LoginConfigStrategy example?

[Phil Chapman]

Thanks for your suggestion, Scott.  I've plumbed it into my password-authn-config.xml file, but still can't seem to define the bean correctly.  Is it just a case of decorating your <util:list> with the id="shibboleth.authn.JAAS.LoginConfigurations" attribute?  When I do this, I end up with the exception...

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.authn.Password.Validators': Cannot resolve reference to bean 'shibboleth.JAASValidator' while setting bean property 'sourceList' with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'ValidateUsernamePasswordAgainstJAAS' defined in class path resource [net/shibboleth/idp/flows/authn/password-authn-beans.xml]: Error setting property values; nested exception is org.springframework.beans.PropertyBatchUpdateException; nested PropertyAccessExceptions (1) are: PropertyAccessException 1: org.springframework.beans.TypeMismatchException: Failed to convert property value of type 'java.util.ArrayList' to required type 'java.util.Collection' for property 'loginConfigurations'; nested exception is java.lang.ClassCastException: class javax.security.auth.Subject cannot be cast to class java.util.Collection (javax.security.auth.Subject and java.util.Collection are in module java.base of loader 'bootstrap')

...so I guess I need to specify the bean type explicitly somewhere, but can't find an example of how.

After spending the day trying to crack this problem, my additions to password-authn-config.xml currently look like this:

    <bean id="Subject1" class="javax.security.auth.Subject">
        <constructor-arg><value>false</value></constructor-arg>
        <constructor-arg>
            <util:set value-type="java.security.Principal">
                <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
                <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
            </util:set>
        </constructor-arg>
        <constructor-arg><util:set value-type="java.security.Principal" /></constructor-arg>
        <constructor-arg><util:set value-type="java.security.Principal" /></constructor-arg>
    </bean>

    <bean id="Subject2" class="javax.security.auth.Subject">
        <constructor-arg><value>false</value></constructor-arg>
        <constructor-arg>
            <util:set value-type="java.security.Principal">
                <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="MySpecialClassRef" />
            </util:set>
        </constructor-arg>
        <constructor-arg><util:set value-type="java.security.Principal" /></constructor-arg>
        <constructor-arg><util:set value-type="java.security.Principal" /></constructor-arg>
    </bean>

    <util:list id="shibboleth.authn.JAAS.LoginConfigurations">
        <bean id="Login1" parent="shibboleth.Pair">
            <property name="first"><value>ShibUserPassAuth1</value></property>
            <property name="second" ref="Subject1" />
        </bean>
        <bean id="Login2" parent="shibboleth.Pair">
            <property name="first"><value>ShibUserPassAuth2</value></property>
            <property name="second" ref="Subject2" />
        </bean>
    </util:list>

Another pointer would be much appreciated!

BTW, the reason I'm still using JAAS is that I'm authenticating against a SQL database via JDBC; I'm not using LDAP at all.

Thanks,
Phil.

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: 19 May 2021 16:56
To: Shib Users <users at shibboleth.net>
Subject: Re: LoginConfigStrategy example?

On 5/19/21, 10:12 AM, "users on behalf of Phil Chapman" <users-bounces at shibboleth.net on behalf of phil.chapman at adept.co.uk> wrote:

>    I believe this should be possible by writing a shibboleth.authn.JAAS.LoginConfigStrategy Function bean, but
> can't get the syntax right and can't find any appropriate examples online. Does anyone have a sample that they
> can share which would meet my needs?

Doesn't require a function, though I probably would argue it's easier syntax.

"If the information the function would return is static, a bean named shibboleth.authn.JAAS.LoginConfigurations can be defined."

This is static (you're just associating each JAAS config with one or more principals).

Bean type is Collection<Pair<String,Subject>>

<util:list>
<!-- one config -->
<bean parent="shibboleth.Pair">
<constructor-arg>config1</constructor-arg>
<constructor-arg>
	<bean class="javax.security.auth.Subject">
		<constructor-arg>false</ constructor-arg>
		<constructor-arg>
			<util:set>
				<bean parent="shibboleth.SAML2AuthnContextClassRef"
				c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />			</util:set>
		</constructor-arg>
		<constructor-arg><null/></constructor-arg>
		<constructor-arg><null/></constructor-arg>
	</bean>
</constructor-arg>
</bean>
<!-- etc. -->
</util:list>

It's something like that, but I doubt it's exact.

FWIW, the historical advice to use JAAS is also largely out of date, that was needed when it was impractical to chain LDAPs or LDAP with other options. The IdP does this natively now and JAAS is slower comparatively speaking.

-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

Disclaimer

The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful.

This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more visit the Mimecast website.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210524/ae12721b/attachment.htm>