[java-identity-provider] branch master updated: IDP-1256 - Add audit field indicating whether encryption was used

Scott Cantor cantor.2 at osu.edu
Thu Apr 5 22:14:51 EDT 2018


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=5f7b276269e7b4ccef54e338eed3315fd08009f6

The following commit(s) were added to refs/heads/master by this push:
       new  5f7b276   IDP-1256 - Add audit field indicating whether encryption was used
5f7b276 is described below

commit 5f7b276269e7b4ccef54e338eed3315fd08009f6
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Apr 5 22:14:46 2018 -0400

    IDP-1256 - Add audit field indicating whether encryption was used
    
    https://issues.shibboleth.net/jira/browse/IDP-1256
---
 idp-conf/src/main/resources/conf/audit.xml         |  2 +-
 .../main/resources/system/conf/audit-system.xml    | 25 +++++++
 .../profile/logic/SpringExpressionPredicate.java   | 80 ++--------------------
 .../idp/saml/profile/SAMLAuditFields.java          |  5 +-
 4 files changed, 37 insertions(+), 75 deletions(-)

diff --git a/idp-conf/src/main/resources/conf/audit.xml b/idp-conf/src/main/resources/conf/audit.xml
index d7e69f9..43f029d 100644
--- a/idp-conf/src/main/resources/conf/audit.xml
+++ b/idp-conf/src/main/resources/conf/audit.xml
@@ -15,7 +15,7 @@
     for compatibility with V2 audit logging.
     -->
     <util:map id="shibboleth.AuditFormattingMap">
-        <entry key="Shibboleth-Audit" value="%T|%b|%I|%SP|%P|%IDP|%bb|%III|%u|%ac|%attr|%n|%i|" />
+        <entry key="Shibboleth-Audit" value="%T|%b|%I|%SP|%P|%IDP|%bb|%III|%u|%ac|%attr|%n|%i|%X" />
     </util:map>
 
     <!-- Override the format of date/time fields in the log and/or convert to default time zone. -->
diff --git a/idp-conf/src/main/resources/system/conf/audit-system.xml b/idp-conf/src/main/resources/system/conf/audit-system.xml
index e5ec04d..2e19168 100644
--- a/idp-conf/src/main/resources/system/conf/audit-system.xml
+++ b/idp-conf/src/main/resources/system/conf/audit-system.xml
@@ -301,6 +301,31 @@
                         </constructor-arg>
                     </bean>
                 </entry>
+                <entry>
+                    <key>
+                        <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.ENCRYPTION"/>
+                    </key>
+                    <bean class="com.google.common.base.Functions" factory-method="compose">
+                        <constructor-arg name="g">
+                            <bean class="com.google.common.base.Functions" factory-method="forPredicate">
+                                <constructor-arg>
+			                        <bean class="net.shibboleth.ext.spring.util.SpringExpressionPredicate"
+			                            c:_0="#input != null and #input.getAssertionEncryptionParameters() != null" />
+			                    </constructor-arg>
+	                        </bean>
+                        </constructor-arg>
+                        <constructor-arg name="f">
+		                    <bean class="com.google.common.base.Functions" factory-method="compose">
+		                        <constructor-arg name="g">
+		                            <ref bean="shibboleth.ChildLookup.EncryptionParameters" />
+		                        </constructor-arg>
+		                        <constructor-arg name="f">
+		                            <ref bean="shibboleth.ChildLookup.RelyingParty" />
+		                        </constructor-arg>
+		                    </bean>
+                        </constructor-arg>
+                    </bean>
+                </entry>
             </map>
         </property>
     </bean>
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/SpringExpressionPredicate.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/SpringExpressionPredicate.java
index d83a4ea..1ec7150 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/SpringExpressionPredicate.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/SpringExpressionPredicate.java
@@ -22,41 +22,17 @@ import javax.annotation.Nullable;
 
 import net.shibboleth.utilities.java.support.annotation.ParameterName;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
 import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.expression.EvaluationException;
-import org.springframework.expression.ExpressionParser;
-import org.springframework.expression.ParseException;
-import org.springframework.expression.spel.standard.SpelExpressionParser;
-import org.springframework.expression.spel.support.StandardEvaluationContext;
-
-import com.google.common.base.Predicate;
+import org.springframework.expression.EvaluationContext;
 
 /**
  * Predicate whose condition is defined by an Spring EL expression.
  * 
  * @author Daniel Lutz
  */
-public class SpringExpressionPredicate implements Predicate<ProfileRequestContext<?,?>> {
-    
-    /** Class logger. */
-    @Nonnull private final Logger log = LoggerFactory.getLogger(SpringExpressionPredicate.class);
-
-    /** SpEL expression to evaluate. */
-    @Nullable private String springExpression;
-    
-    /** A custom object to inject into the expression context. */
-    @Nullable private Object customObject;
-
-    /** Whether to raise runtime exceptions if expression fails. */
-    private boolean hideExceptions;
-    
-    /** Value to return from predicate when an error occurs. */
-    private boolean returnOnError;
+public class SpringExpressionPredicate
+    extends net.shibboleth.ext.spring.util.SpringExpressionPredicate<ProfileRequestContext<?,?>> {
 
     /**
      * Constructor.
@@ -64,56 +40,14 @@ public class SpringExpressionPredicate implements Predicate<ProfileRequestContex
      * @param expression the expression to evaluate
      */
     public SpringExpressionPredicate(@Nonnull @NotEmpty @ParameterName(name="expression") final String expression) {
-        springExpression = Constraint.isNotNull(StringSupport.trimOrNull(expression),
-                "Expression cannot be null or empty");
-    }
-
-
-    /**
-     * Set a custom (externally provided) object.
-     * 
-     * @param object the custom object
-     */
-    public void setCustomObject(@Nullable final Object object) {
-        customObject = object;
-    }
-
-    /**
-     * Set whether to hide exceptions in expression execution (default is false).
-     * 
-     * @param flag flag to set
-     */
-    public void setHideExceptions(final boolean flag) {
-        hideExceptions = flag;
-    }
-
-    /**
-     * Set value to return if an error occurs (default is false).
-     * 
-     * @param flag flag to set
-     */
-    public void setReturnOnError(final boolean flag) {
-        returnOnError = flag;
+        super(expression);
     }
 
     /** {@inheritDoc} */
     @Override
-    public boolean apply(@Nullable final ProfileRequestContext<?,?> input) {
-
-        try {
-            final ExpressionParser parser = new SpelExpressionParser();
-            final StandardEvaluationContext context = new StandardEvaluationContext();
-            context.setVariable("custom", customObject);
-            context.setVariable("profileContext", input);
-            
-            return parser.parseExpression(springExpression).getValue(context, Boolean.class);
-        } catch (final ParseException|EvaluationException e) {
-            log.error("Error evaluating Spring expression", e);
-            if (hideExceptions) {
-                return returnOnError;
-            }
-            throw e;
-        }
+    protected void prepareContext(@Nonnull final EvaluationContext context,
+            @Nullable final ProfileRequestContext<?,?> input) {
+        context.setVariable("profileContext", input);
     }
 
 }
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
index 4eebea6..efa350a 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
@@ -91,7 +91,10 @@ public final class SAMLAuditFields {
 
     /** ForceAuthn requested field. */
     @Nonnull @NotEmpty public static final String FORCE_AUTHN = "fauth";
-    
+
+    /** Encryption field. */
+    @Nonnull @NotEmpty public static final String ENCRYPTION = "X";
+
     /** Constructor. */
     private SAMLAuditFields() {
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list