[java-identity-provider COMMIT] in /trunk: idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X500SubjectCano...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Nov 17 23:28:45 2014
New Revision: 6927

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6927&view=rev
Log:
IDP-115 - add subjectAltName override to c14n action, and wire up options

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X500SubjectCanonicalization.java
    trunk/idp-conf/src/main/resources/conf/c14n/x500-subject-c14n-config.xml
    trunk/idp-conf/src/main/resources/system/flows/c14n/x500-subject-c14n-beans.xml

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X500SubjectCanonicalization.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X500SubjectCanonicalization.java?rev=6927&r1=6926&r2=6927&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X500SubjectCanonicalization.java (original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X500SubjectCanonicalization.java Mon Nov 17 23:28:45 2014
@@ -17,6 +17,7 @@
 
 package net.shibboleth.idp.authn.impl;
 
+import java.security.cert.X509Certificate;
 import java.util.Collections;
 import java.util.Iterator;
 import java.util.List;
@@ -41,19 +42,25 @@
 import org.cryptacular.x509.dn.NameReader;
 import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.security.x509.X509Support;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Predicate;
+import com.google.common.base.Predicates;
+import com.google.common.collect.Collections2;
 import com.google.common.collect.Lists;
 
 /**
  * An action that operates on a {@link SubjectCanonicalizationContext} child of the current
  * {@link ProfileRequestContext}, and transforms the input {@link javax.security.auth.Subject}
- * into a principal name by searching for one and only one {@link X500Principal} custom principal.
+ * into a principal name by searching for one and only one {@link X509Certificate} public credential.
  * 
- * <p>A list of OIDs is used to locate an RDN to extract from the DN and use as the principal name
+ * <p>A list of OIDs is used to locate an RDN to extract from the Subject DN and use as the principal name
  * after applying the transforms from the base class.</p>
+ * 
+ * <p>Alternatively, a list of subjectAltName extension types may be specified, which takes precedence
+ * over the subject, if a match is found.</p>
  * 
  * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
  * @event {@link AuthnEventIds#INVALID_SUBJECT}
@@ -72,18 +79,34 @@
     /** Supplies logic for pre-execute test. */
     @Nonnull private final ActivationCondition embeddedPredicate;
     
+    /** subjectAltName types to search for. */
+    @Nonnull @NonnullElements private List<Integer> subjectAltNameTypes;
+    
     /** OIDs to search for. */
     @Nonnull @NonnullElements private List<String> objectIds;
     
-    /** The custom Principal to operate on. */
-    @Nullable private X500Principal x500Principal;
+    /** The certificate to operate on. */
+    @Nullable private X509Certificate certificate;
     
     /** Constructor. */
     public X500SubjectCanonicalization() {
         embeddedPredicate = new ActivationCondition();
+        subjectAltNameTypes = Collections.emptyList();
         objectIds = Collections.singletonList(CN_OID);
     }
-    
+
+    /**
+     * Set the subjectAltName types to search for, in order of preference.
+     * 
+     * @param types types to search for
+     */
+    public void setSubjectAltNameTypes(@Nonnull @NonnullElements final List<Integer> types) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        Constraint.isNotNull(types, "Type list cannot be null");
+        
+        subjectAltNameTypes = Lists.newArrayList(Collections2.filter(types, Predicates.notNull()));
+    }
+
     /**
      * Set the OIDs to search for, in order of preference.
      * 
@@ -103,7 +126,7 @@
             @Nonnull final SubjectCanonicalizationContext c14nContext) {
 
         if (embeddedPredicate.apply(profileRequestContext, c14nContext, true)) {
-            x500Principal = c14nContext.getSubject().getPrincipals(X500Principal.class).iterator().next();
+            certificate = c14nContext.getSubject().getPublicCredentials(X509Certificate.class).iterator().next();
             return super.doPreExecute(profileRequestContext, c14nContext);
         }
         
@@ -114,21 +137,43 @@
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext, 
             @Nonnull final SubjectCanonicalizationContext c14nContext) {
+
+        if (!subjectAltNameTypes.isEmpty()) {
+            log.debug("{} Searching for subjectAltName types ({})", getLogPrefix(), subjectAltNameTypes);
+            final List altnames = X509Support.getAltNames(certificate, subjectAltNameTypes.toArray(new Integer[0]));

[... 130 lines stripped ...]