[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/conf/intercept/profile-intercept.xml idp-profi...

[noreply at shibboleth.net]

Author: scantor
Date: Sun Nov  2 22:33:05 2014
New Revision: 6823

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6823&view=rev
Log:
Add a predicate and example for enforcing attribute checks.

Added:
    trunk/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/SimpleAttributePredicate.java   (with props)
Modified:
    trunk/idp-conf/src/main/resources/conf/intercept/profile-intercept.xml
    trunk/idp-profile-api/pom.xml

Modified: trunk/idp-conf/src/main/resources/conf/intercept/profile-intercept.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/intercept/profile-intercept.xml?rev=6823&r1=6822&r2=6823&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/intercept/profile-intercept.xml (original)
+++ trunk/idp-conf/src/main/resources/conf/intercept/profile-intercept.xml Sun Nov  2 22:33:05 2014
@@ -32,9 +32,9 @@
     <!-- TODO Per relying party condition will be moved elsewhere.
     <bean id="shibboleth.consent.Condition" parent="shibboleth.Conditions.RelyingPartyId">
         <constructor-arg>
-            <util:list>
+            <list>
                 <value>https://sp.example.org</value>
-            </util:list>
+            </list>
         </constructor-arg>
     </bean>
     -->
@@ -65,8 +65,29 @@
         c:regex="^exampleAttribute.*$" />
      -->
 
-    <!-- Condition to evaluate to interrupt SSO flows to check the state of the transaction before allowing. -->
-    <!-- TODO: turn into legit predicate checking attributes -->
-    <bean id="shibboleth.context-check.Condition" class="com.google.common.base.Predicates" factory-method="alwaysTrue" />
+    <!--
+    Condition to evaluate to interrupt SSO flows to check the state of the transaction before allowing.
+    
+    Typically the flow itself will be activated based on configuration in relying-party.xml, and this controls
+    whether to proceed if the flow is activated.
+    -->
+    <bean id="shibboleth.context-check.Condition" parent="shibboleth.Conditions.AND">
+        <constructor-arg>
+            <list>
+                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidates="#{ 'https://sp.example.org' }" />
+                <bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate">
+                    <property name="attributeValueMap">
+                        <map>
+                            <entry key="eppn">
+                                <list>
+                                    <value>*</value>
+                                </list>
+                            </entry>
+                        </map>
+                    </property>
+                </bean>
+            </list>
+        </constructor-arg>
+    </bean>
 
 </beans>

Modified: trunk/idp-profile-api/pom.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-profile-api/pom.xml?rev=6823&r1=6822&r2=6823&view=diff
==============================================================================
--- trunk/idp-profile-api/pom.xml (original)
+++ trunk/idp-profile-api/pom.xml Sun Nov  2 22:33:05 2014
@@ -17,6 +17,12 @@
 
     <dependencies>
         <!-- Compile Dependencies -->
+        <dependency>
+            <groupId>${project.groupId}</groupId>
+            <artifactId>idp-attribute-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+
         <dependency>
             <groupId>${opensaml.groupId}</groupId>
             <artifactId>opensaml-profile-api</artifactId>