[java-plugin-shibd-saml] branch main updated: JSHIBDSAML-9 - IdP SOAP Pipeline won't work for SP
Codeberg
noreply at shibboleth.net
Tue Oct 13 14:56:50 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-saml/commit/fd187e2d83c8377f392eaeeb08e30256ca67461f
The following commit(s) were added to refs/heads/main by this push:
new fd187e2 JSHIBDSAML-9 - IdP SOAP Pipeline won't work for SP
fd187e2 is described below
commit fd187e2d83c8377f392eaeeb08e30256ca67461f
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Tue Oct 13 10:56:39 2026 -0400
JSHIBDSAML-9 - IdP SOAP Pipeline won't work for SP
https://shibboleth.atlassian.net/browse/JSHIBDSAML-9
Copy in a new pipeline inherited from the IdP's with a few changes.
---
.../config/BrowserSSOProfileConfiguration.java | 5 +-
.../META-INF/net.shibboleth.idp/postconfig.xml | 2 +
.../META-INF/net.shibboleth.idp/sp-soap-client.xml | 134 +++++++++++++++++++++
.../sp/consumer/saml2/artifact/artifact-beans.xml | 2 +-
.../consumer/saml2/artifact/artifact-beans.xml | 2 +-
5 files changed, 140 insertions(+), 5 deletions(-)
diff --git a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index bd664a9..9a7d281 100644
--- a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -22,7 +22,6 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.idp.attribute.IdPAttribute;
-import net.shibboleth.saml.profile.config.SAMLArtifactConsumerProfileConfiguration;
import net.shibboleth.shared.annotation.ConfigurationSetting;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -37,8 +36,8 @@ import org.opensaml.saml.saml2.core.RequestedAuthnContext;
import org.opensaml.saml.saml2.core.SubjectConfirmationData;
/** Configuration support for SP SAML 2.0 Browser SSO. */
-public interface BrowserSSOProfileConfiguration extends SAMLArtifactConsumerProfileConfiguration,
- net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration {
+public interface BrowserSSOProfileConfiguration
+ extends net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration {
/**
* Get whether the inbound {@link SubjectConfirmationData#getInResponseTo()} value
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 7b739b8..58f9126 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -13,6 +13,8 @@
default-init-method="initialize" default-destroy-method="destroy">
+ <import resource="sp-soap-client.xml" />
+
<!-- Session initiator flows. -->
<bean p:id="sp/initiator/ecp" class="net.shibboleth.sp.profile.BasicSessionInitiatorFlowDescriptor">
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/sp-soap-client.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/sp-soap-client.xml
new file mode 100644
index 0000000..9ed24d6
--- /dev/null
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/sp-soap-client.xml
@@ -0,0 +1,134 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <!-- As a rule, any beans starting with SIAPClient. alone and not SOAPClient.sp are in the original IdP client config. -->
+
+ <!-- Aliases used for wiring, especially by other components. In case we want to switch strategies, can do it here -->
+ <alias alias="shibboleth.sp.SOAPClient.SAML" name="SOAPClient.sp.SAML.LocatorMap" />
+
+ <!-- SOAP client and pipeline factory definitions. -->
+
+ <bean id="SOAPClient.sp.SAML.LocatorMap" class="org.opensaml.soap.client.http.PipelineFactoryHttpSOAPClient">
+ <property name="httpClient" ref="#{'%{sp.soap.httpClient:SOAPClient.HttpClient}'.trim()}" />
+ <property name="pipelineFactory" ref="SOAPClient.sp.PipelineFactory.LocatorMap" />
+ </bean>
+
+ <!-- Pipeline-based SOAP client which selects factory dynamically based on serviceMappings below. -->
+ <bean id="SOAPClient.sp.PipelineFactory.LocatorMap" class="org.springframework.beans.factory.config.ServiceLocatorFactoryBean">
+ <property name="serviceLocatorInterface" value="org.opensaml.messaging.pipeline.httpclient.HttpClientMessagePipelineFactory" />
+ <property name="serviceMappings">
+ <props>
+ <prop key="SAML2.ArtifactDecoder">SOAPClient.sp.SAML2.Pipeline</prop>
+ <!--
+ <prop key="SAML2.Logout">SOAPClient.sp.SAML2.Pipeline</prop>
+ -->
+ <prop key="SAML2.AttributeQuery">SOAPClient.sp.SAML2.Pipeline</prop>
+ </props>
+ </property>
+ </bean>
+
+
+ <!-- Basic SAML 2 pipeline inherits from IdP with selecrted overrides. -->
+
+ <bean id="SOAPClient.sp.SAML2.Pipeline" scope="prototype" parent="SOAPClient.SAML2.Pipeline">
+
+ <property name="outboundPayloadHandler">
+ <bean scope="prototype" class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
+ <property name="handlers">
+ <util:list>
+
+ <ref bean="SOAPClient.MessageChannelSecurity" />
+
+ <ref bean="SOAPClient.InitializeRelyingPartyContexFromSAMLPeer" />
+
+ <ref bean="SOAPClient.sp.SelectRelyingPartyConfiguration" />
+
+ <ref bean="SOAPClient.SelectProfileConfiguration" />
+
+ <bean scope="prototype" class="org.opensaml.saml.common.binding.impl.PopulateSignatureSigningParametersHandler"
+ p:signatureSigningParametersResolver-ref="shibboleth.SignatureSigningParametersResolver"
+ p:configurationLookupStrategy-ref="shibboleth.MessageContext.SignatureSigningConfigurationLookup"
+ p:activationCondition-ref="SOAPClient.SAMLSigningPredicate"
+ />
+
+ <bean scope="prototype" class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler" />
+
+ </util:list>
+ </property>
+ </bean>
+ </property>
+
+ <property name="inboundHandler">
+ <bean scope="prototype" class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
+ <property name="handlers">
+ <util:list>
+
+ <bean scope="prototype" class="org.opensaml.saml.common.binding.security.impl.CheckAndRecordServerTLSEntityAuthenticationtHandler"
+ p:entityIDLookup-ref="SOAPClient.OperationContextEntityIDLookup" />
+
+ <bean scope="prototype" class="org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler"
+ p:copyContextLookup-ref="SOAPClient.OperationContextLookup">
+ </bean>
+
+ <bean scope="prototype" class="org.opensaml.xmlsec.messaging.impl.PopulateSignatureValidationParametersHandler"
+ p:signatureValidationParametersResolver-ref="shibboleth.SignatureValidationParametersResolver"
+ p:configurationLookupStrategy-ref="shibboleth.MessageContext.SignatureValidationConfigurationLookup" />
+
+ <bean scope="prototype" class="org.opensaml.saml.common.binding.security.impl.InResponseToSecurityHandler" />
+
+ <bean scope="prototype" class="org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler"
+ p:activationCondition="%{sp.saml.soap.checkReplay:%{sp.saml.checkReplay:true}}"
+ p:replayCache-ref="shibboleth.ReplayCache"
+ p:expires="%{sp.saml.messageLifetime:%{sp.policy.messageLifetime:PT3M}}" />
+
+ <bean scope="prototype" class="org.opensaml.saml.common.binding.security.impl.MessageLifetimeSecurityHandler"
+ p:messageLifetime="%{sp.saml.messageLifetime:%{sp.policy.messageLifetime:PT3M}}"
+ p:clockSkew="%{sp.saml.clockSkew:%{sp.policy.clockSkew:PT3M}}" />
+
+ <bean scope="prototype" class="org.opensaml.saml.common.binding.security.impl.SAMLProtocolMessageXMLSignatureSecurityHandler" />
+
+ <bean scope="prototype" class="org.opensaml.messaging.handler.impl.CheckMandatoryIssuer"
+ p:issuerLookupStrategy-ref="SOAPClient.SAMLMessageContextIssuerFunction" />
+
+ <bean scope="prototype" class="org.opensaml.messaging.handler.impl.CheckExpectedIssuer"
+ p:issuerLookupStrategy-ref="SOAPClient.SAMLMessageContextIssuerFunction"
+ p:expectedIssuerLookupStrategy-ref="SOAPClient.OperationContextEntityIDLookup" />
+
+ <bean scope="prototype" class="org.opensaml.messaging.handler.impl.CheckMandatoryAuthentication">
+ <property name="authenticationLookupStrategy">
+ <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLMessageContextAuthenticationFunction" />
+ </property>
+ </bean>
+
+ </util:list>
+ </property>
+ </bean>
+ </property>
+ </bean>
+
+
+ <!-- Supporting beans. -->
+
+ <bean id="SOAPClient.sp.SelectRelyingPartyConfiguration"
+ class="net.shibboleth.idp.profile.messaging.impl.SelectRelyingPartyConfiguration" scope="prototype"
+ p:relyingPartyConfigurationResolver-ref="SOAPClient.sp.ApplicationRelyingPartyResolver" />
+
+ <bean id="SOAPClient.sp.ApplicationRelyingPartyResolver"
+ class="net.shibboleth.sp.service.impl.SupplierBackedReloadableService">
+ <constructor-arg>
+ <bean class="net.shibboleth.sp.service.impl.ActiveApplicationSupplier"
+ p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier" />
+ </constructor-arg>
+ </bean>
+
+</beans>
\ No newline at end of file
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/artifact/artifact-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/artifact/artifact-beans.xml
index f50dcb2..68d30a0 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/artifact/artifact-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/artifact/artifact-beans.xml
@@ -27,7 +27,7 @@
p:identifierGenerationStrategy-ref="shibboleth.DefaultIdentifierGenerationStrategy"
p:selfEntityIDResolver-ref="ArtifactSupport.SelfEntityIDResolver"
p:artifactEndpointResolver-ref="shibboleth.EndpointResolver"
- p:SOAPClient-ref="shibboleth.SOAPClient.SAML"
+ p:SOAPClient-ref="shibboleth.sp.SOAPClient.SAML"
p:SOAPPipelineName="SAML2.ArtifactDecoder"
p:SOAPClientSecurityConfigurationProfileId="#{T(net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration).PROFILE_ID}"
/>
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/artifact/artifact-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/artifact/artifact-beans.xml
index 2337137..faf2689 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/artifact/artifact-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/artifact/artifact-beans.xml
@@ -22,7 +22,7 @@
p:identifierGenerationStrategy-ref="shibboleth.DefaultIdentifierGenerationStrategy"
p:selfEntityIDResolver-ref="ArtifactSupport.SelfEntityIDResolver"
p:artifactEndpointResolver-ref="shibboleth.EndpointResolver"
- p:SOAPClient-ref="shibboleth.SOAPClient.SAML"
+ p:SOAPClient-ref="shibboleth.sp.SOAPClient.SAML"
p:SOAPPipelineName="SAML2.ArtifactDecoder"
p:SOAPClientSecurityConfigurationProfileId="#{T(net.shibboleth.saml.saml2.profile.config.SingleLogoutProfileConfiguration).PROFILE_ID}"
/>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list