search

picketlink2 / federation

PicketLink v2.1.x Federation. PicketLink v2.5.x onwards is hosted at https://github.com/picketlink
http://www.picketlink.org
14 stars 29 forks source link

added RequestedAuthnContext to sp AuthnRequest https://issues.jboss.org/browse/PRODMGT-503 #196

Closed sdellang closed 11 years ago

sdellang commented 11 years ago

Example Configuration:

      <Handler  class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler">
         <Option Key="AUTHN_CONTEXT_CLASS_REF" Value="urn:oasis:names:tc:SAML:2.0:ac:classes:Password:JBoss,urn:oasis:names:tc:SAML:2.0:ac:classes:Password:JBoss2" />
             <Option Key="AUTHN_CONTEXT_COMPARISON" Value="exact" />
      </Handler>

Comma separated class refs and comparison value as described in the standard (“better” | “exact” | “maximum” | “minimum”). Comparison is optional also if you set AUTHN_CONTEXT_CLASS_REF.

Example authnRequest obtained from the configuration:

    <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    xmlns="urn:oasis:names:tc:SAML:2.0:assertion"
                    AssertionConsumerServiceURL="http://jboss-eap6.corp.generalisvil.net:8180/wsweb/"
                    Destination="https://namx.corp.generalisvil.net/nidp/saml2/sso"
                    ID="ID_dcb979ba-1681-4b2b-b8cb-ae5427789922"
                    IssueInstant="2013-08-26T20:42:30.980Z"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    Version="2.0"
                    >
        <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">http://jboss-eap6.corp.generalisvil.net:8180/wsweb/</saml:Issuer>
        <dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
            <dsig:SignedInfo>
                <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments" />
                <dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
                 <dsig:Reference URI="#ID_dcb979ba-1681-4b2b-b8cb-ae5427789922">
                <dsig:Transforms>
                    <dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                    <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                </dsig:Transforms>
                <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
                <dsig:DigestValue>QpZl7ctT2IN8ejiHtXGrSTdSQvU=</dsig:DigestValue>
            </dsig:Reference>
        </dsig:SignedInfo>
        <dsig:SignatureValue>XSGOA4VhMVryJuyooRIhyjMHYruryxCAjKGEwbUZ7d429xRq7W0u7NUHvTXm7TMFreas+1rW5fU0OIf8aUq9zltVN6mjGK52csRGvmtXOd1PL1phS2sSplXt2Xxlra5cyv6bjMkbWa04me+K80frAD7WJlco7bcB78dqFFlD1PZ79G8s/WUmp5K2nSav1g967aSZHhyIzVBy4IxhzdGqJv5VLWknZzH18pFTxa+wGiXjGg2CYtuKSnc2D+X6CW02xJ8OfSJeexpQkk8RcbD3LM8cArBqD7Nb1EpZ5aXs6PDkC/8Nw1IrZK2IYI+Yop3hsnMhlw4esJ7t9EEybnKeOA==</dsig:SignatureValue>
        <dsig:KeyInfo>
            <dsig:KeyValue>
                <dsig:RSAKeyValue>
                    <dsig:Modulus>1Z+gdQhFcwaqFCCokxx6+usSrdNFtj64bkMvjnhXVS+GqB6BCXvQWjQROYEV2Yb24UH2+NpyUyMMWKgx7tWPGr+omoOgY10Tqd7OsMyXkuiPkTDiwPrekM1cxYbEIkyK0rRXXek4w1U2ozha0gJhKLrAh9LnPBFezQWrKa8cYAYBV3hb4zWfJLzQsj01N+WBhP1tX0aJ8X+bIiE7IhqkhxYRu4z8H0n0WReHzp9BvzsOxIPYMu7XF92vsdvhnm1FdCP0famwANrJRp2FKi9pv/ktW1OZRl4227+W1ztVo83CliodLo3gSCZE19BzHGFYAJKX/nVd58g/uUFX+7bPow==</dsig:Modulus>
                    <dsig:Exponent>AQAB</dsig:Exponent>
                </dsig:RSAKeyValue>
            </dsig:KeyValue>
        </dsig:KeyInfo>
    </dsig:Signature>
    <samlp:RequestedAuthnContext Comparison="exact">
        <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password:JBoss</saml:AuthnContextClassRef>
        <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password:JBoss2</saml:AuthnContextClassRef>
    </samlp:RequestedAuthnContext>
</samlp:AuthnRequest>
pedroigor commented 11 years ago

Hi,

We have this issue already fixed in PicketLink 2.5.0.

As we're going to do 2.5 for 6.2, update PicketLink 2.1 is not necessary for now.

Maybe we can have a 2.1.9 release. In this case the change we did for 2.5.0 will be back ported.

Please, take a look at https://issues.jboss.org/browse/PLINK-245.

Thanks in advance.