[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/system/conf/relying-party-system.xml idp-profi...

[noreply at shibboleth.net]

Author: scantor
Date: Tue Oct 11 22:01:21 2016
New Revision: 8487

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8487&view=rev
Log:
IDP-1049 - Profile setting to disallow RequestedAuthnContext in requests

https://issues.shibboleth.net/jira/browse/IDP-1049

Implemented with a semi-generic capability for blocking "features" using bitmasks.

Modified:
    trunk/idp-conf/src/main/resources/system/conf/relying-party-system.xml
    trunk/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/AbstractProfileConfiguration.java
    trunk/idp-profile-api/src/test/java/net/shibboleth/idp/profile/config/AbstractProfileConfigurationTest.java
    trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
    trunk/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
    trunk/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContextTest.java

Modified: trunk/idp-conf/src/main/resources/system/conf/relying-party-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/relying-party-system.xml?rev=8487&r1=8486&r2=8487&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/relying-party-system.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/conf/relying-party-system.xml	Tue Oct 11 22:01:21 2016
@@ -76,6 +76,9 @@
         p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration"
         p:inboundInterceptorFlows="security-policy/saml2-sso"
         p:encryptionOptionalPredicate="%{idp.encryption.optional:false}" />
+        
+    <util:constant id="SAML2.SSO.FEATURE_AUTHNCONTEXT"
+        static-field="net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration.FEATURE_AUTHNCONTEXT"/>
 
     <bean id="SAML2.ECP"
         class="net.shibboleth.idp.saml.saml2.profile.config.ECPProfileConfiguration"

Modified: trunk/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/AbstractProfileConfiguration.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/AbstractProfileConfiguration.java?rev=8487&r1=8486&r2=8487&view=diff
==============================================================================
--- trunk/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/AbstractProfileConfiguration.java	(original)
+++ trunk/idp-profile-api/src/main/java/net/shibboleth/idp/profile/config/AbstractProfileConfiguration.java	Tue Oct 11 22:01:21 2016
@@ -70,6 +70,12 @@
 
     /** The security configuration for this profile. */
     @Nullable private SecurityConfiguration securityConfiguration;
+    
+    /** Lookup function to return a bitmask of request features to disallow. */
+    @Nullable private Function<ProfileRequestContext,Integer> disallowedFeaturesLookupStrategy;
+    
+    /** Bitmask of request features to disallow. */
+    private int disallowedFeatures;
 
     /**
      * Constructor.
@@ -188,6 +194,54 @@
         outboundFlowsLookupStrategy = strategy;
     }
 
+    /**
+     * Return true iff the input feature constant is disallowed.
+     * 
+     * @param feature a bit constant
+     * 
+     * @return true iff the input feature constant is disallowed
+     * 
+     * @since 3.3.0
+     */
+    public boolean isFeatureDisallowed(final int feature) {
+        return (getDisallowedFeatures() & feature) == feature;
+    }
+    
+    /**
+     * Get a bitmask of disallowed features to block.
+     * 
+     * <p>Individual profiles define their own feature constants.</p>
+     * 
+     * @return bitmask of features to block
+     * 
+     * @since 3.3.0
+     */
+    public int getDisallowedFeatures() {
+        return getIndirectProperty(disallowedFeaturesLookupStrategy, disallowedFeatures);
+    }
+    
+    /**
+     * Set a bitmask of disallowed features to block.
+     * 
+     * @param mask a bitmask of features to block
+     * 
+     * @since 3.3.0
+     */
+    public void setDisallowedFeatures(final int mask) {
+        disallowedFeatures = mask;
+    }
+    
+    /**
+     * Set a lookup strategy for the bitmask of disallowed features to block. 
+     * 
+     * @param strategy lookup strategy
+     * 
+     * @since 3.3.0
+     */
+    public void setDisallowedFeaturesLookupStrategy(@Nullable final Function<ProfileRequestContext,Integer> strategy) {
+        disallowedFeaturesLookupStrategy = strategy;
+    }
+    
     /** {@inheritDoc} */
     @Override
     public int hashCode() {

Modified: trunk/idp-profile-api/src/test/java/net/shibboleth/idp/profile/config/AbstractProfileConfigurationTest.java

[... 306 lines stripped ...]