From bf36b01092474e819597fb7924a88cc969be5ead Mon Sep 17 00:00:00 2001 From: ImalshaG Date: Tue, 18 Jul 2023 10:26:31 +0530 Subject: [PATCH 1/3] Add Sign Response property to session during idp initiated sso --- .../sso/saml/processors/IdPInitSSOAuthnRequestProcessor.java | 1 + 1 file changed, 1 insertion(+) diff --git a/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/processors/IdPInitSSOAuthnRequestProcessor.java b/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/processors/IdPInitSSOAuthnRequestProcessor.java index a42fcd4ea..96de4c4dd 100644 --- a/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/processors/IdPInitSSOAuthnRequestProcessor.java +++ b/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/processors/IdPInitSSOAuthnRequestProcessor.java @@ -135,6 +135,7 @@ public SAMLSSORespDTO process(SAMLSSOAuthnReqDTO authnReqDTO, String sessionId, spDO.setIdPInitSLOEnabled(authnReqDTO.isIdPInitSLOEnabled()); spDO.setAssertionConsumerUrls(authnReqDTO.getAssertionConsumerURLs()); spDO.setIdpInitSLOReturnToURLs(authnReqDTO.getIdpInitSLOReturnToURLs()); + spDO.setDoSignResponse(authnReqDTO.isDoSignResponse()); spDO.setSigningAlgorithmUri(authnReqDTO.getSigningAlgorithmUri()); spDO.setDigestAlgorithmUri(authnReqDTO.getDigestAlgorithmUri()); spDO.setAssertionEncryptionAlgorithmUri(authnReqDTO.getAssertionEncryptionAlgorithmUri()); From b166fe557e104831abd6f6c66b45893c17be5763 Mon Sep 17 00:00:00 2001 From: ImalshaG Date: Wed, 19 Jul 2023 07:37:36 +0530 Subject: [PATCH 2/3] Add config to enable logout response signing for idp init saml sso --- .../carbon/identity/sso/saml/SAMLSSOConstants.java | 1 + .../processors/IdPInitSSOAuthnRequestProcessor.java | 4 +++- .../carbon/identity/sso/saml/util/SAMLSSOUtil.java | 10 ++++++++++ 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/SAMLSSOConstants.java b/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/SAMLSSOConstants.java index 48bdedd58..3de330555 100644 --- a/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/SAMLSSOConstants.java +++ b/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/SAMLSSOConstants.java @@ -68,6 +68,7 @@ public class SAMLSSOConstants { public static final String SAML2_AUTHENTICATION_REQUEST_VALIDITY_PERIOD_ENABLED = "SSOService.SAML2AuthenticationRequestValidityPeriodEnabled"; public static final String SAML2_AUTHENTICATION_REQUEST_VALIDITY_PERIOD = "SSOService.SAML2AuthenticationRequestValidityPeriod"; public static final String SAML_SP_CERTIFICATE_EXPIRY_VALIDATION_ENABLED = "SSOService.SAMLSPCertificateExpiryValidationEnable"; + public static final String SAML_IDP_INIT_LOGOUT_RESPONSE_SIGNING_ENABLED = "SSOService.SAMLIdpInitLogoutResponseSigningEnabled"; public static final String SAML_ASSERTION_ENCRYPT_WITH_APP_CERT = "SSOService.SAMLAssertionEncyptWithAppCert"; public static final String START_SOAP_BINDING = "" + ""; diff --git a/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/processors/IdPInitSSOAuthnRequestProcessor.java b/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/processors/IdPInitSSOAuthnRequestProcessor.java index 96de4c4dd..23cf54bc8 100644 --- a/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/processors/IdPInitSSOAuthnRequestProcessor.java +++ b/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/processors/IdPInitSSOAuthnRequestProcessor.java @@ -135,7 +135,6 @@ public SAMLSSORespDTO process(SAMLSSOAuthnReqDTO authnReqDTO, String sessionId, spDO.setIdPInitSLOEnabled(authnReqDTO.isIdPInitSLOEnabled()); spDO.setAssertionConsumerUrls(authnReqDTO.getAssertionConsumerURLs()); spDO.setIdpInitSLOReturnToURLs(authnReqDTO.getIdpInitSLOReturnToURLs()); - spDO.setDoSignResponse(authnReqDTO.isDoSignResponse()); spDO.setSigningAlgorithmUri(authnReqDTO.getSigningAlgorithmUri()); spDO.setDigestAlgorithmUri(authnReqDTO.getDigestAlgorithmUri()); spDO.setAssertionEncryptionAlgorithmUri(authnReqDTO.getAssertionEncryptionAlgorithmUri()); @@ -143,6 +142,9 @@ public SAMLSSORespDTO process(SAMLSSOAuthnReqDTO authnReqDTO, String sessionId, spDO.setEnableSAML2ArtifactBinding(authnReqDTO.isSAML2ArtifactBindingEnabled()); spDO.setDoValidateSignatureInRequests(authnReqDTO.isDoValidateSignatureInRequests()); spDO.setDoValidateSignatureInArtifactResolve(authnReqDTO.isDoValidateSignatureInArtifactResolve()); + if (SAMLSSOUtil.isSAMLIdpInitLogoutResponseSigningEnabled()) { + spDO.setDoSignResponse(authnReqDTO.isDoSignResponse()); + } sessionPersistenceManager.persistSession(sessionIndexId, authnReqDTO.getUser().getAuthenticatedSubjectIdentifier(), spDO, authnReqDTO.getRpSessionId(), authnReqDTO.getIssuer(), diff --git a/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/util/SAMLSSOUtil.java b/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/util/SAMLSSOUtil.java index d152bb25e..83822201c 100644 --- a/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/util/SAMLSSOUtil.java +++ b/components/org.wso2.carbon.identity.sso.saml/src/main/java/org/wso2/carbon/identity/sso/saml/util/SAMLSSOUtil.java @@ -2691,4 +2691,14 @@ private static SAMLSSOServiceProviderDO getSAMLServiceProviderFromRegistry(Strin PrivilegedCarbonContext.endTenantFlow(); } } + + /** + * Check whether SAML logout response signing is enabled for IDP initiated SSO. + * @return true if enabled. + */ + public static boolean isSAMLIdpInitLogoutResponseSigningEnabled() { + + return Boolean.parseBoolean(IdentityUtil.getProperty( + SAMLSSOConstants.SAML_IDP_INIT_LOGOUT_RESPONSE_SIGNING_ENABLED)); + } } From 0ccb89436737048570a154d7ba3b62d7c5396a29 Mon Sep 17 00:00:00 2001 From: ImalshaG Date: Fri, 28 Jul 2023 07:45:47 +0530 Subject: [PATCH 3/3] Bump framework --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 805745413..748b1eb71 100644 --- a/pom.xml +++ b/pom.xml @@ -452,7 +452,7 @@ 4.9.0 4.9.0 - 5.25.247 + 5.25.260 [5.25.234, 7.0.0) 1.0.0