[java-identity-provider] branch master updated: IDP-1474 - Easier configuration of algorithm agility
Scott Cantor
cantor.2 at osu.edu
Wed Jul 17 20:10:01 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=2154dd4bb84afbebb994b9433c997e704ff8f681
The following commit(s) were added to refs/heads/master by this push:
new 2154dd4 IDP-1474 - Easier configuration of algorithm agility
2154dd4 is described below
commit 2154dd4bb84afbebb994b9433c997e704ff8f681
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jul 17 20:09:52 2019 -0400
IDP-1474 - Easier configuration of algorithm agility
https://issues.shibboleth.net/jira/browse/IDP-1474
Spring parser and schema changes for Algorithm metadata filter.
---
.../filter/impl/AlgorithmFilterParser.java | 141 +++++++++++++++++++++
.../metadata/impl/MetadataNamespaceHandler.java | 2 +
.../metadata/filter/AlgorithmFilterParserTest.java | 120 ++++++++++++++++++
.../relyingparty/metadata/filter/algorithm.xml | 56 ++++++++
.../metadata/filter/algorithmBeans.xml | 14 ++
.../metadata/filter/algorithmConditionScript.js | 2 +
.../metadata/filter/algorithmWithScript.xml | 58 +++++++++
.../filter/algorithmWithScriptResource.xml | 58 +++++++++
.../src/main/resources/META-INF/spring.schemas | 2 +
.../main/resources/schema/shibboleth-metadata.xsd | 49 +++++++
10 files changed, 502 insertions(+)
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/AlgorithmFilterParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/AlgorithmFilterParser.java
new file mode 100644
index 0000000..8a0e275
--- /dev/null
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/AlgorithmFilterParser.java
@@ -0,0 +1,141 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.profile.spring.relyingparty.metadata.filter.impl;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+import javax.xml.namespace.QName;
+
+import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
+import net.shibboleth.idp.profile.spring.relyingparty.metadata.ScriptTypeBeanParser;
+import net.shibboleth.utilities.java.support.logic.ScriptedPredicate;
+import net.shibboleth.utilities.java.support.xml.ElementSupport;
+
+import org.opensaml.core.xml.XMLObject;
+import org.opensaml.core.xml.io.Unmarshaller;
+import org.opensaml.core.xml.io.UnmarshallingException;
+import org.opensaml.core.xml.util.XMLObjectSupport;
+import org.opensaml.saml.common.profile.logic.EntityIdPredicate;
+import org.opensaml.saml.ext.saml2alg.DigestMethod;
+import org.opensaml.saml.ext.saml2alg.SigningMethod;
+import org.opensaml.saml.metadata.resolver.filter.impl.AlgorithmFilter;
+import org.opensaml.saml.saml2.metadata.EncryptionMethod;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.BeanCreationException;
+import org.springframework.beans.factory.config.RuntimeBeanReference;
+import org.springframework.beans.factory.support.BeanDefinitionBuilder;
+import org.springframework.beans.factory.support.ManagedList;
+import org.springframework.beans.factory.support.ManagedMap;
+import org.springframework.beans.factory.xml.AbstractSingleBeanDefinitionParser;
+import org.springframework.beans.factory.xml.ParserContext;
+import org.w3c.dom.Element;
+
+/**
+ * Parser for Algorithm filter.
+ *
+ * @since 4.0.0
+ */
+public class AlgorithmFilterParser extends AbstractSingleBeanDefinitionParser {
+
+ /** Element name. */
+ @Nonnull public static final QName TYPE_NAME = new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE,
+ "Algorithm");
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AlgorithmFilterParser.class);
+
+ /** {@inheritDoc} */
+ @Override protected Class<?> getBeanClass(final Element element) {
+ return AlgorithmFilter.class;
+ }
+
+// Checkstyle: CyclomaticComplexity OFF
+ /** {@inheritDoc} */
+ @Override protected void doParse(final Element element, final ParserContext parserContext,
+ final BeanDefinitionBuilder builder) {
+
+ final Unmarshaller digestUnmarshaller = XMLObjectSupport.getUnmarshaller(DigestMethod.DEFAULT_ELEMENT_NAME);
+ final Unmarshaller signingUnmarshaller =XMLObjectSupport.getUnmarshaller(SigningMethod.DEFAULT_ELEMENT_NAME);
+ final Unmarshaller encryptionUnmarshaller =
+ XMLObjectSupport.getUnmarshaller(EncryptionMethod.DEFAULT_ELEMENT_NAME);
+ if (digestUnmarshaller == null || signingUnmarshaller == null || encryptionUnmarshaller == null) {
+ throw new BeanCreationException("Unable to obtain Unmarshallers");
+ }
+
+ // Accumulate objects to attach as rule values.
+ final List<XMLObject> accumulator = new ArrayList<>();
+
+ final ManagedMap<Object, ManagedList<XMLObject>> ruleMap = new ManagedMap();
+
+ Element child = ElementSupport.getFirstChildElement(element);
+
+ while (child != null) {
+ if (ElementSupport.isElementNamed(child, DigestMethod.DEFAULT_ELEMENT_NAME)) {
+ try {
+ accumulator.add(digestUnmarshaller.unmarshall(child));
+ } catch (final UnmarshallingException e) {
+ log.error("Error unmarshalling DigestMethod element", e);
+ }
+ } else if (ElementSupport.isElementNamed(child, SigningMethod.DEFAULT_ELEMENT_NAME)) {
+ try {
+ accumulator.add(signingUnmarshaller.unmarshall(child));
+ } catch (final UnmarshallingException e) {
+ log.error("Error unmarshalling SigningMethod element", e);
+ }
+ } else if (ElementSupport.isElementNamed(child, EncryptionMethod.DEFAULT_ELEMENT_NAME)) {
+ try {
+ accumulator.add(encryptionUnmarshaller.unmarshall(child));
+ } catch (final UnmarshallingException e) {
+ log.error("Error unmarshalling EncryptionMethod element", e);
+ }
+ } else if (ElementSupport
+ .isElementNamed(child, AbstractMetadataProviderParser.METADATA_NAMESPACE, "Entity")) {
+ final BeanDefinitionBuilder entityIdBuilder =
+ BeanDefinitionBuilder.genericBeanDefinition(EntityIdPredicate.class);
+ entityIdBuilder.addConstructorArgValue(ElementSupport.getElementContentAsString(child));
+ final ManagedList<XMLObject> forRule = new ManagedList(accumulator.size());
+ forRule.addAll(accumulator);
+ ruleMap.put(entityIdBuilder.getBeanDefinition(), forRule);
+ } else if (ElementSupport.isElementNamed(child, AbstractMetadataProviderParser.METADATA_NAMESPACE,
+ "ConditionRef")) {
+ final ManagedList<XMLObject> forRule = new ManagedList(accumulator.size());
+ forRule.addAll(accumulator);
+ ruleMap.put(new RuntimeBeanReference(ElementSupport.getElementContentAsString(child)), forRule);
+ } else if (ElementSupport.isElementNamed(child, AbstractMetadataProviderParser.METADATA_NAMESPACE,
+ "ConditionScript")) {
+ final ManagedList<XMLObject> forRule = new ManagedList(accumulator.size());
+ forRule.addAll(accumulator);
+ ruleMap.put(ScriptTypeBeanParser.parseScriptType(ScriptedPredicate.class, child).getBeanDefinition(),
+ forRule);
+ }
+ child = ElementSupport.getNextSiblingElement(child);
+ }
+
+ builder.addPropertyValue("rules", ruleMap);
+ }
+// Checkstyle: CyclomaticComplexity ON
+
+ /** {@inheritDoc} */
+ @Override protected boolean shouldGenerateId() {
+ return true;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/MetadataNamespaceHandler.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/MetadataNamespaceHandler.java
index 0c43256..00cefbe 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/MetadataNamespaceHandler.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/MetadataNamespaceHandler.java
@@ -21,6 +21,7 @@ import javax.xml.namespace.QName;
import net.shibboleth.ext.spring.util.BaseSpringNamespaceHandler;
import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
+import net.shibboleth.idp.profile.spring.relyingparty.metadata.filter.impl.AlgorithmFilterParser;
import net.shibboleth.idp.profile.spring.relyingparty.metadata.filter.impl.EntitiesDescriptorNameParser;
import net.shibboleth.idp.profile.spring.relyingparty.metadata.filter.impl.EntityAttributesFilterParser;
import net.shibboleth.idp.profile.spring.relyingparty.metadata.filter.impl.EntityRoleFilterParser;
@@ -62,6 +63,7 @@ public class MetadataNamespaceHandler extends BaseSpringNamespaceHandler {
// Filters
registerBeanDefinitionParser(RequiredValidUntilParser.TYPE_NAME, new RequiredValidUntilParser());
+ registerBeanDefinitionParser(AlgorithmFilterParser.TYPE_NAME, new AlgorithmFilterParser());
registerBeanDefinitionParser(EntityAttributesFilterParser.TYPE_NAME, new EntityAttributesFilterParser());
registerBeanDefinitionParser(NameIDFormatFilterParser.TYPE_NAME, new NameIDFormatFilterParser());
registerBeanDefinitionParser(EntityRoleFilterParser.TYPE_NAME, new EntityRoleFilterParser());
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/AlgorithmFilterParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/AlgorithmFilterParserTest.java
new file mode 100644
index 0000000..397350c
--- /dev/null
+++ b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/AlgorithmFilterParserTest.java
@@ -0,0 +1,120 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.profile.spring.relyingparty.metadata.filter;
+
+import static org.testng.Assert.assertEquals;
+
+import java.io.IOException;
+import java.util.Iterator;
+import java.util.List;
+
+import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataParserTest;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.ResolverException;
+
+import org.opensaml.core.criterion.EntityIdCriterion;
+import org.opensaml.core.xml.XMLObject;
+import org.opensaml.saml.ext.saml2alg.DigestMethod;
+import org.opensaml.saml.ext.saml2alg.SigningMethod;
+import org.opensaml.saml.metadata.resolver.MetadataResolver;
+import org.opensaml.saml.metadata.resolver.filter.impl.AlgorithmFilter;
+import org.opensaml.saml.saml2.metadata.EncryptionMethod;
+import org.opensaml.saml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml.saml2.metadata.Extensions;
+import org.opensaml.saml.saml2.metadata.KeyDescriptor;
+import org.opensaml.saml.saml2.metadata.RoleDescriptor;
+import org.opensaml.xmlsec.encryption.MGF;
+import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+public class AlgorithmFilterParserTest extends AbstractMetadataParserTest {
+
+ @Test
+ public void test() throws ResolverException, IOException {
+ doTest("filter/algorithm.xml", "filter/algorithmBeans.xml");
+ }
+
+ @Test
+ public void testFilterScript() throws ResolverException, IOException {
+ doTest("filter/algorithmWithScript.xml");
+ }
+
+ @Test
+ public void testFilterScriptResource() throws ResolverException, IOException {
+ doTest("filter/algorithmWithScriptResource.xml");
+ }
+
+ private void doTest(final String... files) throws ResolverException, IOException {
+
+ final MetadataResolver resolver = getBean(MetadataResolver.class, files);
+
+ final AlgorithmFilter filter = (AlgorithmFilter) resolver.getMetadataFilter();
+ Assert.assertNotNull(filter);
+
+ EntityIdCriterion crit = new EntityIdCriterion("https://sp.example.org/sp/shibboleth");
+ EntityDescriptor entity = resolver.resolveSingle(new CriteriaSet(crit));
+ Assert.assertNotNull(entity);
+
+ Extensions exts = entity.getExtensions();
+ Assert.assertNotNull(exts);
+
+ List<XMLObject> extElements = exts.getUnknownXMLObjects(DigestMethod.DEFAULT_ELEMENT_NAME);
+ assertEquals(extElements.size(), 2);
+
+ Iterator<XMLObject> digests = extElements.iterator();
+ assertEquals(((DigestMethod) digests.next()).getAlgorithm(), SignatureConstants.ALGO_ID_DIGEST_SHA256);
+ assertEquals(((DigestMethod) digests.next()).getAlgorithm(), SignatureConstants.ALGO_ID_DIGEST_SHA512);
+
+ extElements = exts.getUnknownXMLObjects(SigningMethod.DEFAULT_ELEMENT_NAME);
+ assertEquals(extElements.size(), 2);
+
+ Iterator<XMLObject> signings = extElements.iterator();
+ assertEquals(((SigningMethod) signings.next()).getAlgorithm(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
+ assertEquals(((SigningMethod) signings.next()).getAlgorithm(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512);
+
+ for (final RoleDescriptor role : entity.getRoleDescriptors()) {
+ for (final KeyDescriptor key : role.getKeyDescriptors()) {
+ final List<EncryptionMethod> methods = key.getEncryptionMethods();
+ assertEquals(methods.size(), 1);
+ assertEquals(methods.get(0).getAlgorithm(), EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11);
+
+ final List<XMLObject> encDigests = methods.get(0).getUnknownXMLObjects(
+ org.opensaml.xmlsec.signature.DigestMethod.DEFAULT_ELEMENT_NAME);
+ assertEquals(encDigests.size(), 1);
+ assertEquals(((org.opensaml.xmlsec.signature.DigestMethod) encDigests.get(0)).getAlgorithm(),
+ SignatureConstants.ALGO_ID_DIGEST_SHA256);
+
+ final List<XMLObject> mgfs = methods.get(0).getUnknownXMLObjects(MGF.DEFAULT_ELEMENT_NAME);
+ assertEquals(mgfs.size(), 1);
+ assertEquals(((MGF) mgfs.get(0)).getAlgorithm(), EncryptionConstants.ALGO_ID_MGF1_SHA256);
+ }
+ }
+
+ crit = new EntityIdCriterion("https://sp2.example.org/sp/shibboleth");
+ entity = resolver.resolveSingle(new CriteriaSet(crit));
+ Assert.assertNotNull(entity);
+ exts = entity.getExtensions();
+ if (exts != null) {
+ Assert.assertTrue(exts.getUnknownXMLObjects(DigestMethod.DEFAULT_ELEMENT_NAME).isEmpty());
+ Assert.assertTrue(exts.getUnknownXMLObjects(SigningMethod.DEFAULT_ELEMENT_NAME).isEmpty());
+ }
+ }
+
+}
\ No newline at end of file
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithm.xml b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithm.xml
new file mode 100644
index 0000000..d11e50e
--- /dev/null
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithm.xml
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata:MetadataProvider xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:metadata="urn:mace:shibboleth:2.0:metadata"
+ xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+ xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
+ urn:oasis:names:tc:SAML:2.0:assertion http://docs.oasis-open.org/security/saml/v2.0/saml-schema-assertion-2.0.xsd
+ urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd
+ urn:oasis:names:tc:SAML:metadata:algsupport http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-metadata-algsupport-v1.0.xsd
+ http://www.w3.org/2009/xmlenc11# http://www.w3.org/TR/2013/REC-xmlenc-core1-20130411/xenc-schema-11.xsd"
+
+ failFastInitialization="false" requireValidMetadata="false"
+
+ id="algorithms" xsi:type="metadata:InlineMetadataProvider">
+
+ <metadata:MetadataFilter xsi:type="metadata:Algorithm">
+ <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
+ <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512" />
+ <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
+ <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" />
+ <EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#rsa-oaep">
+ <MGF xmlns="http://www.w3.org/2009/xmlenc11#"
+ Algorithm="http://www.w3.org/2009/xmlenc11#mgf1sha256" />
+ <DigestMethod xmlns="http://www.w3.org/2000/09/xmldsig#"
+ Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
+ </EncryptionMethod>
+ <metadata:Entity>https://sp.example.org/sp/shibboleth</metadata:Entity>
+ </metadata:MetadataFilter>
+
+ <EntitiesDescriptor Name="ukgroup">
+ <EntityDescriptor ID="uk001502"
+ entityID="https://sp.example.org/sp/shibboleth">
+ <SPSSODescriptor
+ protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
+
+ <AssertionConsumerService
+ Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
+ Location="https://sp.example.org/Shibboleth.sso/SAML2/POST-SimpleSign"
+ index="5" />
+ </SPSSODescriptor>
+ </EntityDescriptor>
+
+ <EntityDescriptor ID="uk001503"
+ entityID="https://sp2.example.org/sp/shibboleth">
+ <SPSSODescriptor
+ protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
+
+ <AssertionConsumerService
+ Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
+ Location="https://sp2.example.org/Shibboleth.sso/SAML2/POST-SimpleSign"
+ index="5" />
+ </SPSSODescriptor>
+ </EntityDescriptor>
+ </EntitiesDescriptor>
+</metadata:MetadataProvider>
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithmBeans.xml b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithmBeans.xml
new file mode 100644
index 0000000..5ad20a0
--- /dev/null
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithmBeans.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize" default-destroy-method="destroy" default-lazy-init="true">
+
+ <bean id="predicate.AlwaysFalse" class="com.google.common.base.Predicates" factory-method="alwaysFalse" />
+
+</beans>
\ No newline at end of file
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithmConditionScript.js b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithmConditionScript.js
new file mode 100644
index 0000000..9eefa45
--- /dev/null
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithmConditionScript.js
@@ -0,0 +1,2 @@
+
+input.getEntityID().equals("https://sp.example.org/sp/shibboleth");
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithmWithScript.xml b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithmWithScript.xml
new file mode 100644
index 0000000..fad6463
--- /dev/null
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithmWithScript.xml
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata:MetadataProvider xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:metadata="urn:mace:shibboleth:2.0:metadata"
+ xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+ xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
+ urn:oasis:names:tc:SAML:2.0:assertion http://docs.oasis-open.org/security/saml/v2.0/saml-schema-assertion-2.0.xsd
+ urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd
+ urn:oasis:names:tc:SAML:metadata:algsupport http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-metadata-algsupport-v1.0.xsd
+ http://www.w3.org/2009/xmlenc11# http://www.w3.org/TR/2013/REC-xmlenc-core1-20130411/xenc-schema-11.xsd"
+
+ failFastInitialization="false" requireValidMetadata="false"
+
+ id="algorithms" xsi:type="metadata:InlineMetadataProvider">
+
+ <metadata:MetadataFilter xsi:type="metadata:Algorithm">
+ <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
+ <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512" />
+ <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
+ <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" />
+ <EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#rsa-oaep">
+ <MGF xmlns="http://www.w3.org/2009/xmlenc11#"
+ Algorithm="http://www.w3.org/2009/xmlenc11#mgf1sha256" />
+ <DigestMethod xmlns="http://www.w3.org/2000/09/xmldsig#"
+ Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
+ </EncryptionMethod>
+ <metadata:ConditionScript language="javascript">
+ <metadata:Script>input.getEntityID().equals("https://sp.example.org/sp/shibboleth");</metadata:Script>
+ </metadata:ConditionScript>
+ </metadata:MetadataFilter>
+
+ <EntitiesDescriptor Name="ukgroup">
+ <EntityDescriptor ID="uk001502"
+ entityID="https://sp.example.org/sp/shibboleth">
+ <SPSSODescriptor
+ protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
+
+ <AssertionConsumerService
+ Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
+ Location="https://sp.example.org/Shibboleth.sso/SAML2/POST-SimpleSign"
+ index="5" />
+ </SPSSODescriptor>
+ </EntityDescriptor>
+
+ <EntityDescriptor ID="uk001503"
+ entityID="https://sp2.example.org/sp/shibboleth">
+ <SPSSODescriptor
+ protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
+
+ <AssertionConsumerService
+ Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
+ Location="https://sp2.example.org/Shibboleth.sso/SAML2/POST-SimpleSign"
+ index="5" />
+ </SPSSODescriptor>
+ </EntityDescriptor>
+ </EntitiesDescriptor>
+</metadata:MetadataProvider>
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithmWithScriptResource.xml b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithmWithScriptResource.xml
new file mode 100644
index 0000000..dbe2aa0
--- /dev/null
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithmWithScriptResource.xml
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata:MetadataProvider xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:metadata="urn:mace:shibboleth:2.0:metadata"
+ xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+ xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
+ urn:oasis:names:tc:SAML:2.0:assertion http://docs.oasis-open.org/security/saml/v2.0/saml-schema-assertion-2.0.xsd
+ urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd
+ urn:oasis:names:tc:SAML:metadata:algsupport http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-metadata-algsupport-v1.0.xsd
+ http://www.w3.org/2009/xmlenc11# http://www.w3.org/TR/2013/REC-xmlenc-core1-20130411/xenc-schema-11.xsd"
+
+ failFastInitialization="false" requireValidMetadata="false"
+
+ id="algorithms" xsi:type="metadata:InlineMetadataProvider">
+
+ <metadata:MetadataFilter xsi:type="metadata:Algorithm">
+ <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
+ <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512" />
+ <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
+ <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" />
+ <EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#rsa-oaep">
+ <MGF xmlns="http://www.w3.org/2009/xmlenc11#"
+ Algorithm="http://www.w3.org/2009/xmlenc11#mgf1sha256" />
+ <DigestMethod xmlns="http://www.w3.org/2000/09/xmldsig#"
+ Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
+ </EncryptionMethod>
+ <metadata:ConditionScript language="javascript">
+ <metadata:ScriptFile>classpath:/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/algorithmConditionScript.js</metadata:ScriptFile>
+ </metadata:ConditionScript>
+ </metadata:MetadataFilter>
+
+ <EntitiesDescriptor Name="ukgroup">
+ <EntityDescriptor ID="uk001502"
+ entityID="https://sp.example.org/sp/shibboleth">
+ <SPSSODescriptor
+ protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
+
+ <AssertionConsumerService
+ Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
+ Location="https://sp.example.org/Shibboleth.sso/SAML2/POST-SimpleSign"
+ index="5" />
+ </SPSSODescriptor>
+ </EntityDescriptor>
+
+ <EntityDescriptor ID="uk001503"
+ entityID="https://sp2.example.org/sp/shibboleth">
+ <SPSSODescriptor
+ protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
+
+ <AssertionConsumerService
+ Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
+ Location="https://sp2.example.org/Shibboleth.sso/SAML2/POST-SimpleSign"
+ index="5" />
+ </SPSSODescriptor>
+ </EntityDescriptor>
+ </EntitiesDescriptor>
+</metadata:MetadataProvider>
diff --git a/idp-schema/src/main/resources/META-INF/spring.schemas b/idp-schema/src/main/resources/META-INF/spring.schemas
index 2e24806..71aa9bb 100644
--- a/idp-schema/src/main/resources/META-INF/spring.schemas
+++ b/idp-schema/src/main/resources/META-INF/spring.schemas
@@ -27,6 +27,8 @@ http\://www.w3.org/TR/2013/REC-xmlenc-core1-20130411/xenc-schema-11.xsd = schema
http\://docs.oasis-open.org/security/saml/v2.0/saml-schema-assertion-2.0.xsd = schema/saml-schema-assertion-2.0.xsd
http\://docs.oasis-open.org/security/saml/v2.0/saml-schema-protocol-2.0.xsd = schema/saml-schema-protocol-2.0.xsd
http\://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd = schema/saml-schema-metadata-2.0.xsd
+http\://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-metadata-algsupport-v1.0.xsd = schema/sstc-saml-metadata-algsupport-v1.0.xsd
+
# Legacy Filter
classpath\:/schema/shibboleth-2.0-afp.xsd = schema/shibboleth-afp.xsd
diff --git a/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd b/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd
index 7016291..8a6b5db 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd
@@ -2,6 +2,7 @@
<schema xmlns="http://www.w3.org/2001/XMLSchema" targetNamespace="urn:mace:shibboleth:2.0:metadata"
xmlns:shibmd="urn:mace:shibboleth:2.0:metadata" xmlns:security="urn:mace:shibboleth:2.0:security"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
elementFormDefault="qualified">
<annotation>
@@ -12,6 +13,8 @@
schemaLocation="http://docs.oasis-open.org/security/saml/v2.0/saml-schema-assertion-2.0.xsd"/>
<import namespace="urn:oasis:names:tc:SAML:2.0:metadata"
schemaLocation="http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd"/>
+ <import namespace="urn:oasis:names:tc:SAML:metadata:algsupport"
+ schemaLocation="http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-metadata-algsupport-v1.0.xsd"/>
<import namespace="urn:mace:shibboleth:2.0:security"
schemaLocation="http://shibboleth.net/schema/idp/shibboleth-security.xsd"/>
@@ -1181,6 +1184,52 @@
</extension>
</complexContent>
</complexType>
+
+ <complexType name="Algorithm">
+ <annotation>
+ <documentation>
+ A filter that adds SAML Algorithm Support extension content to metadata in order to drive software
+ behavior based on them. Sequences of algorithm elements are supplied, and when an Entity or
+ ConditionRef is encountered, the preceding elements are applied to the corresponding entities.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="shibmd:MetadataFilterType">
+ <sequence>
+ <choice minOccurs="0" maxOccurs="unbounded">
+ <element ref="alg:DigestMethod" />
+ <element ref="alg:SigningMethod" />
+ <element ref="md:EncryptionMethod" />
+ <element name="Entity" type="string">
+ <annotation>
+ <documentation>
+ An entityID to identify an EntityDescriptor to add all the preceding
+ extension elements to.
+ </documentation>
+ </annotation>
+ </element>
+ <element name="ConditionRef" type="string">
+ <annotation>
+ <documentation>
+ The ID of a Spring bean to inject as a condition Predicate to identify one
+ or more EntityDescriptors to add all the preceding extension elements to.
+ </documentation>
+ </annotation>
+ </element>
+ <element name="ConditionScript" type="shibmd:ScriptType">
+ <annotation>
+ <documentation>
+ A script implementing Predicate<EntityDescriptor> to identify one
+ or more EntityDescriptors to add all the preceding extension elements to.
+ </documentation>
+ </annotation>
+ </element>
+ </choice>
+ </sequence>
+ </extension>
+ </complexContent>
+ </complexType>
+
<complexType name="NodeProcessing">
<annotation>
<documentation>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list