[upki-fed:00803] Re: Filter Per SP (FPSP) $B$NF0:n$K4X$9$k(B$B<ALd(B

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[upki-fed:00803] Re: Filter Per SP (FPSP) $B$NF0:n$K4X$9$k(B$B
Subject: [upki-fed:00803] Re: Filter Per SP (FPSP) $B$NF0:n$K4X$9$k(B$B
Date: Mon, 24 Mar 2014 17:21:22 +0900
From: AIMOTO Norihito <xxxxxx@xxxxxxxxxxxxx>
$B7DXf5A=N(BITC$BK\It(B $B:Y@n$5$^(B

$B%*!<%W%s%=!<%9!&%=%j%e!<%7%g%s!&%F%/%N%m%8(B $BAjK\$G$9!#(B

$B:Y@n$5$^$N%Q%C%A$G!"LdBj$J$$$3$H$r3NG'$7$^$7$?!#(B
sendRedirect$B%a%=%C%I$r;HMQ$7$J$/$F$b!"(BuApprove.jp $B$KA+0\$7$^$;$s!#(B

$B;d$NAwIU$7$?;v>]BP1~$N%Q%C%A$G$O!"(BFPSP$B5qH];~$K(B LoginContext $B$rL58z$7$^$9!#(B
uApprove.jp $B$N%=!<%9$r3NG'$7$?$H$3$m!"(BLoginContext $B$,$N(BSP$B$r;H$($J$/$J$k(B
 (3) IdP $B$K%m%0%$%s$7$J$+$C$?>l9g$K!"(BSP $B$,;H$($J$/$J$k(B

(1) $B$NBP=h$H$7$F!"(BsendRedirect$B%a%=%C%I$r;HMQ$9$k$H$7$F$$$?$N$G$9$,(B
$B$=$N8e(B(2)$B$NBP=h$G!"(B(1)$B$NLdBj$b2r7h$7$F$*$j$^$7$?!#(B

$B%Q%C%A$rE,MQ$7$J$$>uBV$N(B FPSP $B$G$O!"(B(1)$B$N;v>]$,H/@8$9$k$H;W$$$^$9!#(B


> SP$B$KAw?.$5$l$J$$B0@-$r>r7o$K;H$&$3$H$O86M}E*$KFq$7$$$N$G$7$g$&$+!)(B
> $B!J(BShibboleth$B$NFbIt9=B$$O$h$/$o$+$C$F$$$J$$$N$@$1$l$I$b$J$s$H$J$/Fq$7$=(B
$B$&$J5$$,$7$^$9!K(B
$B$3$N4QE@$GD4$Y$?$3$H$,$J$$$?$a!"?=$7Lu$"$j$^$;$s$,;d$K$O$o$+$j$^$;$s!#(B


$B0J>e!"$h$m$7$/$*4j$$CW$7$^$9!#(B


(2014$BG/(B03$B7n(B24$BF|(B 16:06), Tatsumi Hosokawa wrote:
> $B%*!<%W%s%=!<%9!&%=%j%e!<%7%g%s!&%F%/%N%m%8(B $BAjK\MM(B
> 
> $B7DXf5A=N(BITC$BK\It$N:Y@n$G$9!#(B
> 
> $B;n$7$K!"(BdoError()$B$r;H$&$h$&$K%Q%C%A$r=q$-49$($F$_$?$N$G$9$,!J%Q%C%A$rE:IU$7$^$9!K!"(B
> $B$J$s$H!"EvJ}$NL\E*$H$7$FA4$/LdBj$J$$F0:n$r$7$F$7$^$$$^$7$?!#(B
> 
> 1. FPSP$B$G6X;_$5$l$?%5%$%H$X$N%"%/%;%9(B
> $B"*(B $B%(%i!<%a%C%;!<%8IU$-$N%(%i!<2hLL$,=P$F%"%/%;%9=PMh$J$$(B
> 
> 2. FPSP$B$G5v2D$5$l$?%5%$%H$X$N%"%/%;%9(B
> $B"*(B uApprove.jp$B$N2hLL$,I=<($5$l!">5G'8e$K%"%/%;%9$G$-$k(B
> 
> 3. FPSP$B$,@_Dj$5$l$F$$$J$$%5%$%H$X$N%"%/%;%9(B
> $B"*(B uApprove.jp$B$N2hLL$,I=<($5$l!">5G'8e$K%"%/%;%9$G$-$k(B
> 
> $B$H$J$C$F$7$^$$!"Hs>o$K%O%C%T!<$J$N$G$9$,!"2?$+;d$,4*0c$$$r$7$F$$$k$N$G$7$g$&$+!)(B
> 
> $B0lJ}!"$h$/FI$`$H(B
> https://meatwiki.nii.ac.jp/confluence/pages/viewpage.action?pageId=12158554
> $B$N2<$NJ}$K$bCf$G=q$$$F$"$j$^$9$,!"(B
> 
> $B!VCm0U#3!'>r7o$K;HMQ$G$-$k(B Attribute $B$OEv3:(BSP$B$KAw?.$5$l$k$b$N(B
> $B!J$D$^$j(B attribute-filter.xml $BEy$G%U%#%k%?$5$l$F$$$J$$$b$N!K$K8B$j$^$9!W(B
> 
> $B$H$$$&$N$O$J$+$J$+87$7$$@)8B$G$9$M!#(B
> $Br7o$K;H$$$?$$(BAffiliation$BDxEY$J$i9M$(J}$H$7$F%"%j$+$H$b;W$&$N$G$9$,!"(B
> $B!t(B gakuninScopedPersonalUniqueCode$B$H$+$@$H$$$/$i2?$G$bL5M}$G$9$h$M!#JXMx$=$&$G$9$,!#(B
> 
> SP$B$KAw?.$5$l$J$$B0@-$r>r7o$K;H$&$3$H$O86M}E*$KFq$7$$$N$G$7$g$&$+!)(B
> $B!J(BShibboleth$B$NFbIt9=B$$O$h$/$o$+$C$F$$$J$$$N$@$1$l$I$b$J$s$H$J$/Fq$7$=$&$J5$$,$7$^$9!K(B
> 
> $B:Y@n(B
> 
> (2014/03/24 14:31), AIMOTO Norihito wrote:
>> $B7DXf5A=N(BITC$BK\It(B $B:Y@n$5$^(B
>>
>> $B$*@$OC$K$J$C$F$*$j$^$9!#(B
>> $B%*!<%W%s%=!<%9!&%=%j%e!<%7%g%s!&%F%/%N%m%8(B $BAjK\$G$9!#(B
>>
>>> $B3:Ev$N=hM}$r9T$C$F$$$?(BdoError()$B$NBe$o$j$K(B
>> httpServletResponse.sendRedirect()$B$K$J$C$F$$$k$N$G!"(B
>>> $B$=$NDL$j$KF0:n$7$F$$$k$N$@$H;W$$$^$9$,!"$3$l$O2?$+M}M3$,$"$k$N$G$7$g$&$+!)(B
>> $B?=$7Lu$J$$$G$9!"K\;v>]$H$OJL7o$NItJ,$^$G4^$a$F$7$^$$$^$7$?!#(B
>> sendRedirect()$B$r8F$S=P$7$F$$$kM}M3$O2<5-$N$H$*$j$G$9!#(B
>>
>> uApprove.jp $B$H0l=o$K;HMQ$7$F$$$k>l9g$K8B$j$^$9$,(B
>> doError() $B$G$O(Bforward$B%a%=%C%I$N$?$a(B uApprove.jp $B$bF0:n$7$^$9!#(B
>> $B%f!<%6!<$N2hLLA+0\$H$7$F!"(BShibboleht IdP $B%m%0%$%s(B $B"*(B $BB0@-Aw?.F10U(B $B"*(B
>> $B%(%i!<2hLL(B $B$H$J$j!"%f!<%6!<$KIT?F@Z$G$9!#(B
>> $B$=$N$?$a$K(B sendRedirect$B%a%=%C%I$H$7$F(B FPSP $BF0:n;~$O(B
>> Shibboleht IdP $B%m%0%$%s(B $B"*(B $B%(%i!<2hLL(B $B$HA+0\$9$kL\E*$G$3$N$h$&$K$7$F$$$^$9!#(B
>>
>> $B0J>e!"$h$m$7$/$*4j$$CW$7$^$9!#(B
>>
>>
>>
>> (2014$BG/(B03$B7n(B24$BF|(B 13:11), Tatsumi Hosokawa wrote:
>>> $B%*!<%W%s%=!<%9!&%=%j%e!<%7%g%s!&%F%/%N%m%8(B $BAjK\MM(B
>>>
>>> $B7DXf5A=N(BITC$BK\It$N:Y@n$G$9!#(B
>>>
>>> $B5.=E$J>pJsM-$jFq$&$4$6$$$^$9!#%Q%C%A$rE,MQ$7$F$_$?$H$3$m!"LdBj$J$/%m%0%$%s$,2DG=$H$J$j$^$7$?!#(B
>>>
>>> $B$H$3$m$G0lJ}!"Aw?.5qH];~$N(Berror.jsp$B$N8F$S=P$7$G%(%i!<860x$,I=<($5$l$J$/$J$C$F$7$^$$$^$7$?!#(B
>>>
>>> $B3:Ev$N=hM}$r9T$C$F$$$?(BdoError()$B$NBe$o$j$K(BhttpServletResponse.sendRedirect()$B$K$J$C$F$$$k$N$G!"(B
>>> $B$=$NDL$j$KF0:n$7$F$$$k$N$@$H;W$$$^$9$,!"$3$l$O2?$+M}M3$,$"$k$N$G$7$g$&$+!)(B
>>>
>>> $B!t(B $B$?$H$($P!"C1$K(BHttpServletHelper.unbindLoginContext()$B$N8e$K!"(B
>>> $B!t(B doError()$B$r8F$S=P$7$?$j$9$k$o$1$K$O$$$+$J$$$N$G$7$g$&$+!)(B
>>>
>>> $B$h$m$7$/$*4j$$$7$^$9!#(B
>>>
>>> $B:Y@n(B
>>>
>>> (2014/03/24 11:52), AIMOTO Norihito wrote:
>>>> $B%*!<%W%s%=!<%9!&%=%j%e!<%7%g%s!&%F%/%N%m%8(B $BAjK\(B $B$H?=$7$^$9!#(B
>>>>
>>>> $B$3$l$O(B FPSP $B$N%P%0$@$H9M$($F$$$^$9!#(B
>>>>
>>>> $B!Z860x![(B
>>>> filter$B>r7o$,!"(B/profile/* $B$G$9$,$3$l$O3F(BSP$B$+$i$N(BSAML Request$B;~$K$bF0:n$7(B
>>>> $B$^$9!#(B
>>>> $B$3$N$H$-!"(BSP$B$N(BEntityID$B$J$I$rJ];}$7$F$$$k%;%C%7%g%s(B(_idp_authn_lc_key)$B$,(B
>>>> $BA02s$N(B
>>>> $B%"%/%;%9;~$N$^$^;D$C$F$$$k$?$a!"0JA0$N(BSP$B$X$N(BEntityID$B$X$N%"%/%;%9$H$7$F(B
>>>> FPSP$B$,H=Dj$7$F$7$^$$$^$9!#(B
>>>>
>>>> $B!ZBP:v![(B
>>>> FPSP$B$G(B"$B5qH](B"$B$7$?:]$K(B_idp_authn_lc_key$B$rGK4~$9$k$3$H$G;v>]$r2r>C$G$-$^$9!#(B
>>>> $B2<5-$N$h$&$J%3!<%I$rF~$l$k$3$H$GK\;v>]$r2r>C$G$-$k$3$H$r3NG'$7$^$7$?!#(B
>>>>               HttpServletHelper.unbindLoginContext(
>>>>                   HttpServletHelper.getStorageService(m_servletContext),
>>>> m_servletContext, httpServletRequest, httpServletResponse);
>>>>
>>>> $B!ZJdB-![(B
>>>> $B;d$,3NG'$7$?8B$j$G$9$,!"K\Mh5qH]$5$l$J$1$l$P$J$i$J$$%f!<%6!<$,5v2D$H$J$k(B
>>>> $B$H$$$&;v>]$OH/@8$7$^$;$s!#(B
>>>> $BG'>Z:Q$_$N>uBV$G$b!"!V(B(1) /idp/profile/SAML2/Redirect/SSO(SAML$B%j%/%(%9(B
>>>> $B%H(B)$B!W(B $B"*(B $B!V(B(2) /idp/AuthnEngine$B!W(B $B"*(B $B!V(B(3) /idp/profile/SAML2/Redirect
>>>> /SSO(SAML$B%l%9%]%s%9(B)$B!W$H(B
>>>> $BA+0\$7!"(B(1)$B$N(Bfilter(FPSP)$B$G$O0JA0$N(BEntityID$B$GH=Dj$5$l$^$9$,!"(B
>>>> $B$3$N%"%/%;%9$G(BSAML$B%j%/%(%9%H$r2r@O$5$l$?7k2L$,%;%C%7%g%s(B
>>>> (_idp_authn_lc_key)$B$KF~$j:FH/9T$5$l$k$?$a(B
>>>> (3)$B$N%"%/%;%9;~$K$O(B(1)$B$N(BSAML$B%j%/%(%9%H$NFbMF$G(BFPSP$B$OH=Dj$7$^$9!#(B
>>>> $B$h$C$F!VA02s$,5v2D!W!"!V:#2s$+5qH]!W$N%Q%?!<%s$G$O(B
>>>> $BA02s$NFbMF$GH=Dj$5$l$k$3$H$O$"$j$^$;$s$G$7$?!#(B
>>>>
>>>>
>>>> $B$3$N;v>]$H$OJL$K(B FPSP $B$rMxMQ$7$F$$$F!"$b$&(B1$B7o%P%0$H;W$o$l$k;v>]$,(B
>>>> $B$"$j$^$7$?$N$G9g$o$;$FJs9p$7$^$9!#(B
>>>>
>>>> $B!Z;v>]![(B
>>>> FPSP$B$GDj5A$5$l$?$$$k(BSP$B$K%"%/%;%9$7$F!"(BShibboleth IdP$B$N%m%0%$%s2hLL$rI=<(8e(B
>>>> Shibboleth IdP$B$K%m%0%$%s$7$J$+$C$?>l9g!"0J9_$I$N(BSP$B$G$b(BFPSP$B$G5qH]$H$J$k!#(B
>>>>
>>>> $B!Z:F8=uBV$G$b(B FPSP $B$,F0:n$7$F$7$^$&!#(B
>>>>
>>>> $B!ZBP:v![(B
>>>> FPSP$B$O(BShibboleth IdP$B$KL$%m%0%$%s>uBV$G$OF0:n$7$J$$$h$&$K$7$^$9!#(B
>>>> $B2<5-$N$h$&$J%3!<%I$rF~$l$k$3$H$GK\;v>]$r2r>C$G$-$k$3$H$r3NG'$7$^$7$?!#(B
>>>>        if (!loginCtx.isPrincipalAuthenticated()) {
>>>>            // $B$^$@%m%0%$%s$7$F$$$J$$>l9g$O%m%0%$%s=hM}$X(B
>>>>            filterChain.doFilter(servletRequest, servletResponse);
>>>>            return;
>>>>        }
>>>>
>>>> $B$3$N(B2$B7o$K4X$7$F$N%Q%C%A$rE:IUCW$7$^$9!#(B
>>>> $B;29M$K$7$F$$$?$@$1$l$P$H;W$$$^$9!#(B
>>>>
>>>> $B0J>e!"$h$m$7$/$*4j$$CW$7$^$9!#(B
>>>>
>>>>
>>>> (2014$BG/(B03$B7n(B24$BF|(B 10:22), Tatsumi Hosokawa wrote:
>>>>> $B7DXf5A=N(BITC$BK\It$N:Y@n$G$9!#(B
>>>>>
>>>>> $B8=:_!"(B
>>>>>
>>>>> https://meatwiki.nii.ac.jp/confluence/pages/viewpage.action?pageId=12158554
>>>>>
>>>>> $B$N(BFilter Per SP (FPSP)$B$r%F%9%H$7$F$*$j!"0l1~F0:n$O$9$k$h$&$K$J$C$?$N$G$9$,!"(B
>>>>> $B$3$l$GB0@-Aw?.$r0lC65qH]$5$l$?>l9g!"$=$l0J9_$=$NB>$N(BSP$B$K(BSSO$B$9$k:]$b!"(B
>>>>> $BA4$F5qH]$5$l$k$h$&$K$J$C$F$7$^$C$F$$$^$9!#(B
>>>>>
>>>>> $B%V%i%&%6$r:F5/F0$9$l$P$^$?B>%5!<%S%9$K$O%m%0%$%s$G$-$k$N$G$9$,!"(B
>>>>> $B$3$l$O$=$N$h$&$J;EMM$J$N$G$7$g$&$+!)(B
>>>>>
>>>>> $B8=:_$N(BSampleFilterPerSP_allow.xml$B$NFbMF$O!"(B
>>>>>
>>>>> <?xml version="1.0" encoding="UTF-8"?>
>>>>> <!DOCTYPE EntitiesDescriptor [
>>>>>       <!ELEMENT EntitiesDescriptor (EntityDescriptor+)>
>>>>>       <!ELEMENT EntityDescriptor   (Attribute+)>
>>>>>       <!ELEMENT Attribute          (#PCDATA)>
>>>>>
>>>>>       <!ATTLIST EntityDescriptor   entityID    CDATA #REQUIRED>
>>>>>       <!ATTLIST Attribute          attributeID CDATA #REQUIRED>
>>>>> ]>
>>>>>
>>>>> <EntitiesDescriptor>
>>>>>     <EntityDescriptor entityID="https://testsp1.itc.keio.ac.jp/shibboleth-sp">
>>>>>       <Attribute attributeID="eduPersonAffiliation">
>>>>>          student
>>>>>       </Attribute>
>>>>>     </EntityDescriptor>
>>>>> </EntitiesDescriptor>
>>>>>
>>>>> $B$H$J$C$F$*$j!"(B https://testsp1.itc.keio.ac.jp/ $B$X$N%m%0%$%s$O!"(B
>>>>> $B;d$N(BeduPersonAffiliation$B$,(Bstaff;member$B$J$N$G5q@d$5$l$^$9!#(B
>>>>>
>>>>> $B$3$3$^$G$O$$$$$N$G$9$,!"$=$N8eB>$N(BSP$B$K@\B3$9$k:]$b!"(B
>>>>>
>>>>> Deny you(xxxxxxxx@xxxxxxxxxx) login to Service Provider https://testsp1.itc.keio.ac.jp/shibboleth-sp
>>>>>
>>>>> $B$N%a%C%;!<%8$,%V%i%&%6$KI=<($5$l!"5q@d$5$l$F$7$^$$$^$9!#(B
>>>>> $B$3$3$G!"(Btestsp1.itc.keio.ac.jp$B$K%"%/%;%9$9$kA0$G$"$l$P!"(B
>>>>> $BB>$N%5!<%S%9$K$bLdBj$J$/%m%0%$%s$G$-$^$9!#(B
>>>>>
>>>>>
>>>>> idp-process.log$B$K$O2?$bI=<($5$l$J$$$N$G$9$,!"(Bcatalina.out$B$K$Ohttps://testsp1.itc.keio.ac.jp $B$K%"%/%;%9$7$?;~(B
>>>>>
>>>>> SampleFilterPerSP spEntityId = https://testsp1.itc.keio.ac.jp/shibboleth-sp
>>>>> SampleFilterPerSP don't match any attributes.
>>>>> SampleFilterPerSP   eduPersonAffiliation=member
>>>>> SampleFilterPerSP   eduPersonAffiliation=staff
>>>>> SampleFilterPerSP   eduPersonPrincipalName=xxxxxxxxxxx@xxxxxxxxxx
>>>>> SampleFilterPerSP   transientId=xxxxxxxxxxxx
>>>>>
>>>>> 2. $B$=$N8e(B https://security-learning.nii.ac.jp $B$K%"%/%;%9$7$?;~(B
>>>>>
>>>>> SampleFilterPerSP spEntityId = https://testsp1.itc.keio.ac.jp/shibboleth-sp
>>>>> SampleFilterPerSP don't match any attributes.
>>>>> SampleFilterPerSP   eduPersonAffiliation=member
>>>>> SampleFilterPerSP   eduPersonAffiliation=staff
>>>>> SampleFilterPerSP   eduPersonPrincipalName=xxxxxxxxxxx@xxxxxxxxxx
>>>>> SampleFilterPerSP   transientId=xxxxxxxxxxxx
>>>>>
>>>>> 3. $B%V%i%&%6$r:F5/F0$7$F(B https://security-learning.nii.ac.jp $B$K%"%/%;%9$7$?;~!JLdBj$J$/%m%0%$%s$G$-$^$9!K(B
>>>>> SampleFilterPerSP spEntityId = https://security-learning.nii.ac.jp/shibboleth-sp
>>>>> SampleFilterPerSP spEntityId = https://security-learning.nii.ac.jp/shibboleth-sp
>>>>>
>>>>>
>>>>> 1,2$B$N%(%i!<$OA4$/F10l$G$9!#$3$N$h$&$J>u67$J$N$G$9$,!"$I$J$?$+(BFPSP$B$rMxMQ$5$l$F$$$kJ}!"(B
>>>>> $B$3$l$,0[>o$JF0:n$J$N$+$I$&$+65$($F$$$?$@$1$^$9$G$7$g$&$+!)(B
>>>>>
>>>>> $B$h$m$7$/$*4j$$$7$^$9!#(B
>>>>>
>>>>
>>>
>>>
>>
>>
> 
>
Follow-Ups:
- [upki-fed:00804] Re: Filter Per SP (FPSP) $B$NF0:n$K4X$9$k(B$B
  - From: Tatsumi Hosokawa
References:

[upki-fed:00792] Filter Per SP (FPSP) $B$NF0:n$K4X$9$k
From: Tatsumi Hosokawa

[upki-fed:00795] Re: Filter Per SP (FPSP) $B$NF0:n$K4X$9$k(B$B
From: AIMOTO Norihito

[upki-fed:00796] Re: Filter Per SP (FPSP) $B$NF0:n$K4X$9$k(B$B
From: Tatsumi Hosokawa

[upki-fed:00797] Re: Filter Per SP (FPSP) $B$NF0:n$K4X$9$k(B$B
From: AIMOTO Norihito

[upki-fed:00799] Re: Filter Per SP (FPSP) $B$NF0:n$K4X$9$k(B$B
From: Tatsumi Hosokawa
Previous by thread: [upki-fed:00799] Re: Filter Per SP (FPSP) $B$NF0:n$K4X$9$k(B$B
Next by thread: [upki-fed:00804] Re: Filter Per SP (FPSP) $B$NF0:n$K4X$9$k(B$B
Index(es):
- Date
- Thread