2

私はForgeRockの人たちからこのOpenIGIdentityGatewayを試し、この場合はいくつかのレガシーシステムを統合しようとしています。特に、ArsDigitaやさまざまな機関のOpenACS+.LRNプロジェクトで使用しています。

問題は次のとおりです。セキュリティの問題を回避するために、OpenIGドキュメントにあるレシピを使用して非表示の値を抽出し、リクエストのCookieに応答すると、POSTリクエストが成功してシステムにログインしましたが、リクエスト後、OpenACSログに通知されます。最初の請願はhttp://10.10.10.10/register、実際のクライアントの請願ではなく、のようなものを要求http://openacs-domain.com/registerし、新しいログインを行うためにIP方向への302リダイレクトにブレークします。

/ etc / hostsを変更して、名前解決が成功しないかどうかを確認しました。

不思議なことに、最初のリクエストが行われたときにドメインに戻ると、有効な開始セッションがあり、すべてがクールです。

私は十分に説明的であり、誰かがこれに対する解決策を持っていることを願っています。config.jsonを添付します

    {
  "heap": {
    "objects": [
    {
        "name": "HandlerServlet",
        "comment": "Entry point that transforms Servlet request to handler request.",
        "type": "HandlerServlet",
        "config": {
            "handler": "DispatchHandler",
            "baseURI":"http://10.10.10.10"
        }
    },
    {      
        "name": "DispatchHandler",
        "type": "DispatchHandler",
        "config": {
            "bindings": [  
                {                      
                    "condition": "${exchange.request.uri.path == '/register/'}",
                    "handler": "LoginChain"
                },
                {                      
                    "handler": "OutgoingChain",
                },
            ]  
        }  
    },
    {
        "name": "LoginChain",
        "type": "Chain",
        "config": {
            "filters": ["SwitchFilter", "HiddenValueExtract"],
            "handler": "OutgoingChain"
        }  
    },
    {
        "name": "HiddenValueExtract",
        "type": "EntityExtractFilter",
        "config": {
            "messageType": "response",
            "target": "${exchange.hiddenValue}",
            "bindings": [
                {
                    "key": "time",
                    "pattern": "time\"\s.*value=\"(.{10})\"",
                    "template": "$1"
                },
                {
                    "key": "tokenId",
                    "pattern": "token_id\"\s.*value=\"(.{3})\"",
                    "template": "$1"
                },
                {
                    "key": "hash",
                    "pattern": "hash\"\s.*value=\"(.*)\"",
                    "template": "$1"
                }
            ]
        }       
    },
    {
        "name": "SwitchFilter",
        "type": "SwitchFilter",
        "config": {
            "onResponse": [
                {
                    "condition": "${exchange.response.status == 200}",
                    "handler": "LoginRequestHandler"
                }
            ]
        }
    },
    {
        "name": "LoginRequestHandler",
        "type": "Chain",
        "config": {
            "filters": ["LoginRequest"],
            "handler": "OutgoingChain"
        }  
    },
    {  
        "name": "LoginRequest",
        "type": "StaticRequestFilter",
        "config": {
            "method": "POST",
            "uri": "http://10.10.10.10/register/",
            "form": {
                "form:mode": ["edit"],
                "form:id": ["login"],
                "__confirmed_p": ["0"],
                "__refreshing_p": ["0"],
                "return_url": ["/dotlrn/control-panel"],
                "time": ["${exchange.hiddenValue.time}"],
                "token_id": ["${exchange.hiddenValue.tokenId}"],
                "hash": ["${exchange.hiddenValue.hash}"]
                "email": ["user.example@gmail.com"],
                "password": ["password"]
            }
            "headers": {
                "cookie": ["${exchange.response.headers['Set-Cookie'][0]}"],
            }  
        }  
    },
    {
        "name": "OutgoingChain",
        "type": "Chain",
        "config": {
            "filters": ["CaptureFilter"],
            "handler": "ClientHandler"
        }  
    },
    {  
        "name": "CaptureFilter",
        "type": "CaptureFilter",
        "config": {
            "captureEntity": false,
            "file": "/tmp/gateway.log",
        }      
    },
    {
        "name": "ClientHandler",
        "comment": "Responsible for sending all requests to remote servers.",
        "type": "ClientHandler",
        "config": {
            }
        }
    ]
  },
  "servletObject": "HandlerServlet",
}
4

1 に答える 1

2

これが最終バージョンです。

{


"heap": {
    "objects": [
    {
        "name": "LogSink",
        "comment": "Default sink for logging information.",
        "type": "ConsoleLogSink",
        "config": {
            "level": "DEBUG",
        }
    },
    {
        "name": "DispatchServlet",
        "type": "DispatchServlet",
        "config": {
            "bindings": [
                {
                    "pattern":"^/saml",
                    "object":"FederationServlet"
                },
                {
                    "pattern":"",
                    "object":"HandlerServlet"
                }
            ]
        }
    },
    {
        "name": "FederationServlet",
        "type": "org.forgerock.openig.saml.FederationServlet",
        "config": {
            "assertionMapping": {
                "userName":"mail",
                "password":"employeenumber"
            },
            "subjectMapping":"subjectName",
            "redirectURI":"/register",
            "logoutURI":"/register/logout"
         }
    },
    {
        "name": "HandlerServlet",
        "comment": "Entry point that transforms Servlet request to handler request.",
        "type": "HandlerServlet",
        "config": {
            "handler": "DispatchHandler",
            "baseURI":"http://www.plataformaciapem.org.mx"
        }
    },
    {      
        "name": "DispatchHandler",
        "type": "DispatchHandler",
        "config": {
            "bindings": [  
                {                      
                    "condition": "${exchange.request.uri.path != '/register/'}",
                    "handler": "ClientHandler"
                },
                {
                    "condition": "${empty exchange.session.userName}",
                    "handler": "SPInitiatedSSORedirectHandler",
                },
                {                      
                    "handler": "LoginChain",
                },
            ]  
        }  
    },
     {
        "name": "SPInitiatedSSORedirectHandler",
           "type": "StaticResponseHandler",
           "config": {
               "status": 302,
               "reason": "Found",
               "headers": {
                   "Location": ["http://www.plataformaciapem.org.mx/saml/SPInitiatedSSO"]
               }
           }
    },
    {
        "name": "LoginChain",
        "type": "Chain",
        "config": {
            "filters": ["SwitchFilter", "HiddenValueExtract"],
            "handler": "OutgoingChain"
        }  
    },
    {
        "name": "HiddenValueExtract",
        "type": "EntityExtractFilter",
        "config": {
            "messageType": "response",
            "target": "${exchange.hiddenValue}",
            "bindings": [
                {
                    "key": "time",
                    "pattern": "time\"\s.*value=\"(.{10})\"",
                    "template": "$1"
                },
                {
                    "key": "tokenId",
                    "pattern": "token_id\"\s.*value=\"(.{3})\"",
                    "template": "$1"
                },
                {
                    "key": "hash",
                    "pattern": "hash\"\s.*value=\"(.*)\"",
                    "template": "$1"
                }
            ]
        }       
    },
    {
        "name": "SwitchFilter",
        "type": "SwitchFilter",
        "config": {
            "onResponse": [
                {
                    "condition": "${exchange.response.status == 200}",
                    "handler": "LoginRequestHandler"
                }
            ]
        }
    },
    {
        "name": "LoginRequestHandler",
        "type": "Chain",
        "config": {
            "filters": ["LoginRequest"],
            "handler": "OutgoingChain"
        }  
    },
    {  
        "name": "LoginRequest",
        "type": "StaticRequestFilter",
        "config": {
            "method": "POST",
            "uri": "http://www.plataformaciapem.org.mx/register/",
            "form": {
                "form:mode": ["edit"],
                "form:id": ["login"],
                "__confirmed_p": ["0"],
                "__refreshing_p": ["0"],
                "return_url": ["/dotlrn/control-panel"],
                "time": ["${exchange.hiddenValue.time}"],
                "token_id": ["${exchange.hiddenValue.tokenId}"],
                "hash": ["${exchange.hiddenValue.hash}"]
                "email": ["${exchange.session.userName}"],
                "password": ["${exchange.session.password}"],
            }
            "headers": {
                "cookie": ["${exchange.response.headers['Set-Cookie'][0]}"],
            }  
        }  
    },
    {
        "name": "OutgoingChain",
        "type": "Chain",
        "config": {
            "filters": ["CaptureFilter"],
            "handler": "ClientHandler"
        }  
    },
    {  
        "name": "CaptureFilter",
        "type": "CaptureFilter",
        "config": {
            "captureEntity": false,
            "file": "/tmp/gateway.log",
        }      
    },
    {
        "name": "ClientHandler",
        "comment": "Responsible for sending all requests to remote servers.",
        "type": "ClientHandler",
        "config": {
            }
        }
    ]
  },
  "servletObject": "DispatchServlet",
}
于 2013-02-11T16:46:44.923 に答える