[java-identity-provider COMMIT] /trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/PopulateBindi...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Feb 17 23:04:56 2014
New Revision: 5391

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=5391&view=rev
Log:
IDP-372 - add signed request support

Modified:
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/PopulateBindingAndEndpointContexts.java

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/PopulateBindingAndEndpointContexts.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/PopulateBindingAndEndpointContexts.java?rev=5391&r1=5390&r2=5391&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/PopulateBindingAndEndpointContexts.java (original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/PopulateBindingAndEndpointContexts.java Mon Feb 17 23:04:56 2014
@@ -25,6 +25,8 @@
 import javax.xml.namespace.QName;
 
 import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.idp.relyingparty.RelyingPartyContext;
+import net.shibboleth.idp.saml.profile.config.saml2.BrowserSSOProfileConfiguration;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -41,6 +43,7 @@
 import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
+import org.opensaml.saml.common.SignableSAMLObject;
 import org.opensaml.saml.common.binding.BindingDescriptor;
 import org.opensaml.saml.common.binding.DefaultEndpointResolver;
 import org.opensaml.saml.common.binding.EndpointResolver;
@@ -53,10 +56,12 @@
 import org.opensaml.saml.criterion.BindingCriterion;
 import org.opensaml.saml.criterion.EndpointCriterion;
 import org.opensaml.saml.criterion.RoleDescriptorCriterion;
+import org.opensaml.saml.criterion.SignedRequestCriterion;
 import org.opensaml.saml.saml2.core.AuthnRequest;
 import org.opensaml.saml.saml2.metadata.AssertionConsumerService;
 import org.opensaml.saml.saml2.metadata.Endpoint;
 import org.opensaml.saml.saml2.metadata.IndexedEndpoint;
+import org.opensaml.xmlsec.signature.SignableXMLObject;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -98,6 +103,9 @@
     
     /** List of possible bindings, in preference order. */
     @Nonnull @NonnullElements private List<BindingDescriptor> bindingDescriptors;
+
+    /** Strategy function for access to {@link RelyingPartyContext}. */
+    @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
     
     /** Strategy function for access to {@link SAMLMetadataContext} for input to resolver. */
     @Nonnull private Function<ProfileRequestContext,SAMLMetadataContext> metadataContextLookupStrategy;
@@ -116,6 +124,8 @@
     
     /** Optional metadata for use in endpoint derivation/validation. */
     @Nullable private SAMLMetadataContext mdContext;
+    
+    private boolean skipValidationWhenSigned;
     
     /** Constructor. */
     public PopulateBindingAndEndpointContexts() {
@@ -123,6 +133,8 @@
         endpointResolver = new DefaultEndpointResolver();
         bindingDescriptors = Collections.emptyList();
         
+        relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
+        
         // Default: outbound msg context -> SAMLPeerEntityContext -> SAMLMetadataContext
         metadataContextLookupStrategy = Functions.compose(
                 new ChildContextLookup<>(SAMLMetadataContext.class),
@@ -172,6 +184,17 @@
         Constraint.isNotNull(bindings, "Binding descriptor list cannot be null");
         
         bindingDescriptors = Lists.newArrayList(Collections2.filter(bindings, Predicates.notNull()));
+    }
+
+    /**
+     * Set lookup strategy for {@link RelyingPartyContext}.
+     * 
+     * @param strategy  lookup strategy
+     */
+    public void setRelyingPartyContextLookupStrategy(
+            @Nonnull final Function<ProfileRequestContext,RelyingPartyContext> strategy) {
+        relyingPartyContextLookupStrategy = Constraint.isNotNull(strategy,
+                "RelyingPartyContext lookup strategy cannot be null");
     }
     
     /**
@@ -230,6 +253,13 @@
             inboundMessage = profileRequestContext.getInboundMessageContext().getMessage();
         }
         
+        final RelyingPartyContext rpContext = relyingPartyContextLookupStrategy.apply(profileRequestContext);
+        if (rpContext != null && rpContext.getProfileConfig() != null
+                && rpContext.getProfileConfig() instanceof BrowserSSOProfileConfiguration) {
+            skipValidationWhenSigned =
+                    ((BrowserSSOProfileConfiguration) rpContext.getProfileConfig()).skipEndpointValidationWhenSigned();
+        }
+        

[... 24 lines stripped ...]