[java-identity-provider] 01/02: OSJ-427: Simple signature verification fails to detect parameter ...
Brent Putman
putmanb at georgetown.edu
Fri Mar 21 16:59:12 UTC 2025
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=b05d766f3719bb1b7f015d2201d8d15d8948a407
commit b05d766f3719bb1b7f015d2201d8d15d8948a407
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Mar 20 20:56:10 2025 -0400
OSJ-427: Simple signature verification fails to detect parameter ...
Add Spring wiring for HttpServletRequestValidator beans for inbound
SAML 1 and 2 request flows.
---
.../shibboleth/idp/conf/saml-binding-config.xml | 152 +++++++++++++++++++++
.../idp/flows/saml/saml-abstract-beans.xml | 4 +
.../idp/flows/saml/saml-abstract-flow.xml | 1 +
.../flows/saml/saml1/artifact-resolution-beans.xml | 2 +
.../idp/flows/saml/saml1/attribute-query-beans.xml | 2 +
.../idp/flows/saml/saml1/sso-unsolicited-beans.xml | 2 +
.../flows/saml/saml2/artifact-resolution-beans.xml | 2 +
.../idp/flows/saml/saml2/attribute-query-beans.xml | 2 +
.../idp/flows/saml/saml2/slo-artifact-beans.xml | 2 +
.../idp/flows/saml/saml2/slo-back-beans.xml | 2 +
.../idp/flows/saml/saml2/slo-post-beans.xml | 2 +
.../flows/saml/saml2/slo-post-simplesign-beans.xml | 2 +
.../idp/flows/saml/saml2/slo-redirect-beans.xml | 2 +
.../idp/flows/saml/saml2/sso-artifact-beans.xml | 2 +
.../idp/flows/saml/saml2/sso-ecp-beans.xml | 2 +
.../idp/flows/saml/saml2/sso-post-beans.xml | 2 +
.../flows/saml/saml2/sso-post-simplesign-beans.xml | 2 +
.../idp/flows/saml/saml2/sso-redirect-beans.xml | 2 +
.../idp/flows/saml/saml2/sso-unsolicited-beans.xml | 2 +
19 files changed, 189 insertions(+)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
index 7ffd15342..827fe8957 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
@@ -173,5 +173,157 @@
<bean id="shibboleth.Encoders.SAML2SOAPEncoder"
class="org.opensaml.saml.saml2.binding.encoding.impl.HTTPSOAP11Encoder" scope="prototype" init-method=""
p:httpServletResponseSupplier-ref="shibboleth.HttpServletResponseSupplier" />
+
+
+ <!-- HTTP request validator beans, which are defined here because are binding-specific. -->
+
+ <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract" abstract="true"
+ class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestParametersValidator" />
+
+ <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Redirect"
+ parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
+ <property name="requiredParameters">
+ <set>
+ <value>SAMLRequest</value>
+ </set>
+ </property>
+ <property name="uniqueParameters">
+ <set>
+ <value>SAMLRequest</value>
+ <value>SAMLEncoding</value>
+ <value>RelayState</value>
+ <value>SigAlg</value>
+ <value>Signature</value>
+ </set>
+ </property>
+ <property name="mutuallyExclusiveParameters">
+ <set>
+ <set>
+ <value>SAMLRequest</value>
+ <value>SAMLResponse</value>
+ </set>
+ </set>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign"
+ parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
+ <property name="requiredParameters">
+ <set>
+ <value>SAMLRequest</value>
+ </set>
+ </property>
+ <property name="uniqueParameters">
+ <set>
+ <value>SAMLRequest</value>
+ <value>RelayState</value>
+ <value>SigAlg</value>
+ <value>Signature</value>
+ <value>KeyInfo</value>
+ </set>
+ </property>
+ <property name="mutuallyExclusiveParameters">
+ <set>
+ <set>
+ <value>SAMLRequest</value>
+ <value>SAMLResponse</value>
+ </set>
+ </set>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST"
+ parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
+ <property name="requiredParameters">
+ <set>
+ <value>SAMLRequest</value>
+ </set>
+ </property>
+ <property name="uniqueParameters">
+ <set>
+ <value>SAMLRequest</value>
+ </set>
+ </property>
+ <property name="mutuallyExclusiveParameters">
+ <set>
+ <set>
+ <value>SAMLRequest</value>
+ <value>SAMLResponse</value>
+ </set>
+ </set>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Artifact"
+ parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
+ <property name="requiredParameters">
+ <set>
+ <value>SAMLart</value>
+ </set>
+ </property>
+ <property name="uniqueParameters">
+ <set>
+ <value>SAMLart</value>
+ <value>RelayState</value>
+ </set>
+ </property>
+ <property name="mutuallyExclusiveParameters">
+ <set>
+ </set>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.SOAP11"
+ parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
+ <property name="requiredParameters">
+ <set>
+ </set>
+ </property>
+ <property name="uniqueParameters">
+ <set>
+ </set>
+ </property>
+ <property name="mutuallyExclusiveParameters">
+ <set>
+ </set>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML1.SOAP11"
+ parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
+ <property name="requiredParameters">
+ <set>
+ </set>
+ </property>
+ <property name="uniqueParameters">
+ <set>
+ </set>
+ </property>
+ <property name="mutuallyExclusiveParameters">
+ <set>
+ </set>
+ </property>
+ </bean>
+
+ <bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML.IdPInitiated"
+ parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
+ <property name="requiredParameters">
+ <set>
+ <value>providerId</value>
+ </set>
+ </property>
+ <property name="uniqueParameters">
+ <set>
+ <value>providerId</value>
+ <value>shire</value>
+ <value>target</value>
+ <value>time</value>
+ </set>
+ </property>
+ <property name="mutuallyExclusiveParameters">
+ <set>
+ </set>
+ </property>
+ </bean>
</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml
index 42a83db62..970df075e 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml
@@ -16,6 +16,10 @@
<bean id="FlowStartPopulateAuditContext" parent="shibboleth.AbstractPopulateAuditContext"
p:fieldExtractors="#{getObject('shibboleth.FlowStartAuditExtractors') ?: getObject('shibboleth.DefaultFlowStartAuditExtractors')}" />
+
+ <bean id="ValidateHttpServletRequest" class="org.opensaml.profile.action.impl.ValidateHttpServletRequest" scope="prototype"
+ p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
+ p:validator="#{getObject('shibboleth.HttpServletRequestValidator') ?: null}" />
<bean id="PopulateMetricContext"
class="org.opensaml.profile.action.impl.PopulateMetricContext" scope="prototype"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml
index a0544bfb9..5f5f76699 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml
@@ -10,6 +10,7 @@
<action-state id="DecodeMessage">
<evaluate expression="PopulateMetricContext" />
+ <evaluate expression="ValidateHttpServletRequest" />
<evaluate expression="DecodeMessage" />
<evaluate expression="PostDecodePopulateAuditContext" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-beans.xml
index 3136e6718..f1f397eb2 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/artifact-resolution-beans.xml
@@ -22,6 +22,8 @@
class="net.shibboleth.idp.profile.impl.InitializeProfileRequestContext" scope="prototype"
p:profileId="#{T(net.shibboleth.saml.saml1.profile.config.ArtifactResolutionProfileConfiguration).PROFILE_ID}"
p:loggingId="%{idp.service.logging.saml1artifact:ArtifactResolution}" />
+
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML1.SOAP11" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
p:messageType="org.opensaml.saml.saml1.core.Request">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-beans.xml
index 509414a35..44a5b9994 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/attribute-query-beans.xml
@@ -23,6 +23,8 @@
class="net.shibboleth.idp.profile.impl.InitializeProfileRequestContext" scope="prototype"
p:profileId="#{T(net.shibboleth.saml.saml1.profile.config.AttributeQueryProfileConfiguration).PROFILE_ID}"
p:loggingId="%{idp.service.logging.saml1attrquery:AttributeQuery}" />
+
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML1.SOAP11" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
p:messageType="org.opensaml.saml.saml1.core.Request">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-unsolicited-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-unsolicited-beans.xml
index af98ac15b..6f450c6ed 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-unsolicited-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml1/sso-unsolicited-beans.xml
@@ -10,6 +10,8 @@
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
default-init-method="initialize"
default-destroy-method="destroy">
+
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML.IdPInitiated" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-beans.xml
index e0de09fb7..10c6fb8b9 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-beans.xml
@@ -22,6 +22,8 @@
class="net.shibboleth.idp.profile.impl.InitializeProfileRequestContext" scope="prototype"
p:profileId="#{T(net.shibboleth.saml.saml2.profile.config.ArtifactResolutionProfileConfiguration).PROFILE_ID}"
p:loggingId="%{idp.service.logging.saml2artifact:ArtifactResolution}" />
+
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.SOAP11" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
p:messageType="org.opensaml.saml.saml2.core.ArtifactResolve">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-beans.xml
index bf57e5366..d7fbf1c09 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/attribute-query-beans.xml
@@ -22,6 +22,8 @@
class="net.shibboleth.idp.profile.impl.InitializeProfileRequestContext" scope="prototype"
p:profileId="#{T(net.shibboleth.saml.saml2.profile.config.AttributeQueryProfileConfiguration).PROFILE_ID}"
p:loggingId="%{idp.service.logging.saml2attrquery:AttributeQuery}" />
+
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.SOAP11" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
p:messageType="org.opensaml.saml.saml2.core.AttributeQuery">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-artifact-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-artifact-beans.xml
index 0a6d249d0..745efc25d 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-artifact-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-artifact-beans.xml
@@ -10,6 +10,8 @@
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
default-init-method="initialize"
default-destroy-method="destroy">
+
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Artifact" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
p:messageType="org.opensaml.saml.saml2.core.LogoutMessage">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-beans.xml
index a5199294f..b76b1a0bd 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-back-beans.xml
@@ -26,6 +26,8 @@
p:profileId="#{T(net.shibboleth.saml.saml2.profile.config.SingleLogoutProfileConfiguration).PROFILE_ID}"
p:browserProfile="false"
p:loggingId="%{idp.service.logging.saml2slo:Logout}" />
+
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.SOAP11" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
p:messageType="org.opensaml.saml.saml2.core.LogoutMessage">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-beans.xml
index 0e7ce5112..5839efe2f 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-beans.xml
@@ -10,6 +10,8 @@
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
default-init-method="initialize"
default-destroy-method="destroy">
+
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
p:messageType="org.opensaml.saml.saml2.core.LogoutMessage">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-simplesign-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-simplesign-beans.xml
index 6da317450..fd4be59ea 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-simplesign-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-post-simplesign-beans.xml
@@ -10,6 +10,8 @@
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
default-init-method="initialize"
default-destroy-method="destroy">
+
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
p:messageType="org.opensaml.saml.saml2.core.LogoutMessage">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-redirect-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-redirect-beans.xml
index fb50f207a..5ae7df4c8 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-redirect-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/slo-redirect-beans.xml
@@ -10,6 +10,8 @@
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
default-init-method="initialize"
default-destroy-method="destroy">
+
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Redirect" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
p:messageType="org.opensaml.saml.saml2.core.LogoutMessage">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-artifact-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-artifact-beans.xml
index def944bbd..a8137a6a2 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-artifact-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-artifact-beans.xml
@@ -19,6 +19,8 @@
p:profileId="#{T(net.shibboleth.idp.saml.saml2.profile.config.impl.BrowserSSOProfileConfiguration).PROFILE_ID}"
p:loggingId="%{idp.service.logging.saml2sso:SSO}"
p:browserProfile="true" />
+
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Artifact" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
p:messageType="org.opensaml.saml.saml2.core.AuthnRequest">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-ecp-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-ecp-beans.xml
index 5703d4350..f741722cd 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-ecp-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-ecp-beans.xml
@@ -19,6 +19,8 @@
<util:constant id="shibboleth.metrics.ProfileCounter"
static-field="net.shibboleth.idp.saml.saml2.profile.config.impl.ECPProfileConfiguration.PROFILE_COUNTER" />
+
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.SOAP11" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
p:messageType="org.opensaml.saml.saml2.core.AuthnRequest">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-beans.xml
index dcb622f31..4d0ea5f9e 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-beans.xml
@@ -20,6 +20,8 @@
p:profileId="#{T(net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration).PROFILE_ID}"
p:loggingId="%{idp.service.logging.saml2sso:SSO}"
p:browserProfile="true" />
+
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
p:messageType="org.opensaml.saml.saml2.core.AuthnRequest">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-simplesign-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-simplesign-beans.xml
index 144bb8592..0d721c2bc 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-simplesign-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-post-simplesign-beans.xml
@@ -20,6 +20,8 @@
p:profileId="#{T(net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration).PROFILE_ID}"
p:loggingId="%{idp.service.logging.saml2sso:SSO}"
p:browserProfile="true" />
+
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign" />
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
p:messageType="org.opensaml.saml.saml2.core.AuthnRequest">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-redirect-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-redirect-beans.xml
index 29af96337..c6eb6efe0 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-redirect-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-redirect-beans.xml
@@ -21,6 +21,8 @@
p:loggingId="%{idp.service.logging.saml2sso:SSO}"
p:browserProfile="true" />
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Redirect" />
+
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
p:messageType="org.opensaml.saml.saml2.core.AuthnRequest">
<constructor-arg>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-unsolicited-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-unsolicited-beans.xml
index 91f79f7d6..379c804dd 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-unsolicited-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-unsolicited-beans.xml
@@ -21,6 +21,8 @@
p:loggingId="%{idp.service.logging.saml2sso:SSO}"
p:browserProfile="true" />
+ <alias alias="shibboleth.HttpServletRequestValidator" name="shibboleth.HttpServletRequestValidator.BasicParams.SAML.IdPInitiated" />
+
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype"
p:messageType="org.opensaml.saml.saml2.core.AuthnRequest">
<constructor-arg>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list