[java-opensaml] 16/16: Work on expected issuer and refactoring of TLS authN check.
Brent Putman
putmanb at georgetown.edu
Fri Sep 21 22:48:54 EDT 2018
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch master
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=d2f3944a94b128dca150173d0be11b9384c39292
commit d2f3944a94b128dca150173d0be11b9384c39292
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Fri Sep 21 21:34:31 2018 -0400
Work on expected issuer and refactoring of TLS authN check.
---
.../handler/impl/CheckExpectedIssuer.java | 7 ++
...ecordServerTLSEntityAuthenticationtHandler.java | 32 +--------
.../impl/OperationContextEntityIDLookup.java | 80 ++++++++++++++++++++++
3 files changed, 90 insertions(+), 29 deletions(-)
diff --git a/opensaml-messaging-impl/src/main/java/org/opensaml/messaging/handler/impl/CheckExpectedIssuer.java b/opensaml-messaging-impl/src/main/java/org/opensaml/messaging/handler/impl/CheckExpectedIssuer.java
index 333bf4e..68fcfe8 100644
--- a/opensaml-messaging-impl/src/main/java/org/opensaml/messaging/handler/impl/CheckExpectedIssuer.java
+++ b/opensaml-messaging-impl/src/main/java/org/opensaml/messaging/handler/impl/CheckExpectedIssuer.java
@@ -29,6 +29,8 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.AbstractMessageHandler;
import org.opensaml.messaging.handler.MessageHandlerException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
import com.google.common.base.Function;
@@ -36,6 +38,9 @@ import com.google.common.base.Function;
* Message handler that checks that a message context has an issuer.
*/
public final class CheckExpectedIssuer extends AbstractMessageHandler {
+
+ /** Logger. */
+ private Logger log = LoggerFactory.getLogger(CheckExpectedIssuer.class);
/** Strategy used to look up the issuer associated with the message context. */
@NonnullAfterInit private Function<MessageContext,String> issuerLookupStrategy;
@@ -94,6 +99,8 @@ public final class CheckExpectedIssuer extends AbstractMessageHandler {
throw new MessageHandlerException("Message context did not contain an expected issuer");
}
+ log.debug("Saw issuer '{}', expected issuer '{}'", issuer, expectedIssuer);
+
if (!Objects.equals(issuer, expectedIssuer)) {
throw new MessageHandlerException("Message context issuer did not match expected issuer");
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/CheckAndRecordServerTLSEntityAuthenticationtHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/CheckAndRecordServerTLSEntityAuthenticationtHandler.java
index 1dfc3fd..a1c0e27 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/CheckAndRecordServerTLSEntityAuthenticationtHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/CheckAndRecordServerTLSEntityAuthenticationtHandler.java
@@ -68,9 +68,11 @@ public class CheckAndRecordServerTLSEntityAuthenticationtHandler extends Abstrac
super();
entityContextClass = SAMLPeerEntityContext.class;
httpClientContextLookup = new DefaultHttpClientContextLookup();
- entityIDLookup = new DefaultEntityIDLookup();
+ entityIDLookup = new OperationContextEntityIDLookup(entityContextClass);
}
+
+
/**
* Set the strategy function for resolving the {@link HttpClientContext to evaluate}.
*
@@ -177,33 +179,5 @@ public class CheckAndRecordServerTLSEntityAuthenticationtHandler extends Abstrac
}
}
-
- /**
- * The default entityID strategy function, which resolves from the configured
- * {@link AbstractAuthenticatableSAMLEntityContext} of the parent {@link InOutOperationContext}.
- */
- public class DefaultEntityIDLookup implements ContextDataLookupFunction<MessageContext, String> {
-
- /** {@inheritDoc} */
- public String apply(@Nullable final MessageContext messageContext) {
- if (messageContext == null) {
- return null;
- }
-
- final InOutOperationContext opContext =
- new RecursiveTypedParentContextLookup<>(InOutOperationContext.class).apply(messageContext);
- if (opContext == null) {
- return null;
- }
-
- final AbstractAuthenticatableSAMLEntityContext entityContext = opContext.getSubcontext(entityContextClass);
- if (entityContext == null) {
- return null;
- }
-
- return entityContext.getEntityId();
- }
-
- }
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/OperationContextEntityIDLookup.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/OperationContextEntityIDLookup.java
new file mode 100644
index 0000000..492ffc6
--- /dev/null
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/OperationContextEntityIDLookup.java
@@ -0,0 +1,80 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.saml.common.binding.security.impl;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.InOutOperationContext;
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
+import org.opensaml.messaging.context.navigate.RecursiveTypedParentContextLookup;
+import org.opensaml.saml.common.messaging.context.AbstractAuthenticatableSAMLEntityContext;
+import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
+
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * Function for resolving the SAML entity ID from the parent {@link InOutOperationContext}.
+ */
+public class OperationContextEntityIDLookup implements ContextDataLookupFunction<MessageContext, String> {
+
+ /** The actual context class holding the authenticatable SAML entity. */
+ @Nonnull private Class<? extends AbstractAuthenticatableSAMLEntityContext> entityContextClass;
+
+ /** Parent operation context lookup function. */
+ @Nonnull private RecursiveTypedParentContextLookup<MessageContext,InOutOperationContext> parentLookup =
+ new RecursiveTypedParentContextLookup(InOutOperationContext.class);
+
+ /**
+ * Constructor.
+ */
+ public OperationContextEntityIDLookup() {
+ this(SAMLPeerEntityContext.class);
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param clazz the entity context class. Defaults to {@link SAMLPeerEntityContext}.
+ */
+ public OperationContextEntityIDLookup(
+ @Nonnull final Class<? extends AbstractAuthenticatableSAMLEntityContext> clazz) {
+ entityContextClass = Constraint.isNotNull(clazz, "The SAML Entity context class may not be null;");
+ }
+
+ /** {@inheritDoc} */
+ public String apply(@Nullable final MessageContext messageContext) {
+ if (messageContext == null) {
+ return null;
+ }
+
+ final InOutOperationContext opContext = parentLookup.apply(messageContext);
+ if (opContext == null) {
+ return null;
+ }
+
+ final AbstractAuthenticatableSAMLEntityContext entityContext = opContext.getSubcontext(entityContextClass);
+ if (entityContext == null) {
+ return null;
+ }
+
+ return entityContext.getEntityId();
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list