[java-opensaml] branch master updated: OSJ-248 - remove NameIDFormat elements from metadata
Scott Cantor
cantor.2 at osu.edu
Tue Sep 4 11:48:53 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=1c7771d2f2fdec337f711e557e11b138854897a8
The following commit(s) were added to refs/heads/master by this push:
new 1c7771d OSJ-248 - remove NameIDFormat elements from metadata
1c7771d is described below
commit 1c7771d2f2fdec337f711e557e11b138854897a8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Sep 4 11:48:46 2018 -0400
OSJ-248 - remove NameIDFormat elements from metadata
https://issues.shibboleth.net/jira/browse/OSJ-248
---
.../resolver/filter/impl/NameIDFormatFilter.java | 76 ++++++++++++++++------
.../filter/impl/NameIDFormatFilterTest.java | 19 +++++-
.../saml/saml2/metadata/InCommon-metadata.xml | 1 +
3 files changed, 76 insertions(+), 20 deletions(-)
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilter.java
index 5edcb0a..047237c 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilter.java
@@ -61,6 +61,9 @@ public class NameIDFormatFilter extends AbstractInitializableComponent implement
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(NameIDFormatFilter.class);
+ /** Whether to strip any existing Formats when adding new ones. */
+ private boolean removeExistingFormats;
+
/** Rules for adding formats. */
@Nonnull @NonnullElements private Multimap<Predicate<EntityDescriptor>,String> applyMap;
@@ -75,6 +78,20 @@ public class NameIDFormatFilter extends AbstractInitializableComponent implement
}
/**
+ * Set whether the filter should remove any existing formats from an entity to which it adds
+ * new ones.
+ *
+ * <p>Defaults to false (for compatibility).</p>
+ *
+ * @param flag flag to set
+ */
+ public void setRemoveExistingFormats(final boolean flag) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ removeExistingFormats = flag;
+ }
+
+ /**
* Set the mappings from {@link Predicate} to format collection to apply.
*
* @param rules rules to apply
@@ -117,31 +134,52 @@ public class NameIDFormatFilter extends AbstractInitializableComponent implement
protected void filterEntityDescriptor(@Nonnull final EntityDescriptor descriptor) {
for (final Map.Entry<Predicate<EntityDescriptor>,Collection<String>> entry : applyMap.asMap().entrySet()) {
if (!entry.getValue().isEmpty() && entry.getKey().apply(descriptor)) {
-
- for (final String format : entry.getValue()) {
- log.info("Adding NameIDFormat '{}' to EntityDescriptor '{}'", format,
- descriptor.getEntityID());
- for (final RoleDescriptor role : descriptor.getRoleDescriptors()) {
- if (role instanceof SPSSODescriptor) {
- final NameIDFormat nif = formatBuilder.buildObject();
- nif.setFormat(format);
- ((SPSSODescriptor) role).getNameIDFormats().add(nif);
- } else if (role instanceof AttributeAuthorityDescriptor) {
- final NameIDFormat nif = formatBuilder.buildObject();
- nif.setFormat(format);
- ((AttributeAuthorityDescriptor) role).getNameIDFormats().add(nif);
- } else if (role instanceof PDPDescriptor) {
- final NameIDFormat nif = formatBuilder.buildObject();
- nif.setFormat(format);
- ((PDPDescriptor) role).getNameIDFormats().add(nif);
- }
- }
+ for (final RoleDescriptor role : descriptor.getRoleDescriptors()) {
+ filterRoleDescriptor(role, entry.getValue());
}
}
}
}
/**
+ *
+ * Filters role descriptor.
+ *
+ * @param role role to modify
+ * @param formats formats to attach
+ */
+ protected void filterRoleDescriptor(@Nonnull final RoleDescriptor role,
+ @Nonnull @NonnullElements final Collection<String> formats) {
+
+ final Collection<NameIDFormat> roleFormats;
+
+ if (role instanceof SPSSODescriptor) {
+ roleFormats = ((SPSSODescriptor) role).getNameIDFormats();
+ } else if (role instanceof AttributeAuthorityDescriptor) {
+ roleFormats = ((AttributeAuthorityDescriptor) role).getNameIDFormats();
+ } else if (role instanceof PDPDescriptor) {
+ roleFormats = ((PDPDescriptor) role).getNameIDFormats();
+ } else {
+ return;
+ }
+
+ if (removeExistingFormats && !roleFormats.isEmpty()) {
+ log.debug("Removing existing NameIDFormats from {} role in EntityDescriptor '{}'",
+ role.getElementQName(), ((EntityDescriptor) role.getParent()).getEntityID());
+ roleFormats.clear();
+ }
+
+ for (final String format : formats) {
+ final NameIDFormat nif = formatBuilder.buildObject();
+ nif.setFormat(format);
+ log.info("Adding NameIDFormat '{}' to EntityDescriptor '{}'", format,
+ ((EntityDescriptor) role.getParent()).getEntityID());
+ roleFormats.add(nif);
+ }
+
+ }
+
+ /**
* Filters entities descriptor.
*
* @param descriptor entities descriptor to filter
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilterTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilterTest.java
index ca02640..8b5c3ea 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilterTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilterTest.java
@@ -78,7 +78,7 @@ public class NameIDFormatFilterTest extends XMLObjectBaseTestCase implements Pre
EntityIdCriterion key = new EntityIdCriterion("https://carmenwiki.osu.edu/shibboleth");
EntityDescriptor entity = metadataProvider.resolveSingle(new CriteriaSet(key));
Assert.assertNotNull(entity);
- Assert.assertEquals(entity.getSPSSODescriptor(SAMLConstants.SAML20P_NS).getNameIDFormats().size(), 2);
+ Assert.assertEquals(entity.getSPSSODescriptor(SAMLConstants.SAML20P_NS).getNameIDFormats().size(), 3);
key = new EntityIdCriterion("https://cms.psu.edu/Shibboleth");
entity = metadataProvider.resolveSingle(new CriteriaSet(key));
@@ -86,6 +86,23 @@ public class NameIDFormatFilterTest extends XMLObjectBaseTestCase implements Pre
Assert.assertEquals(entity.getSPSSODescriptor(SAMLConstants.SAML11P_NS).getNameIDFormats().size(), 1);
}
+ @Test
+ public void testWithRemoval() throws ComponentInitializationException, ResolverException {
+
+ metadataFilter.setRules(Collections.<Predicate<EntityDescriptor>,Collection<String>>singletonMap(this, formats));
+ metadataFilter.setRemoveExistingFormats(true);
+ metadataFilter.initialize();
+
+ metadataProvider.setMetadataFilter(metadataFilter);
+ metadataProvider.setId("test");
+ metadataProvider.initialize();
+
+ EntityIdCriterion key = new EntityIdCriterion("https://carmenwiki.osu.edu/shibboleth");
+ EntityDescriptor entity = metadataProvider.resolveSingle(new CriteriaSet(key));
+ Assert.assertNotNull(entity);
+ Assert.assertEquals(entity.getSPSSODescriptor(SAMLConstants.SAML20P_NS).getNameIDFormats().size(), 2);
+ }
+
/** {@inheritDoc} */
public boolean apply(EntityDescriptor input) {
return input.getEntityID().equals("https://carmenwiki.osu.edu/shibboleth");
diff --git a/opensaml-saml-impl/src/test/resources/org/opensaml/saml/saml2/metadata/InCommon-metadata.xml b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/saml2/metadata/InCommon-metadata.xml
index 9cbbf06..df4a71b 100644
--- a/opensaml-saml-impl/src/test/resources/org/opensaml/saml/saml2/metadata/InCommon-metadata.xml
+++ b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/saml2/metadata/InCommon-metadata.xml
@@ -1162,6 +1162,7 @@ tTupO/NdWvz8SvXU1qIOk9CTQ0D2b2OOftfUW+FuAQ==
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
+ <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
<md:AssertionConsumerService xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://carmenwiki.osu.edu/Shibboleth.sso/SAML/POST" index="1"/>
<md:AssertionConsumerService xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://carmenwiki.osu.edu/Shibboleth.sso/SAML/Artifact" index="2"/>
<md:AssertionConsumerService xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://carmenwiki.it.ohio-state.edu/Shibboleth.sso/SAML/POST" index="3"/>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list