From 0cb050cee45dbe845cd6fc724e4ef07cfbcbb6ab Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Tue, 10 Sep 2019 17:19:35 +0200 Subject: update AuthnRequestValidator to check requested LoA and upgrade LoA if it is to low --- .../verification/AuthnRequestValidator.java | 48 ++++++++++++++++++++++ 1 file changed, 48 insertions(+) (limited to 'connector/src/main') diff --git a/connector/src/main/java/at/asitplus/eidas/specific/connector/verification/AuthnRequestValidator.java b/connector/src/main/java/at/asitplus/eidas/specific/connector/verification/AuthnRequestValidator.java index 12dffe45..bceb9f35 100644 --- a/connector/src/main/java/at/asitplus/eidas/specific/connector/verification/AuthnRequestValidator.java +++ b/connector/src/main/java/at/asitplus/eidas/specific/connector/verification/AuthnRequestValidator.java @@ -39,11 +39,14 @@ import org.opensaml.saml2.metadata.SPSSODescriptor; import org.opensaml.xml.XMLObject; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.beans.factory.annotation.Autowired; import at.asitplus.eidas.specific.connector.MSeIDASNodeConstants; import at.asitplus.eidas.specific.connector.config.ServiceProviderConfiguration; import at.gv.egiz.eaaf.core.api.IRequest; +import at.gv.egiz.eaaf.core.api.data.EAAFConstants; import at.gv.egiz.eaaf.core.api.data.PVPAttributeDefinitions; +import at.gv.egiz.eaaf.core.api.idp.IConfiguration; import at.gv.egiz.eaaf.core.exceptions.AuthnRequestValidatorException; import at.gv.egiz.eaaf.core.exceptions.EAAFException; import at.gv.egiz.eaaf.core.exceptions.EAAFStorageException; @@ -56,6 +59,8 @@ public class AuthnRequestValidator implements IAuthnRequestValidator { private static final Logger log = LoggerFactory.getLogger(AuthnRequestValidator.class); + @Autowired(required=true) private IConfiguration basicConfig; + @Override public void validate(HttpServletRequest httpReq, IRequest pendingReq, AuthnRequest authnReq, SPSSODescriptor spSSODescriptor) throws AuthnRequestValidatorException { @@ -98,6 +103,49 @@ public class AuthnRequestValidator implements IAuthnRequestValidator { //post-process requested LoA List reqLoA = extractLoA(authnReq); + String minimumLoAFromConfig = basicConfig.getBasicConfiguration( + MSeIDASNodeConstants.PROP_EIDAS_REQUEST_LOA_MINIMUM_LEVEL, + EAAFConstants.EIDAS_LOA_HIGH); + String intMinimumLoAFromConfig = minimumLoAFromConfig; + if (minimumLoAFromConfig.startsWith(EAAFConstants.EIDAS_LOA_PREFIX)) + intMinimumLoAFromConfig = minimumLoAFromConfig.substring(EAAFConstants.EIDAS_LOA_PREFIX.length()); + + log.trace("Validate requested LoA to connector configuration minimum LoA: {} ...", minimumLoAFromConfig); + List allowedLoA = new ArrayList<>(); + for (String loa : reqLoA) { + String intLoa = loa; + if (loa.startsWith(EAAFConstants.EIDAS_LOA_PREFIX)) { + intLoa = loa.substring(EAAFConstants.EIDAS_LOA_PREFIX.length()); + + } + + try { + String selectedLoA = EAAFConstants.EIDAS_LOA_HIGH; + if (MSeIDASNodeConstants.EIDAS_LOA_LEVEL_ORDER.valueOf(intLoa).ordinal() >= + MSeIDASNodeConstants.EIDAS_LOA_LEVEL_ORDER.valueOf(intMinimumLoAFromConfig).ordinal()) { + log.info("Client: {} requested LoA: {} will be upgraded to: {}", + pendingReq.getServiceProviderConfiguration().getUniqueIdentifier(), + loa, + minimumLoAFromConfig); + selectedLoA = loa; + + } + + if (!allowedLoA.contains(selectedLoA)) { + log.debug("Allow LoA: {} for Client: {}", + selectedLoA, + pendingReq.getServiceProviderConfiguration().getUniqueIdentifier()); + allowedLoA.add(selectedLoA); + + } + + } catch (IllegalArgumentException e) { + log.warn("LoA: {} is currently NOT supported and it will be ignored.", loa); + + } + + } + pendingReq.getServiceProviderConfiguration(ServiceProviderConfiguration.class).setRequiredLoA(reqLoA); //post-process requested LoA comparison-level -- cgit v1.2.3 From 04d30c74c92ef519654221ac2485c48df4bb5193 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Tue, 10 Sep 2019 18:03:27 +0200 Subject: refactor LoA upgrade to use method from eIDAS Ref. implementation --- .../verification/AuthnRequestValidator.java | 31 +++++++++++----------- 1 file changed, 15 insertions(+), 16 deletions(-) (limited to 'connector/src/main') diff --git a/connector/src/main/java/at/asitplus/eidas/specific/connector/verification/AuthnRequestValidator.java b/connector/src/main/java/at/asitplus/eidas/specific/connector/verification/AuthnRequestValidator.java index bceb9f35..94b0cc02 100644 --- a/connector/src/main/java/at/asitplus/eidas/specific/connector/verification/AuthnRequestValidator.java +++ b/connector/src/main/java/at/asitplus/eidas/specific/connector/verification/AuthnRequestValidator.java @@ -54,6 +54,7 @@ import at.gv.egiz.eaaf.modules.pvp2.api.reqattr.EAAFRequestedAttribute; import at.gv.egiz.eaaf.modules.pvp2.api.reqattr.EAAFRequestedAttributes; import at.gv.egiz.eaaf.modules.pvp2.api.validation.IAuthnRequestValidator; import at.gv.egiz.eaaf.modules.pvp2.exception.NameIDFormatNotSupportedException; +import eu.eidas.auth.commons.protocol.eidas.LevelOfAssurance; public class AuthnRequestValidator implements IAuthnRequestValidator { @@ -103,31 +104,29 @@ public class AuthnRequestValidator implements IAuthnRequestValidator { //post-process requested LoA List reqLoA = extractLoA(authnReq); - String minimumLoAFromConfig = basicConfig.getBasicConfiguration( + + LevelOfAssurance minimumLoAFromConfig = LevelOfAssurance.fromString(basicConfig.getBasicConfiguration( MSeIDASNodeConstants.PROP_EIDAS_REQUEST_LOA_MINIMUM_LEVEL, - EAAFConstants.EIDAS_LOA_HIGH); - String intMinimumLoAFromConfig = minimumLoAFromConfig; - if (minimumLoAFromConfig.startsWith(EAAFConstants.EIDAS_LOA_PREFIX)) - intMinimumLoAFromConfig = minimumLoAFromConfig.substring(EAAFConstants.EIDAS_LOA_PREFIX.length()); + EAAFConstants.EIDAS_LOA_HIGH)); + if (minimumLoAFromConfig == null) { + log.warn("Can not load minimum LoA from configuration. Use LoA: {} as default", EAAFConstants.EIDAS_LOA_HIGH); + minimumLoAFromConfig = LevelOfAssurance.HIGH; + + } log.trace("Validate requested LoA to connector configuration minimum LoA: {} ...", minimumLoAFromConfig); List allowedLoA = new ArrayList<>(); - for (String loa : reqLoA) { - String intLoa = loa; - if (loa.startsWith(EAAFConstants.EIDAS_LOA_PREFIX)) { - intLoa = loa.substring(EAAFConstants.EIDAS_LOA_PREFIX.length()); - - } - + for (String loa : reqLoA) { try { + LevelOfAssurance intLoa = LevelOfAssurance.fromString(loa); String selectedLoA = EAAFConstants.EIDAS_LOA_HIGH; - if (MSeIDASNodeConstants.EIDAS_LOA_LEVEL_ORDER.valueOf(intLoa).ordinal() >= - MSeIDASNodeConstants.EIDAS_LOA_LEVEL_ORDER.valueOf(intMinimumLoAFromConfig).ordinal()) { + if (intLoa != null && + intLoa.numericValue() >= minimumLoAFromConfig.numericValue()) { log.info("Client: {} requested LoA: {} will be upgraded to: {}", pendingReq.getServiceProviderConfiguration().getUniqueIdentifier(), loa, minimumLoAFromConfig); - selectedLoA = loa; + selectedLoA = intLoa.getValue(); } @@ -146,7 +145,7 @@ public class AuthnRequestValidator implements IAuthnRequestValidator { } - pendingReq.getServiceProviderConfiguration(ServiceProviderConfiguration.class).setRequiredLoA(reqLoA); + pendingReq.getServiceProviderConfiguration(ServiceProviderConfiguration.class).setRequiredLoA(allowedLoA); //post-process requested LoA comparison-level String reqLoAComperison = extractComparisonLevel(authnReq); -- cgit v1.2.3