[java-plugin-shibd-saml] branch main updated: Sketch out SAML action for agent consumer responses.
Scott Cantor
cantor.2 at osu.edu
Wed Sep 18 14:18:52 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-saml.git;a=commit;h=3253709636f129ba3d9116789117bffa075c3eb0
The following commit(s) were added to refs/heads/main by this push:
new 3253709 Sketch out SAML action for agent consumer responses.
3253709 is described below
commit 3253709636f129ba3d9116789117bffa075c3eb0
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Sep 18 10:18:49 2024 -0400
Sketch out SAML action for agent consumer responses.
---
.../idp/flows/sp/consumer/saml2/saml2-beans.xml | 3 +
.../idp/flows/sp/consumer/saml2/saml2-flow.xml | 2 +-
.../saml2/profile/impl/PrepareAgentResponse.java | 144 +++++++++++++++++++++
3 files changed, 148 insertions(+), 1 deletion(-)
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
index 04c1f62..90fa982 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
@@ -178,5 +178,8 @@
<bean id="ExtractSAMLAttributes"
class="net.shibboleth.sp.saml.saml2.profile.impl.ExtractSAMLAttributes" scope="prototype"
p:standardExtractionStrategy-ref="StandardExtractionStrategy" />
+
+ <bean id="PrepareAgentResponse"
+ class="net.shibboleth.sp.saml.saml2.profile.impl.PrepareAgentResponse" scope="prototype" />
</beans>
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
index 43e4533..44d4e08 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
@@ -22,10 +22,10 @@
<evaluate expression="DecryptAttributes" />
<evaluate expression="ProcessAssertionsForAuthentication" />
<evaluate expression="ExtractSAMLAttributes" />
+ <evaluate expression="PrepareAgentResponse" />
<!-- <evaluate expression="PostAssertionPopulateAuditContext" />-->
<!-- <evaluate expression="PostResponsePopulateAuditContext" />-->
- <evaluate expression="PrepareAgentResponse" />
<evaluate expression="'proceed'" />
<transition on="proceed" to="proceed" />
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/PrepareAgentResponse.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/PrepareAgentResponse.java
new file mode 100644
index 0000000..2c6c813
--- /dev/null
+++ b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/PrepareAgentResponse.java
@@ -0,0 +1,144 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.saml.saml2.profile.impl;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Map;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.core.xml.io.MarshallingException;
+import org.opensaml.core.xml.util.XMLObjectSupport;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.binding.SAMLBindingSupport;
+import org.opensaml.saml.saml2.core.Assertion;
+import org.opensaml.saml.saml2.core.AuthnStatement;
+import org.opensaml.saml.saml2.core.NameID;
+import org.opensaml.saml.saml2.core.Subject;
+import org.slf4j.Logger;
+
+import net.shibboleth.idp.attribute.context.AttributeContext;
+import net.shibboleth.shared.codec.Base64Support;
+import net.shibboleth.shared.codec.EncodingException;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.xml.SerializeSupport;
+import net.shibboleth.sp.profile.AbstractTokenConsumerResponseAction;
+import net.shibboleth.sp.saml.saml2.context.SAMLTokenContext;
+
+/**
+ * SAML-specific subclass of token consumer response action.
+ *
+ * <p>The base class does all the work, the subclass simply overrides the methods needed to
+ * express SAML-specific RelayState and session data behavior.</p>
+ *
+ * <p>The session data initially will consist of some serialized opaque blob containing
+ * enough information to process logout requests in the future, the SessionIndex and
+ * the {@link NameID}. In the absence of an identifier, no data is neeeded since logout
+ * is impossible, so null can be returned.</p>
+ *
+ * @event {@link EventIds#PROCEED_EVENT_ID}
+ */
+public class PrepareAgentResponse extends AbstractTokenConsumerResponseAction {
+
+ /** Class logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(PrepareAgentResponse.class);
+
+ /** Strategy used to look up {@link SAMLTokenContext} to operate on. */
+ @Nonnull private Function<ProfileRequestContext,SAMLTokenContext> samlTokenContextLookupStrategy;
+
+ /** DOM configuration parameters used by LSSerializer to exclude XML declaration. */
+ @Nonnull private static final Map<String, Object> NO_XML_DECL_PARAMS;
+
+ /** Constructor. */
+ public PrepareAgentResponse() {
+ samlTokenContextLookupStrategy = new ChildContextLookup<>(SAMLTokenContext.class);
+
+ // Override base class attribute lookup by default.
+ setAttributeContextLookupStrategy(new ChildContextLookup<>(AttributeContext.class).compose(
+ new ChildContextLookup<>(SAMLTokenContext.class)));
+ }
+
+ /**
+ * Set the strategy used to return the {@link SAMLTokenContext} for input.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setSAMLTokenContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,SAMLTokenContext> strategy) {
+ checkSetterPreconditions();
+ samlTokenContextLookupStrategy =
+ Constraint.isNotNull(strategy, "SAMLTokenContext lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable protected String getStateToken(@Nonnull final ProfileRequestContext profileRequestContext) {
+ return SAMLBindingSupport.getRelayState(profileRequestContext.ensureInboundMessageContext());
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable protected String getSessionData(@Nonnull final ProfileRequestContext profileRequestContext) {
+ final SAMLTokenContext tokenContext = samlTokenContextLookupStrategy.apply(profileRequestContext);
+ if (tokenContext == null) {
+ log.warn("{} No SAMLTokenContext found", getLogPrefix());
+ return null;
+ }
+
+ final AuthnStatement statement = tokenContext.getAuthnStatement();
+ if (statement == null) {
+ log.warn("{} No AuthnStatement found in SAMLTokenContext", getLogPrefix());
+ return null;
+ }
+
+ if (statement.getParent() instanceof Assertion assertion) {
+
+ final Subject subject = assertion.getSubject();
+ final NameID nameID = subject != null ? subject.getNameID() : null;
+ if (nameID == null) {
+ log.debug("{} No NameID found in assertion, nothing to do", getLogPrefix());
+ return null;
+ }
+
+ final String sessionIndex = statement.getSessionIndex();
+ if (sessionIndex != null) {
+ // If you tell anyone I did this, I will be sad.
+ nameID.setSPProvidedID(sessionIndex);
+ }
+
+ try {
+ final String xml = SerializeSupport.nodeToString(XMLObjectSupport.marshall(nameID), NO_XML_DECL_PARAMS);
+ return Base64Support.encodeURLSafe(xml.getBytes(StandardCharsets.UTF_8));
+ } catch (final MarshallingException | EncodingException e) {
+ log.error("{} Error marshalling and encoding NameID", getLogPrefix(), e);
+ return null;
+ }
+ }
+
+ log.warn("{} No parent Assertion available via AuthnStatement", getLogPrefix());
+ return null;
+ }
+
+ static {
+ NO_XML_DECL_PARAMS = CollectionSupport.<String,Object>singletonMap("xml-declaration", Boolean.FALSE);
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list