[java-identity-provider] branch master updated: IDP-1459 - RuntimeException when using CAS and consent
Scott Cantor
cantor.2 at osu.edu
Thu Apr 9 11:31:33 EDT 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=de532a4e98ebfff3a6273018cadb08b3a260faaa
The following commit(s) were added to refs/heads/master by this push:
new de532a4 IDP-1459 - RuntimeException when using CAS and consent
de532a4 is described below
commit de532a4e98ebfff3a6273018cadb08b3a260faaa
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Apr 9 11:31:29 2020 -0400
IDP-1459 - RuntimeException when using CAS and consent
https://issues.shibboleth.net/jira/browse/IDP-1459
---
.../impl/BuildAuthenticationContextAction.java | 5 ++-
.../system/flows/cas/login/login-beans.xml | 10 -----
.../system/flows/cas/login/login-flow.xml | 52 +++++-----------------
.../idp/test/flows/cas/LoginFlowTest.java | 20 ++++++++-
4 files changed, 33 insertions(+), 54 deletions(-)
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildAuthenticationContextAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildAuthenticationContextAction.java
index 5a2161c..b8d29b3 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildAuthenticationContextAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildAuthenticationContextAction.java
@@ -70,7 +70,6 @@ public class BuildAuthenticationContextAction
final AuthenticationContext ac = new AuthenticationContext();
ac.setForceAuthn(request.isRenew());
- ac.setIsPassive(false);
final LoginConfiguration config = configLookupFunction.apply(profileRequestContext);
@@ -80,6 +79,10 @@ public class BuildAuthenticationContextAction
}
}
+ if (!ac.isForceAuthn()) {
+ ac.setIsPassive(request.isGateway());
+ }
+
if (config != null) {
ac.setProxyCount(config.getProxyCount(profileRequestContext));
}
diff --git a/idp-conf/src/main/resources/system/flows/cas/login/login-beans.xml b/idp-conf/src/main/resources/system/flows/cas/login/login-beans.xml
index b1c2bd1..02b45ec 100644
--- a/idp-conf/src/main/resources/system/flows/cas/login/login-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/cas/login/login-beans.xml
@@ -37,20 +37,10 @@
class="net.shibboleth.idp.cas.flow.impl.GrantServiceTicketAction" scope="prototype"
c:ticketService="#{getObject('shibboleth.CASTicketService') ?: getObject('shibboleth.DefaultCASTicketService')}" />
- <bean id="PopulateSessionContext"
- class="net.shibboleth.idp.session.impl.PopulateSessionContext" scope="prototype"
- p:activationCondition="%{idp.session.enabled:true}"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:sessionResolver-ref="shibboleth.SessionManager" />
-
<bean id="LoginConfigLookup"
class="net.shibboleth.idp.cas.config.ConfigLookupFunction" scope="prototype"
c:clazz="net.shibboleth.idp.cas.config.LoginConfiguration" />
- <bean id="SubjectContextLookup"
- class="org.opensaml.messaging.context.navigate.ChildContextLookup" scope="prototype"
- c:type="net.shibboleth.idp.authn.context.SubjectContext" />
-
<bean id="PopulatePostAuthnInterceptContext"
class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"
p:availableFlows-ref="shibboleth.AvailableInterceptFlows">
diff --git a/idp-conf/src/main/resources/system/flows/cas/login/login-flow.xml b/idp-conf/src/main/resources/system/flows/cas/login/login-flow.xml
index f213786..88e9f4d 100644
--- a/idp-conf/src/main/resources/system/flows/cas/login/login-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/cas/login/login-flow.xml
@@ -6,9 +6,6 @@
parent="cas.abstract">
<action-state id="InitializeLogin">
- <on-entry>
- <evaluate result="flowScope.hasAuthenticationContext" expression="false" />
- </on-entry>
<evaluate expression="InitializeProfileRequestContext"/>
<evaluate expression="FlowStartPopulateAuditContext" />
<evaluate expression="PopulateMetricContext" />
@@ -25,7 +22,6 @@
</subflow-state>
<action-state id="ContinueLogin">
- <evaluate expression="PopulateSessionContext"/>
<evaluate expression="BuildRelyingPartyContext" />
<evaluate expression="BuildSAMLMetadataContext" />
<evaluate expression="SelectRelyingPartyConfiguration" />
@@ -39,35 +35,15 @@
<decision-state id="CheckInboundInterceptContext">
<if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.ProfileInterceptorContext)).getAvailableFlows().isEmpty()"
- then="CheckAuthenticationRequired"
+ then="AuthenticationSetup"
else="DoInboundInterceptSubflow" />
</decision-state>
<subflow-state id="DoInboundInterceptSubflow" subflow="intercept">
<input name="calledAsSubflow" value="true" />
- <transition on="proceed" to="CheckAuthenticationRequired" />
+ <transition on="proceed" to="AuthenticationSetup" />
</subflow-state>
- <decision-state id="CheckAuthenticationRequired">
- <if test="flowScope.serviceTicketRequest.gateway"
- then="CheckForExistingSession"
- else="AuthenticationSetup" />
- </decision-state>
-
- <decision-state id="CheckForExistingSession">
- <on-entry>
- <set name="flowScope.sessionContext" value="SessionContextLookup.apply(opensamlProfileRequestContext)" />
- </on-entry>
- <if test="sessionContext != null and sessionContext.idPSession.authenticationResults.size() > 0"
- then="CheckResolveAttributes"
- else="PrepareForReturnToService" />
- </decision-state>
-
- <action-state id="PrepareForReturnToService">
- <set name="flowScope.redirectUrl" value="flowScope.serviceTicketRequest.service" />
- <transition to="CheckOutboundInterceptContext" />
- </action-state>
-
<action-state id="AuthenticationSetup">
<evaluate expression="BuildAuthenticationContext"/>
<evaluate expression="'proceed'" />
@@ -77,30 +53,22 @@
<subflow-state id="DoAuthenticationSubflow" subflow="authn">
<input name="calledAsSubflow" value="true" />
- <transition on="proceed" to="CheckResolveAttributes">
- <evaluate result="flowScope.hasAuthenticationContext" expression="true" />
- </transition>
+ <transition on="proceed" to="CheckResolveAttributes" />
+ <transition on="NoPassive" to="PassiveFailureReturnToService" />
<transition on="RestartAuthentication" to="AuthenticationSetup" />
</subflow-state>
+ <action-state id="PassiveFailureReturnToService">
+ <set name="flowScope.redirectUrl" value="flowScope.serviceTicketRequest.service" />
+ <transition to="CheckOutboundInterceptContext" />
+ </action-state>
+
<decision-state id="CheckResolveAttributes">
<if test="LoginConfigLookup.apply(opensamlProfileRequestContext).isResolveAttributes(opensamlProfileRequestContext)"
- then="CheckForSubjectContext"
+ then="ResolveAttributes"
else="GrantServiceTicket" />
</decision-state>
- <decision-state id="CheckForSubjectContext">
- <if test="SubjectContextLookup.apply(opensamlProfileRequestContext) == null"
- then="PopulateSubjectContext"
- else="ResolveAttributes" />
- </decision-state>
-
- <action-state id="PopulateSubjectContext">
- <evaluate expression="PopulateSubjectContext" />
- <evaluate expression="'proceed'" />
- <transition on="proceed" to="ResolveAttributes" />
- </action-state>
-
<action-state id="ResolveAttributes">
<evaluate expression="ResolveAttributes" />
<evaluate expression="FilterAttributes" />
diff --git a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
index c246ef6..7a544bd 100644
--- a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
+++ b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
@@ -48,6 +48,8 @@ import org.springframework.webflow.executor.FlowExecutionResult;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.google.common.net.HttpHeaders;
+
import java.util.Collections;
import java.util.List;
import java.util.regex.Matcher;
@@ -83,7 +85,7 @@ public class LoginFlowTest extends AbstractFlowTest {
@BeforeMethod
public void setUp() throws Exception {
- setPostAuthenticationFlows(Collections.<String>emptyList());
+ setPostAuthenticationFlows(Collections.emptyList());
}
@@ -96,6 +98,22 @@ public class LoginFlowTest extends AbstractFlowTest {
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
assertEquals(result.getOutcome().getId(), "RedirectToService");
+ final String url = externalContext.getExternalRedirectUrl();
+ assertTrue(url.contains(service + "?ticket=ST-"));
+ }
+
+ @Test
+ public void testGatewayNoSessionNoAuth() throws Exception {
+ final String service = "https://gateway.example.org/";
+ externalContext.getMockRequestParameterMap().put("service", service);
+ externalContext.getMockRequestParameterMap().put("gateway", "true");
+
+ // Have to remove the basic-auth creds or a passive login will succeed.
+ request.removeHeader(HttpHeaders.AUTHORIZATION);
+
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+
+ assertEquals(result.getOutcome().getId(), "RedirectToService");
assertEquals(externalContext.getExternalRedirectUrl(), service);
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list