<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1740443421;
mso-list-type:hybrid;
mso-list-template-ids:-1817928422 67698705 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have a working shibboleth idp v5.1.4 SAML proxy that delegates the authentication to an upstream shibboleth idp. Now I’d like to add a custom extension to the SAML AuthnRequest that the proxy posts to the upstream idp so that I can add
some more function on the upstream idp.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In a simplest form, I tried these steps:<o:p></o:p></p>
<ol style="margin-top:0in" start="1" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">Made a java class CustomExtension that either extends org.springframework.webflow.execution.Action, where I overrode execute() method; or extends org.opensaml.profile.ProfileRequestContext,
where I overrode doExecute() method. Basically, just hardcoded a string value to a custom extension in AuthnRequest. Tried both implementations in the test with below config.<o:p></o:p></li></ol>
<p class="MsoListParagraph"><o:p> </o:p></p>
<ol style="margin-top:0in" start="2" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">Configured a bean in global.xml for the java, like this:<o:p></o:p></li></ol>
<p class="MsoListParagraph" style="margin-left:1.0in"><bean id=”customExtension” class=”CustomExtension”/><o:p></o:p></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><o:p> </o:p></p>
<ol style="margin-top:0in" start="3" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">Create a folder and file conf/intercept/inject-custom-extension/inject-custom-extension-flow.xml, like this:<o:p></o:p></li></ol>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><flow …some_namespace_defs…><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><action-state id=”injectCustomExtension”><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in;text-indent:.5in"><evaluate expression=”customExtension”/><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in;text-indent:.5in"><transition to=”proceed”/><o:p></o:p></p>
<p class="MsoNormal"> </action-state><o:p></o:p></p>
<p class="MsoNormal"> <end-state id=”proceed”/><o:p></o:p></p>
<p class="MsoNormal"> </flow><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<ol style="margin-top:0in" start="4" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">In relying-party.xml, I have this to reference the injection flow:<o:p></o:p></li></ol>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><util:list id=”shibboleth.RelyingPartyOverrides”><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in">….<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <bean id=”dev-idp” parent=”RelyingPartyByName” c:relyingPartyIds=”…my_upstream_idp_entityID…”><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <property name=”profileConfigurations”><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <list><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <bean parent=”SAML2.SSO” p:outboundInterceptorFlows=”inject-custom-extension”/><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> </list><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> </property><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> </bean><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"></util:list><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">That’s all the config I have. In the java code I have log.info() within the constructor and the overriding execute() method as soon as it gets into the method. Sent a SP request for the test and it went through like no effect from the interceptor.
No errors either. Logs show the constructor of the java CustomExtension is called, but execute() (or doExecute() in the case for extending ProfileRequestContext) is never called.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Do you see the way I am doing this is correct? If this is totally non-starter, what is the right way to implement the task of adding acustom extension to AuthnRequest issued by the proxy idp?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you so much in advance for any suggestion you can provide.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Johnny<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>