<style>
/* Changing the layout to use less space for mobiles */
@media screen and (max-device-width: 480px), screen and (-webkit-min-device-pixel-ratio: 2) {
#email-body { min-width: 30em !important; }
#email-page { padding: 8px !important; }
#email-banner { padding: 8px 8px 0 8px !important; }
#email-avatar { margin: 1px 8px 8px 0 !important; padding: 0 !important; }
#email-fields { padding: 0 8px 8px 8px !important; }
#email-gutter { width: 0 !important; }
}
</style>
<div id="email-body">
<table id="email-wrap" align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#f0f0f0;color:#000000;width:100%;">
<tr valign="top">
<td id="email-page" style="padding:16px !important;">
<table align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#ffffff;border:1px solid #bbbbbb;color:#000000;width:100%;">
<tr valign="top">
<td bgcolor="#ffffff" style="background-color:#ffffff;color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;line-height:1;"><img src="https://shibboleth.net/images/shib_240x83.png" alt="" style="vertical-align:top;" /></td>
</tr><tr valign="top">
<td id="email-banner" style="padding:32px 32px 0 32px;">
<table align="left" border="0" cellpadding="0" cellspacing="0" width="100%" style="width:100%;">
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;padding:0;">
<img id="email-avatar" src="https://issues.shibboleth.net/jira/secure/useravatar?avatarId=10202" alt="" height="48" width="48" border="0" align="left" style="padding:0;margin: 0 16px 16px 0;" />
<div id="email-action" style="padding: 0 0 8px 0;font-size:12px;line-height:18px;">
<a class="user-hover" rel="zccx04fxbfekk/ldylvfqohcyf4=@https://aai-logon.switch.ch/idp/shibboleth" id="email_zccx04fxbfekk/ldylvfqohcyf4=@https://aai-logon.switch.ch/idp/shibboleth" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=zccx04fxbfekk%2Fldylvfqohcyf4%3D%40https%3A%2F%2Faai-logon.switch.ch%2Fidp%2Fshibboleth" style="color:#326ca6;">Kaspar Brand</a>
commented on <img src="https://issues.shibboleth.net/jira/images/icons/issuetypes/subtask_alternate.png" height="16" width="16" border="0" align="absmiddle" alt="Sub-task"> <a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/IDP-115'>IDP-115</a>
</div>
<div id="email-summary" style="font-size:16px;line-height:20px;padding:2px 0 16px 0;">
<a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/IDP-115'><strong>Create an authentication workflow action that validates a user's X.509 certificate</strong></a>
</div>
</td>
</tr>
</table>
</td>
</tr>
<tr valign="top">
<td id="email-fields" style="padding:0 32px 32px 32px;">
<table border="0" cellpadding="0" cellspacing="0" style="padding:0;text-align:left;width:100%;" width="100%">
<tr valign="top">
<td id="email-gutter" style="width:64px;white-space:nowrap;"></td>
<td>
<table border="0" cellpadding="0" cellspacing="0" width="100%">
<tr valign="top">
<td colspan="2" style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 16px 0;width:100%;">
<div class="comment-block" style="background-color:#edf5ff;border:1px solid #dddddd;color:#000000;padding:12px;"><p>Thanks a lot for the implementation! Finally I found some time to experiment with this flow, and was successful in achieving a setup similar to our current v2 configuration ("hybrid" login form with "Certificate Login" button).</p>
<p>Three observations/questions:</p>
<p>1) The shibboleth.c14n.x500.* options don't seem to be wired. I applied the following patch:</p>
<div class="preformatted panel" style="border-width: 1px;"><div class="preformattedContent panelContent">
<pre>Index: system/flows/c14n/x500-subject-c14n-beans.xml
===================================================================
--- system/flows/c14n/x500-subject-c14n-beans.xml (revision 6732)
+++ system/flows/c14n/x500-subject-c14n-beans.xml (working copy)
@@ -18,6 +18,10 @@
<bean class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" />
<bean id="X500SubjectCanonicalization"
- class="net.shibboleth.idp.authn.impl.X500SubjectCanonicalization" scope="prototype" />
+ class="net.shibboleth.idp.authn.impl.X500SubjectCanonicalization" scope="prototype"
+ p:lowercase-ref="shibboleth.c14n.x500.Lowercase"
+ p:uppercase-ref="shibboleth.c14n.x500.Uppercase"
+ p:trim-ref="shibboleth.c14n.x500.Trim"
+ p:transforms-ref="shibboleth.c14n.x500.Transforms" />
</beans>
</pre>
</div></div>
<p>2) <tt>X500SubjectCanonicalization</tt> is currently hardcoded to only extract the CN RDN from the subject (unless I'm missing something essential). The documentation on <a href="https://wiki.shibboleth.net/confluence/display/IDP30/X509AuthnConfiguration" class="external-link">X509AuthnConfiguration</a> says that <cite>the same functionality can be configured using the subject canonicalization mechanism that invokes the attribute resolver, to produce a subjectAltName-sourced attribute that becomes the principal name</cite>, but I couldn't figure out how exactly. If I'm correctly understanding the PostLoginSubjectCanonicalizationFlows (which is configurable via <tt>conf/c14n/attribute-sourced-subject-c14n-config.xml</tt>), then it is based on the idea that the extracted CN attribute value is used to look up further attributes, which are then used as the "effective" principal name. In the case of personal certs, the CN might not always be unique, however, or not suitable for an additional attribute resolution, e.g. due to a) being completely absent from the subject DN (Comodo's free-for-all e-mail certs are such an example), b) having values like "Persona Not Validated - 01234567890123" (Symantec Class 1 certificates) which, even though unique, might not be available for lookup via attribute solution (not stored/available in the user directory etc.) or c) two persons having exactly the same CN (the uniqueness requirement in PKIX is on the issuerDN + serial number, two subjects may have the same CN). In such a case, subjectAltName extension entries like rfc822Name (or <a href="https://forge.switch.ch/redmine/issues/1898" class="external-link">msUPN</a>) are used to distinguish the principals, and as far as I understand the current code, there's no way to get at these pieces from the presented certificate - or I might have overseen where this is handled. (Note that although there exists the infamous PKCS#9 emailAddress attribute which still appears in the subject of certain certs, I would definitely not advocate this as an alternative to the CN attribute - the S/MIME RFCs e.g. have dubbed PKCS#9 emailAddress a SHOULD NOT since 1999 already.)</p>
<p>3) When playing with the shibboleth.c14n.x500.Transforms option, I observed an unexpected behavior when configuring the following bean:</p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="code-java"><bean parent=<span class="code-quote">"shibboleth.Pair"</span> p:first=<span class="code-quote">".*"</span> p:second=<span class="code-quote">"jdoe"</span> />
</pre>
</div></div>
<p>A cert with a "CN=John Doe" RDN would then produce this result:</p>
<div class="preformatted panel" style="border-width: 1px;"><div class="preformattedContent panelContent">
<pre>DEBUG [net.shibboleth.idp.authn.impl.X500SubjectCanonicalization:124] - Profile Action X500SubjectCanonicalization: Extracted RDN with OID 2.5.4.3: John Doe
DEBUG [net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction:226] - Profile Action X500SubjectCanonicalization: trimming whitespace of input string 'John Doe'
DEBUG [net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction:244] - Profile Action X500SubjectCanonicalization: applying replacement expression '.*' against input 'John Doe'
DEBUG [net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction:247] - Profile Action X500SubjectCanonicalization: result of replacement is 'jdoejdoe'
</pre>
</div></div>
<p>Note the double occurrence of <tt>jdoe</tt> in the replacement. It seems to be related to the use of <tt>replaceAll</tt> in <tt>AbstractSubjectCanonicalizationAction.java</tt>, and at least to me it was unexpected given that .* is greedy in Java, too. I was able to achieve the desired result with <tt>p:first="^.*$"</tt>, but am wondering why anchoring is necessary for this.</p></div>
<div style="color:#505050;padding:4px 0 0 0;"> </div>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td><!-- End #email-page -->
</tr>
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:10px;line-height:14px;padding: 0 16px 16px 16px;text-align:center;">
This message is automatically generated by JIRA.<br />
If you think it was sent incorrectly, please contact your JIRA administrators<br />
For more information on JIRA, see: <a style='color:#326ca6;' href='http://www.atlassian.com/software/jira'>http://www.atlassian.com/software/jira</a>
</td>
</tr>
</table><!-- End #email-wrap -->
</div><!-- End #email-body -->