postAuthenticationFlowsLookupStrategy - activationCondition - rpUIContext

[Martin Lunze]

Hi together,

we have a new requirement for our idp and i want to share my experience 
and i also want to know if i did some mistake :-)

We have to skip the attribute release consent if the user tries to login 
to a local sp that provides a privacyStatementURL in his metadata.

At the moment we do not save the consent, the users have to accept it 
after every login XD.
Additionally we add an entityAttribute to all of our sp to mark them 
local and remove this one from all external metadata to be sure this 
attribute will not occure for any other sp.

> <MetadataProviderid="LOCALMD"
> xsi:type="LocalDynamicMetadataProvider"
> sourceDirectory="%{idp.home}/metadata/local">
> <MetadataFilterxsi:type="EntityAttributes">
> <saml:Attribute
> Name="https://tu-dresden.de/entity-type"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
> <saml:AttributeValue>https://tu-dresden.de/entity-type/local</saml:AttributeValue>
> </saml:Attribute>
> <ConditionRef>always-true</ConditionRef>
> </MetadataFilter>
> </MetadataProvider>

> <MetadataProviderid="DFN-AAI-SP"
> xsi:type="FileBackedHTTPMetadataProvider"
> backingFile="%{idp.home}/metadata/DFN-AAI-sp-metadata.xml"
> metadataURL="http://www.aai.dfn.de/fileadmin/metadata/dfn-aai-sp-metadata.xml"
> maxRefreshDelay="PT2H">
> <MetadataFilterxsi:type="SignatureValidation"requireSignedRoot="true"
> certificateFile="/etc/apache2/ssl.crt/dfn-aai.g2.pem"/>
> <MetadataFilterxsi:type="RequiredValidUntil"maxValidityInterval="P14D"/>
> <MetadataFilterxsi:type="EntityRoleWhiteList">
> <RetainedRole>md:SPSSODescriptor</RetainedRole>
> </MetadataFilter>
> <!-- remove unauthorized entity attributes -->
> <MetadataFilterxsi:type="EntityAttributes">
> <AttributeFilterScript>
> <Script>
> <![CDATA[
> (function (attribute) {
> "use strict";
> var prefix = "https://tu-dresden.de/entity-type";
> if (attribute === null) {
> return true;
> }
> return ! attribute.getName().startsWith(prefix);
> }(input));
> ]]>
> </Script>
> </AttributeFilterScript>
> </MetadataFilter>
> </MetadataProvider>

To realize the new behaviour i firstly changed the relyingparty config 
to use dynamic lookupStrategy [1] for the postAuthenticationFlow:

> <beanid="shibboleth.DefaultRelyingParty"parent="RelyingParty">
> <propertyname="profileConfigurations">
> <list>
> <beanparent="SAML2.SSO"
> p:postAuthenticationFlowsLookupStrategy-ref="postAuthenticationFlowsLookup"
> p:nameIDFormatPrecedenceLookupStrategy-ref="nameIDFormatPrecedenceLookup"/>
> <refbean="SAML2.Logout"/>
> <beanparent="SAML2.AttributeQuery"
> p:activationCondition-ref="SP-consumes-persistentId"/>
> <refbean="SAML2.ArtifactResolution"/>
> </list>
> </property>
> </bean>

Within the corresponding lookup-bean, i used a ScriptedPredicate[2] and 
a extra customObject-ref which combines multiple other conditions like this:

> <beanid="postAuthenticationFlowsLookup"parent="shibboleth.ContextFunctions.Scripted"factory-method="inlineScript"p:customObject-ref="SP-skips-attribute-release">
> <constructor-arg>
> <value>
> <![CDATA[
> if (custom.apply(input)) {
> listType = Java.type("java.util.ArrayList");
> postAuthenticationFlows = new listType(1);
> postAuthenticationFlows.add("functional-user-check");
> } else {
> listType = Java.type("java.util.ArrayList");
> postAuthenticationFlows = new listType(2);
> postAuthenticationFlows.add("functional-user-check");
> postAuthenticationFlows.add("attribute-release");
> }
> postAuthenticationFlows;
> ]]>
> </value>
> </constructor-arg>
> </bean>

> <beanid="SP-skips-attribute-release"parent="shibboleth.Conditions.AND">
> <constructor-arg>
> <list>
> <refbean="SP-is-local"/>
> <refbean="SP-has-privacyURL"/>
> </list>
> </constructor-arg>
> </bean>

> <beanid="SP-is-local"parent="shibboleth.Conditions.EntityDescriptor">
> <constructor-argname="pred">
> <beanclass="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate">
> <constructor-arg>
> <list>
> <beanclass="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate"
> c:name="https://tu-dresden.de/entity-type"
> p:values="https://tu-dresden.de/entity-type/local"/>
> </list>
> </constructor-arg>
> </bean>
> </constructor-arg>
> </bean>

> <beanid="SP-has-privacyURL"parent="shibboleth.Conditions.Scripted"factory-method="inlineScript">
> <constructor-arg>
> <value>
> <![CDATA[
> var result = false;
> var rpUIContextClass = 
> "net.shibboleth.idp.ui.context.RelyingPartyUIContext";
> var authnContextClass = 
> "net.shibboleth.idp.authn.context.AuthenticationContext";
> if (profileContext !== null) {
> var authnContext = profileContext.getSubcontext(authnContextClass);
> if (authnContext !== null) {
> var rpUIContext = authnContext.getSubcontext(rpUIContextClass);
> if (rpUIContext !== null) {
> privacyURL = rpUIContext.getPrivacyStatementURL();
> if( privacyURL !== null) {
> result = true;
> }
> } } }
> result;
> ]]>
> </value>
> </constructor-arg>
> </bean>

It took a while until i found the solution how to check for the 
existence of a PrivacyStatementURL in the mdui:UIInfo extension of the 
metadata by using the rpUIContext [3].
The problem was to first get the AuthenticationContext and then find out 
how the rpUIContextClass-string looks like.

But now it seems working and i ask me if it would be a good example for 
how to retrieve informations from the mdui:UIInfo extension.
Where do you think is a good place in your documentation?

Please let me know what you think about this solution :-)
Did i some mistakes or maybe there is a shorter and simpler solution?

With nice regards.
Martin

[1] 
https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration#RelyingPartyConfiguration-OverridingDefaultSettingsDynamically3.3
[2] https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedPredicate
[3] https://wiki.shibboleth.net/confluence/display/IDP30/RpUIContext

-- 
Martin Lunze
IT-Systemadministrator

Technische Universität Dresden
Zentrum für Informationsdienste und Hochleistungsrechnen (ZIH)
Operative Prozesse und Systeme (OPS)
01062 Dresden

Tel.: +49 (351) 463-35881
E-Mail: martin.lunze at tu-dresden.de

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190620/a5094037/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5742 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20190620/a5094037/attachment.p7s>