[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/system/conf/audit-system.xml idp-profile-impl/...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Sep 21 16:27:49 2015
New Revision: 7765

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7765&view=rev
Log:
IDP-779 - Disabled AttributeStatement yields Attribute List in Audit log

Modified:
    trunk/idp-conf/src/main/resources/system/conf/audit-system.xml
    trunk/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/AttributesAuditExtractor.java
    trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/IncludeAttributeStatementPredicate.java

Modified: trunk/idp-conf/src/main/resources/system/conf/audit-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/audit-system.xml?rev=7765&r1=7764&r2=7765&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/audit-system.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/conf/audit-system.xml	Mon Sep 21 16:27:49 2015
@@ -254,7 +254,11 @@
                     <key>
                         <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.ATTRIBUTES"/>
                     </key>
-                    <bean class="net.shibboleth.idp.profile.audit.impl.AttributesAuditExtractor" />
+                    <bean class="net.shibboleth.idp.profile.audit.impl.AttributesAuditExtractor">
+                        <property name="activationCondition">
+                            <bean class="net.shibboleth.idp.saml.profile.config.logic.IncludeAttributeStatementPredicate" />
+                        </property>
+                    </bean>
                 </entry>
                 <entry>
                     <key>
@@ -418,12 +422,6 @@
                             <ref bean="shibboleth.ChildLookup.SessionContext" />
                         </constructor-arg>
                     </bean>
-                </entry>
-                <entry>
-                    <key>
-                        <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.ATTRIBUTES"/>
-                    </key>
-                    <bean class="net.shibboleth.idp.profile.audit.impl.AttributesAuditExtractor" />
                 </entry>
             </map>
         </property>

Modified: trunk/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/AttributesAuditExtractor.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/AttributesAuditExtractor.java?rev=7765&r1=7764&r2=7765&view=diff
==============================================================================
--- trunk/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/AttributesAuditExtractor.java	(original)
+++ trunk/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/audit/impl/AttributesAuditExtractor.java	Mon Sep 21 16:27:49 2015
@@ -28,6 +28,7 @@
 
 import com.google.common.base.Function;
 import com.google.common.base.Functions;
+import com.google.common.base.Predicate;
 
 import net.shibboleth.idp.attribute.context.AttributeContext;
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
@@ -38,6 +39,9 @@
 
     /** Extract the unfiltered attribute list instead of the filtered list. */
     private boolean useUnfiltered;
+    
+    /** A predicate to control whether attributes should be extracted for logging. */
+    @Nullable private Predicate<ProfileRequestContext> activationCondition;
     
     /** Lookup strategy for AttributeContext to read from. */
     @Nonnull private final Function<ProfileRequestContext,AttributeContext> attributeContextLookupStrategy;
@@ -67,10 +71,27 @@
     public void setUseUnfiltered(final boolean flag) {
         useUnfiltered = flag;
     }
+    
+    /**
+     * Set a condition to evaluate to control whether attributes are extracted for logging.
+     * 
+     * <p>This is used primarily to prevent logging of attributes for profiles in which attributes
+     * may be resolved, but not actually disclosed to a relying party.</p> 
+     * 
+     * @param condition condition to evaluate
+     */
+    public void setActivationCondition(@Nullable final Predicate<ProfileRequestContext> condition) {
+        activationCondition = condition;
+    }
 
     /** {@inheritDoc} */
     @Override
     @Nullable public Collection<String> apply(@Nullable final ProfileRequestContext input) {
+        
+        if (activationCondition != null && !activationCondition.apply(input)) {
+            return Collections.emptyList();
+        }
+        
         final AttributeContext attributeCtx = attributeContextLookupStrategy.apply(input);
         if (attributeCtx != null) {
             return (useUnfiltered ? attributeCtx.getUnfilteredIdPAttributes()

Modified: trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/IncludeAttributeStatementPredicate.java

[... 18 lines stripped ...]