[java-plugin-shibd] branch main updated: Finalize agent authentication and clean up flow design.
Scott Cantor
cantor.2 at osu.edu
Thu May 23 18:28:52 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=031d271f42fdbcfc6a13cb43977d1aba142c75a1
The following commit(s) were added to refs/heads/main by this push:
new 031d271 Finalize agent authentication and clean up flow design.
031d271 is described below
commit 031d271f42fdbcfc6a13cb43977d1aba142c75a1
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu May 23 14:28:49 2024 -0400
Finalize agent authentication and clean up flow design.
---
.../idp/flows/sp/abstract/sp-abstract-beans.xml | 8 +-
.../idp/flows/sp/abstract/sp-abstract-flow.xml | 16 +--
.../shibboleth/sp/context/AgentRequestContext.java | 2 +-
sp-server-impl/pom.xml | 5 +
.../authn/impl/InitializeAgentRequestContext.java | 2 +
.../sp/authn/impl/ValidateAgentCredentials.java | 154 +++++++++++++++++++++
.../authn/impl/ValidateCachedAuthentication.java | 3 +-
7 files changed, 176 insertions(+), 14 deletions(-)
diff --git a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml
index c32e617..bf5d804 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-beans.xml
@@ -28,8 +28,8 @@
</bean>
<bean id="ExtractUsernamePasswordFromBasicAuth"
- class="net.shibboleth.idp.authn.impl.ExtractUsernamePasswordFromBasicAuth" scope="prototype"
- p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
+ class="net.shibboleth.idp.authn.impl.ExtractUsernamePasswordFromBasicAuth" scope="prototype"
+ p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
<bean id="InitializeAgentRequestContext"
class="net.shibboleth.sp.authn.impl.InitializeAgentRequestContext" scope="prototype"
@@ -53,8 +53,8 @@
p:cookiePath="/"
p:maxAge="%{sp.agent.authn.cached.maxAge:3600}" />
- <bean id="ValidateCredentials"
- class="net.shibboleth.idp.authn.impl.ValidateCredentials" scope="prototype"
+ <bean id="ValidateAgentCredentials"
+ class="net.shibboleth.so.authn.impl.ValidateAgentCredentials" scope="prototype"
p:requireAll="%{sp.agent.authn.requireAll:false}"
p:validators="#{getObject('shibboleth.AgentValidators') ?: getObject('DefaultAgentValidators')}"
p:cleanupHook-ref="DefaultCleanupHook" />
diff --git a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-flow.xml b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-flow.xml
index 298c66f..59f678b 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-flow.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/abstract/sp-abstract-flow.xml
@@ -18,19 +18,19 @@
<action-state id="DoCachedAuthentication">
<evaluate expression="ValidateCachedAuthentication" />
+ <!-- Inverting the usual approach, proceed means "not cached" so proceed to full validation. -->
+ <evaluate expression="ValidateAgentCredentials" />
<evaluate expression="'proceed'" />
- <!-- Inverting the usual approach, proceed means "not cached". -->
- <transition on="proceed" to="DoAuthentication" />
+ <transition on="proceed" to="DecodeMessage" />
<transition on="BypassAuthentication" to="DecodeMessage" />
</action-state>
-
- <action-state id="DoAuthentication">
- <evaluate expression="ValidateCredentials" />
- <evaluate expression="FinalizeAuthentication" />
+
+ <action-state id="DecodeMessage">
+ <evaluate expression="DecodeMessage" />
<evaluate expression="'proceed'" />
-
- <transition on="proceed" to="DecodeMessage" />
+
+ <transition on="proceed" to="TBD" />
</action-state>
<!-- Passthrough state if an exception is thrown. -->
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/context/AgentRequestContext.java b/sp-server-api/src/main/java/net/shibboleth/sp/context/AgentRequestContext.java
index 2b575b9..fefe176 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/context/AgentRequestContext.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/context/AgentRequestContext.java
@@ -32,7 +32,7 @@ public class AgentRequestContext extends BaseContext {
/** Application for which the request was made. */
@Nullable private Application application;
-
+
/**
* Get the agent making the request.
*
diff --git a/sp-server-impl/pom.xml b/sp-server-impl/pom.xml
index d9f0b83..01dc975 100644
--- a/sp-server-impl/pom.xml
+++ b/sp-server-impl/pom.xml
@@ -33,6 +33,11 @@
<artifactId>idp-authn-api</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>${idp.groupId}</groupId>
+ <artifactId>idp-authn-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>${idp.groupId}</groupId>
<artifactId>idp-profile-api</artifactId>
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/InitializeAgentRequestContext.java b/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/InitializeAgentRequestContext.java
index 03b2583..d30bfe7 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/InitializeAgentRequestContext.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/InitializeAgentRequestContext.java
@@ -119,6 +119,8 @@ public class InitializeAgentRequestContext extends AbstractAuthenticationAction
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
if (agentResolver == null) {
throw new ComponentInitializationException("AgentResolver service cannot be null");
}
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateAgentCredentials.java b/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateAgentCredentials.java
new file mode 100644
index 0000000..bb0d6f6
--- /dev/null
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateAgentCredentials.java
@@ -0,0 +1,154 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.authn.impl;
+
+import java.time.Instant;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import javax.security.auth.Subject;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+
+import com.google.common.net.UrlEscapers;
+
+import jakarta.servlet.http.HttpServletRequest;
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.authn.impl.ValidateCredentials;
+import net.shibboleth.idp.authn.principal.UsernamePrincipal;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.net.CookieManager;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
+import net.shibboleth.shared.security.DataSealer;
+import net.shibboleth.shared.security.DataSealerException;
+import net.shibboleth.shared.servlet.HttpServletSupport;
+import net.shibboleth.sp.Agent;
+import net.shibboleth.sp.context.AgentRequestContext;
+
+/**
+ * Subclass of validation action from IdP that sidesteps all the unneeded machinery outside of building
+ * the {@link Subject} and verifying the result.
+ *
+ * <p>If configured to do so, the encrypted cookie to cache the result of the authentication is also
+ * produced and set by this action if possible. Errors in this step are suppressed.</p>
+ */
+public class ValidateAgentCredentials extends ValidateCredentials {
+
+ /** Class logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(ValidateAgentCredentials.class);
+
+ /** Lookup strategy for {@link AgentRequestContext}. */
+ @Nonnull private Function<ProfileRequestContext,AgentRequestContext> agentRequestContextLookupStrategy;
+
+ /** Cookie name to use. */
+ @Nullable private String cookieName;
+
+ /** CookieManager to use. */
+ @Nullable private CookieManager cookieManager;
+
+ /** DataSealer to use. */
+ @Nullable private DataSealer dataSealer;
+
+ /** Constructor. */
+ public ValidateAgentCredentials() {
+ agentRequestContextLookupStrategy = new ChildContextLookup<>(AgentRequestContext.class);
+ }
+
+ /**
+ * Sets the lookup strategy for the {@link AgentRequestContext}.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setAgentRequestContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,AgentRequestContext> strategy) {
+ checkSetterPreconditions();
+
+ agentRequestContextLookupStrategy = Constraint.isNotNull(strategy,
+ "AgentRequestContext lookup strategy cannot be null");
+ }
+
+ /**
+ * Sets the cookie name to use for cached authentication.
+ *
+ * @param name cookie name
+ */
+ public void setCookieName(@Nullable @NotEmpty final String name) {
+ checkSetterPreconditions();
+
+ cookieName = StringSupport.trimOrNull(name);
+ }
+
+ /**
+ * Sets the {@link CookieManager} to use.
+ *
+ * @param manager cookie manager
+ */
+ public void setCookieManager(@Nullable final CookieManager manager) {
+ checkSetterPreconditions();
+
+ cookieManager = manager;
+ }
+
+ /**
+ * Sets the {@link DataSealer} to use.
+ *
+ * @param sealer data sealer
+ */
+ public void setDataSealer(@Nullable final DataSealer sealer) {
+ checkSetterPreconditions();
+
+ dataSealer = sealer;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void buildAuthenticationResult(@Nonnull ProfileRequestContext profileRequestContext,
+ @Nonnull AuthenticationContext authenticationContext) {
+
+ final Subject subject = populateSubject(getSubject());
+
+ final AgentRequestContext agentCtx = agentRequestContextLookupStrategy.apply(profileRequestContext);
+ final Agent agent = agentCtx != null ? agentCtx.getAgent() : null;
+ final String id = agent != null ? agent.getId() : null;
+ if (id == null || !subject.getPrincipals(UsernamePrincipal.class).contains(new UsernamePrincipal(id))) {
+ throw new IllegalStateException("Agent authentication result did not produce the expected results.");
+ }
+
+ assert agent != null;
+ if (agent.isSupportsCachedAuthentication() && cookieName != null && cookieManager != null && dataSealer != null) {
+ final HttpServletRequest request = getHttpServletRequest();
+ final String address = request != null ? HttpServletSupport.getRemoteAddr(request) : null;
+ if (address != null) {
+ final String plaintext = id + '!' + address;
+ try {
+ assert dataSealer != null;
+ final String wrapped = dataSealer.wrap(plaintext, Instant.now().plusSeconds(cookieManager.getMaxAge()));
+ assert cookieManager != null;
+ cookieManager.addCookie(cookieName, UrlEscapers.urlFormParameterEscaper().escape(wrapped));
+ } catch (final DataSealerException e) {
+ log.error("{} Error encrypting data for cookie", getLogPrefix(), e);
+ }
+ } else {
+ log.warn("{} No client address available, skipping cached authentication cookie creation", getLogPrefix());
+ }
+ }
+ }
+
+}
\ No newline at end of file
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateCachedAuthentication.java b/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateCachedAuthentication.java
index 90ce90e..e50e4d1 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateCachedAuthentication.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/authn/impl/ValidateCachedAuthentication.java
@@ -25,7 +25,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import jakarta.servlet.http.HttpServletRequest;
-import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
@@ -137,6 +136,8 @@ public class ValidateCachedAuthentication extends AbstractProfileAction {
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
if (cookieName == null || cookieManager == null || dataSealer == null) {
throw new ComponentInitializationException("CookieManager, DataSealer, and cookie name must be set");
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list