[java-identity-provider] branch master updated: Add audit fields for requested principal types.
Scott Cantor
cantor.2 at osu.edu
Thu Aug 15 17:17:43 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=67737f4487f4bdb3262e83845ef90c6565230435
The following commit(s) were added to refs/heads/master by this push:
new 67737f4 Add audit fields for requested principal types.
67737f4 is described below
commit 67737f4487f4bdb3262e83845ef90c6565230435
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Aug 15 17:17:40 2019 -0400
Add audit fields for requested principal types.
---
.../net/shibboleth/idp/authn/AuthnAuditFields.java | 6 +++
...tedPrincipalContextOperatorLookupFunction.java} | 29 +++++++------
...tedPrincipalContextPrincipalLookupFunction.java | 47 ++++++++++++++++++++++
.../main/resources/system/conf/audit-system.xml | 30 ++++++++++++++
.../src/main/resources/system/conf/utilities.xml | 3 ++
.../net/shibboleth/idp/profile/IdPAuditFields.java | 2 +-
.../idp/saml/profile/SAMLAuditFields.java | 2 +-
7 files changed, 102 insertions(+), 17 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthnAuditFields.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthnAuditFields.java
index b3237fe..2c15476 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthnAuditFields.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthnAuditFields.java
@@ -26,6 +26,12 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
*/
public final class AuthnAuditFields {
+ /** Requested principal(s) operator field. @since 4.0.0 */
+ @Nonnull @NotEmpty public static final String REQ_PRINC_OP = "ROP";
+
+ /** Requested principal(s) field. @since 4.0.0 */
+ @Nonnull @NotEmpty public static final String REQ_PRINC = "RPRIN";
+
/** Authentication flow ID field. */
@Nonnull @NotEmpty public static final String AUTHN_FLOW_ID = "AF";
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthnAuditFields.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextOperatorLookupFunction.java
similarity index 56%
copy from idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthnAuditFields.java
copy to idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextOperatorLookupFunction.java
index b3237fe..599627a 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthnAuditFields.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextOperatorLookupFunction.java
@@ -15,26 +15,25 @@
* limitations under the License.
*/
-package net.shibboleth.idp.authn;
+package net.shibboleth.idp.authn.context.navigate;
-import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
-/**
- * Constants to use for audit logging fields stored in an {@link net.shibboleth.idp.profile.context.AuditContext}.
- */
-public final class AuthnAuditFields {
-
- /** Authentication flow ID field. */
- @Nonnull @NotEmpty public static final String AUTHN_FLOW_ID = "AF";
+import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
- /** SSO indicator signaling authentication was not "freshly" performed. */
- @Nonnull @NotEmpty public static final String SSO = "SSO";
-
- /** Constructor. */
- private AuthnAuditFields() {
+/** A function that returns {@link RequestedPrincipalContext#getOperator()}. */
+public class RequestedPrincipalContextOperatorLookupFunction
+ implements ContextDataLookupFunction<RequestedPrincipalContext,String> {
+ /** {@inheritDoc} */
+ @Nullable public String apply(@Nullable final RequestedPrincipalContext input) {
+
+ if (input != null) {
+ return input.getOperator();
+ }
+ return null;
}
}
\ No newline at end of file
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextPrincipalLookupFunction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextPrincipalLookupFunction.java
new file mode 100644
index 0000000..c728a74
--- /dev/null
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextPrincipalLookupFunction.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.authn.context.navigate;
+
+import java.security.Principal;
+import java.util.Collection;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
+
+import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
+
+import com.google.common.collect.Collections2;
+
+/**
+ * A function that returns {@link RequestedPrincipalContext#getRequestedPrincipals()} but
+ * transforms the values into strings.
+ */
+public class RequestedPrincipalContextPrincipalLookupFunction
+ implements ContextDataLookupFunction<RequestedPrincipalContext,Collection<String>> {
+
+ /** {@inheritDoc} */
+ @Nullable public Collection<String> apply(@Nullable final RequestedPrincipalContext input) {
+
+ if (input != null) {
+ return Collections2.transform(input.getRequestedPrincipals(), Principal::getName);
+ }
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-conf/src/main/resources/system/conf/audit-system.xml b/idp-conf/src/main/resources/system/conf/audit-system.xml
index 44b029b..599c359 100644
--- a/idp-conf/src/main/resources/system/conf/audit-system.xml
+++ b/idp-conf/src/main/resources/system/conf/audit-system.xml
@@ -386,6 +386,36 @@
</entry>
<entry>
<key>
+ <util:constant static-field="net.shibboleth.idp.authn.AuthnAuditFields.REQ_PRINC_OP"/>
+ </key>
+ <bean parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="net.shibboleth.idp.authn.context.navigate.RequestedPrincipalContextOperatorLookupFunction" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.ChildLookup.RequestedPrincipalContext"
+ c:f-ref="shibboleth.ChildLookup.AuthenticationContext" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.authn.AuthnAuditFields.REQ_PRINC"/>
+ </key>
+ <bean parent="shibboleth.Functions.Compose">
+ <constructor-arg name="g">
+ <bean class="net.shibboleth.idp.authn.context.navigate.RequestedPrincipalContextPrincipalLookupFunction" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.ChildLookup.RequestedPrincipalContext"
+ c:f-ref="shibboleth.ChildLookup.AuthenticationContext" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
<util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.USERNAME"/>
</key>
<bean parent="shibboleth.Functions.Compose"
diff --git a/idp-conf/src/main/resources/system/conf/utilities.xml b/idp-conf/src/main/resources/system/conf/utilities.xml
index ba51221..f11b383 100644
--- a/idp-conf/src/main/resources/system/conf/utilities.xml
+++ b/idp-conf/src/main/resources/system/conf/utilities.xml
@@ -152,6 +152,9 @@
<bean id="shibboleth.ChildLookup.AuthenticationContext"
class="org.opensaml.messaging.context.navigate.ChildContextLookup"
c:type="#{ T(net.shibboleth.idp.authn.context.AuthenticationContext) }" />
+ <bean id="shibboleth.ChildLookup.RequestedPrincipalContext"
+ class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+ c:type="#{ T(net.shibboleth.idp.authn.context.RequestedPrincipalContext) }" />
<bean id="shibboleth.ChildLookup.MultiFactorAuthenticationContext"
class="org.opensaml.messaging.context.navigate.ChildContextLookup"
c:type="#{ T(net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext) }" />
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPAuditFields.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPAuditFields.java
index 6a0f295..0a960fc 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPAuditFields.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPAuditFields.java
@@ -41,7 +41,7 @@ public final class IdPAuditFields {
/** URI field. */
@Nonnull @NotEmpty public static final String URI = "URI";
- /** Destination URL field. {@since 4.0.0} */
+ /** Destination URL field. @since 4.0.0 */
@Nonnull @NotEmpty public static final String DESTINATION_URL = "DEST";
/** Session ID field. */
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
index f0a1833..ebbd0ee 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
@@ -92,7 +92,7 @@ public final class SAMLAuditFields {
/** ForceAuthn requested field. */
@Nonnull @NotEmpty public static final String FORCE_AUTHN = "fauth";
- /** Signed inbound message field. {@since 4.0.0} */
+ /** Signed inbound message field. @since 4.0.0 */
@Nonnull @NotEmpty public static final String SIGNING = "XX";
/** Encryption field. */
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list