Added callback-based request ID checking #581
Open
+180
−57
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…r own request ID check functions. This allows you to check IDs more carefully than you could with just an array - for example to do things like add timeouts to the validity of the auth id. For backward compatibility, I left the original functions in place. Also added an additional XML type for OAEP as current shibboleth returns a different type string old: http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p new: http://www.w3.org/2009/xmlenc11#rsa-oaep For backward compatibility, I left the original functions the same.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The main purpose of this PR is to add the ability to specify authorized IDs by passing in a checking function. This allows you to do more than just check that the ID is in a list - for example you can put expirations on the ID tokens.
For backward compatibility, I left the public-facing functions the same and added new ones with a 2 in the name, mostly because go doesn't support polymorphic function signatures.
The other small change I made was adding the ability to recognize the 2009 spec OAEP decryption that my current shibboleth feeds out. in the long run it might be better to allow users to specify allowed algorithms, if they wish.