[java-identity-provider] branch master updated: OSJ-181: Enhance dynamic metadata resolvers to support non-entityID criteria
Brent Putman
putmanb at georgetown.edu
Mon Oct 1 18:09:36 EDT 2018
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=e006c29168d074d95137e6fa0cffc7cae6962f00
The following commit(s) were added to refs/heads/master by this push:
new e006c29 OSJ-181: Enhance dynamic metadata resolvers to support non-entityID criteria
e006c29 is described below
commit e006c29168d074d95137e6fa0cffc7cae6962f00
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Sun Sep 30 18:10:25 2018 -0400
OSJ-181: Enhance dynamic metadata resolvers to support non-entityID criteria
---
.../AbstractDynamicMetadataProviderParser.java | 5 +++
.../impl/DynamicHTTPMetadataProviderParser.java | 5 +++
.../impl/LocalDynamicMetadataProviderParser.java | 4 +--
.../DynamicHTTPMetadataProviderParserTest.java | 36 ++++++++++++++++++++++
.../profile/spring/relyingparty/metadata/beans.xml | 4 +++
.../relyingparty/metadata/dynamicIndexes.xml | 10 ++++++
...tadataQueryProtocolWithSecondaryURLBuilders.xml | 14 +++++++++
.../main/resources/schema/shibboleth-metadata.xsd | 17 ++++++++++
8 files changed, 93 insertions(+), 2 deletions(-)
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/AbstractDynamicMetadataProviderParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/AbstractDynamicMetadataProviderParser.java
index beb8703..ef79c87 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/AbstractDynamicMetadataProviderParser.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/AbstractDynamicMetadataProviderParser.java
@@ -90,6 +90,11 @@ public abstract class AbstractDynamicMetadataProviderParser extends AbstractMeta
builder.addPropertyValue("cleanupTaskInterval",
StringSupport.trimOrNull(element.getAttributeNS(null, "cleanupTaskInterval")));
}
+
+ if (element.hasAttributeNS(null, "indexesRef")) {
+ builder.addPropertyReference("indexes",
+ StringSupport.trimOrNull(element.getAttributeNS(null, "indexesRef")));
+ }
builder.addPropertyReference("parserPool", getParserPoolRef(element));
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/DynamicHTTPMetadataProviderParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/DynamicHTTPMetadataProviderParser.java
index 785942b..37ab60d 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/DynamicHTTPMetadataProviderParser.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/DynamicHTTPMetadataProviderParser.java
@@ -128,6 +128,8 @@ public class DynamicHTTPMetadataProviderParser extends AbstractDynamicHTTPMetada
final String baseURL = ElementSupport.getElementContentAsString(mdq);
final String transformRef =
StringSupport.trimOrNull(StringSupport.trimOrNull(mdq.getAttributeNS(null, "transformRef")));
+ final String secondaryURLBuildersRef =
+ StringSupport.trimOrNull(StringSupport.trimOrNull(mdq.getAttributeNS(null, "secondaryURLBuildersRef")));
final BeanDefinitionBuilder builder =
BeanDefinitionBuilder.genericBeanDefinition(MetadataQueryProtocolRequestURLBuilder.class);
@@ -135,6 +137,9 @@ public class DynamicHTTPMetadataProviderParser extends AbstractDynamicHTTPMetada
if (transformRef != null) {
builder.addConstructorArgReference(transformRef);
}
+ if (secondaryURLBuildersRef != null) {
+ builder.addConstructorArgReference(secondaryURLBuildersRef);
+ }
return builder.getBeanDefinition();
}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/LocalDynamicMetadataProviderParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/LocalDynamicMetadataProviderParser.java
index 2a298fe..1ccd34b 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/LocalDynamicMetadataProviderParser.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/LocalDynamicMetadataProviderParser.java
@@ -21,7 +21,7 @@ import javax.xml.namespace.QName;
import org.opensaml.core.xml.persist.FilesystemLoadSaveManager;
import org.opensaml.saml.metadata.resolver.MetadataResolver;
-import org.opensaml.saml.metadata.resolver.impl.EntityIDDigestGenerator;
+import org.opensaml.saml.metadata.resolver.impl.DefaultLocalDynamicSourceKeyGenerator;
import org.opensaml.saml.metadata.resolver.impl.LocalDynamicMetadataResolver;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -78,7 +78,7 @@ public class LocalDynamicMetadataProviderParser extends AbstractDynamicMetadataP
sourceManagerRefOrBean = sourceManagerBuilder.getBeanDefinition();
if (sourceKeyGeneratorRefOrBean == null) {
- sourceKeyGeneratorRefOrBean = new EntityIDDigestGenerator(null, null, ".xml", null);
+ sourceKeyGeneratorRefOrBean = new DefaultLocalDynamicSourceKeyGenerator(null, ".xml", null);
}
} else {
log.error("{} LocalDynamicMetadataProvider contained neither a sourceManagerRef nor a sourceDirectory",
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/DynamicHTTPMetadataProviderParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/DynamicHTTPMetadataProviderParserTest.java
index 48d891b..d9a9e3e 100644
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/DynamicHTTPMetadataProviderParserTest.java
+++ b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/DynamicHTTPMetadataProviderParserTest.java
@@ -17,6 +17,8 @@
package net.shibboleth.idp.profile.spring.relyingparty.metadata;
+import java.security.MessageDigest;
+import java.security.SecureRandom;
import java.util.Arrays;
import java.util.Collections;
@@ -27,10 +29,14 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import org.opensaml.core.criterion.EntityIdCriterion;
import org.opensaml.core.xml.persist.FilesystemLoadSaveManager;
import org.opensaml.core.xml.persist.XMLObjectLoadSaveManager;
+import org.opensaml.saml.common.binding.artifact.SAMLSourceIDArtifact;
+import org.opensaml.saml.criterion.ArtifactCriterion;
import org.opensaml.saml.metadata.resolver.impl.AbstractDynamicMetadataResolver;
import org.opensaml.saml.metadata.resolver.impl.FunctionDrivenDynamicHTTPMetadataResolver;
import org.opensaml.saml.metadata.resolver.impl.HTTPEntityIDRequestURLBuilder;
+import org.opensaml.saml.saml2.binding.artifact.SAML2ArtifactType0004;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
+import org.opensaml.security.crypto.JCAConstants;
import org.springframework.context.ApplicationContext;
import org.springframework.mock.env.MockPropertySource;
import org.testng.Assert;
@@ -59,6 +65,7 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
Assert.assertTrue(resolver.isRequireValidMetadata());
Assert.assertNull(resolver.getMetadataFilter());
Assert.assertNotNull(resolver.getParserPool());
+ Assert.assertTrue(resolver.getIndexes().isEmpty());
Assert.assertEquals(resolver.getNegativeLookupCacheDuration(), Long.valueOf(10*60*1000L));
Assert.assertEquals(resolver.getRefreshDelayFactor(), 0.75f);
@@ -87,6 +94,15 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
Assert.assertEquals(resolver.getRequestURLBuilder().getClass(), HTTPEntityIDRequestURLBuilder.class);
}
+
+ @Test
+ public void testIndexes() throws Exception {
+ final FunctionDrivenDynamicHTTPMetadataResolver resolver = getBean(FunctionDrivenDynamicHTTPMetadataResolver.class,
+ "dynamicIndexes.xml", "beans.xml");
+
+ Assert.assertFalse(resolver.getIndexes().isEmpty());
+ Assert.assertEquals(resolver.getIndexes().size(), 3);
+ }
@Test(enabled=false)
public void testDeprecated() throws Exception {
@@ -266,6 +282,26 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
}
@Test
+ public void testMDQWithSecondaryURLBuilderForArtifact() throws Exception {
+ final FunctionDrivenDynamicHTTPMetadataResolver resolver = getBean(FunctionDrivenDynamicHTTPMetadataResolver.class,
+ "dynamicMetadataQueryProtocolWithSecondaryURLBuilders.xml", "beans.xml");
+
+ final String entityID = "https://foo1.example.org/idp/shibboleth";
+ MessageDigest sha1Digester = MessageDigest.getInstance(JCAConstants.DIGEST_SHA1);
+ byte[] entityIDSourceID = sha1Digester.digest(entityID.getBytes("UTF-8"));
+ SecureRandom secureRandom = SecureRandom.getInstance("SHA1PRNG");
+ byte[] messageHandle = new byte[20];
+ secureRandom.nextBytes(messageHandle);
+ SAMLSourceIDArtifact sourceIDArtifact = new SAML2ArtifactType0004(new byte[] {0, 0} , entityIDSourceID, messageHandle);
+
+ final CriteriaSet criteriaSet = new CriteriaSet( new ArtifactCriterion(sourceIDArtifact));
+
+ final EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
+ Assert.assertNotNull(ed);
+ Assert.assertEquals(ed.getEntityID(), entityID);
+ }
+
+ @Test
public void testRegex() throws Exception {
MockPropertySource propSource = singletonPropertySource(PROP_MDURL,
RepositorySupport.buildHTTPResourceURL(REPO_IDP, "idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/$1.xml", false));
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/beans.xml b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/beans.xml
index a128f98..6595e15 100644
--- a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/beans.xml
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/beans.xml
@@ -81,6 +81,10 @@
<bean class="org.opensaml.saml.metadata.resolver.index.impl.SAMLArtifactMetadataIndex" />
</util:set>
+ <util:set id="metadata.MDQ.secondaryURLBuilders">
+ <bean class="org.opensaml.saml.metadata.resolver.impl.SAMLArtifactURLBuilder" />
+ </util:set>
+
<bean id="metadata.LocalDynamicSourceManager" class="org.opensaml.core.xml.persist.MapLoadSaveManager" />
<bean id="metadata.LocalDynamicSourceKeyGenerator" class="org.opensaml.saml.metadata.resolver.impl.IdentityEntityIDGenerator" />
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/dynamicIndexes.xml b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/dynamicIndexes.xml
new file mode 100644
index 0000000..1a44926
--- /dev/null
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/dynamicIndexes.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata:MetadataProvider xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:metadata="urn:mace:shibboleth:2.0:metadata" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
+ urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd"
+
+ id="dynamicDefaults" xsi:type="metadata:DynamicHTTPMetadataProvider" indexesRef="metadata.Indexes">
+
+</metadata:MetadataProvider>
+
\ No newline at end of file
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/dynamicMetadataQueryProtocolWithSecondaryURLBuilders.xml b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/dynamicMetadataQueryProtocolWithSecondaryURLBuilders.xml
new file mode 100644
index 0000000..ba08ea0
--- /dev/null
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/dynamicMetadataQueryProtocolWithSecondaryURLBuilders.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata:MetadataProvider xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:metadata="urn:mace:shibboleth:2.0:metadata" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
+ urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd"
+
+ id="dynamicMDQ" xsi:type="metadata:DynamicHTTPMetadataProvider" >
+
+ <metadata:MetadataQueryProtocol secondaryURLBuildersRef="metadata.MDQ.secondaryURLBuilders">
+ http://shibboleth.net:9000
+ </metadata:MetadataQueryProtocol>
+
+</metadata:MetadataProvider>
+
\ No newline at end of file
diff --git a/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd b/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd
index bcf85e5..998ab7e 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd
@@ -442,6 +442,15 @@
</documentation>
</annotation>
</attribute>
+ <attribute name="secondaryURLBuildersRef" type="string">
+ <annotation>
+ <documentation>
+ Reference to a list of secondary URL builders for non-entityID-based lookups.
+ The list should contain instances of the interface
+ org.opensaml.saml.metadata.resolver.impl.MetadataQueryProtocolRequestURLBuilder.MetadataQueryProtocolURLBuilder.
+ </documentation>
+ </annotation>
+ </attribute>
</extension>
</simpleContent>
</complexType>
@@ -698,6 +707,14 @@
<documentation>ID of the parser pool used to parse incoming metadata.</documentation>
</annotation>
</attribute>
+ <attribute name="indexesRef" type="string">
+ <annotation>
+ <documentation>
+ ID of a Set of MetadataIndex instances used to support resolution of metadata based on
+ criteria other than an entityID.
+ </documentation>
+ </annotation>
+ </attribute>
<attribute name="taskTimerRef" type="string">
<annotation>
<documentation>ID of the task timer used to schedule background refresh jobs.</documentation>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list