[java-identity-provider COMMIT] in /trunk/idp-authn-impl/src: main/java/net/shibboleth/idp/authn/impl/ValidateUserAge...

[noreply at shibboleth.net]

Author: scantor
Date: Wed Jul 31 17:52:49 2013
New Revision: 4644

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=4644&view=rev
Log:
IDP-110: IP address authenticator

Added:
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ValidateUserAgentAddressTest.java   (with props)
Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUserAgentAddress.java

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUserAgentAddress.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUserAgentAddress.java?rev=4644&r1=4643&r2=4644&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUserAgentAddress.java (original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUserAgentAddress.java Wed Jul 31 17:52:49 2013
@@ -20,103 +20,152 @@
 import java.net.InetAddress;
 import java.util.Collection;
 import java.util.Collections;
-import java.util.List;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.ext.spring.webflow.Event;
-import net.shibboleth.ext.spring.webflow.Events;
 import net.shibboleth.idp.authn.AbstractAuthenticationAction;
 import net.shibboleth.idp.authn.AuthenticationException;
+import net.shibboleth.idp.authn.AuthenticationResult;
 import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.UsernamePrincipal;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.UserAgentContext;
-import net.shibboleth.idp.profile.ActionSupport;
 
-import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.context.ProfileRequestContext;
 
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.annotation.constraint.NullableElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.net.IPRange;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.springframework.webflow.execution.RequestContext;
 
 import com.google.common.base.Predicates;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.Iterables;
 
 /**
- * A stage that ensures that the user-agent address is within a given range and, if so acts as if the configured user
- * has been authenticated.
+ * An action that ensures that a user-agent address found within a {@link UserAgentContext}
+ * is within a given range and generates an {@link AuthenticationResult}.
+ *  
+ * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
+ * @event {@link AuthnEventIds#INVALID_AUTHN_CTX}
+ * @event {@link AuthnEventIds#NO_CREDENTIALS}
+ * @event {@link AuthnEventIds#INVALID_CREDENTIALS}
+ * @pre <pre>ProfileRequestContext.getSubcontext(AuthenticationContext.class, false).getAttemptedFlow() != null</pre>
+ * @post If AuthenticationContext.getSubcontext(UserAgentContext.class, false) != null, and the
+ * content of getAddress() satisfies a configured address range, an {@link AuthenticationResult} is
+ * saved to the {@link AuthenticationContext}.
  */
- at Events({
-        @Event(id = EventIds.PROCEED_EVENT_ID),
-        @Event(id = AuthnEventIds.INVALID_AUTHN_CTX,
-                description = "authentication context does not contain UserAgentAddressContext"),
-        @Event(id = AuthnEventIds.INVALID_CREDENTIALS, description = "user agent IP address not in allowed IP ranges")})
 public class ValidateUserAgentAddress extends AbstractAuthenticationAction {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(ValidateUserAgentAddress.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(ValidateUserAgentAddress.class);
 
-    /** The ID of the user to treat as authenticated by this stage. */
-    private final String authenticatedUser;
+    /** The ID of the subject to treat as authenticated by this action. */
+    @NonnullAfterInit @NotEmpty private String principalName;
 
     /** List of designated IP ranges. */
-    private final List<IPRange> designatedRanges;
+    @Nonnull @NonnullElements private Collection<IPRange> designatedRanges;
 
-    /** Whether the {@link #designatedRanges} should be treated as whitelist or a blacklist. */
-    private final boolean whitelistingIPRanges;
-
+    /** User Agent context containing address to evaluate. */

[... 156 lines stripped ...]