[java-identity-provider] branch master updated: CAS-1283 Derive CAS principal from SubjectContext.
Marvin S. Addison
marvin.addison at gmail.com
Wed May 30 11:33:19 EDT 2018
This is an automated email from the git hooks/post-receive script.
serac pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=e9267f90b266c56ead78cb18ff1814a21c0bc6ad
The following commit(s) were added to refs/heads/master by this push:
new e9267f9 CAS-1283 Derive CAS principal from SubjectContext.
e9267f9 is described below
commit e9267f90b266c56ead78cb18ff1814a21c0bc6ad
Author: Marvin S. Addison <serac at vt.edu>
AuthorDate: Tue May 29 13:58:17 2018 -0400
CAS-1283 Derive CAS principal from SubjectContext.
---
.../cas/flow/impl/AbstractCASProtocolAction.java | 18 ---------
.../cas/flow/impl/GrantServiceTicketAction.java | 47 +++++++++++++++++++++-
.../flow/impl/GrantServiceTicketActionTest.java | 2 +
.../idp/cas/flow/impl/TestContextBuilder.java | 8 ++++
4 files changed, 56 insertions(+), 19 deletions(-)
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractCASProtocolAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractCASProtocolAction.java
index 9b74a86..a2be76d 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractCASProtocolAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractCASProtocolAction.java
@@ -45,13 +45,9 @@ public abstract class AbstractCASProtocolAction<RequestType, ResponseType> exten
/** Looks up a CAS protocol context from IdP profile request context. */
private final Function<ProfileRequestContext, ProtocolContext<RequestType, ResponseType>> protocolLookupFunction;
- /** Looks up an IdP session context from IdP profile request context. */
- private final Function<ProfileRequestContext, SessionContext> sessionContextFunction;
-
/** Constructor. */
public AbstractCASProtocolAction() {
protocolLookupFunction = new ChildContextLookup(ProtocolContext.class, true);
- sessionContextFunction = new ChildContextLookup(SessionContext.class, false);
}
/**
@@ -155,20 +151,6 @@ public abstract class AbstractCASProtocolAction<RequestType, ResponseType> exten
}
/**
- * Get the IdP session.
- *
- * @param prc profile request context
- * @return IdP session
- */
- @Nonnull protected IdPSession getIdPSession(final ProfileRequestContext prc) {
- final SessionContext sessionContext = sessionContextFunction.apply(prc);
- if (sessionContext == null || sessionContext.getIdPSession() == null) {
- throw new IllegalStateException("Cannot locate IdP session");
- }
- return sessionContext.getIdPSession();
- }
-
- /**
* Get the CAS protocol context.
*
* @param prc profile request context
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java
index 87aef08..f583be9 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java
@@ -20,8 +20,11 @@ package net.shibboleth.idp.cas.flow.impl;
import javax.annotation.Nonnull;
import com.google.common.base.Function;
+import com.google.common.base.Functions;
import net.shibboleth.idp.authn.AuthenticationResult;
import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.authn.context.SubjectContext;
+import net.shibboleth.idp.authn.context.navigate.SubjectContextPrincipalLookupFunction;
import net.shibboleth.idp.cas.config.impl.ConfigLookupFunction;
import net.shibboleth.idp.cas.config.impl.LoginConfiguration;
import net.shibboleth.idp.cas.protocol.ProtocolError;
@@ -31,6 +34,7 @@ import net.shibboleth.idp.cas.ticket.ServiceTicket;
import net.shibboleth.idp.cas.ticket.TicketServiceEx;
import net.shibboleth.idp.cas.ticket.TicketState;
import net.shibboleth.idp.session.IdPSession;
+import net.shibboleth.idp.session.context.SessionContext;
import net.shibboleth.utilities.java.support.logic.Constraint;
import org.joda.time.DateTime;
import org.joda.time.Instant;
@@ -59,11 +63,22 @@ public class GrantServiceTicketAction extends AbstractCASProtocolAction<ServiceT
private final ConfigLookupFunction<LoginConfiguration> configLookupFunction =
new ConfigLookupFunction<>(LoginConfiguration.class);
+ /** Looks up an IdP session context from IdP profile request context. */
+ @Nonnull
+ private final Function<ProfileRequestContext, SessionContext> sessionContextFunction =
+ new ChildContextLookup<>(SessionContext.class, false);
+
/** AuthenticationContext lookup function. */
@Nonnull
private final Function<ProfileRequestContext, AuthenticationContext> authnCtxLookupFunction =
new ChildContextLookup<>(AuthenticationContext.class);
+ /** Function to retrieve subject principal name. */
+ @Nonnull
+ private final Function<ProfileRequestContext, String> principalLookupFunction = Functions.compose(
+ new SubjectContextPrincipalLookupFunction(),
+ new ChildContextLookup<ProfileRequestContext, SubjectContext>(SubjectContext.class));
+
/** Manages CAS tickets. */
@Nonnull
private final TicketServiceEx ticketServiceEx;
@@ -107,7 +122,7 @@ public class GrantServiceTicketAction extends AbstractCASProtocolAction<ServiceT
log.debug("Granting service ticket for {}", request.getService());
final TicketState state = new TicketState(
session.getId(),
- session.getPrincipalName(),
+ getPrincipalName(profileRequestContext),
new Instant(authnResult.getAuthenticationInstant()),
authnResult.getAuthenticationFlowId());
ticket = ticketServiceEx.createServiceTicket(
@@ -130,6 +145,36 @@ public class GrantServiceTicketAction extends AbstractCASProtocolAction<ServiceT
}
/**
+ * Get the IdP session.
+ *
+ * @param prc profile request context.
+ * @return IdP session
+ */
+ @Nonnull
+ private IdPSession getIdPSession(final ProfileRequestContext prc) {
+ final SessionContext sessionContext = sessionContextFunction.apply(prc);
+ if (sessionContext == null || sessionContext.getIdPSession() == null) {
+ throw new IllegalStateException("Cannot locate IdP session");
+ }
+ return sessionContext.getIdPSession();
+ }
+
+ /**
+ * Get the IdP subject principal name.
+ *
+ * @param prc profile request context.
+ * @return Principal name.
+ */
+ @Nonnull
+ private String getPrincipalName(final ProfileRequestContext prc) {
+ final String principal = principalLookupFunction.apply(prc);
+ if (principal == null ) {
+ throw new IllegalStateException("Cannot determine IdP subject principal name.");
+ }
+ return principal;
+ }
+
+ /**
* Gets the most recent authentication result from the IdP session.
*
* @param session IdP session to ask for authentication results.
diff --git a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketActionTest.java b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketActionTest.java
index 4596999..dded5b5 100644
--- a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketActionTest.java
+++ b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketActionTest.java
@@ -57,6 +57,7 @@ public class GrantServiceTicketActionTest extends AbstractFlowActionTest {
.addProtocolContext(request, null)
.addAuthenticationContext(new AuthenticationResult("Password", new UsernamePrincipal("bob")))
.addSessionContext(mockSession("1234567890", true))
+ .addSubjectContext(TEST_PRINCIPAL_NAME)
.addRelyingPartyContext(request.getService(), true, new LoginConfiguration())
.build();
assertNull(action.execute(context));
@@ -69,5 +70,6 @@ public class GrantServiceTicketActionTest extends AbstractFlowActionTest {
assertEquals(ticket.isRenew(), request.isRenew());
assertEquals(ticket.getId(), response.getTicket());
assertEquals(ticket.getService(), response.getService());
+ assertEquals(ticket.getTicketState().getPrincipalName(), TEST_PRINCIPAL_NAME);
}
}
diff --git a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/TestContextBuilder.java b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/TestContextBuilder.java
index db7b3b5..21d0d4c 100644
--- a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/TestContextBuilder.java
+++ b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/flow/impl/TestContextBuilder.java
@@ -19,6 +19,7 @@ package net.shibboleth.idp.cas.flow.impl;
import net.shibboleth.idp.authn.AuthenticationResult;
import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.idp.authn.context.SubjectContext;
import net.shibboleth.idp.cas.protocol.ProtocolContext;
import net.shibboleth.idp.cas.service.Service;
import net.shibboleth.idp.cas.service.ServiceContext;
@@ -63,6 +64,13 @@ public class TestContextBuilder {
return this;
}
+ public TestContextBuilder addSubjectContext(final String principal) {
+ final SubjectContext subjectContext = new SubjectContext();
+ subjectContext.setPrincipalName(principal);
+ profileRequestContext.addSubcontext(subjectContext);
+ return this;
+ }
+
public TestContextBuilder addProtocolContext(final Object request, final Object response) {
final ProtocolContext context = new ProtocolContext();
context.setRequest(request);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list