[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-beans.xml...

[noreply at shibboleth.net]

Author: putmanb
Date: Sun Oct 25 21:00:53 2015
New Revision: 7877

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7877&view=rev
Log:
IDP-671: Port delegation configuration and policy control components

Add action which adds a shibdel:DelegationPolicy to the issued delegated Assertion.
Update Liberty policy eval action default strategy to pull the max token delegation chain length from the
shibdel:DelegationPolicy of the inbound token. 

Added:
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddDelegationPolicyToAssertion.java   (with props)
Modified:
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-flow.xml
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/EvaluateDelegationPolicy.java

Modified: trunk/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-beans.xml?rev=7877&r1=7876&r2=7877&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-beans.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-beans.xml	Sun Oct 25 21:00:53 2015
@@ -193,5 +193,11 @@
             </bean>
         </property>
     </bean>
+    
+    <bean id="AddDelegationPolicyToAssertion"
+        class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.AddDelegationPolicyToAssertion"
+        scope="prototype"
+        p:activationCondition-ref="shibboleth.Conditions.IssuingDelegatedAssertion">
+    </bean>
         
 </beans>

Modified: trunk/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-flow.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-flow.xml?rev=7877&r1=7876&r2=7877&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-flow.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-flow.xml	Sun Oct 25 21:00:53 2015
@@ -106,6 +106,7 @@
         <evaluate expression="AddChannelBindingsToAssertions" />
         <evaluate expression="AddGeneratedKeyToAssertions" />
         <evaluate expression="DecorateDelegatedAssertion" />
+        <evaluate expression="AddDelegationPolicyToAssertion" />
 
         <!-- Need access to unencrypted NameID and Assertion. -->
         <evaluate expression="PostAssertionPopulateAuditContext" />

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/EvaluateDelegationPolicy.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/EvaluateDelegationPolicy.java?rev=7877&r1=7876&r2=7877&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/EvaluateDelegationPolicy.java	(original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/EvaluateDelegationPolicy.java	Sun Oct 25 21:00:53 2015
@@ -17,6 +17,8 @@
 
 package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
 
+import java.util.List;
+
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
@@ -24,14 +26,17 @@
 import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
 import net.shibboleth.idp.saml.idwsf.profile.config.SSOSProfileConfiguration;
+import net.shibboleth.idp.saml.xmlobject.DelegationPolicy;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 
+import org.opensaml.core.xml.XMLObject;
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.saml.ext.saml2delrestrict.DelegationRestrictionType;
+import org.opensaml.saml.saml2.core.Advice;
 import org.opensaml.saml.saml2.core.Assertion;
 import org.opensaml.saml.saml2.core.Condition;
 import org.opensaml.saml.saml2.core.Conditions;
@@ -312,13 +317,26 @@
     
     /**
      * Default strategy used to resolve the policy maximum token delegation chain length.
+     * 
+     * <p>
+     * This strategy evaluates the extension element value
+     * {@link DelegationPolicy#getMaximumTokenDelegationChainLength()} present in the {@link Advice}
+     * of the presented {@link Assertion} token.
+     * </p>
      */
     public class PolicyMaxChainLengthStrategy implements Function<ProfileRequestContext, Long> {
 

[... 16 lines stripped ...]