[java-identity-provider] 02/03: IDP-1470 Fix mix-scope custom parsing: Attribute Filters
Rod Widdowson
rdw at steadingsoftware.com
Tue Jun 25 04:46:13 EDT 2019
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=545374f7c12ea1390b4942c66f6af6d897b5e6fa
commit 545374f7c12ea1390b4942c66f6af6d897b5e6fa
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Tue Jun 25 08:36:29 2019 +0100
IDP-1470 Fix mix-scope custom parsing: Attribute Filters
https://issues.shibboleth.net/jira/browse/IDP-1470
---
.../filter/spring/basic/impl/AndMatcherParser.java | 3 ++-
.../filter/spring/basic/impl/NotMatcherParser.java | 3 ++-
.../filter/spring/basic/impl/OrMatcherParser.java | 3 ++-
.../spring/impl/AttributeFilterPolicyParser.java | 10 +++-------
.../filter/spring/impl/AttributeRuleParser.java | 23 +++++++++++-----------
.../spring/BaseAttributeFilterParserTest.java | 13 ++++++++++++
.../spring/policy/PredicateRuleParserTest.java | 6 +++---
.../saml/AttributeInMetadataRuleParserTest.java | 15 +++++++-------
.../MappedAttributeInMetadataRuleParserTest.java | 5 ++---
.../attribute/filter/matcher/mappedInMetadata.xml | 4 +++-
10 files changed, 50 insertions(+), 35 deletions(-)
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/basic/impl/AndMatcherParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/basic/impl/AndMatcherParser.java
index 5e46128..3a8956a 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/basic/impl/AndMatcherParser.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/basic/impl/AndMatcherParser.java
@@ -62,7 +62,8 @@ public class AndMatcherParser extends BaseFilterParser {
final List<Element> ruleElements =
ElementSupport.getChildElementsByTagNameNS(configElement, BaseFilterParser.NAMESPACE, "Rule");
- builder.addPropertyValue("subsidiaries", SpringSupport.parseCustomElements(ruleElements, parserContext));
+ builder.addPropertyValue("subsidiaries",
+ SpringSupport.parseCustomElements(ruleElements, parserContext, builder));
}
}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/basic/impl/NotMatcherParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/basic/impl/NotMatcherParser.java
index 640c229..72a6089 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/basic/impl/NotMatcherParser.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/basic/impl/NotMatcherParser.java
@@ -63,7 +63,8 @@ public class NotMatcherParser extends BaseFilterParser {
if (ruleElements != null && !ruleElements.isEmpty()) {
- builder.addPropertyValue("negation", SpringSupport.parseCustomElements(ruleElements, parserContext).get(0));
+ builder.addPropertyValue("negation",
+ SpringSupport.parseCustomElement(ruleElements.get(0), parserContext, builder, false));
}
}
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/basic/impl/OrMatcherParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/basic/impl/OrMatcherParser.java
index 36f410a..50de296 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/basic/impl/OrMatcherParser.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/basic/impl/OrMatcherParser.java
@@ -62,7 +62,8 @@ public class OrMatcherParser extends BaseFilterParser {
final List<Element> ruleElements =
ElementSupport.getChildElementsByTagNameNS(configElement, BaseFilterParser.NAMESPACE, "Rule");
- builder.addPropertyValue("subsidiaries", SpringSupport.parseCustomElements(ruleElements, parserContext));
+ builder.addPropertyValue("subsidiaries",
+ SpringSupport.parseCustomElements(ruleElements, parserContext, builder));
}
}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterPolicyParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterPolicyParser.java
index d8d1a3f..c528103 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterPolicyParser.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterPolicyParser.java
@@ -24,7 +24,6 @@ import javax.xml.namespace.QName;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import org.springframework.beans.BeanMetadataElement;
import org.springframework.beans.factory.config.BeanDefinition;
import org.springframework.beans.factory.support.BeanDefinitionBuilder;
import org.springframework.beans.factory.support.ManagedList;
@@ -77,16 +76,13 @@ public class AttributeFilterPolicyParser extends BaseFilterParser {
BaseFilterParser.POLICY_REQUIREMENT_RULE);
if (policyRequirements != null && policyRequirements.size() > 0) {
final ManagedList<BeanDefinition> requirements =
- SpringSupport.parseCustomElements(policyRequirements, parserContext);
+ SpringSupport.parseCustomElements(policyRequirements, parserContext, builder);
builder.addConstructorArgValue(requirements.get(0));
}
- // Get the attribute rules, both inline or referenced.
- final ManagedList<BeanMetadataElement> attributeRules = new ManagedList<>();
final List<Element> rules = ElementSupport.getChildElements(config, ATTRIBUTE_RULE);
- if (rules != null && rules.size() > 0) {
- attributeRules.addAll(SpringSupport.parseCustomElements(rules, parserContext));
- }
+ final ManagedList<BeanDefinition> attributeRules =
+ SpringSupport.parseCustomElements(rules, parserContext, builder);
builder.addConstructorArgValue(attributeRules);
}
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeRuleParser.java
index cec8c6b..03a0267 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeRuleParser.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeRuleParser.java
@@ -25,9 +25,7 @@ import javax.xml.namespace.QName;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.config.BeanDefinition;
import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.support.ManagedList;
import org.springframework.beans.factory.xml.ParserContext;
import org.w3c.dom.Element;
@@ -79,19 +77,22 @@ public class AttributeRuleParser extends BaseFilterParser {
final List<Element> denyValueRule = ElementSupport.getChildElements(config, BaseFilterParser.DENY_VALUE_RULE);
if (permitValueRule != null && !permitValueRule.isEmpty()) {
+ if (permitValueRule.size() > 1) {
+ log.debug("{} : More than one PermitValueRule, only the first will be used",
+ parserContext.getReaderContext().getResource().getDescription());
+ }
- final ManagedList<BeanDefinition> permitValueRules =
- SpringSupport.parseCustomElements(permitValueRule, parserContext);
- log.debug("permitValueRules {}", permitValueRules);
- builder.addPropertyValue("matcher", permitValueRules.get(0));
+ builder.addPropertyValue("matcher",
+ SpringSupport.parseCustomElement(permitValueRule.get(0), parserContext, builder, false));
builder.addPropertyValue("isDenyRule", false);
} else if (denyValueRule != null && !denyValueRule.isEmpty()) {
-
- final ManagedList<BeanDefinition> denyValueRules =
- SpringSupport.parseCustomElements(denyValueRule, parserContext);
- log.debug("denyValueRules {}", denyValueRules);
- builder.addPropertyValue("matcher", denyValueRules.get(0));
+ if (denyValueRule.size() > 1) {
+ log.debug("{} : More than one DenyValueRule, only the first will be used",
+ parserContext.getReaderContext().getResource().getDescription());
+ }
+ builder.addPropertyValue("matcher",
+ SpringSupport.parseCustomElement(denyValueRule.get(0), parserContext, builder, false));
builder.addPropertyValue("isDenyRule", true);
} else if (config.hasAttributeNS(null, PERMIT_ANY_ATTRIBUTE)
diff --git a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/BaseAttributeFilterParserTest.java b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/BaseAttributeFilterParserTest.java
index 55dde20..d641a3e 100644
--- a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/BaseAttributeFilterParserTest.java
+++ b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/BaseAttributeFilterParserTest.java
@@ -20,6 +20,7 @@ package net.shibboleth.idp.attribute.filter.spring;
import static org.testng.Assert.assertEquals;
import java.util.Collection;
+import java.util.List;
import java.util.Map;
import org.opensaml.core.xml.XMLObjectBaseTestCase;
@@ -101,6 +102,18 @@ public class BaseAttributeFilterParserTest extends XMLObjectBaseTestCase {
return beans.iterator().next();
}
+
+ protected PolicyRequirementRule getPolicyRuleFromAttributeFilterPolicy(GenericApplicationContext ctx) {
+ final AttributeFilterPolicy afp = ctx.getBean(AttributeFilterPolicy.class);
+ return afp.getPolicyRequirementRule();
+ }
+
+ protected List<AttributeRule> getAttributeRulesAttributeFilterPolicy(String fileName, GenericApplicationContext ctx) {
+ final AttributeFilterPolicy afp = getBean(fileName, AttributeFilterPolicy.class, ctx);
+
+ return afp.getAttributeRules();
+ }
+
protected <Type> Type getBean(String fileName, Class<Type> claz, GenericApplicationContext context) {
diff --git a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/PredicateRuleParserTest.java b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/PredicateRuleParserTest.java
index 5590a91..98d4a5e 100644
--- a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/PredicateRuleParserTest.java
+++ b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/PredicateRuleParserTest.java
@@ -53,7 +53,7 @@ public class PredicateRuleParserTest extends BaseAttributeFilterParserTest {
ctx.refresh();
- final PredicatePolicyRule rule = ctx.getBean(PredicatePolicyRule.class);
+ final PredicatePolicyRule rule = (PredicatePolicyRule) getPolicyRuleFromAttributeFilterPolicy(ctx);
assertEquals(rule.getRulePredicate().getClass(), Foo.class);
assertNull(rule.getProfileContextStrategy().apply(new AttributeFilterContext()));
@@ -75,7 +75,7 @@ public class PredicateRuleParserTest extends BaseAttributeFilterParserTest {
ctx.refresh();
- final PredicatePolicyRule rule = ctx.getBean(PredicatePolicyRule.class);
+ final PredicatePolicyRule rule = (PredicatePolicyRule) getPolicyRuleFromAttributeFilterPolicy(ctx);
assertEquals(rule.getRulePredicate().getClass(), Foo.class);
assertNotNull(rule.getProfileContextStrategy().apply(new AttributeFilterContext()));
@@ -101,7 +101,7 @@ public class PredicateRuleParserTest extends BaseAttributeFilterParserTest {
ctx.refresh();
- final PredicatePolicyRule rule = ctx.getBean(PredicatePolicyRule.class);
+ final PredicatePolicyRule rule = (PredicatePolicyRule) getPolicyRuleFromAttributeFilterPolicy(ctx);
assertEquals(rule.matches(prcFor("https://example.org")), Tristate.FALSE);
assertEquals(rule.matches(prcFor("https://sp.example.org")), Tristate.TRUE);
assertEquals(rule.matches(prcFor("https://sp2.example.org")), Tristate.TRUE);
diff --git a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeInMetadataRuleParserTest.java b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeInMetadataRuleParserTest.java
index 1f23f28..cd9b823 100644
--- a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeInMetadataRuleParserTest.java
+++ b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeInMetadataRuleParserTest.java
@@ -25,7 +25,6 @@ import org.testng.annotations.Test;
import net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext;
import net.shibboleth.idp.attribute.filter.AttributeRule;
import net.shibboleth.idp.attribute.filter.PolicyFromMatcher;
-import net.shibboleth.idp.attribute.filter.PolicyRequirementRule;
import net.shibboleth.idp.attribute.filter.matcher.saml.impl.AttributeInMetadataMatcher;
import net.shibboleth.idp.attribute.filter.spring.BaseAttributeFilterParserTest;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeInMetadataRuleParser;
@@ -41,7 +40,8 @@ public class AttributeInMetadataRuleParserTest extends BaseAttributeFilterParse
setTestContext(context);
context.setDisplayName("ApplicationContext: Matcher");
- final AttributeRule rule = getBean(MATCHER_PATH + "requestedInMetadata.xml", AttributeRule.class, context);
+ final AttributeRule rule = getAttributeRulesAttributeFilterPolicy(MATCHER_PATH + "requestedInMetadata.xml", context).get(0);
+
rule.initialize();
AttributeInMetadataMatcher matcher = (AttributeInMetadataMatcher) rule.getMatcher();
@@ -49,11 +49,12 @@ public class AttributeInMetadataRuleParserTest extends BaseAttributeFilterParse
assertTrue(matcher.getOnlyIfRequired());
assertTrue(matcher.getId().endsWith(":PermitRule"));
- final PolicyFromMatcher policyRule = (PolicyFromMatcher) getBean(PolicyRequirementRule.class, context);
- matcher = (AttributeInMetadataMatcher) policyRule.getMatcher();
- assertTrue(matcher.getMatchIfMetadataSilent());
- assertTrue(matcher.getOnlyIfRequired());
- assertTrue(matcher.getId().endsWith(":PRR"));
+ final PolicyFromMatcher policyRule = (PolicyFromMatcher) getPolicyRuleFromAttributeFilterPolicy(context);
+
+ matcher = (AttributeInMetadataMatcher) policyRule.getMatcher();
+ assertTrue(matcher.getMatchIfMetadataSilent());
+ assertTrue(matcher.getOnlyIfRequired());
+ assertTrue(matcher.getId().endsWith(":PRR"));
}
}
diff --git a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/MappedAttributeInMetadataRuleParserTest.java b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/MappedAttributeInMetadataRuleParserTest.java
index 8ff2897..0b77a51 100644
--- a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/MappedAttributeInMetadataRuleParserTest.java
+++ b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/MappedAttributeInMetadataRuleParserTest.java
@@ -25,7 +25,6 @@ import org.testng.annotations.Test;
import net.shibboleth.idp.attribute.filter.AttributeRule;
import net.shibboleth.idp.attribute.filter.PolicyFromMatcher;
-import net.shibboleth.idp.attribute.filter.PolicyRequirementRule;
import net.shibboleth.idp.attribute.filter.matcher.saml.impl.AttributeInMetadataMatcher;
import net.shibboleth.idp.attribute.filter.spring.BaseAttributeFilterParserTest;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.MappedAttributeInMetadataRuleParser;
@@ -41,7 +40,7 @@ public class MappedAttributeInMetadataRuleParserTest extends BaseAttributeFilte
setTestContext(context);
context.setDisplayName("ApplicationContext: Matcher");
- final AttributeRule rule = getBean(MATCHER_PATH + "mappedInMetadata.xml", AttributeRule.class, context);
+ final AttributeRule rule = getAttributeRulesAttributeFilterPolicy(MATCHER_PATH + "mappedInMetadata.xml", context).get(0);
rule.initialize();
AttributeInMetadataMatcher matcher = (AttributeInMetadataMatcher) rule.getMatcher();
@@ -49,7 +48,7 @@ public class MappedAttributeInMetadataRuleParserTest extends BaseAttributeFilte
assertTrue(matcher.getOnlyIfRequired());
assertTrue(matcher.getId().endsWith(":PermitRule"));
- final PolicyFromMatcher policyRule = (PolicyFromMatcher) getBean(PolicyRequirementRule.class, context);
+ final PolicyFromMatcher policyRule = (PolicyFromMatcher) getPolicyRuleFromAttributeFilterPolicy(context);
matcher = (AttributeInMetadataMatcher) policyRule.getMatcher();
assertTrue(matcher.getMatchIfMetadataSilent());
assertEquals(matcher.getOnlyIfRequired(), onlyResult);
diff --git a/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/matcher/mappedInMetadata.xml b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/matcher/mappedInMetadata.xml
index 82e4642..378ba8c 100644
--- a/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/matcher/mappedInMetadata.xml
+++ b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/matcher/mappedInMetadata.xml
@@ -6,7 +6,9 @@
onlyIfRequired="%{prop}"
matchIfMetadataSilent="true"/>
- <AttributeRule attributeID="email">
+ <AttributeRule attributeID="email" xmlns="urn:mace:shibboleth:2.0:afp"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
<PermitValueRule xsi:type="MappedAttributeInMetadata"
id="PermitRule"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list