org.forgerock / org.forgerock.openig

01 Dec, 2014

2 commits

28 Nov, 2014

9 commits

27 Nov, 2014

3 commits

26 Nov, 2014

1 commit

25 Nov, 2014

5 commits

24 Nov, 2014

1 commit

22 Nov, 2014

1 commit

21 Nov, 2014

3 commits

20 Nov, 2014

10 commits

  • 98574eb1   Placate checkstyle ... Browse Code » 
    git-svn-id: https://svn.forgerock.org/openig/trunk@741 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
    mark
     
  • f011fcf7   OPENIG-379 CR-5353 Improve logging when JWT sessions are using random keys and e… ... Browse Code » 
    …nsure that invalid JWT sessions are expired


git-svn-id: https://svn.forgerock.org/openig/trunk@740 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
    matthew
     
  • e323e6df   Remove LogTimer on the GatewayServlet ... Browse Code » 
    Timer values should always be obtained through `timer` decorations.

git-svn-id: https://svn.forgerock.org/openig/trunk@739 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
    guillaume.sauthier
     
  • 0503020c   CR-5343 OPENIG-381 Update doc for change to global decorator config ... Browse Code » 
    git-svn-id: https://svn.forgerock.org/openig/trunk@738 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
    mark
     
  • 13b2d660   CR-5327 OPENIG-365 Doc how to configure multiple SAML SPs ... Browse Code » 
    This patch adds an appendix
that briefly describes and demonstrates
how OpenIG as a SAML 2.0 SP can support more than one application.

For future consideration I have also opened some issues
that might make this easier:
OPENIG-397, but also OPENIG-399, OPENIG-400.

git-svn-id: https://svn.forgerock.org/openig/trunk@737 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
    mark
     
  • 6e866493   OPENIG-359 (CR-5294) Introduce Audit Framework ... Browse Code » 
    The audit framework is a new OpenIG API that gives to users a deeper view (and probably
a better understanding) of what's going on in the observed OpenIG system.

This is an initial version of the audit framework that only supports `Exchange` flow
observation: Filters and Handlers will send `AuditEvent` notifications both when an
Exchange enters or exists.

An `AuditEvent` is a notification that includes meta-information about the observed
component emitter of the notification (its `Name` in particular), a timestamp, the
exchange being captured and a set of tags that helps to qualify the event.

Four tags are supported out-of-the-box: `request`, `response`, `completed` and `exception`.
The user can add as many tags as wanted as part of the decoration configuration:

    "audit": "route-#1"  // add a single tag to the decorated component
    "audit": [ "super-tag", "route-#2" ] // add all of theses tags
    "audit": boolean, object, ... // any other format will be ignored

OpenIG provides a single `audit` decorator by default.

Consumers of AuditEvent are `AuditEventListener`, they have to provide their own Heaplet
implementation that extends `ConditionalListenerHeaplet`. They'll be automatically notified
of emitted AuditEvents and can (optionally) filter the received event using the `condition`
configuration attribute (condition is expressed as an `Expression` that needs to evaluate
to a boolean).

Examples of such event-filtering conditions:

    ${true}
    ${contains(tags, 'tag#1')}
    ${source.name.leaf == 'source'}

git-svn-id: https://svn.forgerock.org/openig/trunk@736 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
    guillaume.sauthier
     
  • 95f1d731   OPENIG-368 (CR-5326) Use exchange.originalUri in OAuth2ClientFilter ... Browse Code » 
    The Client filter heavily use the `exchange.request.uri` property to compute URIs.

That was causing issues because, in the set of upstream filters/handlers, someone
could have rebased the request URI (usually to globally 'redirect' the message
to the protected application). That was causing wrong URI computations (like an
OAuth2 `redirect_uri` with the hostname of the protected application, instead of
the user-facing one of OpenIG).

This changes fix this behaviour with the introduction of an immutable
`exchange.originalUri` property that is the original request URI, as received by the
web container.

The Client filter is now using this instead of the mutable one (`exchange.request.uri`).

Updated the Nascar page sample of the documentation to limit copy/paste errors.

git-svn-id: https://svn.forgerock.org/openig/trunk@735 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
    guillaume.sauthier
     
  • 19e1869d   OPENIG-326 - Revert previously introduced List as Set (no duplicate elements) ... Browse Code » 
    git-svn-id: https://svn.forgerock.org/openig/trunk@734 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
    violette
     
  • 82d70698   Modified error message from the OAuth2Utils#getScopes function as it is ... Browse Code » 
    only used by the Client Server and to uniformize the message with the
OAuth2ResourceFilter.

git-svn-id: https://svn.forgerock.org/openig/trunk@733 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
    violette
     
  • cef1488f   CR-5340 OPENIG-326 The OAuth2 ResourceServer scopes is now a list of ... Browse Code » 
    expressions.

OAuth2ResourceServerFilter.java
- Replaced 'Set<String> scopes' to 'List<Expression> scopes'.
- As the AccessToken defines scopes as Set<String>,
 added a new method to getScopes from List<Expression> to Set<String>.
- InsufficientScopeChallengeHandler is no longer a field of the
OAuth2ResourceServerFilter.
- Added realm attribute to the OAuth2ResourceServerFilter.

OAuth2ResourceServerFilterTest.java
- Fixed tests according to the above modifications.
- Added unit tests with expression evaluations.

man-OAuth2ResourceServerFilter.xml
- Modified doc according to Mark's patch.

git-svn-id: https://svn.forgerock.org/openig/trunk@732 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
    violette
     

19 Nov, 2014

3 commits

18 Nov, 2014

2 commits