<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
Hello Scott!</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<span>> https://wiki.shibboleth.net/confluence/display/IDP4/PredefinedBeans<br>
</span><span>> Under "Other Beans"</span></div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
Sorry, I didn't see that message before writing my last mail.</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
So the injectable bean I need is this one:<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
net.shibboleth.utilities.java.support.net.ThreadLocalHttpServletRequestProxy</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
The other thing, about not using Annotations for wiring but doing that in xml files somewhere:</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
Can you give me some pointers how / where to do that in the supported way?</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
Thank you!</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
Kind regards,</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
Thomas Käfer</div>
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Von:</b> Käfer Thomas <thomas.kaefer@fh-campuswien.ac.at><br>
<b>Gesendet:</b> Montag, 29. Juni 2020 09:01<br>
<b>An:</b> Shib Users <users@shibboleth.net><br>
<b>Betreff:</b> AW: IDP3/4 -> read (&write) custom session cookie for authentication</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
Hi there Scott!</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
Thank you for your continued support even though my organisation is not a member of the Consortium. You have been of great help to me already!
<span id="x_🙂">🙂</span><br>
</div>
<span><br>
</span>
<div>> There I found the HttpServletRequestResponseContext which I was able to use ..<br>
</div>
<div>>> Use the bean we provide to access that class. It's essentially the same but you're depending on things we may change.<br>
</div>
<div><br>
</div>
<div><span>How do I find that bean? I looked around in the packages net.shibboleth.utilities.java.support.* but I couldn't find anything that provides access to these properties of the Request or the Request instance itself:</span></div>
<div><span><br>
</span></div>
<div><span><span>String remoteAddress = HttpServletRequestResponseContext.getRequest().getRemoteAddr();<br>
</span><span>String userAgent = HttpServletRequestResponseContext.getRequest().getHeader("User-Agent");</span><br>
</span></div>
<div><span><br>
</span></div>
<div><span><br>
</span></div>
<div><span>And another problem: It seem Injection doesn't work in JAAS to gain access to the CookieManager. This remains null in my
<br>
</span></div>
<div><span>Class implementing the javax.security.auth.spi.LoginModule interface:<br>
</span></div>
<div><span><span>@Autowired<br>
</span>
<div>@Qualifier("shibboleth.CookieManager")<br>
</div>
<span>CookieManager cm;</span><br>
</span></div>
<div><span><br>
</span></div>
<div><span>And I see no mention of it in in the logfiles.</span></div>
<div><span><br>
</span></div>
<div><span>So for now I used this to set our legacy (non-shibboleth) auth cookie after successful username+password authentication (which works
<span id="x_🙂">🙂</span>):</span></div>
<div><span>HttpServletRequestResponseContext.getResponse().addCookie(cookie);<br>
</span></div>
<div><span><br>
</span></div>
<div><span>Could I maybe use a CredentialValidator (or something else) instead of JAAS which does support injection?</span></div>
<div><span><a href="https://wiki.shibboleth.net/confluence/display/IDP4/PasswordAuthnConfiguration" id="LPlnk650794">https://wiki.shibboleth.net/confluence/display/IDP4/PasswordAuthnConfiguration</a><br>
</span></div>
<div><span><br>
</span></div>
<div><span>Thanks a lot!<br>
</span></div>
<div><span>Kind regards,</span></div>
<div><span>Thomas Käfer<br>
</span></div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>Von:</b> Käfer Thomas <thomas.kaefer@fh-campuswien.ac.at><br>
<b>Gesendet:</b> Donnerstag, 25. Juni 2020 18:57<br>
<b>An:</b> Shib Users <users@shibboleth.net><br>
<b>Betreff:</b> AW: IDP3/4 -> read (&write) custom session cookie for authentication</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
Hello Scott!</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
I found a solution for this one myself, by looking around in the package of that CookieManager you gave me (net.shibboleth.utilities.java.support.net)</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
There I found the HttpServletRequestResponseContext which I was able to use like this:<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
HttpServletRequestResponseContext.getRequest().getRemoteAddr();</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
HttpServletRequestResponseContext.getRequest().getHeader("User-Agent");</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
Now I can successfully authenticate users who have this legacy auth cookie set on our domain.</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
My next task is to set this cookie for users who don't have it yet but can supply a valid username + password combination.</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
The place where I verify those at the moment is a JAAS implementation, but there I don't have access to "HttpServletRequestResponseContext" (or do I?)</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
Is there a way to ask Shibboleth to get the user to enter a username+password set for verification out of such a AuthFunction?</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
Thank you a lot!</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
Kind regards</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
Thomas Käfer<br>
</div>
<div id="x_x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>Von:</b> Käfer Thomas <thomas.kaefer@fh-campuswien.ac.at><br>
<b>Gesendet:</b> Donnerstag, 25. Juni 2020 18:20<br>
<b>An:</b> Shib Users <users@shibboleth.net><br>
<b>Betreff:</b> AW: IDP3/4 -> read (&write) custom session cookie for authentication</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
Hello Scott!</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
> I added a mention of the proper way to handle cookies into the documentation, and that does not rely on doing it by hand.<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
Thank you! That helped me a lot!</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
So I now got this:</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<span><b>@Autowired<br>
</b></span>
<div><b>@Qualifier("shibboleth.CookieManager")<br>
</b></div>
<b><span>CookieManager cm;</span></b></div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
which allowed me to read the cookie, but I also need the User-Agent and the RemoteAddress (to allow the legacy Auth Service to verify that the Cookie hasn't been transfered).</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
I could have gotten that from the HttpServletRequest, but I can't get from this CookieManager.</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
Can you give me some pointers how to get that too?</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
Thank you heaps!</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
Kind regards</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
Thomas Käfer</div>
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_x_x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_x_x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>Von:</b> Käfer Thomas <thomas.kaefer@fh-campuswien.ac.at><br>
<b>Gesendet:</b> Donnerstag, 25. Juni 2020 14:30<br>
<b>An:</b> Shib Users <users@shibboleth.net><br>
<b>Betreff:</b> AW: IDP3/4 -> read (&write) custom session cookie for authentication</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr"><span>Dear Scott,<br>
</span>
<div><br>
</div>
<div>sorry for the long pause.<br>
</div>
<div><br>
</div>
<div>I've now written a Class like this:<br>
</div>
<div><b><br>
</b></div>
<div><b>public class AuthFunction implements Function<ProfileRequestContext<AuthnRequest, String>, Object> {<br>
</b></div>
<div><b>@Override<br>
</b></div>
<div><b>public Object apply(ProfileRequestContext<AuthnRequest, String> arg0) {...}<br>
</b></div>
<div><b>}</b><br>
</div>
<div><br>
</div>
<div>And made my Shibboleth IDP4 use it by having this line in the config file:<br>
</div>
<div><b><bean id="shibboleth.authn.Function.ResultLookupStrategy" class="at.ac.fhcampuswien.campusauth.AuthFunction" /></b><br>
</div>
<div>in the file <b>/opt/shibboleth-idp/conf/authn/function-authn-config.xml</b><br>
</div>
<div><br>
</div>
<div>And the line<br>
</div>
<div><b>idp.authn.flows= Function</b><br>
</div>
<div>in the file <b>/opt/shibboleth-idp/conf/idp.properties</b><br>
</div>
<div><br>
</div>
<div>By returning a hard coded username in that "<b>apply</b>" method, I managed to get successful authentication.</div>
<div><br>
</div>
<div>The problem I have not yet solved is accessing the HttpRequest for getting & HttpResponse for setting my custom authentication cookie (for Single-Sign-On compatibility with some legacy applications that don't use shibboleth for authentification)<br>
</div>
<div><br>
</div>
<div>You said in a previous mail that I need to use injection for that. I tried:<br>
</div>
<div><b>@Autowired<br>
</b></div>
<div><b>org.opensaml.messaging.context.httpclient.HttpClientRequestContext h;</b><br>
</div>
<div><br>
</div>
<div>Which gives me this exception:<br>
</div>
<div><b>org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type 'org.opensaml.messaging.context.httpclient.HttpClientRequestContext' available<br>
</b></div>
<div><br>
</div>
<div>I also tried <br>
</div>
<div><b>@Autowired<br>
</b></div>
<div><b>javax.servlet.http.HttpServletRequest h;</b><br>
</div>
<div><br>
</div>
<div>Which gives the similar exception:<br>
</div>
<div><b>org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type 'javax.servlet.http.HttpServletRequest' available</b><br>
</div>
<div><br>
</div>
<div>Could you please give some more details on how to inject the HttpRequest so I can access the cookie I need?<br>
</div>
<div><br>
</div>
<div>Thank you<br>
</div>
<div>kind regards<br>
</div>
<div><span>Thomas Käfer</span></div>
<div><br>
</div>
<div id="x_x_x_x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_x_x_x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>Von:</b> users <users-bounces@shibboleth.net> im Auftrag von Cantor, Scott <cantor.2@osu.edu><br>
<b>Gesendet:</b> Dienstag, 28. April 2020 16:49<br>
<b>An:</b> Shib Users <users@shibboleth.net><br>
<b>Betreff:</b> Re: IDP3/4 -> read (&write) custom session cookie for authentication</font>
<div> </div>
</div>
<div class="x_x_x_x_BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="x_x_x_x_PlainText">On 4/28/20, 9:21 AM, "users on behalf of Käfer Thomas" <users-bounces@shibboleth.net on behalf of thomas.kaefer@fh-campuswien.ac.at> wrote:<br>
<br>
> Do you maybe have a pre-existing example of any (similar) login flow usage that I could infer how to do this from (I'd<br>
> prefer Java to Javascript-let)..<br>
<br>
That's just too broad a question for me to answer, all there is the source code and the documentation on writing a custom login flow [1] combined with the little bit of higher level documentation. But a function to do this is far different then a real flow.
There's nothing you're intended to rely on in the IdP for the most part other than some low level objects like the servlet API, it's just supposed to do its work and return the result.<br>
<br>
The rest is a matter of Java and Spring and whatever you're actually trying to build it to do. If you're doing REST, then you should use the HttpClient work we have, and we have documentation on wiring that up.<br>
<br>
> Also even if I understand the concept of bean injection, I sadly have no idea of how to do this in the Shibboleth context,<br>
> and again I couldn't find any examples using Google.<br>
<br>
Shibboleth has nothing to do with that part, this is a Spring-based implementation, it's the Spring documentation you have to read to understand how to relate objects together. We supply or standardize the objects, it's Spring configuration that puts them together.
We have documentation on that and pointers to the parts of the Spring documentation that are required reading.<br>
<br>
-- Scott<br>
<br>
[1] <a href="https://wiki.shibboleth.net/confluence/display/IDP4/Authentication">
https://wiki.shibboleth.net/confluence/display/IDP4/Authentication</a><br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</div>
</span></font></div>
</div>
</div>
</div>
</div>
<div style="font-size:10pt; font-family: 'Verdana',sans-serif;">
<p>Informationen zum Datenschutz: www.fh-campuswien.ac.at/datenschutzerklaerung </p>
</div>
</body>
</html>