[java-metadata-aggregator] branch master updated: MDA-160 - optionally record removed entity attributes

Ian Young ian at iay.org.uk
Thu Jun 29 05:49:18 EDT 2017


This is an automated email from the git hooks/post-receive script.

iay pushed a commit to branch master
in repository java-metadata-aggregator.

View the commit online:
http://git.shibboleth.net/view/?p=java-metadata-aggregator.git;a=commit;h=037062a2eceddc52d95742e5883a136a6e4ca67d

The following commit(s) were added to refs/heads/master by this push:
       new  037062a   MDA-160 - optionally record removed entity attributes
037062a is described below

commit 037062a2eceddc52d95742e5883a136a6e4ca67d
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Thu Jun 29 10:49:07 2017 +0100

    MDA-160 - optionally record removed entity attributes
    
    Introduce new recordingRemovals property, enabling recording of removed
    entity attributes as WarningStatus instances.
---
 .../saml/mdattr/EntityAttributeFilteringStage.java | 46 +++++++++++++++++---
 .../mdattr/EntityAttributeFilteringStageTest.java  | 50 +++++++++++++++++++++-
 2 files changed, 89 insertions(+), 7 deletions(-)

diff --git a/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/saml/mdattr/EntityAttributeFilteringStage.java b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/saml/mdattr/EntityAttributeFilteringStage.java
index 845b45a..4b63bd7 100644
--- a/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/saml/mdattr/EntityAttributeFilteringStage.java
+++ b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/saml/mdattr/EntityAttributeFilteringStage.java
@@ -25,6 +25,7 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.metadata.Item;
+import net.shibboleth.metadata.WarningStatus;
 import net.shibboleth.metadata.dom.saml.SAMLMetadataSupport;
 import net.shibboleth.metadata.dom.saml.SAMLSupport;
 import net.shibboleth.metadata.dom.saml.mdrpi.RegistrationAuthority;
@@ -202,7 +203,10 @@ public class EntityAttributeFilteringStage extends BaseStage<Element> {
 
     /** Mode of operation: whitelisting or blacklisting. Default: whitelisting. */
     private boolean whitelisting = true;
-    
+
+    /** Whether we add status metadata to the item when entity attributes are removed. Default: no. */
+    private boolean recordingRemovals;
+
     /**
      * Sets the {@link List} of rules to be used to match attribute values.
      * 
@@ -247,7 +251,29 @@ public class EntityAttributeFilteringStage extends BaseStage<Element> {
     public boolean isWhitelisting() {
         return whitelisting;
     }
-    
+
+    /**
+     * Set whether to record removed entity attributes.
+     *
+     * @param newValue whether to remove recorded entity attributes
+     */
+    public void setRecordingRemovals(final boolean newValue) {
+        ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+        recordingRemovals = newValue;
+    }
+
+    /**
+     * Indicates whether the stage will record removed entity attributes.
+     *
+     * @return <code>true</code> if recording,
+     *         <code>false</code> if not (default)
+     */
+    public boolean isRecordingRemovals() {
+        return recordingRemovals;
+    }
+
     /**
      * Apply the rules to a context.
      * 
@@ -284,8 +310,10 @@ public class EntityAttributeFilteringStage extends BaseStage<Element> {
      * 
      * @param attribute an <code>Attribute</code> element to filter
      * @param registrationAuthority the registration authority associated with the entity
+     * @param item the {@link Item} representing the entity
      */
-    private void filterAttribute(@Nonnull final Element attribute, @Nullable final String registrationAuthority) {
+    private void filterAttribute(@Nonnull final Element attribute, @Nullable final String registrationAuthority,
+            @Nonnull final Item<Element> item) {
         // Determine the attribute's name; this will default to the empty string if not present
         final String attributeName = attribute.getAttribute("Name");
         
@@ -307,6 +335,10 @@ public class EntityAttributeFilteringStage extends BaseStage<Element> {
             final boolean matched = applyRules(ctx);
             if (matched ^ whitelisting) {
                 log.debug("removing {}", ctx);
+                if (recordingRemovals) {
+                    item.getItemMetadata().put(new WarningStatus(getId(),
+                            "removing '" + ctx.getName() + "' = '" + ctx.getValue() + "'"));
+                }
                 attribute.removeChild(value);
             }
         }
@@ -317,16 +349,18 @@ public class EntityAttributeFilteringStage extends BaseStage<Element> {
      * 
      * @param entityAttributes the <code>EntityAttributes</code> extension element
      * @param registrationAuthority the registration authority associated with the entity
+     * @param item the {@link Item} representing the entity
      */
     private void filterEntityAttributes(@Nonnull final Element entityAttributes,
-            @Nullable final String registrationAuthority) {
+            @Nullable final String registrationAuthority,
+            @Nonnull final Item<Element> item) {
         // Locate the Attribute elements to filter
         final List<Element> attributes =
                 ElementSupport.getChildElements(entityAttributes, SAMLSupport.ATTRIBUTE_NAME);
         
         // Filter each Attribute in turn
         for (final Element attribute : attributes) {
-            filterAttribute(attribute, registrationAuthority);
+            filterAttribute(attribute, registrationAuthority, item);
             
             // remove the Attribute container if it is now empty
             if (ElementSupport.getFirstChildElement(attribute) == null) {
@@ -351,7 +385,7 @@ public class EntityAttributeFilteringStage extends BaseStage<Element> {
              */
             for (final Element entityAttributes : SAMLMetadataSupport.getDescriptorExtensionList(entity,
                     MDAttrSupport.ENTITY_ATTRIBUTES_NAME)) {
-                filterEntityAttributes(entityAttributes, registrationAuthority);
+                filterEntityAttributes(entityAttributes, registrationAuthority, item);
                 
                 // remove the EntityAttributes container if it is now empty
                 if (ElementSupport.getFirstChildElement(entityAttributes) == null) {
diff --git a/aggregator-pipeline/src/test/java/net/shibboleth/metadata/dom/saml/mdattr/EntityAttributeFilteringStageTest.java b/aggregator-pipeline/src/test/java/net/shibboleth/metadata/dom/saml/mdattr/EntityAttributeFilteringStageTest.java
index 6ffbfc4..1251185 100644
--- a/aggregator-pipeline/src/test/java/net/shibboleth/metadata/dom/saml/mdattr/EntityAttributeFilteringStageTest.java
+++ b/aggregator-pipeline/src/test/java/net/shibboleth/metadata/dom/saml/mdattr/EntityAttributeFilteringStageTest.java
@@ -22,6 +22,7 @@ import java.util.ArrayList;
 import java.util.List;
 
 import net.shibboleth.metadata.Item;
+import net.shibboleth.metadata.WarningStatus;
 import net.shibboleth.metadata.dom.BaseDOMTest;
 import net.shibboleth.metadata.dom.DOMElementItem;
 import net.shibboleth.metadata.dom.saml.mdattr.EntityAttributeFilteringStage.ContextImpl;
@@ -243,8 +244,8 @@ public class EntityAttributeFilteringStageTest extends BaseDOMTest {
         final Element expected = readXMLData("multiout.xml");
         assertXMLIdentical(expected, result);
     }
-    @Test
 
+    @Test
     public void testMDA168_2() throws Exception {
         final List<Item<Element>> items = makeItems(readXMLData("multi2in.xml"));
         final List<Predicate<EntityAttributeContext>> rules = new ArrayList<>();
@@ -261,4 +262,51 @@ public class EntityAttributeFilteringStageTest extends BaseDOMTest {
         final Element expected = readXMLData("multi2out.xml");
         assertXMLIdentical(expected, result);
     }
+
+    // Tests for MDA-160 log removed entity attributes
+
+    @Test
+    public void testMDA160_1() throws Exception {
+        final List<Item<Element>> items = makeInputItems();
+
+        final List<Predicate<EntityAttributeContext>> rules = new ArrayList<>();
+        rules.add(new EntityCategoryMatcher("http://www.geant.net/uri/dataprotection-code-of-conduct/v1"));
+
+        final EntityAttributeFilteringStage stage = new EntityAttributeFilteringStage();
+        stage.setId("id");
+        stage.setRules(rules);
+        stage.setWhitelisting(false);
+        stage.initialize();
+        stage.execute(items);
+        stage.destroy();
+
+        // should be no warnings if we don't ask for them
+        final List<WarningStatus> result = items.get(0).getItemMetadata().get(WarningStatus.class);
+        Assert.assertEquals(result.size(), 0);
+    }
+
+    @Test
+    public void testMDA160_2() throws Exception {
+        final List<Item<Element>> items = makeInputItems();
+
+        final List<Predicate<EntityAttributeContext>> rules = new ArrayList<>();
+        rules.add(new EntityCategoryMatcher("http://www.geant.net/uri/dataprotection-code-of-conduct/v1"));
+
+        final EntityAttributeFilteringStage stage = new EntityAttributeFilteringStage();
+        stage.setId("id");
+        stage.setRules(rules);
+        stage.setRecordingRemovals(true);
+        stage.setWhitelisting(false);
+        stage.initialize();
+        stage.execute(items);
+        stage.destroy();
+
+        // should be one warning
+        final List<WarningStatus> result = items.get(0).getItemMetadata().get(WarningStatus.class);
+        Assert.assertEquals(result.size(), 1);
+        final WarningStatus warning = result.get(0);
+        Assert.assertEquals(warning.getComponentId(), "id");
+        Assert.assertEquals(warning.getStatusMessage(),
+                "removing 'http://macedir.org/entity-category' = 'http://www.geant.net/uri/dataprotection-code-of-conduct/v1'");
+    }
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list