[java-identity-provider] branch master updated: IDP-1391 - Add a service layer for password validators.
Scott Cantor
cantor.2 at osu.edu
Thu Aug 8 10:54:01 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=fc47649192169a7de505b61866547be18a9d8c99
The following commit(s) were added to refs/heads/master by this push:
new fc47649 IDP-1391 - Add a service layer for password validators.
fc47649 is described below
commit fc47649192169a7de505b61866547be18a9d8c99
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Aug 8 10:53:58 2019 -0400
IDP-1391 - Add a service layer for password validators.
Refactor base classes and add activation condition.
---
.../idp/authn/AbstractCredentialValidator.java | 122 +++++++++++++++++++++
...bstractUsernamePasswordCredentialValidator.java | 43 +-------
2 files changed, 126 insertions(+), 39 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractCredentialValidator.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractCredentialValidator.java
new file mode 100644
index 0000000..149e8f2
--- /dev/null
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractCredentialValidator.java
@@ -0,0 +1,122 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.authn;
+
+import java.util.function.Predicate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import javax.security.auth.Subject;
+
+import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.google.common.base.Predicates;
+
+/**
+ * An abstract {@link CredentialValidator} that handles some common behavior.
+ *
+ * @since 4.0.0
+ */
+public abstract class AbstractCredentialValidator extends AbstractIdentifiedInitializableComponent
+ implements CredentialValidator {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractCredentialValidator.class);
+
+ /** Activation condition. */
+ @Nonnull private Predicate<ProfileRequestContext> activationCondition;
+
+ /** Cached log prefix. */
+ @Nullable private String logPrefix;
+
+ /** Constructor. */
+ public AbstractCredentialValidator() {
+ activationCondition = Predicates.alwaysTrue();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void setId(final String id) {
+ super.setId(id);
+ }
+
+ /**
+ * Set the activation condition controlling use of validator.
+ *
+ * @param condition condition to use
+ */
+ public void setActivationCondition(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ activationCondition = Constraint.isNotNull(condition, "Activation condition cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Subject validate(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Nonnull final AuthenticationContext authenticationContext,
+ @Nullable final WarningHandler warningHandler,
+ @Nullable final ErrorHandler errorHandler) throws Exception {
+ ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
+
+ if (!activationCondition.test(profileRequestContext)) {
+ log.debug("{} Activation condition was false, ignoring request", getLogPrefix());
+ return null;
+ }
+
+ return doValidate(profileRequestContext, authenticationContext, warningHandler, errorHandler);
+ }
+
+ /**
+ * Override method for subclasses to use to perform the actual validation.
+ *
+ * @param profileRequestContext profile request context
+ * @param authenticationContext authentication context
+ * @param warningHandler optional warning handler interface
+ * @param errorHandler optional error handler interface
+ *
+ * @return the validated result, or null if inapplicable
+ *
+ * @throws Exception if an error occurs
+ */
+ @Nullable protected abstract Subject doValidate(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Nonnull final AuthenticationContext authenticationContext,
+ @Nullable final WarningHandler warningHandler,
+ @Nullable final ErrorHandler errorHandler) throws Exception;
+
+ /**
+ * Return a prefix for logging messages for this component.
+ *
+ * @return a string for insertion at the beginning of any log messages
+ */
+ @Nonnull @NotEmpty protected String getLogPrefix() {
+ if (logPrefix == null) {
+ logPrefix = "Credential Validator " + (getId() != null ? getId() : "(unknown)") + ":";
+ }
+ return logPrefix;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordCredentialValidator.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordCredentialValidator.java
index 21b79e2..453921a 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordCredentialValidator.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordCredentialValidator.java
@@ -30,7 +30,6 @@ import net.shibboleth.idp.authn.context.UsernamePasswordContext;
import net.shibboleth.idp.authn.principal.PasswordPrincipal;
import net.shibboleth.idp.authn.principal.UsernamePrincipal;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -41,12 +40,11 @@ import org.slf4j.LoggerFactory;
/**
* An abstract {@link CredentialValidator} that checks for a {@link UsernamePasswordContext} and delegates
- * to subclasses to produce an {@link net.shibboleth.idp.authn.AuthenticationResult}.
+ * to subclasses to produce a result.
*
* @since 4.0.0
*/
-public abstract class AbstractUsernamePasswordCredentialValidator extends AbstractIdentifiedInitializableComponent
- implements CredentialValidator {
+public abstract class AbstractUsernamePasswordCredentialValidator extends AbstractCredentialValidator {
/** Default prefix for metrics. */
@Nonnull @NotEmpty private static final String DEFAULT_METRIC_NAME = "net.shibboleth.idp.authn.password";
@@ -66,21 +64,12 @@ public abstract class AbstractUsernamePasswordCredentialValidator extends Abstra
/** A regular expression to apply for acceptance testing. */
@Nullable private Pattern matchExpression;
- /** Cached log prefix. */
- @Nullable private String logPrefix;
-
/** Constructor. */
public AbstractUsernamePasswordCredentialValidator() {
usernamePasswordContextLookupStrategy = new ChildContextLookup<>(UsernamePasswordContext.class);
removeContextAfterValidation = true;
}
- /** {@inheritDoc} */
- @Override
- public void setId(final String id) {
- super.setId(id);
- }
-
/**
* Set the lookup strategy to locate the {@link UsernamePasswordContext}.
*
@@ -151,12 +140,12 @@ public abstract class AbstractUsernamePasswordCredentialValidator extends Abstra
/** {@inheritDoc} */
@Override
- public Subject validate(@Nonnull final ProfileRequestContext profileRequestContext,
+ protected Subject doValidate(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AuthenticationContext authenticationContext,
@Nullable final WarningHandler warningHandler,
@Nullable final ErrorHandler errorHandler) throws Exception {
- final UsernamePasswordContext upContext = getUsernamePasswordContext(authenticationContext);
+ final UsernamePasswordContext upContext = usernamePasswordContextLookupStrategy.apply(authenticationContext);
if (upContext == null) {
log.info("{} No UsernamePasswordContext available", getLogPrefix());
if (errorHandler != null) {
@@ -208,18 +197,6 @@ public abstract class AbstractUsernamePasswordCredentialValidator extends Abstra
@Nullable final ErrorHandler errorHandler) throws Exception;
/**
- * Get the {@link UsernamePasswordContext} to validate.
- *
- * @param authenticationContext parent context
- *
- * @return context to validate
- */
- @Nullable protected UsernamePasswordContext getUsernamePasswordContext(
- @Nonnull final AuthenticationContext authenticationContext) {
- return usernamePasswordContextLookupStrategy.apply(authenticationContext);
- }
-
- /**
* Decorate the subject with "standard" content from the validation
* and clean up as instructed.
*
@@ -242,17 +219,5 @@ public abstract class AbstractUsernamePasswordCredentialValidator extends Abstra
return subject;
}
-
- /**
- * Return a prefix for logging messages for this component.
- *
- * @return a string for insertion at the beginning of any log messages
- */
- @Nonnull @NotEmpty protected String getLogPrefix() {
- if (logPrefix == null) {
- logPrefix = "Credential Validator " + (getId() != null ? getId() : "(unknown)") + ":";
- }
- return logPrefix;
- }
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list