[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources/system/flows/admin: admin-abstract-beans.xml re...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Aug 22 12:40:58 2016
New Revision: 8341

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8341&view=rev
Log:
IDP-961 - Use of IdP's authentication flow to protect itself

https://issues.shibboleth.net/jira/browse/IDP-961

Support access control based on operation/resource.

Modified:
    trunk/idp-conf/src/main/resources/system/flows/admin/admin-abstract-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/admin/reload-metadata-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/admin/reload-service-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/admin/status-beans.xml

Modified: trunk/idp-conf/src/main/resources/system/flows/admin/admin-abstract-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/admin/admin-abstract-beans.xml?rev=8341&r1=8340&r2=8341&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/admin/admin-abstract-beans.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/admin/admin-abstract-beans.xml	Mon Aug 22 12:40:58 2016
@@ -67,13 +67,27 @@
         class="org.opensaml.profile.action.impl.CheckAccess" scope="prototype"
         p:httpServletRequest-ref="shibboleth.HttpServletRequest"
         p:accessControlService-ref="shibboleth.AccessControlService"
-        p:policyNameLookupStrategy-ref="DescriptorPolicyLookupStrategy" />
+        p:policyNameLookupStrategy-ref="DescriptorPolicyLookupStrategy"
+        p:operationLookupStrategy="#{getObject('shibboleth.AdminOperationLookupStrategy') ?: getObject('DefaultOperationLookupStrategy')}"
+        p:resourceLookupStrategy="#{getObject('shibboleth.AdminResourceLookupStrategy') ?: getObject('DefaultResourceLookupStrategy')}" />
 
     <bean id="DescriptorPolicyLookupStrategy"
         class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
         c:inClass="#{T(org.opensaml.profile.context.ProfileRequestContext)}"
         c:outputType="#{T(java.lang.String)}"
         c:expression="#input.getSubcontext(T(net.shibboleth.idp.profile.context.RelyingPartyContext)).getProfileConfig().getPolicyName()" />
+
+    <!-- Default operation/resource suppliers for access checks. -->
+    <bean id="DefaultOperationLookupStrategy" class="com.google.common.base.Functions" factory-method="constant">
+        <constructor-arg>
+            <null/>
+        </constructor-arg>
+    </bean>
+    <bean id="DefaultResourceLookupStrategy" class="com.google.common.base.Functions" factory-method="constant">
+        <constructor-arg>
+            <null/>
+        </constructor-arg>
+    </bean>
 
     <!-- Logging -->
 

Modified: trunk/idp-conf/src/main/resources/system/flows/admin/reload-metadata-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/admin/reload-metadata-beans.xml?rev=8341&r1=8340&r2=8341&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/admin/reload-metadata-beans.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/admin/reload-metadata-beans.xml	Mon Aug 22 12:40:58 2016
@@ -22,6 +22,20 @@
     <bean id="shibboleth.AdminProfileId" class="java.lang.String"
         c:_0="http://shibboleth.net/ns/profiles/reload-metadata" />
 
+    <!-- Default operation/resource suppliers for access checks. -->
+    
+    <bean id="shibboleth.AdminOperationLookupStrategy" class="com.google.common.base.Functions"
+        factory-method="constant" c:_0="reload" />
+        
+    <bean id="shibboleth.AdminResourceLookupStrategy"
+        class="net.shibboleth.idp.profile.context.navigate.SpringExpressionContextLookupFunction"
+        c:inClass="#{T(org.opensaml.profile.context.ProfileRequestContext)}"
+        c:outputType="#{T(java.lang.String)}"
+        c:expression="T(net.shibboleth.utilities.java.support.primitive.StringSupport).trimOrNull(#custom.getParameter(T(net.shibboleth.idp.saml.profile.impl.ReloadMetadata).RESOLVER_ID))"
+        p:customObject-ref="shibboleth.HttpServletRequest" />
+
+    <!-- Work beans. -->
+
     <bean id="ReloadMetadata"
         class="net.shibboleth.idp.saml.profile.impl.ReloadMetadata" scope="prototype"
         p:httpServletRequest-ref="shibboleth.HttpServletRequest"

Modified: trunk/idp-conf/src/main/resources/system/flows/admin/reload-service-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/admin/reload-service-beans.xml?rev=8341&r1=8340&r2=8341&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/admin/reload-service-beans.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/admin/reload-service-beans.xml	Mon Aug 22 12:40:58 2016
@@ -22,6 +22,20 @@
     <bean id="shibboleth.AdminProfileId" class="java.lang.String"

[... 41 lines stripped ...]