This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/master by this push:
new 56d7f84 CXF-7588 - SAML audience restriction validation is enabled by
default for REST services
56d7f84 is described below
commit 56d7f84e8a344a736e16435a312c82cc366fb28f
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Tue Dec 12 16:33:49 2017 +0000
CXF-7588 - SAML audience restriction validation is enabled by default for
REST services
---
.../java/org/apache/cxf/rs/security/saml/AbstractSamlInHandler.java | 2 +-
.../main/java/org/apache/cxf/rt/security/saml/utils/SAMLUtils.java | 5 +++--
.../src/main/java/org/apache/cxf/rt/security/SecurityConstants.java | 2 +-
.../java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java | 2 +-
.../org/apache/cxf/ws/security/wss4j/WSS4JStaxInInterceptor.java | 2 +-
5 files changed, 7 insertions(+), 6 deletions(-)
diff --git
a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/AbstractSamlInHandler.java
b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/AbstractSamlInHandler.java
index c71257b..d3d55b1 100644
---
a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/AbstractSamlInHandler.java
+++
b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/AbstractSamlInHandler.java
@@ -193,7 +193,7 @@ public abstract class AbstractSamlInHandler implements
ContainerRequestFilter {
}
protected void configureAudienceRestriction(Message msg, RequestData
reqData) {
-
reqData.setAudienceRestrictions(SAMLUtils.getAudienceRestrictions(msg));
+ reqData.setAudienceRestrictions(SAMLUtils.getAudienceRestrictions(msg,
false));
}
protected SAMLKeyInfo createKeyInfoFromDefaultAlias(Crypto sigCrypto)
throws WSSecurityException {
diff --git
a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/utils/SAMLUtils.java
b/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/utils/SAMLUtils.java
index a63a24d..cc27b05 100644
---
a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/utils/SAMLUtils.java
+++
b/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/utils/SAMLUtils.java
@@ -143,10 +143,11 @@ public final class SAMLUtils {
return ((SamlAssertionWrapper)assertion).getElement();
}
- public static List<String> getAudienceRestrictions(Message msg) {
+ public static List<String> getAudienceRestrictions(Message msg, boolean
enableByDefault) {
// Add Audience Restrictions for SAML
boolean enableAudienceRestriction =
-
SecurityUtils.getSecurityPropertyBoolean(SecurityConstants.AUDIENCE_RESTRICTION_VALIDATION,
msg, true);
+
SecurityUtils.getSecurityPropertyBoolean(SecurityConstants.AUDIENCE_RESTRICTION_VALIDATION,
+ msg, enableByDefault);
if (enableAudienceRestriction) {
List<String> audiences = new ArrayList<>();
// See if we have custom audience restriction values specified
first
diff --git
a/rt/security/src/main/java/org/apache/cxf/rt/security/SecurityConstants.java
b/rt/security/src/main/java/org/apache/cxf/rt/security/SecurityConstants.java
index 1982009..3cc5342 100644
---
a/rt/security/src/main/java/org/apache/cxf/rt/security/SecurityConstants.java
+++
b/rt/security/src/main/java/org/apache/cxf/rt/security/SecurityConstants.java
@@ -181,7 +181,7 @@ public class SecurityConstants {
/**
* Enable SAML AudienceRestriction validation. If this is set to "true",
then IF the
* SAML Token contains Audience Restriction URIs, one of them must match
one of the values of the
- * AUDIENCE_RESTRICTIONS property. The default is "true".
+ * AUDIENCE_RESTRICTIONS property. The default is "true" for SOAP
services, "false" for REST services.
*/
public static final String AUDIENCE_RESTRICTION_VALIDATION =
"security.validate.audience-restriction";
diff --git
a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java
b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java
index f1ef9da..a3c9850 100644
---
a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java
+++
b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java
@@ -204,7 +204,7 @@ public class WSS4JInInterceptor extends
AbstractWSS4JInterceptor {
reqData.setEncryptionSerializer(new StaxSerializer());
// Add Audience Restrictions for SAML
-
reqData.setAudienceRestrictions(SAMLUtils.getAudienceRestrictions(msg));
+ reqData.setAudienceRestrictions(SAMLUtils.getAudienceRestrictions(msg,
true));
SOAPMessage doc = getSOAPMessage(msg);
diff --git
a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JStaxInInterceptor.java
b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JStaxInInterceptor.java
index 4ecd1ed..11dd3b1 100644
---
a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JStaxInInterceptor.java
+++
b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JStaxInInterceptor.java
@@ -276,7 +276,7 @@ public class WSS4JStaxInInterceptor extends
AbstractWSS4JStaxInterceptor {
}
// Add Audience Restrictions for SAML
-
securityProperties.setAudienceRestrictions(SAMLUtils.getAudienceRestrictions(msg));
+
securityProperties.setAudienceRestrictions(SAMLUtils.getAudienceRestrictions(msg,
true));
}
/**
--
To stop receiving notification emails like this one, please contact
['"[email protected]" <[email protected]>'].
