You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@syncope.apache.org by mm...@apache.org on 2020/03/05 08:41:01 UTC
[syncope] branch SYNCOPE-163-1 updated: add conf modules for
delegated oidc and saml2-idp authn
This is an automated email from the ASF dual-hosted git repository.
mmoayyed pushed a commit to branch SYNCOPE-163-1
in repository https://gitbox.apache.org/repos/asf/syncope.git
The following commit(s) were added to refs/heads/SYNCOPE-163-1 by this push:
new 31ccbc3 add conf modules for delegated oidc and saml2-idp authn
31ccbc3 is described below
commit 31ccbc391060a364bff052245211a03d0b269dd2
Author: Misagh Moayyed <mm...@gmail.com>
AuthorDate: Thu Mar 5 12:10:44 2020 +0330
add conf modules for delegated oidc and saml2-idp authn
---
.../OIDCAuthenticationModuleConf.java | 179 +++++++++
.../SAML2IdPAuthenticationModuleConf.java | 426 +++++++++++++++++++++
2 files changed, 605 insertions(+)
diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/authentication/OIDCAuthenticationModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/authentication/OIDCAuthenticationModuleConf.java
new file mode 100644
index 0000000..de46774
--- /dev/null
+++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/authentication/OIDCAuthenticationModuleConf.java
@@ -0,0 +1,179 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+
+package org.apache.syncope.common.lib.authentication;
+
+import javax.xml.bind.annotation.XmlRootElement;
+import javax.xml.bind.annotation.XmlType;
+
+import java.util.HashMap;
+import java.util.Map;
+
+@XmlRootElement(name = "oidcAuthenticationModuleConf")
+@XmlType
+public class OIDCAuthenticationModuleConf extends AbstractAuthenticationModuleConf {
+ private static final long serialVersionUID = -471527731042579422L;
+
+ /**
+ * The client id.
+ */
+ private String id;
+
+ /**
+ * The client secret.
+ */
+ private String secret;
+
+ /**
+ * The attribute value that should be used
+ * for the authenticated username, upon a successful authentication
+ * attempt.
+ */
+ private String userIdAttribute;
+
+ private String discoveryUri;
+
+ /**
+ * Whether an initial nonce should be to used
+ * initially for replay attack mitigation.
+ */
+ private boolean useNonce;
+
+ /**
+ * Requested scope(s).
+ */
+ private String scope;
+
+ /**
+ * The JWS algorithm to use forcefully when validating ID tokens.
+ * If none is defined, the first algorithm from metadata will be used.
+ */
+ private String preferredJwsAlgorithm;
+
+ /**
+ * Clock skew in order to account for drift, when validating id tokens.
+ */
+ private int maxClockSkew;
+
+ /**
+ * Custom parameters to send along in authZ requests, etc.
+ */
+ private Map<String, String> customParams = new HashMap<>(0);
+
+ /**
+ * The response mode specifies how the result of the authorization request is formatted.
+ * Possible values includes "query", "fragment", "form_post", or "web_message"
+ */
+ private String responseMode;
+
+ /**
+ * The response type tells the authorization server which grant to execute.
+ * Possibles values includes "code", "token" or "id_token".
+ */
+ private String responseType;
+
+
+ public String getId() {
+ return id;
+ }
+
+ public void setId(final String id) {
+ this.id = id;
+ }
+
+ public String getSecret() {
+ return secret;
+ }
+
+ public void setSecret(final String secret) {
+ this.secret = secret;
+ }
+
+ public String getUserIdAttribute() {
+ return userIdAttribute;
+ }
+
+ public void setUserIdAttribute(final String userIdAttribute) {
+ this.userIdAttribute = userIdAttribute;
+ }
+
+ public String getDiscoveryUri() {
+ return discoveryUri;
+ }
+
+ public void setDiscoveryUri(final String discoveryUri) {
+ this.discoveryUri = discoveryUri;
+ }
+
+ public boolean isUseNonce() {
+ return useNonce;
+ }
+
+ public void setUseNonce(final boolean useNonce) {
+ this.useNonce = useNonce;
+ }
+
+ public String getScope() {
+ return scope;
+ }
+
+ public void setScope(final String scope) {
+ this.scope = scope;
+ }
+
+ public String getPreferredJwsAlgorithm() {
+ return preferredJwsAlgorithm;
+ }
+
+ public void setPreferredJwsAlgorithm(final String preferredJwsAlgorithm) {
+ this.preferredJwsAlgorithm = preferredJwsAlgorithm;
+ }
+
+ public int getMaxClockSkew() {
+ return maxClockSkew;
+ }
+
+ public void setMaxClockSkew(final int maxClockSkew) {
+ this.maxClockSkew = maxClockSkew;
+ }
+
+ public Map<String, String> getCustomParams() {
+ return customParams;
+ }
+
+ public void setCustomParams(final Map<String, String> customParams) {
+ this.customParams = customParams;
+ }
+
+ public String getResponseMode() {
+ return responseMode;
+ }
+
+ public void setResponseMode(final String responseMode) {
+ this.responseMode = responseMode;
+ }
+
+ public String getResponseType() {
+ return responseType;
+ }
+
+ public void setResponseType(final String responseType) {
+ this.responseType = responseType;
+ }
+}
diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/authentication/SAML2IdPAuthenticationModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/authentication/SAML2IdPAuthenticationModuleConf.java
new file mode 100644
index 0000000..18d7b77
--- /dev/null
+++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/authentication/SAML2IdPAuthenticationModuleConf.java
@@ -0,0 +1,426 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+
+package org.apache.syncope.common.lib.authentication;
+
+import javax.xml.bind.annotation.XmlRootElement;
+import javax.xml.bind.annotation.XmlType;
+
+import java.util.ArrayList;
+import java.util.List;
+
+@XmlRootElement(name = "saml2IdPAuthenticationModuleConf")
+@XmlType
+public class SAML2IdPAuthenticationModuleConf extends AbstractAuthenticationModuleConf {
+ private static final long serialVersionUID = -471527731042579422L;
+
+ /**
+ * The attribute value that should be used
+ * for the authenticated username, upon a successful authentication
+ * attempt.
+ */
+ private String userIdAttribute;
+
+ /**
+ * The destination binding to use
+ * when creating authentication requests.
+ */
+ private String destinationBinding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
+
+ /**
+ * The password to use when generating the SP keystore.
+ */
+ private String keystorePassword;
+
+ /**
+ * The password to use when generating the private key for the SP keystore.
+ */
+ private String privateKeyPassword;
+
+ /**
+ * Location of the keystore to use and generate the SP keystore.
+ */
+ private String keystorePath;
+
+ /**
+ * The metadata location of the identity provider that is to handle authentications.
+ */
+ private String identityProviderMetadataPath;
+
+ /**
+ * Flag to indicate whether the allow-create flags
+ * for nameid policies should be set to true, false or ignored/defined.
+ * Accepted values are true, false or undefined.
+ */
+ private String nameIdPolicyAllowCreate = "undefined";
+
+ /**
+ * Once you have an authenticated session on the identity provider, usually it won't prompt you again to enter your
+ * credentials and it will automatically generate a new assertion for you. By default, the SAML client
+ * will accept assertions based on a previous authentication for one hour.
+ * You can adjust this behavior by modifying this setting. The unit of time here is seconds.
+ */
+ private int maximumAuthenticationLifetime = 3600;
+
+ /**
+ * Maximum skew in seconds between SP and IDP clocks.
+ * This skew is added onto the {@code NotOnOrAfter} field in seconds
+ * for the SAML response validation.
+ */
+ private int acceptedSkew = 300;
+
+ /**
+ * The entity id of the SP that is used in the SP metadata generation process.
+ */
+ private String serviceProviderEntityId;
+
+ /**
+ * Location of the SP metadata to use and generate.
+ */
+ private String serviceProviderMetadataPath;
+
+ /**
+ * Whether authentication requests should be tagged as forced auth.
+ */
+ private boolean forceAuth;
+
+ /**
+ * Whether authentication requests should be tagged as passive.
+ */
+ private boolean passive;
+
+ /**
+ * Requested authentication context class in authn requests.
+ */
+ private List<String> authnContextClassRef = new ArrayList<>(0);
+
+ /**
+ * Specifies the comparison rule that should be used to evaluate the specified authentication methods.
+ * For example, if exact is specified, the authentication method used must match one of the authentication
+ * methods specified by the AuthnContextClassRef elements.
+ * AuthContextClassRef element require comparison rule to be used to evaluate the specified
+ * authentication methods. If not explicitly specified "exact" rule will be used by default.
+ * Other acceptable values are minimum, maximum, better.
+ */
+ private String authnContextComparisonType = "exact";
+
+
+ /**
+ * The key alias used in the keystore.
+ */
+ private String keystoreAlias;
+
+
+ /**
+ * NameID policy to request in the authentication requests.
+ */
+ private String nameIdPolicyFormat;
+
+ /**
+ * Whether metadata should be marked to request sign assertions.
+ */
+ private boolean wantsAssertionsSigned;
+
+ /**
+ * AttributeConsumingServiceIndex attribute of AuthnRequest element.
+ * The given index points out a specific AttributeConsumingService structure, declared into the
+ * Service Provider (SP)'s metadata, to be used to specify all the attributes that the Service Provider
+ * is asking to be released within the authentication assertion returned by the Identity Provider (IdP).
+ * This attribute won't be sent with the request unless a positive value (including 0) is defined.
+ */
+ private int attributeConsumingServiceIndex;
+
+ /**
+ * Allows the SAML client to select a specific ACS url from the metadata, if defined.
+ * A negative value de-activates the selection process and is the default.
+ */
+ private int assertionConsumerServiceIndex = -1;
+
+ /**
+ * Whether name qualifiers should be produced
+ * in the final saml response.
+ */
+ private boolean useNameQualifier = true;
+
+ /**
+ * Whether or not SAML SP metadata should be signed when generated.
+ */
+ private boolean signServiceProviderMetadata;
+
+ /**
+ * Whether or not the authnRequest should be signed.
+ */
+ private boolean signAuthnRequest;
+
+ /**
+ * Whether or not the Logout Request sent from the SP should be signed.
+ */
+ private boolean signServiceProviderLogoutRequest;
+
+ /**
+ * Collection of signing signature blacklisted algorithms, if any, to override the global defaults.
+ */
+ private List<String> blackListedSignatureSigningAlgorithms = new ArrayList<>(0);
+
+ /**
+ * Collection of signing signature algorithms, if any, to override the global defaults.
+ */
+ private List<String> signatureAlgorithms = new ArrayList<>(0);
+
+ /**
+ * Collection of signing signature reference digest methods, if any, to override the global defaults.
+ */
+ private List<String> signatureReferenceDigestMethods = new ArrayList<>(0);
+
+ /**
+ * The signing signature canonicalization algorithm, if any, to override the global defaults.
+ */
+ private String signatureCanonicalizationAlgorithm;
+
+ /**
+ * Provider name set for the saml authentication request.
+ * Sets the human-readable name of the requester for use by
+ * the presenter's user agent or the identity provider.
+ */
+ private String providerName;
+
+ public String getUserIdAttribute() {
+ return userIdAttribute;
+ }
+
+ public void setUserIdAttribute(final String userIdAttribute) {
+ this.userIdAttribute = userIdAttribute;
+ }
+
+ public String getDestinationBinding() {
+ return destinationBinding;
+ }
+
+ public void setDestinationBinding(final String destinationBinding) {
+ this.destinationBinding = destinationBinding;
+ }
+
+ public String getKeystorePassword() {
+ return keystorePassword;
+ }
+
+ public void setKeystorePassword(final String keystorePassword) {
+ this.keystorePassword = keystorePassword;
+ }
+
+ public String getPrivateKeyPassword() {
+ return privateKeyPassword;
+ }
+
+ public void setPrivateKeyPassword(final String privateKeyPassword) {
+ this.privateKeyPassword = privateKeyPassword;
+ }
+
+ public String getKeystorePath() {
+ return keystorePath;
+ }
+
+ public void setKeystorePath(final String keystorePath) {
+ this.keystorePath = keystorePath;
+ }
+
+ public String getIdentityProviderMetadataPath() {
+ return identityProviderMetadataPath;
+ }
+
+ public void setIdentityProviderMetadataPath(final String identityProviderMetadataPath) {
+ this.identityProviderMetadataPath = identityProviderMetadataPath;
+ }
+
+ public int getMaximumAuthenticationLifetime() {
+ return maximumAuthenticationLifetime;
+ }
+
+ public void setMaximumAuthenticationLifetime(final int maximumAuthenticationLifetime) {
+ this.maximumAuthenticationLifetime = maximumAuthenticationLifetime;
+ }
+
+ public int getAcceptedSkew() {
+ return acceptedSkew;
+ }
+
+ public void setAcceptedSkew(final int acceptedSkew) {
+ this.acceptedSkew = acceptedSkew;
+ }
+
+ public String getServiceProviderEntityId() {
+ return serviceProviderEntityId;
+ }
+
+ public void setServiceProviderEntityId(final String serviceProviderEntityId) {
+ this.serviceProviderEntityId = serviceProviderEntityId;
+ }
+
+ public String getServiceProviderMetadataPath() {
+ return serviceProviderMetadataPath;
+ }
+
+ public void setServiceProviderMetadataPath(final String serviceProviderMetadataPath) {
+ this.serviceProviderMetadataPath = serviceProviderMetadataPath;
+ }
+
+ public boolean isForceAuth() {
+ return forceAuth;
+ }
+
+ public void setForceAuth(final boolean forceAuth) {
+ this.forceAuth = forceAuth;
+ }
+
+ public boolean isPassive() {
+ return passive;
+ }
+
+ public void setPassive(final boolean passive) {
+ this.passive = passive;
+ }
+
+ public List<String> getAuthnContextClassRef() {
+ return authnContextClassRef;
+ }
+
+ public void setAuthnContextClassRef(final List<String> authnContextClassRef) {
+ this.authnContextClassRef = authnContextClassRef;
+ }
+
+ public String getAuthnContextComparisonType() {
+ return authnContextComparisonType;
+ }
+
+ public void setAuthnContextComparisonType(final String authnContextComparisonType) {
+ this.authnContextComparisonType = authnContextComparisonType;
+ }
+
+ public String getKeystoreAlias() {
+ return keystoreAlias;
+ }
+
+ public void setKeystoreAlias(final String keystoreAlias) {
+ this.keystoreAlias = keystoreAlias;
+ }
+
+ public String getNameIdPolicyFormat() {
+ return nameIdPolicyFormat;
+ }
+
+ public void setNameIdPolicyFormat(final String nameIdPolicyFormat) {
+ this.nameIdPolicyFormat = nameIdPolicyFormat;
+ }
+
+ public boolean isWantsAssertionsSigned() {
+ return wantsAssertionsSigned;
+ }
+
+ public void setWantsAssertionsSigned(final boolean wantsAssertionsSigned) {
+ this.wantsAssertionsSigned = wantsAssertionsSigned;
+ }
+
+ public int getAttributeConsumingServiceIndex() {
+ return attributeConsumingServiceIndex;
+ }
+
+ public void setAttributeConsumingServiceIndex(final int attributeConsumingServiceIndex) {
+ this.attributeConsumingServiceIndex = attributeConsumingServiceIndex;
+ }
+
+ public int getAssertionConsumerServiceIndex() {
+ return assertionConsumerServiceIndex;
+ }
+
+ public void setAssertionConsumerServiceIndex(final int assertionConsumerServiceIndex) {
+ this.assertionConsumerServiceIndex = assertionConsumerServiceIndex;
+ }
+
+ public boolean isUseNameQualifier() {
+ return useNameQualifier;
+ }
+
+ public void setUseNameQualifier(final boolean useNameQualifier) {
+ this.useNameQualifier = useNameQualifier;
+ }
+
+ public boolean isSignServiceProviderMetadata() {
+ return signServiceProviderMetadata;
+ }
+
+ public void setSignServiceProviderMetadata(final boolean signServiceProviderMetadata) {
+ this.signServiceProviderMetadata = signServiceProviderMetadata;
+ }
+
+ public boolean isSignAuthnRequest() {
+ return signAuthnRequest;
+ }
+
+ public void setSignAuthnRequest(final boolean signAuthnRequest) {
+ this.signAuthnRequest = signAuthnRequest;
+ }
+
+ public boolean isSignServiceProviderLogoutRequest() {
+ return signServiceProviderLogoutRequest;
+ }
+
+ public void setSignServiceProviderLogoutRequest(final boolean signServiceProviderLogoutRequest) {
+ this.signServiceProviderLogoutRequest = signServiceProviderLogoutRequest;
+ }
+
+ public List<String> getBlackListedSignatureSigningAlgorithms() {
+ return blackListedSignatureSigningAlgorithms;
+ }
+
+ public void setBlackListedSignatureSigningAlgorithms(final List<String> blackListedSignatureSigningAlgorithms) {
+ this.blackListedSignatureSigningAlgorithms = blackListedSignatureSigningAlgorithms;
+ }
+
+ public List<String> getSignatureAlgorithms() {
+ return signatureAlgorithms;
+ }
+
+ public void setSignatureAlgorithms(final List<String> signatureAlgorithms) {
+ this.signatureAlgorithms = signatureAlgorithms;
+ }
+
+ public List<String> getSignatureReferenceDigestMethods() {
+ return signatureReferenceDigestMethods;
+ }
+
+ public void setSignatureReferenceDigestMethods(final List<String> signatureReferenceDigestMethods) {
+ this.signatureReferenceDigestMethods = signatureReferenceDigestMethods;
+ }
+
+ public String getSignatureCanonicalizationAlgorithm() {
+ return signatureCanonicalizationAlgorithm;
+ }
+
+ public void setSignatureCanonicalizationAlgorithm(final String signatureCanonicalizationAlgorithm) {
+ this.signatureCanonicalizationAlgorithm = signatureCanonicalizationAlgorithm;
+ }
+
+ public String getProviderName() {
+ return providerName;
+ }
+
+ public void setProviderName(final String providerName) {
+ this.providerName = providerName;
+ }
+}