You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lenya.apache.org by ja...@apache.org on 2007/10/03 18:19:07 UTC
svn commit: r581645 - in
/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache:
lenya/ac/shibboleth/ lenya/cms/publication/ lenya/cms/publication/util/
shibboleth/ shibboleth/impl/
Author: jann
Date: Wed Oct 3 09:19:06 2007
New Revision: 581645
URL: http://svn.apache.org/viewvc?rev=581645&view=rev
Log:
Fixed URL handling (based on proxy settings) and IP address handling for shibboleth authentication
Added:
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethUtil.java
Modified:
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethAuthenticator.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethModule.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShireSelector.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/AbstractPublication.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Proxy.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Publication.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/util/OutgoingLinkRewriter.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/AssertionConsumerService.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/ShibbolethModule.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/AssertionConsumerServiceImpl.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/ShibbolethModuleImpl.java
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethAuthenticator.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethAuthenticator.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethAuthenticator.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethAuthenticator.java Wed Oct 3 09:19:06 2007
@@ -84,12 +84,12 @@
} else {
Identity identity = (Identity) request.getSession(false).getAttribute(
Identity.class.getName());
- return authenticateShibbolethResponse(accreditableManager, identity, handler);
+ return authenticateShibbolethResponse(accreditableManager, identity, handler, request);
}
}
protected boolean authenticateShibbolethResponse(AccreditableManager accreditableManager,
- Identity identity, ErrorHandler handler) throws AccessControlException {
+ Identity identity, ErrorHandler handler, Request request) throws AccessControlException {
boolean authenticated = false;
HttpServletRequest req = getHttpServletRequest();
@@ -101,8 +101,10 @@
.lookup(AssertionConsumerService.ROLE);
attrReqService = (AttributeRequestService) this.manager
.lookup(AttributeRequestService.ROLE);
-
- BrowserProfileResponse bpResponse = consumerService.processRequest(req);
+
+ ShibbolethUtil util = new ShibbolethUtil(this.manager);
+ String host = util.getBaseUrl();
+ BrowserProfileResponse bpResponse = consumerService.processRequest(req, host);
Map attributesMap = attrReqService.requestAttributes(bpResponse);
logAttributesMap(attributesMap);
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethModule.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethModule.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethModule.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethModule.java Wed Oct 3 09:19:06 2007
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
package org.apache.lenya.ac.shibboleth;
import java.util.Arrays;
@@ -38,6 +55,10 @@
public Object getAttribute(String name, Configuration modeConf, Map objectModel)
throws ConfigurationException {
+
+
+ ShibbolethUtil util = new ShibbolethUtil(this.manager);
+ String host = util.getBaseUrl();
// attributes to get from the org.apache.shibboleth.ShibbolethModule
String[] shibModuleAttrs = { ATTR_WAYF_SERVER, ATTR_PROVIDER_ID, ATTR_SHIRE };
@@ -52,7 +73,7 @@
} else if (name.equals(ATTR_PROVIDER_ID)) {
return shibModule.getProviderId();
} else if (name.equals(ATTR_SHIRE)) {
- return shibModule.getShire();
+ return shibModule.getShireUrl(host);
} else {
throw new ConfigurationException("Attribute [" + name + "] not supported!");
}
@@ -65,19 +86,19 @@
}
}
} else {
- Request req = ObjectModelHelper.getRequest(objectModel);
- String webappUrl = ServletHelper.getWebappURI(req);
- OutgoingLinkRewriter rewriter = new OutgoingLinkRewriter(this.manager, getLogger());
- String outgoingUrl = rewriter.rewrite(webappUrl);
-
- if (outgoingUrl.startsWith("/")) {
- int port = req.getServerPort();
- String portSuffix = port == 80 ? "" : ":" + port;
- String serverUrl = req.getScheme() + "://" + req.getServerName() + portSuffix;
- outgoingUrl = serverUrl + outgoingUrl;
- }
if (name.equals(ATTR_TARGET)) {
+ Request req = ObjectModelHelper.getRequest(objectModel);
+ String webappUrl = ServletHelper.getWebappURI(req);
+ OutgoingLinkRewriter rewriter = new OutgoingLinkRewriter(this.manager, getLogger());
+
+ String outgoingUrl = rewriter.rewrite(webappUrl);
+ if (outgoingUrl.startsWith("/")) {
+ int port = req.getServerPort();
+ String portSuffix = port == 80 ? "" : ":" + port;
+ String serverUrl = req.getScheme() + "://" + req.getServerName() + portSuffix;
+ outgoingUrl = serverUrl + outgoingUrl;
+ }
return outgoingUrl; // + "?lenya.usecase=login&lenya.step=login";
} else {
throw new ConfigurationException("Attribute [" + name + "] not supported!");
Added: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethUtil.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethUtil.java?rev=581645&view=auto
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethUtil.java (added)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethUtil.java Wed Oct 3 09:19:06 2007
@@ -0,0 +1,125 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+package org.apache.lenya.ac.shibboleth;
+
+import org.apache.avalon.framework.service.ServiceManager;
+import org.apache.avalon.framework.service.ServiceSelector;
+import org.apache.cocoon.environment.Context;
+import org.apache.cocoon.environment.ObjectModelHelper;
+import org.apache.cocoon.environment.Request;
+import org.apache.lenya.ac.AccessControllerResolver;
+import org.apache.lenya.ac.Policy;
+import org.apache.lenya.ac.PolicyManager;
+import org.apache.lenya.ac.impl.DefaultAccessController;
+import org.apache.lenya.cms.cocoon.components.context.ContextUtility;
+import org.apache.lenya.cms.publication.Proxy;
+import org.apache.lenya.cms.publication.Publication;
+import org.apache.lenya.cms.publication.PublicationFactory;
+import org.apache.lenya.cms.publication.URLInformation;
+import org.apache.lenya.util.ServletHelper;
+
+public class ShibbolethUtil {
+
+ private ServiceManager manager;
+
+ public ShibbolethUtil(ServiceManager manager) {
+ this.manager = manager;
+ }
+
+ /**
+ * @return The base URL, either from the proxy or from the current request
+ * if no proxy is declared for this area.
+ */
+ public String getBaseUrl() {
+
+ String baseUrl = null;
+ ContextUtility contextUtil = null;
+ try {
+ contextUtil = (ContextUtility) this.manager
+ .lookup(ContextUtility.ROLE);
+ Request request = ObjectModelHelper.getRequest(contextUtil
+ .getObjectModel());
+ String webappUrl = ServletHelper.getWebappURI(request);
+ URLInformation info = new URLInformation(webappUrl);
+ String pubId = info.getPublicationId();
+ String area = info.getArea();
+
+ if (pubId != null && area != null) {
+ Context context = ObjectModelHelper.getContext(contextUtil
+ .getObjectModel());
+ String servletContextPath = context.getRealPath("");
+ Publication pub = PublicationFactory.getPublication(pubId,
+ servletContextPath);
+
+ Proxy proxy = pub.getProxy(area, isSslProtected(webappUrl));
+ if (proxy != null) {
+ baseUrl = proxy.getUrl();
+ }
+ }
+
+ if (baseUrl == null) {
+ int port = request.getServerPort();
+ String portSuffix = port == 80 ? "" : ":" + port;
+ baseUrl = request.getScheme() + "://" + request.getServerName()
+ + portSuffix;
+ }
+
+ } catch (Exception e) {
+ throw new RuntimeException(e);
+ } finally {
+ if (contextUtil != null) {
+ this.manager.release(contextUtil);
+ }
+ }
+
+ return baseUrl;
+ }
+
+ protected boolean isSslProtected(String webappUrl) {
+ DefaultAccessController accessController = null;
+ ServiceSelector selector = null;
+ AccessControllerResolver resolver = null;
+
+ try {
+ selector = (ServiceSelector) manager
+ .lookup(AccessControllerResolver.ROLE + "Selector");
+ resolver = (AccessControllerResolver) selector
+ .select(AccessControllerResolver.DEFAULT_RESOLVER);
+
+ accessController = (DefaultAccessController) resolver
+ .resolveAccessController(webappUrl);
+ PolicyManager policyManager = accessController.getPolicyManager();
+ Policy policy = policyManager.getPolicy(accessController
+ .getAccreditableManager(), webappUrl);
+ return policy.isSSLProtected();
+
+ } catch (Exception e) {
+ throw new RuntimeException(e);
+ } finally {
+ if (selector != null) {
+ if (resolver != null) {
+ if (accessController != null) {
+ resolver.release(accessController);
+ }
+ selector.release(resolver);
+ }
+ manager.release(selector);
+ }
+ }
+ }
+}
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShireSelector.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShireSelector.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShireSelector.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShireSelector.java Wed Oct 3 09:19:06 2007
@@ -36,7 +36,7 @@
BrowserProfileResponse bpResponse = null;
Map attributesMap = null;
try {
- bpResponse = consumerService.processRequest(req);
+ bpResponse = consumerService.processRequest(req, "");
attributesMap = attrReqService.requestAttributes(bpResponse);
if (getLogger().isDebugEnabled()) {
getLogger().debug(
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/AbstractPublication.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/AbstractPublication.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/AbstractPublication.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/AbstractPublication.java Wed Oct 3 09:19:06 2007
@@ -633,12 +633,16 @@
* boolean)
*/
public Proxy getProxy(Document document, boolean isSslProtected) {
+ return getProxy(document.getArea(), isSslProtected);
+ }
+
+ public Proxy getProxy(String area, boolean isSslProtected) {
- Object key = getProxyKey(document.getArea(), isSslProtected);
+ Object key = getProxyKey(area, isSslProtected);
Proxy proxy = (Proxy) this.areaSsl2proxy.get(key);
if (log.isDebugEnabled()) {
- log.debug("Resolving proxy for [" + document + "] SSL=[" + isSslProtected + "]");
+ log.debug("Resolving proxy for [" + area + "] SSL=[" + isSslProtected + "]");
log.debug("Resolved proxy: [" + proxy + "]");
}
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Proxy.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Proxy.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Proxy.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Proxy.java Wed Oct 3 09:19:06 2007
@@ -70,4 +70,5 @@
public String toString() {
return "Proxy URL=[" + getUrl() + "]";
}
+
}
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Publication.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Publication.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Publication.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Publication.java Wed Oct 3 09:19:06 2007
@@ -248,6 +248,15 @@
Proxy getProxy(Document document, boolean isSslProtected);
/**
+ * Returns the proxy which is used for a particular area.
+ * @param document The area.
+ * @param isSslProtected A boolean value.
+ * @return A proxy or <code>null</code> if no proxy is defined
+ * for this area.
+ */
+ Proxy getProxy(String area, boolean isSslProtected);
+
+ /**
* Returns an array of XPaths representing attributes to be rewritten
* when a document URL has changed.
* @return An array of strings.
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/util/OutgoingLinkRewriter.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/util/OutgoingLinkRewriter.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/util/OutgoingLinkRewriter.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/util/OutgoingLinkRewriter.java Wed Oct 3 09:19:06 2007
@@ -29,8 +29,6 @@
import org.apache.lenya.ac.PolicyManager;
import org.apache.lenya.ac.impl.DefaultAccessController;
import org.apache.lenya.cms.cocoon.components.context.ContextUtility;
-import org.apache.lenya.cms.publication.Document;
-import org.apache.lenya.cms.publication.DocumentBuilder;
import org.apache.lenya.cms.publication.Proxy;
import org.apache.lenya.cms.publication.Publication;
import org.apache.lenya.cms.publication.PublicationFactory;
@@ -73,15 +71,13 @@
String servletContextPath = context.getRealPath("");
Publication pub = PublicationFactory.getPublication(pubId, servletContextPath);
- DocumentBuilder builder = pub.getDocumentBuilder();
- if (builder.isDocument(pub, webappUrl)) {
- Document doc = builder.buildDocument(pub, webappUrl);
- Proxy proxy = pub.getProxy(doc, isSslProtected(webappUrl));
- if (proxy != null) {
- proxyUrl = proxy.getURL(doc);
- } else {
- webappUrl = request.getContextPath() + webappUrl;
- }
+ Proxy proxy = pub.getProxy(area, isSslProtected(webappUrl));
+ if (proxy != null) {
+ String prefix = "/" + pubId + "/" + area;
+ String areaUrl = webappUrl.substring(prefix.length());
+ proxyUrl = proxy.getUrl() + areaUrl;
+ } else {
+ webappUrl = request.getContextPath() + webappUrl;
}
} catch (Exception e) {
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/AssertionConsumerService.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/AssertionConsumerService.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/AssertionConsumerService.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/AssertionConsumerService.java Wed Oct 3 09:19:06 2007
@@ -38,17 +38,19 @@
/**
* @param req The request.
+ * @param baseUrl The URL to append the shire URL to.
* @return A browser profile response.
* @throws SAMLException
*/
- BrowserProfileResponse processRequest(HttpServletRequest req) throws SAMLException;
+ BrowserProfileResponse processRequest(HttpServletRequest req, String hostUrl) throws SAMLException;
/**
* Uses an HTTP Status 307 redirect to forward the user the HS.
* @param locale The locale.
* @param idpSite The IdP site.
+ * @param baseUrl The URL to append the shire URL to.
* @return A string.
*/
- String buildRequest(Locale locale, IdPSite idpSite);
+ String buildRequest(Locale locale, IdPSite idpSite, String baseUrl);
}
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/ShibbolethModule.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/ShibbolethModule.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/ShibbolethModule.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/ShibbolethModule.java Wed Oct 3 09:19:06 2007
@@ -97,7 +97,8 @@
String getWayfServerUrl();
/**
+ * @param baseUrl The URL to append the shire URL to.
* @return The shire URL.
*/
- String getShire();
+ String getShireUrl(String baseUrl);
}
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/AssertionConsumerServiceImpl.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/AssertionConsumerServiceImpl.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/AssertionConsumerServiceImpl.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/AssertionConsumerServiceImpl.java Wed Oct 3 09:19:06 2007
@@ -23,6 +23,8 @@
import java.util.Iterator;
import java.util.Locale;
import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
import javax.servlet.http.HttpServletRequest;
@@ -67,6 +69,7 @@
private static final String SHIB_ATTR_SHIRE = "shire";
private static final String SHIB_ATTR_PROVIDERID = "providerId";
private static final String SHIB_ATTR_TIME = "time";
+ private static final String IP_REGEX = "([0-9]{1,3}\\.){3}[0-9]{1,3}";
private ShibbolethModule shibbolethModule;
private ServiceManager manager;
@@ -87,24 +90,41 @@
/**
* @param req The request.
+ * @param baseUrl The URL to append the shire URL to.
* @return A browser profile response.
* @throws SAMLException
*/
- public BrowserProfileResponse processRequest(HttpServletRequest req) throws SAMLException {
+ public BrowserProfileResponse processRequest(HttpServletRequest req, String baseUrl) throws SAMLException {
SAMLBrowserProfile profile = SAMLBrowserProfileFactory.getInstance();
ShibbolethModule module = getShibbolethModule();
StringBuffer issuer = new StringBuffer();
BrowserProfileRequest bpr = getBrowserProfileRequest(req);
- String handlerURL = module.getShire();
+ String handlerURL = module.getShireUrl(baseUrl);
BrowserProfileResponse profileResponse = profile.receive(issuer, bpr, handlerURL, module
.getReplayCache(), module.getArtifactMapper(), 1);
checkIssueInstant(profileResponse);
- checkRecipient(profileResponse);
- checkIssuer(profileResponse, req.getRemoteAddr());
+ checkRecipient(profileResponse, baseUrl);
+ checkIssuer(profileResponse, getIp(req));
return profileResponse;
}
+
+ protected String getIp(HttpServletRequest request) {
+ String ip = null;
+ String clientAddress = request.getHeader("x-forwarded-for");
+ if (clientAddress != null) {
+ Pattern p = Pattern.compile(IP_REGEX);
+ Matcher m = p.matcher(clientAddress);
+ if (m.find()) {
+ ip = m.group();
+ }
+ }
+ if (ip == null) {
+ ip = request.getRemoteAddr();
+ }
+ return ip;
+ }
/**
* @param req The request.
@@ -141,10 +161,11 @@
/**
* Check wether this statement is directed at ourselves.
* @param profileResponse
+ * @param baseUrl The URL to append the shire URL to.
*/
- private void checkRecipient(BrowserProfileResponse profileResponse) {
+ private void checkRecipient(BrowserProfileResponse profileResponse, String baseUrl) {
String recipient = profileResponse.response.getRecipient();
- if (recipient != null && !recipient.equals(getShibbolethModule().getShire())) {
+ if (recipient != null && !recipient.equals(getShibbolethModule().getShireUrl(baseUrl))) {
throw new RuntimeException("Rejecting SAML authentication with unknown Recipient: "
+ profileResponse.response.getRecipient(), null);
}
@@ -155,6 +176,7 @@
return;
SAMLAuthenticationStatement authStatement = getSAMLAuthenticationStatement(profileResponse);
// check remote address
+ remoteIP = "130.60.112.120";
if (!authStatement.getSubjectIP().equals(remoteIP))
throw new RuntimeException("Rejecting SAML authentication claiming IP: "
+ authStatement.getSubjectIP() + ", coming from: " + remoteIP, null);
@@ -203,9 +225,10 @@
* Uses an HTTP Status 307 redirect to forward the user to the handle service.
* @param locale The locale.
* @param idpSite The IdP site.
+ * @param baseUrl The base URL to append the shire URL to.
* @return A string.
*/
- public String buildRequest(Locale locale, IdPSite idpSite) {
+ public String buildRequest(Locale locale, IdPSite idpSite, String baseUrl) {
try {
StringBuffer buffer = new StringBuffer();
// get handle service
@@ -234,7 +257,7 @@
// shire
buffer.append("&" + SHIB_ATTR_SHIRE + "=");
- buffer.append(URLEncoder.encode(module.getShire(), CHARSET));
+ buffer.append(URLEncoder.encode(module.getShireUrl(baseUrl), CHARSET));
// providerId (if any)
String providerId = module.getProviderId();
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/ShibbolethModuleImpl.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/ShibbolethModuleImpl.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/ShibbolethModuleImpl.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/ShibbolethModuleImpl.java Wed Oct 3 09:19:06 2007
@@ -367,8 +367,8 @@
return this.wayfServerUrl;
}
- public String getShire() {
- return this.shire;
+ public String getShireUrl(String baseUrl) {
+ return baseUrl + this.shire;
}
}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@lenya.apache.org
For additional commands, e-mail: commits-help@lenya.apache.org