[java-identity-provider] 02/02: IDP-1103 - Configurable event signaling during password validation
Scott Cantor
cantor.2 at osu.edu
Wed Aug 29 14:18:46 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=fc93a2a0e54b12315ebc6de0096286c38e15cd7e
commit fc93a2a0e54b12315ebc6de0096286c38e15cd7e
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Aug 29 14:18:41 2018 -0400
IDP-1103 - Configurable event signaling during password validation
https://issues.shibboleth.net/jira/browse/IDP-1103
---
.../idp/authn/AbstractValidationAction.java | 19 +++++++++++--
.../idp/authn/context/AuthenticationContext.java | 33 ++++++++++++++++++++++
.../authn/impl/PopulateAuthenticationContext.java | 21 ++++++++++++++
.../resources/system/flows/authn/authn-beans.xml | 3 +-
4 files changed, 72 insertions(+), 4 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
index f2943c0..34e5d00 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
@@ -120,9 +120,11 @@ public abstract class AbstractValidationAction<InboundMessageType, OutboundMessa
}
/**
- * Set the base name to use for metrics reported.
+ * Get the base name to use for metrics reported.
*
* @return root for name of metrics
+ *
+ * @since 3.3.0
*/
@Nonnull @NotEmpty public String getMetricName() {
return metricName;
@@ -140,7 +142,7 @@ public abstract class AbstractValidationAction<InboundMessageType, OutboundMessa
metricName = Constraint.isNotNull(StringSupport.trimOrNull(name), "Metric name cannot be null or empty");
}
-
+
/**
* Get whether to inject the authentication flow's default custom principals into the subject.
*
@@ -272,6 +274,7 @@ public abstract class AbstractValidationAction<InboundMessageType, OutboundMessa
return authenticatedSubject;
}
+// Checkstyle: CyclomaticComplexity OFF
/** {@inheritDoc} */
@Override
protected boolean doPreExecute(
@@ -288,7 +291,7 @@ public abstract class AbstractValidationAction<InboundMessageType, OutboundMessa
if (clearErrorContext) {
authenticationContext.removeSubcontext(AuthenticationErrorContext.class);
- }
+ }
// If the request mandates particular principals, evaluate this validating component to see if it
// can produce a matching principal. This skips validators chained together in flows that aren't
@@ -322,8 +325,18 @@ public abstract class AbstractValidationAction<InboundMessageType, OutboundMessa
return false;
}
+ if (authenticationContext.getFixedEventLookupStrategy() != null) {
+ final String fixedEvent = authenticationContext.getFixedEventLookupStrategy().apply(profileRequestContext);
+ if (fixedEvent != null) {
+ log.info("{} Signaling fixed event: {}", getLogPrefix(), fixedEvent);
+ ActionSupport.buildEvent(profileRequestContext, fixedEvent);
+ return false;
+ }
+ }
+
return true;
}
+// Checkstyle: CyclomaticComplexity ON
/**
* Normally called upon successful completion of credential validation, calls the {@link #populateSubject(Subject)}
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java
index 8a5e3f6..e6d1388 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java
@@ -41,7 +41,9 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
import org.joda.time.DateTime;
import org.opensaml.messaging.context.BaseContext;
+import org.opensaml.profile.context.ProfileRequestContext;
+import com.google.common.base.Function;
import com.google.common.base.MoreObjects;
/**
@@ -74,6 +76,9 @@ public final class AuthenticationContext extends BaseContext {
/** Allowed time in ms since an {@link AuthenticationResult} was created that it can be reused for this request. */
@NonNegative @Duration private long maxAge;
+ /** Lookup strategy for a fixed event to return from validators for testing. */
+ @Nullable private Function<ProfileRequestContext,String> fixedEventLookupStrategy;
+
/** Flows that are known to the system. */
@Nonnull @NonnullElements private final Map<String,AuthenticationFlowDescriptor> availableFlows;
@@ -352,6 +357,34 @@ public final class AuthenticationContext extends BaseContext {
maxAge = Constraint.isGreaterThanOrEqual(0, age, "MaxAge cannot be negative");
return this;
}
+
+ /**
+ * Get optional lookup strategy to return a fixed event to return from credential validation
+ * to exercise error and warning logic.
+ *
+ * @return lookup strategy, or null
+ *
+ * @since 3.4.0
+ */
+ @Nullable public Function<ProfileRequestContext,String> getFixedEventLookupStrategy() {
+ return fixedEventLookupStrategy;
+ }
+
+ /**
+ * Set optional lookup strategy to return a fixed event to return from credential validation
+ * to exercise error and warning logic.
+ *
+ * @param strategy lookup strategy
+ *
+ * @return this context
+ *
+ * @since 3.4.0
+ */
+ @Nonnull public AuthenticationContext setFixedEventLookupStrategy(
+ @Nullable final Function<ProfileRequestContext,String> strategy) {
+ fixedEventLookupStrategy = strategy;
+ return this;
+ }
/**
* Get the authentication flow that was attempted in order to authenticate the user.
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateAuthenticationContext.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateAuthenticationContext.java
index 91acc84..ecd9689 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateAuthenticationContext.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateAuthenticationContext.java
@@ -72,6 +72,9 @@ public class PopulateAuthenticationContext extends AbstractAuthenticationAction
/** The registry of predicate factories for custom principal evaluation. */
@Nullable private PrincipalEvalPredicateFactoryRegistry evalRegistry;
+ /** Optional lookup strategy for triggering credential validators to return a fixed event for testing. */
+ @Nullable private Function<ProfileRequestContext,String> fixedEventLookupStrategy;
+
/** Constructor. */
PopulateAuthenticationContext() {
availableFlows = Collections.emptyList();
@@ -136,6 +139,20 @@ public class PopulateAuthenticationContext extends AbstractAuthenticationAction
evalRegistry = Constraint.isNotNull(registry, "PrincipalEvalPredicateFactoryRegistry cannot be null");
}
+
+ /**
+ * Set optional lookup strategy to return a fixed event to return from credential validation
+ * to exercise error and warning logic.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 3.4.0
+ */
+ public void setFixedEventLookupStrategy(@Nullable final Function<ProfileRequestContext,String> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ fixedEventLookupStrategy = strategy;
+ }
// Checkstyle: CyclomaticComplexity OFF
/** {@inheritDoc} */
@@ -153,6 +170,10 @@ public class PopulateAuthenticationContext extends AbstractAuthenticationAction
}
}
+ if (fixedEventLookupStrategy != null) {
+ authenticationContext.setFixedEventLookupStrategy(fixedEventLookupStrategy);
+ }
+
if (availableFlows.isEmpty()) {
log.warn("{} No authentication flows are available", getLogPrefix());
return;
diff --git a/idp-conf/src/main/resources/system/flows/authn/authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/authn-beans.xml
index 2a9a45b..fc470d4 100644
--- a/idp-conf/src/main/resources/system/flows/authn/authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/authn-beans.xml
@@ -22,7 +22,8 @@
class="net.shibboleth.idp.authn.impl.PopulateAuthenticationContext" scope="prototype"
p:availableFlows-ref="shibboleth.AvailableAuthenticationFlows"
p:potentialFlows="#{@'shibboleth.AvailableAuthenticationFlows'.?[id matches 'authn/(' + '%{idp.authn.flows:}'.trim() + ')']}"
- p:principalEvalPredicateFactoryRegistry-ref="shibboleth.AuthnComparisonRegistry" />
+ p:principalEvalPredicateFactoryRegistry-ref="shibboleth.AuthnComparisonRegistry"
+ p:fixedEventLookupStrategy="#{getObject('shibboleth.FixedAuthenticationEventStrategy')}" />
<bean id="PopulateAuthenticationContextWithInitialFlow"
class="net.shibboleth.idp.authn.impl.PopulateAuthenticationContext" scope="prototype"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list