[java-identity-provider COMMIT] /trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignAs...

[noreply at shibboleth.net]

Author: scantor
Date: Thu Feb  5 21:02:54 2015
New Revision: 7317

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7317&view=rev
Log:
IDP-595 - The WantAssertionsSigned SP metadata flag is not honored.

Modified:
    trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignAssertionsPredicate.java

Modified: trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignAssertionsPredicate.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignAssertionsPredicate.java?rev=7317&r1=7316&r2=7317&view=diff
==============================================================================
--- trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignAssertionsPredicate.java (original)
+++ trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignAssertionsPredicate.java Thu Feb  5 21:02:54 2015
@@ -17,21 +17,72 @@
 
 package net.shibboleth.idp.saml.profile.config.logic;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.idp.profile.config.ProfileConfiguration;
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
 import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
 import net.shibboleth.idp.saml.profile.config.SAMLProfileConfiguration;
+import net.shibboleth.idp.saml.profile.context.navigate.SAMLMetadataContextLookupFunction;
+import net.shibboleth.utilities.java.support.logic.Constraint;
 
 import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
+import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
+
+import com.google.common.base.Function;
 
 /** A predicate implementation that forwards to {@link SAMLProfileConfiguration#getSignAssertions()}. */
 public class SignAssertionsPredicate extends AbstractRelyingPartyPredicate {
 
+    /** Whether to override the result based on the WantAssertionsSigned flag in SAML metadata. */
+    private boolean honorMetadata;
+    
+    /** Lookup strategy for {@link SAMLMetadataContext}. */
+    private Function<ProfileRequestContext,SAMLMetadataContext> metadataContextLookupStrategy;
+    
+    /** Constructor. */
+    public SignAssertionsPredicate() {
+        honorMetadata = true;
+        metadataContextLookupStrategy = new SAMLMetadataContextLookupFunction();
+    }
+    
+    /**
+     * Set whether to override the result based on the WantAssertionsSigned flag in SAML metadata.
+     * 
+     * @param flag flag to set
+     */
+    public void setHonorMetadata(final boolean flag) {
+        honorMetadata = flag;
+    }
+    
+    /**
+     * Set lookup strategy for {@link SAMLMetadataContext}.
+     * 
+     * @param strategy lookup strategy
+     */
+    public void setMetadataContextLookupStrategy(
+            @Nonnull final Function<ProfileRequestContext,SAMLMetadataContext> strategy) {
+        metadataContextLookupStrategy = Constraint.isNotNull(strategy,
+                "SAMLMetadataContext lookup strategy cannot be null");
+    }
+    
     /** {@inheritDoc} */
     @Override
     public boolean apply(@Nullable final ProfileRequestContext input) {
+        
+        if (honorMetadata) {
+            final SAMLMetadataContext metadataCtx = metadataContextLookupStrategy.apply(input);
+            if (metadataCtx != null && metadataCtx.getRoleDescriptor() != null
+                    && metadataCtx.getRoleDescriptor() instanceof SPSSODescriptor) {
+                final Boolean flag = ((SPSSODescriptor) metadataCtx.getRoleDescriptor()).getWantAssertionsSigned();
+                if (flag != null && flag.booleanValue()) {
+                    return true;
+                }
+            }
+        }
+        
         final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
         if (rpc != null) {
             final ProfileConfiguration pc = rpc.getProfileConfig();