[java-identity-provider COMMIT] in /trunk: idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RemoteUserAuthS...

[noreply at shibboleth.net]

Author: scantor
Date: Mon May 18 15:50:38 2015
New Revision: 7521

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7521&view=rev
Log:
IDP-699 - extend RemoteUserAuthServlet with Java Subject and authnMethod features

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RemoteUserAuthServlet.java
    trunk/idp-conf/src/main/resources/conf/authn/external-authn-config.xml
    trunk/idp-conf/src/main/resources/conf/authn/remoteuser-authn-config.xml

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RemoteUserAuthServlet.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RemoteUserAuthServlet.java?rev=7521&r1=7520&r2=7521&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RemoteUserAuthServlet.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RemoteUserAuthServlet.java	Mon May 18 15:50:38 2015
@@ -18,33 +18,50 @@
 package net.shibboleth.idp.authn.impl;
 
 import java.io.IOException;
+import java.security.Principal;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.Enumeration;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import javax.security.auth.Subject;
 import javax.servlet.ServletConfig;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import net.shibboleth.idp.authn.AuthenticationFlowDescriptor;
 import net.shibboleth.idp.authn.ExternalAuthentication;
 import net.shibboleth.idp.authn.ExternalAuthenticationException;
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.authn.principal.UsernamePrincipal;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
+import org.opensaml.profile.context.ProfileRequestContext;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Predicates;
+import com.google.common.base.Strings;
 import com.google.common.collect.Collections2;
 
 /**
- * Extracts REMOTE_USER and places it in a request attribute to be used by the IdP's external authentication
+ * Extracts authentication information from the request and returns it via the IdP's external authentication
  * interface.
+ * 
+ * <p>Common usage allows for extraction of REMOTE_USER or a username from request attributes or headers.</p>
+ * 
+ * <p>More advanced features include the ability to directly consume a {@link Subject} from a request
+ * attribute (in which case it is returned sight unseen directly to the IdP as the external result)
+ * and the ability to check a header for strings containing authentication method identifiers which
+ * can be mapped back into custom {@link Principal} objects (in which case they are attached to a newly
+ * constructed {@link Subject} to return).</p>
  */
 public class RemoteUserAuthServlet extends HttpServlet {
 
@@ -56,9 +73,15 @@
 
     /** Init parameter controlling what attributes to check. */
     @Nonnull @NotEmpty private static final String CHECK_ATTRIBUTES_PARAM = "checkAttributes";
-    
+
     /** Init parameter controlling what headers to check. */
     @Nonnull @NotEmpty private static final String CHECK_HEADERS_PARAM = "checkHeaders";
+
+    /** Init parameter identifying an attribute to check for a Subject. */
+    @Nonnull @NotEmpty private static final String SUBJECT_ATTRIBUTE_PARAM = "subjectAttribute";
+
+    /** Init parameter identifying a header to check for one or more authentication method strings. */
+    @Nonnull @NotEmpty private static final String AUTHN_METHOD_HEADER_PARAM = "authnMethodHeader";
     
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(RemoteUserAuthServlet.class);
@@ -71,6 +94,12 @@
 
     /** List of request headers to check for an identity. */
     @Nonnull @NonnullElements private Collection<String> checkHeaders;
+    
+    /** Request attribute to check for a {@link Subject}. */
+    @Nullable @NotEmpty private String subjectAttribute;
+    
+    /** Header to check for authentication method strings. */
+    @Nullable @NotEmpty private String authnMethodHeader;
 
     /** Constructor. */
     public RemoteUserAuthServlet() {
@@ -106,6 +135,25 @@
         checkHeaders = new ArrayList<>(Collections2.filter(headers, Predicates.notNull()));
     }
     
+    /**
+     * Set the name of a request attribute to check for a {@link Subject}.
+     * 
+     * @param attribute request attribute name
+     */
+    public void setSubjectAttribute(@Nullable @NotEmpty final String attribute) {
+        subjectAttribute = StringSupport.trimOrNull(attribute);

[... 211 lines stripped ...]