[java-opensaml] branch master updated: IDP-1474 - Easier configuration of algorithm agility
Scott Cantor
cantor.2 at osu.edu
Wed Jul 17 15:49:11 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=8b9f9b098447efb260f59276ab0d7be5620bf483
The following commit(s) were added to refs/heads/master by this push:
new 8b9f9b0 IDP-1474 - Easier configuration of algorithm agility
8b9f9b0 is described below
commit 8b9f9b098447efb260f59276ab0d7be5620bf483
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jul 17 15:49:08 2019 -0400
IDP-1474 - Easier configuration of algorithm agility
Add Algorithm metadata filter.
---
.../resolver/filter/impl/AlgorithmFilter.java | 212 +++++++++++++++++++++
.../resolver/filter/impl/AlgorithmFilterTest.java | 156 +++++++++++++++
2 files changed, 368 insertions(+)
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilter.java
new file mode 100644
index 0000000..1381b1e
--- /dev/null
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilter.java
@@ -0,0 +1,212 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.saml.metadata.resolver.filter.impl;
+
+
+import java.util.Collection;
+import java.util.Map;
+import java.util.function.Predicate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.component.AbstractInitializableComponent;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+import org.opensaml.core.xml.XMLObject;
+import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
+import org.opensaml.core.xml.io.MarshallingException;
+import org.opensaml.core.xml.io.UnmarshallingException;
+import org.opensaml.core.xml.util.XMLObjectSupport;
+import org.opensaml.saml.common.SAMLObjectBuilder;
+import org.opensaml.saml.ext.saml2alg.DigestMethod;
+import org.opensaml.saml.ext.saml2alg.SigningMethod;
+import org.opensaml.saml.metadata.resolver.filter.FilterException;
+import org.opensaml.saml.metadata.resolver.filter.MetadataFilter;
+import org.opensaml.saml.saml2.metadata.EncryptionMethod;
+import org.opensaml.saml.saml2.metadata.EntitiesDescriptor;
+import org.opensaml.saml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml.saml2.metadata.Extensions;
+import org.opensaml.saml.saml2.metadata.KeyDescriptor;
+import org.opensaml.saml.saml2.metadata.RoleDescriptor;
+import org.opensaml.security.credential.UsageType;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.google.common.base.Predicates;
+import com.google.common.collect.ArrayListMultimap;
+import com.google.common.collect.Collections2;
+import com.google.common.collect.Multimap;
+
+/**
+ * A filter that adds algorithm extension content to entities in order to drive software
+ * behavior based on them.
+ *
+ * <p>The entities to annotate are identified with a {@link Predicate}, and multiple algorithms can be
+ * associated with each.</p>
+ */
+public class AlgorithmFilter extends AbstractInitializableComponent implements MetadataFilter {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AlgorithmFilter.class);
+
+ /** Rules for adding algorithms. */
+ @Nonnull @NonnullElements private Multimap<Predicate<EntityDescriptor>,XMLObject> applyMap;
+
+ /** Builder for {@link Extensions}. */
+ @Nonnull private final SAMLObjectBuilder<Extensions> extBuilder;
+
+ /** Constructor. */
+ public AlgorithmFilter() {
+ extBuilder = (SAMLObjectBuilder<Extensions>)
+ XMLObjectProviderRegistrySupport.getBuilderFactory().<Extensions>getBuilderOrThrow(
+ Extensions.DEFAULT_ELEMENT_NAME);
+ applyMap = ArrayListMultimap.create();
+ }
+
+ /**
+ * Set the mappings from {@link Predicate} to extensions of various types to apply.
+ *
+ * @param rules rules to apply
+ */
+ public void setRules(@Nonnull @NonnullElements final Map<Predicate<EntityDescriptor>,Collection<XMLObject>> rules) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+ Constraint.isNotNull(rules, "Rules map cannot be null");
+
+ applyMap = ArrayListMultimap.create(rules.size(), 1);
+ for (final Map.Entry<Predicate<EntityDescriptor>,Collection<XMLObject>> entry : rules.entrySet()) {
+ if (entry.getKey() != null && entry.getValue() != null) {
+ applyMap.putAll(entry.getKey(), Collections2.filter(entry.getValue(), Predicates.notNull()));
+ }
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public XMLObject filter(@Nullable final XMLObject metadata) throws FilterException {
+ if (metadata == null) {
+ return null;
+ }
+
+ if (metadata instanceof EntitiesDescriptor) {
+ filterEntitiesDescriptor((EntitiesDescriptor) metadata);
+ } else {
+ filterEntityDescriptor((EntityDescriptor) metadata);
+ }
+
+ return metadata;
+ }
+
+ /**
+ * Filters entity descriptor.
+ *
+ * @param descriptor entity descriptor to filter
+ */
+ protected void filterEntityDescriptor(@Nonnull final EntityDescriptor descriptor) {
+
+ for (final Map.Entry<Predicate<EntityDescriptor>,Collection<XMLObject>> entry : applyMap.asMap().entrySet()) {
+ if (!entry.getValue().isEmpty() && entry.getKey().test(descriptor)) {
+
+ for (final XMLObject xmlObject : entry.getValue()) {
+ try {
+ if (xmlObject instanceof DigestMethod) {
+ log.info("Adding DigestMethod ({}) to EntityDescriptor ({})",
+ ((DigestMethod) xmlObject).getAlgorithm(), descriptor.getEntityID());
+ getExtensions(descriptor).getUnknownXMLObjects().add(
+ XMLObjectSupport.cloneXMLObject(xmlObject));
+ } else if (xmlObject instanceof SigningMethod) {
+ log.info("Adding SigningMethod ({}) to EntityDescriptor ({})",
+ ((SigningMethod) xmlObject).getAlgorithm(), descriptor.getEntityID());
+ getExtensions(descriptor).getUnknownXMLObjects().add(
+ XMLObjectSupport.cloneXMLObject(xmlObject));
+ } else if (xmlObject instanceof EncryptionMethod) {
+ log.info("Adding EncryptionMethod ({}) to EntityDescriptor ({})",
+ ((EncryptionMethod) xmlObject).getAlgorithm(), descriptor.getEntityID());
+ addEncryptionMethod(descriptor, (EncryptionMethod) xmlObject);
+ }
+
+ } catch (final MarshallingException | UnmarshallingException e) {
+ log.error("Error cloning XMLObject", e);
+ }
+ }
+ }
+ }
+ }
+
+ /**
+ * Filters entities descriptor.
+ *
+ * @param descriptor entities descriptor to filter
+ */
+ protected void filterEntitiesDescriptor(@Nonnull final EntitiesDescriptor descriptor) {
+
+ // First we check any contained EntitiesDescriptors.
+ for (final EntitiesDescriptor group : descriptor.getEntitiesDescriptors()) {
+ filterEntitiesDescriptor(group);
+ }
+
+ // Next, check contained EntityDescriptors.
+ for (final EntityDescriptor entity : descriptor.getEntityDescriptors()) {
+ filterEntityDescriptor(entity);
+ }
+ }
+
+ /**
+ * Return existing {@link Extensions} object or create it first.
+ *
+ * @param descriptor the surrounding entity
+ *
+ * @return new or existing extension block
+ */
+ @Nonnull protected Extensions getExtensions(@Nonnull final EntityDescriptor descriptor) {
+
+ Extensions extensions = descriptor.getExtensions();
+ if (extensions == null) {
+ extensions = extBuilder.buildObject();
+ descriptor.setExtensions(extensions);
+ }
+
+ return extensions;
+ }
+
+ /**
+ * Add {@link EncryptionMethod} extension to every {@link KeyDescriptor} found in
+ * an entity.
+ *
+ * @param descriptor the entity to modify
+ * @param encryptionMethod extension to add
+ */
+ protected void addEncryptionMethod(@Nonnull final EntityDescriptor descriptor,
+ @Nonnull final EncryptionMethod encryptionMethod) {
+
+ for (final RoleDescriptor role : descriptor.getRoleDescriptors()) {
+ for (final KeyDescriptor key : role.getKeyDescriptors()) {
+ if (key.getUse() == null || key.getUse() != UsageType.SIGNING) {
+ try {
+ key.getEncryptionMethods().add(XMLObjectSupport.cloneXMLObject(encryptionMethod));
+ } catch (final MarshallingException|UnmarshallingException e) {
+ log.error("Error cloning XMLObject", e);
+ }
+ }
+ }
+ }
+ }
+
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilterTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilterTest.java
new file mode 100644
index 0000000..75217b4
--- /dev/null
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilterTest.java
@@ -0,0 +1,156 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.saml.metadata.resolver.filter.impl;
+
+import static org.testng.Assert.*;
+
+import java.io.File;
+import java.net.URL;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Iterator;
+import java.util.List;
+import java.util.function.Predicate;
+
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.ResolverException;
+
+import org.opensaml.core.criterion.EntityIdCriterion;
+import org.opensaml.core.xml.XMLObject;
+import org.opensaml.core.xml.XMLObjectBaseTestCase;
+import org.opensaml.saml.ext.saml2alg.DigestMethod;
+import org.opensaml.saml.ext.saml2alg.SigningMethod;
+import org.opensaml.saml.metadata.resolver.impl.FilesystemMetadataResolver;
+import org.opensaml.saml.metadata.resolver.impl.FilesystemMetadataResolverTest;
+import org.opensaml.saml.saml2.metadata.EncryptionMethod;
+import org.opensaml.saml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml.saml2.metadata.Extensions;
+import org.opensaml.saml.saml2.metadata.KeyDescriptor;
+import org.opensaml.saml.saml2.metadata.RoleDescriptor;
+import org.opensaml.xmlsec.encryption.MGF;
+import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+public class AlgorithmFilterTest extends XMLObjectBaseTestCase implements Predicate<EntityDescriptor> {
+
+ private FilesystemMetadataResolver metadataProvider;
+
+ private File mdFile;
+
+ @BeforeMethod
+ protected void setUp() throws Exception {
+
+ URL mdURL = FilesystemMetadataResolverTest.class
+ .getResource("/org/opensaml/saml/saml2/metadata/InCommon-metadata.xml");
+ mdFile = new File(mdURL.toURI());
+
+ metadataProvider = new FilesystemMetadataResolver(mdFile);
+ metadataProvider.setParserPool(parserPool);
+ }
+
+ @Test
+ public void test() throws ComponentInitializationException, ResolverException {
+
+ final DigestMethod digest1 = buildXMLObject(DigestMethod.DEFAULT_ELEMENT_NAME);
+ digest1.setAlgorithm(SignatureConstants.ALGO_ID_DIGEST_SHA256);
+
+ final DigestMethod digest2 = buildXMLObject(DigestMethod.DEFAULT_ELEMENT_NAME);
+ digest2.setAlgorithm(SignatureConstants.ALGO_ID_DIGEST_SHA512);
+
+ final SigningMethod signing1 = buildXMLObject(SigningMethod.DEFAULT_ELEMENT_NAME);
+ signing1.setAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
+
+ final SigningMethod signing2 = buildXMLObject(SigningMethod.DEFAULT_ELEMENT_NAME);
+ signing2.setAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512);
+
+ final EncryptionMethod enc = buildXMLObject(EncryptionMethod.DEFAULT_ELEMENT_NAME);
+ enc.setAlgorithm(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11);
+
+ final org.opensaml.xmlsec.signature.DigestMethod embeddedDigest =
+ buildXMLObject(org.opensaml.xmlsec.signature.DigestMethod.DEFAULT_ELEMENT_NAME);
+ embeddedDigest.setAlgorithm(SignatureConstants.ALGO_ID_DIGEST_SHA256);
+ enc.getUnknownXMLObjects().add(embeddedDigest);
+
+ final MGF mgf = buildXMLObject(MGF.DEFAULT_ELEMENT_NAME);
+ mgf.setAlgorithm(EncryptionConstants.ALGO_ID_MGF1_SHA256);
+ enc.getUnknownXMLObjects().add(mgf);
+
+ final Collection<XMLObject> algs = Arrays.asList(digest1, digest2, signing1, signing2, enc);
+
+ final AlgorithmFilter filter = new AlgorithmFilter();
+ filter.setRules(Collections.<Predicate<EntityDescriptor>,Collection<XMLObject>>singletonMap(this, algs));
+ filter.initialize();
+
+ metadataProvider.setMetadataFilter(filter);
+ metadataProvider.setId("test");
+ metadataProvider.initialize();
+
+ EntityIdCriterion crit = new EntityIdCriterion("https://carmenwiki.osu.edu/shibboleth");
+ EntityDescriptor entity = metadataProvider.resolveSingle(new CriteriaSet(crit));
+ assertNotNull(entity);
+ final Extensions exts = entity.getExtensions();
+ assertNotNull(exts);
+
+ List<XMLObject> extElements = exts.getUnknownXMLObjects(DigestMethod.DEFAULT_ELEMENT_NAME);
+ assertEquals(extElements.size(), 2);
+
+ Iterator<XMLObject> digests = extElements.iterator();
+ assertEquals(((DigestMethod) digests.next()).getAlgorithm(), SignatureConstants.ALGO_ID_DIGEST_SHA256);
+ assertEquals(((DigestMethod) digests.next()).getAlgorithm(), SignatureConstants.ALGO_ID_DIGEST_SHA512);
+
+ extElements = exts.getUnknownXMLObjects(SigningMethod.DEFAULT_ELEMENT_NAME);
+ assertEquals(extElements.size(), 2);
+
+ Iterator<XMLObject> signings = extElements.iterator();
+ assertEquals(((SigningMethod) signings.next()).getAlgorithm(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
+ assertEquals(((SigningMethod) signings.next()).getAlgorithm(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512);
+
+ for (final RoleDescriptor role : entity.getRoleDescriptors()) {
+ for (final KeyDescriptor key : role.getKeyDescriptors()) {
+ final List<EncryptionMethod> methods = key.getEncryptionMethods();
+ assertEquals(methods.size(), 1);
+ assertEquals(methods.get(0).getAlgorithm(), EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11);
+
+ final List<XMLObject> encDigests = methods.get(0).getUnknownXMLObjects(
+ org.opensaml.xmlsec.signature.DigestMethod.DEFAULT_ELEMENT_NAME);
+ assertEquals(encDigests.size(), 1);
+ assertEquals(((org.opensaml.xmlsec.signature.DigestMethod) encDigests.get(0)).getAlgorithm(),
+ SignatureConstants.ALGO_ID_DIGEST_SHA256);
+
+ final List<XMLObject> mgfs = methods.get(0).getUnknownXMLObjects(MGF.DEFAULT_ELEMENT_NAME);
+ assertEquals(mgfs.size(), 1);
+ assertEquals(((MGF) mgfs.get(0)).getAlgorithm(), EncryptionConstants.ALGO_ID_MGF1_SHA256);
+ }
+ }
+
+ crit = new EntityIdCriterion("https://cms.psu.edu/Shibboleth");
+ entity = metadataProvider.resolveSingle(new CriteriaSet(crit));
+ assertNotNull(entity);
+ assertNull(entity.getExtensions());
+ }
+
+ /** {@inheritDoc} */
+ public boolean test(final EntityDescriptor input) {
+ return input.getEntityID().equals("https://carmenwiki.osu.edu/shibboleth");
+ }
+
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list