[java-identity-provider COMMIT] /trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/i...

[noreply at shibboleth.net]

Author: putmanb
Date: Tue Oct 20 21:11:16 2015
New Revision: 7842

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7842&view=rev
Log:
Some refactoring and cleanup.

Modified:
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessSAML20AssertionWSSToken.java

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessSAML20AssertionWSSToken.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessSAML20AssertionWSSToken.java?rev=7842&r1=7841&r2=7842&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessSAML20AssertionWSSToken.java	(original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessSAML20AssertionWSSToken.java	Tue Oct 20 21:11:16 2015
@@ -18,7 +18,6 @@
 package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
 
 import javax.annotation.Nonnull;
-
 import javax.annotation.Nullable;
 import javax.security.auth.Subject;
 
@@ -30,12 +29,12 @@
 import net.shibboleth.idp.saml.authn.principal.NameIDPrincipal;
 import net.shibboleth.idp.saml.saml2.profile.delegation.LibertySSOSContext;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.xml.SerializeSupport;
 
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.core.xml.util.XMLObjectSupport;
 import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.saml.saml2.core.NameID;
 import org.opensaml.saml.saml2.wssecurity.SAML20AssertionToken;
@@ -66,6 +65,9 @@
     /** Function used to obtain the responder ID. */
     @Nullable private Function<ProfileRequestContext,String> responderLookupStrategy;
     
+    /** Function used to resolve the assertion token to process. */
+    @Nonnull private Function<ProfileRequestContext, SAML20AssertionToken> assertionTokenStrategy;
+    
     /** The SAML 2 Assertion token being processed. */
     private SAML20AssertionToken assertionToken;
     
@@ -85,6 +87,18 @@
      * 
      * @param strategy lookup strategy
      */
+    public void setAssertionTokenStrategy(
+            @Nonnull final Function<ProfileRequestContext,SAML20AssertionToken> strategy) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+        assertionTokenStrategy = Constraint.isNotNull(strategy, "Assertion token strategy may not be null");
+    }
+    
+    /**
+     * Set the strategy used to locate the requester ID for canonicalization.
+     * 
+     * @param strategy lookup strategy
+     */
     public void setRequesterLookupStrategy(
             @Nullable final Function<ProfileRequestContext,String> strategy) {
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
@@ -108,21 +122,11 @@
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         
-        WSSecurityContext wssContext = 
-                profileRequestContext.getInboundMessageContext().getSubcontext(WSSecurityContext.class);
-        if (wssContext == null) {
-            log.info("{} No WSSecurityContext available within inbound message context", getLogPrefix());
-            ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
+        if (!super.doPreExecute(profileRequestContext)) {
             return false;
         }
         
-        // Just look for the first SAML20AssertionToken which is valid
-        // TODO factor out to function/predicate usage
-        for (Token token : wssContext.getTokens()) {
-            if (token.getValidationStatus().equals(ValidationStatus.VALID) && token instanceof SAML20AssertionToken) {
-                assertionToken = (SAML20AssertionToken) token;
-            }
-        }
+        assertionToken = assertionTokenStrategy.apply(profileRequestContext);
         
         if (assertionToken == null) {
             log.info("{} No valid SAML20AssertionToken available within inbound WSSecurityContext", getLogPrefix());
@@ -131,8 +135,6 @@
             return false;
         }
         
-        // TODO need to be able to handle EncryptedIDs. Earlier flow code will probably do the decryption
-        // Will it replace the EncryptedID in-place, or store in a context, etc?
         org.opensaml.saml.saml2.core.Subject samlSubject = assertionToken.getWrappedToken().getSubject();
         if (samlSubject == null || samlSubject.getNameID() == null) {
             log.info("{} SAML20AssertionToken does not contain either a Subject or a NameID", getLogPrefix());
@@ -179,4 +181,36 @@
         profileRequestContext.addSubcontext(c14n, true);
     }
     

[... 34 lines stripped ...]