shibboleth.Conditions.Scripted and User-Agent http header ?

[Jarno Huuskonen]

Hi,

On Fri, 2022-03-25 at 13:11 +0000, Cantor, Scott via users wrote:
> shibboleth.HttpServletRequest is the bean for the request object. Plug it
> into the condition bean as a customObject-ref and you can access it, there
> are examples in the wiki under ActivationConditions and other places and
> it's been covered on the list many times.

Thanks !

Found examples from
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631622/SPNEGOAuthnConfiguration

Just can't seem to get it running:

in global.xml:
<bean id="UEFSameSiteCondition" parent="shibboleth.Conditions.Scripted"
factory-method="inlineScript"
        p:customObject-ref="shibboleth.HttpServletRequest"
p:returnOnError="true" p:hideExceptions="true">
    <constructor-arg>
        <value>
        <![CDATA[
            true;
         ]]>
        </value>
    </constructor-arg>
</bean>

and in idp.properties:
idp.cookie.sameSiteCondition = UEFSameSiteCondition

results in ERROR
[net.shibboleth.utilities.java.support.logic.ScriptedPredicate:114] -
JSESSIONID= - Scripted Predicate from Inline: Input of type class
org.apache.catalina.connector.RequestFacade was not of type class
org.opensaml.profile.context.ProfileRequestContext

BTW I think resourceScript example in
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631706/ScriptedPredicate
has the parameters in wrong order:
"If two parameters are provided, the the first is the name of the
(installed) JSR-223 lanuage and the second is the location."

the example has c:_0= file and c:_1= the language.

With resourceScript(<bean id="UEFSameSiteCondition"
parent="shibboleth.Conditions.Scripted" factory-method="resourceScript"
        p:customObject-ref="shibboleth.HttpServletRequest"
p:returnOnError="true" p:hideExceptions="true"
        c:_0="javascript" c:_1="/opt/shibboleth-idp/conf/samesite.js" />
)

I can get this javascript running:
//-----------------------------
var activate = true;
var logger =
Java.type("org.slf4j.LoggerFactory").getLogger("shibboleth.sameSiteCondition
");
logger.info('JJH condition running');
var identifier = custom.getHeader("User-Agent");
activate;
//-----------------------------

but trying to access headers fails with:
Current HttpServletRequest has not been loaded via
HttpServletRequestResponseContext

Exception

net.shibboleth.utilities.java.support.logic.ConstraintViolationException:
Current HttpServletRequest has not been loaded via
HttpServletRequestResponseContext
	net.shibboleth.utilities.java.support.logic.Constraint.isNotNull(Co
nstraint.java:307)
	net.shibboleth.utilities.java.support.net.ThreadLocalHttpServletReq
uestProxy.getCurrent(ThreadLocalHttpServletRequestProxy.java:405)
	net.shibboleth.utilities.java.support.net.ThreadLocalHttpServletReq
uestProxy.getHeader(ThreadLocalHttpServletRequestProxy.java:215)
	jdk.scripting.nashorn.scripts/jdk.nashorn.internal.scripts.Script$R
ecompilation$3$\^eval\_$cu1$restOf.:program(<eval>:4)
	jdk.scripting.nashorn/jdk.nashorn.internal.runtime.ScriptFunctionDa
ta.invoke(ScriptFunctionData.java:655)
	jdk.scripting.nashorn/jdk.nashorn.internal.runtime.ScriptFunction.i
nvoke(ScriptFunction.java:513)
	jdk.scripting.nashorn/jdk.nashorn.internal.runtime.ScriptRuntime.ap
ply(ScriptRuntime.java:527)
	jdk.scripting.nashorn/jdk.nashorn.api.scripting.NashornScriptEngine
.evalImpl(NashornScriptEngine.java:428)
	jdk.scripting.nashorn/jdk.nashorn.api.scripting.NashornScriptEngine
$3.eval(NashornScriptEngine.java:521)
	net.shibboleth.utilities.java.support.scripting.EvaluableScript.eva
l(EvaluableScript.java:380)
	net.shibboleth.utilities.java.support.scripting.AbstractScriptEvalu
ator.evaluate(AbstractScriptEvaluator.java:178)
	net.shibboleth.utilities.java.support.logic.ScriptedPredicate.test(
ScriptedPredicate.java:119)
	net.shibboleth.utilities.java.support.net.SameSiteCookieHeaderFilte
r.doFilter(SameSiteCookieHeaderFilter.java:202)
	org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate
(DelegatingFilterProxy.java:354)
	org.springframework.web.filter.DelegatingFilterProxy.doFilter(Deleg
atingFilterProxy.java:267)


-Jarno

-- 
Jarno Huuskonen