Remove Address from SubjectConfirmationData

[Plovich, Tony]

Hello Nate,

Thanks for the response, and taking a look at the source.  If it works, your solution would be a good way to test whether removing Address will fix this SP.

I'll also try submitting a feature request for supporting this long term.


Tony Plovich
Business Information Systems
Argonne National Laboratory

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Nate Klingenstein <ndk at signet.id>
Sent: Friday, February 5, 2021 6:14 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Remove Address from SubjectConfirmationData

Tony,

Well, actually, if you just yank the HTTP Servlet Request property from that bean, you might end up with chaotic explosions, or you might end up with nothing populated.  My Java stinks, so I can't tell you definitively, but if I were you, I would try that just for fun.

/system/flows/saml/saml2/sso-abstract-beans.xml:

    <bean id="AddSubjectConfirmationToSubjects"
        class="org.opensaml.saml.saml2.profile.impl.AddSubjectConfirmationToSubjects" scope="prototype"
        p:httpServletRequest-ref="shibboleth.HttpServletRequest"
        p:method="urn:oasis:names:tc:SAML:2.0:cm:bearer" />

->

    <bean id="AddSubjectConfirmationToSubjects"
        class="org.opensaml.saml.saml2.profile.impl.AddSubjectConfirmationToSubjects" scope="prototype"
        p:method="urn:oasis:names:tc:SAML:2.0:cm:bearer" />


Note that this would be a universal change, though, impacting all assertions coming out of the IdP.  If it works.


http://git.shibboleth.net/view/?p=java-opensaml.git;a=blob;f=opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddSubjectConfirmationToSubjects.java;h=3a8c721957b420c7b11f39da55a5ebf8a23ca4b4;hb=HEAD

 121         // Default pulls from servlet request.
 122         addressLookupStrategy = new Function<>() {
 123             public String apply(final ProfileRequestContext input) {
 124                 final String address = getHttpServletRequest() != null ?
 125                         HttpServletSupport.getRemoteAddr(getHttpServletRequest()) : null;
 126                 log.debug("{} Setting confirmation data Address to {}", getLogPrefix(),
 127                         address != null ? address : "(none)");
 128                 return address;
 129             }
 130         };

 289         SubjectConfirmationData confirmationData = null;
 290
 291         final String address = addressLookupStrategy != null
 292                 ? addressLookupStrategy.apply(profileRequestContext) : null;
 293         if (address != null) {
 294             confirmationData = confirmationData != null ? confirmationData : confirmationDataBuilder.buildObject();
 295             confirmationData.setAddress(address);
 296         }

 319         if (confirmationData != null) {
 320             confirmation.setSubjectConfirmationData(confirmationData);
 321         }


Probably shouldn't be sending this,
Nate.
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210208/4865bce9/attachment.htm>