[java-plugin-shibd-saml] branch main updated: Bug fixes and adjustments.
Scott Cantor
cantor.2 at osu.edu
Wed Oct 2 19:42:47 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-saml.git;a=commit;h=2fd141b6ee4ac081a7a0f6849c51ce18e7269850
The following commit(s) were added to refs/heads/main by this push:
new 2fd141b Bug fixes and adjustments.
2fd141b is described below
commit 2fd141b6ee4ac081a7a0f6849c51ce18e7269850
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Oct 2 15:42:45 2024 -0400
Bug fixes and adjustments.
---
.../sp/consumer/saml2/artifact/artifact-beans.xml | 1 +
.../post-simplesign/post-simplesign-beans.xml | 1 +
.../flows/sp/consumer/saml2/post/post-beans.xml | 1 +
.../idp/flows/sp/consumer/saml2/saml2-beans.xml | 7 ++-
.../idp/flows/sp/consumer/saml2/saml2-flow.xml | 28 +++++++-----
.../sp/saml2-abstract/saml2-abstract-flow.xml | 33 --------------
...2-abstract-beans.xml => saml2-common-beans.xml} | 0
.../flows/saml2/SAML2TokenConsumerFlowTest.java | 3 +-
sp-saml-impl/pom.xml | 12 ++---
.../saml2/profile/impl/ValidateAssertions.java | 51 ++++++++++++++++++++++
10 files changed, 85 insertions(+), 52 deletions(-)
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/artifact/artifact-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/artifact/artifact-beans.xml
index c9fa203..e32dbf6 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/artifact/artifact-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/artifact/artifact-beans.xml
@@ -11,6 +11,7 @@
p:messageType="org.opensaml.saml.saml2.core.Response">
<constructor-arg>
<bean class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPArtifactDecoder" scope="prototype"
+ p:checkDuringInit="false"
p:parserPool-ref="shibboleth.ParserPool"
p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier"
p:bindingDescriptor-ref="shibboleth.Binding.SAML2Artifact"
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post-simplesign/post-simplesign-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post-simplesign/post-simplesign-beans.xml
index 0f354ee..dc6b2fb 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post-simplesign/post-simplesign-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post-simplesign/post-simplesign-beans.xml
@@ -11,6 +11,7 @@
p:messageType="org.opensaml.saml.saml2.core.Response">
<constructor-arg>
<bean class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostSimpleSignDecoder" scope="prototype"
+ p:checkDuringInit="false"
p:parserPool-ref="shibboleth.ParserPool"
p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier"
p:bindingDescriptor-ref="shibboleth.Binding.SAML2POSTSimpleSign" />
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post/post-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post/post-beans.xml
index 2e97960..1f06fd8 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post/post-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/post/post-beans.xml
@@ -11,6 +11,7 @@
p:messageType="org.opensaml.saml.saml2.core.Response">
<constructor-arg>
<bean class="org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder" scope="prototype"
+ p:checkDuringInit="false"
p:parserPool-ref="shibboleth.ParserPool"
p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier"
p:bindingDescriptor-ref="shibboleth.Binding.SAML2POST" />
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
index f1b0f51..fc243ad 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
@@ -7,6 +7,9 @@
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
default-init-method="initialize" default-destroy-method="destroy">
+ <!-- These MAY end up reused for logout, etc. -->
+ <import resource="classpath:/META-INF/net/shibboleth/idp/flows/sp/saml2-common-beans.xml" />
+
<bean id="InboundEntityIDLookup" parent="shibboleth.Functions.Compose">
<constructor-arg name="g">
<bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLEntityIDFunction" />
@@ -31,6 +34,7 @@
<list>
<!-- <bean class="org.opensaml.saml.common.binding.security.impl.InResponseToSecurityHandler" scope="prototype" />-->
<bean class="org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler" scope="prototype"
+ p:checkDuringInit="false"
p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier" />
<bean class="org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler" scope="prototype"
p:replayCache-ref="shibboleth.ReplayCache"
@@ -41,6 +45,7 @@
<bean class="org.opensaml.saml.common.binding.impl.CheckMessageStatusHandler" scope="prototype" />
<bean class="org.opensaml.saml.common.binding.security.impl.SAMLProtocolMessageXMLSignatureSecurityHandler" scope="prototype" />
<bean class="org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPPostSimpleSignSecurityHandler" scope="prototype"
+ p:checkDuringInit="false"
p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier"
p:parser-ref="shibboleth.ParserPool"
p:keyInfoResolver-ref="shibboleth.KeyInfoCredentialResolver" />
@@ -133,7 +138,7 @@
</bean>
<bean id="ValidateAssertions"
- class="org.opensaml.saml.saml2.profile.impl.ValidateAssertions" scope="prototype"
+ class="net.shibboleth.sp.saml.saml2.profile.impl.ValidateAssertions" scope="prototype"
p:invalidFatal="false"
p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier"
p:validationContextBuilder-ref="AssertionValidationContextBuilder"
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
index df00ef7..7eba489 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
@@ -1,19 +1,25 @@
<flow xmlns="http://www.springframework.org/schema/webflow"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
- abstract="true" parent="sp/consumer, sp/saml2-abstract">
+ abstract="true" parent="sp/consumer">
- <!-- Need a dummy state to prepend to parent flow to pass control to it. -->
- <action-state id="InitialState">
-<!-- <evaluate expression="FlowStartPopulateAuditContext" />-->
- <evaluate expression="'proceed'" />
-
- <!-- Transitions to preamble implemented by abstract parent flow. -->
- <transition on="proceed" to="DecodeMessage" />
- </action-state>
-
- <!-- Picks work back up from abstract parent flow. -->
<action-state id="DoProfileWork">
+<!-- <evaluate expression="PopulateMetricContext" />-->
+ <evaluate expression="DecodeMessage" />
+<!-- <evaluate expression="PostDecodePopulateAuditContext" />-->
+
+ <evaluate expression="CheckMessageVersion" />
+ <evaluate expression="SAMLProtocolAndRole" />
+ <evaluate expression="SAMLMetadataLookup" />
+
+ <evaluate expression="InitializeRelyingPartyContextFromSAMLPeer" />
+ <evaluate expression="SelectRelyingPartyConfiguration" />
+<!-- <evaluate expression="PostLookupPopulateAuditContext" />-->
+ <evaluate expression="SelectProfileConfiguration" />
+
+ <evaluate expression="PopulateSignatureValidationParameters" />
+ <evaluate expression="PopulateClientTLSValidationParameters" />
+
<evaluate expression="HandleResponse" />
<evaluate expression="PopulateDecryptionParameters" />
<evaluate expression="DecryptAssertions" />
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/saml2-abstract/saml2-abstract-flow.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/saml2-abstract/saml2-abstract-flow.xml
deleted file mode 100644
index 62502bf..0000000
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/saml2-abstract/saml2-abstract-flow.xml
+++ /dev/null
@@ -1,33 +0,0 @@
-<flow xmlns="http://www.springframework.org/schema/webflow"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
- abstract="true">
-
- <action-state id="DecodeMessage">
-<!-- <evaluate expression="PopulateMetricContext" />-->
- <evaluate expression="DecodeMessage" />
-<!-- <evaluate expression="PostDecodePopulateAuditContext" />-->
-
- <evaluate expression="CheckMessageVersion" />
- <evaluate expression="SAMLProtocolAndRole" />
- <evaluate expression="SAMLMetadataLookup" />
-
- <evaluate expression="InitializeRelyingPartyContextFromSAMLPeer" />
- <evaluate expression="SelectRelyingPartyConfiguration" />
-
-<!-- <evaluate expression="PostLookupPopulateAuditContext" />-->
-
- <evaluate expression="SelectProfileConfiguration" />
-
- <evaluate expression="PopulateSignatureValidationParameters" />
- <evaluate expression="PopulateClientTLSValidationParameters" />
-
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="DoProfileWork" />
- </action-state>
-
- <!-- The file really exists in this directory, but it's referenced from extending flow-directories -->
- <bean-import resource="classpath:/META-INF/net/shibboleth/idp/flows/sp/saml2-abstract/saml2-abstract-beans.xml" />
-
-</flow>
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/saml2-abstract/saml2-abstract-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/saml2-common-beans.xml
similarity index 100%
rename from sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/saml2-abstract/saml2-abstract-beans.xml
rename to sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/saml2-common-beans.xml
diff --git a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java
index e581a51..97add80 100644
--- a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java
+++ b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java
@@ -41,6 +41,7 @@ import org.testng.annotations.BeforeClass;
import org.testng.annotations.Test;
import net.shibboleth.idp.authn.AuthnEventIds;
+import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.shared.codec.Base64Support;
import net.shibboleth.shared.codec.EncodingException;
import net.shibboleth.shared.collection.CollectionSupport;
@@ -136,7 +137,7 @@ public class SAML2TokenConsumerFlowTest extends AbstractSPFlowTest {
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertFlowExecutionResult(result, FLOW_ID);
assertFlowExecutionOutcome(result.getOutcome());
- assertOutputMessageEvent(result, EventIds.INVALID_MESSAGE);
+ assertOutputMessageEvent(result, IdPEventIds.INVALID_PROFILE_CONFIG);
}
/**
diff --git a/sp-saml-impl/pom.xml b/sp-saml-impl/pom.xml
index 1e3c31b..b908724 100644
--- a/sp-saml-impl/pom.xml
+++ b/sp-saml-impl/pom.xml
@@ -83,6 +83,12 @@
<artifactId>opensaml-saml-api</artifactId>
<scope>provided</scope>
</dependency>
+
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-saml-impl</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>jakarta.servlet</groupId>
@@ -129,12 +135,6 @@
<scope>test</scope>
</dependency>
- <dependency>
- <groupId>${opensaml.groupId}</groupId>
- <artifactId>opensaml-saml-impl</artifactId>
- <scope>test</scope>
- </dependency>
-
<dependency>
<groupId>${opensaml.groupId}</groupId>
<artifactId>opensaml-testing</artifactId>
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/ValidateAssertions.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/ValidateAssertions.java
new file mode 100644
index 0000000..de60155
--- /dev/null
+++ b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/ValidateAssertions.java
@@ -0,0 +1,51 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.saml.saml2.profile.impl;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.sp.context.AgentRequestContext;
+import net.shibboleth.sp.messaging.RemotedHttpServletRequestResponseContext;
+
+/**
+ * Subclass of base class action that encapsulates the execution step with the thread-local
+ * remoted servlet request and response.
+ */
+public class ValidateAssertions extends org.opensaml.saml.saml2.profile.impl.ValidateAssertions {
+
+ /** Constructor. */
+ public ValidateAssertions() {
+ // Override init-time check for servlet request.
+ setCheckDuringInit(false);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ final AgentRequestContext agentRequestContext =
+ profileRequestContext.ensureSubcontext(AgentRequestContext.class);
+
+ try {
+ RemotedHttpServletRequestResponseContext.loadCurrent(agentRequestContext.getRemotedHttpServletRequest(),
+ agentRequestContext.getRemotedHttpServletResponse());
+ super.doExecute(profileRequestContext);
+ } finally {
+ RemotedHttpServletRequestResponseContext.clearCurrent();
+ }
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list