[java-identity-provider] branch master updated: CAS-1283 Derive CAS principal from SubjectContext.

Marvin S. Addison marvin.addison at gmail.com
Wed May 30 11:33:19 EDT 2018


This is an automated email from the git hooks/post-receive script.

serac pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=e9267f90b266c56ead78cb18ff1814a21c0bc6ad

The following commit(s) were added to refs/heads/master by this push:
       new  e9267f9   CAS-1283 Derive CAS principal from SubjectContext.
e9267f9 is described below

commit e9267f90b266c56ead78cb18ff1814a21c0bc6ad
Author: Marvin S. Addison <serac at vt.edu>
AuthorDate: Tue May 29 13:58:17 2018 -0400

    CAS-1283 Derive CAS principal from SubjectContext.
---
 .../cas/flow/impl/AbstractCASProtocolAction.java   | 18 ---------
 .../cas/flow/impl/GrantServiceTicketAction.java    | 47 +++++++++++++++++++++-
 .../flow/impl/GrantServiceTicketActionTest.java    |  2 +
 .../idp/cas/flow/impl/TestContextBuilder.java      |  8 ++++
 4 files changed, 56 insertions(+), 19 deletions(-)

diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractCASProtocolAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractCASProtocolAction.java
index 9b74a86..a2be76d 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractCASProtocolAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractCASProtocolAction.java
@@ -45,13 +45,9 @@ public abstract class AbstractCASProtocolAction<RequestType, ResponseType> exten
     /** Looks up a CAS protocol context from IdP profile request context. */
     private final Function<ProfileRequestContext, ProtocolContext<RequestType, ResponseType>> protocolLookupFunction;
 
-    /** Looks up an IdP session context from IdP profile request context. */
-    private final Function<ProfileRequestContext, SessionContext> sessionContextFunction;
-
     /** Constructor. */
     public AbstractCASProtocolAction() {
         protocolLookupFunction = new ChildContextLookup(ProtocolContext.class, true);
-        sessionContextFunction = new ChildContextLookup(SessionContext.class, false);
     }
 
     /**
@@ -155,20 +151,6 @@ public abstract class AbstractCASProtocolAction<RequestType, ResponseType> exten
     }
 
     /**
-     * Get the IdP session.
-     * 
-     * @param prc profile request context
-     * @return IdP session
-     */
-    @Nonnull protected IdPSession getIdPSession(final ProfileRequestContext prc) {
-        final SessionContext sessionContext = sessionContextFunction.apply(prc);
-        if (sessionContext == null || sessionContext.getIdPSession() == null) {
-            throw new IllegalStateException("Cannot locate IdP session");
-        }
-        return sessionContext.getIdPSession();
-    }
-
-    /**
      * Get the CAS protocol context.
      * 
      * @param prc profile request context
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java
index 87aef08..f583be9 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java
@@ -20,8 +20,11 @@ package net.shibboleth.idp.cas.flow.impl;
 import javax.annotation.Nonnull;
 
 import com.google.common.base.Function;
+import com.google.common.base.Functions;
 import net.shibboleth.idp.authn.AuthenticationResult;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.authn.context.SubjectContext;
+import net.shibboleth.idp.authn.context.navigate.SubjectContextPrincipalLookupFunction;
 import net.shibboleth.idp.cas.config.impl.ConfigLookupFunction;
 import net.shibboleth.idp.cas.config.impl.LoginConfiguration;
 import net.shibboleth.idp.cas.protocol.ProtocolError;
@@ -31,6 +34,7 @@ import net.shibboleth.idp.cas.ticket.ServiceTicket;
 import net.shibboleth.idp.cas.ticket.TicketServiceEx;
 import net.shibboleth.idp.cas.ticket.TicketState;
 import net.shibboleth.idp.session.IdPSession;
+import net.shibboleth.idp.session.context.SessionContext;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 import org.joda.time.DateTime;
 import org.joda.time.Instant;
@@ -59,11 +63,22 @@ public class GrantServiceTicketAction extends AbstractCASProtocolAction<ServiceT
     private final ConfigLookupFunction<LoginConfiguration> configLookupFunction =
             new ConfigLookupFunction<>(LoginConfiguration.class);
 
+    /** Looks up an IdP session context from IdP profile request context. */
+    @Nonnull
+    private final Function<ProfileRequestContext, SessionContext> sessionContextFunction =
+            new ChildContextLookup<>(SessionContext.class, false);
+
     /** AuthenticationContext lookup function. */
     @Nonnull
     private final Function<ProfileRequestContext, AuthenticationContext> authnCtxLookupFunction =
             new ChildContextLookup<>(AuthenticationContext.class);
 
+    /** Function to retrieve subject principal name. */
+    @Nonnull
+    private final Function<ProfileRequestContext, String> principalLookupFunction = Functions.compose(
+            new SubjectContextPrincipalLookupFunction(),
+            new ChildContextLookup<ProfileRequestContext, SubjectContext>(SubjectContext.class));
+
     /** Manages CAS tickets. */
     @Nonnull
     private final TicketServiceEx ticketServiceEx;
@@ -107,7 +122,7 @@ public class GrantServiceTicketAction extends AbstractCASProtocolAction<ServiceT
             log.debug("Granting service ticket for {}", request.getService());
             final TicketState state = new TicketState(
                     session.getId(),
-                    session.getPrincipalName(),
+                    getPrincipalName(profileRequestContext),
                     new Instant(authnResult.getAuthenticationInstant()),
                     authnResult.getAuthenticationFlowId());
             ticket = ticketServiceEx.createServiceTicket(
@@ -130,6 +145,36 @@ public class GrantServiceTicketAction extends AbstractCASProtocolAction<ServiceT
     }
 
     /**
+     * Get the IdP session.
+     *
+     * @param prc profile request context.
+     * @return IdP session
+     */
+    @Nonnull
+    private IdPSession getIdPSession(final ProfileRequestContext prc) {
+        final SessionContext sessionContext = sessionContextFunction.apply(prc);
+        if (sessionContext == null || sessionContext.getIdPSession() == null) {
+            throw new IllegalStateException("Cannot locate IdP session");
+        }
+        return sessionContext.getIdPSession();
+    }
+
+    /**
+     * Get the IdP subject principal name.
+     *
+     * @param prc profile request context.
+     * @return Principal name.
+     */
+    @Nonnull
+    private String getPrincipalName(final ProfileRequestContext prc) {
+        final String principal = principalLookupFunction.apply(prc);
+        if (principal == null ) {
+            throw new IllegalStateException("Cannot determine IdP subject principal name.");
+        }
+        return principal;
+    }
+
+    /**
      * Gets the most recent authentication result from the IdP session.
      *
      * @param session IdP session to ask for authentication results.
diff --git a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketActionTest.java b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketActionTest.java
index 4596999..dded5b5 100644
--- a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketActionTest.java
+++ b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketActionTest.java
@@ -57,6 +57,7 @@ public class GrantServiceTicketActionTest extends AbstractFlowActionTest {
                 .addProtocolContext(request, null)
                 .addAuthenticationContext(new AuthenticationResult("Password", new UsernamePrincipal("bob")))
                 .addSessionContext(mockSession("1234567890", true))
+                .addSubjectContext(TEST_PRINCIPAL_NAME)
                 .addRelyingPartyContext(request.getService(), true, new LoginConfiguration())
                 .build();
         assertNull(action.execute(context));
@@ -69,5 +70,6 @@ public class GrantServiceTicketActionTest extends AbstractFlowActionTest {
         assertEquals(ticket.isRenew(), request.isRenew());
         assertEquals(ticket.getId(), response.getTicket());
         assertEquals(ticket.getService(), response.getService());
+        assertEquals(ticket.getTicketState().getPrincipalName(), TEST_PRINCIPAL_NAME);
     }
 }
diff --git a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/TestContextBuilder.java b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/TestContextBuilder.java
index db7b3b5..21d0d4c 100644
--- a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/TestContextBuilder.java
+++ b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/TestContextBuilder.java
@@ -19,6 +19,7 @@ package net.shibboleth.idp.cas.flow.impl;
 
 import net.shibboleth.idp.authn.AuthenticationResult;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.authn.context.SubjectContext;
 import net.shibboleth.idp.cas.protocol.ProtocolContext;
 import net.shibboleth.idp.cas.service.Service;
 import net.shibboleth.idp.cas.service.ServiceContext;
@@ -63,6 +64,13 @@ public class TestContextBuilder {
         return this;
     }
 
+    public TestContextBuilder addSubjectContext(final String principal) {
+        final SubjectContext subjectContext = new SubjectContext();
+        subjectContext.setPrincipalName(principal);
+        profileRequestContext.addSubcontext(subjectContext);
+        return this;
+    }
+
     public TestContextBuilder addProtocolContext(final Object request, final Object response) {
         final ProtocolContext context = new ProtocolContext();
         context.setRequest(request);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list