Skip to content

Commit 292f36f

Browse files
JarToiJarToi
authored
Merge pull request #2 from CSCfi/updatev5
Update IdP v5 support
2 parents 3b820ce + fd82aad commit 292f36f

28 files changed

+298
-154
lines changed

‎README.md

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
1-
# Shibboleth IdP v4: Shibboleth SP authentication
1+
# Shibboleth IdP v5: Shibboleth SP authentication
22

33
[![License](http://img.shields.io/:license-mit-blue.svg)](https://opensource.org/licenses/MIT)
44
[![Build Status](https://travis-ci.org/CSCfi/shibboleth-idp-authn-shibsp.svg?branch=master)](https://travis-ci.org/CSCfi/shibboleth-idp-authn-shibsp)
55

66
## Overview
77

8-
This module implements an authentication flow for [Shibboleth Identity Provider v4](https://wiki.shibboleth.net/confluence/display/IDP4/Home) exploiting attributes provided by [Shibboleth Service Provider](https://shibboleth.net/products/service-provider.html). The module can be used for outsourcing the authentication to another SAML IdP instead of prompting and validating the user
8+
This module implements an authentication flow for [Shibboleth Identity Provider v5](https://shibboleth.atlassian.net/wiki/spaces/IDP5/overview) exploiting attributes provided by [Shibboleth Service Provider](https://shibboleth.net/products/service-provider.html). The module can be used for outsourcing the authentication to another SAML IdP instead of prompting and validating the user
99
credentials itself.
1010

11-
NOTE! The IdP v4 natively supports [SAML authentication](https://wiki.shibboleth.net/confluence/display/IDP4/SAMLAuthnConfiguration), with many additional features compared to this plugin. The main purpose of this plugin is to serve in smooth transition to V4 for the existing IdP v3 deployments.
11+
NOTE! The IdP v5 natively supports [SAML authentication](https://wiki.shibboleth.net/confluence/display/IDP4/SAMLAuthnConfiguration), with many additional features compared to this plugin. The main purpose of this plugin is to serve in smooth transition to V4 for the existing IdP v3 deployments.
1212

1313
## Prerequisities and compilation
1414

15-
- Java 11+
15+
- Java 17+
1616
- [Apache Maven 3](https://maven.apache.org/)
1717

1818
```
@@ -142,7 +142,7 @@ The flow definition must also be enabled via _idp.authn.flows_ variable in _/opt
142142

143143
The attributes provided by Shibboleth SP can be converted into IdP attributes in the following way:
144144

145-
### 1. Enable attribute and/or header population into Subject
145+
### 1. Enable attribute idPAttribute and/or header population into Subject
146146

147147
In the _/opt/shibboleth-idp/flows/authn/Shib/shib-beans.xml_, enable _populateAttributes_ and/or _populateHeaders_ settings for the bean _ValidateShibbolethAuthentication_.
148148

@@ -153,7 +153,8 @@ The example above enables population of both attributes and headers:
153153
class="fi.csc.shibboleth.authn.impl.ValidateShibbolethAuthentication" scope="prototype"
154154
p:classifiedMessages-ref="shibboleth.authn.Shib.ClassifiedMessageMap"
155155
p:resultCachingPredicate="#{getObject('shibboleth.authn.Shib.resultCachingPredicate')}"
156-
p:usernameAttribute="eppn" p:populateHeaders="true" p:populateAttributes="true" />
156+
p:usernameAttribute="eppn" p:populateHeaders="true" p:populateAttributes="true"
157+
p:populateIdpAttributes="true" />
157158
```
158159

159160
### 2. Enable principal serializers

‎idp-authn-api-shibsp/pom.xml

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ THE SOFTWARE.
2525
<parent>
2626
<groupId>fi.csc.shibboleth</groupId>
2727
<artifactId>idp-authn-shibsp</artifactId>
28-
<version>1.2.0-SNAPSHOT</version>
28+
<version>1.3.0</version>
2929
<relativePath>..</relativePath>
3030
</parent>
3131
<artifactId>idp-authn-api-shibsp</artifactId>
@@ -63,8 +63,8 @@ THE SOFTWARE.
6363
<dependencies>
6464
<!-- Compile Dependencies -->
6565
<dependency>
66-
<groupId>net.shibboleth.idp</groupId>
67-
<artifactId>idp-attribute-api</artifactId>
66+
<groupId>net.shibboleth</groupId>
67+
<artifactId>shib-attribute-api</artifactId>
6868
</dependency>
6969
<dependency>
7070
<groupId>net.shibboleth.idp</groupId>
@@ -79,10 +79,6 @@ THE SOFTWARE.
7979
<artifactId>idp-profile-api</artifactId>
8080
</dependency>
8181

82-
<dependency>
83-
<groupId>${opensaml.groupId}</groupId>
84-
<artifactId>opensaml-core</artifactId>
85-
</dependency>
8682
<dependency>
8783
<groupId>${opensaml.groupId}</groupId>
8884
<artifactId>opensaml-profile-api</artifactId>

‎idp-authn-api-shibsp/src/main/java/fi/csc/shibboleth/authn/context/ShibbolethSpAuthenticationContext.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030

3131
import javax.annotation.Nonnull;
3232

33-
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
33+
import net.shibboleth.shared.annotation.constraint.NotEmpty;
3434

3535
import org.opensaml.messaging.context.BaseContext;
3636

@@ -112,7 +112,7 @@ public ShibbolethSpAuthenticationContext() {
112112
*
113113
* @param httpHeaders The Http headers.
114114
*/
115-
@Nonnull @NotEmpty public void setHeaders(Map<String, String> httpHeaders) {
115+
public void setHeaders(Map<String, String> httpHeaders) {
116116
headers = httpHeaders;
117117
}
118118

@@ -130,7 +130,7 @@ public ShibbolethSpAuthenticationContext() {
130130
*
131131
* @param requestAttributes The request attributes.
132132
*/
133-
@Nonnull @NotEmpty public void setAttributes(Map<String, String> requestAttributes) {
133+
public void setAttributes(Map<String, String> requestAttributes) {
134134
attributes = requestAttributes;
135135
}
136136

‎idp-authn-api-shibsp/src/main/java/fi/csc/shibboleth/authn/principal/impl/KeyValuePrincipal.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,10 @@
2828
import javax.annotation.Nonnull;
2929

3030
import net.shibboleth.idp.authn.principal.CloneablePrincipal;
31-
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
32-
import net.shibboleth.utilities.java.support.logic.Constraint;
33-
import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
34-
import net.shibboleth.utilities.java.support.primitive.StringSupport;
31+
import net.shibboleth.shared.annotation.constraint.NotEmpty;
32+
import net.shibboleth.shared.logic.Constraint;
33+
import net.shibboleth.shared.logic.ConstraintViolationException;
34+
import net.shibboleth.shared.primitive.StringSupport;
3535

3636
import com.google.common.base.MoreObjects;
3737

‎idp-authn-api-shibsp/src/main/java/fi/csc/shibboleth/authn/principal/impl/ShibAttributePrincipal.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424

2525
import javax.annotation.Nonnull;
2626

27-
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
27+
import net.shibboleth.shared.annotation.constraint.NotEmpty;
2828

2929
/**
3030
* This class is designed to carry request attribute key and value -pairs inside {@link Principal}.

‎idp-authn-api-shibsp/src/main/java/fi/csc/shibboleth/authn/principal/impl/ShibHeaderPrincipal.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525

2626
import javax.annotation.Nonnull;
2727

28-
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
28+
import net.shibboleth.shared.annotation.constraint.NotEmpty;
2929

3030
/**
3131
* This class is designed to carry HTTP header key and value -pairs inside {@link Principal}.

‎idp-authn-api-shibsp/src/test/java/fi/csc/shibboleth/authn/principal/impl/KeyValuePrincipalTest.java

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,7 @@
2929
import org.testng.annotations.BeforeTest;
3030
import org.testng.annotations.Test;
3131

32-
import fi.csc.shibboleth.authn.principal.impl.KeyValuePrincipal;
33-
import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
32+
import net.shibboleth.shared.logic.ConstraintViolationException;
3433

3534
/**
3635
* Unit tests for classes extending {@link KeyValuePrincipal}.

‎idp-authn-impl-shibsp/pom.xml

Lines changed: 25 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ THE SOFTWARE.
2525
<parent>
2626
<groupId>fi.csc.shibboleth</groupId>
2727
<artifactId>idp-authn-shibsp</artifactId>
28-
<version>1.2.0-SNAPSHOT</version>
28+
<version>1.3.0</version>
2929
<relativePath>..</relativePath>
3030
</parent>
3131
<artifactId>idp-authn-impl-shibsp</artifactId>
@@ -67,8 +67,8 @@ THE SOFTWARE.
6767
<artifactId>idp-authn-api-shibsp</artifactId>
6868
</dependency>
6969
<dependency>
70-
<groupId>net.shibboleth.idp</groupId>
71-
<artifactId>idp-attribute-api</artifactId>
70+
<groupId>net.shibboleth</groupId>
71+
<artifactId>shib-attribute-api</artifactId>
7272
</dependency>
7373
<dependency>
7474
<groupId>net.shibboleth.idp</groupId>
@@ -86,10 +86,7 @@ THE SOFTWARE.
8686
<groupId>net.shibboleth.idp</groupId>
8787
<artifactId>idp-saml-api</artifactId>
8888
</dependency>
89-
<dependency>
90-
<groupId>${opensaml.groupId}</groupId>
91-
<artifactId>opensaml-core</artifactId>
92-
</dependency>
89+
9390
<dependency>
9491
<groupId>${opensaml.groupId}</groupId>
9592
<artifactId>opensaml-profile-api</artifactId>
@@ -127,6 +124,11 @@ THE SOFTWARE.
127124
<artifactId>jakarta.json-api</artifactId>
128125
<scope>provided</scope>
129126
</dependency>
127+
<dependency>
128+
<groupId>jakarta.servlet</groupId>
129+
<artifactId>jakarta.servlet-api</artifactId>
130+
<scope>provided</scope>
131+
</dependency>
130132

131133
<!-- Runtime Dependencies -->
132134

@@ -171,6 +173,21 @@ THE SOFTWARE.
171173
<scope>test</scope>
172174
</dependency>
173175

176+
<dependency>
177+
<groupId>net.shibboleth.idp</groupId>
178+
<artifactId>idp-testing</artifactId>
179+
<version>${shib.idp.version}</version>
180+
<scope>test</scope>
181+
</dependency>
182+
183+
<dependency>
184+
<groupId>net.shibboleth.idp</groupId>
185+
<artifactId>idp-saml-impl</artifactId>
186+
<version>${shib.idp.version}</version>
187+
<scope>test</scope>
188+
<type>test-jar</type>
189+
</dependency>
190+
174191
<dependency>
175192
<groupId>net.shibboleth.idp</groupId>
176193
<artifactId>idp-authn-impl</artifactId>
@@ -186,9 +203,8 @@ THE SOFTWARE.
186203

187204
<dependency>
188205
<groupId>${opensaml.groupId}</groupId>
189-
<artifactId>opensaml-core</artifactId>
206+
<artifactId>opensaml-testing</artifactId>
190207
<scope>test</scope>
191-
<type>test-jar</type>
192208
</dependency>
193209

194210
<dependency>

‎idp-authn-impl-shibsp/src/main/java/fi/csc/shibboleth/authn/impl/AbstractShibbolethSpContextPredicate.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434

3535
import fi.csc.shibboleth.authn.context.ShibbolethSpAuthenticationContext;
3636
import net.shibboleth.idp.authn.context.AuthenticationContext;
37-
import net.shibboleth.utilities.java.support.logic.Constraint;
37+
import net.shibboleth.shared.logic.Constraint;
3838

3939
/**
4040
* An abstract class for {@link Predicate}s dealing with {@link ShibbolethSpAuthenticationContext}.

‎idp-authn-impl-shibsp/src/main/java/fi/csc/shibboleth/authn/impl/ExtractShibbolethAttributesFromRequest.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,14 +29,14 @@
2929

3030
import javax.annotation.Nonnull;
3131
import javax.security.auth.Subject;
32-
import javax.servlet.http.HttpServletRequest;
32+
import jakarta.servlet.http.HttpServletRequest;
3333

3434
import net.shibboleth.idp.authn.AbstractExtractionAction;
3535
import net.shibboleth.idp.authn.AuthnEventIds;
3636
import net.shibboleth.idp.authn.context.AuthenticationContext;
3737
import net.shibboleth.idp.authn.context.ExternalAuthenticationContext;
38-
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
39-
import net.shibboleth.utilities.java.support.primitive.StringSupport;
38+
import net.shibboleth.shared.component.ComponentInitializationException;
39+
import net.shibboleth.shared.primitive.StringSupport;
4040

4141
import org.opensaml.profile.action.ActionSupport;
4242
import org.opensaml.profile.context.ProfileRequestContext;

0 commit comments

Comments
 (0)