[java-opensaml COMMIT] /trunk/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/CheckAccess.java

[noreply at shibboleth.net]

Author: scantor
Date: Mon Aug 22 12:04:33 2016
New Revision: 4476

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4476&view=rev
Log:
IDP-961 - Use of IdP's authentication flow to protect itself

https://issues.shibboleth.net/jira/browse/IDP-961

Further work on CheckAccess for generalization.

Modified:
    trunk/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/CheckAccess.java

Modified: trunk/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/CheckAccess.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/CheckAccess.java?rev=4476&r1=4475&r2=4476&view=diff
==============================================================================
--- trunk/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/CheckAccess.java	(original)
+++ trunk/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/CheckAccess.java	Mon Aug 22 12:04:33 2016
@@ -56,16 +56,18 @@
     
     /** Lookup strategy for policy to apply. */
     @Nonnull private Function<ProfileRequestContext,String> policyNameLookupStrategy;
+
+    /** Lookup strategy for operation. */
+    @Nonnull private Function<ProfileRequestContext,String> operationLookupStrategy;
     
-    /** Operation. */
-    @Nullable private String operation;
-
-    /** Resource. */
-    @Nullable private String resource;
+    /** Lookup strategy for resource. */
+    @Nonnull private Function<ProfileRequestContext,String> resourceLookupStrategy;
     
     /** Constructor. */
     public CheckAccess() {
         policyNameLookupStrategy = FunctionSupport.constant(null);
+        operationLookupStrategy = FunctionSupport.constant(null);
+        resourceLookupStrategy = FunctionSupport.constant(null);
     }
 
     /**
@@ -105,25 +107,51 @@
     }
 
     /**
+     * Set a lookup strategy to use to obtain the operation.
+     * 
+     * @param strategy  lookup strategy
+     * 
+     * @since 3.3.0
+     */
+    public void setOperationLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        operationLookupStrategy = Constraint.isNotNull(strategy, "Policy lookup strategy cannot be null");
+    }
+    
+    /**
      * Set operation.
      * 
      * @param op operation
      */
-    public void setOperation(@Nonnull final String op) {
+    public void setOperation(@Nullable final String op) {
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
         
-        operation = StringSupport.trimOrNull(op);
+        operationLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(op));
     }
 
+    /**
+     * Set a lookup strategy to use to obtain the resource.
+     * 
+     * @param strategy  lookup strategy
+     * 
+     * @since 3.3.0
+     */
+    public void setResourceLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        resourceLookupStrategy = Constraint.isNotNull(strategy, "Policy lookup strategy cannot be null");
+    }
+    
     /**
      * Set resource.
      * 
      * @param res resource
      */
-    public void setResource(@Nonnull final String res) {
+    public void setResource(@Nullable final String res) {
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
         
-        resource = StringSupport.trimOrNull(res);
+        resourceLookupStrategy = FunctionSupport.constant(StringSupport.trimOrNull(res));
     }
     
     /** {@inheritDoc} */
@@ -159,7 +187,9 @@
         if (policyName == null) {
             log.warn("{} No policy name returned by lookup strategy, disallowing access", getLogPrefix());
             ActionSupport.buildEvent(profileRequestContext, EventIds.ACCESS_DENIED);
-        } else if (!service.getInstance(policyName).checkAccess(getHttpServletRequest(), operation, resource)) {
+        } else if (!service.getInstance(policyName).checkAccess(
+                getHttpServletRequest(), operationLookupStrategy.apply(profileRequestContext),
+                resourceLookupStrategy.apply(profileRequestContext))) {
             ActionSupport.buildEvent(profileRequestContext, EventIds.ACCESS_DENIED);
         }
     }