[java-identity-provider] branch master updated: IDP-1477 - Add lookup strategy for populating Address attributes
Scott Cantor
cantor.2 at osu.edu
Wed Dec 18 21:07:02 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=9eaba9c399bbdbbb278479fafc3fc347f5d3403c
The following commit(s) were added to refs/heads/master by this push:
new 9eaba9c IDP-1477 - Add lookup strategy for populating Address attributes
9eaba9c is described below
commit 9eaba9c399bbdbbb278479fafc3fc347f5d3403c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Dec 18 21:06:59 2019 -0500
IDP-1477 - Add lookup strategy for populating Address attributes
https://issues.shibboleth.net/jira/browse/IDP-1477
---
.../system/flows/saml/saml1/common-beans.xml | 3 +-
.../system/flows/saml/saml2/common-beans.xml | 3 +-
.../BaseAddAuthenticationStatementToAssertion.java | 58 +++++++++++++++++++++-
.../AddAuthenticationStatementToAssertion.java | 13 ++---
.../profile/impl/AddAuthnStatementToAssertion.java | 19 ++++---
5 files changed, 77 insertions(+), 19 deletions(-)
diff --git a/idp-conf/src/main/resources/system/flows/saml/saml1/common-beans.xml b/idp-conf/src/main/resources/system/flows/saml/saml1/common-beans.xml
index b184b1c..5f86693 100644
--- a/idp-conf/src/main/resources/system/flows/saml/saml1/common-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/saml/saml1/common-beans.xml
@@ -31,7 +31,8 @@
<bean id="AddAuthenticationStatementToAssertion"
class="net.shibboleth.idp.saml.saml1.profile.impl.AddAuthenticationStatementToAssertion" scope="prototype"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest">
+ p:httpServletRequest-ref="shibboleth.HttpServletRequest"
+ p:addressLookupStrategy="#{getObject('shibboleth.SubjectLocalityAddressStrategy')}">
<property name="identifierGeneratorLookupStrategy">
<bean class="net.shibboleth.idp.profile.config.navigate.IdentifierGenerationStrategyLookupFunction"
p:defaultIdentifierGenerationStrategy-ref="shibboleth.DefaultIdentifierGenerationStrategy" />
diff --git a/idp-conf/src/main/resources/system/flows/saml/saml2/common-beans.xml b/idp-conf/src/main/resources/system/flows/saml/saml2/common-beans.xml
index 4ba739c..d155490 100644
--- a/idp-conf/src/main/resources/system/flows/saml/saml2/common-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/saml/saml2/common-beans.xml
@@ -32,7 +32,8 @@
<bean id="AddAuthnStatementToAssertion"
class="net.shibboleth.idp.saml.saml2.profile.impl.AddAuthnStatementToAssertion" scope="prototype"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest">
+ p:httpServletRequest-ref="shibboleth.HttpServletRequest"
+ p:addressLookupStrategy="#{getObject('shibboleth.SubjectLocalityAddressStrategy')}">
<property name="identifierGeneratorLookupStrategy">
<bean class="net.shibboleth.idp.profile.config.navigate.IdentifierGenerationStrategyLookupFunction"
p:defaultIdentifierGenerationStrategy-ref="shibboleth.DefaultIdentifierGenerationStrategy" />
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAuthenticationStatementToAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAuthenticationStatementToAssertion.java
index 7c823dd..e11aa48 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAuthenticationStatementToAssertion.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAuthenticationStatementToAssertion.java
@@ -33,6 +33,8 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.config.navigate.IdentifierGenerationStrategyLookupFunction;
import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.security.IdentifierGenerationStrategy;
@@ -64,7 +66,10 @@ public abstract class BaseAddAuthenticationStatementToAssertion extends Abstract
/** Strategy used to obtain the assertion issuer value. */
@Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
+
+ /** Strategy used to obtain the client Address to insert. */
+ @NonnullAfterInit private Function<ProfileRequestContext,String> addressLookupStrategy;
+
/** AuthenticationResult basis of statement. */
@Nullable private AuthenticationResult authenticationResult;
@@ -127,6 +132,30 @@ public abstract class BaseAddAuthenticationStatementToAssertion extends Abstract
issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
}
+
+ /**
+ * Get the strategy used to obtain the client IP address to insert into the statement.
+ *
+ * @return lookup strategy
+ *
+ * @since 4.0.0
+ */
+ @NonnullAfterInit public Function<ProfileRequestContext,String> getAddressLookupStrategy() {
+ return addressLookupStrategy;
+ }
+
+ /**
+ * Set the strategy used to obtain the client IP address to insert into the statement.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 4.0.0
+ */
+ public void setAddressLookupStrategy(@Nullable final Function<ProfileRequestContext,String> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ addressLookupStrategy = strategy;
+ }
/**
* Get the {@link AuthenticationResult} to encode.
@@ -160,6 +189,16 @@ public abstract class BaseAddAuthenticationStatementToAssertion extends Abstract
/** {@inheritDoc} */
@Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (addressLookupStrategy == null) {
+ addressLookupStrategy = new RemoteAddressStrategy();
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AuthenticationContext authenticationContext) {
@@ -193,4 +232,21 @@ public abstract class BaseAddAuthenticationStatementToAssertion extends Abstract
return true;
}
+ /**
+ * Default strategy for obtaining client address from servlet layer.
+ *
+ * @since 4.0.0
+ */
+ private class RemoteAddressStrategy implements Function<ProfileRequestContext,String> {
+
+ /** {@inheritDoc} */
+ @Nullable public String apply(@Nullable final ProfileRequestContext t) {
+ if (getHttpServletRequest() != null) {
+ return getHttpServletRequest().getRemoteAddr();
+ }
+
+ return null;
+ }
+
+ }
}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/AddAuthenticationStatementToAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/AddAuthenticationStatementToAssertion.java
index 908e349..341736a 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/AddAuthenticationStatementToAssertion.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/AddAuthenticationStatementToAssertion.java
@@ -81,7 +81,7 @@ public class AddAuthenticationStatementToAssertion extends BaseAddAuthentication
/** Strategy used to determine the AuthenticationMethod attribute. */
@NonnullAfterInit private Function<ProfileRequestContext,AuthenticationMethodPrincipal> methodLookupStrategy;
-
+
/** The generator to use. */
@Nullable private IdentifierGenerationStrategy idGenerator;
@@ -107,7 +107,7 @@ public class AddAuthenticationStatementToAssertion extends BaseAddAuthentication
methodLookupStrategy = Constraint.isNotNull(strategy, "Authentication method strategy cannot be null");
}
-
+
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
@@ -170,12 +170,13 @@ public class AddAuthenticationStatementToAssertion extends BaseAddAuthentication
statement.setAuthenticationMethod(methodLookupStrategy.apply(profileRequestContext).getName());
}
- if (getHttpServletRequest() != null) {
+ final String address = getAddressLookupStrategy().apply(profileRequestContext);
+ if (address != null) {
final SubjectLocality locality = localityBuilder.buildObject();
- locality.setIPAddress(getHttpServletRequest().getRemoteAddr());
+ locality.setIPAddress(address);
statement.setSubjectLocality(locality);
} else {
- log.debug("{} HttpServletRequest not available, omitting SubjectLocality element", getLogPrefix());
+ log.debug("{} Address not available, omitting SubjectLocality element", getLogPrefix());
}
return statement;
@@ -216,5 +217,5 @@ public class AddAuthenticationStatementToAssertion extends BaseAddAuthentication
}
}
-
+
}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertion.java
index fd9dd1b..581848d 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertion.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertion.java
@@ -178,8 +178,7 @@ public class AddAuthnStatementToAssertion extends BaseAddAuthenticationStatement
*
* @return the authentication statement
*/
- @Nonnull private AuthnStatement buildAuthnStatement(
- @Nonnull final ProfileRequestContext profileRequestContext,
+ @Nonnull private AuthnStatement buildAuthnStatement(@Nonnull final ProfileRequestContext profileRequestContext,
@Nullable final RequestedPrincipalContext requestedPrincipalContext) {
final XMLObjectBuilderFactory bf = XMLObjectProviderRegistrySupport.getBuilderFactory();
@@ -231,21 +230,21 @@ public class AddAuthnStatementToAssertion extends BaseAddAuthenticationStatement
}
}
- if (sessionLifetimeLookupStrategy != null) {
- final Duration lifetime = sessionLifetimeLookupStrategy.apply(profileRequestContext);
- if (lifetime != null && lifetime.toMillis() > 0) {
- statement.setSessionNotOnOrAfter(Instant.now().plus(lifetime));
- }
+ final Duration lifetime = sessionLifetimeLookupStrategy != null ?
+ sessionLifetimeLookupStrategy.apply(profileRequestContext) : null;
+ if (lifetime != null && lifetime.toMillis() > 0) {
+ statement.setSessionNotOnOrAfter(Instant.now().plus(lifetime));
}
statement.setSessionIndex(getIdGenerator().generateIdentifier());
- if (getHttpServletRequest() != null) {
+ final String address = getAddressLookupStrategy().apply(profileRequestContext);
+ if (address != null) {
final SubjectLocality locality = localityBuilder.buildObject();
- locality.setAddress(getHttpServletRequest().getRemoteAddr());
+ locality.setAddress(address);
statement.setSubjectLocality(locality);
} else {
- log.debug("{} HttpServletRequest not available, omitting SubjectLocality element", getLogPrefix());
+ log.debug("{} Address not available, omitting SubjectLocality element", getLogPrefix());
}
return statement;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list