[java-plugin-shibd] branch main updated: Implement authentication method switch, and allow bypass for localhost.
Scott Cantor
cantor.2 at osu.edu
Wed Jun 12 17:42:54 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=ffd06ff7aa0e2294020ebc6133ada52b350e21e1
The following commit(s) were added to refs/heads/main by this push:
new ffd06ff Implement authentication method switch, and allow bypass for localhost.
ffd06ff is described below
commit ffd06ff7aa0e2294020ebc6133ada52b350e21e1
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jun 12 13:42:51 2024 -0400
Implement authentication method switch, and allow bypass for localhost.
---
.../idp/flows/sp/abstract/sp-abstract-flow.xml | 8 ++++++-
.../shibboleth/idp/module/conf/sp/sp.properties | 4 ++--
.../net/shibboleth/sp/conf/agents-system.xml | 1 +
.../src/main/java/net/shibboleth/sp/Agent.java | 14 ++++++++++++
.../authn/impl/ValidateCachedAuthentication.java | 4 +++-
.../java/net/shibboleth/sp/impl/BasicAgent.java | 25 ++++++++++++++++++++++
6 files changed, 52 insertions(+), 4 deletions(-)
diff --git a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-flow.xml b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-flow.xml
index 6e28b7a..25c945a 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-flow.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-flow.xml
@@ -14,9 +14,15 @@
<evaluate expression="ValidateAgentAddress" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="DoCachedAuthentication" />
+ <transition on="proceed" to="CheckAuthenticationType" />
</action-state>
+ <decision-state id="CheckAuthenticationType">
+ <if test="opensamlProfileRequestContext.ensureSubcontext(T(net.shibboleth.sp.context.AgentRequestContext)).getAgent().getAuthenticationMethod() == null"
+ then="DecodeAgentRequest"
+ else="DoCachedAuthentication" />
+ </decision-state>
+
<action-state id="DoCachedAuthentication">
<evaluate expression="ValidateCachedAuthentication" />
<!-- Inverting the usual approach, proceed means "not cached" so proceed to full validation. -->
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
index 01b5d15..754db63 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
@@ -21,8 +21,8 @@ sp.encryption.cert = %{idp.home}/credentials/sp/sp-encryption.crt
#sp.encryption.key.2 = %{idp.home}/credentials/sp/sp-encryption-old.key
#sp.encryption.cert.2 = %{idp.home}/credentials/sp/sp-encryption-old.crt
-# Set to Basic to require shared secret authentication
-#sp.agent.authn.method = None
+# Set to empty value to skip shared secret authentication
+#sp.agent.authn.method = basic
# Set false to globally disable cookie-based authentication by agents
#sp.agent.authn.cached = true
#sp.agent.authn.cacheDuration = PT1H
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
index 35314b8..2954c1b 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
@@ -21,6 +21,7 @@
<!-- Parent beans for Agents and Applications. -->
<bean id="shibboleth.Agent" class="net.shibboleth.sp.impl.BasicAgent" abstract="true"
+ p:authenticationMethod="%{sp.agent.authn.method:basic}"
p:allowedAddressRanges="#{{ '127.0.0.1/32', '::1/128' }}"
p:supportsCachedAuthentication="%{sp.agent.authn.cached:true}" />
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/Agent.java b/sp-server-api/src/main/java/net/shibboleth/sp/Agent.java
index d9f71ff..df24a71 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/Agent.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/Agent.java
@@ -39,6 +39,9 @@ import net.shibboleth.shared.net.IPRange;
@ThreadSafe
public interface Agent extends IdentifiedComponent {
+ /** Method constant for "basic". */
+ @Nonnull @NotEmpty static String AUTH_METHOD_BASIC = "basic";
+
/**
* Get the network addresses or ranges of addresses from which requests from this agent may
* originate.
@@ -47,6 +50,17 @@ public interface Agent extends IdentifiedComponent {
*/
@Nonnull Set<IPRange> getAllowedAddressRanges();
+ /**
+ * Get the authentication method to use for the agent.
+ *
+ * <p>Authentication methods are in addition to address restrictions.</p>
+ *
+ * <p>The only currently defined value is {@link #AUTH_METHOD_BASIC}.</p>
+ *
+ * @return authentication method/type, null for none
+ */
+ @Nullable @NotEmpty String getAuthenticationMethod();
+
/**
* Get the shared secrets configured directly on this agent.
*
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateCachedAuthentication.java b/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateCachedAuthentication.java
index 30c1f16..c37baa1 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateCachedAuthentication.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateCachedAuthentication.java
@@ -32,6 +32,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.servlet.HttpServletSupport;
import net.shibboleth.sp.Agent;
import net.shibboleth.sp.context.AgentRequestContext;
@@ -120,7 +121,8 @@ public class ValidateCachedAuthentication extends AbstractProfileAction {
final Object attr = session.getAttribute(AGENT_SESSION_ATTRIBUTE);
if (attr instanceof CachedAgentAuthentication cached) {
assert request != null;
- if (cached.agentId().equals(agent.getId()) && cached.address().equals(request.getRemoteAddr()) &&
+ if (cached.agentId().equals(agent.getId()) &&
+ cached.address().equals(HttpServletSupport.getRemoteAddr(request)) &&
cached.expiration().isAfter(Instant.now())) {
log.info("{} Accepted cached authentication session from agent '{}'", getLogPrefix(), agent.getId());
ActionSupport.buildEvent(profileRequestContext, BYPASS_AUTHENTICATION);
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicAgent.java b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicAgent.java
index fc72d5f..5803228 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicAgent.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicAgent.java
@@ -37,6 +37,7 @@ import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.net.IPRange;
+import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.sp.Agent;
import net.shibboleth.sp.Application;
@@ -50,6 +51,9 @@ public class BasicAgent extends DefaultRelyingPartyConfigurationResolver impleme
/** Allowed address ranges. */
@Nonnull private Set<IPRange> allowedAddressRanges;
+
+ /** Authentication method. */
+ @Nullable @NotEmpty String authenticationMethod;
/** Internally configured shared secrets. */
@Nonnull private Set<String> sharedSecrets;
@@ -64,6 +68,7 @@ public class BasicAgent extends DefaultRelyingPartyConfigurationResolver impleme
public BasicAgent() {
supportsCachedAuthentication = true;
allowedAddressRanges = CollectionSupport.emptySet();
+ authenticationMethod = AUTH_METHOD_BASIC;
sharedSecrets = CollectionSupport.emptySet();
applicationMap = CollectionSupport.emptyMap();
issuerLookupStrategy = FunctionSupport.constant(null);
@@ -92,6 +97,26 @@ public class BasicAgent extends DefaultRelyingPartyConfigurationResolver impleme
return allowedAddressRanges.stream().anyMatch(r -> r.contains(address));
}
+ /** {@inheritDoc} */
+ @Nullable @NotEmpty public String getAuthenticationMethod() {
+ return authenticationMethod;
+ }
+
+ /**
+ * Set the authentication method to require for this agent.
+ *
+ * <p>Defaults to {@link #AUTH_METHOD_BASIC}.</p>
+ *
+ * @param method method identifier
+ */
+ public void setAuthenticationMethod(@Nullable @NotEmpty final String method) {
+ checkSetterPreconditions();
+
+ final String trimmed = StringSupport.trimOrNull(method);
+ Constraint.isTrue(trimmed == null || AUTH_METHOD_BASIC.equals(trimmed), "Unsupported authentication method");
+ authenticationMethod = trimmed;
+ }
+
/** {@inheritDoc} */
@Nonnull public Set<String> getSharedSecrets() {
return sharedSecrets;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list