{"type":"doc","content":[{"type":"paragraph","content":[{"text":"Current File(s):","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"conf/intercept/context-check-intercept-config.xml","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Format:","type":"text","marks":[{"type":"strong"}]},{"text":" Native Spring","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"4a0b97e4-c210-4316-89fc-321c33621442"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"c0f12e2f-d4ef-45f7-ac06-3db772fc023d"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"The \"context-check\" interceptor flow is an example of how to use an interceptor to interrupt processing and either continue or halt processing based on the state of the \"context tree\" that makes up the state of the request. A common use case for this feature is to impose authorization rules at the IdP to work around the limitations of a service that either does not implement any authorization or does not provide an adequate user experience in the event of failure. A frequently cited example of the latter is Google Apps for Education. Must be their limited budget.","type":"text"}]},{"type":"paragraph","content":[{"text":"Everything about a request is tracked in the tree of context objects (or can be injected into the condition bean applied), so there is no \"hidden\" information. Anything is on the table for examination, including:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"information about the relying party","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"information about the user, the user's session, the user's authentication state, or attributes","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"environmental information from the client request","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"any configuration/rules you define and inject with Spring","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"All interceptors are enabled or disabled on a per-relying-party basis using properties in the profile bean(s) you want to enable the flow for. See the ","type":"text"},{"text":"ProfileInterceptConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1265631714"}}]},{"text":" topic for an example.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Enabling Module (V4.1+)","type":"text"}]},{"type":"paragraph","content":[{"text":"For V4.1+, configuring and using this feature requires that you first enable the \"idp.intercept.ContextCheck\" module if it isn't already enabled. Systems upgraded from older releases generally come pre-enabled due to the prior state of the configuration tree.","type":"text"}]},{"type":"codeBlock","content":[{"text":"(Windows)\nC:\\opt\\shibboleth-idp> bin\\module.bat -t idp.intercept.ContextCheck || bin\\module.bat -e idp.intercept.ContextCheck\n \n(Other)\n$ bin/module.sh -t idp.intercept.ContextCheck || bin/module.sh -e idp.intercept.ContextCheck","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"General Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"This flow can operate in a limited \"single condition\" mode, or a more flexible functional mode. The functional mode is strongly suggested.","type":"text"}]},{"type":"expand","attrs":{"title":"Functional Mode"},"content":[{"type":"paragraph","content":[{"text":"Previously, it was common to need to create copies of the flow to accommodate different needs. While this is possible, it can be avoided in essentially all cases by using the support for applying a ","type":"text"},{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":" instead of a single condition/predicate. While the condition mode applies a single condition and returns a fixed error Event, the ","type":"text"},{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":" mode is more general in that it directly returns a string to use as the follow up event.","type":"text"}]},{"type":"paragraph","content":[{"text":"A bean named ","type":"text"},{"text":"shibboleth.context-check.Function","type":"text","marks":[{"type":"strong"}]},{"text":" in ","type":"text"},{"text":"conf/intercept/context-check-intercept-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" must be defined by you with the function you want to apply. The bean must be of type ","type":"text"},{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":",","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":">. The return value contains the event that the interceptor should signal, either \"proceed\" to indicate that processing should continue successfully or any other value as a custom Event. For example, returning \"ContextCheckDenied\" will match the existing behavior of the original condition mode.","type":"text"}]},{"type":"paragraph","content":[{"text":"If you want to support one or more custom events, you'll need to add the event(s) to ","type":"text"},{"text":"conf/intercept/intercept-events-flow.xml","type":"text","marks":[{"type":"em"}]},{"text":". The default file includes a commented example for an event called \"MyCustomEvent\". Then you'll need to add that event in ","type":"text"},{"text":"conf/errors.xml","type":"text","marks":[{"type":"em"}]},{"text":" if you want it handled with a local error page.","type":"text"}]},{"type":"paragraph","content":[{"text":"As a primitive example, consider a map indexed by relying party name, allowing a condition to be uniquely defined for each applicable relying party separately.","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Example function using a map of conditions","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\t\n\t\t\n\t\n\t\n\t\t\n\t\n\n\n\n\t\n\t\t\n\t\t\n\t\t\n\t\n","type":"text"}]}]},{"type":"expand","attrs":{"title":"Condition Mode"},"content":[{"type":"paragraph","content":[{"text":"The only configuration involved with this mode is to define the condition you want it to evaluate, and possibly adjust the user interface result in the event of failure.","type":"text"}]},{"type":"paragraph","content":[{"text":"The bean named ","type":"text"},{"text":"shibboleth.context-check.Condition","type":"text","marks":[{"type":"strong"}]},{"text":" in ","type":"text"},{"text":"conf/intercept/context-check-intercept-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" must be defined by you with the condition you want to apply. The bean must be of type ","type":"text"},{"text":"Predicate","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Predicate"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":">, but beyond that, it can do anything. Note that this is the same type signature as the conditions discussed in the ","type":"text"},{"text":"ActivationConditions","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1265631713"}}]},{"text":" topic, so the examples there may help you. Non-programmers may be particularly interested in the scripted examples.","type":"text"}]},{"type":"panel","attrs":{"panelType":"success"},"content":[{"type":"paragraph","content":[{"text":"The common authorization usage for this flow is reflected in the example condition you will find in the file. It demonstrates the use of a built-in condition called a ","type":"text"},{"text":"SimpleAttributePredicate","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.profile.logic.SimpleAttributePredicate"}}]},{"text":", which evaluates the request for the presence of particular attribute(s) and optionally value(s) through a simple map. Each map entry is the ID of an attribute, and the map values are a list of values of that attribute to check for (or you can use an asterisk as a wildcard to indicate that any value is acceptable). Refer to the Javadoc for additional details.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The other half of the configuration of this flow is the result. Obviously success simply causes things to proceed in the usual fashion, but failure will produce an event called \"ContextCheckDenied\". The IdP's built-in ","type":"text"},{"text":"ErrorHandlingConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1265631634"}}]},{"text":" treats that event as a \"local error\", meaning that processing is halted and an error page displayed.","type":"text"}]},{"type":"paragraph","content":[{"text":"The event is mapped to a default error message using the standard machinery, which you can adjust, but producing the right response for a lot of different (possibly unrelated) scenarios will quickly become hard to manage. You will probably want to define your own events, and to do that, you should use the ","type":"text"},{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":" mode described earlier.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Notable Events","type":"text"}]},{"type":"paragraph","content":[{"text":"A couple of internal event strings are noteworthy for some specific cases that come up occasionally. Your flow can signal these events to cause the IdP to react in a controlled way:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"RestartAuthentication","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"This event will cause the IdP to reset the request state and start the authentication (and attribute resolution) stages from scratch.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"UpdateSecurityParameters","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"This event will cause the IdP to re-derive the internal settings that govern how the IdP identifies itself and how it signs and encrypts messages. As an example, if the IdP's entityID and/or signing key needs to change mid-transaction, you can install functions into the profile configuration to derive them dynamically and signal this event to cause those functions to be called again in case their results are expected to be different.","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Examples","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Enforcing Authentication Policy","type":"text"}]},{"type":"paragraph","content":[{"text":"In most cases, it is strongly advisable that the authentication \"strength\" required for a given transaction be managed by expressing requirements through requested principal types associated with the request, either via a SAML 2.0 ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element, or when necessary via the ","type":"text"},{"text":"defaultAuthenticationMethods","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"Profile Configuration","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1265631678"}}]},{"text":" property. When properly configured, the IdP will automatically prevent an inadequate authentication result from being used for a request.","type":"text"}]},{"type":"paragraph","content":[{"text":"In some cases, this may not be sufficient, such as when the user's identity or associated attributes dictate whether authentication is sufficient, regardless of the service. If the ","type":"text"},{"text":"MFA","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1265631610"}}]},{"text":" login flow is being used, the suggested approach is to manipulate the ","type":"text"},{"text":"RequestedPrincipalContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.context.RequestedPrincipalContext"}}]},{"text":" object in the context tree as part of the MFA ruleset, so that the IdP will enforce the appropriate policy for you.","type":"text"}]},{"type":"paragraph","content":[{"text":"If the MFA login flow is not being used, another possible technique is to perform this enforcement check yourself by means of this interceptor flow. As a simple example, consider a case where the presence of an attribute is a signal to require a particular principal be present in the result. The example demonstrates use of an InCommon-defined MFA profile in which the values represent \"use of MFA\" or \"non-use of MFA\".","type":"text"}]},{"type":"expand","attrs":{"title":"Example enforcing use of MFA based on user policy"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n \n \n \n \n \n \n http://id.incommon.org/assurance/basic\n \n \n \n \n \n \n \n \n \n\n\t\n\t\n\t\t\n\t\t\t\n\n\t\t\t\n\t\t\n\t","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"expand","attrs":{"title":"Beans"},"content":[{"type":"paragraph","content":[{"text":"The following beans may be defined in ","type":"text"},{"text":"conf/intercept/context-check-intercept-config.xml","type":"text","marks":[{"type":"em"}]},{"text":":","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"e3e6dfec-d4e0-4ce9-b5db-d981a548ef17"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[309.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[332.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[655.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[309.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.context-check.Condition","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[332.0]},"content":[{"type":"paragraph","content":[{"text":"Predicate","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Predicate"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[655.0]},"content":[{"type":"paragraph","content":[{"text":"Condition evaluated by the interceptor flow to decide whether to continue","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[309.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.context-check.Function ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[332.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Function"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":",","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[655.0]},"content":[{"type":"paragraph","content":[{"text":"Function evaluated by the interceptor flow to produce the event to signal","type":"text"}]}]}]}]}]},{"type":"paragraph"}],"version":1}

Browser not supported