Limit the domains that we will redirect to after login / logout to a
set of trusted domains. By default we only allow redirects to the
current domain.
This change breaks backwards compatibility with any site that relies on
redirects to separate domains.
Fixes #35
The OASIS specification "SAML V2.0 Enhanced Client or Proxy Profile
Version 2.0" added ECP service options into the HTTP PAOS header. We
previously were not looking for these optional flags. The function
am_validate_paos_header() was rewritten to correctly parse the service
value and the optional URN flags and return a bitmask of the ECP
service flags.
The following flags were added:
* ECP_SERVICE_OPTION_CHANNEL_BINDING
* ECP_SERVICE_OPTION_HOLDER_OF_KEY
* ECP_SERVICE_OPTION_WANT_AUTHN_SIGNED
* ECP_SERVICE_OPTION_DELEGATION
The flags are stored in the am_req_cfg_rec.ecp_service_options member.
Currently only the want_authn_signed option is acted upon, it sets the
lasso signature hint when generating a AuthnRequest.
Lasso as of 2.5.0 is missing 3 of the URN flag identifier constants, a
patch was submitted to upstream Lasso to include them and was
accepted. As a fallback they are conditionally added to lasso_compat.h
in case the version of lasso this is compiled against does not yet
have the new constants.
The function am_is_paos_request() was modified to return an error.
New error codes were added to auth_mellon.h.
New utility code to tokenize a string was added. This is used to
parse the PAOS header, primarily to handle quoted strings.
A new utility routine, *am_ecp_service_options_str() was added so log
messages could include the ECP service option flags in their output.
Signed-off-by: John Dennis <jdennis@redhat.com>
To allow the user to specify CFLAGS in configure, add the CFLAGS macro
to the generated `apxs` command line. This allows us to run things like:
./configure CFLAGS=-Werror
Replace the call to lasso_provider_get_metadata_one() with
lasso_provider_get_metadata_one_for_role() so that we can exlicitly
pass the LASSO_PROVIDER_ROLE_SP role. The former call obtains the
role from the provider object and then calls
lasso_provider_get_metadata_one_for_role() using that role. However
the role will not have been set in the provider until the first request is
processed. This means the first time we call this routine it won't
work correctly because the role will not have been set yet, by
explicitly passing the role we avoid this problem.
Signed-off-by: John Dennis <jdennis@redhat.com>
The modifications in this commit address the changes necessary to
support the SP component of SAML ECP. The Lasso library needs
additional modifications before SAML ECP will be fully functional,
those fixes have been submitted to upstream Lasso, mod_auth_mellon
will continue to operate correctly without the Lasso upgrade, it just
won't properly support ECP without the Lasso fixes.
Below are the major logical changes in the commit and the rationale
behind them.
* Allow compilation against older versions of Lasso by conditionally
compiling.
Add the following CPP symbols set by configure:
* HAVE_ECP
* HAVE_LASSO_UTILS_H
* Add lasso_compat.h
If we can't include lasso utils.h than pull in our own
local definitions so we can use some of the valuable
utilities.
* Add ECP specific documentation file
Documentation specific to ECP is now contained in ECP.rst
(using reStructuredText formatting). Information on general ECP
concepts, mod_auth_mellon user information, and internal
mod_auth_mellon coding issues are covered.
* Add am_get_boolean_query_parameter() utility
* Add am_validate_paos_header() utility
This utility routine validates the PAOS HTTP header. It is used
in conjunction with am_header_has_media_type() to determine if a
client is ECP capable.
* Add am_is_paos_request() utility
This utility checks to see if the request is PAOS based on the
required HTTP header content.
* Add utility function am_header_has_media_type() to check if an HTTP
Accept header includes a specific media type. This is necessary
because the SP detects an ECP client by the presence of a
application/vnd.paos+xml media type in the Accept
header. Unfortunately neither Apache nor mod_auth_mellon already had
a function to check Accept media types so this was custom written
and added to mod_auth_mellon.
* Add utility function am_get_assertion_consumer_service_by_binding()
because Lasso does not expose that in it's public API. It's
necessary to get the URL of the PAOS AssertionConsumerService.
* Add MellonECPSendIDPList config option
This option controls whether to include a list of IDP's when
sending an ECP PAOS <AuthnRequest> message to an ECP client.
* We need to do some bookkeeping during the processing of a
request. Some Apache modules call this "adding a
note". mod_auth_mellon was already doing this but because it only
needed to track one value (the cookie value) took a shortcut and
stuffed the cookie value into the per module request slot rather
than defining a struct that could hold a variety of per-request
values. To accommodate multiple per request bookkeeping values we
define a new struct, am_req_cfg_rec, that holds the previously used
cookie value and adds a new ECP specific value. This struct is now
the bookkeeping data item attached to each request. To support the
new am_req_cfg_rec struct the am_get_req_cfg macro was added (mirrors
the existing am_get_srv_cfg, am_get_mod_cfg and am_get_dir_cfg
macros). The am_create_request() Apache hook was added to
initialize the am_req_cfg_rec at the beginning of the request
pipeline.
* A new endpoint was added to handle PAOS responses from the ECP
client. The endpoint is called "paosResponse" and lives along side
of the existing endpoints (e.g. postResponse, artifactResponse,
metadata, auth, logout, etc.). The new endpoint is handled by
am_handle_paos_reply(). The metadata generation implemented in
am_generate_metadata() was augmented to add the paosResponse
endpoint and bind it to the SAML2 PAOS binding.
* am_handle_reply_common() was being called by am_handle_post_reply()
and am_handle_artifact_reply() because replies share a fair amount
of common logic. The new am_handle_paos_reply() also needs to
utilize the same common logic in am_handle_reply_common() but ECP
has slightly different behavior that has to be accounted for. With
ECP there is no SP generated cookie because the SP did not initiate
the process and has no state to track. Also the RelayState is
optional with ECP and is carried in the PAOS header as opposed to an
HTTP query/post parameter. The boolean flag is_paos was added as a
parameter to am_handle_reply_common() so as to be able to
distinguish between the PAOS and non-PAOS logic.
* Add PAOS AssertionConsumerService to automatically generated metadata.
Note, am_get_assertion_consumer_service_by_binding() should be able
to locate this endpoint.
* Refactor code to send <AuthnRequest>, now also supports PAOS
The creation and initialization of a LassoLogin object is different
for the ECP case. We want to share as much common code as possible,
the following refactoring was done to achieve that goal.
The function am_send_authn_request() was removed and it's logic
moved to am_init_authn_request_common(),
am_send_login_authn_request() and
am_set_authn_request_content(). This allows the logic used to create
and initialize a LassoLogin object to be shared between the PAOS and
non-PAOS cases. am_send_paos_authn_request() also calls
am_init_authn_request_common() and
am_set_authn_request_content(). The function
am_set_authn_request_content() replaces the logic at the end of
am_send_authn_request(), it is responsible for setting the HTTP
headers and body content based on the LassoLogin.
Signed-off-by: John Dennis <jdennis@redhat.com>
This patch makes the username of the main request available in the
subrequests, such as those used by DirectoryIndex to find the
actual page to display when you access a folder.
The error messages would look like this:
> No authentication done but request not allowed without authentication
> for /index.html. Authentication not configured?
This patch fixes issue 38.
The only supported options were 'none' and 'feide', where there is
no usecase anymore for 'feide', leaving only 'none'. This changes
the function into a no-op, it will still accept the MellonDecoder
directive for backwards compatibility.
must-revalidate without max-age or Expire allows browser to
heuristically choose an arbitrary expiration time (especially if
the Last-Modified header is returned in the response). But after a
logout all cached content should be invalidated whatever its expiration
time; to prevent returning stale data to logged-out user we set
max-age=0.
As per e6f60211; apr_uintptr_t was added in apr 1.3.0. Switching to
apt_size_t restores compatibility with earlier versions of apr.
Signed-off-by: Alex Vandiver <alex@chmrr.net>
To make sure that the cookie is deleted, we need to use the
same parameters (domain and path) as when we set the cookie.
Update the code to use the new am_cookie_params()-function to
set the parameters when deleting the cookie.
We need to make sure that we use the same parameters when deleting
the cookie, so create a new function am_cookie_params() that
calculates the parameters.
Olav Morken
Olav Morken
vrasneur
John Dennis
Thijs Kinkhorst
Josh
Steve Traylen
Benjamin Dauvergne
Jan Pazdziora
Alex Vandiver