This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/3.1.x-fixes by this push:
new 1e3416c CXF-7588 - SAML audience restriction validation is enabled by
default for REST services
1e3416c is described below
commit 1e3416c1717f0b5628a5b8290570a3d075f543c4
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Tue Dec 12 16:33:49 2017 +0000
CXF-7588 - SAML audience restriction validation is enabled by default for
REST services
(cherry picked from commit 56d7f84e8a344a736e16435a312c82cc366fb28f)
---
.../java/org/apache/cxf/rs/security/saml/AbstractSamlInHandler.java | 2 +-
.../main/java/org/apache/cxf/rt/security/saml/utils/SAMLUtils.java | 5 +++--
.../src/main/java/org/apache/cxf/rt/security/SecurityConstants.java | 2 +-
.../java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java | 2 +-
.../org/apache/cxf/ws/security/wss4j/WSS4JStaxInInterceptor.java | 2 +-
5 files changed, 7 insertions(+), 6 deletions(-)
diff --git
a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/AbstractSamlInHandler.java
b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/AbstractSamlInHandler.java
index 972be26..2145dde 100644
---
a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/AbstractSamlInHandler.java
+++
b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/saml/AbstractSamlInHandler.java
@@ -192,7 +192,7 @@ public abstract class AbstractSamlInHandler implements
ContainerRequestFilter {
}
protected void configureAudienceRestriction(Message msg, RequestData
reqData) {
-
reqData.setAudienceRestrictions(SAMLUtils.getAudienceRestrictions(msg));
+ reqData.setAudienceRestrictions(SAMLUtils.getAudienceRestrictions(msg,
false));
}
protected SAMLKeyInfo createKeyInfoFromDefaultAlias(Crypto sigCrypto)
throws WSSecurityException {
diff --git
a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/utils/SAMLUtils.java
b/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/utils/SAMLUtils.java
index a19c041..1079ff7 100644
---
a/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/utils/SAMLUtils.java
+++
b/rt/security-saml/src/main/java/org/apache/cxf/rt/security/saml/utils/SAMLUtils.java
@@ -143,10 +143,11 @@ public final class SAMLUtils {
return ((SamlAssertionWrapper)assertion).getElement();
}
- public static List<String> getAudienceRestrictions(Message msg) {
+ public static List<String> getAudienceRestrictions(Message msg, boolean
enableByDefault) {
// Add Audience Restrictions for SAML
boolean enableAudienceRestriction =
-
SecurityUtils.getSecurityPropertyBoolean(SecurityConstants.AUDIENCE_RESTRICTION_VALIDATION,
msg, true);
+
SecurityUtils.getSecurityPropertyBoolean(SecurityConstants.AUDIENCE_RESTRICTION_VALIDATION,
+ msg, enableByDefault);
if (enableAudienceRestriction) {
List<String> audiences = new ArrayList<>();
// See if we have custom audience restriction values specified
first
diff --git
a/rt/security/src/main/java/org/apache/cxf/rt/security/SecurityConstants.java
b/rt/security/src/main/java/org/apache/cxf/rt/security/SecurityConstants.java
index c285510..0d08632 100644
---
a/rt/security/src/main/java/org/apache/cxf/rt/security/SecurityConstants.java
+++
b/rt/security/src/main/java/org/apache/cxf/rt/security/SecurityConstants.java
@@ -181,7 +181,7 @@ public class SecurityConstants {
/**
* Enable SAML AudienceRestriction validation. If this is set to "true",
then IF the
* SAML Token contains Audience Restriction URIs, one of them must match
one of the values of the
- * AUDIENCE_RESTRICTIONS property. The default is "true".
+ * AUDIENCE_RESTRICTIONS property. The default is "true" for SOAP
services, "false" for REST services.
*/
public static final String AUDIENCE_RESTRICTION_VALIDATION =
"security.validate.audience-restriction";
diff --git
a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java
b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java
index dcfbc30..f9bf268 100644
---
a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java
+++
b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java
@@ -199,7 +199,7 @@ public class WSS4JInInterceptor extends
AbstractWSS4JInterceptor {
reqData.setEncryptionSerializer(new StaxSerializer());
// Add Audience Restrictions for SAML
-
reqData.setAudienceRestrictions(SAMLUtils.getAudienceRestrictions(msg));
+ reqData.setAudienceRestrictions(SAMLUtils.getAudienceRestrictions(msg,
true));
SOAPMessage doc = getSOAPMessage(msg);
diff --git
a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JStaxInInterceptor.java
b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JStaxInInterceptor.java
index e7e2afa..38a58e3 100644
---
a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JStaxInInterceptor.java
+++
b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JStaxInInterceptor.java
@@ -291,7 +291,7 @@ public class WSS4JStaxInInterceptor extends
AbstractWSS4JStaxInterceptor {
}
// Add Audience Restrictions for SAML
-
securityProperties.setAudienceRestrictions(SAMLUtils.getAudienceRestrictions(msg));
+
securityProperties.setAudienceRestrictions(SAMLUtils.getAudienceRestrictions(msg,
true));
}
/**
--
To stop receiving notification emails like this one, please contact
['"[email protected]" <[email protected]>'].
