[java-identity-provider COMMIT] /trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/Populat...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Jun  2 11:41:07 2014
New Revision: 6023

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6023&view=rev
Log:
Add override when the requester specifically asks for NameID encryption.

Modified:
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java?rev=6023&r1=6022&r2=6023&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java (original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java Mon Jun  2 11:41:07 2014
@@ -27,12 +27,15 @@
 import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
 import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
 import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
 import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
 import org.opensaml.saml.criterion.EntityRoleCriterion;
 import org.opensaml.saml.criterion.ProtocolCriterion;
 import org.opensaml.saml.criterion.RoleDescriptorCriterion;
+import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.core.NameID;
 import org.opensaml.saml.saml2.profile.context.EncryptionContext;
 import org.opensaml.xmlsec.EncryptionConfiguration;
 import org.opensaml.xmlsec.EncryptionParameters;
@@ -55,6 +58,7 @@
 
 import org.opensaml.core.criterion.EntityIdCriterion;
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.messaging.context.navigate.MessageLookup;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -83,6 +87,9 @@
 
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(PopulateEncryptionParameters.class);
+
+    /** Strategy used to locate the {@link AuthnRequest} to operate on, if any. */
+    @Nonnull private Function<ProfileRequestContext,AuthnRequest> requestLookupStrategy;
     
     /** Strategy used to look up a {@link RelyingPartyContext} for configuration options. */
     @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
@@ -126,6 +133,9 @@
      * Initializes {@link #messageMetadataContextLookupStrategy} to {@link ChildContextLookup}.
      */
     public PopulateEncryptionParameters() {
+        
+        requestLookupStrategy =
+                Functions.compose(new MessageLookup<>(AuthnRequest.class), new InboundMessageContextLookup());
         
         relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
         
@@ -138,6 +148,17 @@
         peerContextLookupStrategy =
                 Functions.compose(new ChildContextLookup<>(SAMLPeerEntityContext.class),
                         new OutboundMessageContextLookup());
+    }
+    
+    /**
+     * Set the strategy used to locate the {@link AuthnRequest} to examine, if any.
+     * 
+     * @param strategy strategy used to locate the {@link AuthnRequest}
+     */
+    public void setRequestLookupStrategy(@Nonnull final Function<ProfileRequestContext,AuthnRequest> strategy) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+        requestLookupStrategy = Constraint.isNotNull(strategy, "AuthnRequest lookup strategy cannot be null");
     }
     
     /**
@@ -238,6 +259,7 @@
         }
     }
     
+// Checkstyle: CyclomaticComplexity OFF
     /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -258,16 +280,28 @@
         
         final SAML2ProfileConfiguration profileConfiguration = (SAML2ProfileConfiguration) rpContext.getProfileConfig();
         
+        final AuthnRequest request = requestLookupStrategy.apply(profileRequestContext);
+        if (request != null && request.getNameIDPolicy() != null) {
+            final String requestedFormat = request.getNameIDPolicy().getFormat();
+            if (requestedFormat != null && NameID.ENCRYPTED.equals(requestedFormat)) {
+                log.debug("{} Request asked for encrypted identifier, disregarding installed predicate");
+                encryptIdentifiers = true;
+            }
+        }
+
+        if (!encryptIdentifiers) {
+            encryptIdentifiers = profileConfiguration.getEncryptNameIDsPredicate().apply(profileRequestContext);
+            // Encryption can only be optional if the request didn't specify it above.

[... 25 lines stripped ...]