[java-plugin-shibd-saml] branch main updated: Alterations to session initiator flow for alignment with agent code.
Scott Cantor
cantor.2 at osu.edu
Mon Feb 10 15:10:53 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd-saml.git;a=commit;h=8dbf101c6a62cf4d5b6d1da1fd80a5efd445bf80
The following commit(s) were added to refs/heads/main by this push:
new 8dbf101 Alterations to session initiator flow for alignment with agent code.
8dbf101 is described below
commit 8dbf101c6a62cf4d5b6d1da1fd80a5efd445bf80
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Feb 10 10:10:50 2025 -0500
Alterations to session initiator flow for alignment with agent code.
---
.../saml2/profile/SAML2InitiatorConstants.java | 31 ++++-
.../idp/flows/sp/initiator/saml2/saml2-beans.xml | 12 ++
.../flows/saml2/SAML2SessionInitiatorFlowTest.java | 32 +++---
.../saml/saml2/profile/impl/AddAuthnRequest.java | 128 ++++++++++++++++++---
4 files changed, 165 insertions(+), 38 deletions(-)
diff --git a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/SAML2InitiatorConstants.java b/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/SAML2InitiatorConstants.java
index 7e74962..3d2ac82 100644
--- a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/SAML2InitiatorConstants.java
+++ b/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/SAML2InitiatorConstants.java
@@ -16,15 +16,42 @@ package net.shibboleth.sp.saml.saml2.profile;
import javax.annotation.Nonnull;
+import org.opensaml.saml.saml2.core.AuthnContextClassRef;
+import org.opensaml.saml.saml2.core.NameIDPolicy;
+import org.opensaml.saml.saml2.metadata.NameIDFormat;
+
import net.shibboleth.shared.annotation.constraint.NotEmpty;
/**
- * Constants for session initiator operations.
+ * Constants for SAML 2.0 session initiator operations.
+ *
+ * <p>Most are named for compatibility with settings used in older SP versions.</p>
*/
public final class SAML2InitiatorConstants {
+ /** ForceAuthn input parameter. */
+ @Nonnull @NotEmpty public static final String FORCE_AUTHN = "forceAuthn";
+
+ /** IsPassive input parameter. */
+ @Nonnull @NotEmpty public static final String IS_PASSIVE = "isPassive";
+
+ /** authnContextClassRef input parameter. */
+ @Nonnull @NotEmpty public static final String AUTHN_CONTEXT_CLASS_REF = AuthnContextClassRef.DEFAULT_ELEMENT_LOCAL_NAME;
+
+ /** authnContextComparison input parameter. */
+ @Nonnull @NotEmpty public static final String AUTHN_CONTEXT_COMPARISON = "authnContextComparison";
+
+ /** AttributeConsumingServiceIndex input parameter. */
+ @Nonnull @NotEmpty public static final String ATTRIBUTE_INDEX = "attributeIndex";
+
+ /** NameIDFormat input parameter. */
+ @Nonnull @NotEmpty public static final String NAMEID_FORMAT = NameIDFormat.DEFAULT_ELEMENT_LOCAL_NAME;
+
+ /** SPNameQualifier input parameter. */
+ @Nonnull @NotEmpty public static final String SP_NAME_QUALIFIER = NameIDPolicy.SP_NAME_QUALIFIER_ATTRIB_NAME;
+
/** Private constructor. */
private SAML2InitiatorConstants() {
-
+
}
}
\ No newline at end of file
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml
index 5c98607..3f69126 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml
@@ -65,6 +65,18 @@
p:protocol-ref="shibboleth.MetadataLookup.Protocol"
p:role-ref="shibboleth.MetadataLookup.Role" />
+ <util:map id="InboundSAML2BindingMap">
+ <entry key="POST">
+ <ref bean="shibboleth.Binding.SAML2POST" />
+ </entry>
+ <entry key="POST-SimpleSign">
+ <ref bean="shibboleth.Binding.SAML2POSTSimpleSign" />
+ </entry>
+ <entry key="Artifact">
+ <ref bean="shibboleth.Binding.SAML2Artifact" />
+ </entry>
+ </util:map>
+
<bean id="AddAuthnRequest"
class="net.shibboleth.sp.saml.saml2.profile.impl.AddAuthnRequest" scope="prototype"
p:overwriteExisting="true"
diff --git a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2SessionInitiatorFlowTest.java b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2SessionInitiatorFlowTest.java
index b95d042..25c9bc5 100644
--- a/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2SessionInitiatorFlowTest.java
+++ b/sp-saml-conf-impl/src/test/java/net/shibboleth/sp/saml/flows/saml2/SAML2SessionInitiatorFlowTest.java
@@ -29,13 +29,11 @@ import org.opensaml.saml.common.SAMLObject;
import org.opensaml.saml.common.binding.SAMLBindingSupport;
import org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder;
import org.opensaml.saml.saml2.core.AuthnContext;
-import org.opensaml.saml.saml2.core.AuthnContextClassRef;
import org.opensaml.saml.saml2.core.AuthnContextComparisonTypeEnumeration;
import org.opensaml.saml.saml2.core.AuthnRequest;
import org.opensaml.saml.saml2.core.NameIDPolicy;
import org.opensaml.saml.saml2.core.NameIDType;
import org.opensaml.saml.saml2.core.RequestedAuthnContext;
-import org.opensaml.saml.saml2.metadata.NameIDFormat;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.web.WebAppConfiguration;
@@ -51,8 +49,9 @@ import net.shibboleth.shared.primitive.NonnullSupplier;
import net.shibboleth.sp.context.AgentRequestContext;
import net.shibboleth.sp.ddf.DDF;
import net.shibboleth.sp.flows.AbstractSPFlowTest;
-import net.shibboleth.sp.messaging.RemotedHttpServletRequest;
import net.shibboleth.sp.profile.InitiatorConstants;
+import net.shibboleth.sp.profile.SPConstants;
+import net.shibboleth.sp.saml.saml2.profile.SAML2InitiatorConstants;
/**
* Unit test for the SP session-initiator flow.
@@ -164,7 +163,7 @@ public class SAML2SessionInitiatorFlowTest extends AbstractSPFlowTest {
final DDF input = new DDF(null).structure();
input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- input.addmember(InitiatorConstants.STATE).string("foostate");
+ input.addmember(SPConstants.STATE).string("foostate");
setApplicationRequest(APPLICATION_ID, input);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
@@ -192,9 +191,8 @@ public class SAML2SessionInitiatorFlowTest extends AbstractSPFlowTest {
final DDF input = new DDF(null).structure();
input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- final DDF httpreq = input.addmember(RemotedHttpServletRequest.STRUCTURE_NAME);
- httpreq.addmember(RemotedHttpServletRequest.REQUEST_URL).unsafe_string("https://sp.example.org/cgi-bin/test.cgi".getBytes());
- httpreq.addmember(RemotedHttpServletRequest.QUERY_STRING).unsafe_string("foo=bar%20baz&frobnitz=zorkmid".getBytes());
+ input.addmember(SPConstants.TARGET).unsafe_string("https://sp.example.org/cgi-bin/test.cgi?foo=bar%20baz&frobnitz=zorkmid".getBytes(StandardCharsets.UTF_8));
+
setApplicationRequest(APPLICATION_ID, input);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
@@ -222,7 +220,7 @@ public class SAML2SessionInitiatorFlowTest extends AbstractSPFlowTest {
final DDF input = new DDF(null).structure();
input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- input.addmember(AuthnRequest.FORCE_AUTHN_ATTRIB_NAME).integer(1);
+ input.addmember(SAML2InitiatorConstants.FORCE_AUTHN).integer(1);
setApplicationRequest(APPLICATION_ID, input);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
@@ -250,7 +248,7 @@ public class SAML2SessionInitiatorFlowTest extends AbstractSPFlowTest {
final DDF input = new DDF(null).structure();
input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- input.addmember(AuthnRequest.FORCE_AUTHN_ATTRIB_NAME).integer(1);
+ input.addmember(SAML2InitiatorConstants.FORCE_AUTHN).integer(1);
setApplicationRequest("feature-blocking", input);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
@@ -278,7 +276,7 @@ public class SAML2SessionInitiatorFlowTest extends AbstractSPFlowTest {
final DDF input = new DDF(null).structure();
input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- input.addmember(AuthnRequest.IS_PASSIVE_ATTRIB_NAME).integer(1);
+ input.addmember(SAML2InitiatorConstants.IS_PASSIVE).integer(1);
setApplicationRequest(APPLICATION_ID, input);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
@@ -306,7 +304,7 @@ public class SAML2SessionInitiatorFlowTest extends AbstractSPFlowTest {
final DDF input = new DDF(null).structure();
input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- input.addmember(NameIDFormat.DEFAULT_ELEMENT_LOCAL_NAME).string(NameIDType.EMAIL);
+ input.addmember(SAML2InitiatorConstants.NAMEID_FORMAT).string(NameIDType.EMAIL);
setApplicationRequest(APPLICATION_ID, input);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
@@ -334,7 +332,7 @@ public class SAML2SessionInitiatorFlowTest extends AbstractSPFlowTest {
final DDF input = new DDF(null).structure();
input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- input.addmember(NameIDFormat.DEFAULT_ELEMENT_LOCAL_NAME).string(NameIDType.EMAIL);
+ input.addmember(SAML2InitiatorConstants.NAMEID_FORMAT).string(NameIDType.EMAIL);
setApplicationRequest("feature-blocking", input);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
@@ -362,10 +360,10 @@ public class SAML2SessionInitiatorFlowTest extends AbstractSPFlowTest {
final DDF input = new DDF(null).structure();
input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- final DDF aclist = input.addmember(AuthnContextClassRef.DEFAULT_ELEMENT_LOCAL_NAME).list();
+ final DDF aclist = input.addmember(SAML2InitiatorConstants.AUTHN_CONTEXT_CLASS_REF).list();
aclist.add(new DDF(null).string(AuthnContext.X509_AUTHN_CTX));
aclist.add(new DDF(null).string(AuthnContext.TIME_SYNC_TOKEN_AUTHN_CTX));
- input.addmember("AuthnContextComparison").string(AuthnContextComparisonTypeEnumeration.MINIMUM.toString());
+ input.addmember(SAML2InitiatorConstants.AUTHN_CONTEXT_COMPARISON).string(AuthnContextComparisonTypeEnumeration.MINIMUM.toString());
setApplicationRequest(APPLICATION_ID, input);
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
@@ -399,7 +397,7 @@ public class SAML2SessionInitiatorFlowTest extends AbstractSPFlowTest {
final DDF input = new DDF(null).structure();
input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- final DDF aclist = input.addmember(AuthnContextClassRef.DEFAULT_ELEMENT_LOCAL_NAME).list();
+ final DDF aclist = input.addmember(SAML2InitiatorConstants.AUTHN_CONTEXT_CLASS_REF).list();
aclist.add(new DDF(null).string(AuthnContext.X509_AUTHN_CTX));
aclist.add(new DDF(null).string(AuthnContext.TIME_SYNC_TOKEN_AUTHN_CTX));
setApplicationRequest("feature-blocking", input);
@@ -445,7 +443,7 @@ public class SAML2SessionInitiatorFlowTest extends AbstractSPFlowTest {
if (redirect != null) {
final String redirectURL = new String(redirect, StandardCharsets.UTF_8);
final SAMLObject saml = decodeRedirect(redirectURL,
- input != null ? input.getmember(InitiatorConstants.STATE).string() : null);
+ input != null ? input.getmember(SPConstants.STATE).string() : null);
assert saml instanceof AuthnRequest;
authnRequest = (AuthnRequest) saml;
Assert.assertTrue(redirectURL.startsWith(authnRequest.getDestination()));
@@ -457,7 +455,7 @@ public class SAML2SessionInitiatorFlowTest extends AbstractSPFlowTest {
assert saml instanceof AuthnRequest;
authnRequest = (AuthnRequest) saml;
Assert.assertEquals(SAMLBindingSupport.getRelayState(prc.ensureOutboundMessageContext()),
- input != null ? input.getmember(InitiatorConstants.STATE).string() : null);
+ input != null ? input.getmember(SPConstants.STATE).string() : null);
}
assert authnRequest != null;
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/AddAuthnRequest.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/AddAuthnRequest.java
index 69ab38e..1d57a4c 100644
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/AddAuthnRequest.java
+++ b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/AddAuthnRequest.java
@@ -17,6 +17,8 @@ package net.shibboleth.sp.saml.saml2.profile.impl;
import java.time.Instant;
import java.util.Collection;
import java.util.List;
+import java.util.Map;
+import java.util.Optional;
import java.util.function.Function;
import java.util.stream.Collectors;
@@ -34,6 +36,8 @@ import net.shibboleth.shared.security.IdentifierGenerationStrategy;
import net.shibboleth.sp.ddf.DDF;
import net.shibboleth.sp.profile.AbstractApplicationAction;
import net.shibboleth.sp.profile.InitiatorConstants;
+import net.shibboleth.sp.profile.SPConstants;
+import net.shibboleth.sp.saml.saml2.profile.SAML2InitiatorConstants;
import net.shibboleth.sp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
import org.opensaml.core.xml.XMLObjectBuilderFactory;
@@ -62,7 +66,6 @@ import org.opensaml.saml.saml2.core.NameIDPolicy;
import org.opensaml.saml.saml2.core.RequestedAuthnContext;
import org.opensaml.saml.saml2.core.Scoping;
import org.opensaml.saml.saml2.core.Subject;
-import org.opensaml.saml.saml2.metadata.NameIDFormat;
import org.opensaml.saml.saml2.metadata.RequestedAttribute;
import org.slf4j.Logger;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -109,6 +112,9 @@ public class AddAuthnRequest extends AbstractApplicationAction {
/** Optional strategy to populate request with a {@link NameID}. */
@Nullable private Function<ProfileRequestContext,NameID> nameIDLookupStrategy;
+ /** Map of agent binding tokens to SAML binding constants. */
+ @Nonnull private Map<String,String> inboundBindingMap;
+
/** The generator to use. */
@NonnullBeforeExec private IdentifierGenerationStrategy idGenerator;
@@ -128,6 +134,8 @@ public class AddAuthnRequest extends AbstractApplicationAction {
issuerLookupStrategy = new IssuerLookupFunction();
relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
+
+ inboundBindingMap = CollectionSupport.emptyMap();
}
/**
@@ -197,6 +205,25 @@ public class AddAuthnRequest extends AbstractApplicationAction {
checkSetterPreconditions();
nameIDLookupStrategy = strategy;
}
+
+ /**
+ * Set mapping of legacy binding tokens to SAML binding constants.
+ *
+ * <p>This is a legacy compatibility feature allowing binding-specific response endpoints to be supported.
+ * Agents will supply a structure that maps endpoints to binding tokens (e.g., POST, Artifact) and this
+ * mapping determines the binding constants to use in requests. This is a simplification to avoid contaminating
+ * agents with SAML constants.</p>
+ *
+ * @param map binding map
+ */
+ public void setInboundBindingMap(@Nullable final Map<String,String> map) {
+ checkSetterPreconditions();
+ if (map != null) {
+ inboundBindingMap = CollectionSupport.copyToMap(map);
+ } else {
+ inboundBindingMap = CollectionSupport.emptyMap();
+ }
+ }
/** {@inheritDoc} */
@Override
@@ -268,11 +295,14 @@ public class AddAuthnRequest extends AbstractApplicationAction {
object.setIssueInstant(Instant.now());
object.setVersion(SAMLVersion.VERSION_20);
- // Response URL always comes from agent.
- object.setAssertionConsumerServiceURL(input.getmember(InitiatorConstants.RESPONSE_URL).string());
- // Protocol binding always comes from config, may be null.
- object.setProtocolBinding(profileConfiguration.getResponseBinding(profileRequestContext));
-
+ if (!setResponseEndpoint(profileRequestContext, object)) {
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
+ return;
+ }
+
+ log.debug("{} Response endpoint ({}), binding ({})", getLogPrefix(),
+ object.getAssertionConsumerServiceURL(), object.getProtocolBinding());
+
if (issuerId != null) {
log.debug("{} Setting Issuer to {}", getLogPrefix(), issuerId);
final SAMLObjectBuilder<Issuer> issuerBuilder =
@@ -284,7 +314,7 @@ public class AddAuthnRequest extends AbstractApplicationAction {
log.debug("{} No issuer value available, leaving Issuer unset", getLogPrefix());
}
- Integer index = input.getmember(AuthnRequest.ATTRIBUTE_CONSUMING_SERVICE_INDEX_ATTRIB_NAME).integer();
+ Integer index = input.getmember(SAML2InitiatorConstants.ATTRIBUTE_INDEX).integer();
if (index == null) {
index = profileConfiguration.getAttributeIndex(profileRequestContext);
}
@@ -295,9 +325,9 @@ public class AddAuthnRequest extends AbstractApplicationAction {
setForceAuthn(profileRequestContext, object);
- final Integer passive = input.getmember(AuthnRequest.IS_PASSIVE_ATTRIB_NAME).integer();
+ final Integer passive = input.getmember(SAML2InitiatorConstants.IS_PASSIVE).integer();
if (passive != null && passive == 1) {
- log.debug("{} Setting IsPassive", getLogPrefix());
+ log.debug("{} Setting IsPassive to true", getLogPrefix());
object.setIsPassive(true);
}
@@ -313,7 +343,7 @@ public class AddAuthnRequest extends AbstractApplicationAction {
profileRequestContext.ensureOutboundMessageContext().setMessage(object);
// Check for RelayState.
- final String relayState = input.getmember(InitiatorConstants.STATE).string();
+ final String relayState = input.getmember(SPConstants.STATE).string();
if (relayState != null) {
SAMLBindingSupport.setRelayState(profileRequestContext.ensureOutboundMessageContext(), relayState);
}
@@ -321,6 +351,67 @@ public class AddAuthnRequest extends AbstractApplicationAction {
log.info("{} Generated AuthnRequest with ID {} from {}", getLogPrefix(), object.getID(), issuerId);
}
+ /**
+ * Sets the response endpoint and binding attributes in the request.
+ *
+ * <p>This is messy due to support for legacy SPs avoiding metadata changes by
+ * allowing for the older design of an endpoint per binding. Some of these cases
+ * aren't expected to arise but are implemented for completeness.</p>
+ *
+ * @param profileRequestContext profile request context
+ * @param authnRequest request message
+ *
+ * @return true iff successful in picking an endpoint
+ */
+ private boolean setResponseEndpoint(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Nonnull final AuthnRequest authnRequest) {
+
+ DDF response_url = input.getmember(InitiatorConstants.RESPONSE_URL);
+
+ // Check for a single URL.
+ if (response_url.isstring()) {
+ authnRequest.setAssertionConsumerServiceURL(response_url.string());
+ // Protocol binding comes from config, may be null.
+ authnRequest.setProtocolBinding(profileConfiguration.getResponseBinding(profileRequestContext));
+ return true;
+ }
+
+ final List<DDF> endpoints = response_url.asList();
+ if (endpoints.isEmpty()) {
+ // No endpoints were supplied, so we have to rely on the IdP selecting a default.
+ // Protocol binding comes from config, may be null.
+ authnRequest.setProtocolBinding(profileConfiguration.getResponseBinding(profileRequestContext));
+ return true;
+ }
+
+ final String binding = profileConfiguration.getResponseBinding(profileRequestContext);
+ if (binding == null || inboundBindingMap.isEmpty()) {
+ // We have no means of determining which of multiple endpoints would match the intended binding,
+ // or no specific binding is required, so we have to just pick the first endpoint.
+ authnRequest.setAssertionConsumerServiceURL(endpoints.get(0).string());
+ // Protocol binding comes from config, may be null.
+ authnRequest.setProtocolBinding(binding);
+ return true;
+ }
+
+ // The most complex case: we have multiple options, a specified binding to use, and a
+ // need to locate a match using the binding map. This is essentially the legacy case
+ // for preserving support for per-binding endpoints from the older SP.
+ final Optional<DDF> match = endpoints.stream()
+ .filter(e -> { return binding.equals(inboundBindingMap.get(e.name())); })
+ .findFirst();
+ if (match.isPresent()) {
+ authnRequest.setAssertionConsumerServiceURL(match.get().string());
+ authnRequest.setProtocolBinding(inboundBindingMap.get(match.get().name()));
+ return true;
+ } else {
+ // There's no match for the binding specified in the set of endpoints we were given.
+ // This is an outright failure.
+ log.warn("{} No response endpoint supplied matching binding ({})", getLogPrefix(), binding);
+ return false;
+ }
+ }
+
/**
* Set ForceAuthn appropriately.
*
@@ -330,20 +421,20 @@ public class AddAuthnRequest extends AbstractApplicationAction {
private void setForceAuthn(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AuthnRequest authnRequest) {
- final Integer forceAuthn = input.getmember(AuthnRequest.FORCE_AUTHN_ATTRIB_NAME).integer();
+ final Integer forceAuthn = input.getmember(SAML2InitiatorConstants.FORCE_AUTHN).integer();
if (forceAuthn != null) {
if (profileConfiguration.isFeatureDisallowed(profileRequestContext,
BrowserSSOProfileConfiguration.FEATURE_FORCEAUTHN)) {
log.warn("{} Agent disallowed from overriding ForceAuthn", getLogPrefix());
} else if (forceAuthn == 1) {
- log.debug("{} Setting ForceAuthn", getLogPrefix());
+ log.debug("{} Setting ForceAuthn to true", getLogPrefix());
authnRequest.setForceAuthn(true);
return;
}
}
if (profileConfiguration.isForceAuthn(profileRequestContext)) {
- log.debug("{} Setting ForceAuthn", getLogPrefix());
+ log.debug("{} Setting ForceAuthn to true", getLogPrefix());
authnRequest.setForceAuthn(true);
}
}
@@ -362,7 +453,7 @@ public class AddAuthnRequest extends AbstractApplicationAction {
final NameIDPolicy nip = builder.buildObject();
nip.setAllowCreate(true);
- String format = input.getmember(NameIDFormat.DEFAULT_ELEMENT_LOCAL_NAME).string();
+ String format = input.getmember(SAML2InitiatorConstants.NAMEID_FORMAT).string();
if (format != null && profileConfiguration.isFeatureDisallowed(profileRequestContext,
BrowserSSOProfileConfiguration.FEATURE_NAMEIDFORMAT)) {
log.warn("{} Agent disallowed from overriding NameIDPolicy Format", getLogPrefix());
@@ -378,7 +469,7 @@ public class AddAuthnRequest extends AbstractApplicationAction {
nip.setFormat(format);
}
- String qualifier = input.getmember(NameIDPolicy.SP_NAME_QUALIFIER_ATTRIB_NAME).string();
+ String qualifier = input.getmember(SAML2InitiatorConstants.SP_NAME_QUALIFIER).string();
if (qualifier != null) {
if (profileConfiguration.isFeatureDisallowed(profileRequestContext,
BrowserSSOProfileConfiguration.FEATURE_SPNAMEQUALIFIER)) {
@@ -409,7 +500,7 @@ public class AddAuthnRequest extends AbstractApplicationAction {
@Nullable private RequestedAuthnContext buildRequestedAuthnContext(
@Nullable final ProfileRequestContext profileRequestContext) {
- List<String> classrefs = input.getmember(AuthnContextClassRef.DEFAULT_ELEMENT_LOCAL_NAME).asList()
+ List<String> classrefs = input.getmember(SAML2InitiatorConstants.AUTHN_CONTEXT_CLASS_REF).asList()
.stream()
.map(DDF::string)
.collect(CollectionSupport.nonnullCollector(Collectors.toUnmodifiableList())).get();
@@ -447,7 +538,7 @@ public class AddAuthnRequest extends AbstractApplicationAction {
rac.getAuthnContextClassRefs().add(obj);
});
- String opstring = input.getmember("AuthnContextComparison").string();
+ String opstring = input.getmember(SAML2InitiatorConstants.AUTHN_CONTEXT_COMPARISON).string();
if (opstring != null && profileConfiguration.isFeatureDisallowed(profileRequestContext,
BrowserSSOProfileConfiguration.FEATURE_AUTHNCONTEXT)) {
log.warn("{} Agent disallowed from overriding RequestedAuthnContext operator", getLogPrefix());
@@ -483,8 +574,7 @@ public class AddAuthnRequest extends AbstractApplicationAction {
*/
@Nullable private Subject buildSubject(@Nonnull final ProfileRequestContext profileRequestContext) {
- final NameID nameID = nameIDLookupStrategy != null
- ? nameIDLookupStrategy.apply(profileRequestContext) : null;
+ final NameID nameID = nameIDLookupStrategy != null ? nameIDLookupStrategy.apply(profileRequestContext) : null;
if (nameID == null) {
return null;
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list