[java-plugin-shibd-saml] branch main updated: JSHIBDSAML-4 - Redo consumer flow conditions with new validator API
Scott Cantor
cantor.2 at osu.edu
Mon Apr 7 19:22:48 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-saml.git;a=commit;h=19320a0431409900054ab497b5b7f7876edc3ea9
The following commit(s) were added to refs/heads/main by this push:
new 19320a0 JSHIBDSAML-4 - Redo consumer flow conditions with new validator API
19320a0 is described below
commit 19320a0431409900054ab497b5b7f7876edc3ea9
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Apr 7 15:22:46 2025 -0400
JSHIBDSAML-4 - Redo consumer flow conditions with new validator API
https://shibboleth.atlassian.net/browse/JSHIBDSAML-4
Wired in new chain of rules to enforce matching original criteria.
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 65 ++++++++++++++++------
.../idp/flows/sp/consumer/saml2/saml2-beans.xml | 5 --
.../idp/flows/sp/consumer/saml2/saml2-flow.xml | 1 -
3 files changed, 49 insertions(+), 22 deletions(-)
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index a12f605..9f712a8 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -17,32 +17,65 @@
<bean p:id="sp/consumer/saml2/post" class="net.shibboleth.sp.profile.BasicTokenConsumerFlowDescriptor">
<property name="activationCondition">
- <bean class="net.shibboleth.sp.profile.context.logic.HttpSeevletRequestPredicate"
- p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier"
- p:allowedMethods="POST"
- p:allowedContentTypes="application/x-www-form-urlencoded"
- p:requiredParameters="SAMLResponse" />
+ <bean class="net.shibboleth.sp.profile.context.logic.HttpServletRequestPredicate"
+ p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier">
+ <property name="httpServletRequestValidator">
+ <bean class="net.shibboleth.shared.servlet.impl.ChainingHttpServletRequestValidator">
+ <property name="validators">
+ <list>
+ <bean class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestMethodValidator"
+ p:allowedMethods="POST" />
+ <bean class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestContentTypeValidator"
+ p:allowedContentTypes="application/x-www-form-urlencoded" />
+ <ref bean="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST.Response" />
+ </list>
+ </property>
+ </bean>
+ </property>
+ </bean>
</property>
</bean>
<bean p:id="sp/consumer/saml2/post-simplesign" class="net.shibboleth.sp.profile.BasicTokenConsumerFlowDescriptor">
<property name="activationCondition">
- <bean class="net.shibboleth.sp.profile.context.logic.HttpSeevletRequestPredicate"
- p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier"
- p:allowedMethods="POST"
- p:allowedContentTypes="application/x-www-form-urlencoded"
- p:requiredParameters="SAMLResponse" />
+ <bean class="net.shibboleth.sp.profile.context.logic.HttpServletRequestPredicate"
+ p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier">
+ <property name="httpServletRequestValidator">
+ <bean class="net.shibboleth.shared.servlet.impl.ChainingHttpServletRequestValidator">
+ <property name="validators">
+ <list>
+ <bean class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestMethodValidator"
+ p:allowedMethods="POST" />
+ <bean class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestContentTypeValidator"
+ p:allowedContentTypes="application/x-www-form-urlencoded" />
+ <ref bean="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign.Response" />
+ </list>
+ </property>
+ </bean>
+ </property>
+ </bean>
</property>
</bean>
<bean p:id="sp/consumer/saml2/artifact" class="net.shibboleth.sp.profile.BasicTokenConsumerFlowDescriptor">
<property name="activationCondition">
- <bean class="net.shibboleth.sp.profile.context.logic.HttpSeevletRequestPredicate"
- p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier"
- p:allowedMethods="#{{ 'GET', 'POST' }}"
- p:allowedContentTypes="application/x-www-form-urlencoded"
- p:allowNullContentType="true"
- p:requiredParameters="SAMLart" />
+ <bean class="net.shibboleth.sp.profile.context.logic.HttpServletRequestPredicate"
+ p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier">
+ <property name="httpServletRequestValidator">
+ <bean class="net.shibboleth.shared.servlet.impl.ChainingHttpServletRequestValidator">
+ <property name="validators">
+ <list>
+ <bean class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestMethodValidator"
+ p:allowedMethods="#{{ 'GET', 'POST' }}" />
+ <bean class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestContentTypeValidator"
+ p:allowedContentTypes="application/x-www-form-urlencoded"
+ p:allowNullContentType="true" />
+ <ref bean="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Artifact" />
+ </list>
+ </property>
+ </bean>
+ </property>
+ </bean>
</property>
</bean>
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
index a0f1214..d5c1bd2 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
@@ -12,11 +12,6 @@
<import resource="classpath:/META-INF/net/shibboleth/idp/flows/sp/saml2-common-beans.xml" />
- <bean id="ValidateHttpServletRequest" class="net.shibboleth.sp.profile.impl.ValidateHttpServletRequest" scope="prototype"
- p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier"
- p:validator="#{getObject('shibboleth.HttpServletRequestValidator') ?: null}"
- p:checkDuringInit="false" />
-
<bean id="InboundEntityIDLookup" parent="shibboleth.Functions.Compose">
<constructor-arg name="g">
<bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLEntityIDFunction" />
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
index 88a0b5d..06ea41b 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
@@ -5,7 +5,6 @@
<action-state id="DoProfileWork">
<!-- <evaluate expression="PopulateMetricContext" />-->
- <evaluate expression="ValidateHttpServletRequest" />
<evaluate expression="DecodeMessage" />
<!-- <evaluate expression="PostDecodePopulateAuditContext" />-->
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list