[java-plugin-shibd-saml] branch main updated: JSHIBDSAML-1 - Request/response correlation and passive tracking
Scott Cantor
cantor.2 at osu.edu
Mon Apr 14 16:22:00 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-saml.git;a=commit;h=f29149a76ddf314dce13be326d28488ead9bb4f7
The following commit(s) were added to refs/heads/main by this push:
new f29149a JSHIBDSAML-1 - Request/response correlation and passive tracking
f29149a is described below
commit f29149a76ddf314dce13be326d28488ead9bb4f7
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Apr 14 12:21:57 2025 -0400
JSHIBDSAML-1 - Request/response correlation and passive tracking
https://shibboleth.atlassian.net/browse/JSHIBDSAML-1
Wire in action to produce cookie.
Adjust tests.
---
.../idp/flows/sp/initiator/saml2/saml2-beans.xml | 36 +++++++++++++++++++++-
.../idp/flows/sp/initiator/saml2/saml2-flow.xml | 2 +-
.../flows/saml2/SAML2SessionInitiatorFlowTest.java | 27 ++++++++++++++--
3 files changed, 60 insertions(+), 5 deletions(-)
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml
index 6c72d4f..f4d4b93 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml
@@ -87,7 +87,7 @@
p:defaultIdentifierGenerationStrategy-ref="shibboleth.DefaultIdentifierGenerationStrategy" />
</property>
</bean>
-
+
<!-- Default formats not to encrypt. -->
<util:set id="DefaultPlaintextNameIDFormats">
<util:constant static-field="org.opensaml.saml.saml2.core.NameIDType.ENTITY" />
@@ -137,6 +137,40 @@
</property>
</bean>
+ <bean id="IssueCorrelationCookie" class="net.shibboleth.sp.profile.impl.IssueCorrelationCookie" scope="prototype"
+ p:cookieManager-ref="shibboleth.RemotedCookieManager"
+ p:cookiePrefix="%{sp.correlation.cookiePrefix:_Host-_shibsp_req_}"
+ p:createOutputObjects="true"
+ p:errorFatal="%{sp.stateToken.errorsFatal:false}"
+ p:requestIDLookupStrategy-ref="RequestIDStrategy"
+ p:passiveRequestPredicate-ref="PassivePredicate" />
+
+ <bean id="RequestIDStrategy" parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLMessageInfoContextIDFunction" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.ChildLookupOrCreate.SAMLMessageInfoContext"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </constructor-arg>
+ </bean>
+
+ <bean id="PassivePredicate" class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean class="net.shibboleth.idp.saml.audit.impl.IsPassiveAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.AuthnRequest"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </constructor-arg>
+ </bean>
+ </constructor-arg>
+ <constructor-arg>
+ <ref bean="shibboleth.Conditions.FALSE" />
+ </constructor-arg>
+ </bean>
+
<bean id="messageEncoderFactory" class="net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory" />
<bean id="EncodeMessage" class="net.shibboleth.sp.profile.impl.EncodeMessage" scope="prototype"
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-flow.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-flow.xml
index 9a413e9..df9abda 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-flow.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-flow.xml
@@ -15,7 +15,6 @@
<evaluate expression="InitializeOutboundMessageContext" />
<evaluate expression="InitializeMessageChannelSecurityContext" />
- <!-- TODO: RelayState handling so it's populated on the inbound side... -->
<evaluate expression="PopulateBindingAndEndpointContexts" />
<evaluate expression="PopulateRequestSignatureSigningParameters" />
@@ -25,6 +24,7 @@
<evaluate expression="EncryptNameIDs" />
<evaluate expression="HandleOutboundMessage" />
+ <evaluate expression="IssueCorrelationCookie" />
<evaluate expression="EncodeMessage" />
<evaluate expression="'proceed'" />
diff --git a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2SessionInitiatorFlowTest.java b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2SessionInitiatorFlowTest.java
index 5e680b7..c1265ef 100644
--- a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2SessionInitiatorFlowTest.java
+++ b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2SessionInitiatorFlowTest.java
@@ -51,8 +51,10 @@ import net.shibboleth.sp.context.AgentRequestContext;
import net.shibboleth.sp.ddf.DDF;
import net.shibboleth.sp.flows.AbstractSPFlowTest;
import net.shibboleth.sp.messaging.RemotedHttpServletRequest;
+import net.shibboleth.sp.messaging.RemotedHttpServletResponse;
import net.shibboleth.sp.profile.InitiatorConstants;
import net.shibboleth.sp.profile.SPConstants;
+import net.shibboleth.sp.profile.impl.IssueCorrelationCookie;
import net.shibboleth.sp.saml.saml2.profile.SAML2InitiatorConstants;
/**
@@ -577,11 +579,11 @@ public class SAML2SessionInitiatorFlowTest extends AbstractSPFlowTest {
assert output != null;
Assert.assertTrue(output.isstruct());
- final DDF http = output.getmember("http");
+ final DDF http = output.getmember(RemotedHttpServletResponse.STRUCTURE_NAME);
Assert.assertTrue(http.isstruct());
final AuthnRequest authnRequest;
- final byte[] redirect = http.getmember("redirect").unsafe_string();
+ final byte[] redirect = http.getmember(RemotedHttpServletResponse.REDIRECT).unsafe_string();
if (redirect != null) {
final String redirectURL = new String(redirect, StandardCharsets.UTF_8);
final SAMLObject saml = decodeRedirect(redirectURL,
@@ -603,7 +605,26 @@ public class SAML2SessionInitiatorFlowTest extends AbstractSPFlowTest {
assert authnRequest != null;
Assert.assertNotNull(authnRequest.getID());
Assert.assertTrue(Instant.now().isAfter(authnRequest.getIssueInstant()));
-
+
+ if (input != null) {
+ boolean foundCorrelationCookie = false;
+ for (final DDF header : http.getmember(RemotedHttpServletResponse.HEADERS)) {
+ if ("Set-Cookie".equals(header.name())) {
+ final String cookie = header.string();
+ assert cookie != null;
+ if (cookie.startsWith("_Host-" + IssueCorrelationCookie.DEFAULT_COOKIE_PREFIX)) {
+ final Boolean passive = authnRequest.isPassive();
+ final String passiveDelim = passive ? "=T:" : "=F:";
+ Assert.assertEquals(cookie,
+ "_Host-_shibsp_req_" + input.getmember(SPConstants.STATE).string() + passiveDelim + authnRequest.getID()
+ + "; HttpOnly=true; Path=/; SameSite=None; Secure=true");
+ foundCorrelationCookie = true;
+ }
+ }
+ }
+ Assert.assertTrue(foundCorrelationCookie);
+ }
+
final NameIDPolicy pol = authnRequest.getNameIDPolicy();
assert pol != null;
assertTrue(pol.getAllowCreate());
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list