IdP - EntityAttributes - Predicate - Regex filter for federation SPs

[Martin Lunze]

Hi List,

our identity provider (idp) is member of the DFN-AAI (german federation) 
and we have some functional accounts in our idm.

As it is not allowed to use them outside our organisation i included 
some custom login flow / context check interceptor to prevent these 
accounts to authenticate for external service providers (sp).

I did this by checking the registration authority information of the 
metadata.
If the sp is registered by the DFN-AAI than the login-flow stops at idp 
side.

Here is the relevant bean i use:

> <bean id="SP-is-in-DFNAAI" 
> parent="shibboleth.Conditions.EntityDescriptor">
> <constructor-arg name="pred">
> <bean 
> class="org.opensaml.saml.common.profile.logic.RegistrationAuthorityPredicate" 
>
> <constructor-arg>
> <list>
> <value>https://www.aai.dfn.de</value>
>                 </list>
> </constructor-arg>
> </bean>
> </constructor-arg>
> </bean>

These works great.
But now our idp is joining EduGain and i am looking for a mechanism to 
simply and flexible check if the sp (the user wants to login) is in 
edugain or not.
I did not want to extend the list of registration authorities and i did 
not want to "mark" our local sp and using "InEntityGroup" is also no 
possibility.

After some reading and testing i think i found the "best" solution for me.
Using EntityAttributes-MetadataFilter [1] like this to create a "flag" 
(entityAttribute) for every member [2] of the EduGain metadata:

> <MetadataProvider id="DFN-AAI-EduGain"
>     xsi:type="FileBackedHTTPMetadataProvider"
> backingFile="%{idp.home}/metadata/DFN-AAI-edugain-metadata.xml"
> metadataURL="https://www.aai.dfn.de/fileadmin/metadata/dfn-aai-edugain+sp-metadata.xml"
>     maxRefreshDelay="PT2H">
>
>     <MetadataFilter xsi:type="SignatureValidation" 
> requireSignedRoot="true"
>         certificateFile="/etc/apache2/ssl.crt/dfn-aai.g2.pem"/>
>     <MetadataFilter xsi:type="EntityRoleWhiteList">
> <RetainedRole>md:SPSSODescriptor</RetainedRole>
>     </MetadataFilter>
>     <MetadataFilter xsi:type="EntityAttributes">
>         <saml:Attribute
>             Name="https://tu-dresden.de/entity-type"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
> <saml:AttributeValue>https://tu-dresden.de/entity-type/external/edugain</saml:AttributeValue>
>         </saml:Attribute>
>         <ConditionRef>always-true</ConditionRef>
>     </MetadataFilter>
> </MetadataProvider>
>
> <bean id="always-true" factory-method="alwaysTrue" 
> class="com.google.common.base.Predicates"/>
[1] 
https://wiki.shibboleth.net/confluence/display/IDP30/EntityAttributesFilter
[2] 
http://shibboleth.1660669.n2.nabble.com/idpv3-attribute-resolver-PluginActivationConditions-td7618529.html

At this moment i had the idea to not only create one value for the new 
entityAttribute, but rather multiple values for different federations or 
"groups" of sp.

My activation condition to check for "external" sp (tagged relying 
parties [3]) now looks like this:

> <bean id="SP-is-external" parent="shibboleth.Conditions.EntityDescriptor">
>     <constructor-arg name="pred">
>         <bean 
> class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate">
>             <constructor-arg>
>                 <list>
>                     <bean 
> class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate"
>                         c:name="https://tu-dresden.de/entity-type"
> p:values="https://tu-dresden.de/entity-type/external" />
>                     <bean 
> class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate"
>                         c:name="https://tu-dresden.de/entity-type"
> p:values="https://tu-dresden.de/entity-type/external/dfn-aai" />
>                     <bean 
> class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate"
>                         c:name="https://tu-dresden.de/entity-type"
> p:values="https://tu-dresden.de/entity-type/external/dfn-aai/sp" />
>                     <bean 
> class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate"
>                         c:name="https://tu-dresden.de/entity-type"
> p:values="https://tu-dresden.de/entity-type/external/edugain" />
>                 </list>
>             </constructor-arg>
>         </bean>
>     </constructor-arg>
> </bean>
[3] 
https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions#ActivationConditions-RelyingPartiesByTag

Among other questions came up i now want to know if it is possible to 
use regex for this task?
Filtering attributes supports such a mechanism [4], but i did not found 
a solution to build a analogue bean / activation condition.

> <Rule xsi:type="EntityAttributeRegexMatch"
>     attributeName="https://tu-dresden.de/entity-type"
> attributeValueRegex="^https://tu-dresden.de/entity-type/external.*$" />
[4] 
https://wiki.shibboleth.net/confluence/display/IDP30/EntityAttributeRegexMatchConfiguration

Maybe i missed some interesting point of the documentation?
Or other solutions for my purpose?

With nice regards.
Martin

-- 
Martin Lunze
IT-Systemadministrator

Technische Universität Dresden
Zentrum für Informationsdienste und Hochleistungsrechnen (ZIH)
Operative Prozesse und Systeme (OPS)
01062 Dresden

Tel.: +49 (351) 463-35881
E-Mail: martin.lunze at tu-dresden.de

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180424/ff992932/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5677 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20180424/ff992932/attachment.p7s>