[java-plugin-shibd-saml] branch main updated: Add/adjust SAML property names, and work on successful test validation.
Scott Cantor
cantor.2 at osu.edu
Tue Oct 8 14:27:53 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-saml.git;a=commit;h=243e551e6ca6226fca29d06ac1cc81329b29dae8
The following commit(s) were added to refs/heads/main by this push:
new 243e551 Add/adjust SAML property names, and work on successful test validation.
243e551 is described below
commit 243e551e6ca6226fca29d06ac1cc81329b29dae8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Oct 8 10:27:50 2024 -0400
Add/adjust SAML property names, and work on successful test validation.
---
.../net/shibboleth/sp/service/agent/postconfig.xml | 27 ++++++++--------
.../idp/module/conf/sp/saml-credentials.xml | 12 ++++----
.../shibboleth/idp/module/conf/sp/saml.properties | 33 +++++++++++++++-----
.../flows/saml2/SAML2TokenConsumerFlowTest.java | 36 +++++++++++++++++++---
.../idp/module/conf/attribute-filter.xml | 26 ++++++++++++++++
.../idp/module/conf/attributes/nameid-testing.xml | 1 +
.../saml2/profile/impl/ValidateAssertions.java | 7 +++++
7 files changed, 110 insertions(+), 32 deletions(-)
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
index b1eb4c8..fc273c7 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
@@ -27,7 +27,8 @@
<bean id="SAML2.SSO" lazy-init="true"
class="net.shibboleth.sp.saml.saml2.profile.config.impl.BrowserSSOProfileConfiguration"
p:securityConfiguration-ref="shibboleth.DefaultXMLSecurityConfiguration"
- p:encryptionOptionalPredicate="%{sp.encryption.optional:false}" />
+ p:encryptionOptionalPredicate="%{sp.saml.encryption.optional:true}"
+ p:extractStandardAttributes="%{sp.saml.extractStandardAttributes:false}" />
<util:constant id="SAML2.SSO.FEATURE_AUTHNCONTEXT"
static-field="net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration.FEATURE_AUTHNCONTEXT"/>
@@ -44,16 +45,14 @@
<util:constant id="SAML2.SSO.FEATURE_FORCEAUTHN"
static-field="net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration.FEATURE_FORCEAUTHN"/>
- <bean id="SAML2.ECP" lazy-init="true"
- class="net.shibboleth.sp.saml.saml2.profile.config.impl.ECPProfileConfiguration"
- p:securityConfiguration-ref="shibboleth.DefaultXMLSecurityConfiguration"
- p:encryptionOptionalPredicate="%{sp.encryption.optional:false}" />
+ <bean id="SAML2.ECP" parent="SAML2.SSO" lazy-init="true"
+ class="net.shibboleth.sp.saml.saml2.profile.config.impl.ECPProfileConfiguration" />
<bean id="SAML2.Logout" lazy-init="true"
class="net.shibboleth.sp.saml.saml2.profile.config.impl.SingleLogoutProfileConfiguration"
p:securityConfiguration-ref="shibboleth.DefaultXMLSecurityConfiguration"
- p:encryptionOptionalPredicate="%{sp.encryption.optional:false}"
- p:asynchronous="%{sp.logout.asynchronous:true}" />
+ p:encryptionOptionalPredicate="%{sp.saml.encryption.optional:true}"
+ p:asynchronous="%{sp.saml.logout.asynchronous:true}" />
<!--
Security Configuration Defaults
@@ -64,27 +63,27 @@
<bean id="shibboleth.DefaultXMLSecurityConfiguration" class="org.opensaml.xmlsec.config.BasicXMLSecurityConfiguration">
<property name="signatureSigningConfiguration">
- <ref bean="#{'%{sp.signing.config:shibboleth.SigningConfiguration.SHA256}'.trim()}" />
+ <ref bean="#{'%{sp.saml.signing.config:shibboleth.SigningConfiguration.SHA256}'.trim()}" />
</property>
<property name="signatureValidationConfiguration">
<bean parent="shibboleth.BasicSignatureValidationConfiguration"
- p:signatureTrustEngine-ref="#{'%{sp.trust.signatures:shibboleth.ChainingSignatureTrustEngine}'.trim()}" />
+ p:signatureTrustEngine-ref="#{'%{sp.saml.trust.signatures:shibboleth.ChainingSignatureTrustEngine}'.trim()}" />
</property>
<property name="clientTLSValidationConfiguration">
<bean parent="shibboleth.BasicClientTLSValidationConfiguration"
- p:x509TrustEngine-ref="#{'%{sp.trust.certificates:shibboleth.ChainingX509TrustEngine}'.trim()}" />
+ p:x509TrustEngine-ref="#{'%{sp.saml.trust.certificates:shibboleth.ChainingX509TrustEngine}'.trim()}" />
</property>
<property name="httpClientSecurityConfiguration">
<bean parent="shibboleth.BasicHttpClientSecurityConfiguration"
p:clientTLSCredential="#{getObject('shibboleth.DefaultClientTLSCredential')}"
- p:TLSTrustEngine-ref="#{'%{sp.trust.httpClient.tls:shibboleth.ChainingX509TrustEngine}'.trim()}" />
+ p:TLSTrustEngine-ref="#{'%{sp.saml.trust.httpClient.tls:shibboleth.ChainingX509TrustEngine}'.trim()}" />
</property>
<property name="encryptionConfiguration">
- <ref bean="#{'%{sp.encryption.config:shibboleth.EncryptionConfiguration.CBC}'.trim()}" />
+ <ref bean="#{'%{sp.saml.encryption.config:shibboleth.EncryptionConfiguration.CBC}'.trim()}" />
</property>
<property name="decryptionConfiguration">
@@ -108,7 +107,7 @@
p:targetMethod="registerFactory">
<property name="arguments">
<list>
- <ref bean="%{sp.security.basicKeyInfoFactory:shibboleth.BasicKeyInfoGeneratorFactory}" />
+ <ref bean="%{sp.saml.security.basicKeyInfoFactory:shibboleth.BasicKeyInfoGeneratorFactory}" />
</list>
</property>
</bean>
@@ -117,7 +116,7 @@
p:targetMethod="registerFactory">
<property name="arguments">
<list>
- <ref bean="%{sp.security.x509KeyInfoFactory:shibboleth.X509KeyInfoGeneratorFactory}" />
+ <ref bean="%{sp.saml.security.x509KeyInfoFactory:shibboleth.X509KeyInfoGeneratorFactory}" />
</list>
</property>
</bean>
diff --git a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml-credentials.xml b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml-credentials.xml
index fb1f6e1..7f1daad 100644
--- a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml-credentials.xml
+++ b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml-credentials.xml
@@ -21,8 +21,8 @@
<!-- Your SP's default signing key, set via property file. -->
<bean id="shibboleth.DefaultSigningCredential" parent="shibboleth.BasicX509CredentialFactoryBean"
- p:privateKeyResource="%{sp.signing.key}"
- p:certificateResource="%{sp.signing.cert}" />
+ p:privateKeyResource="%{sp.saml.signing.key}"
+ p:certificateResource="%{sp.saml.signing.cert}" />
<!-- Your SPs default client TLS credential, by default the same as the default signing credential. -->
<alias alias="shibboleth.DefaultClientTLSCredential" name="shibboleth.DefaultSigningCredential" />
@@ -30,8 +30,8 @@
<!-- Your SP's default encryption (really decryption) keys, set via property file. -->
<util:list id="shibboleth.DefaultEncryptionCredentials">
<bean parent="shibboleth.BasicX509CredentialFactoryBean"
- p:privateKeyResource="%{sp.encryption.key}"
- p:certificateResource="%{sp.encryption.cert}" />
+ p:privateKeyResource="%{sp.saml.encryption.key}"
+ p:certificateResource="%{sp.saml.encryption.cert}" />
<!--
For key rollover, uncomment and point to your original keypair, and use the one above
@@ -39,8 +39,8 @@
-->
<!--
<bean parent="shibboleth.BasicX509CredentialFactoryBean"
- p:privateKeyResource="%{sp.encryption.key.2}"
- p:certificateResource="%{sp.encryption.cert.2}" />
+ p:privateKeyResource="%{sp.saml.encryption.key.2}"
+ p:certificateResource="%{sp.saml.encryption.cert.2}" />
-->
</util:list>
diff --git a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
index edfd267..1d75b95 100644
--- a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
+++ b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
@@ -3,12 +3,29 @@
# Settings for SP public/private signing and encryption key(s)
# During decryption key rollover, point the ".2" properties at a second
# keypair, uncomment in credentials.xml, then publish it in your metadata.
-sp.signing.key = %{idp.home}/credentials/sp/sp-signing.key
-sp.signing.cert = %{idp.home}/credentials/sp/sp-signing.crt
-sp.encryption.key = %{idp.home}/credentials/sp/sp-encryption.key
-sp.encryption.cert = %{idp.home}/credentials/sp/sp-encryption.crt
-#sp.encryption.key.2 = %{idp.home}/credentials/sp/sp-encryption-old.key
-#sp.encryption.cert.2 = %{idp.home}/credentials/sp/sp-encryption-old.crt
-
-# Default security configuration for SAML RelyingParty beans
+sp.saml.signing.key = %{idp.home}/credentials/sp/sp-signing.key
+sp.saml.signing.cert = %{idp.home}/credentials/sp/sp-signing.crt
+sp.saml.encryption.key = %{idp.home}/credentials/sp/sp-encryption.key
+sp.saml.encryption.cert = %{idp.home}/credentials/sp/sp-encryption.crt
+#sp.saml.encryption.key.2 = %{idp.home}/credentials/sp/sp-encryption-old.key
+#sp.saml.encryption.cert.2 = %{idp.home}/credentials/sp/sp-encryption-old.crt
+
+#sp.saml.encryption.optional = true
+
+# Default security configuration for SAML
#sp.saml.security.config = shibboleth.DefaultXMLSecurityConfiguration
+
+# "Standard" attribute extraction from SAML response/assertion
+#sp.saml.extractStandardAttributes = false
+#sp.saml.issuerAttributeId =
+#sp.saml.authnInstantAttributeId =
+#sp.saml.authnContextClassRefAttributeId =
+#sp.saml.authnContextDeclRefAttributeId =
+#sp.saml.sessionIndexAttributeId =
+#sp.saml.consentAttributeId =
+#sp.saml.authorityAttributeId =
+#sp.saml.notBeforeAttributeId =
+#sp.saml.notOnOrAfterAttributeId =
+#sp.saml.sessionNotOnOrAfterAttributeId =
+#sp.saml.addressAttributeId =
+#sp.saml.dnsNameAttributeId =
diff --git a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java
index c1866da..478a940 100644
--- a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java
+++ b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2TokenConsumerFlowTest.java
@@ -292,6 +292,29 @@ public class SAML2TokenConsumerFlowTest extends AbstractSPFlowTest {
response.getAssertions().get(0).getID()));
}
+ /**
+ * Test flow with bad confirmation address.
+ *
+ * @throws IOException
+ */
+ @Test
+ public void testBadConfirmationMethod() throws IOException {
+ final Response response = buildSAMLResponse(ISSUER, StatusCode.SUCCESS);
+ final Subject subject = response.getAssertions().get(0).getSubject();
+ assert subject != null;
+ subject.getSubjectConfirmations().get(0).setMethod(SubjectConfirmation.METHOD_SENDER_VOUCHES);
+ sign(response);
+ final DDF input = buildRemotedPOSTResponse(response);
+ setApplicationRequest(APPLICATION_ID, input);
+
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ assertFlowExecutionResult(result, FLOW_ID);
+ assertFlowExecutionOutcome(result.getOutcome());
+ final DDF output = assertOutputMessageEvent(result, EventIds.INVALID_MESSAGE);
+ validateAssertionError(output, String.format("No subject confirmation methods were met for assertion with ID '%s'",
+ response.getAssertions().get(0).getID()));
+ }
+
/**
* Test flow with bad confirmation recipient.
*
@@ -313,8 +336,8 @@ public class SAML2TokenConsumerFlowTest extends AbstractSPFlowTest {
assertFlowExecutionResult(result, FLOW_ID);
assertFlowExecutionOutcome(result.getOutcome());
final DDF output = assertOutputMessageEvent(result, EventIds.INVALID_MESSAGE);
- validateAssertionError(output, String.format("SubjectConfirmationData/@Recipient for assertion '%s' did not match any valid recipients: [https://sp.example.org/Shibboleth.sso/SAML2/POST]",
- response.getAssertions().get(0).getID()));
+ validateAssertionError(output, String.format("SubjectConfirmationData/@Recipient for assertion '%s' did not match any valid recipients: [%s]",
+ response.getAssertions().get(0).getID(), RESPONSE_URL));
}
/**
@@ -461,6 +484,9 @@ public class SAML2TokenConsumerFlowTest extends AbstractSPFlowTest {
assertFlowExecutionResult(result, FLOW_ID);
assertFlowExecutionOutcome(result.getOutcome());
final DDF output = assertOutputMessageEvent(result, null);
+ assert output != null;
+ System.out.println("testSuccess output: " + output.toString());
+ validateOutputMessage(result, "/");
}
/**
@@ -482,8 +508,10 @@ public class SAML2TokenConsumerFlowTest extends AbstractSPFlowTest {
final DDF http = output.getmember(RemotedHttpServletRequest.STRUCTURE_NAME);
Assert.assertTrue(http.isstruct());
- final String redirect = http.getmember(RemotedHttpServletResponse.REDIRECT).string();
- Assert.assertEquals(resource, redirect);
+ final byte[] redirect = http.getmember(RemotedHttpServletResponse.REDIRECT).unsafe_string();
+ Assert.assertEquals(resource != null ? resource.getBytes(StandardCharsets.UTF_8) : null, redirect);
+
+ Assert.assertTrue(output.getmember(ConsumerConstants.VALIDATION_ERRORS).isnull());
return output;
}
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-filter.xml b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-filter.xml
new file mode 100644
index 0000000..b83e023
--- /dev/null
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attribute-filter.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ This file is an EXAMPLE policy file. While the policy presented in this
+ example file is illustrative of some simple cases, it relies on the names of
+ non-existent example services and the example attributes demonstrated in the
+ default attribute-resolver.xml file.
+
+ This example does contain some usable "general purpose" policies that may be
+ useful in conjunction with specific deployment choices, but those policies may
+ not be applicable to your specific needs or constraints.
+-->
+<AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"
+ xmlns="urn:mace:shibboleth:2.0:afp"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:oidc="urn:mace:shibboleth:2.0:afp:oidc"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd
+ urn:mace:shibboleth:2.0:afp:oidc http://shibboleth.net/schema/oidc/shibboleth-afp-oidc.xsd">
+
+ <!-- Release home org signifier to everybody. -->
+ <AttributeFilterPolicy id="alwaysRelease">
+ <PolicyRequirementRule xsi:type="Issuer" value="https://idp.example.org" />
+
+ <AttributeRule attributeID="mail" permitAny="true" />
+ </AttributeFilterPolicy>
+
+</AttributeFilterPolicyGroup>
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attributes/nameid-testing.xml b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attributes/nameid-testing.xml
index de2d7ba..3a5a8fb 100644
--- a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attributes/nameid-testing.xml
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/attributes/nameid-testing.xml
@@ -31,6 +31,7 @@
<prop key="id">mail</prop>
<prop key="transcoder">SAML2StringNameIDTranscoder</prop>
<prop key="saml2.nameFormat">urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</prop>
+ <prop key="saml2.defaultQualifiers">true</prop>
<prop key="displayName.en">E-mail</prop>
<prop key="displayName.de">E-Mail</prop>
<prop key="displayName.fr">Email</prop>
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/ValidateAssertions.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/ValidateAssertions.java
index e0aef8a..a66d7bb 100644
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/ValidateAssertions.java
+++ b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/ValidateAssertions.java
@@ -58,8 +58,15 @@ public class ValidateAssertions extends org.opensaml.saml.saml2.profile.impl.Val
protected void processResult(@Nonnull final ValidationContext validationContext,
@Nonnull final ValidationResult validationResult, @Nonnull final Assertion assertion,
@Nonnull final ProfileRequestContext profileRequestContext) {
+
super.processResult(validationContext, validationResult, assertion, profileRequestContext);
+ // Capture any validation errors into the output message.
+
+ if (validationContext.getValidationFailureMessages().isEmpty()) {
+ return;
+ }
+
final AgentRequestContext agentRequestContext =
profileRequestContext.ensureSubcontext(AgentRequestContext.class);
DDF output = agentRequestContext.getOutput();
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list