hazza/DSpace
1
0
Fork 0
mirror of https://github.com/DSpace/DSpace.git synced 2025-10-07 10:04:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix shibboleth redirect to work with all allowed origins

Browse Source
This commit is contained in:
Giuseppe Digilio
2020-09-17 10:49:55 +02:00
parent e24f924654
commit debf437ae7
2 changed files with 34 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
dspace-server-webapp/src/main/java/org/dspace/app/rest/ShibbolethRestController.java
View File

@@ -8,6 +8,7 @@
package org.dspace.app.rest;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Arrays;
import javax.servlet.http.HttpServletResponse;
@@ -62,8 +63,14 @@ public class ShibbolethRestController implements InitializingBean {
// Validate that the redirectURL matches either the server or UI hostname. It *cannot* be an arbitrary URL.
String redirectHostName = Utils.getHostName(redirectUrl);
String serverHostName = Utils.getHostName(configurationService.getProperty("dspace.server.url"));
String clientHostName = Utils.getHostName(configurationService.getProperty("dspace.ui.url"));
if (StringUtils.equalsAnyIgnoreCase(redirectHostName, serverHostName, clientHostName)) {
ArrayList<String> allowedHostNames = new ArrayList<String>();
allowedHostNames.add(serverHostName);
String[] allowedUrls = configurationService.getArrayProperty("rest.cors.allowed-origins");
for (String url : allowedUrls) {
allowedHostNames.add(Utils.getHostName(url));
}
if (StringUtils.equalsAnyIgnoreCase(redirectHostName, allowedHostNames.toArray(new String[0]))) {
log.debug("Shibboleth redirecting to " + redirectUrl);
response.sendRedirect(redirectUrl);
} else {

25
dspace-server-webapp/src/test/java/org/dspace/app/rest/ShibbolethRestControllerIT.java
View File

@@ -12,7 +12,10 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
import org.dspace.app.rest.test.AbstractControllerIntegrationTest;
import org.dspace.services.ConfigurationService;
import org.junit.Before;
import org.junit.Test;
import org.springframework.beans.factory.annotation.Autowired;
/**
* Integration test that cover ShibbolethRestController
@@ -21,6 +24,17 @@ import org.junit.Test;
*/
public class ShibbolethRestControllerIT extends AbstractControllerIntegrationTest {
@Autowired
ConfigurationService configurationService;
@Before
public void setup() throws Exception {
super.setUp();
configurationService.setProperty("rest.cors.allowed-origins",
"${dspace.ui.url}, http://anotherdspacehost:4000");
}
@Test
public void testRedirectToDefaultDspaceUrl() throws Exception {
String token = getAuthToken(eperson.getEmail(), password);
@@ -32,6 +46,7 @@ public class ShibbolethRestControllerIT extends AbstractControllerIntegrationTes
@Test
public void testRedirectToGivenTrustedUrl() throws Exception {
String token = getAuthToken(eperson.getEmail(), password);
getClient(token).perform(get("/api/authn/shibboleth")
@@ -40,6 +55,16 @@ public class ShibbolethRestControllerIT extends AbstractControllerIntegrationTes
.andExpect(redirectedUrl("http://localhost:8080/server/api/authn/status"));
}
@Test
public void testRedirectToAnotherGivenTrustedUrl() throws Exception {
String token = getAuthToken(eperson.getEmail(), password);
getClient(token).perform(get("/api/authn/shibboleth")
.param("redirectUrl", "http://anotherdspacehost:4000/home"))
.andExpect(status().is3xxRedirection())
.andExpect(redirectedUrl("http://anotherdspacehost:4000/home"));
}
@Test
public void testRedirectToGivenUntrustedUrl() throws Exception {
String token = getAuthToken(eperson.getEmail(), password);