[java-identity-provider COMMIT] in /trunk: idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/NameDecoderExcep...

[noreply at shibboleth.net]

Author: rdw
Date: Thu Jan 30 08:25:03 2014
New Revision: 5275

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=5275&view=rev
Log:
IDP-359 Distinguish between decoding errors and bad parameters once decoding has happened.  Add extra testing that the requester and responder match the values found (if at all) in the NameID or NameIdentifier

Added:
    trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/NameDecoderException.java   (with props)
Modified:
    trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/NameIdentifierDecoder.java
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/AbstractSAMLNameCanonicalization.java
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/CryptoTransientDecoder.java
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/NameIDCanonicalization.java
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/NameIdentifierCanonicalization.java
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/TransientDecoder.java
    trunk/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/impl/nameid/CryptoTransientDecoderTest.java
    trunk/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/impl/nameid/NameIDCanonicalizationTest.java
    trunk/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/impl/nameid/NameIdentifierCanonicalizationTest.java
    trunk/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/impl/nameid/TransientDecoderTest.java

Modified: trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/NameIdentifierDecoder.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/NameIdentifierDecoder.java?rev=5275&r1=5274&r2=5275&view=diff
==============================================================================
--- trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/NameIdentifierDecoder.java (original)
+++ trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/NameIdentifierDecoder.java Thu Jan 30 08:25:03 2014
@@ -38,9 +38,10 @@
      * @param responderId the entityID of the which issued (and is looking at and responding to) the value
      * @param requesterId the entityID of the which is providing the and which asking for information based on it.
      * @return the principal decoded from the value
-     * @throws SubjectCanonicalizationException if some preconditions failed or an error occurred during translation.
+     * @throws SubjectCanonicalizationException if match conditions failed.
+     * @throws NameDecoderException if an error occurred during translation.
      */
     @Nonnull public String decode(@Nonnull String value, @Nullable String responderId, @Nullable String requesterId)
-            throws SubjectCanonicalizationException;
+            throws SubjectCanonicalizationException, NameDecoderException;
 
 }

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/AbstractSAMLNameCanonicalization.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/AbstractSAMLNameCanonicalization.java?rev=5275&r1=5274&r2=5275&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/AbstractSAMLNameCanonicalization.java (original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/AbstractSAMLNameCanonicalization.java Thu Jan 30 08:25:03 2014
@@ -25,11 +25,16 @@
 import javax.annotation.Nonnull;
 
 import net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction;
+import net.shibboleth.idp.authn.AuthnEventIds;
+import net.shibboleth.idp.authn.SubjectCanonicalizationException;
+import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
 import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
 import net.shibboleth.utilities.java.support.collection.CollectionSupport;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.context.ProfileRequestContext;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -80,4 +85,79 @@
 
         formats = ImmutableSet.copyOf(newFormats);
     }
+
+    /**
+     * Check the format against the format list. If we are in the action then we log the error into the C14N context and
+     * add the appropriate event to the ProfileRequest context
+     * 
+     * @param format the format to check
+     * @param profileRequestContext the current profile request context
+     * @param c14nContext the current c14n context
+     * @param duringAction true iff the method is run from the action above
+     * @return true if the format matches.
+     */

[... 678 lines stripped ...]