[java-identity-provider] branch master updated: Advanced attribute predicate that computes candidate values.
Scott Cantor
cantor.2 at osu.edu
Thu Aug 16 19:42:11 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=4f954262a8e267d748c7bdb892c3af7e295dafe2
The following commit(s) were added to refs/heads/master by this push:
new 4f95426 Advanced attribute predicate that computes candidate values.
4f95426 is described below
commit 4f954262a8e267d748c7bdb892c3af7e295dafe2
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Aug 16 19:42:06 2018 -0400
Advanced attribute predicate that computes candidate values.
---
.../profile/logic/AbstractAttributePredicate.java | 21 ++-
.../profile/logic/DynamicAttributePredicate.java | 173 +++++++++++++++++++++
2 files changed, 192 insertions(+), 2 deletions(-)
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/AbstractAttributePredicate.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/AbstractAttributePredicate.java
index c3cd39f..1fd7559 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/AbstractAttributePredicate.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/AbstractAttributePredicate.java
@@ -54,6 +54,15 @@ public abstract class AbstractAttributePredicate implements Predicate<ProfileReq
new ChildContextLookup<ProfileRequestContext,RelyingPartyContext>(RelyingPartyContext.class));
useUnfilteredAttributes = true;
}
+
+ /**
+ * Get the lookup strategy to use to locate the {@link AttributeContext}.
+ *
+ * @return lookup strategy to use
+ */
+ @Nonnull public Function<ProfileRequestContext,AttributeContext> getAttributeContextLookupStrategy() {
+ return attributeContextLookupStrategy;
+ }
/**
* Set the lookup strategy to use to locate the {@link AttributeContext}.
@@ -68,6 +77,15 @@ public abstract class AbstractAttributePredicate implements Predicate<ProfileReq
}
/**
+ * Get whether to source the input attributes from the unfiltered set.
+ *
+ * @return whether to source the input attributes from the unfiltered set
+ */
+ public boolean isUseUnfilteredAttributes() {
+ return useUnfilteredAttributes;
+ }
+
+ /**
* Set whether to source the input attributes from the unfiltered set.
*
* <p>Defaults to true.</p>
@@ -78,7 +96,6 @@ public abstract class AbstractAttributePredicate implements Predicate<ProfileReq
useUnfilteredAttributes = flag;
}
-
/** {@inheritDoc} */
@Override
public boolean apply(@Nullable final ProfileRequestContext input) {
@@ -108,7 +125,7 @@ public abstract class AbstractAttributePredicate implements Predicate<ProfileReq
protected boolean allowNullAttributeContext() {
return false;
}
-
+
/**
* Abstract implementation of the condition to evaluate.
*
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/DynamicAttributePredicate.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/DynamicAttributePredicate.java
new file mode 100644
index 0000000..dbea89f
--- /dev/null
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/DynamicAttributePredicate.java
@@ -0,0 +1,173 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.profile.logic;
+
+import com.google.common.base.Function;
+import com.google.common.base.Predicates;
+import com.google.common.collect.ArrayListMultimap;
+import com.google.common.collect.Collections2;
+import com.google.common.collect.ListMultimap;
+
+import net.shibboleth.idp.attribute.IdPAttribute;
+import net.shibboleth.idp.attribute.IdPAttributeValue;
+import net.shibboleth.idp.attribute.StringAttributeValue;
+import net.shibboleth.idp.attribute.context.AttributeContext;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import java.util.Collection;
+import java.util.Map;
+
+/**
+ * Predicate over an {@link AttributeContext} that derives the value(s) to match based
+ * on one or more supplied Functions instead of static values.
+ *
+ * @since 3.4.0
+ */
+public class DynamicAttributePredicate extends AbstractAttributePredicate {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(DynamicAttributePredicate.class);
+
+ /** Map of attribute IDs to functions. */
+ @Nonnull @NonnullElements private ListMultimap<String,Function<ProfileRequestContext,String>> attributeFunctionMap;
+
+ /** Constructor. */
+ public DynamicAttributePredicate() {
+ attributeFunctionMap = ArrayListMultimap.create();
+ }
+
+ /**
+ * Set the map of attribute/function pairs (as a map of function collections) to check for.
+ *
+ * @param map map of attribute/function pairs
+ */
+ public void setAttributeFunctionMap(
+ @Nonnull @NonnullElements final Map<String,Collection<Function<ProfileRequestContext,String>>> map) {
+ Constraint.isNotNull(map, "Attribute/value map cannot be null");
+
+ attributeFunctionMap.clear();
+ for (final Map.Entry<String,Collection<Function<ProfileRequestContext,String>>> entry : map.entrySet()) {
+ final String attributeId = StringSupport.trimOrNull(entry.getKey());
+ attributeFunctionMap.putAll(attributeId, Collections2.filter(entry.getValue(), Predicates.notNull()));
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean apply(@Nullable final ProfileRequestContext input) {
+
+ final AttributeContext attributeCtx = getAttributeContextLookupStrategy().apply(input);
+ if (attributeCtx == null) {
+ log.warn("No AttributeContext located for evaluation");
+ return allowNullAttributeContext();
+ }
+
+ final Map<String,IdPAttribute> attributes = isUseUnfilteredAttributes()
+ ? attributeCtx.getUnfilteredIdPAttributes()
+ : attributeCtx.getIdPAttributes();
+
+ if (hasMatch(input, attributes)) {
+ log.debug("Context satisfied requirements");
+ return true;
+ }
+ return false;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected boolean hasMatch(@Nonnull @NonnullElements final Map<String,IdPAttribute> attributeMap) {
+ log.error("Method should never be called");
+ return false;
+ }
+
+ /**
+ * Implementation of the condition to evaluate.
+ *
+ * @param profileRequestContext current profile request context
+ * @param attributeMap the attributes to evaluate
+ *
+ * @return the condition result
+ */
+ protected boolean hasMatch(@Nullable final ProfileRequestContext profileRequestContext,
+ @Nonnull @NonnullElements final Map<String,IdPAttribute> attributeMap) {
+
+ for (final String id : attributeFunctionMap.keySet()) {
+ log.debug("Checking for attribute: {}", id);
+
+ final IdPAttribute attribute = attributeMap.get(id);
+ if (attribute == null) {
+ log.debug("Attribute {} not found in context", id);
+ return false;
+ }
+
+ boolean matched = false;
+
+ for (final Function<ProfileRequestContext,String> fn : attributeFunctionMap.get(id)) {
+ if (findMatch(fn.apply(profileRequestContext), attribute)) {
+ matched = true;
+ break;
+ }
+ }
+
+ if (!matched) {
+ log.debug("Attribute {} values not matched", id);
+ return false;
+ }
+ }
+
+ return true;
+ }
+
+ /**
+ * Look for a matching value in an attribute.
+ *
+ * @param toMatch value to look for
+ * @param attribute attribute to check
+ *
+ * @return true iff the value is one of the attribute's values
+ */
+ protected boolean findMatch(@Nonnull @NotEmpty final String toMatch, @Nonnull final IdPAttribute attribute) {
+
+ if ("*".equals(toMatch)) {
+ log.debug("Wildcard (*) value rule for attribute {}", attribute.getId());
+ return true;
+ } else {
+ for (final IdPAttributeValue<?> value : attribute.getValues()) {
+ if (value instanceof StringAttributeValue) {
+ if (toMatch.equals(value.getValue())) {
+ log.debug("Found matching value ({}) in attribute {}", toMatch, attribute.getId());
+ return true;
+ }
+ }
+ }
+ }
+
+ return false;
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list