Hi All, I addressed my problem by patching the class
*AbstractSamlProfileHandlerController*.
In particular, I changed into *constructServiceUrl()* to
*deflate/compress* samlRequest parameter and into
*retrieveSamlAuthenticationRequestFromHttpRequest()* to *inflate* the
previously deflated request parameter.
In this way, I'm currently able to work with a shorter redirection URL,
compliant with mod_proxy_http limitations (max size for response headers
8k - e.g. Location header).
I would ask you for a feedback on this approach.
For my purpose, I didn't be able to use *CompressionUtils.deflate()* to
compress the saml request because this method didn't handle correctly
with head and foot bytes. I had to write my personal deflate method.
I summarize below the main pieces of code.
Please, let me have a feedback.
Best regards,
F.
@Controller
public abstract class AbstractSamlProfileHandlerController {
...
protected String *constructServiceUrl*(
final HttpServletRequest request,
final HttpServletResponse response,
final Pair<? extends SignableSAMLObject, MessageContext>
pair) throws SamlException {
final AuthnRequest authnRequest =
AuthnRequest.class.cast(pair.getLeft());
final MessageContext messageContext = pair.getRight();
try (StringWriter writer =
SamlUtils.transformSamlObject(this.configBean, authnRequest)) {
final URLBuilder builder = new
URLBuilder(this.callbackService.getId());
builder.getQueryParams().add(
new
net.shibboleth.utilities.java.support.collection.Pair<>(
SamlProtocolConstants.PARAMETER_ENTITY_ID,
SamlIdPUtils.getIssuerFromSamlRequest(authnRequest)));
*
** // -----------------------------**
** // Compress the saml request in order to be compliant with
mod_proxy_http response header size limitations (max 8K)**
** // -----------------------------**
** final String samlRequest =
compress(writer.toString().getBytes(StandardCharsets.UTF_8));**
** // -----------------------------*
builder.getQueryParams().add(
new
net.shibboleth.utilities.java.support.collection.Pair<>(
SamlProtocolConstants.PARAMETER_SAML_REQUEST,
samlRequest));
builder.getQueryParams().add(
new
net.shibboleth.utilities.java.support.collection.Pair<>(
SamlProtocolConstants.PARAMETER_SAML_RELAY_STATE,
SAMLBindingSupport.getRelayState(messageContext)));
final String url = builder.buildURL();
LOGGER.trace("Built service callback url [{}]", url);
return CommonUtils.constructServiceUrl(request, response,
url, casProperties.getServer().getName(),
CasProtocolConstants.PARAMETER_SERVICE,
CasProtocolConstants.PARAMETER_TICKET, false);
} catch (final Exception e) {
throw new SamlException(e.getMessage(), e);
}
}
protected AuthnRequest
*retrieveSamlAuthenticationRequestFromHttpRequest*(final
HttpServletRequest request) throws
Exception {
LOGGER.debug("Retrieving authentication request from scope");
final String requestValue =
request.getParameter(SamlProtocolConstants.PARAMETER_SAML_REQUEST);
if (StringUtils.isBlank(requestValue)) {
throw new IllegalArgumentException("SAML request could not
be determined from the authentication request");
}
* // -----------------------------**
** // C**onsider deflated requests**
** // -----------------------------**
** final byte[] encodedRequest =
decodeSamlAuthnRequest(requestValue);**
** // -----------------------------*
final AuthnRequest authnRequest = (AuthnRequest)
XMLObjectSupport.unmarshallFromInputStream(this.configBean.
getParserPool(), new ByteArrayInputStream(encodedRequest));
return authnRequest;
}
* // -----------------------------**
** // U**tility methods ....**
** // -----------------------------*
private String *compress*(byte[] input) {
Deflater deflater = new Deflater();
deflater.setInput(input, 0, input.length);
deflater.finish();
byte[] buff = new byte[input.length + 50];
deflater.deflate(buff);
int compressedSize = deflater.getTotalOut();
if (deflater.getTotalIn() != input.length) {
return null;
}
byte[] output = new byte[compressedSize - 6];
System.arraycopy(buff, 2, output, 0, compressedSize - 6);// del
head and foot byte
return EncodingUtils.encodeBase64(output);
}
private byte[] *decodeSamlAuthnRequest*(final String
encodedRequestXmlString) {
if (StringUtils.isEmpty(encodedRequestXmlString)) {
return null;
}
final byte[] decodedBytes =
EncodingUtils.decodeBase64(encodedRequestXmlString);
if (decodedBytes == null) {
return null;
}
final String inflated = CompressionUtils.inflate(decodedBytes);
if (StringUtils.isEmpty(inflated)) {
return decodedBytes;
}
return inflated.getBytes(StandardCharsets.UTF_8);
}
...
}
Il 14/11/2017 21:48, Tom Poage ha scritto:
This is why the most common profile for SAMLResponse is POST. That, or use SAML
Attribute Query (uncommon with SAML 2.0).
Tom.
On Nov 14, 2017, at 8:59 AM, Fabio Martelli <[email protected]> wrote:
Hi All, I have some trouble with SAML Authentication through mod_proxy_http.
It seems that there is a strong limitation to 8k for http response headers: in
particular, my issue is about a redirect URL generated by CAS 5.2_RC4 [1].
As you know, this redirection requests results in a specific response header
specification: Location.
Unfortunately, the redirection URL results to be of ~13k. For this reason, the
Location header is truncated by mod_proxy and the SAML authentication fails
(authentication request results in an invalid XML).
Is there a known way to address this problem or I need to implement some custom
string compression somewhere?
I'm quite sure I cannot be alone facing with this kind of problem .... Please,
let me have your help.
Best regards,
F.
[1]
https://github.com/apereo/cas/blob/master/support/cas-server-support-saml-idp/src/main/java/org/apereo/cas/support/saml/web/idp/profile/AbstractSamlProfileHandlerController.java#L386-L403
--
Fabio Martelli
https://it.linkedin.com/pub/fabio-martelli/1/974/a44
http://blog.tirasa.net/author/fabio/index.html
Tirasa - Open Source Excellence
http://www.tirasa.net/index.html?pk_campaign=email&pk_kwd=fm
Apache Syncope PMC
http://people.apache.org/~fmartelli/
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
--- You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/63e1b4dd-e8b6-8cb4-eb1d-7af4ad2b9e91%40gmail.com.
--
Fabio Martelli
https://it.linkedin.com/pub/fabio-martelli/1/974/a44
http://blog.tirasa.net/author/fabio/index.html
Tirasa - Open Source Excellence
http://www.tirasa.net/index.html?pk_campaign=email&pk_kwd=fm
Apache Syncope PMC
http://people.apache.org/~fmartelli/
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/d7309d8a-afbe-545f-edd5-1e0adaddb72c%40gmail.com.
