[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/conf/audit.xml idp-conf/src/main/resources/sys...

[noreply at shibboleth.net]

Author: scantor
Date: Thu Nov  5 14:54:35 2015
New Revision: 7945

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7945&view=rev
Log:
IDP-840 - Addition of F-ticks support in the IdP

Starting point, added the hashed username field extractor and an FTICKS format, commented.

Modified:
    trunk/idp-conf/src/main/resources/conf/audit.xml
    trunk/idp-conf/src/main/resources/system/conf/audit-system.xml
    trunk/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPAuditFields.java

Modified: trunk/idp-conf/src/main/resources/conf/audit.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/audit.xml?rev=7945&r1=7944&r2=7945&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/audit.xml	(original)
+++ trunk/idp-conf/src/main/resources/conf/audit.xml	Thu Nov  5 14:54:35 2015
@@ -16,6 +16,10 @@
     -->
     <util:map id="shibboleth.AuditFormattingMap">
         <entry key="Shibboleth-Audit" value="%T|%b|%I|%SP|%P|%IDP|%bb|%III|%u|%ac|%attr|%n|%i|" />
+        <!--        
+        <entry key="Shibboleth-Audit-FTICKS"
+            value="F-TICKS/%{idp.fticks.federation:Undefined}/1.0#TS=%T#RP=%SP#AP=%IDP#PN=%HASHEDu#AM=%ac#" />
+        -->
     </util:map>
 
     <!-- Allows auditing to be disabled selectively for particular profiles/flows. -->

Modified: trunk/idp-conf/src/main/resources/system/conf/audit-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/audit-system.xml?rev=7945&r1=7944&r2=7945&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/audit-system.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/conf/audit-system.xml	Thu Nov  5 14:54:35 2015
@@ -10,6 +10,7 @@
 	   default-init-method="initialize"
        default-destroy-method="destroy">
     
+    <!-- Controls which profiles get audited. -->
     <bean id="shibboleth.ProfileAuditingCondition" class="com.google.common.base.Predicates" factory-method="not">
         <constructor-arg>
             <bean class="net.shibboleth.utilities.java.support.logic.StrategyIndirectedPredicate">
@@ -23,6 +24,24 @@
         </constructor-arg>
     </bean>
     
+    <!-- Reusable bean for extracting a username and hashing it for F-TICKS. -->
+    <bean id="shibboleth.UsernameHasher" class="com.google.common.base.Functions" factory-method="compose">
+        <constructor-arg name="g">
+            <bean class="net.shibboleth.utilities.java.support.codec.StringDigester"
+                c:algorithm="#{'%{idp.fticks.algorithm:SHA-256}'.trim()}" c:format="HEX_LOWER" p:salt="%{idp.fticks.salt:undefined}" />
+        </constructor-arg>
+        <constructor-arg name="f">
+            <bean class="com.google.common.base.Functions" factory-method="compose">
+                <constructor-arg name="g">
+                    <bean class="net.shibboleth.idp.authn.context.navigate.SubjectContextPrincipalLookupFunction" />
+                </constructor-arg>
+                <constructor-arg name="f">
+                    <ref bean="shibboleth.ChildLookup.SubjectContext" />
+                </constructor-arg>
+            </bean>
+        </constructor-arg>
+    </bean>
+    
     <!--
     The actual beans used are in user-space, but they inherit from the maps below. We have to use a
     MapFactoryBean instead of util:map because merging isn't supported by the util:map schema.
@@ -287,6 +306,12 @@
                 </entry>
                 <entry>
                     <key>
+                        <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.HASHED_USERNAME"/>
+                    </key>
+                    <ref bean="shibboleth.UsernameHasher" />
+                </entry>
+                <entry>
+                    <key>
                         <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.SESSION_ID"/>
                     </key>
                     <bean class="com.google.common.base.Functions" factory-method="compose">
@@ -463,6 +488,12 @@
                 </entry>
                 <entry>
                     <key>
+                        <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.HASHED_USERNAME"/>
+                    </key>
+                    <ref bean="shibboleth.UsernameHasher" />
+                </entry>
+                <entry>
+                    <key>
                         <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.SESSION_ID"/>
                     </key>
                     <bean class="com.google.common.base.Functions" factory-method="compose">
@@ -501,6 +532,12 @@
                     <bean class="com.google.common.base.Functions" factory-method="compose"
                         c:g-ref="shibboleth.PrincipalNameLookup.Subject"
                         c:f-ref="shibboleth.ChildLookup.SubjectContext" />
+                </entry>

[... 27 lines stripped ...]