[java-identity-provider] branch master updated: Add audit fields for requested principal types.

Scott Cantor cantor.2 at osu.edu
Thu Aug 15 17:17:43 EDT 2019


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=67737f4487f4bdb3262e83845ef90c6565230435

The following commit(s) were added to refs/heads/master by this push:
       new  67737f4   Add audit fields for requested principal types.
67737f4 is described below

commit 67737f4487f4bdb3262e83845ef90c6565230435
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Aug 15 17:17:40 2019 -0400

    Add audit fields for requested principal types.
---
 .../net/shibboleth/idp/authn/AuthnAuditFields.java |  6 +++
 ...tedPrincipalContextOperatorLookupFunction.java} | 29 +++++++------
 ...tedPrincipalContextPrincipalLookupFunction.java | 47 ++++++++++++++++++++++
 .../main/resources/system/conf/audit-system.xml    | 30 ++++++++++++++
 .../src/main/resources/system/conf/utilities.xml   |  3 ++
 .../net/shibboleth/idp/profile/IdPAuditFields.java |  2 +-
 .../idp/saml/profile/SAMLAuditFields.java          |  2 +-
 7 files changed, 102 insertions(+), 17 deletions(-)

diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthnAuditFields.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthnAuditFields.java
index b3237fe..2c15476 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthnAuditFields.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthnAuditFields.java
@@ -26,6 +26,12 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
  */
 public final class AuthnAuditFields {
 
+    /** Requested principal(s) operator field. @since 4.0.0 */
+    @Nonnull @NotEmpty public static final String REQ_PRINC_OP = "ROP";
+
+    /** Requested principal(s) field. @since 4.0.0 */
+    @Nonnull @NotEmpty public static final String REQ_PRINC = "RPRIN";
+
     /** Authentication flow ID field. */
     @Nonnull @NotEmpty public static final String AUTHN_FLOW_ID = "AF";
 
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthnAuditFields.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextOperatorLookupFunction.java
similarity index 56%
copy from idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthnAuditFields.java
copy to idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextOperatorLookupFunction.java
index b3237fe..599627a 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthnAuditFields.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextOperatorLookupFunction.java
@@ -15,26 +15,25 @@
  * limitations under the License.
  */
 
-package net.shibboleth.idp.authn;
+package net.shibboleth.idp.authn.context.navigate;
 
-import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
 
-/**
- * Constants to use for audit logging fields stored in an {@link net.shibboleth.idp.profile.context.AuditContext}.
- */
-public final class AuthnAuditFields {
-
-    /** Authentication flow ID field. */
-    @Nonnull @NotEmpty public static final String AUTHN_FLOW_ID = "AF";
+import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
 
-    /** SSO indicator signaling authentication was not "freshly" performed. */
-    @Nonnull @NotEmpty public static final String SSO = "SSO";
-    
-    /** Constructor. */
-    private AuthnAuditFields() {
+/** A function that returns {@link RequestedPrincipalContext#getOperator()}. */
+public class RequestedPrincipalContextOperatorLookupFunction
+        implements ContextDataLookupFunction<RequestedPrincipalContext,String> {
 
+    /** {@inheritDoc} */
+    @Nullable public String apply(@Nullable final RequestedPrincipalContext input) {
+        
+        if (input != null) {
+            return input.getOperator();
+        }
+        return null;
     }
 
 }
\ No newline at end of file
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextPrincipalLookupFunction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextPrincipalLookupFunction.java
new file mode 100644
index 0000000..c728a74
--- /dev/null
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextPrincipalLookupFunction.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.authn.context.navigate;
+
+import java.security.Principal;
+import java.util.Collection;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
+
+import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
+
+import com.google.common.collect.Collections2;
+
+/**
+ * A function that returns {@link RequestedPrincipalContext#getRequestedPrincipals()} but
+ * transforms the values into strings.
+ */
+public class RequestedPrincipalContextPrincipalLookupFunction
+        implements ContextDataLookupFunction<RequestedPrincipalContext,Collection<String>> {
+
+    /** {@inheritDoc} */
+    @Nullable public Collection<String> apply(@Nullable final RequestedPrincipalContext input) {
+        
+        if (input != null) {
+            return Collections2.transform(input.getRequestedPrincipals(), Principal::getName);
+        }
+        return null;
+    }
+
+}
\ No newline at end of file
diff --git a/idp-conf/src/main/resources/system/conf/audit-system.xml b/idp-conf/src/main/resources/system/conf/audit-system.xml
index 44b029b..599c359 100644
--- a/idp-conf/src/main/resources/system/conf/audit-system.xml
+++ b/idp-conf/src/main/resources/system/conf/audit-system.xml
@@ -386,6 +386,36 @@
                 </entry>
                 <entry>
                     <key>
+                        <util:constant static-field="net.shibboleth.idp.authn.AuthnAuditFields.REQ_PRINC_OP"/>
+                    </key>
+                    <bean parent="shibboleth.Functions.Compose">
+                        <constructor-arg name="g">
+                            <bean class="net.shibboleth.idp.authn.context.navigate.RequestedPrincipalContextOperatorLookupFunction" />
+                        </constructor-arg>
+                        <constructor-arg name="f">
+                            <bean parent="shibboleth.Functions.Compose"
+                                c:g-ref="shibboleth.ChildLookup.RequestedPrincipalContext"
+                                c:f-ref="shibboleth.ChildLookup.AuthenticationContext" />
+                        </constructor-arg>
+                    </bean>
+                </entry>
+                <entry>
+                    <key>
+                        <util:constant static-field="net.shibboleth.idp.authn.AuthnAuditFields.REQ_PRINC"/>
+                    </key>
+                    <bean parent="shibboleth.Functions.Compose">
+                        <constructor-arg name="g">
+                            <bean class="net.shibboleth.idp.authn.context.navigate.RequestedPrincipalContextPrincipalLookupFunction" />
+                        </constructor-arg>
+                        <constructor-arg name="f">
+                            <bean parent="shibboleth.Functions.Compose"
+                                c:g-ref="shibboleth.ChildLookup.RequestedPrincipalContext"
+                                c:f-ref="shibboleth.ChildLookup.AuthenticationContext" />
+                        </constructor-arg>
+                    </bean>
+                </entry>
+                <entry>
+                    <key>
                         <util:constant static-field="net.shibboleth.idp.profile.IdPAuditFields.USERNAME"/>
                     </key>
                     <bean parent="shibboleth.Functions.Compose"
diff --git a/idp-conf/src/main/resources/system/conf/utilities.xml b/idp-conf/src/main/resources/system/conf/utilities.xml
index ba51221..f11b383 100644
--- a/idp-conf/src/main/resources/system/conf/utilities.xml
+++ b/idp-conf/src/main/resources/system/conf/utilities.xml
@@ -152,6 +152,9 @@
     <bean id="shibboleth.ChildLookup.AuthenticationContext"
         class="org.opensaml.messaging.context.navigate.ChildContextLookup"
         c:type="#{ T(net.shibboleth.idp.authn.context.AuthenticationContext) }" />
+    <bean id="shibboleth.ChildLookup.RequestedPrincipalContext"
+        class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+        c:type="#{ T(net.shibboleth.idp.authn.context.RequestedPrincipalContext) }" />
     <bean id="shibboleth.ChildLookup.MultiFactorAuthenticationContext"
         class="org.opensaml.messaging.context.navigate.ChildContextLookup"
         c:type="#{ T(net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext) }" />
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPAuditFields.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPAuditFields.java
index 6a0f295..0a960fc 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPAuditFields.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/IdPAuditFields.java
@@ -41,7 +41,7 @@ public final class IdPAuditFields {
     /** URI field. */
     @Nonnull @NotEmpty public static final String URI = "URI";
 
-    /** Destination URL field. {@since 4.0.0} */
+    /** Destination URL field. @since 4.0.0 */
     @Nonnull @NotEmpty public static final String DESTINATION_URL = "DEST";
     
     /** Session ID field. */
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
index f0a1833..ebbd0ee 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
@@ -92,7 +92,7 @@ public final class SAMLAuditFields {
     /** ForceAuthn requested field. */
     @Nonnull @NotEmpty public static final String FORCE_AUTHN = "fauth";
 
-    /** Signed inbound message field. {@since 4.0.0} */
+    /** Signed inbound message field. @since 4.0.0 */
     @Nonnull @NotEmpty public static final String SIGNING = "XX";
 
     /** Encryption field. */

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list