Skip to content

Instantly share code, notes, and snippets.

@serac

serac/extended-flow-changes.diff

Created August 10, 2016 15:52
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save serac/4429c75af127b442c919b2ad99d53f9c to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save serac/4429c75af127b442c919b2ad99d53f9c to your computer and use it in GitHub Desktop.
Download ZIP
IdP Extended Flow Configuration Changes
Raw
extended-flow-changes.diff
diff --git a/idp/conf/authn/general-authn.xml b/idp/conf/authn/general-authn.xml
index 13c429c..8ce2639 100644
--- a/idp/conf/authn/general-authn.xml
+++ b/idp/conf/authn/general-authn.xml
@@ -112,6 +112,12 @@
</property>
</bean>
+ <!-- Extended flow that can be called from Password -->
+ <bean id="authn/conditions/iforgot" parent="shibboleth.AuthenticationFlow"
+ p:forcedAuthenticationSupported="true"
+ p:passiveAuthenticationSupported="false"
+ p:nonBrowserSupported="false" />
+
</util:list>
<!--
diff --git a/idp/conf/authn/password-authn-config.xml b/idp/conf/authn/password-authn-config.xml
index d974444..e537e15 100644
--- a/idp/conf/authn/password-authn-config.xml
+++ b/idp/conf/authn/password-authn-config.xml
@@ -66,4 +66,33 @@
</entry>
</util:map>
+ <!--
+ Configuration of "extended" login methods to offer in the password login form.
+
+ The String bean is a regular expression identifying the flows to offer. These flows
+ must also be enabled at the "top" level to be available for use.
+
+ The ExtendedFlowParameters bean can be used to transfer custom parameters from the
+ login form into the context tree for use later by other flows.
+
+ The last bean provides the set of custom Principals to use for results produced by the
+ Password flow itself. You would use this if you need the Password flow to run as a shell
+ to run the "extended" login methods, but want to limit its own results more narrowly.
+ -->
+ <bean id="shibboleth.authn.Password.ExtendedFlows" class="java.lang.String" c:_0="conditions/iforgot" />
+
+ <!--
+ <util:list id="shibboleth.authn.Password.ExtendedFlowParameters">
+ </util:list>
+
+ <util:list id="shibboleth.authn.Password.PrincipalOverride">
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
+ <bean parent="shibboleth.SAML2AuthnContextClassRef"
+ c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
+ <bean parent="shibboleth.SAML1AuthenticationMethod"
+ c:method="urn:oasis:names:tc:SAML:1.0:am:password" />
+ </util:list>
+ -->
+
</beans>
diff --git a/idp/conf/idp.properties b/idp/conf/idp.properties
index c1a28ba..575d4c5 100644
--- a/idp/conf/idp.properties
+++ b/idp/conf/idp.properties
@@ -89,7 +89,7 @@ idp.session.secondaryServiceIndex = true
idp.session.defaultSPlifetime = PT24H
# Regular expression matching login flows to enable, e.g. IPAddress|Password
-idp.authn.flows= X509Internal|MFA|Password|X509
+idp.authn.flows= X509Internal|MFA|Password|X509|conditions/iforgot
# Regular expression of forced "initial" methods when no session exists,
# usually in conjunction with the idp.authn.resolveAttribute property below.
diff --git a/idp/conf/relying-party.xml b/idp/conf/relying-party.xml
index 2fdaea4..df5bab2 100644
--- a/idp/conf/relying-party.xml
+++ b/idp/conf/relying-party.xml
@@ -17,7 +17,7 @@
This approach helps reduce duplication.
-->
<bean id="Shibboleth.SSO.default" parent="Shibboleth.SSO"
- p:authenticationFlows="#{{'X509Internal', 'MFA', 'X509'}}"
+ p:authenticationFlows="#{{'X509Internal', 'MFA', 'X509', 'conditions/iforgot'}}"
p:postAuthenticationFlows="vt-account-mgmt"
p:nameIDFormatPrecedence="#{{
'urn:mace:shibboleth:1.0:nameIdentifier',
@@ -25,7 +25,7 @@
'urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName'}}" />
<bean id="SAML2.SSO.default" parent="SAML2.SSO"
- p:authenticationFlows="#{{'X509Internal', 'MFA', 'X509'}}"
+ p:authenticationFlows="#{{'X509Internal', 'MFA', 'X509', 'conditions/iforgot'}}"
p:postAuthenticationFlows="vt-account-mgmt"
p:nameIDFormatPrecedence="#{{
'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
@@ -34,7 +34,7 @@
'urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName'}}" />
<bean id="CAS.LoginConfiguration.default" parent="CAS.LoginConfiguration"
- p:authenticationFlows="#{{'X509Internal', 'MFA', 'X509'}}"
+ p:authenticationFlows="#{{'X509Internal', 'MFA', 'X509', 'conditions/iforgot'}}"
p:postAuthenticationFlows="vt-account-mgmt" />
<bean id="CAS.ValidateConfiguration.default" parent="CAS.ValidateConfiguration"
@@ -166,17 +166,17 @@
<property name="profileConfigurations">
<list>
<bean parent="Shibboleth.SSO.default"
- p:authenticationFlows="#{{'X509Internal', 'Password', 'X509'}}" />
+ p:authenticationFlows="#{{'X509Internal', 'Password', 'X509', 'conditions/iforgot'}}" />
<ref bean="SAML1.AttributeQuery" />
<ref bean="SAML1.ArtifactResolution" />
<bean parent="SAML2.SSO.default"
- p:authenticationFlows="#{{'X509Internal', 'Password', 'X509'}}" />
+ p:authenticationFlows="#{{'X509Internal', 'Password', 'X509', 'conditions/iforgot'}}" />
<ref bean="SAML2.ECP" />
<ref bean="SAML2.Logout" />
<ref bean="SAML2.AttributeQuery" />
<ref bean="SAML2.ArtifactResolution" />
<bean parent="CAS.LoginConfiguration.default"
- p:authenticationFlows="#{{'X509Internal', 'Password', 'X509'}}" />
+ p:authenticationFlows="#{{'X509Internal', 'Password', 'X509', 'conditions/iforgot'}}" />
<ref bean="CAS.ProxyConfiguration" />
<ref bean="CAS.ValidateConfiguration.default" />
</list>
@@ -236,14 +236,17 @@
</constructor-arg>
<property name="profileConfigurations">
<list>
- <bean parent="Shibboleth.SSO.default" p:authenticationFlows="MFA" />
+ <bean parent="Shibboleth.SSO.default"
+ p:authenticationFlows="#{{'MFA', 'conditions/iforgot'}}" />
<ref bean="SAML1.ArtifactResolution" />
- <bean parent="SAML2.SSO.default" p:authenticationFlows="MFA" />
+ <bean parent="SAML2.SSO.default"
+ p:authenticationFlows="#{{'MFA', 'conditions/iforgot'}}" />
<ref bean="SAML2.ECP" />
<ref bean="SAML2.Logout" />
<ref bean="SAML2.AttributeQuery" />
<ref bean="SAML2.ArtifactResolution" />
- <bean parent="CAS.LoginConfiguration.default" p:authenticationFlows="MFA" />
+ <bean parent="CAS.LoginConfiguration.default"
+ p:authenticationFlows="#{{'MFA', 'conditions/iforgot'}}" />
<ref bean="CAS.ProxyConfiguration" />
<ref bean="CAS.ValidateConfiguration.default" />
</list>
@@ -262,14 +265,17 @@
</constructor-arg>
<property name="profileConfigurations">
<list>
- <bean parent="Shibboleth.SSO.default" p:authenticationFlows="Password" />
+ <bean parent="Shibboleth.SSO.default"
+ p:authenticationFlows="#{{'Password', 'conditions/iforgot'}}" />
<ref bean="SAML1.ArtifactResolution" />
- <bean parent="SAML2.SSO.default" p:authenticationFlows="Password" />
+ <bean parent="SAML2.SSO.default"
+ p:authenticationFlows="#{{'Password', 'conditions/iforgot'}}" />
<ref bean="SAML2.ECP" />
<ref bean="SAML2.Logout" />
<ref bean="SAML2.AttributeQuery" />
<ref bean="SAML2.ArtifactResolution" />
- <bean parent="CAS.LoginConfiguration.default" p:authenticationFlows="Password" />
+ <bean parent="CAS.LoginConfiguration.default"
+ p:authenticationFlows="#{{'Password', 'conditions/iforgot'}}" />
<ref bean="CAS.ProxyConfiguration" />
<ref bean="CAS.ValidateConfiguration.default" />
</list>
diff --git a/idp/edit-webapp/WEB-INF/lib/idp3-ext-1.2.6-20160809T071500.jar b/idp/edit-webapp/WEB-INF/lib/idp3-ext-1.2.6-20160809T071500.jar
deleted file mode 100644
index 5e10edf..0000000
Binary files a/idp/edit-webapp/WEB-INF/lib/idp3-ext-1.2.6-20160809T071500.jar and /dev/null differ
diff --git a/idp/edit-webapp/WEB-INF/lib/idp3-ext-1.2.6-20160811T110000.jar b/idp/edit-webapp/WEB-INF/lib/idp3-ext-1.2.6-20160811T110000.jar
new file mode 100644
index 0000000..182d417
Binary files /dev/null and b/idp/edit-webapp/WEB-INF/lib/idp3-ext-1.2.6-20160811T110000.jar differ
diff --git a/idp/flows/authn/conditions/iforgot/iforgot-flow.xml b/idp/flows/authn/conditions/iforgot/iforgot-flow.xml
index fb757b3..59ebc46 100644
--- a/idp/flows/authn/conditions/iforgot/iforgot-flow.xml
+++ b/idp/flows/authn/conditions/iforgot/iforgot-flow.xml
@@ -40,7 +40,7 @@
<evaluate expression="flowRequestContext.externalContext.nativeRequest" result="requestScope.request" />
<evaluate expression="flowRequestContext.externalContext.nativeResponse" result="requestScope.response" />
</on-render>
- <transition on="proceed" to="proceed" />
+ <transition on="proceed" to="DisplayUsernamePasswordPage" />
</view-state>
<view-state id="ShowForgotGuestIdHelpPage" view="iforgot-help-guestId">
@@ -52,7 +52,7 @@
<evaluate expression="flowRequestContext.externalContext.nativeRequest" result="requestScope.request" />
<evaluate expression="flowRequestContext.externalContext.nativeResponse" result="requestScope.response" />
</on-render>
- <transition on="proceed" to="proceed" />
+ <transition on="proceed" to="DisplayUsernamePasswordPage" />
</view-state>
<view-state id="ShowUserLookupForm" view="iforgot-user-lookup">
@@ -95,7 +95,7 @@
<evaluate expression="flowExecutionUrl + '&amp;_eventId_proceed'" result="requestScope.proceedUrl" />
<evaluate expression="'https://' + environment.getProperty('VHOSTNAME')" result="requestScope.baseUrl" />
</on-render>
- <transition on="proceed" to="proceed" />
+ <transition on="proceed" to="DisplayUsernamePasswordPage" />
</view-state>
<view-state id="ShowHelpUnknownUserPage" view="iforgot-help-unknown-user">
@@ -107,13 +107,13 @@
<evaluate expression="flowRequestContext.externalContext.nativeRequest" result="requestScope.request" />
<evaluate expression="flowRequestContext.externalContext.nativeResponse" result="requestScope.response" />
</on-render>
- <transition on="proceed" to="proceed" />
+ <transition on="proceed" to="DisplayUsernamePasswordPage" />
</view-state>
- <end-state id="proceed" />
+ <end-state id="DisplayUsernamePasswordPage" />
<global-transitions>
- <transition on="cancel" to="proceed" />
+ <transition on="cancel" to="DisplayUsernamePasswordPage" />
</global-transitions>
<bean-import resource="iforgot-beans.xml" />
diff --git a/idp/views/login.vm b/idp/views/login.vm
index e3215bd..ff4a912 100644
--- a/idp/views/login.vm
+++ b/idp/views/login.vm
@@ -59,11 +59,9 @@
<div class="field">
<label for="password">Password</label>
<input id="password" name="j_password" type="password" value="" tabindex="2">
- #if ($flowRequestContext.activeFlow.id == 'authn/Duo')
- <div class="note">
- <p><a href="$flowExecutionUrl&_eventId_iforgot">I forgot</a> my username or password.</a>
- </div>
- #end
+ <div class="note">
+ <p><a href="$flowExecutionUrl&_eventId_authn%2Fconditions%2Fiforgot">I forgot</a> my username or password.</a>
+ </div>
</div><!--
<div class="field checkboxes">
<input id="donotcache" type="checkbox" name="donotcache" value="1" tabindex="3">
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment