Access principal name from servlet filter

[Etienne Dysli-Metref]

On 21/08/15 18:04, Cantor, Scott wrote:
> The basic rules for writing action beans are in [1] and are pretty up
> to date. So you have two choices, generally, creating one that's
> Spring-aware or one that's not. This one probably wouldn't need to
> be, so it would be inheriting from the OpenSAML version of
> AbstractProfileAction.

Ok so I got my action and flow implemented and running with SWF in an
integration test. :) Here is what I did to make the IdP run it:
1. Created the flow definition and beans files at
   flows/intercept/vho-cookie-{flow,beans}.xml
2. Modified conf/relying-party.xml to add the intercept flow
   <bean parent="SAML2.SSO" p:postAuthenticationFlows="#{
{'terms-of-use', 'attribute-release', 'vho-cookie'} }" />
3. Modified conf/intercept/profile-intercept.xml to add a flow descriptor:
    <bean id="shibboleth.AvailableInterceptFlows"
parent="shibboleth.DefaultInterceptFlows" lazy-init="true">
      <property name="sourceList">
        <list merge="true">
          [...]
+         <bean id="intercept/vho-cookie"
+               parent="vho.UsernameCookieFlow" />
        </list>
      </property>
    </bean>
+   <bean id="vho.UsernameCookieFlow" parent="shibboleth.InterceptFlow"
+         abstract="true" p:nonBrowserSupported="false" />

So far it works and I get the cookie. Is the way I set it up correct?
(especially 3. above)

> You could also, if you wanted, look at using a bean we have called
> shibboleth.CookieManager that implements this class:
> net.shibboleth.utilities.java.support.net.CookieManager

I used bean definition inheritance to copy it with my own settings, but
I got the Spring errors below unless I explicitly added the secure and
httpOnly properties.

  <bean id="vho.PersistentCookieManager"
        parent="shibboleth.PersistentCookieManager"
    p:cookieDomain="%{vho.cookie.domain:}"
    p:cookiePath="%{vho.cookie.path:/}" />

ERROR [net.shibboleth.idp.saml.profile:-2] - Uncaught runtime exception
o.s.beans.factory.BeanCreationException: Error creating bean with name
'vho.PersistentCookieManager' defined in file
[/opt/shibboleth-idp/flows/intercept/vho-cookie-beans.xml]: Error
setting property values;
nested exception is o.s.beans.PropertyBatchUpdateException;
nested PropertyAccessExceptions (2) are:
PropertyAccessException 1: o.s.beans.MethodInvocationException: Property
'httpOnly' threw exception;
nested exception is j.l.IllegalArgumentException: argument type mismatch
PropertyAccessException 2: o.s.beans.MethodInvocationException: Property
'secure' threw exception;
nested exception is j.l.IllegalArgumentException: argument type mismatch
  at
o.s.beans.factory.support.AbstractAutowireCapableBeanFactory.applyPropertyValues(AbstractAutowireCapableBeanFactory.java:1506)
Caused by: o.s.beans.PropertyBatchUpdateException: Failed properties:
Property 'httpOnly' threw exception;
nested exception is j.l.IllegalArgumentException: argument type mismatch
Property 'secure' threw exception;
nested exception is j.l.IllegalArgumentException: argument type mismatch
  at
o.s.beans.AbstractPropertyAccessor.setPropertyValues(AbstractPropertyAccessor.java:121)

These errors didn't appear in my test with SWF, weird...

  Etienne

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20150826/5e5a3572/attachment.sig>