Generate SAML metadata for the Identity Provider #52415
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Expose an API that consumes (possibly signed) AuthnRequests as defined by the HTTP-Redirect binding. - Process AuthnRequests, validate and parse them into a minimum set of information to be used for subsequent API calls to get a SAML Response
This change adds an API for generating SAML metadata for the configured Identity Provider. All parameters that can contribute to the metadata, from signing keys to Organization and contact details are all configured in node settings. The caller of the API needs to define the SP that will consume this metadata as the values included can potentially be different, depending on the registered SP configuration and the IDP policy.
Collaborator
|
Pinging @elastic/es-security (:Security/Security) |
jkakavas
commented
Feb 26, 2020
...ntity-provider/src/main/java/org/elasticsearch/xpack/idp/saml/idp/SamlMetadataGenerator.java
Show resolved
Hide resolved
jkakavas
commented
Feb 26, 2020
...n/identity-provider/src/test/java/org/elasticsearch/xpack/idp/saml/test/IdpSamlTestCase.java
Show resolved
Hide resolved
tvernum
reviewed
Feb 27, 2020
...ty-provider/src/main/java/org/elasticsearch/xpack/idp/action/SamlGenerateMetadataAction.java
Outdated
Show resolved
Hide resolved
...y-provider/src/main/java/org/elasticsearch/xpack/idp/action/SamlGenerateMetadataRequest.java
Show resolved
Hide resolved
...-provider/src/main/java/org/elasticsearch/xpack/idp/action/SamlGenerateMetadataResponse.java
Outdated
Show resolved
Hide resolved
...provider/src/main/java/org/elasticsearch/xpack/idp/rest/RestSamlGenerateMetadataRequest.java
Outdated
Show resolved
Hide resolved
...tity-provider/src/main/java/org/elasticsearch/xpack/idp/saml/idp/SamlIdPMetadataBuilder.java
Outdated
Show resolved
Hide resolved
...tity-provider/src/main/java/org/elasticsearch/xpack/idp/saml/idp/SamlIdPMetadataBuilder.java
Outdated
Show resolved
Hide resolved
...ntity-provider/src/main/java/org/elasticsearch/xpack/idp/saml/idp/SamlMetadataGenerator.java
Show resolved
Hide resolved
...n/identity-provider/src/test/java/org/elasticsearch/xpack/idp/saml/test/IdpSamlTestCase.java
Show resolved
Hide resolved
tvernum
approved these changes
Feb 28, 2020
|
|
||
| import static org.elasticsearch.rest.RestRequest.Method.GET; | ||
|
|
||
| public class RestSamlMetadataRequestAction extends BaseRestHandler { |
Contributor
There was a problem hiding this comment.
I would call this either
Suggested change
| public class RestSamlMetadataRequestAction extends BaseRestHandler { | |
| public class RestGetSamlMetadataAction extends BaseRestHandler { |
or
Suggested change
| public class RestSamlMetadataRequestAction extends BaseRestHandler { | |
| public class RestSamlMetadataAction extends BaseRestHandler { |
|
|
||
| @Override | ||
| public String getName() { | ||
| return "saml_idp_generate_metadata"; |
Contributor
There was a problem hiding this comment.
I'd probably change this name, based on what you decide to call the class.
Contributor
|
GitHub/Jenkins seems to have lost the CI results. @elasticmachine test this please |
tvernum
approved these changes
Feb 28, 2020
| @Override | ||
| public String getName() { | ||
| return "saml_idp_generate_metadata"; | ||
| return "saml_metadata"; |
Contributor
There was a problem hiding this comment.
Tiny nit, our names typically end in _action.
TBH I don't know why - it's already obvious it's an action.
Contributor
Author
|
@elasticmachine update branch |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This change adds an API for generating SAML metadata for the
configured Identity Provider. All parameters that can contribute
to the metadata, from signing keys to Organization and contact
details are all configured in node settings.
The caller of the API needs to define the SP that will consume this
metadata as the values included can potentially be different,
depending on the registered SP configuration and the IDP policy.
This doesn't actually really depend, but builds upon #52018 to reduce duplication of effort, so it should be reviewed once that is merged.