[java-identity-provider] branch main updated: Update wiring and properties for SAML HTTP request validators.
Brent Putman
putmanb at georgetown.edu
Sat Mar 22 23:51:51 UTC 2025
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=fab73dcf25b4e332f82866e3859340dc4c138d91
The following commit(s) were added to refs/heads/main by this push:
new fab73dcf2 Update wiring and properties for SAML HTTP request validators.
fab73dcf2 is described below
commit fab73dcf25b4e332f82866e3859340dc4c138d91
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Sat Mar 22 19:40:43 2025 -0400
Update wiring and properties for SAML HTTP request validators.
---
.../shibboleth/idp/conf/saml-binding-config.xml | 72 +++++++++++++++++++++-
.../net/shibboleth/idp/module/conf/idp.properties | 4 ++
2 files changed, 75 insertions(+), 1 deletion(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
index 1ec47cdd7..f0aed3fec 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
@@ -178,10 +178,20 @@
<!-- HTTP request validator beans, which are defined here because are binding-specific. -->
<bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract" abstract="true"
- class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestParametersValidator" />
+ class="net.shibboleth.shared.servlet.impl.BasicHttpServletRequestParametersValidator"
+ p:enforceAllowedParameters="%{idp.http.saml.enforceAllowedParameters:false}" />
<bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Redirect"
parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
+ <property name="allowedParameters">
+ <set>
+ <value>SAMLRequest</value>
+ <value>SAMLEncoding</value>
+ <value>RelayState</value>
+ <value>SigAlg</value>
+ <value>Signature</value>
+ </set>
+ </property>
<property name="requiredParameters">
<set>
<value>SAMLRequest</value>
@@ -190,6 +200,7 @@
<property name="uniqueParameters">
<set>
<value>SAMLRequest</value>
+ <value>SAMLResponse</value>
<value>SAMLEncoding</value>
<value>RelayState</value>
<value>SigAlg</value>
@@ -208,6 +219,16 @@
<bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Redirect.RequestOrResponse"
parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Redirect">
+ <property name="allowedParameters">
+ <set>
+ <value>SAMLRequest</value>
+ <value>SAMLResponse</value>
+ <value>SAMLEncoding</value>
+ <value>RelayState</value>
+ <value>SigAlg</value>
+ <value>Signature</value>
+ </set>
+ </property>
<property name="requiredParameters">
<set>
</set>
@@ -216,6 +237,15 @@
<bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign"
parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
+ <property name="allowedParameters">
+ <set>
+ <value>SAMLRequest</value>
+ <value>RelayState</value>
+ <value>SigAlg</value>
+ <value>Signature</value>
+ <value>KeyInfo</value>
+ </set>
+ </property>
<property name="requiredParameters">
<set>
<value>SAMLRequest</value>
@@ -224,6 +254,7 @@
<property name="uniqueParameters">
<set>
<value>SAMLRequest</value>
+ <value>SAMLResponse</value>
<value>RelayState</value>
<value>SigAlg</value>
<value>Signature</value>
@@ -242,6 +273,16 @@
<bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign.RequestOrResponse"
parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POSTSimpleSign">
+ <property name="allowedParameters">
+ <set>
+ <value>SAMLRequest</value>
+ <value>SAMLResponse</value>
+ <value>RelayState</value>
+ <value>SigAlg</value>
+ <value>Signature</value>
+ <value>KeyInfo</value>
+ </set>
+ </property>
<property name="requiredParameters">
<set>
</set>
@@ -250,6 +291,12 @@
<bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST"
parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
+ <property name="allowedParameters">
+ <set>
+ <value>SAMLRequest</value>
+ <value>RelayState</value>
+ </set>
+ </property>
<property name="requiredParameters">
<set>
<value>SAMLRequest</value>
@@ -258,6 +305,8 @@
<property name="uniqueParameters">
<set>
<value>SAMLRequest</value>
+ <value>SAMLResponse</value>
+ <value>RelayState</value>
</set>
</property>
<property name="mutuallyExclusiveParameters">
@@ -272,6 +321,13 @@
<bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST.RequestOrResponse"
parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.POST">
+ <property name="allowedParameters">
+ <set>
+ <value>SAMLRequest</value>
+ <value>SAMLResponse</value>
+ <value>RelayState</value>
+ </set>
+ </property>
<property name="requiredParameters">
<set>
</set>
@@ -280,6 +336,12 @@
<bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML2.Artifact"
parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
+ <property name="allowedParameters">
+ <set>
+ <value>SAMLart</value>
+ <value>RelayState</value>
+ </set>
+ </property>
<property name="requiredParameters">
<set>
<value>SAMLart</value>
@@ -305,6 +367,14 @@
<bean id="shibboleth.HttpServletRequestValidator.BasicParams.SAML.IdPInitiated"
parent="shibboleth.HttpServletRequestValidator.BasicParams.SAML.Abstract">
+ <property name="allowedParameters">
+ <set>
+ <value>providerId</value>
+ <value>shire</value>
+ <value>target</value>
+ <value>time</value>
+ </set>
+ </property>
<property name="requiredParameters">
<set>
<value>providerId</value>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
index 834390abd..5cd59b91e 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
@@ -261,3 +261,7 @@ idp.ui.fallbackLanguages=en,fr,de
# Set false if you want SAML bindings "spelled out" in audit log
idp.audit.shortenBindings = true
+
+# Set true if you want inbound SAML requests to enforce that only
+# allowed HTTP parameters are present
+#idp.http.saml.enforceAllowedParameters = false
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list