[java-identity-provider] branch master updated: IDP-1408 Stop relying on legacy NameID Encoders to prime C14N tests
Rod Widdowson
rdw at steadingsoftware.com
Fri Feb 1 10:20:41 EST 2019
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=27d1abdd035a2e19018764ccde10363884671d01
The following commit(s) were added to refs/heads/master by this push:
new 27d1abd IDP-1408 Stop relying on legacy NameID Encoders to prime C14N tests
27d1abd is described below
commit 27d1abdd035a2e19018764ccde10363884671d01
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Fri Feb 1 15:11:57 2019 +0000
IDP-1408 Stop relying on legacy NameID Encoders to prime C14N tests
https://issues.shibboleth.net/jira/browse/IDP-1408
---
.../test/flows/c14n/actions/SetupForSAML1C14N.java | 70 +++++++++++++++-------
.../test/flows/c14n/actions/SetupForSAML2C14N.java | 69 ++++++++++++++-------
.../src/test/resources/c14n/attribute-resolver.xml | 15 +----
3 files changed, 101 insertions(+), 53 deletions(-)
diff --git a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML1C14N.java b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML1C14N.java
index 29eafe4..07d7527 100644
--- a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML1C14N.java
+++ b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML1C14N.java
@@ -17,22 +17,26 @@
package net.shibboleth.idp.test.flows.c14n.actions;
+import java.util.Collection;
+
import javax.annotation.Nonnull;
import javax.security.auth.Subject;
-import net.shibboleth.idp.attribute.AttributeEncoder;
-import net.shibboleth.idp.attribute.AttributeEncodingException;
+import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.SAMLObjectBuilder;
+import org.opensaml.saml.saml1.core.NameIdentifier;
+
+import net.shibboleth.idp.attribute.IdPAttribute;
+import net.shibboleth.idp.attribute.IdPAttributeValue;
import net.shibboleth.idp.attribute.context.AttributeContext;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.saml.authn.principal.NameIdentifierPrincipal;
-import net.shibboleth.idp.saml.nameid.SAML1NameIdentifierAttributeEncoder;
-
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml1.core.NameIdentifier;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
* Action to mock up a Subject for C14N.
@@ -55,24 +59,48 @@ public class SetupForSAML1C14N extends AbstractProfileAction {
this.attributeName = attributeName;
}
- @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ private NameIdentifier encode(IdPAttribute attribute) {
+ final Collection<IdPAttributeValue<?>> attributeValues = attribute.getValues();
+ if (attributeValues == null || attributeValues.isEmpty()) {
+ return null;
+ }
- final RelyingPartyContext rpc = profileRequestContext.getSubcontext(RelyingPartyContext.class);
+ final SAMLObjectBuilder<NameIdentifier> identifierBuilder = (SAMLObjectBuilder<NameIdentifier>) XMLObjectProviderRegistrySupport.getBuilderFactory().getBuilder(
+ NameIdentifier.DEFAULT_ELEMENT_NAME);
- NameIdentifier nid = null;
- final AttributeContext ac = rpc.getSubcontext(AttributeContext.class, false);
- for (final AttributeEncoder enc : ac.getIdPAttributes().get(getAttributeName()).getEncoders()) {
- if (enc instanceof SAML1NameIdentifierAttributeEncoder
- && enc.getActivationCondition().apply(profileRequestContext)) {
- try {
- nid = ((SAML1NameIdentifierAttributeEncoder) enc).encode(ac.getIdPAttributes().get(getAttributeName()));
- } catch (AttributeEncodingException e) {
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return;
+ final NameIdentifier nameId = identifierBuilder.buildObject();
+ final String format;
+ if ("Principal".equals(attributeName)) {
+ format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
+ } else {
+ format="urn:mace:shibboleth:1.0:nameIdentifier";
+ }
+ nameId.setFormat(format);
+ for (final IdPAttributeValue attrValue : attributeValues) {
+ if (attrValue == null || attrValue.getValue() == null) {
+ continue;
+ }
+ final Object value = attrValue.getValue();
+ if (value instanceof String) {
+ // Check for empty or all-whitespace, but don't trim.
+ if (StringSupport.trimOrNull((String) value) == null) {
+ continue;
}
+ nameId.setValue((String) value);
+ return nameId;
+ } else {
+ continue;
}
}
-
+ return null;
+ }
+
+ @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+ final RelyingPartyContext rpc = profileRequestContext.getSubcontext(RelyingPartyContext.class);
+
+ final AttributeContext ac = rpc.getSubcontext(AttributeContext.class, false);
+ final NameIdentifier nid = encode(ac.getIdPAttributes().get(getAttributeName()));
if (nid == null) {
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return;
diff --git a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML2C14N.java b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML2C14N.java
index 6add010..b392373 100644
--- a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML2C14N.java
+++ b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML2C14N.java
@@ -17,22 +17,26 @@
package net.shibboleth.idp.test.flows.c14n.actions;
+import java.util.Collection;
+
import javax.annotation.Nonnull;
import javax.security.auth.Subject;
-import net.shibboleth.idp.attribute.AttributeEncoder;
-import net.shibboleth.idp.attribute.AttributeEncodingException;
+import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.SAMLObjectBuilder;
+import org.opensaml.saml.saml2.core.NameID;
+
+import net.shibboleth.idp.attribute.IdPAttribute;
+import net.shibboleth.idp.attribute.IdPAttributeValue;
import net.shibboleth.idp.attribute.context.AttributeContext;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.saml.authn.principal.NameIDPrincipal;
-import net.shibboleth.idp.saml.nameid.SAML2NameIDAttributeEncoder;
-
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.NameID;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
/**
*
@@ -55,23 +59,48 @@ public class SetupForSAML2C14N extends AbstractProfileAction {
this.attributeName = attributeName;
}
+ private NameID encode(@Nonnull final IdPAttribute attribute) {
+
+ final Collection<IdPAttributeValue<?>> attributeValues = attribute.getValues();
+ if (attributeValues == null || attributeValues.isEmpty()) {
+ return null;
+ }
+ final SAMLObjectBuilder<NameID> identifierBuilder = (SAMLObjectBuilder<NameID>)
+ XMLObjectProviderRegistrySupport.getBuilderFactory().getBuilder(NameID.DEFAULT_ELEMENT_NAME);
+ final NameID nameId = identifierBuilder.buildObject();
+ final String format;
+ if ("Principal".equals(attributeName)) {
+ format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
+ } else {
+ format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
+ }
+ nameId.setFormat(format);
+ for (final IdPAttributeValue attrValue : attributeValues) {
+ if (attrValue == null || attrValue.getValue() == null) {
+ continue;
+ }
+
+ final Object value = attrValue.getValue();
+ if (value instanceof String) {
+ // Check for empty or all-whitespace, but don't trim.
+ if (StringSupport.trimOrNull((String) value) == null) {
+ continue;
+ }
+ nameId.setValue((String) value);
+ return nameId;
+ } else {
+ continue;
+ }
+ }
+ return null;
+ }
+
@Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final RelyingPartyContext rpc = profileRequestContext.getSubcontext(RelyingPartyContext.class);
- NameID nid = null;
final AttributeContext ac = rpc.getSubcontext(AttributeContext.class, false);
- for (final AttributeEncoder enc : ac.getIdPAttributes().get(getAttributeName()).getEncoders()) {
- if (enc instanceof SAML2NameIDAttributeEncoder &&
- enc.getActivationCondition().apply(profileRequestContext)) {
- try {
- nid = ((SAML2NameIDAttributeEncoder) enc).encode(ac.getIdPAttributes().get(getAttributeName()));
- } catch (AttributeEncodingException e) {
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return;
- }
- }
- }
+ final NameID nid = encode(ac.getIdPAttributes().get(getAttributeName()));
if (nid == null) {
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
diff --git a/idp-conf/src/test/resources/c14n/attribute-resolver.xml b/idp-conf/src/test/resources/c14n/attribute-resolver.xml
index f8a1c45..e3b89c0 100644
--- a/idp-conf/src/test/resources/c14n/attribute-resolver.xml
+++ b/idp-conf/src/test/resources/c14n/attribute-resolver.xml
@@ -12,19 +12,10 @@
<!-- Attribute Definitions for webflow testing -->
- <resolver:AttributeDefinition id="transientId" xsi:type="ad:TransientId">
- <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
- <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
- </resolver:AttributeDefinition>
+ <resolver:AttributeDefinition id="transientId" xsi:type="ad:TransientId"/>
- <resolver:AttributeDefinition id="cryptoTransientId" xsi:type="ad:CryptoTransientId" dataSealerRef="shibboleth.DataSealer">
- <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
- <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
- </resolver:AttributeDefinition>
+ <resolver:AttributeDefinition id="cryptoTransientId" xsi:type="ad:CryptoTransientId" dataSealerRef="shibboleth.DataSealer"/>
- <resolver:AttributeDefinition id="Principal" xsi:type="ad:PrincipalName" >
- <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
- <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
- </resolver:AttributeDefinition>
+ <resolver:AttributeDefinition id="Principal" xsi:type="ad:PrincipalName"/>
</resolver:AttributeResolver>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list