Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add IsPassive support in SAML IDP initiated flow #411

Merged
merged 7 commits into from
Dec 1, 2023
Merged

Add IsPassive support in SAML IDP initiated flow #411

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
19a93be
Add isPassive validation for IPD initiated SSO flow
JeethJJ Nov 22, 2023
29e9f3e
Update testcases and update license.
JeethJJ Nov 22, 2023
dcc7cf9
Preserve backward compatibility with method overloading when introduc…
JeethJJ Nov 24, 2023
990008b
Separate isPassive parameter to a variable.
JeethJJ Nov 24, 2023
93b4a09
Adding param descriptions.
JeethJJ Nov 24, 2023
e1e8730
Fix javadoc comments.
JeethJJ Nov 24, 2023
a16d803
Fix comments.
JeethJJ Nov 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions ...n.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/SAMLSSOConstants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
/*
* Copyright (c) 2010, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
* Copyright (c) 2010, WSO2 LLC. (http://www.wso2.org).
*
* WSO2 Inc. licenses this file to you under the Apache License,
* WSO2 LLC. licenses this file to you under the Apache License,
* Version 2.0 (the "License"); you may not use this file except
* in compliance with the License.
* You may obtain a copy of the License at
Expand Down Expand Up @@ -126,7 +126,8 @@ public enum QueryParameter {
SLO("slo"),
RETURN_TO("returnTo"),
SP_ENTITY_ID("spEntityID"),
SP_QUALIFIER("spQualifier");
SP_QUALIFIER("spQualifier"),
IS_PASSIVE("IsPassive");

private final String parameterName;

Expand Down
12 changes: 7 additions & 5 deletions ...bon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/SAMLSSOService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
/*
* Copyright (c) 2010, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
* Copyright (c) 2010, WSO2 LLC. (http://www.wso2.org).
*
* WSO2 Inc. licenses this file to you under the Apache License,
* WSO2 LLC. licenses this file to you under the Apache License,
* Version 2.0 (the "License"); you may not use this file except
* in compliance with the License.
* You may obtain a copy of the License at
Expand Down Expand Up @@ -178,11 +178,11 @@ public SAMLSSOReqValidationResponseDTO validateIdPInitSSORequest(String relaySta
QueryParamDTO[] queryParamDTOs,
String serverURL, String sessionId,
String rpSessionId, String authnMode,
boolean isLogout) throws IdentityException {
boolean isLogout, boolean isPassive) throws IdentityException {

// For backward compatibility, SUPER_TENANT_DOMAIN was used as the cache maintaining tenant.
return validateIdPInitSSORequest(relayState, queryString, queryParamDTOs, serverURL, sessionId, rpSessionId,
authnMode, isLogout, MultitenantConstants.SUPER_TENANT_DOMAIN_NAME);
authnMode, isLogout, MultitenantConstants.SUPER_TENANT_DOMAIN_NAME, isPassive);
}

/**
Expand All @@ -206,7 +206,8 @@ public SAMLSSOReqValidationResponseDTO validateIdPInitSSORequest(String relaySta
QueryParamDTO[] queryParamDTOs,
String serverURL, String sessionId,
String rpSessionId, String authnMode,
boolean isLogout, String loginTenantDomain)
boolean isLogout, String loginTenantDomain,
boolean isPassive)
throws IdentityException {

SAMLSSOReqValidationResponseDTO validationResponseDTO = null;
Expand All @@ -224,6 +225,7 @@ public SAMLSSOReqValidationResponseDTO validateIdPInitSSORequest(String relaySta
}
validationResponseDTO.setQueryString(queryString);
validationResponseDTO.setRpSessionId(rpSessionId);
validationResponseDTO.setPassive(isPassive);
return validationResponseDTO;
}

Expand Down
9 changes: 6 additions & 3 deletions ....saml/src/main/java/org/wso2/carbon/identity/sso/saml/servlet/SAMLSSOProviderServlet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,6 +224,8 @@ private void handleRequest(HttpServletRequest req, HttpServletResponse resp, boo
String relayState = req.getParameter(SAMLSSOConstants.RELAY_STATE);
String spEntityID = req.getParameter(SAMLSSOConstants.QueryParameter
.SP_ENTITY_ID.toString());
boolean isPassive = Boolean.valueOf(req.getParameter(SAMLSSOConstants.QueryParameter
.IS_PASSIVE.toString()));
String samlRequest = req.getParameter(SAMLSSOConstants.SAML_REQUEST);
String samlResponse = req.getParameter(SAMLSSOConstants.SAML_RESP);
String sessionDataKey = getSessionDataKey(req);
Expand Down Expand Up @@ -308,7 +310,8 @@ private void handleRequest(HttpServletRequest req, HttpServletResponse resp, boo
return;
}
} else if (spEntityID != null || slo != null) { // idp initiated SSO/SLO
handleIdPInitSSO(req, resp, relayState, queryString, authMode, sessionId, isPost, (slo != null));
handleIdPInitSSO(req, resp, relayState, queryString, authMode, sessionId, isPost,
(slo != null), isPassive);
} else if (samlRequest != null) {// SAMLRequest received. SP initiated SSO
handleSPInitSSO(req, resp, queryString, relayState, authMode, samlRequest, sessionId, isPost);
} else if (samlResponse != null) {// SAMLResponse received.
Expand Down Expand Up @@ -649,7 +652,7 @@ private void sendNotification(String errorResp, String status, String message,

private void handleIdPInitSSO(HttpServletRequest req, HttpServletResponse resp, String relayState,
String queryString, String authMode, String sessionId,
boolean isPost, boolean isLogout) throws UserStoreException, IdentityException,
boolean isPost, boolean isLogout, boolean isPassive) throws UserStoreException, IdentityException,
IOException, ServletException {

DiagnosticLog.DiagnosticLogBuilder diagnosticLogBuilder = null;
Expand All @@ -671,7 +674,7 @@ private void handleIdPInitSSO(HttpServletRequest req, HttpServletResponse resp,
String defaultLogoutLocation = FrameworkUtils.getRedirectURL(SAMLSSOUtil.getDefaultLogoutEndpoint(), req);
SAMLSSOReqValidationResponseDTO signInRespDTO = samlSSOService.validateIdPInitSSORequest(
relayState, queryString, getQueryParams(req), defaultLogoutLocation, sessionId, rpSessionId,
authMode, isLogout, getLoggedInTenantDomain(req));
authMode, isLogout, getLoggedInTenantDomain(req), isPassive);
setSPAttributeToRequest(req, signInRespDTO.getIssuer(), SAMLSSOUtil.getTenantDomainFromThreadLocal());

if (!signInRespDTO.isLogOutReq()) {
Expand Down
26 changes: 18 additions & 8 deletions ...identity.sso.saml/src/test/java/org/wso2/carbon/identity/sso/saml/SAMLSSOServiceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
/*
* Copyright (c) 2017, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
* Copyright (c) 2017, WSO2 LLC. (http://www.wso2.org).
*
* WSO2 Inc. licenses this file to you under the Apache License,
* WSO2 LLC. licenses this file to you under the Apache License,
* Version 2.0 (the "License"); you may not use this file except
* in compliance with the License.
* You may obtain a copy of the License at
Expand Down Expand Up @@ -90,6 +90,16 @@ public static Object[][] authnRequests() {
};
}

@DataProvider(name = "testValidateIdPInitSSORequestAuthentication")
public static Object[][] idpInitAuthRequests() {
return new Object[][]{{true}, {false}};
}

@DataProvider(name = "testValidateIdPInitSSORequestLogout")
public static Object[][] idpInitLogoutRequests() {
return new Object[][]{{true}, {false}};
}

@ObjectFactory
public IObjectFactory getObjectFactory() {
return new PowerMockObjectFactory();
Expand Down Expand Up @@ -185,8 +195,8 @@ private SAMLSSOReqValidationResponseDTO mockValidSPInitLogoutRequestProcessing(S
return samlssoReqValidationResponseDTO;
}

@Test
public void testValidateIdPInitSSORequestAuthentication() throws Exception {
@Test(dataProvider = "testValidateIdPInitSSORequestAuthentication")
public void testValidateIdPInitSSORequestAuthentication(boolean isPassive) throws Exception {

// Inputs for SAMLSSOService's validateIdPInitSSORequest method.
String relayState = null;
Expand All @@ -213,7 +223,7 @@ public void testValidateIdPInitSSORequestAuthentication() throws Exception {
SAMLSSOService samlssoService = new SAMLSSOService();
SAMLSSOReqValidationResponseDTO samlssoReqValidationResponseDTO = samlssoService.validateIdPInitSSORequest(
relayState, queryString, queryParamDTOs, serverURL, sessionId, rpSessionId, authnMode, isLogout,
MultitenantConstants.SUPER_TENANT_DOMAIN_NAME);
MultitenantConstants.SUPER_TENANT_DOMAIN_NAME,isPassive);
assertTrue(samlssoReqValidationResponseDTO.isValid(), "Should be a valid SAML authentication request.");
assertTrue(samlssoReqValidationResponseDTO.isIdPInitSSO(), "Should be an IDP initiated SAML SSO request.");
assertEquals(samlssoReqValidationResponseDTO.getQueryString(), queryString, "Query String should be same as " +
Expand All @@ -222,8 +232,8 @@ public void testValidateIdPInitSSORequestAuthentication() throws Exception {
"the given input RpSessionId.");
}

@Test
public void testValidateIdPInitSSORequestLogout() throws Exception {
@Test(dataProvider = "testValidateIdPInitSSORequestLogout")
public void testValidateIdPInitSSORequestLogout(boolean isPassive) throws Exception {

// Inputs for SAMLSSOService's validateIdPInitSSORequest method.
String relayState = null;
Expand All @@ -249,7 +259,7 @@ public void testValidateIdPInitSSORequestLogout() throws Exception {
SAMLSSOService samlssoService = new SAMLSSOService();
SAMLSSOReqValidationResponseDTO samlssoReqValidationResponseDTO = samlssoService.validateIdPInitSSORequest(
relayState, queryString, queryParamDTOs, serverURL, sessionId, rpSessionId, authnMode, isLogout,
MultitenantConstants.SUPER_TENANT_DOMAIN_NAME);
MultitenantConstants.SUPER_TENANT_DOMAIN_NAME, isPassive);
assertTrue(samlssoReqValidationResponseDTO.isValid(), "Should be a valid SAML SLO request.");
assertTrue(samlssoReqValidationResponseDTO.isIdPInitSLO(), "Should be an IDP initiated SLO request");
assertEquals(samlssoReqValidationResponseDTO.getQueryString(), queryString, "Query String should be same as " +
Expand Down
Loading