libre.sh/keycloak-scim
2
0
Fork 0
Code Issues 14 Pull requests Releases Packages Activity Actions 6

force post binding switch

Browse source
This commit is contained in:
Bill Burke 2014-10-22 14:32:46 -04:00
parent b3fe650e27
commit f715a026ba
4 changed files with 46 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/applications.js
View file

@ -363,6 +363,7 @@ module.controller('ApplicationDetailCtrl', function($scope, realm, application,
$scope.samlAssertionSignature = false;
$scope.samlClientSignature = false;
$scope.samlEncrypt = false;
$scope.samlForcePostBinding = false;
if (!$scope.create) {
if (!application.attributes) {
application.attributes = {};
@ -442,6 +443,13 @@ module.controller('ApplicationDetailCtrl', function($scope, realm, application,
$scope.samlMultiValuedRoles = false;
}
}
if ($scope.application.attributes["saml.force.post.binding"]) {
if ($scope.application.attributes["saml.force.post.binding"] == "true") {
$scope.samlForcePostBinding = true;
} else {
$scope.samlForcePostBinding = false;
}
}
$scope.switchChange = function() {
$scope.changed = true;
@ -534,6 +542,12 @@ module.controller('ApplicationDetailCtrl', function($scope, realm, application,
} else {
$scope.application.attributes["saml.multivalued.roles"] = "false";
}
if ($scope.samlForcePostBinding == true) {
$scope.application.attributes["saml.force.post.binding"] = "true";
} else {
$scope.application.attributes["saml.force.post.binding"] = "false";
}
$scope.application.protocol = $scope.protocol;

14
forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-detail.html
View file

@ -56,6 +56,13 @@
</div>
<span tooltip-placement="right" tooltip="'Confidential' applications require a secret to initiate login protocol. 'Public' clients do not require a secret. 'Bearer-only' applications are web services that never initiate a login." class="fa fa-info-circle"></span>
</div>
<div class="form-group clearfix block" data-ng-show="protocol == 'saml'">
<label class="col-sm-2 control-label" for="samlServerSignature">Force POST Responses</label>
<div class="col-sm-6">
<input ng-model="samlAuthnStatement" ng-click="switchChange()" name="samlAuthnStatement" id="samlAuthnStatement" onoffswitch />
</div>
<span tooltip-placement="right" tooltip="Should a statement specifying the method and timestamp be included in login responses?" class="fa fa-info-circle"></span>
</div>
<div class="form-group clearfix block" data-ng-show="protocol == 'saml'">
<label class="col-sm-2 control-label" for="samlServerSignature">Include AuthnStatement</label>
<div class="col-sm-6">
@ -111,6 +118,13 @@
</div>
<span tooltip-placement="right" tooltip="Will the client sign their saml requests and responses? And should they be validated?" class="fa fa-info-circle"></span>
</div>
<div class="form-group clearfix block" data-ng-show="protocol == 'saml'">
<label class="col-sm-2 control-label" for="samlForcePostBinding">Force POST Binding</label>
<div class="col-sm-6">
<input ng-model="samlForcePostBinding" ng-click="switchChange()" name="samlForcePostBinding" id="samlForcePostBinding" onoffswitch />
</div>
<span tooltip-placement="right" tooltip="Always use POST binding for responses." class="fa fa-info-circle"></span>
</div>
<div class="form-group" data-ng-show="!application.bearerOnly">
<label class="col-sm-2 control-label" for="newRedirectUri">Redirect URI <span class="required" data-ng-show="create">*</span></label>

25
saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java
View file

@ -39,6 +39,14 @@ public class SamlProtocol implements LoginProtocol {
public static final String SAML_BINDING = "saml_binding";
public static final String SAML_POST_BINDING = "post";
public static final String SAML_GET_BINDING = "get";
public static final String SAML_SERVER_SIGNATURE = "saml.server.signature";
public static final String SAML_ASSERTION_SIGNATURE = "saml.assertion.signature";
public static final String SAML_AUTHNSTATEMENT = "saml.authnstatement";
public static final String SAML_MULTIVALUED_ROLES = "saml.multivalued.roles";
public static final String SAML_SIGNATURE_ALGORITHM = "saml.signature.algorithm";
public static final String SAML_ENCRYPT = "saml.encrypt";
public static final String SAML_FORCE_POST_BINDING = "saml.force.post.binding";
public static final String REQUEST_ID = "REQUEST_ID";
protected KeycloakSession session;
@ -98,14 +106,15 @@ public class SamlProtocol implements LoginProtocol {
}
protected boolean isPostBinding(ClientSessionModel clientSession) {
return SamlProtocol.SAML_POST_BINDING.equals(clientSession.getNote(SamlProtocol.SAML_BINDING));
ClientModel client = clientSession.getClient();
return SamlProtocol.SAML_POST_BINDING.equals(clientSession.getNote(SamlProtocol.SAML_BINDING)) || "true".equals(client.getAttribute(SAML_FORCE_POST_BINDING));
}
@Override
public Response authenticated(UserSessionModel userSession, ClientSessionCode accessCode) {
ClientSessionModel clientSession = accessCode.getClientSession();
ClientModel client = clientSession.getClient();
String requestID = clientSession.getNote("REQUEST_ID");
String requestID = clientSession.getNote(REQUEST_ID);
String relayState = clientSession.getNote(GeneralConstants.RELAY_STATE);
String redirectUri = clientSession.getRedirectUri();
String responseIssuer = getResponseIssuer(realm);
@ -166,23 +175,23 @@ public class SamlProtocol implements LoginProtocol {
}
private boolean requiresRealmSignature(ClientModel client) {
return "true".equals(client.getAttribute("saml.server.signature"));
return "true".equals(client.getAttribute(SAML_SERVER_SIGNATURE));
}
private boolean requiresAssertionSignature(ClientModel client) {
return "true".equals(client.getAttribute("saml.assertion.signature"));
return "true".equals(client.getAttribute(SAML_ASSERTION_SIGNATURE));
}
private boolean includeAuthnStatement(ClientModel client) {
return "true".equals(client.getAttribute("saml.authnstatement"));
return "true".equals(client.getAttribute(SAML_AUTHNSTATEMENT));
}
private boolean multivaluedRoles(ClientModel client) {
return "true".equals(client.getAttribute("saml.multivalued.roles"));
return "true".equals(client.getAttribute(SAML_MULTIVALUED_ROLES));
}
public static SignatureAlgorithm getSignatureAlgorithm(ClientModel client) {
String alg = client.getAttribute("saml.signature.algorithm");
String alg = client.getAttribute(SAML_SIGNATURE_ALGORITHM);
if (alg != null) {
SignatureAlgorithm algorithm = SignatureAlgorithm.valueOf(alg);
if (algorithm != null) return algorithm;
@ -191,7 +200,7 @@ public class SamlProtocol implements LoginProtocol {
}
private boolean requiresEncryption(ClientModel client) {
return "true".equals(client.getAttribute("saml.encrypt"));
return "true".equals(client.getAttribute(SAML_ENCRYPT));
}
public void initClaims(SALM2LoginResponseBuilder builder, ClientModel model, UserModel user) {

2
saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlService.java
View file

@ -198,7 +198,7 @@ public class SamlService {
clientSession.setAction(ClientSessionModel.Action.AUTHENTICATE);
clientSession.setNote(SamlProtocol.SAML_BINDING, getBindingType());
clientSession.setNote(GeneralConstants.RELAY_STATE, relayState);
clientSession.setNote("REQUEST_ID", requestAbstractType.getID());
clientSession.setNote(SamlProtocol.REQUEST_ID, requestAbstractType.getID());
Response response = authManager.checkNonFormAuthentication(session, clientSession, realm, uriInfo, request, clientConnection, headers, event);
if (response != null) return response;