[FEDIZ-72] Make Trusted IDP protocol customizable

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.1.0
• Fix Version/s: 1.2.0
• Component/s: IDP
• Assignee: Oliver Wulff
• Reporter: Oliver Wulff
• Created: 20/Feb/14 09:30
• Updated: 28/Apr/15 09:24
• Resolved: 11/Apr/15 13:01

Description

In release 1.1, the Fediz IDP doesn't support other protocols than WS-Federation for a Trusted IDP. Due to the usage of Spring Web Flow, the flow can still be customized but it has a bigger impact and later migration to new release require more effort.

This is a proposal to add support for custom protocols for Trusted IDPs:

• Introduce Interface "SSOProtocolBridge" which is able to transform a WS-Federation SignIn Request to another SignIn Request (ex. SAML-P AuthRequest) and to transform another SignIn Response (ex. SAML-P AuthResponse) to a WS-Federation SignIn Response.

• Processing logic is part of the main IDP web flow which chooses a protocol depending on the configuration of the TrustedIdp

• New protocol implementations can be found due to spring annotations scanning and injecting the beans in the core processing logic

public interface SSOProtocolBridge {
    
    boolean canHandleRequest(HttpServletRequest request);

    String getProtocol();

    // ActionState before redirectToTrustedIDP end-state to define SignIn URL
    // Note: Only supports HTTP GET SignIn Requests
    URL mapSignInRequest(RequestContext context);
    
    // Hook in <action-state id="validateToken"> of federation-signin-response.xml
    // ValidateTokenAction class delegates to an implementation of mapSignInResponse() according to the current protocol in the conversation
    SecurityToken mapSignInResponse(RequestContext context);
}

Issue Links

• is depended upon by: FEDIZ-74 Support Google Login for Trusted IDP
• is depended upon by: FEDIZ-8 Add support for OAuth2 Authorization and Access Token Service
• is depended upon by: FEDIZ-75 Support LinkedIn Login for Trusted IDP
• is depended upon by: FEDIZ-73 Support SAML-P protocol for Trusted IDP
• is depended upon by: FEDIZ-76 Support Facebook Login for Trusted IDP