[java-identity-provider] branch master updated: IDP-1117 - Support for AuthenticatingAuthority
Scott Cantor
cantor.2 at osu.edu
Tue Aug 21 21:35:10 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=61438759920bcf160cb0f1c4917ab20eb6341b4e
The following commit(s) were added to refs/heads/master by this push:
new 6143875 IDP-1117 - Support for AuthenticatingAuthority
6143875 is described below
commit 61438759920bcf160cb0f1c4917ab20eb6341b4e
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Aug 21 21:35:06 2018 -0400
IDP-1117 - Support for AuthenticatingAuthority
https://issues.shibboleth.net/jira/browse/IDP-1117
ProxyAuthenticationPrincipal and serializer.
---
.../principal/ProxyAuthenticationPrincipal.java | 87 ++++++++++++
.../ProxyAuthenticationPrincipalSerializer.java | 149 +++++++++++++++++++++
.../DefaultAuthenticationResultSerializerTest.java | 31 ++++-
.../idp/authn/impl/ProxyAuthenticationResult.json | 1 +
4 files changed, 267 insertions(+), 1 deletion(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/ProxyAuthenticationPrincipal.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/ProxyAuthenticationPrincipal.java
new file mode 100644
index 0000000..bb782c3
--- /dev/null
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/ProxyAuthenticationPrincipal.java
@@ -0,0 +1,87 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.authn.principal;
+
+import java.security.Principal;
+import java.util.ArrayList;
+import java.util.Collection;
+
+import javax.annotation.Nonnull;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.Live;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+import com.google.common.base.MoreObjects;
+
+/** Principal that wraps a set of proxied authentication authorities. */
+public class ProxyAuthenticationPrincipal implements Principal {
+
+ /** The authorities. */
+ @Nonnull @NonnullElements private Collection<String> authorities;
+
+ /** Constructor. */
+ public ProxyAuthenticationPrincipal() {
+ authorities = new ArrayList<>();
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull @NotEmpty public String getName() {
+ return authorities.toString();
+ }
+
+ /**
+ * Get the mutable authority collection.
+ *
+ * @return the authorities
+ */
+ @Nonnull @NonnullElements @Live public Collection<String> getAuthorities() {
+ return authorities;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public int hashCode() {
+ return authorities.hashCode();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean equals(final Object other) {
+ if (other == null) {
+ return false;
+ }
+
+ if (this == other) {
+ return true;
+ }
+
+ if (other instanceof ProxyAuthenticationPrincipal) {
+ return authorities.equals(((ProxyAuthenticationPrincipal) other).getAuthorities());
+ }
+
+ return false;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public String toString() {
+ return MoreObjects.toStringHelper(this).add("authorities", authorities).toString();
+ }
+
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/ProxyAuthenticationPrincipalSerializer.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/ProxyAuthenticationPrincipalSerializer.java
new file mode 100644
index 0000000..7b18a5d
--- /dev/null
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/ProxyAuthenticationPrincipalSerializer.java
@@ -0,0 +1,149 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.authn.principal.impl;
+
+import java.io.IOException;
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.security.Principal;
+import java.util.regex.Pattern;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import javax.annotation.concurrent.ThreadSafe;
+import javax.json.Json;
+import javax.json.JsonArray;
+import javax.json.JsonArrayBuilder;
+import javax.json.JsonBuilderFactory;
+import javax.json.JsonObject;
+import javax.json.JsonObjectBuilder;
+import javax.json.JsonReader;
+import javax.json.JsonString;
+import javax.json.JsonStructure;
+import javax.json.JsonValue;
+import javax.json.JsonValue.ValueType;
+import javax.json.stream.JsonGenerator;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.google.common.base.Predicates;
+import com.google.common.collect.Collections2;
+
+import net.shibboleth.idp.authn.principal.AbstractPrincipalSerializer;
+import net.shibboleth.idp.authn.principal.ProxyAuthenticationPrincipal;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Principal serializer for {@link ProxyAuthenticationPrincipal}.
+ */
+ at ThreadSafe
+public class ProxyAuthenticationPrincipalSerializer extends AbstractPrincipalSerializer<String> {
+
+ /** Field name of principal content. */
+ @Nonnull @NotEmpty private static final String PROXY_AUTH_FIELD = "AA";
+
+ /** Pattern used to determine if input is supported. */
+ private static final Pattern JSON_PATTERN = Pattern.compile("^\\{\"AA\":.*\\}$");
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ProxyAuthenticationPrincipalSerializer.class);
+
+ /** JSON object bulder factory. */
+ @Nonnull private final JsonBuilderFactory objectBuilderFactory;
+
+ /** Constructor. */
+ public ProxyAuthenticationPrincipalSerializer() {
+ objectBuilderFactory = Json.createBuilderFactory(null);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean supports(@Nonnull final Principal principal) {
+ return principal instanceof ProxyAuthenticationPrincipal;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nonnull @NotEmpty public String serialize(@Nonnull final Principal principal) throws IOException {
+ final JsonArrayBuilder arrayBuilder = getJsonArrayBuilder();
+ for (final String aa : Collections2.filter(((ProxyAuthenticationPrincipal) principal).getAuthorities(),
+ Predicates.notNull())) {
+ arrayBuilder.add(aa);
+ }
+ final StringWriter sink = new StringWriter(32);
+ final JsonGenerator gen = getJsonGenerator(sink);
+ gen.writeStartObject().write(PROXY_AUTH_FIELD, arrayBuilder.build()).writeEnd();
+ gen.close();
+ return sink.toString();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean supports(@Nonnull @NotEmpty final String value) {
+ return JSON_PATTERN.matcher(value).matches();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public ProxyAuthenticationPrincipal deserialize(@Nonnull @NotEmpty final String value)
+ throws IOException {
+ final JsonReader reader = getJsonReader(new StringReader(value));
+ JsonStructure st = null;
+ try {
+ st = reader.read();
+ } finally {
+ reader.close();
+ }
+ if (!(st instanceof JsonObject)) {
+ throw new IOException("Found invalid data structure while parsing ProxyAuthenticationPrincipal");
+ }
+
+ final JsonValue jsonValue = ((JsonObject) st).get(PROXY_AUTH_FIELD);
+ if (jsonValue != null && ValueType.ARRAY.equals(jsonValue.getValueType())) {
+ final ProxyAuthenticationPrincipal ret = new ProxyAuthenticationPrincipal();
+ for (final JsonValue e : (JsonArray) jsonValue) {
+ if (ValueType.STRING.equals(e.getValueType())) {
+ ret.getAuthorities().add(((JsonString) e).getString());
+ }
+ }
+ return ret;
+ } else {
+ throw new IOException("Serialized ProxyAuthenticationPrincipal missing array field");
+ }
+ }
+
+ /**
+ * Get a {@link JsonObjectBuilder} in a thread-safe manner.
+ *
+ * @return an object builder
+ */
+ @Nonnull private synchronized JsonObjectBuilder getJsonObjectBuilder() {
+ return objectBuilderFactory.createObjectBuilder();
+ }
+
+ /**
+ * Get a {@link JsonArrayBuilder} in a thread-safe manner.
+ *
+ * @return an array builder
+ */
+ @Nonnull private synchronized JsonArrayBuilder getJsonArrayBuilder() {
+ return objectBuilderFactory.createArrayBuilder();
+ }
+
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/DefaultAuthenticationResultSerializerTest.java b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/DefaultAuthenticationResultSerializerTest.java
index 4f2a001..8670045 100644
--- a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/DefaultAuthenticationResultSerializerTest.java
+++ b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/DefaultAuthenticationResultSerializerTest.java
@@ -22,6 +22,7 @@ import java.io.FileInputStream;
import java.io.IOException;
import java.net.URISyntaxException;
import java.util.Arrays;
+import java.util.Collection;
import java.util.Collections;
import javax.security.auth.Subject;
@@ -36,11 +37,13 @@ import net.shibboleth.idp.authn.principal.AuthenticationResultPrincipal;
import net.shibboleth.idp.authn.principal.IdPAttributePrincipal;
import net.shibboleth.idp.authn.principal.PasswordPrincipal;
import net.shibboleth.idp.authn.principal.PrincipalSerializer;
+import net.shibboleth.idp.authn.principal.ProxyAuthenticationPrincipal;
import net.shibboleth.idp.authn.principal.TestPrincipal;
import net.shibboleth.idp.authn.principal.UsernamePrincipal;
import net.shibboleth.idp.authn.principal.impl.IdPAttributePrincipalSerializer;
import net.shibboleth.idp.authn.principal.impl.LDAPPrincipalSerializer;
import net.shibboleth.idp.authn.principal.impl.PasswordPrincipalSerializer;
+import net.shibboleth.idp.authn.principal.impl.ProxyAuthenticationPrincipalSerializer;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.resource.TestResourceConverter;
import net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy;
@@ -264,7 +267,33 @@ public class DefaultAuthenticationResultSerializerTest {
Assert.assertEquals(((ScopedStringAttributeValue) attribute.getValues().get(1)).getScope(), "scope");
Assert.assertEquals(attribute.getValues().get(2), EmptyAttributeValue.ZERO_LENGTH);
}
-
+
+ @Test public void testProxyAuthentication() throws Exception {
+ final ProxyAuthenticationPrincipalSerializer proxySerializer = new ProxyAuthenticationPrincipalSerializer();
+ serializer.setPrincipalSerializers(Collections.<PrincipalSerializer<String>>singletonList(proxySerializer));
+ serializer.initialize();
+
+ final AuthenticationResult result = createResult("test", new Subject());
+ final ProxyAuthenticationPrincipal prin = new ProxyAuthenticationPrincipal();
+ prin.getAuthorities().addAll(Arrays.asList("foo","bar","baz"));
+ result.getSubject().getPrincipals().add(prin);
+
+ final String s = serializer.serialize(result);
+ final String s2 = fileToString(DATAPATH + "ProxyAuthenticationResult.json");
+ Assert.assertEquals(s, s2);
+
+ final AuthenticationResult result2 = serializer.deserialize(1, CONTEXT, KEY, s2, ACTIVITY);
+
+ Assert.assertEquals(result.getAuthenticationFlowId(), result2.getAuthenticationFlowId());
+ Assert.assertEquals(result.getAuthenticationInstant(), result2.getAuthenticationInstant());
+ Assert.assertEquals(result.getLastActivityInstant(), result2.getLastActivityInstant());
+ Assert.assertEquals(result.getSubject(), result2.getSubject());
+
+ final Collection<String> authorities =
+ ((ProxyAuthenticationPrincipal) result2.getSubject().getPrincipals().iterator().next()).getAuthorities();
+ Assert.assertEquals(authorities, prin.getAuthorities());
+ }
+
@Test public void testNestedAuthenticationResult() throws Exception {
serializer.initialize();
diff --git a/idp-authn-impl/src/test/resources/net/shibboleth/idp/authn/impl/ProxyAuthenticationResult.json b/idp-authn-impl/src/test/resources/net/shibboleth/idp/authn/impl/ProxyAuthenticationResult.json
new file mode 100644
index 0000000..a2e06e3
--- /dev/null
+++ b/idp-authn-impl/src/test/resources/net/shibboleth/idp/authn/impl/ProxyAuthenticationResult.json
@@ -0,0 +1 @@
+{"id":"test","ts":1378827849463,"princ":[{"AA":["foo","bar","baz"]}]}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list