[java-identity-provider COMMIT] /trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePas...

[noreply at shibboleth.net]

Author: scantor
Date: Fri Feb 19 20:57:28 2016
New Revision: 8098

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8098&view=rev
Log:
IDP-925 - Dynamic determination of JAAS configuration and custom Principals

https://issues.shibboleth.net/jira/browse/IDP-925

Backward compatible way to configure or derive via Function a set of JAAS config name -> Principal collection mappings to apply.

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAAS.java

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAAS.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAAS.java?rev=8098&r1=8097&r2=8098&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAAS.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAAS.java	Fri Feb 19 20:57:28 2016
@@ -18,12 +18,14 @@
 package net.shibboleth.idp.authn.impl;
 
 import java.security.NoSuchAlgorithmException;
+import java.security.Principal;
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.Collections;
-import java.util.List;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
+import javax.security.auth.Subject;
 import javax.security.auth.callback.Callback;
 import javax.security.auth.callback.CallbackHandler;
 import javax.security.auth.callback.NameCallback;
@@ -37,15 +39,17 @@
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.collection.Pair;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
 import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+
+import com.google.common.base.Function;
 
 /**
  * An action that checks for a {@link UsernamePasswordContext} and directly produces an
@@ -74,12 +78,20 @@
     @Nullable private Configuration.Parameters loginConfigParameters;
     
     /** Application name(s) in JAAS configuration to use. */
-    @Nonnull @NonnullElements private List<String> loginConfigNames;
+    @Nonnull @NonnullElements private Collection< Pair< String,Collection<Principal> > > loginConfigurations;
+    
+    /** Strategy function to dynamically derive the login config name(s) to use. */
+    @Nullable
+    private Function< ProfileRequestContext,Collection< Pair< String,Collection<Principal> > > > loginConfigStrategy;
+    
+    /** Tracks any Principals derived from the login configuration to add to the Subject. */
+    @Nullable @NonnullElements private Collection<Principal> derivedPrincipals;
     
     /** Constructor. */
     public ValidateUsernamePasswordAgainstJAAS() {
         // For compatibility with V2.
-        loginConfigNames = Collections.singletonList("ShibUserPassAuth");
+        loginConfigurations = Collections.singletonList(
+                new Pair<String,Collection<Principal>>("ShibUserPassAuth", Collections.<Principal>emptyList()));
     }
     
     /**
@@ -96,7 +108,7 @@
      * 
      * @param type the type of JAAS configuration to use
      */
-    public void setLoginConfigType(@Nullable String type) {
+    public void setLoginConfigType(@Nullable final String type) {
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
         
         loginConfigType = StringSupport.trimOrNull(type);
@@ -116,7 +128,7 @@
      * 
      * @param params the JAAS configuration parameters to use
      */
-    public void setLoginConfigParameters(@Nullable Configuration.Parameters params) {
+    public void setLoginConfigParameters(@Nullable final Configuration.Parameters params) {
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
         
         loginConfigParameters = params;
@@ -127,15 +139,43 @@
      * 
      * @param names list of JAAS application names to use
      */
-    public void setLoginConfigNames(@Nonnull @NonnullElements @NotEmpty List<String> names) {
+    public void setLoginConfigurations(
+            @Nonnull @NonnullElements final Collection< Pair< String,Collection<Principal> > > names) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        Constraint.isNotNull(names, "Configuration list cannot be null");
+
+        loginConfigurations = new ArrayList<>(names);
+    }
+
+    /**

[... 117 lines stripped ...]