Configured more

docker-compose.prod.yml

@@ -137,7 +137,6 @@ services:
       SERVER_NAME: dbrepo.ossdip.at
       SPRING_PROFILES_ACTIVE: sandbox
       KEY_STORE_PASSWORD: ${KEY_STORE_PASSWORD}
-      SAML_SIGN_KEY: ${SAML_SIGN_KEY}
     ports:
       - "9097:9097"
     depends_on:

fda-authentication-service/README.md

@@ -20,7 +20,7 @@ set KEY_STORE_PASSWORD "..."
 
 The key store is a secure container that contains the SSL/TLS certificate:
 
-1. Let's Encrypt private key for `dbrepo.ossdip.at` with alias `1`
+1. Let's Encrypt private key for `dbrepo.ossdip.at` with alias `ssl`
 
 ## Development
 

fda-authentication-service/rest-service/src/main/java/at/tuwien/config/SamlConfig.java

 package at.tuwien.config;
 
+import lombok.extern.log4j.Log4j2;
 import org.apache.commons.httpclient.HttpClient;
 import org.apache.commons.httpclient.MultiThreadedHttpConnectionManager;
 import org.apache.velocity.app.VelocityEngine;
@@ -35,12 +36,17 @@ import org.springframework.security.saml.util.VelocityFactory;
 import org.springframework.security.saml.websso.*;
 import org.springframework.security.web.*;
 import org.springframework.security.web.access.channel.ChannelProcessingFilter;
+import org.springframework.security.web.authentication.logout.LogoutHandler;
+import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
 import org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler;
 import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
+import org.springframework.security.web.csrf.CsrfFilter;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 
+import java.io.IOException;
 import java.util.*;
 
+@Log4j2
 @Configuration
 @EnableWebSecurity
 @EnableGlobalMethodSecurity(securedEnabled = true)
@@ -155,7 +161,7 @@ public class SamlConfig extends WebSecurityConfigurerAdapter {
         extendedMetadata.setIdpDiscoveryEnabled(true);
         extendedMetadata.setSignMetadata(true);
         extendedMetadata.setSigningKey(samlSignKey);
-//        extendedMetadata.setEncryptionKey(samlSignKey);
+        extendedMetadata.setEncryptionKey(samlSignKey);
         return extendedMetadata;
     }
 
@@ -177,7 +183,9 @@ public class SamlConfig extends WebSecurityConfigurerAdapter {
     public CachingMetadataManager metadata(ExtendedMetadataDelegate extendedMetadataDelegate) throws MetadataProviderException {
         final List<MetadataProvider> providers = new ArrayList<>();
         providers.add(extendedMetadataDelegate);
-        return new CachingMetadataManager(providers);
+        CachingMetadataManager metadataManager = new CachingMetadataManager(providers);
+        metadataManager.setDefaultIDP(idpProviderMetadata);
+        return metadataManager;
     }
 
     @Bean
@@ -227,17 +235,39 @@ public class SamlConfig extends WebSecurityConfigurerAdapter {
         return new SAMLProcessorImpl(bindings);
     }
 
+    @Bean
+    public SecurityContextLogoutHandler logoutHandler() {
+        SecurityContextLogoutHandler logoutHandler = new SecurityContextLogoutHandler();
+        logoutHandler.setInvalidateHttpSession(true);
+        logoutHandler.setClearAuthentication(true);
+        return logoutHandler;
+    }
+
+    @Bean
+    public SAMLLogoutFilter samlLogoutFilter() {
+        return new SAMLLogoutFilter(successLogoutHandler(),
+                new LogoutHandler[]{logoutHandler()},
+                new LogoutHandler[]{logoutHandler()});
+    }
+
+    @Bean
+    public SAMLLogoutProcessingFilter samlLogoutProcessingFilter() {
+        return new SAMLLogoutProcessingFilter(successLogoutHandler(), logoutHandler());
+    }
+
     @Bean
     public FilterChainProxy samlFilter() throws Exception {
-        final List<SecurityFilterChain> chains = new ArrayList<>();
-        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/login/**"),
-                samlEntryPoint()));
-        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/metadata/**"),
-                metadataDisplayFilter()));
+        List<SecurityFilterChain> chains = new ArrayList<>();
         chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/SSO/**"),
                 samlWebSSOProcessingFilter()));
         chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/discovery/**"),
                 samlIDPDiscovery()));
+        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/login/**"),
+                samlEntryPoint()));
+        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/logout/**"),
+                samlLogoutFilter()));
+        chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/SingleLogout/**"),
+                samlLogoutProcessingFilter()));
         return new FilterChainProxy(chains);
     }
 
@@ -256,13 +286,23 @@ public class SamlConfig extends WebSecurityConfigurerAdapter {
         http.csrf()
                 .disable();
         http.addFilterBefore(metadataGeneratorFilter(), ChannelProcessingFilter.class)
-                .addFilterAfter(samlFilter(), BasicAuthenticationFilter.class);
-        /* allow metadata and saml stuff */
+                .addFilterAfter(samlFilter(), BasicAuthenticationFilter.class)
+                .addFilterBefore(samlFilter(), CsrfFilter.class);
         http.authorizeRequests()
-                .antMatchers("/saml/**").permitAll()
-                .antMatchers("/health").permitAll()
-                .antMatchers("/error").permitAll()
-                .anyRequest().authenticated();
+                .antMatchers("/").permitAll()
+//                .antMatchers("/saml/**").permitAll()
+//                .antMatchers("/health").permitAll()
+//                .antMatchers("/error").permitAll()
+                .anyRequest()
+                .authenticated();
+        http.logout()
+                .addLogoutHandler((request, response, authentication) -> {
+                    try {
+                        response.sendRedirect("/saml/logout");
+                    } catch (IOException e) {
+                        log.error("Failed to logout: {}", e.getMessage());
+                    }
+                });
     }
 
     @Bean

fda-authentication-service/rest-service/src/main/java/at/tuwien/config/SecurityConfig.java

+package at.tuwien.config;
+
+import at.tuwien.service.AuthenticationService;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.saml.SAMLAuthenticationProvider;
+
+@Configuration
+public class SecurityConfig {
+
+    @Bean
+    public SAMLAuthenticationProvider samlAuthenticationProvider() {
+        return new AuthenticationService();
+    }
+
+}

fda-authentication-service/rest-service/src/main/java/at/tuwien/endpoints/TestEndpoint.java

+package at.tuwien.endpoints;
+
+import lombok.extern.log4j.Log4j2;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.web.bind.annotation.CrossOrigin;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@Log4j2
+@RestController("/api/test")
+@CrossOrigin(origins = "*")
+public class TestEndpoint {
+
+    @GetMapping("/")
+    public String index() {
+        final Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+        log.debug("auth {}", auth);
+        log.debug("auth principal {}", auth.getPrincipal());
+        return "hello";
+    }
+
+}
\ No newline at end of file

fda-authentication-service/services/src/main/java/at/tuwien/service/AuthenticationService.java

+package at.tuwien.service;
+
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.providers.ExpiringUsernameAuthenticationToken;
+import org.springframework.security.saml.SAMLAuthenticationProvider;
+import org.springframework.security.saml.SAMLCredential;
+import org.springframework.stereotype.Service;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+
+@Service
+public class AuthenticationService extends SAMLAuthenticationProvider {
+
+    @Override
+    public Collection<? extends GrantedAuthority> getEntitlements(SAMLCredential credential, Object userDetail) {
+        if (userDetail instanceof ExpiringUsernameAuthenticationToken) {
+            return new ArrayList<>(((ExpiringUsernameAuthenticationToken) userDetail)
+                    .getAuthorities());
+        } else {
+            return Collections.emptyList();
+        }
+    }
+}
\ No newline at end of file

fda-authentication-service/services/src/main/java/at/tuwien/service/SamlUserDetailsService.java

-package at.tuwien.service;
-
-import lombok.extern.log4j.Log4j2;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
-import org.springframework.security.core.userdetails.User;
-import org.springframework.security.core.userdetails.UsernameNotFoundException;
-import org.springframework.security.saml.SAMLCredential;
-import org.springframework.security.saml.userdetails.SAMLUserDetailsService;
-import org.springframework.stereotype.Service;
-
-import java.util.List;
-
-@Log4j2
-@Service
-public class SamlUserDetailsService implements SAMLUserDetailsService {
-
-    @Override
-    public Object loadUserBySAML(SAMLCredential credential) throws UsernameNotFoundException {
-        String id = credential.getNameID().getValue();
-        /* right now we only support users */
-        return new User(id, "empty", true, true, true, true, List.of(new SimpleGrantedAuthority("ROLE_USER")));
-    }
-}