[java-identity-provider] 01/08: Add new RPC resolver which operates on CriteriaSet and delegates.
Brent Putman
putmanb at georgetown.edu
Fri Sep 21 22:49:06 EDT 2018
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=1463decd92ee5879a64204619a03b5431bca0563
commit 1463decd92ee5879a64204619a03b5431bca0563
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Mar 15 21:53:33 2018 -0400
Add new RPC resolver which operates on CriteriaSet and delegates.
---
.../CriteriaRelyingPartyConfigurationResolver.java | 42 +++++
idp-profile-impl/pom.xml | 13 ++
...gCriteriaRelyingPartyConfigurationResolver.java | 189 +++++++++++++++++++++
...atingRelyingPartyConfigurationResolverTest.java | 116 +++++++++++++
4 files changed, 360 insertions(+)
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/relyingparty/CriteriaRelyingPartyConfigurationResolver.java b/idp-profile-api/src/main/java/net/shibboleth/idp/relyingparty/CriteriaRelyingPartyConfigurationResolver.java
new file mode 100644
index 0000000..15dde8f
--- /dev/null
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/relyingparty/CriteriaRelyingPartyConfigurationResolver.java
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.relyingparty;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.component.IdentifiedComponent;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.Resolver;
+
+/** Resolves a {@link RelyingPartyConfiguration} for a given {@link CriteriaSet}. */
+public interface CriteriaRelyingPartyConfigurationResolver extends Resolver<RelyingPartyConfiguration,CriteriaSet>,
+ IdentifiedComponent {
+
+ /**
+ * Return the default security configuration for the profile.
+ *
+ * @param profileId the profile ID (available via
+ * {@link net.shibboleth.idp.profile.config.ProfileConfiguration#getId()}
+ * @return the configured default configuration
+ */
+ @Nullable SecurityConfiguration getDefaultSecurityConfiguration(@Nonnull @NotEmpty final String profileId);
+
+}
\ No newline at end of file
diff --git a/idp-profile-impl/pom.xml b/idp-profile-impl/pom.xml
index 7a26bea..bb2fd26 100644
--- a/idp-profile-impl/pom.xml
+++ b/idp-profile-impl/pom.xml
@@ -80,6 +80,13 @@
<!-- Test Dependencies -->
<dependency>
<groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-core</artifactId>
+ <version>${opensaml.version}</version>
+ <type>test-jar</type>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
<artifactId>opensaml-profile-api</artifactId>
<type>test-jar</type>
<scope>test</scope>
@@ -91,6 +98,12 @@
</dependency>
<dependency>
<groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-saml-impl</artifactId>
+ <version>${opensaml.version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
<artifactId>opensaml-storage-impl</artifactId>
<scope>test</scope>
</dependency>
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DelegatingCriteriaRelyingPartyConfigurationResolver.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DelegatingCriteriaRelyingPartyConfigurationResolver.java
new file mode 100644
index 0000000..65aa413
--- /dev/null
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DelegatingCriteriaRelyingPartyConfigurationResolver.java
@@ -0,0 +1,189 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.relyingparty.impl;
+
+import java.util.Collections;
+import java.util.Iterator;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.core.criterion.EntityIdCriterion;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.criterion.RoleDescriptorCriterion;
+import org.opensaml.saml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml.saml2.metadata.RoleDescriptor;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.relyingparty.CriteriaRelyingPartyConfigurationResolver;
+import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
+import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.component.IdentifiableComponent;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.ResolverException;
+
+/**
+ * An implementation of {@link CriteriaRelyingPartyConfigurationResolver} which delegates to an instance of
+ * {@link RelyingPartyConfigurationResolver}.
+ *
+ * <p>
+ * One of the following input criteria is required for resolution based on relying party entityID:
+ * <ul>
+ * <li>{@link EntityIdCriterion}</li>
+ * <li>{@link RoleDescriptorCriterion}</li>
+ * </ul>
+ * </p>
+ */
+public class DelegatingCriteriaRelyingPartyConfigurationResolver extends AbstractIdentifiedInitializableComponent
+ implements CriteriaRelyingPartyConfigurationResolver, IdentifiableComponent {
+
+ /** Logger. */
+ private Logger log = LoggerFactory.getLogger(DelegatingCriteriaRelyingPartyConfigurationResolver.class);
+
+ /** The RelyingPartyConfigurationResolver to which to delegate. */
+ @NonnullAfterInit private RelyingPartyConfigurationResolver delegate;
+
+ /** Constructor. */
+ public DelegatingCriteriaRelyingPartyConfigurationResolver() {
+ super();
+ }
+
+ /**
+ * Set the {@link RelyingPartyConfigurationResolver} instance to which to delegate.
+ *
+ * @param resolver the resolver delegate instance
+ */
+ public void setDelegate(@Nullable final RelyingPartyConfigurationResolver resolver) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+ delegate = resolver;
+ }
+
+ /** {@inheritDoc} */
+ @Override public void setId(@Nonnull final String componentId) {
+ super.setId(componentId);
+ }
+
+ /** {@inheritDoc} */
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+ if (delegate == null) {
+ throw new ComponentInitializationException("RelyingPartyConfigurationResolver delegate was null");
+ }
+ }
+
+ /** {@inheritDoc} */
+ protected void doDestroy() {
+ delegate = null;
+ super.doDestroy();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public SecurityConfiguration getDefaultSecurityConfiguration(@Nonnull @NotEmpty final String profileId) {
+ ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+ return delegate.getDefaultSecurityConfiguration(profileId);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public RelyingPartyConfiguration resolveSingle(@Nullable final CriteriaSet criteria)
+ throws ResolverException {
+ ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+
+ final Iterator<RelyingPartyConfiguration> results = resolve(criteria).iterator();
+ if (results.hasNext()) {
+ return results.next();
+ } else {
+ return null;
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nonnull @NonnullElements public Iterable<RelyingPartyConfiguration> resolve(@Nullable final CriteriaSet criteria)
+ throws ResolverException {
+ ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+
+ final ProfileRequestContext prc = buildContext(criteria);
+ if (prc != null) {
+ return delegate.resolve(prc);
+ } else {
+ return Collections.emptyList();
+ }
+
+ }
+
+ /**
+ * Build and populate the synthetic instance of {@link ProfileRequestContext} which will be passed
+ * in the resolution call to the delegate.
+ *
+ * @param criteria the input criteria
+ * @return the synthetic context instance, or null if required data is not supplied
+ */
+ @Nullable private ProfileRequestContext buildContext(@Nullable final CriteriaSet criteria) {
+ if (criteria == null) {
+ return null;
+ }
+
+ final String entityID = resolveEntityID(criteria);
+ log.debug("Resolved effective entityID from criteria: {}", entityID);
+ if (entityID != null) {
+ final ProfileRequestContext prc = new ProfileRequestContext<>();
+ final RelyingPartyContext rp = prc.getSubcontext(RelyingPartyContext.class, true);
+ rp.setRelyingPartyId(entityID);
+ rp.setVerified(true);
+ return prc;
+ } else {
+ return null;
+ }
+ }
+
+ /**
+ * Resolve the entityID from the criteria.
+ *
+ * @param criteria the input criteria
+ * @return the input entityID criterion or null if could not be resolved
+ */
+ private String resolveEntityID(@Nonnull final CriteriaSet criteria) {
+ if (criteria.contains(EntityIdCriterion.class)) {
+ return criteria.get(EntityIdCriterion.class).getEntityId();
+ }
+
+ if (criteria.contains(RoleDescriptorCriterion.class)) {
+ final RoleDescriptor rd = criteria.get(RoleDescriptorCriterion.class).getRole();
+ if (rd.getParent() != null && rd.getParent() instanceof EntityDescriptor) {
+ return ((EntityDescriptor)rd.getParent()).getEntityID();
+ }
+ }
+
+ return null;
+ }
+
+}
diff --git a/idp-profile-impl/src/test/java/net/shibboleth/idp/relyingparty/impl/DelegatingRelyingPartyConfigurationResolverTest.java b/idp-profile-impl/src/test/java/net/shibboleth/idp/relyingparty/impl/DelegatingRelyingPartyConfigurationResolverTest.java
new file mode 100644
index 0000000..6de535f
--- /dev/null
+++ b/idp-profile-impl/src/test/java/net/shibboleth/idp/relyingparty/impl/DelegatingRelyingPartyConfigurationResolverTest.java
@@ -0,0 +1,116 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.relyingparty.impl;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Iterator;
+import java.util.List;
+
+import org.opensaml.core.criterion.EntityIdCriterion;
+import org.opensaml.core.xml.XMLObjectBaseTestCase;
+import org.opensaml.core.xml.util.XMLObjectSupport;
+import org.opensaml.saml.criterion.RoleDescriptorCriterion;
+import org.opensaml.saml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml.saml2.metadata.RoleDescriptor;
+import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
+import net.shibboleth.idp.saml.relyingparty.impl.RelyingPartyConfigurationSupport;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.ResolverException;
+
+/** Unit tests for {@link DelegatingCriteriaRelyingPartyConfigurationResolver. */
+public class DelegatingRelyingPartyConfigurationResolverTest extends XMLObjectBaseTestCase {
+
+ @Test
+ public void testResolve() throws ComponentInitializationException, ResolverException {
+ final RelyingPartyConfiguration anonRP = new RelyingPartyConfiguration();
+ anonRP.setId("anonRPId");
+ anonRP.setResponderId("anonRPResp");
+ anonRP.setDetailedErrors(true);
+ anonRP.initialize();
+
+ final RelyingPartyConfiguration defaultRP = new RelyingPartyConfiguration();
+ defaultRP.setId("defaultRPId");
+ defaultRP.setResponderId("defaultRPResp");
+ defaultRP.setDetailedErrors(true);
+ defaultRP.initialize();
+
+ final RelyingPartyConfiguration one = RelyingPartyConfigurationSupport.byName(Collections.singleton("rp1"));
+ one.setResponderId("foo");
+ one.setDetailedErrors(true);
+ one.initialize();
+
+ final RelyingPartyConfiguration two = RelyingPartyConfigurationSupport.byName(Collections.singleton("rp2"));
+ two.setResponderId("foo");
+ two.setDetailedErrors(true);
+ two.initialize();
+
+ final RelyingPartyConfiguration three = RelyingPartyConfigurationSupport.byName(Collections.singleton("rp3"));
+ three.setResponderId("foo");
+ three.setDetailedErrors(true);
+ three.initialize();
+
+ final List<RelyingPartyConfiguration> rpConfigs = Arrays.asList(one, two, three);
+
+ final DefaultRelyingPartyConfigurationResolver delegate = new DefaultRelyingPartyConfigurationResolver();
+ delegate.setId("delegate");
+ delegate.setRelyingPartyConfigurations(rpConfigs);
+ delegate.setUnverifiedConfiguration(anonRP);
+ delegate.setDefaultConfiguration(defaultRP);
+ delegate.initialize();
+
+ final DelegatingCriteriaRelyingPartyConfigurationResolver resolver = new DelegatingCriteriaRelyingPartyConfigurationResolver();
+ resolver.setId("resolver");
+ resolver.setDelegate(delegate);
+ resolver.initialize();
+
+ Iterable<RelyingPartyConfiguration> results = resolver.resolve(new CriteriaSet(new EntityIdCriterion("rp1")));
+ Assert.assertNotNull(results);
+
+ Iterator<RelyingPartyConfiguration> resultItr = results.iterator();
+ Assert.assertTrue(resultItr.hasNext());
+ Assert.assertSame(resultItr.next(), one);
+ Assert.assertFalse(resultItr.hasNext());
+
+ RelyingPartyConfiguration result = resolver.resolveSingle(new CriteriaSet(new EntityIdCriterion("rp2")));
+ Assert.assertSame(result, two);
+
+ EntityDescriptor ed = (EntityDescriptor) XMLObjectSupport.buildXMLObject(EntityDescriptor.DEFAULT_ELEMENT_NAME);
+ ed.setEntityID("rp3");
+ RoleDescriptor rd = (RoleDescriptor) XMLObjectSupport.buildXMLObject(SPSSODescriptor.DEFAULT_ELEMENT_NAME);
+ ed.getRoleDescriptors().add(rd);
+ result = resolver.resolveSingle(new CriteriaSet(new RoleDescriptorCriterion(rd)));
+ Assert.assertSame(result, three);
+
+ result = resolver.resolveSingle(new CriteriaSet(new EntityIdCriterion("doesNotExist")));
+ Assert.assertSame(result, defaultRP);
+
+ results = resolver.resolve(null);
+ Assert.assertNotNull(results);
+ Assert.assertFalse(results.iterator().hasNext());
+
+ result = resolver.resolveSingle(null);
+ Assert.assertNull(result);
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list