You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2016/03/26 19:15:27 UTC
[1/2] cxf-fediz git commit: Enforce ForceAuthn
Repository: cxf-fediz
Updated Branches:
refs/heads/master a1111af73 -> e5492d868
Enforce ForceAuthn
Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/b0c4e1af
Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/b0c4e1af
Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/b0c4e1af
Branch: refs/heads/master
Commit: b0c4e1afd56a5caacbede0a33892f79940791e48
Parents: a1111af
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Sat Mar 26 18:12:28 2016 +0000
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Sat Mar 26 18:12:28 2016 +0000
----------------------------------------------------------------------
.../idp/beans/samlsso/AuthnRequestParser.java | 28 +++++++++++++++-----
.../WEB-INF/flows/saml-signin-request.xml | 7 ++++-
2 files changed, 28 insertions(+), 7 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/b0c4e1af/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestParser.java
----------------------------------------------------------------------
diff --git a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestParser.java b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestParser.java
index 565de41..0f8dd49 100644
--- a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestParser.java
+++ b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestParser.java
@@ -53,12 +53,16 @@ public class AuthnRequestParser {
if (samlRequest == null) {
WebUtils.removeAttributeFromFlowScope(context, IdpConstants.SAML_AUTHN_REQUEST);
} else {
- try {
- parsedRequest = extractRequest(samlRequest);
- WebUtils.putAttributeInFlowScope(context, IdpConstants.SAML_AUTHN_REQUEST, parsedRequest);
- LOG.debug("SAML Request with id '{}' successfully parsed", parsedRequest.getID());
- } catch (Exception ex) {
- LOG.warn("Error parsing request: {}", ex.getMessage());
+ parsedRequest =
+ (AuthnRequest)WebUtils.getAttributeFromFlowScope(context, IdpConstants.SAML_AUTHN_REQUEST);
+ if (parsedRequest == null) {
+ try {
+ parsedRequest = extractRequest(samlRequest);
+ WebUtils.putAttributeInFlowScope(context, IdpConstants.SAML_AUTHN_REQUEST, parsedRequest);
+ LOG.debug("SAML Request with id '{}' successfully parsed", parsedRequest.getID());
+ } catch (Exception ex) {
+ LOG.warn("Error parsing request: {}", ex.getMessage());
+ }
}
}
}
@@ -118,6 +122,17 @@ public class AuthnRequestParser {
return null;
}
+ public boolean isForceAuthentication(RequestContext context) {
+ AuthnRequest authnRequest =
+ (AuthnRequest)WebUtils.getAttributeFromFlowScope(context, IdpConstants.SAML_AUTHN_REQUEST);
+ if (authnRequest != null) {
+ return authnRequest.isForceAuthn().booleanValue();
+ }
+
+ LOG.debug("No AuthnRequest available to be parsed");
+ return false;
+ }
+
private AuthnRequest extractRequest(String samlRequest) throws Exception {
byte[] deflatedToken = Base64Utility.decode(samlRequest);
InputStream tokenStream = new DeflateEncoderDecoder().inflateToken(deflatedToken);
@@ -130,4 +145,5 @@ public class AuthnRequestParser {
}
return request;
}
+
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/b0c4e1af/services/idp/src/main/webapp/WEB-INF/flows/saml-signin-request.xml
----------------------------------------------------------------------
diff --git a/services/idp/src/main/webapp/WEB-INF/flows/saml-signin-request.xml b/services/idp/src/main/webapp/WEB-INF/flows/saml-signin-request.xml
index a5c16f1..a609ae1 100644
--- a/services/idp/src/main/webapp/WEB-INF/flows/saml-signin-request.xml
+++ b/services/idp/src/main/webapp/WEB-INF/flows/saml-signin-request.xml
@@ -41,8 +41,13 @@
</decision-state>
<action-state id="checkTokenExpiry">
+ <on-entry>
+ <evaluate expression="authnRequestParser.parseSAMLRequest(flowRequestContext, flowScope.idpConfig,
+ flowScope.SAMLRequest)" />
+ </on-entry>
<evaluate
- expression="idpTokenExpiredAction.isTokenExpired(flowScope.homerealm, flowRequestContext)" />
+ expression="idpTokenExpiredAction.isTokenExpired(flowScope.homerealm, flowRequestContext)
+ or authnRequestParser.isForceAuthentication(flowRequestContext)" />
<transition on="yes" to="redirectToLocalIDP" />
<transition on="no" to="parseAndValidateSAMLRequest">
<set name="flowScope.idpToken" value="externalContext.sessionMap[flowScope.homerealm]" />
[2/2] cxf-fediz git commit: Add support to configure deflate encoding
Posted by co...@apache.org.
Add support to configure deflate encoding
Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/e5492d86
Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/e5492d86
Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/e5492d86
Branch: refs/heads/master
Commit: e5492d86845b6bef8783d560029812bfd3664c1e
Parents: b0c4e1a
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Sat Mar 26 18:15:00 2016 +0000
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Sat Mar 26 18:15:00 2016 +0000
----------------------------------------------------------------------
.../fediz/service/idp/beans/samlsso/AuthnRequestParser.java | 6 +++++-
.../fediz/service/idp/beans/samlsso/SamlResponseCreator.java | 2 +-
.../federation/samlsso/src/test/resources/entities-realma.xml | 2 +-
3 files changed, 7 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/e5492d86/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestParser.java
----------------------------------------------------------------------
diff --git a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestParser.java b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestParser.java
index 0f8dd49..c36f3d9 100644
--- a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestParser.java
+++ b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestParser.java
@@ -18,6 +18,7 @@
*/
package org.apache.cxf.fediz.service.idp.beans.samlsso;
+import java.io.ByteArrayInputStream;
import java.io.InputStream;
import java.io.InputStreamReader;
@@ -45,6 +46,7 @@ import org.springframework.webflow.execution.RequestContext;
public class AuthnRequestParser {
private static final Logger LOG = LoggerFactory.getLogger(AuthnRequestParser.class);
+ private boolean supportDeflateEncoding = true;
public void parseSAMLRequest(RequestContext context, Idp idp, String samlRequest) throws ProcessingException {
LOG.debug("Received SAML Request: {}", samlRequest);
@@ -135,7 +137,9 @@ public class AuthnRequestParser {
private AuthnRequest extractRequest(String samlRequest) throws Exception {
byte[] deflatedToken = Base64Utility.decode(samlRequest);
- InputStream tokenStream = new DeflateEncoderDecoder().inflateToken(deflatedToken);
+ InputStream tokenStream = supportDeflateEncoding
+ ? new DeflateEncoderDecoder().inflateToken(deflatedToken)
+ : new ByteArrayInputStream(deflatedToken);
Document responseDoc = StaxUtils.read(new InputStreamReader(tokenStream, "UTF-8"));
AuthnRequest request =
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/e5492d86/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/SamlResponseCreator.java
----------------------------------------------------------------------
diff --git a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/SamlResponseCreator.java b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/SamlResponseCreator.java
index a12f257..9ba1167 100644
--- a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/SamlResponseCreator.java
+++ b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/SamlResponseCreator.java
@@ -61,7 +61,7 @@ import org.springframework.webflow.execution.RequestContext;
public class SamlResponseCreator {
private static final Logger LOG = LoggerFactory.getLogger(SamlResponseCreator.class);
- private boolean supportDeflateEncoding;
+ private boolean supportDeflateEncoding = true;
public String createSAMLResponse(RequestContext context, Idp idp, Element rpToken,
String consumerURL, String requestId, String requestIssuer)
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/e5492d86/systests/federation/samlsso/src/test/resources/entities-realma.xml
----------------------------------------------------------------------
diff --git a/systests/federation/samlsso/src/test/resources/entities-realma.xml b/systests/federation/samlsso/src/test/resources/entities-realma.xml
index ec7782b..83cc384 100644
--- a/systests/federation/samlsso/src/test/resources/entities-realma.xml
+++ b/systests/federation/samlsso/src/test/resources/entities-realma.xml
@@ -138,7 +138,7 @@
<property name="parameters">
<util:map>
<entry key="sign.request" value="true" />
- <entry key="support.deflate.encoding" value="false" />
+ <entry key="support.deflate.encoding" value="true" />
</util:map>
</property>
</bean>