[java-identity-provider COMMIT] in /trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl: nameid/LegacyCano...

[noreply at shibboleth.net]

Author: scantor
Date: Tue Mar 25 01:16:09 2014
New Revision: 5633

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=5633&view=rev
Log:
IDP-359 - add a policy predicate to SAML c14n actions, and lookup functions to access qualifiers from c14n context

Added:
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/logic/NameQualifierFromCanonicalizationContextFunction.java   (with props)
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/logic/SPNameQualifierFromCanonicalizationContextFunction.java   (with props)
Modified:
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/LegacyCanonicalization.java
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/NameIDCanonicalization.java
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/NameIdentifierCanonicalization.java

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/LegacyCanonicalization.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/LegacyCanonicalization.java?rev=5633&r1=5632&r2=5633&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/LegacyCanonicalization.java (original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/LegacyCanonicalization.java Tue Mar 25 01:16:09 2014
@@ -34,6 +34,7 @@
 import net.shibboleth.idp.saml.authn.principal.NameIdentifierPrincipal;
 import net.shibboleth.idp.service.ReloadableService;
 import net.shibboleth.idp.service.ServiceableComponent;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 
 import org.opensaml.profile.action.ActionSupport;
@@ -53,6 +54,12 @@
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(LegacyCanonicalization.class);
 
+    /**
+     * Predicate to validate {@link org.opensaml.saml.saml2.core.NameID} or
+     * {@link org.opensaml.saml.saml1.core.NameIdentifier} for permission to decode.
+     */
+    @Nullable private Predicate<ProfileRequestContext> nameIDPolicyPredicate;
+    
     /** Service used to get the resolver used to fetch attributes. */
     @Nonnull private final ReloadableService<AttributeResolver> attributeResolverService;
 
@@ -65,6 +72,30 @@
         attributeResolverService = Constraint.isNotNull(resolverService, "AttributeResolver cannot be null");
     }
 
+    /**
+     * Set a predicate used to evaluate the {@link org.opensaml.saml.saml2.core.NameID} or
+     * {@link org.opensaml.saml.saml1.core.NameIdentifier} to determine whether to proceed
+     * with the decoding process.
+     * 
+     * @param predicate predicate used to evaluate the identifier
+     */
+    public void setNameIDPolicyPredicate(@Nullable final Predicate<ProfileRequestContext> predicate) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        nameIDPolicyPredicate = predicate;
+    }
+
+    /** {@inheritDoc} */
+    @Override protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
+            @Nonnull final SubjectCanonicalizationContext c14nContext) throws SubjectCanonicalizationException {
+
+        if (nameIDPolicyPredicate != null && !nameIDPolicyPredicate.apply(profileRequestContext)) {
+            return false;
+        }
+        
+        return super.doPreExecute(profileRequestContext, c14nContext);
+    }
+    
     /** {@inheritDoc} */
     @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull final SubjectCanonicalizationContext c14nContext) throws SubjectCanonicalizationException {

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/NameIDCanonicalization.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/NameIDCanonicalization.java?rev=5633&r1=5632&r2=5633&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/NameIDCanonicalization.java (original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/nameid/NameIDCanonicalization.java Tue Mar 25 01:16:09 2014
@@ -64,6 +64,9 @@
     /** Supplies logic for pre-execute test. */
     @Nonnull private final ActivationCondition embeddedPredicate;
 
+    /** Predicate to validate {@link NameID} for permission to decode. */
+    @Nullable private Predicate<ProfileRequestContext> nameIDPolicyPredicate;
+    
     /** Supplies logic for decoding the {@link NameID} into a principal. */
     @NonnullAfterInit private NameIDDecoder decoder;
 
@@ -94,6 +97,18 @@
         decoder = Constraint.isNotNull(theDecoder, "Name ID decoder cannot be null");
     }

[... 81 lines stripped ...]