[java-identity-provider] 07/08: SAML artifact consumer profile config and SOAP pipeline usage thereof.
Brent Putman
putmanb at georgetown.edu
Fri Sep 21 22:49:12 EDT 2018
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=eecc855ae6cdef86535b5b60a2e5b299f0233e0c
commit eecc855ae6cdef86535b5b60a2e5b299f0233e0c
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Fri Sep 21 21:36:33 2018 -0400
SAML artifact consumer profile config and SOAP pipeline usage thereof.
---
.../src/main/resources/system/conf/soap-client.xml | 29 ++++++--
.../messaging/AbstractRelyingPartyPredicate.java | 77 ++++++++++++++++++++++
.../SAMLArtifactConsumerProfileConfiguration.java | 47 +++++++++++++
.../ClientTLSArtifactRequestsPredicate.java | 47 +++++++++++++
.../messaging/SignArtifactRequestsPredicate.java | 47 +++++++++++++
...ractSAML2ArtifactAwareProfileConfiguration.java | 46 ++++++++++++-
.../AttributeQueryProfileConfigurationTest.java | 28 ++++++--
.../config/BrowserSSOProfileConfigurationTest.java | 18 +++++
.../SingleLogoutProfileConfigurationTest.java | 26 +++++++-
9 files changed, 350 insertions(+), 15 deletions(-)
diff --git a/idp-conf/src/main/resources/system/conf/soap-client.xml b/idp-conf/src/main/resources/system/conf/soap-client.xml
index ed2613e..9af5f4f 100644
--- a/idp-conf/src/main/resources/system/conf/soap-client.xml
+++ b/idp-conf/src/main/resources/system/conf/soap-client.xml
@@ -68,6 +68,7 @@
<bean scope="prototype" class="org.opensaml.saml.common.binding.impl.PopulateSignatureSigningParametersHandler"
p:signatureSigningParametersResolver-ref="shibboleth.SignatureSigningParametersResolver"
p:configurationLookupStrategy-ref="shibboleth.MessageContext.SignatureSigningConfigurationLookup"
+ p:activationCondition-ref="SOAPClient.SignArtifactRequestsPredicate"
/>
<bean scope="prototype" class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler" />
@@ -84,6 +85,7 @@
<bean scope="prototype" class="org.opensaml.security.messaging.impl.PopulateHttpClientSecurityParametersHandler"
p:httpClientSecurityParametersResolver-ref="shibboleth.HttpClientSecurityParametersResolver"
p:configurationLookupStrategy-ref="shibboleth.MessageContext.HttpClientSecurityConfigurationLookup"
+ p:clientTLSPredicate-ref="SOAPClient.ClientTLSArtifactRequestsPredicate"
/>
</util:list>
</property>
@@ -95,7 +97,8 @@
<property name="handlers">
<util:list>
- <bean scope="prototype" class="org.opensaml.saml.common.binding.security.impl.CheckAndRecordServerTLSEntityAuthenticationtHandler" />
+ <bean scope="prototype" class="org.opensaml.saml.common.binding.security.impl.CheckAndRecordServerTLSEntityAuthenticationtHandler"
+ p:entityIDLookup-ref="SOAPClient.OperationContextEntityIDLookup" />
<bean scope="prototype" class="org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler"
p:copyContextLookup-ref="SOAPClient.OperationContextLookup">
@@ -115,11 +118,13 @@
<bean scope="prototype" class="org.opensaml.saml.common.binding.security.impl.SAMLProtocolMessageXMLSignatureSecurityHandler" />
- <bean scope="prototype" class="org.opensaml.messaging.handler.impl.CheckMandatoryIssuer">
- <property name="issuerLookupStrategy">
- <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLMessageContextIssuerFunction" />
- </property>
- </bean>
+ <bean scope="prototype" class="org.opensaml.messaging.handler.impl.CheckMandatoryIssuer"
+ p:issuerLookupStrategy-ref="SOAPClient.SAMLMessageContextIssuerFunction" />
+
+ <bean scope="prototype" class="org.opensaml.messaging.handler.impl.CheckExpectedIssuer"
+ p:issuerLookupStrategy-ref="SOAPClient.SAMLMessageContextIssuerFunction"
+ p:expectedIssuerLookupStrategy-ref="SOAPClient.OperationContextEntityIDLookup"
+ />
<bean scope="prototype" class="org.opensaml.messaging.handler.impl.CheckMandatoryAuthentication">
<property name="authenticationLookupStrategy">
@@ -142,6 +147,18 @@
class="org.opensaml.messaging.context.navigate.RecursiveTypedParentContextLookup"
c:targetClass="#{T(org.opensaml.messaging.context.InOutOperationContext)}" />
+ <bean id="SOAPClient.OperationContextEntityIDLookup"
+ class="org.opensaml.saml.common.binding.security.impl.OperationContextEntityIDLookup" />
+
+ <bean id="SOAPClient.SAMLMessageContextIssuerFunction"
+ class="org.opensaml.saml.common.messaging.context.navigate.SAMLMessageContextIssuerFunction" />
+
+ <bean id="SOAPClient.SignArtifactRequestsPredicate"
+ class="net.shibboleth.idp.saml.profile.config.logic.messaging.SignArtifactRequestsPredicate" />
+
+ <bean id="SOAPClient.ClientTLSArtifactRequestsPredicate"
+ class="net.shibboleth.idp.saml.profile.config.logic.messaging.ClientTLSArtifactRequestsPredicate" />
+
<bean id="SOAPClient.SOAPClientSecurityProfileIdLookup"
class="org.opensaml.soap.client.security.SOAPClientSecurityProfileIdLookupFunction" />
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/messaging/AbstractRelyingPartyPredicate.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/messaging/AbstractRelyingPartyPredicate.java
new file mode 100644
index 0000000..29ccbc1
--- /dev/null
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/messaging/AbstractRelyingPartyPredicate.java
@@ -0,0 +1,77 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.profile.logic.messaging;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.messaging.context.InOutOperationContext;
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.messaging.context.navigate.RecursiveTypedParentContextLookup;
+
+import com.google.common.base.Function;
+import com.google.common.base.Functions;
+import com.google.common.base.Predicate;
+
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * Abstract base class for a predicate that evaluates a {@link MessageContext}
+ * and which requires a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link InOutOperationContext}
+ * the parent of the specified {@link MessageContext}.
+ */
+public abstract class AbstractRelyingPartyPredicate implements Predicate<MessageContext> {
+
+ /**
+ * Strategy used to locate the {@link RelyingPartyContext} associated with a given {@link MessageContext}.
+ */
+ @Nonnull private Function<MessageContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
+
+ /** Constructor. */
+ public AbstractRelyingPartyPredicate() {
+ relyingPartyContextLookupStrategy = Functions.compose(
+ new ChildContextLookup<InOutOperationContext, RelyingPartyContext>(RelyingPartyContext.class),
+ new RecursiveTypedParentContextLookup<MessageContext,InOutOperationContext>(InOutOperationContext.class)
+ );
+ }
+
+ /**
+ * Set the strategy used to locate the {@link RelyingPartyContext} associated with a given
+ * {@link MessageContext}.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setRelyingPartyContextLookupStrategy(
+ @Nonnull final Function<MessageContext,RelyingPartyContext> strategy) {
+ relyingPartyContextLookupStrategy =
+ Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
+ }
+
+ /**
+ * Get the strategy used to locate the {@link RelyingPartyContext} associated with a given
+ * {@link MessageContext}.
+ *
+ * @return lookup strategy
+ */
+ @Nonnull public Function<MessageContext,RelyingPartyContext> getRelyingPartyContextLookupStrategy() {
+ return relyingPartyContextLookupStrategy;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/SAMLArtifactConsumerProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/SAMLArtifactConsumerProfileConfiguration.java
new file mode 100644
index 0000000..35a2cff
--- /dev/null
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/SAMLArtifactConsumerProfileConfiguration.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.profile.config;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.messaging.context.MessageContext;
+
+import com.google.common.base.Predicate;
+
+/**
+ * Common interface for SAML profile configurations involving artifact consumption, for example artifact
+ * resolution requests.
+ */
+public interface SAMLArtifactConsumerProfileConfiguration extends SAMLProfileConfiguration {
+
+ /**
+ * Get the predicate used to determine if artifact resolution requests should be signed.
+ *
+ * @return predicate used to determine if artifact resolution requests should be signed
+ */
+ @Nonnull Predicate<MessageContext> getSignArtifactRequests();
+
+ /**
+ * Get the predicate used to determine if artifact resolution requests should use client TLS.
+ *
+ * @return predicate used to determine if artifact resolution requests should use client TLS
+ */
+ @Nonnull Predicate<MessageContext> getClientTLSArtifactRequests();
+
+
+}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/messaging/ClientTLSArtifactRequestsPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/messaging/ClientTLSArtifactRequestsPredicate.java
new file mode 100644
index 0000000..388adc8
--- /dev/null
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/messaging/ClientTLSArtifactRequestsPredicate.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.profile.config.logic.messaging;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.logic.messaging.AbstractRelyingPartyPredicate;
+import net.shibboleth.idp.saml.profile.config.SAMLArtifactConsumerProfileConfiguration;
+
+/** A predicate implementation that forwards to
+ * {@link SAMLArtifactConsumerProfileConfiguration#getClientTLSArtifactRequests()}. */
+public class ClientTLSArtifactRequestsPredicate extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean apply(@Nullable final MessageContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null && pc instanceof SAMLArtifactConsumerProfileConfiguration) {
+ return ((SAMLArtifactConsumerProfileConfiguration) pc).getClientTLSArtifactRequests().apply(input);
+ }
+ }
+
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/messaging/SignArtifactRequestsPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/messaging/SignArtifactRequestsPredicate.java
new file mode 100644
index 0000000..3f2601d
--- /dev/null
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/messaging/SignArtifactRequestsPredicate.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.profile.config.logic.messaging;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.logic.messaging.AbstractRelyingPartyPredicate;
+import net.shibboleth.idp.saml.profile.config.SAMLArtifactConsumerProfileConfiguration;
+
+/** A predicate implementation that forwards to
+ * {@link SAMLArtifactConsumerProfileConfiguration#getSignArtifactRequests()}. */
+public class SignArtifactRequestsPredicate extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean apply(@Nullable final MessageContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null && pc instanceof SAMLArtifactConsumerProfileConfiguration) {
+ return ((SAMLArtifactConsumerProfileConfiguration) pc).getSignArtifactRequests().apply(input);
+ }
+ }
+
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ArtifactAwareProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ArtifactAwareProfileConfiguration.java
index 44b4308..290abae 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ArtifactAwareProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ArtifactAwareProfileConfiguration.java
@@ -21,11 +21,17 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import com.google.common.base.Function;
+import com.google.common.base.Predicate;
+import com.google.common.base.Predicates;
+
+import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.saml.profile.config.SAMLArtifactAwareProfileConfiguration;
import net.shibboleth.idp.saml.profile.config.SAMLArtifactConfiguration;
+import net.shibboleth.idp.saml.profile.config.SAMLArtifactConsumerProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
@@ -35,10 +41,16 @@ import net.shibboleth.utilities.java.support.logic.FunctionSupport;
*/
public abstract class AbstractSAML2ArtifactAwareProfileConfiguration
extends AbstractSAML2ProfileConfiguration
- implements SAMLArtifactAwareProfileConfiguration {
+ implements SAMLArtifactAwareProfileConfiguration, SAMLArtifactConsumerProfileConfiguration {
/** Lookup function to supply <code>artifactConfiguration</code> property. */
@Nonnull private Function<ProfileRequestContext,SAMLArtifactConfiguration> artifactConfigurationLookupStrategy;
+
+ /** Predicate used to determine if artifact resolution requests should be signed. */
+ @Nonnull private Predicate<MessageContext> signArtifactRequestsPredicate;
+
+ /** Predicate used to determine if artifact resolution requests should use client TLS. */
+ @Nonnull private Predicate<MessageContext> clientTLSArtifactRequestsPredicate;
/**
* Constructor.
@@ -48,6 +60,8 @@ public abstract class AbstractSAML2ArtifactAwareProfileConfiguration
protected AbstractSAML2ArtifactAwareProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
artifactConfigurationLookupStrategy = FunctionSupport.constant(null);
+ signArtifactRequestsPredicate = Predicates.alwaysFalse();
+ clientTLSArtifactRequestsPredicate = Predicates.alwaysFalse();
}
/** {@inheritDoc} */
@@ -77,4 +91,34 @@ public abstract class AbstractSAML2ArtifactAwareProfileConfiguration
? strategy : FunctionSupport.<ProfileRequestContext,SAMLArtifactConfiguration>constant(null);
}
+ /** {@inheritDoc} */
+ public Predicate<MessageContext> getSignArtifactRequests() {
+ return signArtifactRequestsPredicate;
+ }
+
+ /**
+ * Set the predicate used to determine if artifact resolution requests should be signed.
+ *
+ * @param predicate the predicate
+ */
+ public void setSignArtifactRequests(@Nonnull final Predicate<MessageContext> predicate) {
+ signArtifactRequestsPredicate = Constraint.isNotNull(predicate,
+ "Predicate used to determine artifact request signing may not be null");
+ }
+
+ /** {@inheritDoc} */
+ public Predicate<MessageContext> getClientTLSArtifactRequests() {
+ return clientTLSArtifactRequestsPredicate;
+ }
+
+ /**
+ * Set the predicate used to determine if artifact resolution requests should use client TLS.
+ *
+ * @param predicate the predicate
+ */
+ public void setClientTLSArtifactRequests(@Nonnull final Predicate<MessageContext> predicate) {
+ clientTLSArtifactRequestsPredicate = Constraint.isNotNull(predicate,
+ "Predicate used to determine artifact client TLS use may not be null");
+ }
+
}
\ No newline at end of file
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java
index 3a9e1a9..348cc35 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java
@@ -17,15 +17,17 @@
package net.shibboleth.idp.saml.saml2.profile.config;
-import net.shibboleth.idp.saml.profile.config.BasicSAMLArtifactConfiguration;
-import net.shibboleth.idp.saml.profile.config.SAMLArtifactConfiguration;
-import net.shibboleth.idp.saml.saml2.profile.config.AttributeQueryProfileConfiguration;
-
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
+import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.testng.Assert;
import org.testng.annotations.Test;
+import com.google.common.base.Predicates;
+
+import net.shibboleth.idp.saml.profile.config.BasicSAMLArtifactConfiguration;
+import net.shibboleth.idp.saml.profile.config.SAMLArtifactConfiguration;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
+
/** Unit test for {@link AttributeQueryProfileConfiguration}. */
public class AttributeQueryProfileConfigurationTest {
@@ -59,5 +61,21 @@ public class AttributeQueryProfileConfigurationTest {
Assert.assertSame(config.getArtifactConfiguration(), artifactConfiguration);
}
+
+ @Test
+ public void testSignArtifactRequests() {
+ final AttributeQueryProfileConfiguration config = new AttributeQueryProfileConfiguration();
+
+ config.setSignArtifactRequests(Predicates.<MessageContext>alwaysTrue());
+ Assert.assertSame(config.getSignArtifactRequests(), Predicates.<MessageContext>alwaysTrue());
+ }
+
+ @Test
+ public void testClientTLSArtifactRequests() {
+ final AttributeQueryProfileConfiguration config = new AttributeQueryProfileConfiguration();
+
+ config.setClientTLSArtifactRequests(Predicates.<MessageContext>alwaysTrue());
+ Assert.assertSame(config.getClientTLSArtifactRequests(), Predicates.<MessageContext>alwaysTrue());
+ }
}
\ No newline at end of file
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java
index fe1b9f3..e5cf722 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java
@@ -29,6 +29,7 @@ import java.util.HashSet;
import java.util.List;
import java.util.Set;
+import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.testng.Assert;
import org.testng.annotations.Test;
@@ -300,5 +301,22 @@ public class BrowserSSOProfileConfigurationTest {
FunctionSupport.<ProfileRequestContext,Collection<String>>constant(formats));
Assert.assertEquals(config.getNameIDFormatPrecedence(), formats);
}
+
+ @Test
+ public void testSignArtifactRequests() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+
+ config.setSignArtifactRequests(Predicates.<MessageContext>alwaysTrue());
+ Assert.assertSame(config.getSignArtifactRequests(), Predicates.<MessageContext>alwaysTrue());
+ }
+
+ @Test
+ public void testClientTLSArtifactRequests() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+
+ config.setClientTLSArtifactRequests(Predicates.<MessageContext>alwaysTrue());
+ Assert.assertSame(config.getClientTLSArtifactRequests(), Predicates.<MessageContext>alwaysTrue());
+ }
+
}
\ No newline at end of file
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfigurationTest.java
index 5d8fd31..be6dbfc 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfigurationTest.java
@@ -17,13 +17,17 @@
package net.shibboleth.idp.saml.saml2.profile.config;
-import net.shibboleth.idp.saml.profile.config.BasicSAMLArtifactConfiguration;
-import net.shibboleth.idp.saml.profile.config.SAMLArtifactConfiguration;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
+import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.testng.Assert;
import org.testng.annotations.Test;
+import com.google.common.base.Predicates;
+
+import net.shibboleth.idp.saml.profile.config.BasicSAMLArtifactConfiguration;
+import net.shibboleth.idp.saml.profile.config.SAMLArtifactConfiguration;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
+
/** Unit test for {@link SingleLogoutProfileConfiguration}. */
public class SingleLogoutProfileConfigurationTest {
@@ -57,5 +61,21 @@ public class SingleLogoutProfileConfigurationTest {
Assert.assertSame(config.getArtifactConfiguration(), artifactConfiguration);
}
+
+ @Test
+ public void testSignArtifactRequests() {
+ final SingleLogoutProfileConfiguration config = new SingleLogoutProfileConfiguration();
+
+ config.setSignArtifactRequests(Predicates.<MessageContext>alwaysTrue());
+ Assert.assertSame(config.getSignArtifactRequests(), Predicates.<MessageContext>alwaysTrue());
+ }
+
+ @Test
+ public void testClientTLSArtifactRequests() {
+ final SingleLogoutProfileConfiguration config = new SingleLogoutProfileConfiguration();
+
+ config.setClientTLSArtifactRequests(Predicates.<MessageContext>alwaysTrue());
+ Assert.assertSame(config.getClientTLSArtifactRequests(), Predicates.<MessageContext>alwaysTrue());
+ }
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list