{"action":"created","issue":{"url":"https://api.github.com/repos/UNINETT/mod_auth_mellon/issues/37","labels_url":"https://api.github.com/repos/UNINETT/mod_auth_mellon/issues/37/labels{/name}","comments_url":"https://api.github.com/repos/UNINETT/mod_auth_mellon/issues/37/comments","events_url":"https://api.github.com/repos/UNINETT/mod_auth_mellon/issues/37/events","html_url":"https://github.com/UNINETT/mod_auth_mellon/pull/37","id":93378381,"number":37,"title":"Add support for SAML ECP.","user":{"login":"jdennis","id":300306,"avatar_url":"https://avatars.githubusercontent.com/u/300306?v=3","gravatar_id":"","url":"https://api.github.com/users/jdennis","html_url":"https://github.com/jdennis","followers_url":"https://api.github.com/users/jdennis/followers","following_url":"https://api.github.com/users/jdennis/following{/other_user}","gists_url":"https://api.github.com/users/jdennis/gists{/gist_id}","starred_url":"https://api.github.com/users/jdennis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdennis/subscriptions","organizations_url":"https://api.github.com/users/jdennis/orgs","repos_url":"https://api.github.com/users/jdennis/repos","events_url":"https://api.github.com/users/jdennis/events{/privacy}","received_events_url":"https://api.github.com/users/jdennis/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-07-06T21:12:02Z","updated_at":"2015-07-14T00:06:52Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/UNINETT/mod_auth_mellon/pulls/37","html_url":"https://github.com/UNINETT/mod_auth_mellon/pull/37","diff_url":"https://github.com/UNINETT/mod_auth_mellon/pull/37.diff","patch_url":"https://github.com/UNINETT/mod_auth_mellon/pull/37.patch"},"body":"The modifications in this commit address the changes necessary to\r\nsupport the SP component of SAML ECP. The Lasso library needs\r\nadditional modifications before SAML ECP will be fully functional,\r\nthose fixes have been submitted to upstream Lasso, mod_auth_mellon\r\nwill continue to operate correctly without the Lasso upgrade, it just\r\nwon't properly support ECP without the Lasso fixes.\r\n\r\nBelow are the major logical changes in the commit and the rationale\r\nbehind them.\r\n\r\n* Allow compilation against older versions of Lasso by conditionally\r\n  compiling.\r\n\r\n  Add the following CPP symbols set by configure:\r\n\r\n  * HAVE_ECP\r\n  * HAVE_LASSO_UTILS_H\r\n\r\n* Add lasso_compat.h\r\n\r\n  If we can't include lasso utils.h than pull in our own\r\n  local definitions so we can use some of the valuable\r\n  utilities.\r\n\r\n* Add ECP specific documentation file\r\n\r\n  Documentation specific to ECP is now contained in ECP.rst\r\n  (using reStructuredText formatting). Information on general ECP\r\n  concepts, mod_auth_mellon user information, and internal\r\n  mod_auth_mellon coding issues are covered.\r\n\r\n* Add am_get_is_passive() utility\r\n\r\n  Add utilty to get the IsPassive flag so it can be called\r\n  from multiple places.\r\n\r\n* Add am_validate_paos_header() utility\r\n\r\n  This utility routine validates the PAOS HTTP header. It is used\r\n  in conjunction with am_header_has_media_type() to determine if a\r\n  client is ECP capable.\r\n\r\n* Add utility function am_header_has_media_type() to check if an HTTP\r\n  Accept header includes a specific media type. This is necessary\r\n  because the SP detects an ECP client by the presence of a\r\n  application/vnd.paos+xml media type in the Accept\r\n  header. Unfortunately neither Apache nor mod_auth_mellon already had\r\n  a function to check Accept media types so this was custom written\r\n  and added to mod_auth_mellon.\r\n\r\n* Add utility function am_get_assertion_consumer_service_by_binding()\r\n  because Lasso does not expose that in it's public API. It's\r\n  necessary to get the URL of the PAOS AssertionConsumerService.\r\n\r\n* Add MellonECPSendIDPList config option\r\n\r\n  This option controls whether to include a list of IDP's when\r\n  sending an ECP PAOS <AuthnRequest> message to an ECP client.\r\n\r\n* We need to do some bookkeeping during the processing of a\r\n  request. Some Apache modules call this \"adding a\r\n  note\". mod_auth_mellon was already doing this but because it only\r\n  needed to track one value (the cookie value) took a shortcut and\r\n  stuffed the cookie value into the per module request slot rather\r\n  than defining a struct that could hold a variety of per-request\r\n  values. To accommodate multiple per request bookkeeping values we\r\n  define a new struct, am_req_cfg_rec, that holds the previously used\r\n  cookie value and adds a new ECP specific value. This struct is now\r\n  the bookkeeping data item attached to each request. To support the\r\n  new am_req_cfg_rec struct the am_get_req_cfg macro was added (mirrors\r\n  the existing am_get_srv_cfg, am_get_mod_cfg and am_get_dir_cfg\r\n  macros). The am_create_request() Apache hook was added to\r\n  initialize the am_req_cfg_rec at the beginning of the request\r\n  pipeline.\r\n\r\n* A new endpoint was added to handle PAOS responses from the ECP\r\n  client. The endpoint is called \"paosResponse\" and lives along side\r\n  of the existing endpoints (e.g. postResponse, artifactResponse,\r\n  metadata, auth, logout, etc.). The new endpoint is handled by\r\n  am_handle_paos_reply(). The metadata generation implemented in\r\n  am_generate_metadata() was augmented to add the paosResponse\r\n  endpoint and bind it to the SAML2 PAOS binding.\r\n\r\n* am_handle_reply_common() was being called by am_handle_post_reply()\r\n  and am_handle_artifact_reply() because replies share a fair amount\r\n  of common logic. The new am_handle_paos_reply() also needs to\r\n  utilize the same common logic in am_handle_reply_common() but ECP\r\n  has slightly different behavior that has to be accounted for. With\r\n  ECP there is no SP generated cookie because the SP did not initiate\r\n  the process and has no state to track. Also the RelayState is\r\n  optional with ECP and is carried in the PAOS header as opposed to an\r\n  HTTP query/post parameter. The boolean flag is_paos was added as a\r\n  parameter to am_handle_reply_common() so as to be able to\r\n  distinguish between the PAOS and non-PAOS logic.\r\n\r\n* Add PAOS AssertionConsumerService to automatically generated metadata.\r\n  Note, am_get_assertion_consumer_service_by_binding() should be able\r\n  to locate this endpoint.\r\n\r\n* Refactor code to send <AuthnRequest>, now also supports PAOS\r\n\r\n  The creation and initialization of a LassoLogin object is different\r\n  for the ECP case. We want to share as much common code as possible,\r\n  the following refactoring was done to achieve that goal.\r\n\r\n  The function am_send_authn_request() was removed and it's logic\r\n  moved to am_init_authn_request_common(),\r\n  am_send_login_authn_request() and\r\n  am_set_authn_request_content(). This allows the logic used to create\r\n  and initialize a LassoLogin object to be shared between the PAOS and\r\n  non-PAOS cases. am_send_paos_authn_request() also calls\r\n  am_init_authn_request_common() and\r\n  am_set_authn_request_content(). The function\r\n  am_set_authn_request_content() replaces the logic at the end of\r\n  am_send_authn_request(), it is responsible for setting the HTTP\r\n  headers and body content based on the LassoLogin.\r\n\r\nSigned-off-by: John Dennis <jdennis@redhat.com>"},"comment":{"url":"https://api.github.com/repos/UNINETT/mod_auth_mellon/issues/comments/121095814","html_url":"https://github.com/UNINETT/mod_auth_mellon/pull/37#issuecomment-121095814","issue_url":"https://api.github.com/repos/UNINETT/mod_auth_mellon/issues/37","id":121095814,"user":{"login":"jdennis","id":300306,"avatar_url":"https://avatars.githubusercontent.com/u/300306?v=3","gravatar_id":"","url":"https://api.github.com/users/jdennis","html_url":"https://github.com/jdennis","followers_url":"https://api.github.com/users/jdennis/followers","following_url":"https://api.github.com/users/jdennis/following{/other_user}","gists_url":"https://api.github.com/users/jdennis/gists{/gist_id}","starred_url":"https://api.github.com/users/jdennis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdennis/subscriptions","organizations_url":"https://api.github.com/users/jdennis/orgs","repos_url":"https://api.github.com/users/jdennis/repos","events_url":"https://api.github.com/users/jdennis/events{/privacy}","received_events_url":"https://api.github.com/users/jdennis/received_events","type":"User","site_admin":false},"created_at":"2015-07-14T00:06:52Z","updated_at":"2015-07-14T00:06:52Z","body":"On 07/10/2015 05:49 AM, Olav Morken wrote:\n>\n> Hi,\n>\n> just want to let you know that I am leaving for my summer vacation in \n> a couple of hours, so I won't be able to follow up on this pull \n> request until the beginning of August.\n>\n>\n\nWishing you a wonderful summer vacation Olav. Enjoy!\n\nI have addressed each of your comments and made fixes (one commit per \nissue) that I've pushed to the ecp branch. Provided you're OK with the \nchanges my suggestion would be to squash everything into one commit for \nclarity. I updated the original commit message to reflect the review \nchanges but I can't amend the commit message without incurring a \nnon-fastforward error. I can send you the updated commit message when \nyou're ready.\n\nTalk to you when you get back, hopefully well rested.\n\nJohn\n\n"}}