[java-identity-provider] branch master updated: Default to skipping AffiliationDescriptor checking, option to enable.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=9474a6cca8d994d40501150d75aef080c06e4307

The following commit(s) were added to refs/heads/master by this push:
       new  9474a6c   Default to skipping AffiliationDescriptor checking, option to enable.
9474a6c is described below

commit 9474a6cca8d994d40501150d75aef080c06e4307
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Sep 28 14:28:08 2018 -0400

    Default to skipping AffiliationDescriptor checking, option to enable.
---
 .../AttributeRequesterInEntityGroupPolicyRule.java   | 20 +++++++++++++++++++-
 .../AttributeRequesterInEntityGroupRuleParser.java   |  4 ++++
 .../src/main/resources/schema/shibboleth-afp.xsd     |  9 +++++++++
 3 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRule.java b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRule.java
index ccb83e0..d5c6d18 100644
--- a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRule.java
+++ b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRule.java
@@ -48,6 +48,9 @@ public class AttributeRequesterInEntityGroupPolicyRule extends AbstractPolicyRul
     /** The entity group to match against. */
     @Nullable private String entityGroup;
     
+    /** Whether to search metadata for AffiliationDescriptor membership. */
+    private boolean checkAffiliations;
+    
     /**
      * Gets the entity group to match against.
      * 
@@ -65,6 +68,20 @@ public class AttributeRequesterInEntityGroupPolicyRule extends AbstractPolicyRul
     public void setEntityGroup(@Nullable final String group) {
         entityGroup = StringSupport.trimOrNull(group);
     }
+    
+    /**
+     * Set whether to check a supplied {@link MetadataResolver} for membership in an AffiliationDescriptor
+     * as a form of group policy.
+     * 
+     * <p>Defaults to false.</p>
+     * 
+     * @param flag flag to set
+     * 
+     * @since 3.4.0
+     */
+    public void setCheckAffiliations(final boolean flag) {
+        checkAffiliations = flag;
+    }
 
     /**
      * Gets the entity descriptor for the entity to check.
@@ -103,7 +120,8 @@ public class AttributeRequesterInEntityGroupPolicyRule extends AbstractPolicyRul
         }
 
         final Predicate<EntityDescriptor> predicate =
-                new EntityGroupNamePredicate(Collections.singleton(entityGroup), input.getMetadataResolver());
+                new EntityGroupNamePredicate(Collections.singleton(entityGroup),
+                        checkAffiliations ? input.getMetadataResolver() : null);
         
         final EntityDescriptor entity = getEntityMetadata(input);
         return predicate.apply(entity) ? Tristate.TRUE : Tristate.FALSE;
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterInEntityGroupRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterInEntityGroupRuleParser.java
index 03e981b..69b4cf8 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterInEntityGroupRuleParser.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterInEntityGroupRuleParser.java
@@ -59,5 +59,9 @@ public class AttributeRequesterInEntityGroupRuleParser extends BasePolicyRulePar
             @Nonnull final BeanDefinitionBuilder builder) {
 
         builder.addPropertyValue("entityGroup", StringSupport.trimOrNull(element.getAttributeNS(null, "groupID")));
+        if (element.hasAttributeNS(null, "checkAffiliations")) {
+            builder.addPropertyValue("checkAffiliations",
+                    StringSupport.trimOrNull(element.getAttributeNS(null, "checkAffiliations")));
+        }
     }
 }
diff --git a/idp-schema/src/main/resources/schema/shibboleth-afp.xsd b/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
index c72f03e..fa63c9d 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
@@ -720,6 +720,15 @@
                         <documentation>The entity group ID that an entity must be in.</documentation>
                     </annotation>
                 </attribute>
+                <attribute name="checkAffiliations" type="string">
+                    <annotation>
+                        <documentation>
+                            Whether to check for membership in metadata-based AffiliationDescriptors.
+                            
+                            Defaults to false.
+                        </documentation>
+                    </annotation>
+                </attribute>
             </extension>
         </complexContent>
     </complexType>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.