[java-identity-provider] branch master updated: IDP-1408 - Unpick NameID Encoders and beyond
Scott Cantor
cantor.2 at osu.edu
Wed Feb 6 12:06:39 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=28aa96598c01447501f3bbdd4898e7047ddf98aa
The following commit(s) were added to refs/heads/master by this push:
new 28aa965 IDP-1408 - Unpick NameID Encoders and beyond
28aa965 is described below
commit 28aa96598c01447501f3bbdd4898e7047ddf98aa
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Feb 6 12:06:36 2019 -0500
IDP-1408 - Unpick NameID Encoders and beyond
https://issues.shibboleth.net/jira/browse/IDP-1408
Kill off legacy NameID generation.
---
.../src/main/resources/conf/saml-nameid.properties | 4 -
.../main/resources/system/conf/global-system.xml | 2 +
.../resources/system/conf/saml-nameid-system.xml | 12 +-
.../saml/nameid/impl/LegacyCanonicalization.java | 16 ++-
.../nameid/impl/LegacyNameIdentifierGenerator.java | 127 ---------------------
.../impl/LegacySAML1NameIdentifierGenerator.java | 34 ------
.../nameid/impl/LegacySAML2NameIDGenerator.java | 34 ------
7 files changed, 11 insertions(+), 218 deletions(-)
diff --git a/idp-conf/src/main/resources/conf/saml-nameid.properties b/idp-conf/src/main/resources/conf/saml-nameid.properties
index bbc1597..85e20a0 100644
--- a/idp-conf/src/main/resources/conf/saml-nameid.properties
+++ b/idp-conf/src/main/resources/conf/saml-nameid.properties
@@ -4,10 +4,6 @@
# identifiers. See saml-nameid.xml and c14n/subject-c14n.xml for advanced
# settings
-# Comment out to disable legacy NameID generation via Attribute Resolver
-#idp.nameid.saml2.legacyGenerator = shibboleth.LegacySAML2NameIDGenerator
-#idp.nameid.saml1.legacyGenerator = shibboleth.LegacySAML1NameIdentifierGenerator
-
# Default NameID Formats to use when nothing else is called for.
# Don't change these just to change the Format used for a single SP!
#idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:transient
diff --git a/idp-conf/src/main/resources/system/conf/global-system.xml b/idp-conf/src/main/resources/system/conf/global-system.xml
index 1ec7f19..3c9ca5e 100644
--- a/idp-conf/src/main/resources/system/conf/global-system.xml
+++ b/idp-conf/src/main/resources/system/conf/global-system.xml
@@ -91,6 +91,8 @@
<property name="deadProperties">
<list>
<value>idp.authn.flows.initial</value>
+ <value>idp.nameid.saml1.legacyGenerator</value>
+ <value>idp.nameid.saml2.legacyGenerator</value>
</list>
</property>
</bean>
diff --git a/idp-conf/src/main/resources/system/conf/saml-nameid-system.xml b/idp-conf/src/main/resources/system/conf/saml-nameid-system.xml
index 93b56a2..b8e02f5 100644
--- a/idp-conf/src/main/resources/system/conf/saml-nameid-system.xml
+++ b/idp-conf/src/main/resources/system/conf/saml-nameid-system.xml
@@ -75,12 +75,6 @@
<bean id="shibboleth.JDBCPersistentIdStore" abstract="true"
class="net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStoreEx" />
- <!-- These two beans handle legacy support for NameID generation in the Attribute Resolver. -->
- <bean id="shibboleth.LegacySAML1NameIdentifierGenerator" lazy-init="true"
- class="net.shibboleth.idp.saml.nameid.impl.LegacySAML1NameIdentifierGenerator" />
- <bean id="shibboleth.LegacySAML2NameIDGenerator" lazy-init="true"
- class="net.shibboleth.idp.saml.nameid.impl.LegacySAML2NameIDGenerator" />
-
<!--
This is the actual service being exposed, and it takes a pair of generators that are
actually wrappers around generator lists defined by the deployer.
@@ -89,13 +83,11 @@
<bean class="net.shibboleth.idp.saml.nameid.impl.NameIdentifierGenerationServiceImpl">
<property name="SAML1NameIdentifierGenerator">
<bean class="org.opensaml.saml.saml1.profile.impl.ChainingSAML1NameIdentifierGenerator"
- p:generators-ref="shibboleth.SAML1NameIdentifierGenerators"
- p:defaultGenerator="#{getObject('%{idp.nameid.saml1.legacyGenerator:}'.trim())}" />
+ p:generators-ref="shibboleth.SAML1NameIdentifierGenerators" />
</property>
<property name="SAML2NameIDGenerator">
<bean class="org.opensaml.saml.saml2.profile.impl.ChainingSAML2NameIDGenerator"
- p:generators-ref="shibboleth.SAML2NameIDGenerators"
- p:defaultGenerator="#{getObject('%{idp.nameid.saml2.legacyGenerator:}'.trim())}" />
+ p:generators-ref="shibboleth.SAML2NameIDGenerators" />
</property>
</bean>
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyCanonicalization.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyCanonicalization.java
index 7615c1a..df9f69d 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyCanonicalization.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyCanonicalization.java
@@ -17,7 +17,6 @@
package net.shibboleth.idp.saml.nameid.impl;
-import java.util.Set;
import java.util.function.Predicate;
import javax.annotation.Nonnull;
@@ -34,7 +33,6 @@ import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
import net.shibboleth.idp.saml.nameid.NameIDCanonicalizationFlowDescriptor;
import net.shibboleth.utilities.java.support.annotation.ParameterName;
-import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
import net.shibboleth.utilities.java.support.service.ReloadableService;
@@ -54,16 +52,18 @@ public class LegacyCanonicalization extends AbstractSubjectCanonicalizationActio
*/
public LegacyCanonicalization(@Nonnull @ParameterName(name="resolverService")
final ReloadableService<AttributeResolver> resolverService) {
- Constraint.isNotNull(resolverService, "AttributeResolver cannot be null");
+
}
//CheckStyle: ReturnCount OFF
/** {@inheritDoc} */
- @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Override protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final SubjectCanonicalizationContext c14nContext) {
- log.error("legacy C14N no supported");
+ log.error("Legacy PrincipalConnectors no longer supported");
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_SUBJECT_C14N_CTX);
+
+ return false;
}
//CheckStyle: ReturnCount ON
@@ -84,16 +84,13 @@ public class LegacyCanonicalization extends AbstractSubjectCanonicalizationActio
*/
public static class ActivationCondition implements Predicate<ProfileRequestContext> {
- /** Service used to get the resolver used to fetch attributes. */
- @Nullable private final ReloadableService<AttributeResolver> attributeResolverService;
-
/**
* Constructor.
*
* @param service the service we need to interrogate.
*/
public ActivationCondition(final @ParameterName(name="service") ReloadableService<AttributeResolver> service) {
- attributeResolverService = service;
+
}
/**
@@ -105,4 +102,5 @@ public class LegacyCanonicalization extends AbstractSubjectCanonicalizationActio
return false;
}
}
+
}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyNameIdentifierGenerator.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyNameIdentifierGenerator.java
deleted file mode 100644
index 92e1ec3..0000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyNameIdentifierGenerator.java
+++ /dev/null
@@ -1,127 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.nameid.impl;
-
-import java.util.function.Function;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.SAMLException;
-import org.opensaml.saml.common.SAMLObject;
-import org.opensaml.saml.common.profile.NameIdentifierGenerator;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.google.common.base.Predicates;
-
-import net.shibboleth.idp.attribute.context.AttributeContext;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
-
-/**
- * Legacy generator of name identifier objects that relies on resolved attributes having
- * {@link NameIdentifierAttributeEncoder}s attached.
- *
- * <p>Provided for compatibility with V2 configurations.</p>
- *
- * <p>While in principle this generator could be configured in the V3 manner by mapping Format(s)
- * to instances of the class, this would require extra configuration to guarantee compatibility,
- * so by design it works by relying on the Format value supplied at generation time to decide
- * which attribute encoders use, in the manner the V2 IdP does.</p>
- *
- * @param <NameIdType> type of identifier object
- *
- * @deprecated
- */
-public class LegacyNameIdentifierGenerator<NameIdType extends SAMLObject>
- extends AbstractIdentifiableInitializableComponent implements NameIdentifierGenerator<NameIdType> {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(LegacyNameIdentifierGenerator.class);
-
- /** A predicate indicating whether the component applies to a request. */
- @Nonnull private Predicate<ProfileRequestContext> activationCondition;
-
- /** Lookup strategy for {@link AttributeContext}. */
- @Nonnull private Function<ProfileRequestContext, AttributeContext> attributeContextLookupStrategy;
-
-
- /**
- * Constructor.
- *
- */
- protected LegacyNameIdentifierGenerator() {
- activationCondition = Predicates.alwaysTrue();
-
- // ProfileRequestContext -> RelyingPartyContext -> AttributeContext
- attributeContextLookupStrategy = new ChildContextLookup<>(AttributeContext.class).compose(
- new ChildContextLookup<>(RelyingPartyContext.class));
- }
-
- /**
- * Set an activation condition that determines whether to run or not.
- *
- * @param condition an activation condition
- */
- public void setActivationCondition(@Nonnull final Predicate<ProfileRequestContext> condition) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- activationCondition = Constraint.isNotNull(condition, "Predicate cannot be null");
- }
-
- /**
- * Set the lookup strategy to locate the {@link AttributeContext} to pull from.
- *
- * @param strategy lookup strategy
- */
- public void setAttributeContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, AttributeContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- attributeContextLookupStrategy = Constraint.isNotNull(strategy,
- "AttributeContext lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- DeprecationSupport.warn(ObjectType.CLASS, getClass().getName(), null, null);
- }
-
- /** {@inheritDoc} */
- @Override
- @Nullable public NameIdType generate(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull @NotEmpty final String format) throws SAMLException {
- ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
- Constraint.isNotNull(format, "Format cannot be null or empty");
- log.error("Legacy encoding as NameID not supported");
- return null;
- }
-}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacySAML1NameIdentifierGenerator.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacySAML1NameIdentifierGenerator.java
deleted file mode 100644
index 7a81b0d..0000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacySAML1NameIdentifierGenerator.java
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.nameid.impl;
-
-import org.opensaml.saml.saml1.core.NameIdentifier;
-import org.opensaml.saml.saml1.profile.SAML1NameIdentifierGenerator;
-
-/**
- * Legacy generator of {@link NameIdentifier} objects that fails
- *
- * <p>See the base class for additional detail.</p>
- *
- * @deprecated
- */
-public class LegacySAML1NameIdentifierGenerator extends LegacyNameIdentifierGenerator<NameIdentifier>
- implements SAML1NameIdentifierGenerator {
-
-
-}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacySAML2NameIDGenerator.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacySAML2NameIDGenerator.java
deleted file mode 100644
index ea1457f..0000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacySAML2NameIDGenerator.java
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.nameid.impl;
-
-import org.opensaml.saml.saml2.core.NameID;
-import org.opensaml.saml.saml2.profile.SAML2NameIDGenerator;
-
-/**
- * Legacy generator of {@link NameID} objects that fails
- *
- * <p>See the base class for additional detail.</p>
- *
- * @deprecated
- */
-public class LegacySAML2NameIDGenerator extends LegacyNameIdentifierGenerator<NameID>
- implements SAML2NameIDGenerator {
-
-
-}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list