[java-plugin-shibd] branch main updated: Config improvements around discovery.
Scott Cantor
cantor.2 at osu.edu
Tue Jul 1 20:08:54 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=8e1e4df7f1e911812bf54c9a9930c6290c451703
The following commit(s) were added to refs/heads/main by this push:
new 8e1e4df Config improvements around discovery.
8e1e4df is described below
commit 8e1e4df7f1e911812bf54c9a9930c6290c451703
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jul 1 16:08:48 2025 -0400
Config improvements around discovery.
---
.../idp/flows/sp/initiator/disco/disco-beans.xml | 12 ++++++----
.../net/shibboleth/idp/module/conf/sp/agents.xml | 1 -
.../shibboleth/idp/module/conf/sp/sp.properties | 7 ++++++
.../net/shibboleth/sp/conf/agents-system.xml | 1 +
.../shibboleth/sp/conf/relying-party-system.xml | 1 +
.../sp/profile/AbstractAgentRequestAction.java | 4 ++--
.../impl/ValidateSessionInitiatorRequest.java | 26 +++++++++++++++++-----
7 files changed, 40 insertions(+), 12 deletions(-)
diff --git a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/disco/disco-beans.xml b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/disco/disco-beans.xml
index d0c3754..e50a266 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/disco/disco-beans.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/disco/disco-beans.xml
@@ -14,13 +14,17 @@
<bean id="ValidateSessionInitiatorRequest"
class="net.shibboleth.sp.profile.impl.ValidateSessionInitiatorRequest" scope="prototype"
- p:setRequireDiscoveryURL="true"
- p:setRequireRelyingPartyId="false" />
+ p:flowId="discovery"
+ p:requireDiscoveryURL="true"
+ p:requireRelyingPartyId="false" />
+ <bean id="DefaultDiscoveryURLStrategy" parent="shibboleth.Functions.Constant"
+ c:_0="#{'%{sp.discoveryURL:}'.trim()}" />
+
<bean id="IssueDiscoveryRequest"
class="net.shibboleth.sp.profile.impl.IssueDiscoveryRequest" scope="prototype"
+ p:httpServletResponseSupplier-ref="shibboleth.RemotedHttpServletResponseSupplier"
p:createOutputObjects="true"
- p:httpServletResponseSupplier-ref="shibboleth.RemotedHttpServletResponseSupplier" />
-
+ p:discoveryURLLookupStrategy="#{getObject('%{sp.discoveryURLFunction:DefaultDiscoveryURLStrategy}'.trim())}" />
</beans>
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
index 1364e85..8842a62 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
@@ -27,7 +27,6 @@
<property name="applications">
<set>
<bean p:id="default" parent="shibboleth.Application"
- p:issuer="https://sp.example.org"
p:authenticatingAuthority="https://idp.example.org" />
</set>
</property>
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
index 5d8f41d..ed48880 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/sp.properties
@@ -1,3 +1,6 @@
+# Default issuer/entityID/client_id/etc.
+sp.issuer = https://sp.example.org
+
# Controls configuration of service to resolve SP agents and applications
# Uncomment and define to override service resources
#sp.service.agents.resources = shibboleth.AgentResolverResources
@@ -41,3 +44,7 @@ sp.service.agents.checkInterval = PT5M
# Request/response correlation control
#sp.correlation.cookiePrefix = _Host-_shibsp_req_
+
+# Uncomment/set to define a default IdP discovery service URL or Function
+#sp.discoveryURL =
+#sp.discoveryURLFunction =
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
index c1ca5f6..0864602 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
@@ -26,6 +26,7 @@
p:supportsCachedAuthentication="%{sp.agent.authn.cached:true}" />
<bean id="shibboleth.Application" class="net.shibboleth.sp.impl.BasicApplication" abstract="true"
+ p:issuer="#{'%{sp.issuer}'.trim()}"
p:metadataResolver-ref="shibboleth.MetadataResolverService"
p:attributeTranscoderRegistry-ref="shibboleth.AttributeRegistryService"
p:attributeResolver-ref="shibboleth.AttributeResolverService"
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml
index 640e017..8496c3f 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml
@@ -18,6 +18,7 @@
<!-- Parent bean for generic RelyingParty overrides that establishes defaults. -->
<bean id="RelyingParty" abstract="true" class="net.shibboleth.profile.relyingparty.BasicRelyingPartyConfiguration"
+ p:issuer="#{'%{sp.issuer}'.trim()}"
p:detailedErrorsPredicate="%{sp.errors.detailed:false}"
p:securityConfiguration-ref="#{'%{sp.security.config:shibboleth.DefaultSecurityConfiguration}'.trim()}"
p:profileConfigurations-ref="shibboleth.DefaultProfileConfigurations" />
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractAgentRequestAction.java b/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractAgentRequestAction.java
index 710b3ad..f0e5d9b 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractAgentRequestAction.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractAgentRequestAction.java
@@ -123,11 +123,11 @@ public abstract class AbstractAgentRequestAction extends AbstractProfileAction {
if (ctx != null) {
final Agent agent = ctx.getAgent();
if (agent != null) {
- s.append("Agent ").append(agent.getId()).append(":");
+ s.append("Agent ").append(agent.getId()).append(" - ");
}
final Application app = ctx.getApplication();
if (app != null) {
- s.append(" Application ").append(app.getId()).append(": ");
+ s.append(" Application ").append(app.getId()).append(" - ");
}
}
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequest.java b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequest.java
index 01745cb..cc87c37 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequest.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ValidateSessionInitiatorRequest.java
@@ -61,6 +61,9 @@ public class ValidateSessionInitiatorRequest extends AbstractApplicationAction {
/** Creation strategy for {@link RelyingPartyContext}. */
@Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextCreationStrategy;
+ /** Initiator flow indicator for logging. */
+ @Nullable private String flowId;
+
/** Whether to require a relying party ID to exist. */
private boolean requireRelyingPartyId;
@@ -75,6 +78,17 @@ public class ValidateSessionInitiatorRequest extends AbstractApplicationAction {
relyingPartyContextCreationStrategy = new ChildContextLookup<>(RelyingPartyContext.class, true);
}
+ /**
+ * Set initiator flow ID for logging.
+ *
+ * @param id flow ID
+ */
+ public void setFlowId(@Nullable final String id) {
+ checkSetterPreconditions();
+
+ flowId = StringSupport.trimOrNull(id);
+ }
+
/**
* Set an optional lookup strategy to identify the relying party name, as a substitute for the session/logout
* assumptions made by the action otherwise.
@@ -121,6 +135,8 @@ public class ValidateSessionInitiatorRequest extends AbstractApplicationAction {
return false;
}
+ log.debug("{} Evaluating applicability of request to {} session initiator flow", getLogPrefix(), flowId);
+
final DDF input = ensureAgentRequestContext().getInput();
if (input == null) {
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
@@ -131,7 +147,8 @@ public class ValidateSessionInitiatorRequest extends AbstractApplicationAction {
if (requireDiscoveryURL) {
if (StringSupport.trimOrNull(input.getmember(InitiatorConstants.DISCOVERY_RETURN_URL).string()) == null) {
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
- log.info("{} Input message did not include '{}' parameter", getLogPrefix(), InitiatorConstants.DISCOVERY_RETURN_URL);
+ log.info("{} Input message missing '{}' parameter, {} flow skipped", getLogPrefix(),
+ InitiatorConstants.DISCOVERY_RETURN_URL, flowId);
return false;
}
}
@@ -141,8 +158,6 @@ public class ValidateSessionInitiatorRequest extends AbstractApplicationAction {
relyingPartyId = input.getmember(InitiatorConstants.ENTITY_ID).string();
}
if (relyingPartyId == null) {
- log.debug("{} Request did not specify authority to use, falling back to Application default",
- getLogPrefix());
relyingPartyId = ensureApplication().getAuthenticatingAuthority(profileRequestContext);
}
@@ -150,7 +165,7 @@ public class ValidateSessionInitiatorRequest extends AbstractApplicationAction {
// Need it, don't have it, signal an error to drop into discovery (if configured).
if (relyingPartyId == null) {
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
- log.debug("{} Authenticating authority unknown", getLogPrefix());
+ log.debug("{} Authenticating authority unknown, {} flow skipped", getLogPrefix(), flowId);
return false;
}
// Need it, got it, good.
@@ -158,7 +173,8 @@ public class ValidateSessionInitiatorRequest extends AbstractApplicationAction {
} else if (relyingPartyId != null) {
// We don't need it, but it's there? We shouldn't be running, because a loop could result.
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
- log.warn("{} Authenticating authority provided, but not expected", getLogPrefix());
+ log.warn("{} Authenticating authority provided, but not expected by {} flow, loop may result",
+ getLogPrefix(), flowId);
return false;
} else {
// Don't need it, don't have it, skip execution phase.
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list