[java-plugin-shibd-saml] branch main updated: Update testing environment, and add in InResponseTo bypass feature.
Scott Cantor
cantor.2 at osu.edu
Thu Apr 3 19:52:19 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-saml.git;a=commit;h=a665c25223297a767372a6511e0acdf81e8ed6a8
The following commit(s) were added to refs/heads/main by this push:
new a665c25 Update testing environment, and add in InResponseTo bypass feature.
a665c25 is described below
commit a665c25223297a767372a6511e0acdf81e8ed6a8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Apr 3 15:52:16 2025 -0400
Update testing environment, and add in InResponseTo bypass feature.
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 2 +-
.../idp/flows/sp/consumer/saml2/saml2-beans.xml | 17 +++++++-
.../net/shibboleth/idp/module/conf/sp/agents.xml | 2 +-
.../idp/module/credentials/sp/sp-encryption.crt | 37 ++++++++--------
.../idp/module/credentials/sp/sp-encryption.key | 50 +++++++++++-----------
.../idp/module/credentials/sp/sp-signing.crt | 37 ++++++++--------
.../idp/module/credentials/sp/sp-signing.key | 50 +++++++++++-----------
.../impl/BrowserSSOProfileConfiguration.java | 29 +++++++++++++
8 files changed, 131 insertions(+), 93 deletions(-)
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 7888966..a12f605 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -31,7 +31,7 @@
p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier"
p:allowedMethods="POST"
p:allowedContentTypes="application/x-www-form-urlencoded"
- p:requiredParameters="#{{ 'SAMLResponse', 'Signature' }}" />
+ p:requiredParameters="SAMLResponse" />
</property>
</bean>
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
index c330976..a0f1214 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
@@ -33,7 +33,15 @@
<bean class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
<property name="handlers">
<list>
-<!-- <bean class="org.opensaml.saml.common.binding.security.impl.InResponseToSecurityHandler" scope="prototype" />-->
+ <!--
+ Don't know how to deal woth this, the usual MessageContext/PRC paradox/mess.
+
+ <bean class="org.opensaml.saml.common.binding.security.impl.InResponseToSecurityHandler" scope="prototype">
+ <property name="activationCondition">
+ <bean class="net.shibboleth.saml.saml2.profile.config.logic.CheckInResponseToPredicate" />
+ </property>
+ </bean>
+ -->
<bean class="org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler" scope="prototype"
p:checkDuringInit="false"
p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier" />
@@ -123,6 +131,13 @@
<property name="checkAddress">
<bean class="net.shibboleth.saml.saml2.profile.config.logic.CheckAddressPredicate" />
</property>
+ <property name="inResponseToIgnored">
+ <bean parent="shibboleth.Conditions.NOT">
+ <constructor-arg>
+ <bean class="net.shibboleth.saml.saml2.profile.config.logic.CheckInResponseToPredicate" />
+ </constructor-arg>
+ </bean>
+ </property>
<property name="maximumTimeSinceAuthn">
<bean class="net.shibboleth.saml.saml2.profile.config.navigate.MaximumTimeSinceAuthnLookupFunction" />
</property>
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
index 3556931..849e885 100644
--- a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
@@ -46,7 +46,7 @@
<util:list id="shibboleth.DefaultProfileConfigurations">
<!-- Your profiles here. -->
- <ref bean="SAML2.SSO" />
+ <bean parent="SAML2.SSO" p:checkAddress="false" p:checkInResponseTo="false" />
</util:list>
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-encryption.crt b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-encryption.crt
index c0df65b..f0e542e 100644
--- a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-encryption.crt
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-encryption.crt
@@ -1,22 +1,19 @@
-----BEGIN CERTIFICATE-----
-MIIDtTCCAp2gAwIBAgIJAPmsD+VGldyPMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
-BAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX
-aWRnaXRzIFB0eSBMdGQwHhcNMTQwNDExMTMzOTE4WhcNMjQwNDA4MTMzOTE4WjBF
-MQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50
-ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAxg0TyQAP/tIvOH89EtaXuRRn8SYzTj7W1TbNY4VvBmobjkRmSkki4hH9
-x4sQpi635wn6WtXTN/FNNmkTK3N/LspmBWxfZS+n+cc7I82E5yvCAPX67QsZgqgg
-lp2W5dvK/FsMMCS6X6SVqzBLMP88NenXKxY+HMxMs0sT0UKYh1cAEqadrHRBO65a
-DBcm5a0sBVYt9K6pgaOHrp/zSIbhnR5tFFLjBbtFktDpHL3AdGBH3OYidNGKBO3t
-J3Ms7LeKXsM0+0Y4P+9fHZINL2X3E2N6GVnKs5PZTg9sP0FtIpAbYm/+zCx7Yj1E
-T/Er8mDd6tNVGSQsn9s5xUBwGqn14wIDAQABo4GnMIGkMB0GA1UdDgQWBBSiQhSu
-p9BYjD2ZuMkEiQK7w/Zq0TB1BgNVHSMEbjBsgBSiQhSup9BYjD2ZuMkEiQK7w/Zq
-0aFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNV
-BAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAPmsD+VGldyPMAwGA1UdEwQF
-MAMBAf8wDQYJKoZIhvcNAQELBQADggEBAHZmIo9GBTSsD5DJfKkCVUvBafwR089H
-BkgVPOuVuEe803BRlKd4BVIsuxAUAy3oqdJYqf9ptPEx8Ef+ALbcDhRbWINhMgO7
-0/S4x3pS9gOn7/Y9yZplOe4Jd2q3R8QBef+hKLcD/Uv0Sqy2nilM8BnMga5tqsL+
-8oFt0blzXtQ2vcOVyNyG326uZBZv2Cf6FXFsYQX1L/tLeTBJegefgGkg2dqCTKIU
-1Qy/Kd2P3/S01kQxjDeG7UfXc9qtelJ68kvzK2d3WOJ2qmsdMxjMNfTItP7FO54M
-i8V7gp9HK+EimdSbgu7xktKlrqA2Rsn+dBoPSgOUs/LOGtCS9/biF0w=
+MIIDCTCCAfGgAwIBAgIJAN5X7xMzDu64MA0GCSqGSIb3DQEBBQUAMBkxFzAVBgNV
+BAMTDnNwLmV4YW1wbGUub3JnMB4XDTEzMDUyNDIxMzU0NloXDTIzMDUyMjIxMzU0
+NlowGTEXMBUGA1UEAxMOc3AuZXhhbXBsZS5vcmcwggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQDAVA9a1ip1mvd5rQJe9xhL6TXvIHxPm+FLxabvQJA48sJh
+XsXmLAsyGzSm/HviqdkdR3VxyFhzLoj03TqqPP8/IoTFA2Lp+q9PnaeEHKaYeJGH
+g4RozQ0UKhiuyppWptO2Syls302haIaWWXz+p3iOgjuZKg/ESs1udGEJvAC/OUVu
+Eo08b6BuySxO/KsX9kWYoCF6vm+tN1kpOrMTceCqcJlRDyFzxUo4JTaku/81k88v
+iF+5/b0p7McB3IGqCFHR6MhZol880Dgxeze3o6/hmvXwGbJgOeWc46jgKareWwYn
+CSQ7/08TDvX0RhCca39IJXqSP/Wv4QOkALTdobQhAgMBAAGjVDBSMDEGA1UdEQQq
+MCiCDnNwLmV4YW1wbGUub3JnhhZodHRwczovL3NwLmV4YW1wbGUub3JnMB0GA1Ud
+DgQWBBQ1FR+wdqXqtICqb7G0fms7ELdt1zANBgkqhkiG9w0BAQUFAAOCAQEAoW/5
+uKnQMuQJfEx11uVCItAvRNmjWSmGFXpQ3rown3XbRkdX78PztcIdgwwtNZoTlMmA
+122Kdb8ViXw2tsZaB1iOaBiavMtLgdxbg9j6B6UmQrzERQm+zq5rBAzSTh6VRyDP
+kCMYnlX4+PyjWXGVADI65cRBbFBnED6By0NhJesDfaH8VpY19LN9AYpXVJRv4/Dc
+zlnQds4vPKzOaJGvt01Ni9jqZtcUDzKt9UdmDATbukoStvCKTwcr4gAPvfCfNZgo
+CUaW4GEmfyDkCahd5qNlWw0++Z2kNoSRyPA1PTJIkZhagv+VbO85ua2SDJWVgF4I
+h+XNZ5oAql/cjrwDWw==
-----END CERTIFICATE-----
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-encryption.key b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-encryption.key
index 951462f..ea775a2 100644
--- a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-encryption.key
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-encryption.key
@@ -1,27 +1,27 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEAxg0TyQAP/tIvOH89EtaXuRRn8SYzTj7W1TbNY4VvBmobjkRm
-Skki4hH9x4sQpi635wn6WtXTN/FNNmkTK3N/LspmBWxfZS+n+cc7I82E5yvCAPX6
-7QsZgqgglp2W5dvK/FsMMCS6X6SVqzBLMP88NenXKxY+HMxMs0sT0UKYh1cAEqad
-rHRBO65aDBcm5a0sBVYt9K6pgaOHrp/zSIbhnR5tFFLjBbtFktDpHL3AdGBH3OYi
-dNGKBO3tJ3Ms7LeKXsM0+0Y4P+9fHZINL2X3E2N6GVnKs5PZTg9sP0FtIpAbYm/+
-zCx7Yj1ET/Er8mDd6tNVGSQsn9s5xUBwGqn14wIDAQABAoIBAHG6nLv13zmTdS5a
-UrX4qNPNVgryxs+N4kw51iPqQeFLGVvPB3ZtHSz46+SkhQEJHu37mtqCo3IijRZL
-rIhtIIG8FG3U18sBXNJgiCN9J26ggB2RI3DvyMxww5X6FOcWGjBkEFGtJaE6n//Y
-EbWnO+oxyC+j7DMZVoo2+MBYH8LHPXpMPFPhYbf12LpHY+WeNgX/eemMTlSylBln
-lfhySCtpLcgY7+juYlXaZ9Y1z37QZBcP6yYLTnXJVlhY1KcULh+/PUnmzVpHbkwU
-v/yQiFGFsve1ROp0ztB6sFufLnvGcTa3T1Oeza9ZaX/zjbMbGp3qjSGoknS23U0Q
-ZotRB+ECgYEA9EmvBYLWgEayOlZPcBwKZ3Qrwf9ip3xmtubrf9byIozEeQTKvHmA
-UvK5dKN1pwK0gTaWk5aq+n64HtwJ0+pO4bV32TJJlV/la4xd7wHdH5+S5cdQjd/r
-tuxyejp5FhqT+x2rKibskEeFKhfgIIolpkcNFIKc9xa3/VBOWPxV19kCgYEAz4vl
-xJhD8Cf97bm5hemiJPt2eQMCTGCE39O4UaY6xi5lINoySoh8qd2e59nnneG4YaNp
-tHU23oh00m68Jx8b7wMFliQ/J59lxAkfP262EkBqf/VOAVXQo/iaA8HSwq3Hfwt5
-0F4HMQEfB6qf7/LGvFHTQ8+Wn1upZGaYP1YAghsCgYBe3FILmNAExe8luihkx26+
-15y6W5qKoUMdmTQv0175TaJpwBOd9qx/CWQ8x9DDBsjjODhmnWZNmXGUAiwKz3zM
-JvSgMefjCncDOWGskxOz2PppIenE/gQBZ3XYwuYMUEvQgqfZ2X2ZVTx/qP/Ogva1
-x/drVIDxbjAKPOn/ohUPmQKBgQChW5qfZeIr7Gu3TxW1zxaIuhg5rOU0jDXB7tD2
-ac54Fcn56KoA2GxThEHu77LrRHodLvcXnamzCVQJ5p3RrJYDFM5bFIMlQv/TkWQB
-5QkY14v1P7oNv7IeSUE0epRpVsIrO7jRDsl4h+6f/z+pRY7NCrC9n77y1ki0Di9/
-zlVG0QKBgFXQkO/bf0Qs3COPWUs5nHyQ/sR0ptx1jrFDSjCdGvBC7NrDlwNP3894
-EHCUTrEHhjtAGVzyZakZ6PLAN9cf86N1QhvOdj/oasL5vddWyFK74x2/mtp59VOU
-LaCxnnbG4JoSVX96BSzUFbtRrQbf2+t5ZON9K12IPIxstMkF2j8u
+MIIEpQIBAAKCAQEAwFQPWtYqdZr3ea0CXvcYS+k17yB8T5vhS8Wm70CQOPLCYV7F
+5iwLMhs0pvx74qnZHUd1cchYcy6I9N06qjz/PyKExQNi6fqvT52nhBymmHiRh4OE
+aM0NFCoYrsqaVqbTtkspbN9NoWiGlll8/qd4joI7mSoPxErNbnRhCbwAvzlFbhKN
+PG+gbsksTvyrF/ZFmKAher5vrTdZKTqzE3HgqnCZUQ8hc8VKOCU2pLv/NZPPL4hf
+uf29KezHAdyBqghR0ejIWaJfPNA4MXs3t6Ov4Zr18BmyYDnlnOOo4Cmq3lsGJwkk
+O/9PEw719EYQnGt/SCV6kj/1r+EDpAC03aG0IQIDAQABAoIBAQCItrg7f+Wqt7+W
+9I6s5sSUoXA/TT5QcKQT8qoZhDGA6b+W64GNfl1u/rvMv8lodAfrsjIf8aQ+LCQa
+u2/KN5XRUT5DtYaIgDRCSfUcCim6VGpOhASJYskbPllRVp+jXO89s+v8gjdytxSE
+p5QciPs/gf/PfoC6rdmd3IhmHQgC5PxCu/3GvlB2n7ec/twPcaBG2BY95jLTJg4C
+3Xfiwl0qK2rNX1axiywEYwGyLDl4eco4t6MYLXMmB/QyDETRLx/6U6JsfgoY/2+W
+aWq6NSDDs5z5DzI8vAef9sxUdw1iZ4OfeyKPVJ5FaI5OlzDq2kWZ8p9p4B3w/pe3
+fPVM/cABAoGBAPPP1GiooBHxt2HwSjUeokGibZv9yv8ut8V6odxJKFCJHAiSVkFH
+soR8Q/8Nd8oeNrRe41qnRffmgSoBlnQUxOikDyO2gqnE45Keb0I8nlGN6UQQSDct
+Pc4GiEhQU3cPWgRmQYcxMxIZTL5BZRnoqE70ka/zr7pmdwmUCffVTv8BAoGBAMnx
+X3lafsU0aSnAfMF8zCGiHlvpUGoZ7l1wcCMpUfiaLYh3AkT15CoXBIo4rupXblKq
+Y0EPVG6KbzeGxZ07HsMr9kIQOSjRehnxHobGqzsLCMpNZFQEx45RIwy1fkpw3bHH
+/wyGyQrLDkisMwgqbjgjs6f/Ls1ubUJQH0nrR9UhAoGBAIC6GGHxtiIDR1l0bxnA
+xNZ2lfyocQdueSTQ7KjMD3cGDUERUm1BF6YPni8Jw1d5wFRXTR7N9ok+sK+nCvLb
+DGPwSvYGJNLR233MHN4R910D2kdPeXF4d4tRs57KmmbgOhzciHiCp35E0VoaWPDn
+AAY/5rPJq9x0wSDTgrfRbdYBAoGBAI3WgheLT0UV1dNkhnukOwBYjPhDfJ65TenF
+Qo3/xLpXGCokZKypBLPnbOHkhD7GYA+h64rTyJrHkuwuNfiEgMvWweWO3Ybk8tzr
+tWQ2gCg9TNRC3XgBz2QPaw3PIEAK3Du1XFehB+4TxxmWEVXn73hw4wvZOTdDG2yb
+OA7EObThAoGASjDc6zKQO+/7pwulathFMfnleETgKni4bq0MQ3ad6TRZdj7NwvbD
+w6ccGtC5qLQfqPZgPKZQavxXD3ENL/DPj9cWdRFEJUIkEQfMalyek1xogyXY09RZ
+kcF18N167B5zly0rALGo7godgiahjcC5S8l/T1zJeYESwkMG6o7KHw8=
-----END RSA PRIVATE KEY-----
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing.crt b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing.crt
index c0df65b..f0e542e 100644
--- a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing.crt
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing.crt
@@ -1,22 +1,19 @@
-----BEGIN CERTIFICATE-----
-MIIDtTCCAp2gAwIBAgIJAPmsD+VGldyPMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
-BAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX
-aWRnaXRzIFB0eSBMdGQwHhcNMTQwNDExMTMzOTE4WhcNMjQwNDA4MTMzOTE4WjBF
-MQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50
-ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAxg0TyQAP/tIvOH89EtaXuRRn8SYzTj7W1TbNY4VvBmobjkRmSkki4hH9
-x4sQpi635wn6WtXTN/FNNmkTK3N/LspmBWxfZS+n+cc7I82E5yvCAPX67QsZgqgg
-lp2W5dvK/FsMMCS6X6SVqzBLMP88NenXKxY+HMxMs0sT0UKYh1cAEqadrHRBO65a
-DBcm5a0sBVYt9K6pgaOHrp/zSIbhnR5tFFLjBbtFktDpHL3AdGBH3OYidNGKBO3t
-J3Ms7LeKXsM0+0Y4P+9fHZINL2X3E2N6GVnKs5PZTg9sP0FtIpAbYm/+zCx7Yj1E
-T/Er8mDd6tNVGSQsn9s5xUBwGqn14wIDAQABo4GnMIGkMB0GA1UdDgQWBBSiQhSu
-p9BYjD2ZuMkEiQK7w/Zq0TB1BgNVHSMEbjBsgBSiQhSup9BYjD2ZuMkEiQK7w/Zq
-0aFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNV
-BAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAPmsD+VGldyPMAwGA1UdEwQF
-MAMBAf8wDQYJKoZIhvcNAQELBQADggEBAHZmIo9GBTSsD5DJfKkCVUvBafwR089H
-BkgVPOuVuEe803BRlKd4BVIsuxAUAy3oqdJYqf9ptPEx8Ef+ALbcDhRbWINhMgO7
-0/S4x3pS9gOn7/Y9yZplOe4Jd2q3R8QBef+hKLcD/Uv0Sqy2nilM8BnMga5tqsL+
-8oFt0blzXtQ2vcOVyNyG326uZBZv2Cf6FXFsYQX1L/tLeTBJegefgGkg2dqCTKIU
-1Qy/Kd2P3/S01kQxjDeG7UfXc9qtelJ68kvzK2d3WOJ2qmsdMxjMNfTItP7FO54M
-i8V7gp9HK+EimdSbgu7xktKlrqA2Rsn+dBoPSgOUs/LOGtCS9/biF0w=
+MIIDCTCCAfGgAwIBAgIJAN5X7xMzDu64MA0GCSqGSIb3DQEBBQUAMBkxFzAVBgNV
+BAMTDnNwLmV4YW1wbGUub3JnMB4XDTEzMDUyNDIxMzU0NloXDTIzMDUyMjIxMzU0
+NlowGTEXMBUGA1UEAxMOc3AuZXhhbXBsZS5vcmcwggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQDAVA9a1ip1mvd5rQJe9xhL6TXvIHxPm+FLxabvQJA48sJh
+XsXmLAsyGzSm/HviqdkdR3VxyFhzLoj03TqqPP8/IoTFA2Lp+q9PnaeEHKaYeJGH
+g4RozQ0UKhiuyppWptO2Syls302haIaWWXz+p3iOgjuZKg/ESs1udGEJvAC/OUVu
+Eo08b6BuySxO/KsX9kWYoCF6vm+tN1kpOrMTceCqcJlRDyFzxUo4JTaku/81k88v
+iF+5/b0p7McB3IGqCFHR6MhZol880Dgxeze3o6/hmvXwGbJgOeWc46jgKareWwYn
+CSQ7/08TDvX0RhCca39IJXqSP/Wv4QOkALTdobQhAgMBAAGjVDBSMDEGA1UdEQQq
+MCiCDnNwLmV4YW1wbGUub3JnhhZodHRwczovL3NwLmV4YW1wbGUub3JnMB0GA1Ud
+DgQWBBQ1FR+wdqXqtICqb7G0fms7ELdt1zANBgkqhkiG9w0BAQUFAAOCAQEAoW/5
+uKnQMuQJfEx11uVCItAvRNmjWSmGFXpQ3rown3XbRkdX78PztcIdgwwtNZoTlMmA
+122Kdb8ViXw2tsZaB1iOaBiavMtLgdxbg9j6B6UmQrzERQm+zq5rBAzSTh6VRyDP
+kCMYnlX4+PyjWXGVADI65cRBbFBnED6By0NhJesDfaH8VpY19LN9AYpXVJRv4/Dc
+zlnQds4vPKzOaJGvt01Ni9jqZtcUDzKt9UdmDATbukoStvCKTwcr4gAPvfCfNZgo
+CUaW4GEmfyDkCahd5qNlWw0++Z2kNoSRyPA1PTJIkZhagv+VbO85ua2SDJWVgF4I
+h+XNZ5oAql/cjrwDWw==
-----END CERTIFICATE-----
diff --git a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing.key b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing.key
index 951462f..ea775a2 100644
--- a/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing.key
+++ b/sp-saml-conf-impl/src/test/resources/net/shibboleth/idp/module/credentials/sp/sp-signing.key
@@ -1,27 +1,27 @@
-----BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEAxg0TyQAP/tIvOH89EtaXuRRn8SYzTj7W1TbNY4VvBmobjkRm
-Skki4hH9x4sQpi635wn6WtXTN/FNNmkTK3N/LspmBWxfZS+n+cc7I82E5yvCAPX6
-7QsZgqgglp2W5dvK/FsMMCS6X6SVqzBLMP88NenXKxY+HMxMs0sT0UKYh1cAEqad
-rHRBO65aDBcm5a0sBVYt9K6pgaOHrp/zSIbhnR5tFFLjBbtFktDpHL3AdGBH3OYi
-dNGKBO3tJ3Ms7LeKXsM0+0Y4P+9fHZINL2X3E2N6GVnKs5PZTg9sP0FtIpAbYm/+
-zCx7Yj1ET/Er8mDd6tNVGSQsn9s5xUBwGqn14wIDAQABAoIBAHG6nLv13zmTdS5a
-UrX4qNPNVgryxs+N4kw51iPqQeFLGVvPB3ZtHSz46+SkhQEJHu37mtqCo3IijRZL
-rIhtIIG8FG3U18sBXNJgiCN9J26ggB2RI3DvyMxww5X6FOcWGjBkEFGtJaE6n//Y
-EbWnO+oxyC+j7DMZVoo2+MBYH8LHPXpMPFPhYbf12LpHY+WeNgX/eemMTlSylBln
-lfhySCtpLcgY7+juYlXaZ9Y1z37QZBcP6yYLTnXJVlhY1KcULh+/PUnmzVpHbkwU
-v/yQiFGFsve1ROp0ztB6sFufLnvGcTa3T1Oeza9ZaX/zjbMbGp3qjSGoknS23U0Q
-ZotRB+ECgYEA9EmvBYLWgEayOlZPcBwKZ3Qrwf9ip3xmtubrf9byIozEeQTKvHmA
-UvK5dKN1pwK0gTaWk5aq+n64HtwJ0+pO4bV32TJJlV/la4xd7wHdH5+S5cdQjd/r
-tuxyejp5FhqT+x2rKibskEeFKhfgIIolpkcNFIKc9xa3/VBOWPxV19kCgYEAz4vl
-xJhD8Cf97bm5hemiJPt2eQMCTGCE39O4UaY6xi5lINoySoh8qd2e59nnneG4YaNp
-tHU23oh00m68Jx8b7wMFliQ/J59lxAkfP262EkBqf/VOAVXQo/iaA8HSwq3Hfwt5
-0F4HMQEfB6qf7/LGvFHTQ8+Wn1upZGaYP1YAghsCgYBe3FILmNAExe8luihkx26+
-15y6W5qKoUMdmTQv0175TaJpwBOd9qx/CWQ8x9DDBsjjODhmnWZNmXGUAiwKz3zM
-JvSgMefjCncDOWGskxOz2PppIenE/gQBZ3XYwuYMUEvQgqfZ2X2ZVTx/qP/Ogva1
-x/drVIDxbjAKPOn/ohUPmQKBgQChW5qfZeIr7Gu3TxW1zxaIuhg5rOU0jDXB7tD2
-ac54Fcn56KoA2GxThEHu77LrRHodLvcXnamzCVQJ5p3RrJYDFM5bFIMlQv/TkWQB
-5QkY14v1P7oNv7IeSUE0epRpVsIrO7jRDsl4h+6f/z+pRY7NCrC9n77y1ki0Di9/
-zlVG0QKBgFXQkO/bf0Qs3COPWUs5nHyQ/sR0ptx1jrFDSjCdGvBC7NrDlwNP3894
-EHCUTrEHhjtAGVzyZakZ6PLAN9cf86N1QhvOdj/oasL5vddWyFK74x2/mtp59VOU
-LaCxnnbG4JoSVX96BSzUFbtRrQbf2+t5ZON9K12IPIxstMkF2j8u
+MIIEpQIBAAKCAQEAwFQPWtYqdZr3ea0CXvcYS+k17yB8T5vhS8Wm70CQOPLCYV7F
+5iwLMhs0pvx74qnZHUd1cchYcy6I9N06qjz/PyKExQNi6fqvT52nhBymmHiRh4OE
+aM0NFCoYrsqaVqbTtkspbN9NoWiGlll8/qd4joI7mSoPxErNbnRhCbwAvzlFbhKN
+PG+gbsksTvyrF/ZFmKAher5vrTdZKTqzE3HgqnCZUQ8hc8VKOCU2pLv/NZPPL4hf
+uf29KezHAdyBqghR0ejIWaJfPNA4MXs3t6Ov4Zr18BmyYDnlnOOo4Cmq3lsGJwkk
+O/9PEw719EYQnGt/SCV6kj/1r+EDpAC03aG0IQIDAQABAoIBAQCItrg7f+Wqt7+W
+9I6s5sSUoXA/TT5QcKQT8qoZhDGA6b+W64GNfl1u/rvMv8lodAfrsjIf8aQ+LCQa
+u2/KN5XRUT5DtYaIgDRCSfUcCim6VGpOhASJYskbPllRVp+jXO89s+v8gjdytxSE
+p5QciPs/gf/PfoC6rdmd3IhmHQgC5PxCu/3GvlB2n7ec/twPcaBG2BY95jLTJg4C
+3Xfiwl0qK2rNX1axiywEYwGyLDl4eco4t6MYLXMmB/QyDETRLx/6U6JsfgoY/2+W
+aWq6NSDDs5z5DzI8vAef9sxUdw1iZ4OfeyKPVJ5FaI5OlzDq2kWZ8p9p4B3w/pe3
+fPVM/cABAoGBAPPP1GiooBHxt2HwSjUeokGibZv9yv8ut8V6odxJKFCJHAiSVkFH
+soR8Q/8Nd8oeNrRe41qnRffmgSoBlnQUxOikDyO2gqnE45Keb0I8nlGN6UQQSDct
+Pc4GiEhQU3cPWgRmQYcxMxIZTL5BZRnoqE70ka/zr7pmdwmUCffVTv8BAoGBAMnx
+X3lafsU0aSnAfMF8zCGiHlvpUGoZ7l1wcCMpUfiaLYh3AkT15CoXBIo4rupXblKq
+Y0EPVG6KbzeGxZ07HsMr9kIQOSjRehnxHobGqzsLCMpNZFQEx45RIwy1fkpw3bHH
+/wyGyQrLDkisMwgqbjgjs6f/Ls1ubUJQH0nrR9UhAoGBAIC6GGHxtiIDR1l0bxnA
+xNZ2lfyocQdueSTQ7KjMD3cGDUERUm1BF6YPni8Jw1d5wFRXTR7N9ok+sK+nCvLb
+DGPwSvYGJNLR233MHN4R910D2kdPeXF4d4tRs57KmmbgOhzciHiCp35E0VoaWPDn
+AAY/5rPJq9x0wSDTgrfRbdYBAoGBAI3WgheLT0UV1dNkhnukOwBYjPhDfJ65TenF
+Qo3/xLpXGCokZKypBLPnbOHkhD7GYA+h64rTyJrHkuwuNfiEgMvWweWO3Ybk8tzr
+tWQ2gCg9TNRC3XgBz2QPaw3PIEAK3Du1XFehB+4TxxmWEVXn73hw4wvZOTdDG2yb
+OA7EObThAoGASjDc6zKQO+/7pwulathFMfnleETgKni4bq0MQ3ad6TRZdj7NwvbD
+w6ccGtC5qLQfqPZgPKZQavxXD3ENL/DPj9cWdRFEJUIkEQfMalyek1xogyXY09RZ
+kcF18N167B5zly0rALGo7godgiahjcC5S8l/T1zJeYESwkMG6o7KHw8=
-----END RSA PRIVATE KEY-----
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
index 14e4be4..6393f31 100644
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
+++ b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
@@ -59,6 +59,9 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionConsum
/** Whether to compare client and assertion addresses on inbound SSO. */
@Nonnull private Predicate<ProfileRequestContext> checkAddressPredicate;
+ /** Whether to validate inbound InResponseTo values. */
+ @Nonnull private Predicate<ProfileRequestContext> checkInResponseToPredicate;
+
/** Lookup function to supply maximum time since inbound AuthnInstant. */
@Nonnull private Function<ProfileRequestContext,Duration> maximumTimeSinceAuthnLookupStrategy;
@@ -113,6 +116,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionConsum
attributeRecipientGroupIDLookupStrategy = FunctionSupport.constant(null);
forceAuthnPredicate = PredicateSupport.alwaysFalse();
checkAddressPredicate = PredicateSupport.alwaysTrue();
+ checkInResponseToPredicate = PredicateSupport.alwaysTrue();
maximumTimeSinceAuthnLookupStrategy = FunctionSupport.constant(null);
proxyCountLookupStrategy = FunctionSupport.constant(null);
authnContextComparisonLookupStrategy = FunctionSupport.constant(null);
@@ -223,6 +227,31 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionConsum
checkAddressPredicate = Constraint.isNotNull(condition, "Address checking predicate cannot be null");
}
+ /** {@inheritDoc} */
+ public boolean isCheckInResponseTo(@Nullable final ProfileRequestContext profileRequestContext) {
+ return checkInResponseToPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether the inbound InResponseTo value should be checked against the outgoing request message
+ * during inbound SSO.
+ *
+ * @param flag flag to set
+ */
+ public void setCheckInResponseTo(final boolean flag) {
+ checkInResponseToPredicate = PredicateSupport.constant(flag);
+ }
+
+ /**
+ * Set a condition to determine whether the inbound InResponseTo value should be checked against the outgoing
+ * request message during inbound SSO.
+ *
+ * @param condition condition to set
+ */
+ public void setCheckInResponseToPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ checkInResponseToPredicate = Constraint.isNotNull(condition, "InResponseTo checking predicate cannot be null");
+ }
+
/** {@inheritDoc} */
@Nullable public Duration getMaximumTimeSinceAuthn(@Nullable final ProfileRequestContext profileRequestContext) {
final Duration amount = maximumTimeSinceAuthnLookupStrategy.apply(profileRequestContext);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list