[java-identity-provider COMMIT] /trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindi...

[noreply at shibboleth.net]

Author: scantor
Date: Wed Aug 20 00:02:01 2014
New Revision: 6447

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6447&view=rev
Log:
IDP-470 - redesign endpoint resolver handling of "implicitly trusted" endpoint criterion

Modified:
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java?rev=6447&r1=6446&r2=6447&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java (original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java Wed Aug 20 00:02:01 2014
@@ -32,6 +32,7 @@
 import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -58,7 +59,6 @@
 import org.opensaml.saml.criterion.BindingCriterion;
 import org.opensaml.saml.criterion.EndpointCriterion;
 import org.opensaml.saml.criterion.RoleDescriptorCriterion;
-import org.opensaml.saml.criterion.SignedRequestCriterion;
 import org.opensaml.saml.saml2.core.AuthnRequest;
 import org.opensaml.saml.saml2.metadata.AssertionConsumerService;
 import org.opensaml.saml.saml2.metadata.Endpoint;
@@ -140,6 +140,9 @@
     
     /** Optional metadata for use in endpoint derivation/validation. */
     @Nullable private SAMLMetadataContext mdContext;
+
+    /** Is the relying party "anonymous" in SAML terms? */
+    private boolean anonymous;
     
     /** Whether to bypass endpoint validation when message is signed. */
     private boolean skipValidationWhenSigned;
@@ -311,12 +314,18 @@
     /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+        
+        if (!super.doPreExecute(profileRequestContext)) {
+            return false;
+        }
+        
         if (profileRequestContext.getInboundMessageContext() != null) {
             inboundMessage = profileRequestContext.getInboundMessageContext().getMessage();
         }
         
         final RelyingPartyContext rpContext = relyingPartyContextLookupStrategy.apply(profileRequestContext);
         if (rpContext != null) {
+            anonymous = rpContext.isAnonymous();
             if (rpContext.getProfileConfig() != null
                     && rpContext.getProfileConfig() instanceof SAMLProfileConfiguration) {
                 final SAMLProfileConfiguration profileConfiguration =
@@ -339,8 +348,7 @@
         }
         
         mdContext = metadataContextLookupStrategy.apply(profileRequestContext);
-
-        return super.doPreExecute(profileRequestContext);
+        return true;
     }
 
 // Checkstyle: CyclomaticComplexity|MethodLength OFF
@@ -364,23 +372,17 @@
             log.warn("{} No outbound bindings are eligible for use", getLogPrefix());
             ActionSupport.buildEvent(profileRequestContext, SAMLEventIds.ENDPOINT_RESOLUTION_FAILED);
             return;
-        } else {
-            log.trace("{} Eligible outbound bindings: {}", getLogPrefix(), bindings);
-        }
+        }
+        
+        log.trace("{} Candidate outbound bindings: {}", getLogPrefix(), bindings);
         
         // Build criteria for the resolver.
-        final CriteriaSet criteria = new CriteriaSet(new EndpointCriterion(buildTemplateEndpoint()),
-                new BindingCriterion(bindings));
-        
+        final CriteriaSet criteria = new CriteriaSet(new BindingCriterion(bindings),
+                buildEndpointCriterion(bindings.get(0)));
         if (mdContext != null && mdContext.getRoleDescriptor() != null) {
             criteria.add(new RoleDescriptorCriterion(mdContext.getRoleDescriptor()));
         } else {
             log.debug("{} No metadata available for endpoint resolution", getLogPrefix());
-        }
-        
-        if (skipValidationWhenSigned && inboundMessage instanceof AuthnRequest
-                && ((AuthnRequest) inboundMessage).isSigned()) {
-            criteria.add(new SignedRequestCriterion());
         }
         
         // Attempt resolution.
@@ -481,11 +483,14 @@
     }
 
     /**
-     * Build a template Endpoint object to use as input criteria to the resolution process.
-     * 

[... 37 lines stripped ...]