[java-identity-provider COMMIT] in /trunk/idp-authn-impl/src: main/java/net/shibboleth/idp/authn/impl/ValidateUsernam...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Feb 22 14:52:19 2016
New Revision: 8100

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8100&view=rev
Log:
IDP-925 - Dynamic determination of JAAS configuration and custom Principals

https://issues.shibboleth.net/jira/browse/IDP-925

Some reworking of the interface, and adding in support for auto-eval of principal requirements to prevent deliberately breaking the IdP.

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAAS.java
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAASTest.java
    trunk/idp-authn-impl/src/test/resources/data/net/shibboleth/idp/authn/impl/jaas.config
    trunk/idp-authn-impl/src/test/resources/logback-test.xml

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAAS.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAAS.java?rev=8100&r1=8099&r2=8100&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAAS.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstJAAS.java	Mon Feb 22 14:52:19 2016
@@ -22,6 +22,7 @@
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.Set;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -37,6 +38,10 @@
 import net.shibboleth.idp.authn.AbstractUsernamePasswordValidationAction;
 import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
+import net.shibboleth.idp.authn.principal.PrincipalEvalPredicate;
+import net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactory;
+import net.shibboleth.idp.authn.principal.PrincipalSupportingComponent;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 import net.shibboleth.utilities.java.support.collection.Pair;
@@ -57,7 +62,9 @@
  * <p>Various optional properties are supported to control the JAAS configuration process.</p>
  *  
  * @event {@link org.opensaml.profile.action.EventIds#PROCEED_EVENT_ID}
+ * @event {@link AuthnEventIds#NO_CREDENTIALS}
  * @event {@link AuthnEventIds#INVALID_CREDENTIALS}
+ * @event {@link AuthnEventIds#REQUEST_UNSUPPORTED}
  * @pre <pre>ProfileRequestContext.getSubcontext(AuthenticationContext.class).getAttemptedFlow() != null</pre>
  * @post If AuthenticationContext.getSubcontext(UsernamePasswordContext.class) != null, then
  * an {@link net.shibboleth.idp.authn.AuthenticationResult} is saved to the {@link AuthenticationContext} on a
@@ -77,20 +84,22 @@
     @Nullable private Configuration.Parameters loginConfigParameters;
     
     /** Application name(s) in JAAS configuration to use. */
-    @Nonnull @NonnullElements private Collection< Pair< String,Collection<Principal> > > loginConfigurations;
-    
-    /** Strategy function to dynamically derive the login config name(s) to use. */
+    @Nonnull private Collection<Pair<String,Subject>> loginConfigurations;
+    
+    /** Strategy function to dynamically derive the login config(s) to use. */
     @Nullable
-    private Function< ProfileRequestContext,Collection< Pair< String,Collection<Principal> > > > loginConfigStrategy;
-    
-    /** Tracks any Principals derived from the login configuration to add to the Subject. */
-    @Nullable @NonnullElements private Collection<Principal> derivedPrincipals;
+    private Function<ProfileRequestContext,Collection<Pair<String,Subject>>> loginConfigStrategy;
+    
+    /** Saved off context. */
+    @Nullable private RequestedPrincipalContext requestedPrincipalCtx;
+    
+    /** Tracks any principals derived from the login configuration to add to the Subject. */
+    @Nullable private Subject derivedSubject;
     
     /** Constructor. */
     public ValidateUsernamePasswordAgainstJAAS() {
         // For compatibility with V2.
-        loginConfigurations = Collections.singletonList(
-                new Pair<String,Collection<Principal>>("ShibUserPassAuth", Collections.<Principal>emptyList()));
+        loginConfigurations = Collections.singletonList(new Pair<String,Subject>("ShibUserPassAuth", null));
     }
     
     /**
@@ -134,16 +143,28 @@
     }
 
     /**
-     * Set the JAAS application name(s) to use.
-     * 
-     * @param names list of JAAS application names to use
-     */
-    public void setLoginConfigurations(
-            @Nullable @NonnullElements final Collection< Pair< String,Collection<Principal> > > names) {
-        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
-        if (names != null) {

[... 397 lines stripped ...]