SAML2 Authentication Valve

This releases makes it possible to run the module with the latest version of Jahia authentication modules.

There are no functional changes in this module which was released solely for compatibility purposes.

Bug fixes

Fixed an issue introduced in v3.1.0 causing a conflict with distributed-sessions and unability to authenticate when the distributed-session module is active.

Environments currently running v3.1.0 are encouraged to upgrade to v3.1.1

Though not expected to be a breaking change, some classes that were previously incorrectly exported were made private as part of #150. In the very unlikely event that you were relying on those classes in another modules, you will need to adjust your code to only use the currently exposed interface (SAML2InfoProvider) or to package it as a module fragment.

Improvements

• Expose SAML2InfoProvider interface making it possible for a custom module to query specific SAML2 config values (in particular the callback URL) (#150)
• Improved error handling (#151, #152)

Bug fixes

• Fixed an issue with relaystate size causing warnings to be logged (#150)

Misc

• Bumped commons-beanutils version from 1.9.4 to 1.11.0 (#142)

Breaking Changes

URLs used in SAML have changed:

• The URL suffix to initiate the SAML Authentication process has changed from connectToSaml.do to connect.saml
• The URL suffix for the SAML callback has changed from samlCallback.do to callback.saml
• The URL suffix for SAML metadata has changed from saml2Metadata.do to metadata.saml 

A new siteKey query parameter (for example: *.connect.saml?siteKey={sitekey}) is now mandatory except if SAML is used on a URL with a configured, and unique, Jahia ServerName.

Migrate from SAML 2x

Search in your code, site and SAML configs, for occurences of the above-mentioned suffixes (connectToSaml.do, samlCallback.do, saml2Metadata.do) and replace them with their new value.

Ensure the siteKey parameter is present if the URL is not the same than Jahia ServerName for this site.

For example:

• If "mysite.sample.com" is the Jahia server name for the site "mysite", then the siteKey is not required and a URL such as https://mysite.sample.com/connect.saml can be used.
• If "mysite.sample.com" is NOT Jahia server name for the site "mysite", then the siteKey is required and a URL such as https://mysite.sample.com/connect.saml?siteKey=mysite can be used.

Improvements

• Added compatibility for SAML authentication for fully private website
• Made possible to use SAML suffixes on any URLs (including root), this was previously restricted to pages only
• Ensured the post-login redirect URL is valid according to Jahia redirect restrictions (https://academy.jahia.com/documentation/knowledge-base/setting-authorizedredirecthosts-in-jahia)

Improvements

• Made the module compatible with Jahia 8.2
• Updated versions of dependant libraries

Bug fixes

• Made callback actions available for POST requests

• Fixed an issue with caml2 callback url

• Upgraded xalan from 2.7.2 to 2.7.3
• Fixed issue with incorrect redirection path provided in the cookie

• Added the ability to extract profile information from SAML2 authentication and add those to Jahia user properties

• Added new field "server location" in the SAML settings

• Added dependency to jahia-authentication
• Added dependency to Joda-time 2.9.9
• Upgraded Pac4j from 3.2.0 to 4.5.4 
• Upgraded Open SAML from 3.2.0 to 3.4.6
• Upgraded Java-support from 7.1.1 to 7.5.2
• Upgraded Bouncy Castle from 1.53 to 1.70
• Upgraded Commons-codec from 1.9 to 1.15
• Upgraded Cryptacular from 1.2.1 to 1.2.4
• Upgraded Guava from 26.0 to 31.0.1
• Upgraded Xmlsec from 1.3.0 to 2.1.7
• Fixed issues with redirect URL by using server port

• Separated the authentication from the user creation (see Jahia Authentication module)
• Security review and fixes
• Fixed issue to not create duplicate users if LDAP is connected
• Improved the configuration (see this README for more details)
• Improved the error handling

• Fixed issue with user properties being overridden if already set

• Fixed issues with redirect URL by using server port

• Version compatible with Jahia 7.3