp.authn.impl.ExtractUsernamePasswordFromBasicAuth" scope="prototype"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
+ class="net.shibboleth.idp.authn.impl.ExtractUsernamePasswordFromBasicAuth" scope="prototype"
+ p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
<bean id="InitializeAgentRequestContext"
class="net.shibboleth.sp.authn.impl.InitializeAgentRequestContext" scope="prototype"
@@ -42,6 +42,8 @@
<bean id="ValidateAgentCredentials"
class="net.shibboleth.sp.authn.impl.ValidateAgentCredentials" scope="prototype"
+ p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
+ p:cacheDuration="%{sp.agent.authn.cacheDuration:PT1H}"
p:requireAll="%{sp.agent.authn.requireAll:false}"
p:validators="#{getObject('shibboleth.AgentValidators') ?: getObject('DefaultAgentValidators')}"
p:cleanupHook-ref="DefaultCleanupHook" />
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
index 20efc04..01b5d15 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
@@ -25,5 +25,4 @@ sp.encryption.cert = %{idp.home}/credentials/sp/sp-encryption.crt
#sp.agent.authn.method = None
# Set false to globally disable cookie-based authentication by agents
#sp.agent.authn.cached = true
-#sp.agent.authn.cached.cookieName = __Host-shibsp_agent_token
-#sp.agent.authn.cached.maxAge = 3600
+#sp.agent.authn.cacheDuration = PT1H
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateAgentCredentials.java b/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateAgentCredentials.java
index bb0d6f6..c6bc19b 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateAgentCredentials.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateAgentCredentials.java
@@ -14,30 +14,24 @@
package net.shibboleth.sp.authn.impl;
+import java.time.Duration;
import java.time.Instant;
import java.util.function.Function;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import javax.security.auth.Subject;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import com.google.common.net.UrlEscapers;
-
import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpSession;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.authn.impl.ValidateCredentials;
import net.shibboleth.idp.authn.principal.UsernamePrincipal;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.net.CookieManager;
import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.primitive.StringSupport;
-import net.shibboleth.shared.security.DataSealer;
-import net.shibboleth.shared.security.DataSealerException;
import net.shibboleth.shared.servlet.HttpServletSupport;
import net.shibboleth.sp.Agent;
import net.shibboleth.sp.context.AgentRequestContext;
@@ -57,18 +51,13 @@ public class ValidateAgentCredentials extends ValidateCredentials {
/** Lookup strategy for {@link AgentRequestContext}. */
@Nonnull private Function<ProfileRequestContext,AgentRequestContext> agentRequestContextLookupStrategy;
- /** Cookie name to use. */
- @Nullable private String cookieName;
-
- /** CookieManager to use. */
- @Nullable private CookieManager cookieManager;
-
- /** DataSealer to use. */
- @Nullable private DataSealer dataSealer;
-
+ /** Duration for cached authentication record. */
+ @Nonnull private Duration cacheDuration;
+
/** Constructor. */
public ValidateAgentCredentials() {
agentRequestContextLookupStrategy = new ChildContextLookup<>(AgentRequestContext.class);
+ cacheDuration = Duration.ofHours(1);
}
/**
@@ -83,38 +72,18 @@ public class ValidateAgentCredentials extends ValidateCredentials {
agentRequestContextLookupStrategy = Constraint.isNotNull(strategy,
"AgentRequestContext lookup strategy cannot be null");
}
-
- /**
- * Sets the cookie name to use for cached authentication.
- *
- * @param name cookie name
- */
- public void setCookieName(@Nullable @NotEmpty final String name) {
- checkSetterPreconditions();
-
- cookieName = StringSupport.trimOrNull(name);
- }
/**
- * Sets the {@link CookieManager} to use.
+ * Sets the duration for which authentication should be cached.
*
- * @param manager cookie manager
- */
- public void setCookieManager(@Nullable final CookieManager manager) {
- checkSetterPreconditions();
-
- cookieManager = manager;
- }
-
- /**
- * Sets the {@link DataSealer} to use.
+ * <p>Defaults to an hour.</p>
*
- * @param sealer data sealer
+ * @param duration cache duration
*/
- public void setDataSealer(@Nullable final DataSealer sealer) {
+ public void setCacheDuration(@Nonnull final Duration duration) {
checkSetterPreconditions();
- dataSealer = sealer;
+ cacheDuration = Constraint.isNotNull(duration, "Cache duration cannot be null");
}
/** {@inheritDoc} */
@@ -132,21 +101,15 @@ public class ValidateAgentCredentials extends ValidateCredentials {
}
assert agent != null;
- if (agent.isSupportsCachedAuthentication() && cookieName != null && cookieManager != null && dataSealer != null) {
+ if (agent.isSupportsCachedAuthentication()) {
final HttpServletRequest request = getHttpServletRequest();
+ final HttpSession session = request != null ? request.getSession(true) : null;
final String address = request != null ? HttpServletSupport.getRemoteAddr(request) : null;
- if (address != null) {
- final String plaintext = id + '!' + address;
- try {
- assert dataSealer != null;
- final String wrapped = dataSealer.wrap(plaintext, Instant.now().plusSeconds(cookieManager.getMaxAge()));
- assert cookieManager != null;
- cookieManager.addCookie(cookieName, UrlEscapers.urlFormParameterEscaper().escape(wrapped));
- } catch (final DataSealerException e) {
- log.error("{} Error encrypting data for cookie", getLogPrefix(), e);
- }
+ if (session != null && address != null) {
+ session.setAttribute(ValidateCachedAuthentication.AGENT_SESSION_ATTRIBUTE,
+ new CachedAgentAuthentication(id, address, Instant.now().plus(cacheDuration)));
} else {
- log.warn("{} No client address available, skipping cached authentication cookie creation", getLogPrefix());
+ log.warn("{} No session or client address available, skipping authentication caching", getLogPrefix());
}
}
}
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateCachedAuthentication.java b/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateCachedAuthentication.java
index f7adf35..30c1f16 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateCachedAuthentication.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateCachedAuthentication.java
@@ -127,6 +127,7 @@ public class ValidateCachedAuthentication extends AbstractProfileAction {
} else {
log.info("{} Rejected cached authentication session record from agent '{}': {}",
getLogPrefix(), agent.getId(), cached);
+ session.removeAttribute(AGENT_SESSION_ATTRIBUTE);
}
} else {
log.debug("{} No session record for request from agent '{}', full authentication will proceed",
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list