[java-identity-provider] branch master updated: IDP-1408 Stop relying on legacy NameID Encoders to prime C14N tests

Rod Widdowson rdw at steadingsoftware.com
Fri Feb 1 10:20:41 EST 2019


This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=27d1abdd035a2e19018764ccde10363884671d01

The following commit(s) were added to refs/heads/master by this push:
       new  27d1abd   IDP-1408 Stop relying on legacy NameID Encoders to prime C14N tests
27d1abd is described below

commit 27d1abdd035a2e19018764ccde10363884671d01
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Fri Feb 1 15:11:57 2019 +0000

    IDP-1408 Stop relying on legacy NameID Encoders to prime C14N tests
    
    https://issues.shibboleth.net/jira/browse/IDP-1408
---
 .../test/flows/c14n/actions/SetupForSAML1C14N.java | 70 +++++++++++++++-------
 .../test/flows/c14n/actions/SetupForSAML2C14N.java | 69 ++++++++++++++-------
 .../src/test/resources/c14n/attribute-resolver.xml | 15 +----
 3 files changed, 101 insertions(+), 53 deletions(-)

diff --git a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML1C14N.java b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML1C14N.java
index 29eafe4..07d7527 100644
--- a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML1C14N.java
+++ b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML1C14N.java
@@ -17,22 +17,26 @@
 
 package net.shibboleth.idp.test.flows.c14n.actions;
 
+import java.util.Collection;
+
 import javax.annotation.Nonnull;
 import javax.security.auth.Subject;
 
-import net.shibboleth.idp.attribute.AttributeEncoder;
-import net.shibboleth.idp.attribute.AttributeEncodingException;
+import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.SAMLObjectBuilder;
+import org.opensaml.saml.saml1.core.NameIdentifier;
+
+import net.shibboleth.idp.attribute.IdPAttribute;
+import net.shibboleth.idp.attribute.IdPAttributeValue;
 import net.shibboleth.idp.attribute.context.AttributeContext;
 import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
 import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
 import net.shibboleth.idp.saml.authn.principal.NameIdentifierPrincipal;
-import net.shibboleth.idp.saml.nameid.SAML1NameIdentifierAttributeEncoder;
-
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml1.core.NameIdentifier;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
 /**
  * Action to mock up a Subject for C14N.
@@ -55,24 +59,48 @@ public class SetupForSAML1C14N extends AbstractProfileAction {
         this.attributeName = attributeName;
     }
 
-    @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+    private NameIdentifier encode(IdPAttribute attribute) {
+        final Collection<IdPAttributeValue<?>> attributeValues = attribute.getValues();
+        if (attributeValues == null || attributeValues.isEmpty()) {
+            return null;
+        }
 
-        final RelyingPartyContext rpc = profileRequestContext.getSubcontext(RelyingPartyContext.class);
+        final SAMLObjectBuilder<NameIdentifier> identifierBuilder =  (SAMLObjectBuilder<NameIdentifier>) XMLObjectProviderRegistrySupport.getBuilderFactory().getBuilder(
+                NameIdentifier.DEFAULT_ELEMENT_NAME);
 
-        NameIdentifier nid = null;
-        final AttributeContext ac = rpc.getSubcontext(AttributeContext.class, false);
-        for (final AttributeEncoder enc : ac.getIdPAttributes().get(getAttributeName()).getEncoders()) {
-            if (enc instanceof SAML1NameIdentifierAttributeEncoder
-                    && enc.getActivationCondition().apply(profileRequestContext)) {
-                try {
-                    nid = ((SAML1NameIdentifierAttributeEncoder) enc).encode(ac.getIdPAttributes().get(getAttributeName()));
-                } catch (AttributeEncodingException e) {
-                    ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
-                    return;
+        final NameIdentifier nameId = identifierBuilder.buildObject();
+        final String format;
+        if ("Principal".equals(attributeName)) {
+            format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
+        } else {
+            format="urn:mace:shibboleth:1.0:nameIdentifier";
+        }
+        nameId.setFormat(format);
+        for (final IdPAttributeValue attrValue : attributeValues) {
+            if (attrValue == null || attrValue.getValue() == null) {
+                continue;
+            }
+            final Object value = attrValue.getValue();
+            if (value instanceof String) {
+                // Check for empty or all-whitespace, but don't trim.
+                if (StringSupport.trimOrNull((String) value) == null) {
+                    continue;
                 }
+                nameId.setValue((String) value);
+                return nameId;
+            } else {
+                continue;
             }
         }
-        
+        return null;
+    }
+
+    @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+        final RelyingPartyContext rpc = profileRequestContext.getSubcontext(RelyingPartyContext.class);
+
+        final AttributeContext ac = rpc.getSubcontext(AttributeContext.class, false);
+        final NameIdentifier nid = encode(ac.getIdPAttributes().get(getAttributeName()));
         if (nid == null) {
             ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
             return;
diff --git a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML2C14N.java b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML2C14N.java
index 6add010..b392373 100644
--- a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML2C14N.java
+++ b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/actions/SetupForSAML2C14N.java
@@ -17,22 +17,26 @@
 
 package net.shibboleth.idp.test.flows.c14n.actions;
 
+import java.util.Collection;
+
 import javax.annotation.Nonnull;
 import javax.security.auth.Subject;
 
-import net.shibboleth.idp.attribute.AttributeEncoder;
-import net.shibboleth.idp.attribute.AttributeEncodingException;
+import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.SAMLObjectBuilder;
+import org.opensaml.saml.saml2.core.NameID;
+
+import net.shibboleth.idp.attribute.IdPAttribute;
+import net.shibboleth.idp.attribute.IdPAttributeValue;
 import net.shibboleth.idp.attribute.context.AttributeContext;
 import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
 import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
 import net.shibboleth.idp.saml.authn.principal.NameIDPrincipal;
-import net.shibboleth.idp.saml.nameid.SAML2NameIDAttributeEncoder;
-
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.NameID;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
 /**
  *
@@ -55,23 +59,48 @@ public class SetupForSAML2C14N extends AbstractProfileAction {
         this.attributeName = attributeName;
     }
 
+    private NameID encode(@Nonnull final IdPAttribute attribute) {
+
+        final Collection<IdPAttributeValue<?>> attributeValues = attribute.getValues();
+        if (attributeValues == null || attributeValues.isEmpty()) {
+            return null;
+        }
+        final SAMLObjectBuilder<NameID> identifierBuilder = (SAMLObjectBuilder<NameID>)
+                XMLObjectProviderRegistrySupport.getBuilderFactory().getBuilder(NameID.DEFAULT_ELEMENT_NAME);
+        final NameID nameId = identifierBuilder.buildObject();
+        final String format;
+        if ("Principal".equals(attributeName)) {
+            format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
+        } else {
+            format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
+        }
+        nameId.setFormat(format);
+        for (final IdPAttributeValue attrValue : attributeValues) {
+            if (attrValue == null || attrValue.getValue() == null) {
+                continue;
+            }
+            
+            final Object value = attrValue.getValue();
+            if (value instanceof String) {
+                // Check for empty or all-whitespace, but don't trim.
+                if (StringSupport.trimOrNull((String) value) == null) {
+                    continue;
+                }
+                nameId.setValue((String) value);
+                return nameId;
+            } else {
+                continue;
+            }
+        }
+        return null;
+    }
+
     @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
 
         final RelyingPartyContext rpc = profileRequestContext.getSubcontext(RelyingPartyContext.class);
 
-        NameID nid = null;
         final AttributeContext ac = rpc.getSubcontext(AttributeContext.class, false);
-        for (final AttributeEncoder enc : ac.getIdPAttributes().get(getAttributeName()).getEncoders()) {
-            if (enc instanceof SAML2NameIDAttributeEncoder &&
-                    enc.getActivationCondition().apply(profileRequestContext)) {
-                try {
-                    nid = ((SAML2NameIDAttributeEncoder) enc).encode(ac.getIdPAttributes().get(getAttributeName()));
-                } catch (AttributeEncodingException e) {
-                    ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
-                    return;
-                }
-            }
-        }
+        final NameID nid = encode(ac.getIdPAttributes().get(getAttributeName()));
         
         if (nid == null) {
             ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
diff --git a/idp-conf/src/test/resources/c14n/attribute-resolver.xml b/idp-conf/src/test/resources/c14n/attribute-resolver.xml
index f8a1c45..e3b89c0 100644
--- a/idp-conf/src/test/resources/c14n/attribute-resolver.xml
+++ b/idp-conf/src/test/resources/c14n/attribute-resolver.xml
@@ -12,19 +12,10 @@
 
     <!-- Attribute Definitions for webflow testing -->
 
-    <resolver:AttributeDefinition id="transientId" xsi:type="ad:TransientId">
-        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
-        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
-    </resolver:AttributeDefinition>
+    <resolver:AttributeDefinition id="transientId" xsi:type="ad:TransientId"/>
     
-    <resolver:AttributeDefinition id="cryptoTransientId" xsi:type="ad:CryptoTransientId" dataSealerRef="shibboleth.DataSealer">
-        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
-        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
-    </resolver:AttributeDefinition>
+    <resolver:AttributeDefinition id="cryptoTransientId" xsi:type="ad:CryptoTransientId" dataSealerRef="shibboleth.DataSealer"/>
 
-    <resolver:AttributeDefinition id="Principal" xsi:type="ad:PrincipalName" >
-        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
-        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
-    </resolver:AttributeDefinition>
+    <resolver:AttributeDefinition id="Principal" xsi:type="ad:PrincipalName"/>
 
 </resolver:AttributeResolver>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list