[java-identity-provider] branch master updated: Add IssuerInEntityGroup policy rule, parser, tests.
Scott Cantor
cantor.2 at osu.edu
Thu Dec 5 12:21:52 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=b8dde8be275baa3b46c3479261e132b80b82f433
The following commit(s) were added to refs/heads/master by this push:
new b8dde8b Add IssuerInEntityGroup policy rule, parser, tests.
b8dde8b is described below
commit b8dde8be275baa3b46c3479261e132b80b82f433
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Dec 5 12:21:48 2019 -0500
Add IssuerInEntityGroup policy rule, parser, tests.
---
...ule.java => AbstractEntityGroupPolicyRule.java} | 27 ++----
.../AttributeIssuerInEntityGroupPolicyRule.java | 58 +++++++++++
.../AttributeRequesterInEntityGroupPolicyRule.java | 107 +--------------------
...AttributeIssuerInEntityGroupPolicyRuleTest.java | 62 ++++++++++++
.../impl/AttributeFilterNamespaceHandler.java | 4 +
...ser.java => AbstractEntityGroupRuleParser.java} | 18 +---
.../AttributeIssuerInEntityGroupRuleParser.java | 39 ++++++++
.../AttributeRequesterInEntityGroupRuleParser.java | 21 +---
...AttributeIssuerInEntityGroupRuleParserTest.java | 54 +++++++++++
.../idp/attribute/filter/policyrule/issuerEG2.xml | 5 +
.../src/main/resources/schema/shibboleth-afp.xsd | 12 +++
11 files changed, 251 insertions(+), 156 deletions(-)
diff --git a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRule.java b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AbstractEntityGroupPolicyRule.java
similarity index 83%
copy from idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRule.java
copy to idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AbstractEntityGroupPolicyRule.java
index 5f9d935..45c37ae 100644
--- a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRule.java
+++ b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AbstractEntityGroupPolicyRule.java
@@ -32,20 +32,16 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
import org.opensaml.saml.common.profile.logic.EntityGroupNamePredicate;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
- * A matcher that evaluates to true if attribute requester matches the provided entity group name,
- * or (as of 3.4.0) a valid metadata-sourced affiliation of entities.
+ * A matcher that evaluates to true if an entity's metadata matches the provided entity group name,
+ * or a valid metadata-sourced affiliation of entities.
+ *
+ * @since 4.0.0
*/
-public class AttributeRequesterInEntityGroupPolicyRule extends AbstractPolicyRule {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AttributeRequesterInEntityGroupPolicyRule.class);
+public abstract class AbstractEntityGroupPolicyRule extends AbstractPolicyRule {
/** The entity group to match against. */
@NonnullAfterInit @NotEmpty private String entityGroup;
@@ -118,16 +114,9 @@ public class AttributeRequesterInEntityGroupPolicyRule extends AbstractPolicyRul
*
* @return entity descriptor for the entity to check
*/
- @Nullable protected EntityDescriptor getEntityMetadata(@Nonnull final AttributeFilterContext filterContext) {
- final SAMLMetadataContext metadataContext = filterContext.getRequesterMetadataContext();
-
- if (null == metadataContext) {
- log.debug("{} No requester metadata found", getLogPrefix());
- return null;
- }
- return metadataContext.getEntityDescriptor();
- }
-
+ @Nullable protected abstract EntityDescriptor getEntityMetadata(
+ @Nonnull final AttributeFilterContext filterContext);
+
/**
* Checks if the given entity is in the provided entity group.
*
diff --git a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerInEntityGroupPolicyRule.java b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerInEntityGroupPolicyRule.java
new file mode 100644
index 0000000..1b8b48d
--- /dev/null
+++ b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerInEntityGroupPolicyRule.java
@@ -0,0 +1,58 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.policyrule.saml.impl;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
+
+import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
+import org.opensaml.saml.saml2.metadata.EntityDescriptor;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * A matcher that evaluates to true if attribute issuer's metadata matches the provided entity group name,
+ * or a valid metadata-sourced affiliation of entities.
+ *
+ * @since 4.0.0
+ */
+public class AttributeIssuerInEntityGroupPolicyRule extends AbstractEntityGroupPolicyRule {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AttributeIssuerInEntityGroupPolicyRule.class);
+
+ /**
+ * Gets the entity descriptor for the entity to check.
+ *
+ * @param filterContext current filter request context
+ *
+ * @return entity descriptor for the entity to check
+ */
+ @Nullable protected EntityDescriptor getEntityMetadata(@Nonnull final AttributeFilterContext filterContext) {
+ final SAMLMetadataContext metadataContext = filterContext.getIssuerMetadataContext();
+
+ if (null == metadataContext) {
+ log.debug("{} No issuer metadata found", getLogPrefix());
+ return null;
+ }
+ return metadataContext.getEntityDescriptor();
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRule.java b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRule.java
index 5f9d935..cfb8c4a 100644
--- a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRule.java
+++ b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRule.java
@@ -17,99 +17,24 @@
package net.shibboleth.idp.attribute.filter.policyrule.saml.impl;
-import java.util.Collections;
-import java.util.function.Predicate;
-
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
-import net.shibboleth.idp.attribute.filter.policyrule.impl.AbstractPolicyRule;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
-import org.opensaml.saml.common.profile.logic.EntityGroupNamePredicate;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
/**
- * A matcher that evaluates to true if attribute requester matches the provided entity group name,
- * or (as of 3.4.0) a valid metadata-sourced affiliation of entities.
+ * A matcher that evaluates to true if attribute requester's metadata matches the provided entity group name,
+ * or a valid metadata-sourced affiliation of entities.
*/
-public class AttributeRequesterInEntityGroupPolicyRule extends AbstractPolicyRule {
+public class AttributeRequesterInEntityGroupPolicyRule extends AbstractEntityGroupPolicyRule {
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(AttributeRequesterInEntityGroupPolicyRule.class);
-
- /** The entity group to match against. */
- @NonnullAfterInit @NotEmpty private String entityGroup;
-
- /** Whether to search metadata for AffiliationDescriptor membership. */
- private boolean checkAffiliations;
-
- /**
- * Gets the entity group to match against.
- *
- * @return entity group to match against
- */
- @NonnullAfterInit @NotEmpty public String getEntityGroup() {
- return entityGroup;
- }
-
- /**
- * Sets the entity group to match against.
- *
- * @param group entity group to match against
- */
- public void setEntityGroup(@Nullable final String group) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- entityGroup = StringSupport.trimOrNull(group);
- }
-
- /**
- * Set whether to check a supplied {@link org.opensaml.saml.metadata.resolver.MetadataResolver}
- * for membership in an AffiliationDescriptor
- * as a form of group policy.
- *
- * <p>Defaults to false.</p>
- *
- * @param flag flag to set
- */
- public void setCheckAffiliations(final boolean flag) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- checkAffiliations = flag;
- }
-
-
- /**
- * Returns whether we check a supplied {@link org.opensaml.saml.metadata.resolver.MetadataResolver}
- * for membership in an AffiliationDescriptor
- * as a form of group policy.
- *
- * @return the value of {@link #checkAffiliations}
- *
- * @since 4.0.0
- */
- public boolean isCheckAffiliations() {
- return checkAffiliations;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (entityGroup == null) {
- throw new ComponentInitializationException("entityGroup cannot be null");
- }
- }
/**
* Gets the entity descriptor for the entity to check.
@@ -128,30 +53,4 @@ public class AttributeRequesterInEntityGroupPolicyRule extends AbstractPolicyRul
return metadataContext.getEntityDescriptor();
}
- /**
- * Checks if the given entity is in the provided entity group.
- *
- * @param input the context to look at
- *
- * @return whether the entity is in the group
- * {@inheritDoc}
- */
- @Override
- @Nonnull public Tristate matches(@Nonnull final AttributeFilterContext input) {
- ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
-
- Constraint.isNotNull(input, "Context must be supplied");
-
- final EntityDescriptor entity = getEntityMetadata(input);
- if (entity == null) {
- return Tristate.FALSE;
- }
-
- final Predicate<EntityDescriptor> predicate =
- new EntityGroupNamePredicate(Collections.singleton(entityGroup),
- checkAffiliations ? input.getMetadataResolver() : null);
-
- return predicate.test(entity) ? Tristate.TRUE : Tristate.FALSE;
- }
-
}
\ No newline at end of file
diff --git a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerInEntityGroupPolicyRuleTest.java b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerInEntityGroupPolicyRuleTest.java
new file mode 100644
index 0000000..a7f82c7
--- /dev/null
+++ b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerInEntityGroupPolicyRuleTest.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.policyrule.saml.impl;
+
+import static org.testng.Assert.assertEquals;
+
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.attribute.filter.PolicyRequirementRule.Tristate;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+
+/**
+ * test for {@link AttributeIssuerInEntityGroupPolicyRule}.
+ */
+public class AttributeIssuerInEntityGroupPolicyRuleTest extends BaseMetadataTests {
+
+ private AttributeIssuerInEntityGroupPolicyRule getMatcher(String group) throws ComponentInitializationException {
+ AttributeIssuerInEntityGroupPolicyRule matcher = new AttributeIssuerInEntityGroupPolicyRule();
+ matcher.setId("matcher");
+ matcher.setEntityGroup(group);
+ matcher.initialize();
+ return matcher;
+ }
+
+
+ @Test public void parent() throws ComponentInitializationException {
+ AttributeIssuerInEntityGroupPolicyRule matcher = getMatcher("http://shibboleth.net");
+
+ assertEquals(matcher.matches(issMetadataContext(jiraEntity, "Principal")), Tristate.TRUE);
+ assertEquals(matcher.matches(issMetadataContext(null, null)), Tristate.FALSE);
+
+ matcher = getMatcher("urn:otherstuff");
+ assertEquals(matcher.matches(issMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ }
+
+ @Test public void getter() throws ComponentInitializationException {
+ assertEquals(getMatcher("http://shibboleth.net").getEntityGroup(), "http://shibboleth.net");
+ }
+
+ @Test(expectedExceptions=ComponentInitializationException.class)
+ public void noGroup() throws ComponentInitializationException {
+ AttributeIssuerInEntityGroupPolicyRule matcher = new AttributeIssuerInEntityGroupPolicyRule();
+ matcher.setId("matcher");
+ matcher.initialize();
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
index 5de75cf..bbb0875 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
@@ -45,6 +45,7 @@ import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.ProxiedRequest
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeInMetadataRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeIssuerEntityAttributeExactRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeIssuerEntityAttributeRegexRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeIssuerInEntityGroupRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeIssuerRegistrationAuthorityRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterEntityAttributeExactRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterEntityAttributeRegexRuleParser;
@@ -146,6 +147,9 @@ public class AttributeFilterNamespaceHandler extends BaseSpringNamespaceHandler
registerBeanDefinitionParser(AttributeRequesterInEntityGroupRuleParser.SCHEMA_TYPE,
new AttributeRequesterInEntityGroupRuleParser());
+ registerBeanDefinitionParser(AttributeIssuerInEntityGroupRuleParser.SCHEMA_TYPE,
+ new AttributeIssuerInEntityGroupRuleParser());
+
registerBeanDefinitionParser(AttributeInMetadataRuleParser.SCHEMA_TYPE,
new AttributeInMetadataRuleParser());
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterInEntityGroupRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AbstractEntityGroupRuleParser.java
similarity index 73%
copy from idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterInEntityGroupRuleParser.java
copy to idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AbstractEntityGroupRuleParser.java
index 0fd2d8c..5b4bd23 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterInEntityGroupRuleParser.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AbstractEntityGroupRuleParser.java
@@ -18,11 +18,8 @@
package net.shibboleth.idp.attribute.filter.spring.saml.impl;
import javax.annotation.Nonnull;
-import javax.xml.namespace.QName;
import net.shibboleth.ext.spring.util.SpringSupport;
-import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeRequesterInEntityGroupPolicyRule;
-import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.BasePolicyRuleParser;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
@@ -31,17 +28,9 @@ import org.springframework.beans.factory.xml.ParserContext;
import org.w3c.dom.Element;
/**
- * Parser for {@link AttributeRequesterInEntityGroupPolicyRule}.
+ * Parser for entity group policy rules.
*/
-public class AttributeRequesterInEntityGroupRuleParser extends BasePolicyRuleParser {
-
- /** Schema type. */
- public static final QName SCHEMA_TYPE = new QName(BaseFilterParser.NAMESPACE, "InEntityGroup");
-
- /** {@inheritDoc} */
- @Override @Nonnull protected Class<AttributeRequesterInEntityGroupPolicyRule> getNativeBeanClass() {
- return AttributeRequesterInEntityGroupPolicyRule.class;
- }
+public abstract class AbstractEntityGroupRuleParser extends BasePolicyRuleParser {
/** {@inheritDoc} */
@Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
@@ -53,4 +42,5 @@ public class AttributeRequesterInEntityGroupRuleParser extends BasePolicyRulePar
element.getAttributeNS(null, "checkAffiliations")));
}
}
-}
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeIssuerInEntityGroupRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeIssuerInEntityGroupRuleParser.java
new file mode 100644
index 0000000..eaf5c73
--- /dev/null
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeIssuerInEntityGroupRuleParser.java
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.spring.saml.impl;
+
+import javax.annotation.Nonnull;
+import javax.xml.namespace.QName;
+
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeIssuerInEntityGroupPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
+
+/**
+ * Parser for {@link AttributeIssuerInEntityGroupPolicyRule}.
+ */
+public class AttributeIssuerInEntityGroupRuleParser extends AbstractEntityGroupRuleParser {
+
+ /** Schema type. */
+ public static final QName SCHEMA_TYPE = new QName(BaseFilterParser.NAMESPACE, "IssuerInEntityGroup");
+
+ /** {@inheritDoc} */
+ @Override @Nonnull protected Class<AttributeIssuerInEntityGroupPolicyRule> getNativeBeanClass() {
+ return AttributeIssuerInEntityGroupPolicyRule.class;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterInEntityGroupRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterInEntityGroupRuleParser.java
index 0fd2d8c..cc4e8f0 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterInEntityGroupRuleParser.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterInEntityGroupRuleParser.java
@@ -20,20 +20,13 @@ package net.shibboleth.idp.attribute.filter.spring.saml.impl;
import javax.annotation.Nonnull;
import javax.xml.namespace.QName;
-import net.shibboleth.ext.spring.util.SpringSupport;
import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeRequesterInEntityGroupPolicyRule;
import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
-import net.shibboleth.idp.attribute.filter.spring.policyrule.BasePolicyRuleParser;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
/**
* Parser for {@link AttributeRequesterInEntityGroupPolicyRule}.
*/
-public class AttributeRequesterInEntityGroupRuleParser extends BasePolicyRuleParser {
+public class AttributeRequesterInEntityGroupRuleParser extends AbstractEntityGroupRuleParser {
/** Schema type. */
public static final QName SCHEMA_TYPE = new QName(BaseFilterParser.NAMESPACE, "InEntityGroup");
@@ -43,14 +36,4 @@ public class AttributeRequesterInEntityGroupRuleParser extends BasePolicyRulePar
return AttributeRequesterInEntityGroupPolicyRule.class;
}
- /** {@inheritDoc} */
- @Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
- @Nonnull final BeanDefinitionBuilder builder) {
-
- builder.addPropertyValue("entityGroup", StringSupport.trimOrNull(element.getAttributeNS(null, "groupID")));
- if (element.hasAttributeNS(null, "checkAffiliations")) {
- builder.addPropertyValue("checkAffiliations", SpringSupport.getStringValueAsBoolean(
- element.getAttributeNS(null, "checkAffiliations")));
- }
- }
-}
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeIssuerInEntityGroupRuleParserTest.java b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeIssuerInEntityGroupRuleParserTest.java
new file mode 100644
index 0000000..3e13f00
--- /dev/null
+++ b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeIssuerInEntityGroupRuleParserTest.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.spring.saml;
+
+import static org.testng.Assert.assertEquals;
+
+import org.springframework.beans.factory.BeanCreationException;
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeIssuerInEntityGroupPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseAttributeFilterParserTest;
+import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeIssuerInEntityGroupRuleParser;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+
+/**
+ * test for {@link AttributeIssuerInEntityGroupRuleParser}.
+ */
+public class AttributeIssuerInEntityGroupRuleParserTest extends BaseAttributeFilterParserTest {
+
+ private void testRule(final String propValue, final boolean result) throws ComponentInitializationException {
+ final AttributeIssuerInEntityGroupPolicyRule rule = (AttributeIssuerInEntityGroupPolicyRule) getPolicyRule("issuerEG2.xml", contextWithPropertyValue(propValue));
+
+ assertEquals(rule.getEntityGroup(), "urn:example.org");
+ assertEquals(rule.isCheckAffiliations(), result);
+ }
+
+ @Test(expectedExceptions = {BeanCreationException.class}) public void basic() throws ComponentInitializationException {
+ testRule("", false);
+ }
+
+ @Test public void egTrue() throws ComponentInitializationException {
+ testRule("true", true);
+ }
+
+ @Test public void egFalse() throws ComponentInitializationException {
+ testRule("false", false);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/issuerEG2.xml b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/issuerEG2.xml
new file mode 100644
index 0000000..bc56e87
--- /dev/null
+++ b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/issuerEG2.xml
@@ -0,0 +1,5 @@
+<AttributeFilterPolicy id="MostBasicExample" xmlns="urn:mace:shibboleth:2.0:afp"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
+ <PolicyRequirementRule xsi:type="IssuerInEntityGroup" groupID="urn:example.org" checkAffiliations="%{prop}"/>
+</AttributeFilterPolicy>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-afp.xsd b/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
index 2bf8554..885dbd2 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
@@ -737,6 +737,18 @@
</complexContent>
</complexType>
+ <complexType name="IssuerInEntityGroup">
+ <annotation>
+ <documentation>
+ A match function that evaluates to true if the attribute issuer is found in metadata and
+ is a member of the given entity group.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:EntityGroupMatchType"/>
+ </complexContent>
+ </complexType>
+
<complexType name="EntityGroupMatchType" abstract="true">
<complexContent>
<extension base="afp:MatchFunctorType">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list