[java-identity-provider] branch master updated: Add metadata source to filtering context and to group policy rule.
Scott Cantor
cantor.2 at osu.edu
Thu Aug 3 11:46:03 EDT 2017
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=107637d99a507396cb305734f17247e91942ee98
The following commit(s) were added to refs/heads/master by this push:
new 107637d Add metadata source to filtering context and to group policy rule.
107637d is described below
commit 107637d99a507396cb305734f17247e91942ee98
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Aug 3 11:46:01 2017 -0400
Add metadata source to filtering context and to group policy rule.
---
.../filter/context/AttributeFilterContext.java | 36 +++++++++++++++++++---
.../AttributeRequesterInEntityGroupPolicyRule.java | 6 ++--
.../system/flows/cas/cas-abstract-beans.xml | 3 +-
.../system/flows/saml/saml-abstract-beans.xml | 3 +-
.../idp/profile/impl/FilterAttributes.java | 19 ++++++++++++
5 files changed, 58 insertions(+), 9 deletions(-)
diff --git a/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java b/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java
index 5d56b28..638ee3e 100644
--- a/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java
+++ b/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java
@@ -35,6 +35,7 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
import org.opensaml.messaging.context.BaseContext;
import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
+import org.opensaml.saml.metadata.resolver.MetadataResolver;
import com.google.common.base.Function;
import com.google.common.base.Predicates;
@@ -44,13 +45,16 @@ import com.google.common.base.Predicates;
public final class AttributeFilterContext extends BaseContext {
/** Attributes which are to be filtered. */
- private Map<String, IdPAttribute> prefilteredAttributes;
+ @Nonnull private Map<String, IdPAttribute> prefilteredAttributes;
/** Attributes which have been filtered. */
- private Map<String, IdPAttribute> filteredAttributes;
+ @Nonnull private Map<String, IdPAttribute> filteredAttributes;
+ /** Optional, supplemental metadata resolver. */
+ @Nullable private MetadataResolver metadataResolver;
+
/** The principal associated with the filtering. */
- private String principal;
+ @Nullable private String principal;
/** The attribute source identity. */
@Nullable private String attributeIssuerID;
@@ -123,13 +127,35 @@ public final class AttributeFilterContext extends BaseContext {
filteredAttributes.put(attribute.getId(), attribute);
}
}
+
+ /**
+ * Get supplemental source of metadata for filtering rules.
+ *
+ * @return metadata resolver
+ *
+ * @since 3.4.0
+ */
+ @Nullable public MetadataResolver getMetadataResolver() {
+ return metadataResolver;
+ }
+
+ /**
+ * Set supplemental source of metadata for filtering rules.
+ *
+ * @param resolver metadata resolver
+ *
+ * @since 3.4.0
+ */
+ public void setMetadataResolver(@Nullable final MetadataResolver resolver) {
+ metadataResolver = resolver;
+ }
/**
* Sets the principal associated with the filtering.
*
* @return Returns the principal.
*/
- public String getPrincipal() {
+ @Nullable public String getPrincipal() {
return principal;
}
@@ -138,7 +164,7 @@ public final class AttributeFilterContext extends BaseContext {
*
* @param who The principal to set.
*/
- public void setPrincipal(final String who) {
+ public void setPrincipal(@Nullable final String who) {
principal = who;
}
diff --git a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRule.java b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRule.java
index 9d898ff..ccb83e0 100644
--- a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRule.java
+++ b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRule.java
@@ -37,7 +37,8 @@ import org.slf4j.LoggerFactory;
import com.google.common.base.Predicate;
/**
- * A matcher that evaluates to true if attribute requester matches the provided entity group name.
+ * A matcher that evaluates to true if attribute requester matches the provided entity group name,
+ * or (as of 3.4.0) a valid metadata-sourced affiliation of entities.
*/
public class AttributeRequesterInEntityGroupPolicyRule extends AbstractPolicyRule {
@@ -101,7 +102,8 @@ public class AttributeRequesterInEntityGroupPolicyRule extends AbstractPolicyRul
return Tristate.FALSE;
}
- final Predicate<EntityDescriptor> predicate = new EntityGroupNamePredicate(Collections.singleton(entityGroup));
+ final Predicate<EntityDescriptor> predicate =
+ new EntityGroupNamePredicate(Collections.singleton(entityGroup), input.getMetadataResolver());
final EntityDescriptor entity = getEntityMetadata(input);
return predicate.apply(entity) ? Tristate.TRUE : Tristate.FALSE;
diff --git a/idp-conf/src/main/resources/system/flows/cas/cas-abstract-beans.xml b/idp-conf/src/main/resources/system/flows/cas/cas-abstract-beans.xml
index 3789bbf..dde939b 100644
--- a/idp-conf/src/main/resources/system/flows/cas/cas-abstract-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/cas/cas-abstract-beans.xml
@@ -81,7 +81,8 @@
class="net.shibboleth.idp.profile.impl.FilterAttributes"
scope="prototype"
c:filterService-ref="shibboleth.AttributeFilterService"
- p:maskFailures="%{idp.service.attribute.filter.maskFailures:true}">
+ p:maskFailures="%{idp.service.attribute.filter.maskFailures:true}"
+ p:metadataResolver-ref="shibboleth.MetadataResolver">
<property name="metadataContextLookupStrategy">
<bean class="net.shibboleth.idp.saml.profile.context.navigate.SAMLMetadataContextLookupFunction" />
</property>
diff --git a/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml b/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
index 1db0b9f..1c4a643 100644
--- a/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
@@ -230,7 +230,8 @@
<bean id="FilterAttributes" class="net.shibboleth.idp.profile.impl.FilterAttributes" scope="prototype"
c:filterService-ref="shibboleth.AttributeFilterService"
- p:maskFailures="%{idp.service.attribute.filter.maskFailures:true}" />
+ p:maskFailures="%{idp.service.attribute.filter.maskFailures:true}"
+ p:metadataResolver-ref="shibboleth.MetadataResolver" />
<bean id="FilterByQueriedAttributeDesignators"
class="net.shibboleth.idp.saml.saml1.profile.impl.FilterByQueriedAttributeDesignators" scope="prototype"
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java
index 45958e3..200b98c 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java
@@ -45,6 +45,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
+import org.opensaml.saml.metadata.resolver.MetadataResolver;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -68,6 +69,9 @@ public class FilterAttributes extends AbstractProfileAction {
/** Service used to get the engine used to filter attributes. */
@Nonnull private final ReloadableService<AttributeFilter> attributeFilterService;
+ /** Optional supplemental metadata source. */
+ @Nullable private MetadataResolver metadataResolver;
+
/** Strategy used to locate the identity of the issuer associated with the attribute filtering. */
@Nullable private Function<ProfileRequestContext,String> issuerLookupStrategy;
@@ -151,6 +155,19 @@ public class FilterAttributes extends AbstractProfileAction {
}
/**
+ * Set a metadata source to use during filtering.
+ *
+ * @param resolver metadata resolver
+ *
+ * @since 3.4.0
+ */
+ public void setMetadataResolver(@Nullable final MetadataResolver resolver) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ metadataResolver = resolver;
+ }
+
+ /**
* Set the strategy used to lookup the issuer for this attribute filtering.
*
* @param strategy lookup strategy
@@ -347,6 +364,8 @@ public class FilterAttributes extends AbstractProfileAction {
private void populateFilterContext(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AttributeFilterContext filterContext) {
+ filterContext.setMetadataResolver(metadataResolver);
+
filterContext.setPrincipal(principalNameLookupStrategy.apply(profileRequestContext));
filterContext.setPrincipalAuthenticationMethod(null);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list