[java-identity-provider COMMIT] /trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/i...

[noreply at shibboleth.net]

Author: putmanb
Date: Wed Oct 19 17:53:58 2016
New Revision: 8519

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8519&view=rev
Log:
IDP-1012: Delegation Liberty SSOS flow Assertion Subject C14N fails for transient NameIDs

Refactor to move NameID SPNameQualifier eval logic into default requester strategy function.

Modified:
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessDelegatedAssertion.java

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessDelegatedAssertion.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessDelegatedAssertion.java?rev=8519&r1=8518&r2=8519&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessDelegatedAssertion.java	(original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessDelegatedAssertion.java	Wed Oct 19 17:53:58 2016
@@ -21,17 +21,6 @@
 import javax.annotation.Nullable;
 import javax.security.auth.Subject;
 
-import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.idp.profile.context.navigate.RelyingPartyIdLookupFunction;
-import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
-import net.shibboleth.idp.saml.authn.principal.NameIDPrincipal;
-import net.shibboleth.utilities.java.support.annotation.Prototype;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.xml.SerializeSupport;
-
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.core.xml.util.XMLObjectSupport;
 import org.opensaml.profile.action.ActionSupport;
@@ -43,6 +32,16 @@
 import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Function;
+
+import net.shibboleth.idp.authn.AuthnEventIds;
+import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
+import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
+import net.shibboleth.idp.saml.authn.principal.NameIDPrincipal;
+import net.shibboleth.utilities.java.support.annotation.Prototype;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.xml.SerializeSupport;
 
 
 /**
@@ -85,7 +84,7 @@
      * Constructor.
      */
     public ProcessDelegatedAssertion() {
-        requesterLookupStrategy = new SAMLPresenterLookupFunction();
+        requesterLookupStrategy = new DefaultC14NRequesterLookupFunction();
         responderLookupStrategy = new ResponderIdLookupFunction();
         assertionTokenStrategy = new DelegatedAssertionLookupStrategy();
     }
@@ -175,22 +174,15 @@
         c14n.setSubject(subject);
         
         String requesterEntityID = null;
-        if (nameID.getSPNameQualifier() != null) {
-            requesterEntityID = nameID.getSPNameQualifier();
-            log.debug("Saw NameID SPNameQualifier: {}", requesterEntityID);
-        } else {
-            if (requesterLookupStrategy != null) {
-                requesterEntityID = requesterLookupStrategy.apply(profileRequestContext);
-                log.debug("Resolved SAML requester entityID from context: {}", requesterEntityID);
-            }
-        }
-        
+        if (requesterLookupStrategy != null) {
+            requesterEntityID = requesterLookupStrategy.apply(profileRequestContext);
+        }
         if (requesterEntityID != null) {
             log.debug("Resolved effective SAML requester entityID for Subject c14n: {}", requesterEntityID);
             c14n.setRequesterId(requesterEntityID);
         } else {
-            log.warn("Unable to determine effective SAML requester for c14n purposes, " 
-                    + "Subject c14n may fail, depending on NameID type");
+            log.warn("Unable to determine effective SAML requester for c14n, Subject c14n may fail, " 
+                    + "depending on NameID type");
         }
         
         if (responderLookupStrategy != null) {
@@ -200,23 +192,33 @@
     }
     
     /**
-     * Default strategy for resolving the SAML presenter entityID.
-     */
-    public static class SAMLPresenterLookupFunction implements Function<ProfileRequestContext, String> {
+     * Default strategy for resolving the requester entityID for SAML subject c14n.
+     */
+    public class DefaultC14NRequesterLookupFunction implements Function<ProfileRequestContext, String> {
 
         /** {@inheritDoc} */
         public String apply(final ProfileRequestContext input) {

[... 34 lines stripped ...]