coheigea opened a new pull request, #3637: URL: https://github.com/apache/cxf/pull/3637
…token endpoint SamlOAuthValidator did not check whether a bearer assertion had already been used (there was a TODO for it), so a captured assertion could be presented to the token endpoint, as a SAML2 bearer grant or for client authentication, any number of times until it expired. Add an optional TokenReplayCache to SamlOAuthValidator. When it is set, the assertion ID is cached once the assertion has otherwise been validated, until the latest NotOnOrAfter of the assertion Conditions and its Bearer Subject Confirmations, and an assertion whose ID has already been seen is rejected. No replay cache is set by default, for either Saml2BearerGrantHandler or Saml2BearerAuthHandler. To make the replay caches available to oauth2-saml without a dependency on the SAML SSO module, move the TokenReplayCache interface (including putIdIfAbsent) and the JCache implementation to cxf-rt-rs-security-xml, in org.apache.cxf.rs.security.common and org.apache.cxf.rs.security.common.jcache. The JCache API is an optional dependency there. The new default JCache configuration uses its own Ehcache persistence directory, so that it can be used alongside the SSO one in the same JVM. For backwards compatibility, org.apache.cxf.rs.security.saml.sso.TokenReplayCache is kept as a sub-interface of the common one, and the SSO JCacheTokenReplayCache as a subclass of the common one, with the same cache name and default configuration file as before. The SSO setters keep taking the SSO type, so existing implementations, configurations and compiled callers continue to work unchanged. Add system tests which configure a JCacheTokenReplayCache on the JCache OAuth2 test server, and check that a SAML2 bearer grant assertion and a SAML2 client authentication assertion are each only accepted once. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
