[java-identity-provider] 02/51: IDP-1121 Remove Principal Connectors. Implementation and tests
Rod Widdowson
rdw at steadingsoftware.com
Wed Feb 6 08:42:33 EST 2019
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=21bd71d24e6cc3ed847069f294dcd554db2bd25f
commit 21bd71d24e6cc3ed847069f294dcd554db2bd25f
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Thu Nov 22 10:30:54 2018 +0000
IDP-1121 Remove Principal Connectors. Implementation and tests
https://issues.shibboleth.net/jira/browse/IDP-1121
---
.../attribute/resolver/LegacyPrincipalDecoder.java | 52 ------
.../resolver/impl/AttributeResolverImpl.java | 35 +---
.../resolver/impl/AttributeResolverImplTest.java | 39 +---
.../spring/impl/AttributeResolverParser.java | 7 -
.../impl/AttributeResolverServiceStrategy.java | 9 +-
.../resolver/spring/AttributeResolverTest.java | 13 --
.../spring/BaseAttributeDefinitionParserTest.java | 22 ---
.../idp/test/flows/c14n/TestLegacyC14N.java | 57 ------
.../resources/c14n/attribute-resolver-legacy.xml | 22 ---
.../test/resources/c14n/locate-legacy-resolver.xml | 14 --
.../impl/PrincipalConnector.java | 184 -------------------
.../impl/PrinicpalConnectorCanonicalizer.java | 202 ---------------------
.../principalconnector/impl/package-info.java | 23 ---
.../saml/nameid/impl/LegacyCanonicalization.java | 7 +-
14 files changed, 8 insertions(+), 678 deletions(-)
diff --git a/idp-attribute-resolver-api/src/main/java/net/shibboleth/idp/attribute/resolver/LegacyPrincipalDecoder.java b/idp-attribute-resolver-api/src/main/java/net/shibboleth/idp/attribute/resolver/LegacyPrincipalDecoder.java
deleted file mode 100644
index 0394c9d..0000000
--- a/idp-attribute-resolver-api/src/main/java/net/shibboleth/idp/attribute/resolver/LegacyPrincipalDecoder.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.attribute.resolver;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
-
-/**
- * Definition of the legacy Principal Connectors. <br/>
- * This is the component which takes a context and produces the unique principal.
- *
- * Code will only be implemented by the legacy parsing of the <PrinicipalConnector> statements and will consume
- * CanonicalizationContexts.
- *
- */
-public interface LegacyPrincipalDecoder {
-
- /**
- * Resolve the principal with respect to the provided context. This is expected to strip out the
- * NameID or NameIdentifier and match it against the connector definitions configured.
- *
- * @param context what to look at.
- * @return the IdP principal, or null if no definitions were applicable
- * @throws ResolutionException if we recognise the definition but could not decode it (data out of date and so
- * forth)
- */
- @Nullable String canonicalize(@Nonnull final SubjectCanonicalizationContext context) throws ResolutionException;
-
- /**
- * Report on whether this decoder has any configured connectors.
- * @return whether there are any decoders.
- */
-
- boolean hasValidConnectors();
-}
diff --git a/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/impl/AttributeResolverImpl.java b/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/impl/AttributeResolverImpl.java
index fad4cea..326f654 100644
--- a/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/impl/AttributeResolverImpl.java
+++ b/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/impl/AttributeResolverImpl.java
@@ -47,7 +47,6 @@ import net.shibboleth.idp.attribute.resolver.AttributeDefinition;
import net.shibboleth.idp.attribute.resolver.AttributeResolver;
import net.shibboleth.idp.attribute.resolver.DataConnector;
import net.shibboleth.idp.attribute.resolver.DataConnectorEx;
-import net.shibboleth.idp.attribute.resolver.LegacyPrincipalDecoder;
import net.shibboleth.idp.attribute.resolver.ResolutionException;
import net.shibboleth.idp.attribute.resolver.ResolvedAttributeDefinition;
import net.shibboleth.idp.attribute.resolver.ResolverAttributeDefinitionDependency;
@@ -75,12 +74,10 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
* {@link net.shibboleth.utilities.java.support.resolver.Resolver} which in about summoning up bits of generic data from
* the configuration (usually the metadata) in response to specific
* {@link net.shibboleth.utilities.java.support.resolver.Criterion}s. <br>
- * The implementation also implements {@link LegacyPrincipalDecoder} in support of the deprecated
- * <PrincipalConnector>
- * */
+ */
@ThreadSafe
public class AttributeResolverImpl extends AbstractServiceableComponent<AttributeResolver> implements
- AttributeResolver, LegacyPrincipalDecoder {
+ AttributeResolver {
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(AttributeResolverImpl.class);
@@ -93,10 +90,7 @@ public class AttributeResolverImpl extends AbstractServiceableComponent<Attribut
/** cache for the log prefix - to save multiple recalculations. */
@NonnullAfterInit private String logPrefix;
-
- /** The Principal mapper. */
- @Nullable private LegacyPrincipalDecoder principalConnector;
-
+
/** Whether to strip null attribute values. */
private boolean stripNulls;
@@ -194,15 +188,6 @@ public class AttributeResolverImpl extends AbstractServiceableComponent<Attribut
stripNulls = doStripNulls;
}
- /** Set the Decoder.
- * @param principalResolver code to resolve the principal
- */
- public void setPrincipalDecoder(@Nullable final LegacyPrincipalDecoder principalResolver) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- principalConnector = principalResolver;
- }
-
/**
* Set the mechanism to obtain the {@link ProfileRequestContext}.
*
@@ -615,20 +600,6 @@ public class AttributeResolverImpl extends AbstractServiceableComponent<Attribut
return this;
}
- /** {@inheritDoc} */
- @Override @Nullable public String canonicalize(@Nonnull final SubjectCanonicalizationContext context)
- throws ResolutionException {
- if (null == principalConnector) {
- return null;
- }
- return principalConnector.canonicalize(context);
- }
-
- /** {@inheritDoc} */
- @Override public boolean hasValidConnectors() {
- return principalConnector.hasValidConnectors();
- }
-
/**
* Conditionally start a timer at the beginning of the resolution process.
*
diff --git a/idp-attribute-resolver-impl/src/test/java/net/shibboleth/idp/attribute/resolver/impl/AttributeResolverImplTest.java b/idp-attribute-resolver-impl/src/test/java/net/shibboleth/idp/attribute/resolver/impl/AttributeResolverImplTest.java
index dd10d34..c3b2f87 100644
--- a/idp-attribute-resolver-impl/src/test/java/net/shibboleth/idp/attribute/resolver/impl/AttributeResolverImplTest.java
+++ b/idp-attribute-resolver-impl/src/test/java/net/shibboleth/idp/attribute/resolver/impl/AttributeResolverImplTest.java
@@ -42,7 +42,6 @@ import net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition;
import net.shibboleth.idp.attribute.resolver.AttributeDefinition;
import net.shibboleth.idp.attribute.resolver.AttributeResolver;
import net.shibboleth.idp.attribute.resolver.DataConnector;
-import net.shibboleth.idp.attribute.resolver.LegacyPrincipalDecoder;
import net.shibboleth.idp.attribute.resolver.MockAttributeDefinition;
import net.shibboleth.idp.attribute.resolver.MockDataConnector;
import net.shibboleth.idp.attribute.resolver.ResolutionException;
@@ -876,47 +875,13 @@ public class AttributeResolverImplTest {
}
}
- @Test public void testPrincipalConnector() throws ComponentInitializationException, ResolutionException {
- final LazySet<AttributeDefinition> definitions = new LazySet<>();
-
- AttributeResolverImpl resolver = newAttributeResolverImpl("foo", definitions, null);
- resolver.initialize();
-
- Assert.assertNull(resolver.canonicalize(null));
-
- resolver =
- newAttributeResolverWithPrincipalConnector("foo", definitions, null,
- new LegacyPrincipalDecoder() {
-
- @Override @Nullable public String canonicalize(final SubjectCanonicalizationContext context)
- throws ResolutionException {
- return "Principal";
- }
-
- @Override public boolean hasValidConnectors() {
- return true;
- }
- });
- resolver.initialize();
- Assert.assertEquals(resolver.canonicalize(null), "Principal");
- }
-
- public static AttributeResolverImpl newAttributeResolverWithPrincipalConnector(@Nonnull @NotEmpty final String resolverId,
+ public static AttributeResolverImpl newAttributeResolverImpl(@Nonnull @NotEmpty final String resolverId,
@Nullable @NullableElements final Collection<AttributeDefinition> definitions,
- @Nullable @NullableElements final Collection<DataConnector> connectors,
- @Nullable final LegacyPrincipalDecoder principalResolver) {
+ @Nullable @NullableElements final Collection<DataConnector> connectors) {
final AttributeResolverImpl result = new AttributeResolverImpl();
result.setId(resolverId);
result.setAttributeDefinitions(definitions);
result.setDataConnectors(connectors);
- result.setPrincipalDecoder(principalResolver);
return result;
}
-
- public static AttributeResolverImpl newAttributeResolverImpl(@Nonnull @NotEmpty final String resolverId,
- @Nullable @NullableElements final Collection<AttributeDefinition> definitions,
- @Nullable @NullableElements final Collection<DataConnector> connectors) {
- return newAttributeResolverWithPrincipalConnector(resolverId, definitions, connectors, null);
- }
-
}
\ No newline at end of file
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/impl/AttributeResolverParser.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/impl/AttributeResolverParser.java
index d29b2b2..42ae53a 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/impl/AttributeResolverParser.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/impl/AttributeResolverParser.java
@@ -75,13 +75,6 @@ public class AttributeResolverParser implements BeanDefinitionParser {
children = configChildren.get(AbstractDataConnectorParser.ELEMENT_NAME);
SpringSupport.parseCustomElements(children, context);
- children = configChildren.get(new QName(AttributeResolverNamespaceHandler.NAMESPACE, "PrincipalConnector"));
- if (null != children && !children.isEmpty()) {
- DeprecationSupport.warn(ObjectType.ELEMENT, "<PrincipalConnector>",
- context.getReaderContext().getResource().getDescription(),
- "(https://wiki.shibboleth.net/confluence/display/IDP30/NameIDConsumptionConfiguration)");
- }
- SpringSupport.parseCustomElements(children, context);
return null;
}
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/impl/AttributeResolverServiceStrategy.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/impl/AttributeResolverServiceStrategy.java
index 534c262..e0ee46a 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/impl/AttributeResolverServiceStrategy.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/impl/AttributeResolverServiceStrategy.java
@@ -70,22 +70,17 @@ public class AttributeResolverServiceStrategy extends AbstractIdentifiableInitia
/** {@inheritDoc} */
@Nullable public ServiceableComponent<AttributeResolver> apply(@Nullable final ApplicationContext appContext) {
- final Collection<PrincipalConnector> pcs = appContext.getBeansOfType(PrincipalConnector.class).values();
- final PrinicpalConnectorCanonicalizer pcc = new PrinicpalConnectorCanonicalizer();
- pcc.setConnectors(pcs);
-
final Collection<AttributeDefinition> definitions =
appContext.getBeansOfType(AttributeDefinition.class).values();
final Collection<DataConnector> connectors = appContext.getBeansOfType(DataConnector.class).values();
- log.debug("Creating Attribute Resolver {} with {} Attribute Definition(s), {} Data Connector(s)"
- + " and {} Principal Connector(s)", getId(), definitions.size(), connectors.size(), pcs.size());
+ log.debug("Creating Attribute Resolver {} with {} Attribute Definition(s) and {} Data Connector(s)",
+ getId(), definitions.size(), connectors.size());
final AttributeResolverImpl resolver = new AttributeResolverImpl();
resolver.setAttributeDefinitions(definitions);
resolver.setDataConnectors(connectors);
- resolver.setPrincipalDecoder(pcc);
resolver.setId(getId());
resolver.setStripNulls(isStripNulls());
resolver.setApplicationContext(appContext);
diff --git a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/AttributeResolverTest.java b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/AttributeResolverTest.java
index 6bd5dbc..10a1a2c 100644
--- a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/AttributeResolverTest.java
+++ b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/AttributeResolverTest.java
@@ -339,19 +339,6 @@ public class AttributeResolverTest extends OpenSAMLInitBaseTestCase {
ctx.setRequesterId("REQ");
ctx.setResponderId("RES");
- try {
- serviceableComponent = attributeResolverService.getServiceableComponent();
-
- final AttributeResolver resolver = serviceableComponent.getComponent();
- final LegacyPrincipalDecoder decoder = (LegacyPrincipalDecoder) resolver;
- Assert.assertFalse(decoder.hasValidConnectors());
- Assert.assertNull(decoder.canonicalize(ctx));
-
- } finally {
- if (null != serviceableComponent) {
- serviceableComponent.unpinComponent();
- }
- }
}
@Test public void selective() throws ResolutionException {
diff --git a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/BaseAttributeDefinitionParserTest.java b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/BaseAttributeDefinitionParserTest.java
index 59252ff..13cd3c4 100644
--- a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/BaseAttributeDefinitionParserTest.java
+++ b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/BaseAttributeDefinitionParserTest.java
@@ -34,7 +34,6 @@ import net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl;
import net.shibboleth.idp.attribute.resolver.spring.ad.BaseAttributeDefinitionParser;
import net.shibboleth.idp.attribute.resolver.spring.ad.impl.SimpleAttributeDefinitionParser;
import net.shibboleth.idp.attribute.resolver.spring.impl.AttributeResolverServiceStrategy;
-import net.shibboleth.idp.saml.attribute.principalconnector.impl.PrincipalConnector;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import org.opensaml.core.OpenSAMLInitBaseTestCase;
@@ -204,27 +203,6 @@ public abstract class BaseAttributeDefinitionParserTest extends OpenSAMLInitBase
}
- protected PrincipalConnector getPrincipalConnector(final String fileName) {
-
- final GenericApplicationContext context = new GenericApplicationContext();
- setTestContext(context);
- context.setDisplayName("ApplicationContext: " + PrincipalConnector.class);
-
- return getBean(PRINCIPALCONNECTOR_FILE_PATH + fileName, PrincipalConnector.class, context);
- }
-
- protected PrincipalConnector getPrincipalConnector(final String fileName, final String beanFileName) {
-
- final GenericApplicationContext context = new GenericApplicationContext();
- setTestContext(context);
- context.setDisplayName("ApplicationContext: " + PrincipalConnector.class);
- final XmlBeanDefinitionReader configReader = new SchemaTypeAwareXMLBeanDefinitionReader(context);
-
- configReader.loadBeanDefinitions(BEAN_FILE_PATH + beanFileName);
-
- return getBean(PRINCIPALCONNECTOR_FILE_PATH + fileName, PrincipalConnector.class, context);
- }
-
static public AttributeResolverImpl getResolver(final ApplicationContext appCtx) {
final AttributeResolverServiceStrategy strategy = new AttributeResolverServiceStrategy();
strategy.setId("testResolver");
diff --git a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/TestLegacyC14N.java b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/TestLegacyC14N.java
deleted file mode 100644
index 57bd0e1..0000000
--- a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/c14n/TestLegacyC14N.java
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.test.flows.c14n;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.test.flows.AbstractFlowTest;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.test.context.ContextConfiguration;
-import org.springframework.webflow.executor.FlowExecutionResult;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * Tests for C14N.
- */
- at ContextConfiguration({"classpath:/c14n/test-webflow-config.xml", "classpath:/c14n/locate-legacy-resolver.xml"})
-public class TestLegacyC14N extends AbstractFlowTest {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(TestLegacyC14N.class);
-
- @Test public void testTransientNameID() {
-
- FlowExecutionResult result = flowExecutor.launchExecution("transientNameID", null, externalContext);
- Assert.assertEquals("transientNameID", result.getFlowId());
-
- assertFlowExecutionResult(result, "transientNameID");
- assertFlowExecutionOutcome(result.getOutcome());
- }
-
- @Test public void testTransientNameIdentifier() {
-
- FlowExecutionResult result = flowExecutor.launchExecution("transientNameIdentifier", null, externalContext);
- Assert.assertEquals("transientNameIdentifier", result.getFlowId());
-
- assertFlowExecutionResult(result, "transientNameIdentifier");
- assertFlowExecutionOutcome(result.getOutcome());
- }
-}
\ No newline at end of file
diff --git a/idp-conf/src/test/resources/c14n/attribute-resolver-legacy.xml b/idp-conf/src/test/resources/c14n/attribute-resolver-legacy.xml
deleted file mode 100644
index 4dca055..0000000
--- a/idp-conf/src/test/resources/c14n/attribute-resolver-legacy.xml
+++ /dev/null
@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<resolver:AttributeResolver xmlns:resolver="urn:mace:shibboleth:2.0:resolver" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xmlns:pc="urn:mace:shibboleth:2.0:resolver:pc" xmlns:ad="urn:mace:shibboleth:2.0:resolver:ad"
- xmlns:dc="urn:mace:shibboleth:2.0:resolver:dc" xmlns:enc="urn:mace:shibboleth:2.0:attribute:encoder"
- xmlns:sec="urn:mace:shibboleth:2.0:security"
- xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd
- urn:mace:shibboleth:2.0:resolver:pc http://shibboleth.net/schema/idp/shibboleth-attribute-resolver-pc.xsd
- urn:mace:shibboleth:2.0:resolver:ad http://shibboleth.net/schema/idp/shibboleth-attribute-resolver-ad.xsd
- urn:mace:shibboleth:2.0:resolver:dc http://shibboleth.net/schema/idp/shibboleth-attribute-resolver-dc.xsd
- urn:mace:shibboleth:2.0:attribute:encoder http://shibboleth.net/schema/idp/shibboleth-attribute-encoder.xsd
- urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd">
-
- <!-- Attribute Definitions for webflow testing -->
-
- <resolver:AttributeDefinition id="transientId" xsi:type="ad:TransientId">
- <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="http://example.org/SAML1"/>
- <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="http://example.org/SAML2"/>
- </resolver:AttributeDefinition>
-
- <resolver:PrincipalConnector xsi:type="pc:Transient" nameIDFormat="http://example.org/SAML1" id="Transient"/>
- <resolver:PrincipalConnector xsi:type="pc:Transient" nameIDFormat="http://example.org/SAML2" id="TransientSAML1"/>
-</resolver:AttributeResolver>
diff --git a/idp-conf/src/test/resources/c14n/locate-legacy-resolver.xml b/idp-conf/src/test/resources/c14n/locate-legacy-resolver.xml
deleted file mode 100644
index b116423..0000000
--- a/idp-conf/src/test/resources/c14n/locate-legacy-resolver.xml
+++ /dev/null
@@ -1,14 +0,0 @@
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">
-
- <util:list id ="shibboleth.AttributeResolverResources">
- <value>classpath:c14n/attribute-resolver-legacy.xml/</value>
- </util:list>
-
-
-</beans>
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/attribute/principalconnector/impl/PrincipalConnector.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/attribute/principalconnector/impl/PrincipalConnector.java
deleted file mode 100644
index 1e059b3..0000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/attribute/principalconnector/impl/PrincipalConnector.java
+++ /dev/null
@@ -1,184 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.attribute.principalconnector.impl;
-
-import java.util.Collection;
-import java.util.Collections;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
-import net.shibboleth.idp.saml.nameid.NameDecoderException;
-import net.shibboleth.idp.saml.nameid.NameIDDecoder;
-import net.shibboleth.idp.saml.nameid.NameIdentifierDecoder;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
-import net.shibboleth.utilities.java.support.annotation.constraint.NullableElements;
-import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
-import net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-import org.opensaml.saml.saml1.core.NameIdentifier;
-import org.opensaml.saml.saml2.core.NameID;
-
-import com.google.common.base.Predicates;
-import com.google.common.collect.ImmutableSet;
-import com.google.common.collect.Iterables;
-
-/**
- * The concrete representation of a <PrincipalConnector>, delegates actual work to decoders.
- */
-public class PrincipalConnector extends AbstractIdentifiableInitializableComponent implements NameIdentifierDecoder,
- NameIDDecoder {
-
- /** The {@link NameID} decoder. */
- @NonnullAfterInit private NameIDDecoder nameIDDecoder;
-
- /** The {@link NameIdentifier} decoder. */
- @NonnullAfterInit private NameIdentifierDecoder nameIdentifierDecoder;
-
- /** The format we match against. */
- @NonnullAfterInit @NotEmpty private String format;
-
- /** The relying parties we support. */
- @Nonnull private Collection<String> relyingParties = Collections.emptySet();
-
- /** {@inheritDoc} */
- @Override protected void doInitialize() throws ComponentInitializationException {
- if (null == nameIDDecoder) {
- throw new ComponentInitializationException("NameIDDecoder cannot be null");
- }
- if (null == nameIdentifierDecoder) {
- throw new ComponentInitializationException("NameIdentifierDecoder cannot be null");
- }
- if (null == format) {
- throw new ComponentInitializationException("Name identifier format cannot be empty or null");
- }
- super.doInitialize();
- }
-
- /**
- * Set the {@link NameIDDecoder}.
- *
- * @param saml2Decoder the decoder
- */
- @Nonnull public void setNameIDDecoder(final NameIDDecoder saml2Decoder) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- nameIDDecoder = Constraint.isNotNull(saml2Decoder, "NameIDDecoder cannot be null");
- }
-
- /**
- * Get the {@link NameIDDecoder}.
- *
- * @return the decoder
- */
- @Nonnull public NameIDDecoder getNameIDDecoder() {
- return nameIDDecoder;
- }
-
- /**
- * Get the {@link NameIdentifierDecoder}.
- *
- * @param saml1Decoder the decoder for a {@link NameIdentifier}
- */
- @Nonnull public void setNameIdentifierDecoder(@Nonnull final NameIdentifierDecoder saml1Decoder) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- nameIdentifierDecoder = Constraint.isNotNull(saml1Decoder, "NameIdentifierDecoder cannot be null");
- }
-
- /**
- * Set the {@link NameIdentifierDecoder}.
- *
- * @return the decoder
- */
- @Nonnull public NameIdentifierDecoder getNameIdentifierDecoder() {
- return nameIdentifierDecoder;
- }
-
- /**
- * Set the format we support.
- *
- * @param theFormat the format to match on
- */
- @Nonnull public void setFormat(@Nonnull @NotEmpty final String theFormat) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- format = Constraint.isNotNull(StringSupport.trimOrNull(theFormat),
- "Name identifier format cannot be empty or null");
- }
-
- /**
- * Get the format we support.
- *
- * @return the format we support
- */
- @Nonnull public String getFormat() {
- return format;
- }
-
- /**
- * Get the supported relying parties.
- *
- * @return the supporred relying parties
- */
- @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getRelyingParties() {
- return relyingParties;
- }
-
- /**
- * Set the supported relying parties.
- *
- * @param rps the supported relying parties
- */
- public void setRelyingParties(@Nullable @NullableElements final Collection<String> rps) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- if (null != rps) {
- relyingParties = ImmutableSet.copyOf(Iterables.filter(rps, Predicates.notNull()));
- }
- }
-
- /**
- * Does the supplier requester (relying party) match our configuration?
- *
- * @param requester the requester
- * @return true iff no relyingParties were configured or the requester matches
- */
- public boolean requesterMatches(@Nullable final String requester) {
- return null == requester || relyingParties.isEmpty() || relyingParties.contains(requester);
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable public String decode(@Nonnull final SubjectCanonicalizationContext c14nContext,
- @Nonnull final NameID nameID) throws NameDecoderException {
- return nameIDDecoder.decode(c14nContext, nameID);
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable public String decode(@Nonnull final SubjectCanonicalizationContext c14nContext,
- @Nonnull final NameIdentifier nameIdentifier) throws NameDecoderException {
- return nameIdentifierDecoder.decode(c14nContext, nameIdentifier);
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/attribute/principalconnector/impl/PrinicpalConnectorCanonicalizer.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/attribute/principalconnector/impl/PrinicpalConnectorCanonicalizer.java
deleted file mode 100644
index 9a5d631..0000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/attribute/principalconnector/impl/PrinicpalConnectorCanonicalizer.java
+++ /dev/null
@@ -1,202 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.attribute.principalconnector.impl;
-
-import java.util.Collection;
-import java.util.Collections;
-import java.util.Set;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.attribute.resolver.LegacyPrincipalDecoder;
-import net.shibboleth.idp.attribute.resolver.ResolutionException;
-import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
-import net.shibboleth.idp.saml.authn.principal.NameIDPrincipal;
-import net.shibboleth.idp.saml.authn.principal.NameIdentifierPrincipal;
-import net.shibboleth.idp.saml.nameid.NameDecoderException;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.annotation.constraint.NullableElements;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-import org.opensaml.saml.saml1.core.NameIdentifier;
-import org.opensaml.saml.saml1.profile.SAML1ObjectSupport;
-import org.opensaml.saml.saml2.core.NameID;
-import org.opensaml.saml.saml2.profile.SAML2ObjectSupport;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.google.common.base.Predicates;
-import com.google.common.collect.ImmutableSet;
-import com.google.common.collect.Iterables;
-
-/**
- * Implements SAML subject canonicalization using a series of {@link PrincipalConnector} instances.
- */
-public class PrinicpalConnectorCanonicalizer implements LegacyPrincipalDecoder {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(PrinicpalConnectorCanonicalizer.class);
-
- /** The connectors. */
- @Nonnull @NonnullElements private Collection<PrincipalConnector> principalConnectors = Collections.emptySet();
-
- /**
- * Set the connectors we care about.
- *
- * @param connectors the connectors we care about.
- */
- public void setConnectors(
- @Nullable @NullableElements final Collection<PrincipalConnector> connectors) {
-
- if (null != connectors) {
- principalConnectors = ImmutableSet.copyOf(Iterables.filter(connectors, Predicates.notNull()));
- } else {
- principalConnectors = Collections.emptySet();
- }
- }
-
- /** {@inheritDoc} */
- @Override public boolean hasValidConnectors() {
- return !principalConnectors.isEmpty();
- }
-
- /**
- * Resolve the principal with respect to the provided context. This is expected to strip out the
- * {@link org.opensaml.saml.saml2.core.NameID} or {@link org.opensaml.saml.saml1.core.NameIdentifier} and match it
- * against the connector definitions configured.
- *
- * @param c14nContext what to look at.
- * @return the IdP principal, or null if no definitions were applicable. A null will be turned into a
- * {@link net.shibboleth.idp.authn.AuthnEventIds#INVALID_SUBJECT} event
- * @throws ResolutionException if we recognise the definition but could not decode it (data out of date and so
- * forth) This will be turned into a {@link net.shibboleth.idp.authn.AuthnEventIds#SUBJECT_C14N_ERROR}
- * event
- */
- @Override @Nullable public String canonicalize(@Nonnull final SubjectCanonicalizationContext c14nContext)
- throws ResolutionException {
-
- Constraint.isNotNull(c14nContext, "Context cannot be null");
-
- if (c14nContext.getSubject() == null) {
- return null;
- }
-
- final Set<NameIdentifierPrincipal> nameIdentifierPrincipals =
- c14nContext.getSubject().getPrincipals(NameIdentifierPrincipal.class);
- if (nameIdentifierPrincipals != null && !nameIdentifierPrincipals.isEmpty()) {
- if (nameIdentifierPrincipals.size() > 1) {
- log.debug("Legacy Principal Decoder: too many NameIdentifierPrincipals");
- } else {
- return canonicalize(nameIdentifierPrincipals.iterator().next().getNameIdentifier(), c14nContext);
- }
- }
-
- final Set<NameIDPrincipal> nameIDPrincipals = c14nContext.getSubject().getPrincipals(NameIDPrincipal.class);
- if (nameIDPrincipals != null && !nameIDPrincipals.isEmpty()) {
- if (nameIDPrincipals.size() > 1) {
- log.debug("Legacy Principal Decoder: too many NameIDPrincipals");
- } else {
- return canonicalize(nameIDPrincipals.iterator().next().getNameID(), c14nContext);
- }
- }
-
- return null;
- }
-
-
- /**
- * Canonicalize the provided {@link NameIdentifier} with respect to the provided
- * {@link SubjectCanonicalizationContext}.
- *
- * <p>We iterate over all the connectors to see whether anything matches.</p>
- *
- * @param nameIdentifier the {@link NameIdentifier}
- * @param c14nContext the {@link SubjectCanonicalizationContext}
- *
- * @return the Principal, or null if we could not match
- * @throws ResolutionException if we get a fatal error during decoding.
- */
- @Nullable protected String canonicalize(@Nonnull final NameIdentifier nameIdentifier,
- @Nonnull final SubjectCanonicalizationContext c14nContext) throws ResolutionException {
-
- for (final PrincipalConnector connector : principalConnectors) {
-
- log.trace("Legacy Principal Decoder: looking at connector {}", connector.getId());
-
- if (connector.requesterMatches(c14nContext.getRequesterId())
- && SAML1ObjectSupport.areNameIdentifierFormatsEquivalent(connector.getFormat(),
- nameIdentifier.getFormat())) {
-
- try {
- final String result = connector.decode(c14nContext, nameIdentifier);
- if (null != result) {
- log.trace("Legacy Principal Decoder: decoded to {}", result);
- return result;
- }
- log.trace("Legacy Principal Decoder: decode provided no result");
- } catch (final NameDecoderException e) {
- throw new ResolutionException(e);
- }
- } else {
- log.trace("Legacy Principal Decoder: format or relying party mismatch");
- }
- }
-
- return null;
- }
-
- /**
- * Canonicalize the provided {@link NameID} with respect to the provided {@link SubjectCanonicalizationContext}.
- * <br/>
- * We iterate over all the connectors to see whether anything matches.
- *
- * @param nameID the {@link NameID}
- * @param c14nContext the {@link SubjectCanonicalizationContext}
- * @return the Principal, or null if we could not match
- * @throws ResolutionException if we get a fatal error during decoding.
- */
- @Nullable protected String canonicalize(@Nonnull final NameID nameID,
- @Nonnull final SubjectCanonicalizationContext c14nContext) throws ResolutionException {
-
- for (final PrincipalConnector connector : principalConnectors) {
-
- log.trace("Legacy Principal Decoder: looking at connector {}", connector.getId());
-
- if (connector.requesterMatches(c14nContext.getRequesterId()) &&
- SAML2ObjectSupport.areNameIDFormatsEquivalent(connector.getFormat(), nameID.getFormat())) {
-
- try {
- final String result = connector.decode(c14nContext, nameID);
- if (null != result) {
- log.trace("Legacy Principal Decoder: decoded to {}", result);
- return result;
- }
- log.trace("Legacy Principal Decoder: decode provided no result");
- } catch (final NameDecoderException e) {
- throw new ResolutionException(e);
- }
- } else {
- log.trace("Legacy Principal Decoder: format or relying party mismatch");
- }
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/attribute/principalconnector/impl/package-info.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/attribute/principalconnector/impl/package-info.java
deleted file mode 100644
index 33567fb..0000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/attribute/principalconnector/impl/package-info.java
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * This module contains the code which implements the legacy
- * <PrincipalConnector> Canonicalizeation.
- */
-
-package net.shibboleth.idp.saml.attribute.principalconnector.impl;
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyCanonicalization.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyCanonicalization.java
index 43a98d4..3a968e9 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyCanonicalization.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyCanonicalization.java
@@ -34,10 +34,7 @@ import net.shibboleth.idp.attribute.resolver.LegacyPrincipalDecoder;
import net.shibboleth.idp.attribute.resolver.ResolutionException;
import net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction;
import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.authn.SubjectCanonicalizationException;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
-import net.shibboleth.idp.saml.authn.principal.NameIDPrincipal;
-import net.shibboleth.idp.saml.authn.principal.NameIdentifierPrincipal;
import net.shibboleth.idp.saml.nameid.NameIDCanonicalizationFlowDescriptor;
import net.shibboleth.utilities.java.support.annotation.ParameterName;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -47,9 +44,7 @@ import net.shibboleth.utilities.java.support.service.ReloadableService;
import net.shibboleth.utilities.java.support.service.ServiceableComponent;
/**
- * Action to perform c14n based on the contents of the attribute-resolver.xml file, this
- * delegates the work to an {@link AttributeResolver} instance that supports the
- * {@link LegacyPrincipalDecoder} interface.
+ * Action to fail if asked to perform C14N ..
*/
public class LegacyCanonicalization extends AbstractSubjectCanonicalizationAction {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list