[java-plugin-shibd-saml] branch main updated: JSHIBDSAML-1 - Request/response correlation and passive tracking
Scott Cantor
cantor.2 at osu.edu
Tue Apr 15 18:24:52 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-saml.git;a=commit;h=96c00e50c768062e472e2f40f296e7c03dd0a2cb
The following commit(s) were added to refs/heads/main by this push:
new 96c00e5 JSHIBDSAML-1 - Request/response correlation and passive tracking
96c00e5 is described below
commit 96c00e50c768062e472e2f40f296e7c03dd0a2cb
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Apr 15 14:24:49 2025 -0400
JSHIBDSAML-1 - Request/response correlation and passive tracking
https://shibboleth.atlassian.net/browse/JSHIBDSAML-1
Wire in action to extract correlation ID and strategies to enforce it.
---
.../idp/flows/sp/consumer/saml2/saml2-beans.xml | 54 ++++++++++++++++------
.../idp/flows/sp/consumer/saml2/saml2-flow.xml | 1 +
.../idp/flows/sp/initiator/saml2/saml2-beans.xml | 22 ++++-----
.../net/shibboleth/sp/service/agent/postconfig.xml | 2 +
.../shibboleth/idp/module/conf/sp/saml.properties | 9 ++++
5 files changed, 64 insertions(+), 24 deletions(-)
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
index d5c1bd2..52e7ae1 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
@@ -22,21 +22,27 @@
</constructor-arg>
</bean>
+ <bean id="ProcessCorrelationCookie" class="net.shibboleth.sp.profile.impl.ProcessCorrelationCookie" scope="prototype"
+ p:cookieManager-ref="shibboleth.RemotedCookieManager"
+ p:cookiePrefix="%{sp.correlation.cookiePrefix:_Host-_shibsp_req_}"
+ p:createOutputObjects="true"
+ p:stateTokenLookupStrategy-ref="RelayStateLookupStrategy" />
+
+ <bean id="RelayStateLookupStrategy" parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean parent="shibboleth.Functions.Expression"
+ c:_0="#input != null ? T(org.opensaml.saml.common.binding.SAMLBindingSupport).getRelayState(#input) : null" />
+ </constructor-arg>
+ <constructor-arg name="f" ref="shibboleth.MessageContextLookup.Inbound"/>
+ </bean>
+
+
<bean id="HandleResponse" class="net.shibboleth.sp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
c:executionDirection="INBOUND">
<constructor-arg>
<bean class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
<property name="handlers">
<list>
- <!--
- Don't know how to deal woth this, the usual MessageContext/PRC paradox/mess.
-
- <bean class="org.opensaml.saml.common.binding.security.impl.InResponseToSecurityHandler" scope="prototype">
- <property name="activationCondition">
- <bean class="net.shibboleth.saml.saml2.profile.config.logic.CheckInResponseToPredicate" />
- </property>
- </bean>
- -->
<bean class="org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler" scope="prototype"
p:checkDuringInit="false"
p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier" />
@@ -120,12 +126,36 @@
c:expression="T(net.shibboleth.shared.collection.CollectionSupport).singleton(#custom.apply(#input.ensureInboundMessageContext()))"
p:customObject-ref="InboundEntityIDLookup" />
</property>
+ <property name="inResponseTo">
+ <bean parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="net.shibboleth.sp.profile.context.navigate.MessageCorrelationIDLookupFunction" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <bean parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+ c:type="#{ T(net.shibboleth.sp.context.TokenConsumerContext) }" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <bean class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+ c:type="#{ T(net.shibboleth.sp.context.AgentRequestContext) }" />
+ </constructor-arg>
+ </bean>
+ </constructor-arg>
+ </bean>
+ </property>
<property name="requireEntityIssuer">
<ref bean="shibboleth.Conditions.TRUE" />
</property>
<property name="checkAddress">
<bean class="net.shibboleth.saml.saml2.profile.config.logic.CheckAddressPredicate" />
</property>
+ <!-- This effectively determines whether unsolicited responses work. -->
+ <property name="inResponseToRequired">
+ <bean class="net.shibboleth.saml.saml2.profile.config.logic.CheckInResponseToPredicate" />
+ </property>
+ <!-- This accomodates broken IdPs or problems getting correlation to work. -->
<property name="inResponseToIgnored">
<bean parent="shibboleth.Conditions.NOT">
<constructor-arg>
@@ -151,10 +181,8 @@
<util:constant static-field="org.opensaml.saml.saml2.core.AudienceRestriction.DEFAULT_ELEMENT_NAME" />
</set>
</property>
- <!-- TODO: wire up to unsolicited response control point. -->
- <property name="inResponseToRequired" value="false" />
- <property name="recipientRequired" value="true" />
- <property name="notOnOrAfterRequired" value="true" />
+ <property name="recipientRequired" value="%{sp.saml.checkRecipient:true}" />
+ <property name="notOnOrAfterRequired" value="%{sp.saml.checkNotOnOrAfter:true}" />
</bean>
<bean id="ValidateAssertions"
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
index 06ea41b..051b125 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-flow.xml
@@ -9,6 +9,7 @@
<!-- <evaluate expression="PostDecodePopulateAuditContext" />-->
<evaluate expression="CheckMessageVersion" />
+ <evaluate expression="ProcessCorrelationCookie" />
<evaluate expression="SAMLProtocolAndRole" />
<evaluate expression="SAMLMetadataLookup" />
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml
index f4d4b93..c32d55c 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml
@@ -59,11 +59,11 @@
</bean>
<bean id="PopulateEncryptionParameters"
- class="net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters" scope="prototype"
- p:configurationLookupStrategy-ref="shibboleth.EncryptionConfigurationLookup"
- p:encryptionParametersResolver-ref="shibboleth.EncryptionParametersResolver"
- p:protocol-ref="shibboleth.MetadataLookup.Protocol"
- p:role-ref="shibboleth.MetadataLookup.Role" />
+ class="net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters" scope="prototype"
+ p:configurationLookupStrategy-ref="shibboleth.EncryptionConfigurationLookup"
+ p:encryptionParametersResolver-ref="shibboleth.EncryptionParametersResolver"
+ p:protocol-ref="shibboleth.MetadataLookup.Protocol"
+ p:role-ref="shibboleth.MetadataLookup.Role" />
<util:map id="InboundSAML2BindingMap">
<entry key="POST">
@@ -138,12 +138,12 @@
</bean>
<bean id="IssueCorrelationCookie" class="net.shibboleth.sp.profile.impl.IssueCorrelationCookie" scope="prototype"
- p:cookieManager-ref="shibboleth.RemotedCookieManager"
- p:cookiePrefix="%{sp.correlation.cookiePrefix:_Host-_shibsp_req_}"
- p:createOutputObjects="true"
- p:errorFatal="%{sp.stateToken.errorsFatal:false}"
- p:requestIDLookupStrategy-ref="RequestIDStrategy"
- p:passiveRequestPredicate-ref="PassivePredicate" />
+ p:cookieManager-ref="shibboleth.RemotedCookieManager"
+ p:cookiePrefix="%{sp.correlation.cookiePrefix:_Host-_shibsp_req_}"
+ p:createOutputObjects="true"
+ p:errorFatal="%{sp.stateToken.errorsFatal:false}"
+ p:requestIDLookupStrategy-ref="RequestIDStrategy"
+ p:passiveRequestPredicate-ref="PassivePredicate" />
<bean id="RequestIDStrategy" parent="shibboleth.Functions.Compose">
<constructor-arg name="g">
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
index fc273c7..ce2ed0b 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
@@ -28,6 +28,8 @@
class="net.shibboleth.sp.saml.saml2.profile.config.impl.BrowserSSOProfileConfiguration"
p:securityConfiguration-ref="shibboleth.DefaultXMLSecurityConfiguration"
p:encryptionOptionalPredicate="%{sp.saml.encryption.optional:true}"
+ p:checkAddress="%{sp.saml.checkAddress:true}"
+ p:checkInResponseTo="%{sp.saml.checkInResoonseTo:false}"
p:extractStandardAttributes="%{sp.saml.extractStandardAttributes:false}" />
<util:constant id="SAML2.SSO.FEATURE_AUTHNCONTEXT"
diff --git a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
index 1d75b95..e2a6aec 100644
--- a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
+++ b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
@@ -10,7 +10,16 @@ sp.saml.encryption.cert = %{idp.home}/credentials/sp/sp-encryption.crt
#sp.saml.encryption.key.2 = %{idp.home}/credentials/sp/sp-encryption-old.key
#sp.saml.encryption.cert.2 = %{idp.home}/credentials/sp/sp-encryption-old.crt
+# Profile defaults, can be overridden globally or per-Agent/Application/IdP
#sp.saml.encryption.optional = true
+# TODO: The next two are global only at the moment.
+#sp.saml.checkRecipient = true
+#sp.saml.checkNotOnOrAfter = true
+# Turn off to disable address check during assertion validation
+#sp.saml.checkAddress = true
+# Turn on to disallow unsolicited SSO responses
+#sp.saml.checkInResponseTo = false
+
# Default security configuration for SAML
#sp.saml.security.config = shibboleth.DefaultXMLSecurityConfiguration
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list