[java-identity-provider] branch master updated: IDP-1430 - Review and cleanup of ProfileConfig classes
Scott Cantor
cantor.2 at osu.edu
Thu Mar 28 09:46:07 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=7854b488b3a70ab623e3c5888f62f4d978c474d2
The following commit(s) were added to refs/heads/master by this push:
new 7854b48 IDP-1430 - Review and cleanup of ProfileConfig classes
7854b48 is described below
commit 7854b488b3a70ab623e3c5888f62f4d978c474d2
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Mar 28 09:45:59 2019 -0400
IDP-1430 - Review and cleanup of ProfileConfig classes
https://issues.shibboleth.net/jira/browse/IDP-1430
Second cleanup round hitting all but the MessageContext
based properties.
---
.../config/impl/AbstractProtocolConfiguration.java | 13 +-
.../idp/cas/config/impl/ValidateConfiguration.java | 5 +-
.../system/conf/relying-party-mddriven.xml | 73 +++++++----
.../profile/config/SSOSProfileConfiguration.java | 29 +++--
.../config/AbstractSAMLProfileConfiguration.java | 145 ++++++++++++---------
.../SAMLArtifactAwareProfileConfiguration.java | 7 +-
.../profile/config/SAMLProfileConfiguration.java | 27 +++-
.../logic/NotBeforeProfileConfigPredicate.java | 2 +-
.../config/logic/SignAssertionsPredicate.java | 2 +-
.../config/logic/SignRequestsPredicate.java | 2 +-
.../config/logic/SignResponsesPredicate.java | 2 +-
.../navigate/AssertionLifetimeLookupFunction.java | 2 +-
.../AudienceRestrictionsLookupFunction.java | 24 ++--
.../ProxyAudienceRestrictionsLookupFunction.java | 4 +-
.../config/navigate/ProxyCountLookupFunction.java | 2 +-
.../QualifiedNameIDFormatsLookupFunction.java | 4 +-
...ractSAML1ArtifactAwareProfileConfiguration.java | 23 ++--
.../ArtifactResolutionProfileConfiguration.java | 4 +-
.../config/AttributeQueryProfileConfiguration.java | 8 +-
.../config/BrowserSSOProfileConfiguration.java | 16 +--
...ractSAML2ArtifactAwareProfileConfiguration.java | 21 ++-
.../config/AbstractSAML2ProfileConfiguration.java | 140 +++++++++++---------
.../ArtifactResolutionProfileConfiguration.java | 6 +-
.../config/AttributeQueryProfileConfiguration.java | 7 +-
.../config/BrowserSSOProfileConfiguration.java | 43 +++---
.../profile/config/ECPProfileConfiguration.java | 38 +++---
.../profile/config/SAML2ProfileConfiguration.java | 27 +++-
.../config/SingleLogoutProfileConfiguration.java | 46 +++----
.../profile/config/logic/SOAPErrorPredicate.java | 2 +-
.../config/SSOSProfileConfigurationTest.java | 13 +-
.../AbstractSAMLProfileConfigurationTest.java | 65 +++++----
.../AttributeQueryProfileConfigurationTest.java | 6 +-
.../config/BrowserSSOProfileConfigurationTest.java | 6 +-
.../AbstractSAML2ProfileConfigurationTest.java | 58 ++++-----
.../AttributeQueryProfileConfigurationTest.java | 19 ++-
.../config/BrowserSSOProfileConfigurationTest.java | 9 +-
.../SingleLogoutProfileConfigurationTest.java | 19 ++-
.../impl/PopulateBindingAndEndpointContexts.java | 3 +-
.../delegation/impl/EvaluateDelegationPolicy.java | 23 ++--
.../profile/impl/PopulateEncryptionParameters.java | 8 +-
40 files changed, 529 insertions(+), 424 deletions(-)
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/config/impl/AbstractProtocolConfiguration.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/config/impl/AbstractProtocolConfiguration.java
index 6117b56..1d3e389 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/config/impl/AbstractProtocolConfiguration.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/config/impl/AbstractProtocolConfiguration.java
@@ -45,7 +45,10 @@ public abstract class AbstractProtocolConfiguration extends AbstractConditionalP
InitializableComponent {
/** CAS base protocol URI. */
- public static final String PROTOCOL_URI = "https://www.apereo.org/cas/protocol";
+ @Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://www.apereo.org/cas/protocol";
+
+ /** Default ticket validity. */
+ @Nonnull public static final Duration DEFAULT_TICKET_VALIDITY_PERIOD = Duration.ofSeconds(15);
/** Lookup function to supply {@link #ticketValidityPeriod} property. */
@Nonnull private Function<ProfileRequestContext,Duration> ticketValidityPeriodLookupStrategy;
@@ -65,7 +68,7 @@ public abstract class AbstractProtocolConfiguration extends AbstractConditionalP
super(profileId);
resolveAttributesPredicate = Predicates.alwaysTrue();
- ticketValidityPeriodLookupStrategy = FunctionSupport.constant(Duration.ofSeconds(15));
+ ticketValidityPeriodLookupStrategy = FunctionSupport.constant(DEFAULT_TICKET_VALIDITY_PERIOD);
defaultSecurityConfiguration = new SecurityConfiguration(Duration.ofMinutes(5),
new TicketIdentifierGenerationStrategy(getDefaultTicketPrefix(), getDefaultTicketLength()));
@@ -87,7 +90,11 @@ public abstract class AbstractProtocolConfiguration extends AbstractConditionalP
* @return ticket validity period
*/
@Nonnull public Duration getTicketValidityPeriod(@Nullable final ProfileRequestContext profileRequestContext) {
- return ticketValidityPeriodLookupStrategy.apply(profileRequestContext);
+
+ final Duration ticketTTL = ticketValidityPeriodLookupStrategy.apply(profileRequestContext);
+ Constraint.isNotNull(ticketTTL, "Ticket lifetime cannot be null");
+ Constraint.isFalse(ticketTTL.isNegative() || ticketTTL.isZero(), "Ticket lifetime must be greater than 0");
+ return ticketTTL;
}
/**
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/config/impl/ValidateConfiguration.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/config/impl/ValidateConfiguration.java
index 479b3f1..649daec 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/config/impl/ValidateConfiguration.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/config/impl/ValidateConfiguration.java
@@ -48,6 +48,9 @@ public class ValidateConfiguration extends AbstractProtocolConfiguration {
/** Ticket validation profile ID. */
@Nonnull @NotEmpty public static final String PROFILE_ID = PROTOCOL_URI + "/serviceValidate";
+ /** Default ticket validity. */
+ @Nonnull public static final Duration DEFAULT_TICKET_VALIDITY_PERIOD = Duration.ofSeconds(15);
+
/** Default ticket prefix. */
@Nonnull @NotEmpty public static final String DEFAULT_TICKET_PREFIX = "PGT";
@@ -72,7 +75,7 @@ public class ValidateConfiguration extends AbstractProtocolConfiguration {
// Ticket validity period for this configuration container applies to proxy-granting tickets
// Default to 12H
- setTicketValidityPeriod(Duration.ofHours(12));
+ setTicketValidityPeriod(DEFAULT_TICKET_VALIDITY_PERIOD);
userAttributeLookupStrategy = FunctionSupport.constant(null);
serviceComparatorLookupStrategy = FunctionSupport.constant(new DefaultServiceComparator());
diff --git a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
index 3772af6..2d1cec1 100644
--- a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
+++ b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
@@ -105,7 +105,7 @@
</bean>
<bean id="AbstractMDDrivenSAMLProfile" parent="AbstractMDDrivenProfile" abstract="true">
- <property name="signRequests">
+ <property name="signRequestsPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signRequests" />
@@ -113,7 +113,7 @@
<constructor-arg value="false" />
</bean>
</property>
- <property name="signResponses">
+ <property name="signResponsesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signResponses" />
@@ -121,7 +121,7 @@
<constructor-arg value="false" />
</bean>
</property>
- <property name="signAssertions">
+ <property name="signAssertionsPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signAssertions" />
@@ -138,9 +138,14 @@
</bean>
</property>
<property name="assertionLifetimeLookupStrategy">
- <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="assertionLifetime" />
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="assertionLifetime">
+ <property name="defaultValue">
+ <util:constant
+ static-field="net.shibboleth.idp.saml.profile.config.AbstractSAMLProfileConfiguration.DEFAULT_ASSERTION_LIFETIME" />
+ </property>
+ </bean>
</property>
- <property name="assertionAudiencesLookupStrategy">
+ <property name="additionalAudiencesForAssertionLookupStrategy">
<bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="assertionAudiences" />
</property>
</bean>
@@ -154,7 +159,7 @@
<constructor-arg value="%{idp.encryption.optional:false}" />
</bean>
</property>
- <property name="encryptAssertions">
+ <property name="encryptAssertionsPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptAssertions" />
@@ -162,7 +167,7 @@
<constructor-arg value="false" />
</bean>
</property>
- <property name="encryptNameIDs">
+ <property name="encryptNameIDsPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptNameIDs" />
@@ -170,7 +175,7 @@
<constructor-arg value="false" />
</bean>
</property>
- <property name="encryptAttributes">
+ <property name="encryptAttributesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptAttributes" />
@@ -179,7 +184,12 @@
</bean>
</property>
<property name="proxyCountLookupStrategy">
- <bean parent="shibboleth.MDDrivenLongProperty" p:propertyName="proxyCount" />
+ <bean parent="shibboleth.MDDrivenLongProperty" p:propertyName="proxyCount">
+ <property name="defaultValue">
+ <util:constant
+ static-field="net.shibboleth.idp.saml.saml2.profile.config.AbstractSAML2ProfileConfiguration.DEFAULT_PROXY_COUNT" />
+ </property>
+ </bean>
</property>
<property name="proxyAudiencesLookupStrategy">
<bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="proxyAudiences" />
@@ -196,7 +206,12 @@
</bean>
</property>
<property name="ticketValidityPeriodLookupStrategy">
- <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="ticketValidityPeriod" p:defaultValue="PT15S" />
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="ticketValidityPeriod">
+ <property name="defaultValue">
+ <util:constant
+ static-field="net.shibboleth.idp.cas.config.impl.AbstractProtocolConfiguration.DEFAULT_TICKET_VALIDITY_PERIOD" />
+ </property>
+ </bean>
</property>
</bean>
@@ -210,7 +225,7 @@
<bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="artifactConfiguration"
p:propertyType="#{T(net.shibboleth.idp.saml.profile.config.SAMLArtifactConfiguration)}" />
</property>
- <property name="signResponses">
+ <property name="signResponsesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signResponses" />
@@ -257,7 +272,7 @@
<bean id="SAML1.AttributeQuery.MDDriven" parent="AbstractMDDrivenSAMLProfile" lazy-init="true"
class="net.shibboleth.idp.saml.saml1.profile.config.AttributeQueryProfileConfiguration"
p:inboundInterceptorFlows="security-policy/saml-soap">
- <property name="signResponses">
+ <property name="signResponsesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signResponses" />
@@ -272,7 +287,7 @@
<bean id="SAML1.ArtifactResolution.MDDriven" parent="AbstractMDDrivenSAMLProfile" lazy-init="true"
class="net.shibboleth.idp.saml.saml1.profile.config.ArtifactResolutionProfileConfiguration"
p:inboundInterceptorFlows="security-policy/saml-soap">
- <property name="signResponses">
+ <property name="signResponsesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signResponses" />
@@ -316,7 +331,7 @@
</constructor-arg>
</bean>
</property>
- <property name="signResponses">
+ <property name="signResponsesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signResponses" />
@@ -324,7 +339,7 @@
<constructor-arg value="true" />
</bean>
</property>
- <property name="encryptAssertions">
+ <property name="encryptAssertionsPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptAssertions" />
@@ -386,7 +401,12 @@
</bean>
</property>
<property name="maximumTokenDelegationChainLengthLookupStrategy">
- <bean parent="shibboleth.MDDrivenLongProperty" p:propertyName="maximumTokenDelegationChainLength" />
+ <bean parent="shibboleth.MDDrivenLongProperty" p:propertyName="maximumTokenDelegationChainLength">
+ <property name="defaultValue">
+ <util:constant
+ static-field="net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration.DEFAULT_DELEGATION_CHAIN_LENGTH"/>
+ </property>
+ </bean>
</property>
</bean>
@@ -454,7 +474,7 @@
</constructor-arg>
</bean>
</property>
- <property name="signRequests">
+ <property name="signRequestsPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signRequests" />
@@ -464,7 +484,7 @@
</constructor-arg>
</bean>
</property>
- <property name="signResponses">
+ <property name="signResponsesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signResponses" />
@@ -474,7 +494,7 @@
</constructor-arg>
</bean>
</property>
- <property name="encryptNameIDs">
+ <property name="encryptNameIDsPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptNameIDs" />
@@ -492,7 +512,7 @@
<bean id="SAML2.AttributeQuery.MDDriven" parent="AbstractMDDrivenSAML2Profile" lazy-init="true"
class="net.shibboleth.idp.saml.saml2.profile.config.AttributeQueryProfileConfiguration"
p:inboundInterceptorFlows="security-policy/saml-soap">
- <property name="signResponses">
+ <property name="signResponsesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signResponses" />
@@ -502,7 +522,7 @@
</constructor-arg>
</bean>
</property>
- <property name="encryptAssertions">
+ <property name="encryptAssertionsPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptAssertions" />
@@ -517,7 +537,7 @@
<bean id="SAML2.ArtifactResolution.MDDriven" parent="AbstractMDDrivenSAML2Profile" lazy-init="true"
class="net.shibboleth.idp.saml.saml2.profile.config.ArtifactResolutionProfileConfiguration"
p:inboundInterceptorFlows="security-policy/saml-soap">
- <property name="signResponses">
+ <property name="signResponsesPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signResponses" />
@@ -527,7 +547,7 @@
</constructor-arg>
</bean>
</property>
- <property name="encryptAssertions">
+ <property name="encryptAssertionsPredicate">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
<bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptAssertions" />
@@ -580,7 +600,12 @@
<bean id="CAS.ValidateConfiguration.MDDriven" parent="AbstractMDDrivenCASProfile" lazy-init="true"
class="net.shibboleth.idp.cas.config.impl.ValidateConfiguration">
<property name="ticketValidityPeriodLookupStrategy">
- <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="ticketValidityPeriod" p:defaultValue="PT12H" />
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="ticketValidityPeriod">
+ <property name="defaultValue">
+ <util:constant
+ static-field="net.shibboleth.idp.cas.config.impl.ValidateConfiguration.DEFAULT_TICKET_VALIDITY_PERIOD" />
+ </property>
+ </bean>
</property>
<property name="serviceComparatorLookupStrategy">
<bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="serviceComparator"
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/idwsf/profile/config/SSOSProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/idwsf/profile/config/SSOSProfileConfiguration.java
index e25e658..22d9b7d 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/idwsf/profile/config/SSOSProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/idwsf/profile/config/SSOSProfileConfiguration.java
@@ -20,6 +20,7 @@ package net.shibboleth.idp.saml.idwsf.profile.config;
import java.util.function.Predicate;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -48,32 +49,42 @@ public class SSOSProfileConfiguration extends BrowserSSOProfileConfiguration {
*
* @param profileId unique ID for this profile
*/
- protected SSOSProfileConfiguration(final String profileId) {
+ protected SSOSProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
delegationPredicate = Predicates.alwaysFalse();
}
/**
- * Gets the predicate used to determine whether a delegated token presented
- * to the IdP by another non-user entity may be used to complete SAML 2 SSO
- * to this relying party.
+ * Get whether a delegated token presented to the IdP by another non-user entity
+ * may be used to complete SAML 2 SSO to this relying party.
*
- * @return predicate the delegation predicate
+ * @param profileRequestContext current profile request context
+ *
+ * @return suitability of token for delegated authentication
*/
- @Nonnull public Predicate<ProfileRequestContext> getDelegationPredicate() {
- return delegationPredicate;
+ public boolean isDelegation(@Nullable final ProfileRequestContext profileRequestContext) {
+ return delegationPredicate.test(profileRequestContext);
}
/**
+ * Set whether a delegated token presented to the IdP by another non-user entity
+ * may be used to complete SAML 2 SSO to this relying party.
+ *
+ * @param flag flag to set
+ */
+ public void setDelegation(final boolean flag) {
+ delegationPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
* Sets the predicate used to determine whether a delegated token presented
* to the IdP by another non-user entity may be used to complete SAML 2 SSO
* to this relying party.
*
* @param predicate the new delegation predicate
*/
- public void setDelegationPredicate(
- @Nonnull final Predicate<ProfileRequestContext> predicate) {
+ public void setDelegationPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
delegationPredicate = Constraint.isNotNull(predicate, "Delegation predicate cannot be null");
}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java
index bb5c856..f148f66 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java
@@ -19,7 +19,6 @@ package net.shibboleth.idp.saml.profile.config;
import java.time.Duration;
import java.util.Collection;
-import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
@@ -34,7 +33,9 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElemen
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+import net.shibboleth.utilities.java.support.collection.CollectionSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -42,11 +43,13 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.google.common.base.Predicates;
-import com.google.common.collect.ImmutableSet;
/** Base class for SAML profile configurations. */
public abstract class AbstractSAMLProfileConfiguration extends AbstractConditionalProfileConfiguration implements
SAMLProfileConfiguration {
+
+ /** Default assertion lifetime. */
+ @Nonnull public static final Duration DEFAULT_ASSERTION_LIFETIME = Duration.ofMinutes(5);
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(AbstractSAMLProfileConfiguration.class);
@@ -61,19 +64,13 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractCondition
@Nonnull private Predicate<ProfileRequestContext> signAssertionsPredicate;
/** Controls whether to include a NotBefore attribute in the Conditions of generated assertions. */
- @Nullable private Predicate<ProfileRequestContext> includeNotBeforePredicate;
+ @Nonnull private Predicate<ProfileRequestContext> includeNotBeforePredicate;
/** Lookup function to supply {@link #assertionLifetime} property. */
- @Nullable private Function<ProfileRequestContext,Duration> assertionLifetimeLookupStrategy;
-
- /** Lifetime of an assertion. Default value: 5 minutes */
- @Nonnull private Duration assertionLifetime;
+ @Nonnull private Function<ProfileRequestContext,Duration> assertionLifetimeLookupStrategy;
/** Lookup function to supply {@link #assertionAudiences} property. */
- @Nullable private Function<ProfileRequestContext,Collection<String>> assertionAudiencesLookupStrategy;
-
- /** Additional audiences to which an assertion may be released. Default value: empty */
- @Nonnull @NonnullElements private Set<String> assertionAudiences;
+ @Nonnull private Function<ProfileRequestContext,Collection<String>> assertionAudiencesLookupStrategy;
/**
* Constructor.
@@ -87,8 +84,8 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractCondition
signResponsesPredicate = Predicates.alwaysFalse();
signAssertionsPredicate = Predicates.alwaysFalse();
includeNotBeforePredicate = Predicates.alwaysTrue();
- assertionLifetime = Duration.ofMinutes(5);
- assertionAudiences = Collections.emptySet();
+ assertionLifetimeLookupStrategy = FunctionSupport.constant(DEFAULT_ASSERTION_LIFETIME);
+ assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
@@ -104,54 +101,86 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractCondition
}
/** {@inheritDoc} */
- @Nonnull public Predicate<ProfileRequestContext> getSignAssertions() {
- return signAssertionsPredicate;
+ public boolean isSignAssertions(@Nullable final ProfileRequestContext profileRequestContext) {
+ return signAssertionsPredicate.test(profileRequestContext);
}
/**
+ * Set whether generated assertions should be signed.
+ *
+ * @param flag flag to set
+ */
+ public void setSignAssertions(final boolean flag) {
+ signAssertionsPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
* Set the predicate used to determine if generated assertions should be signed.
*
* @param predicate predicate used to determine if generated assertions should be signed
+ *
+ * @since 4.0.0
*/
- public void setSignAssertions(@Nonnull final Predicate<ProfileRequestContext> predicate) {
- signAssertionsPredicate =
- Constraint.isNotNull(predicate, "Predicate to determine if assertions should be signed cannot be null");
+ public void setSignAssertionsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+ signAssertionsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
}
/** {@inheritDoc} */
- @Nonnull public Predicate<ProfileRequestContext> getSignRequests() {
- return signRequestsPredicate;
+ public boolean isSignRequests(@Nullable final ProfileRequestContext profileRequestContext) {
+ return signRequestsPredicate.test(profileRequestContext);
}
/**
+ * Set whether generated requests should be signed.
+ *
+ * @param flag flag to set
+ */
+ public void setSignRequests(final boolean flag) {
+ signRequestsPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
* Set the predicate used to determine if generated requests should be signed.
*
* @param predicate predicate used to determine if generated requests should be signed
+ *
+ * @since 4.0.0
*/
- public void setSignRequests(@Nonnull final Predicate<ProfileRequestContext> predicate) {
- signRequestsPredicate =
- Constraint.isNotNull(predicate,
- "Predicate to determine if requests should be signed cannot be null");
+ public void setSignRequestsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+ signRequestsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
}
/** {@inheritDoc} */
- @Nonnull public Predicate<ProfileRequestContext> getSignResponses() {
- return signResponsesPredicate;
+ public boolean isSignResponses(@Nullable final ProfileRequestContext profileRequestContext) {
+ return signResponsesPredicate.test(profileRequestContext);
}
/**
+ * Set whether generated responses should be signed.
+ *
+ * @param flag flag to set
+ */
+ public void setSignResponses(final boolean flag) {
+ signResponsesPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
* Set the predicate used to determine if generated responses should be signed.
*
* @param predicate predicate used to determine if generated responses should be signed
+ *
+ * @since 4.0.0
*/
- public void setSignResponses(@Nonnull final Predicate<ProfileRequestContext> predicate) {
- signResponsesPredicate =
- Constraint.isNotNull(predicate, "Predicate to determine if responses should be signed cannot be null");
+ public void setSignResponsesPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+ signResponsesPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
}
/** {@inheritDoc} */
- @Nonnull public Duration getAssertionLifetime() {
- return getIndirectProperty(assertionLifetimeLookupStrategy, assertionLifetime);
+ @Nonnull public Duration getAssertionLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
+ final Duration lifetime = assertionLifetimeLookupStrategy.apply(profileRequestContext);
+ Constraint.isNotNull(lifetime, "Assertion lifetime cannot be null");
+ Constraint.isFalse(lifetime.isNegative() || lifetime.isZero(), "Assertion lifetime must be greater than 0");
+ return lifetime;
}
/**
@@ -163,45 +192,32 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractCondition
Constraint.isNotNull(lifetime, "Assertion lifetime cannot be null");
Constraint.isFalse(lifetime.isNegative() || lifetime.isZero(), "Assertion lifetime must be greater than 0");
- assertionLifetime = lifetime;
+ assertionLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
}
/**
- * Set a lookup strategy for the {@link #assertionLifetime} property.
+ * Set a lookup strategy for the lifetime of an assertion.
*
* @param strategy lookup strategy
*
* @since 3.3.0
*/
- public void setAssertionLifetimeLookupStrategy(@Nullable final Function<ProfileRequestContext,Duration> strategy) {
- assertionLifetimeLookupStrategy = strategy;
+ public void setAssertionLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext,Duration> strategy) {
+ assertionLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
/**{@inheritDoc} */
- public boolean includeConditionsNotBefore() {
- return includeNotBeforePredicate.test(getProfileRequestContext());
+ public boolean isIncludeConditionsNotBefore(@Nullable final ProfileRequestContext profileRequestContext) {
+ return includeNotBeforePredicate.test(profileRequestContext);
}
/**
* Set whether to include a NotBefore attribute in the Conditions of generated assertions.
*
- * @param include whether to include a NotBefore attribute in the Conditions of generated assertions
- */
- public void setIncludeConditionsNotBefore(final boolean include) {
- includeNotBeforePredicate = include ? Predicates.<ProfileRequestContext>alwaysTrue()
- : Predicates.<ProfileRequestContext>alwaysFalse();
- }
-
- /**
- * Get a condition to determine whether to include a NotBefore attribute in the Conditions of
- * generated assertions.
- *
- * @return a condition to evaluate
- *
- * @since 3.3.0
+ * @param flag flag to set
*/
- @Nonnull public Predicate<ProfileRequestContext> getIncludeConditionsNotBeforePredicate() {
- return includeNotBeforePredicate;
+ public void setIncludeConditionsNotBefore(final boolean flag) {
+ includeNotBeforePredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
}
/**
@@ -213,12 +229,13 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractCondition
* @since 3.3.0
*/
public void setIncludeConditionsNotBeforePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- includeNotBeforePredicate = Constraint.isNotNull(condition, "NotBefore predicate cannot be null");
+ includeNotBeforePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
/** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive public Set<String> getAdditionalAudiencesForAssertion() {
- return ImmutableSet.copyOf(getIndirectProperty(assertionAudiencesLookupStrategy, assertionAudiences));
+ @Nonnull @NonnullElements @NotLive public Set<String> getAdditionalAudiencesForAssertion(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return CollectionSupport.buildImmutableSet(assertionAudiencesLookupStrategy.apply(profileRequestContext));
}
/**
@@ -230,28 +247,30 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractCondition
public void setAdditionalAudiencesForAssertion(@Nullable @NonnullElements final Collection<String> audiences) {
if (audiences == null || audiences.isEmpty()) {
- assertionAudiences = Collections.emptySet();
+ assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
} else {
- assertionAudiences = new HashSet<>();
+ final Set<String> assertionAudiences = new HashSet<>();
for (final String audience : audiences) {
final String trimmedAudience = StringSupport.trimOrNull(audience);
if (trimmedAudience != null) {
assertionAudiences.add(trimmedAudience);
}
}
+ assertionAudiencesLookupStrategy = FunctionSupport.constant(assertionAudiences);
}
}
/**
- * Set a lookup strategy for the {@link #assertionAudiences} property.
+ * Set a lookup strategy for the set of audiences, in addition to the relying party(ies) to which the IdP
+ * is issuing the assertion, with which an assertion may be shared.
*
* @param strategy lookup strategy
*
- * @since 3.3.0
+ * @since 4.0.0
*/
- public void setAssertionAudiencesLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Collection<String>> strategy) {
- assertionAudiencesLookupStrategy = strategy;
+ public void setAdditionalAudiencesForAssertionLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
+ assertionAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/SAMLArtifactAwareProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/SAMLArtifactAwareProfileConfiguration.java
index 81367e2..d571a98 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/SAMLArtifactAwareProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/SAMLArtifactAwareProfileConfiguration.java
@@ -19,14 +19,19 @@ package net.shibboleth.idp.saml.profile.config;
import javax.annotation.Nullable;
+import org.opensaml.profile.context.ProfileRequestContext;
+
/** Common interface for SAML profile configurations involving artifact production. */
public interface SAMLArtifactAwareProfileConfiguration extends SAMLProfileConfiguration {
/**
* Get the associated {@link SAMLArtifactConfiguration} for the profile, if any.
*
+ * @param profileRequestContext current profile request context
+ *
* @return an associated artifact configuration, or null
*/
- @Nullable SAMLArtifactConfiguration getArtifactConfiguration();
+ @Nullable SAMLArtifactConfiguration getArtifactConfiguration(
+ @Nullable final ProfileRequestContext profileRequestContext);
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/SAMLProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/SAMLProfileConfiguration.java
index e5b4a35..fd27b9f 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/SAMLProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/SAMLProfileConfiguration.java
@@ -19,9 +19,9 @@ package net.shibboleth.idp.saml.profile.config;
import java.time.Duration;
import java.util.Set;
-import java.util.function.Predicate;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -36,44 +36,57 @@ public interface SAMLProfileConfiguration extends ProfileConfiguration {
/**
* Get the predicate used to determine if generated assertions should be signed.
*
+ * @param profileRequestContext current profile request context
+ *
* @return predicate used to determine if generated assertions should be signed
*/
- @Nonnull Predicate<ProfileRequestContext> getSignAssertions();
+ boolean isSignAssertions(@Nullable final ProfileRequestContext profileRequestContext);
/**
* Get the predicate used to determine if generated requests should be signed.
*
+ * @param profileRequestContext current profile request context
+ *
* @return predicate used to determine if generated requests should be signed
*/
- @Nonnull Predicate<ProfileRequestContext> getSignRequests();
+ boolean isSignRequests(@Nullable final ProfileRequestContext profileRequestContext);
/**
* Get the predicate used to determine if generated responses should be signed.
*
+ * @param profileRequestContext current profile request context
+ *
* @return predicate used to determine if generated responses should be signed
*/
- @Nonnull Predicate<ProfileRequestContext> getSignResponses();
+ boolean isSignResponses(@Nullable final ProfileRequestContext profileRequestContext);
/**
* Get the lifetime of generated assertions.
*
+ * @param profileRequestContext current profile request context
+ *
* @return lifetime of generated assertions
*/
- @Nonnull Duration getAssertionLifetime();
+ @Nonnull Duration getAssertionLifetime(@Nullable final ProfileRequestContext profileRequestContext);
/**
* Get an unmodifiable set of audiences, in addition to the relying party(ies) to which the IdP is issuing the
* assertion, with which an assertion may be shared.
*
+ * @param profileRequestContext current profile request context
+ *
* @return additional audiences to which an assertion may be shared
*/
- @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getAdditionalAudiencesForAssertion();
+ @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getAdditionalAudiencesForAssertion(
+ @Nullable final ProfileRequestContext profileRequestContext);
/**
* Get whether to include a NotBefore attribute in the Conditions of generated assertions.
*
+ * @param profileRequestContext current profile request context
+ *
* @return whether to include a NotBefore attribute in the Conditions of generated assertions
*/
- boolean includeConditionsNotBefore();
+ boolean isIncludeConditionsNotBefore(@Nullable final ProfileRequestContext profileRequestContext);
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/NotBeforeProfileConfigPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/NotBeforeProfileConfigPredicate.java
index 18a4cb2..786adb2 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/NotBeforeProfileConfigPredicate.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/NotBeforeProfileConfigPredicate.java
@@ -41,7 +41,7 @@ public class NotBeforeProfileConfigPredicate extends AbstractRelyingPartyPredica
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null && pc instanceof SAMLProfileConfiguration) {
- return ((SAMLProfileConfiguration) pc).includeConditionsNotBefore();
+ return ((SAMLProfileConfiguration) pc).isIncludeConditionsNotBefore(input);
}
}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignAssertionsPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignAssertionsPredicate.java
index 1a10569..5ec665c 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignAssertionsPredicate.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignAssertionsPredicate.java
@@ -86,7 +86,7 @@ public class SignAssertionsPredicate extends AbstractRelyingPartyPredicate {
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null && pc instanceof SAMLProfileConfiguration) {
- return ((SAMLProfileConfiguration) pc).getSignAssertions().test(input);
+ return ((SAMLProfileConfiguration) pc).isSignAssertions(input);
}
}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignRequestsPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignRequestsPredicate.java
index 35a93a8..86f2c4a 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignRequestsPredicate.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignRequestsPredicate.java
@@ -35,7 +35,7 @@ public class SignRequestsPredicate extends AbstractRelyingPartyPredicate {
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null && pc instanceof SAMLProfileConfiguration) {
- return ((SAMLProfileConfiguration) pc).getSignRequests().test(input);
+ return ((SAMLProfileConfiguration) pc).isSignRequests(input);
}
}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignResponsesPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignResponsesPredicate.java
index 154e959..61f60a0 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignResponsesPredicate.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignResponsesPredicate.java
@@ -35,7 +35,7 @@ public class SignResponsesPredicate extends AbstractRelyingPartyPredicate {
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null && pc instanceof SAMLProfileConfiguration) {
- return ((SAMLProfileConfiguration) pc).getSignResponses().test(input);
+ return ((SAMLProfileConfiguration) pc).isSignResponses(input);
}
}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AssertionLifetimeLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AssertionLifetimeLookupFunction.java
index a252936..201e87d 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AssertionLifetimeLookupFunction.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AssertionLifetimeLookupFunction.java
@@ -43,7 +43,7 @@ public class AssertionLifetimeLookupFunction extends AbstractRelyingPartyLookupF
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null && pc instanceof SAMLProfileConfiguration) {
- return ((SAMLProfileConfiguration) pc).getAssertionLifetime();
+ return ((SAMLProfileConfiguration) pc).getAssertionLifetime(input);
}
}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AudienceRestrictionsLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AudienceRestrictionsLookupFunction.java
index 2c60b6f..25e71e9 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AudienceRestrictionsLookupFunction.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AudienceRestrictionsLookupFunction.java
@@ -19,6 +19,7 @@ package net.shibboleth.idp.saml.profile.config.navigate;
import java.util.Collection;
import java.util.Collections;
+import java.util.Set;
import javax.annotation.Nullable;
@@ -53,16 +54,21 @@ public class AudienceRestrictionsLookupFunction extends AbstractRelyingPartyLook
if (rpc != null) {
final String id = rpc.getRelyingPartyId();
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof SAMLProfileConfiguration
- && !((SAMLProfileConfiguration) pc).getAdditionalAudiencesForAssertion().isEmpty()) {
- final Builder<String> builder = ImmutableList.builder();
- if (id != null) {
- builder.add(rpc.getRelyingPartyId());
+ if (pc != null && pc instanceof SAMLProfileConfiguration) {
+ final Set<String> additional =
+ ((SAMLProfileConfiguration) pc).getAdditionalAudiencesForAssertion(input);
+ if (!additional.isEmpty()) {
+ final Builder<String> builder = ImmutableList.builder();
+ if (id != null) {
+ builder.add(rpc.getRelyingPartyId());
+ }
+ builder.addAll(additional);
+ return builder.build();
}
- builder.addAll(((SAMLProfileConfiguration) pc).getAdditionalAudiencesForAssertion());
- return builder.build();
- } else if (id != null) {
- return ImmutableList.<String>of(rpc.getRelyingPartyId());
+ }
+
+ if (id != null) {
+ return ImmutableList.of(rpc.getRelyingPartyId());
}
}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/ProxyAudienceRestrictionsLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/ProxyAudienceRestrictionsLookupFunction.java
index b3b96bf..9e28e52 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/ProxyAudienceRestrictionsLookupFunction.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/ProxyAudienceRestrictionsLookupFunction.java
@@ -32,8 +32,6 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.google.common.collect.ImmutableList;
-
/**
* A function that returns the effective proxy audience restrictions to include in assertions,
* based on the result of {@link SAML2ProfileConfiguration#getProxyAudiences()},
@@ -51,7 +49,7 @@ public class ProxyAudienceRestrictionsLookupFunction extends AbstractRelyingPart
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null && pc instanceof SAML2ProfileConfiguration) {
- return ImmutableList.copyOf(((SAML2ProfileConfiguration) pc).getProxyAudiences());
+ return ((SAML2ProfileConfiguration) pc).getProxyAudiences(input);
}
}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/ProxyCountLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/ProxyCountLookupFunction.java
index a0a026c..9dd69a7 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/ProxyCountLookupFunction.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/ProxyCountLookupFunction.java
@@ -42,7 +42,7 @@ public class ProxyCountLookupFunction extends AbstractRelyingPartyLookupFunction
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null && pc instanceof SAML2ProfileConfiguration) {
- return ((SAML2ProfileConfiguration) pc).getProxyCount();
+ return ((SAML2ProfileConfiguration) pc).getProxyCount(input);
}
}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/QualifiedNameIDFormatsLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/QualifiedNameIDFormatsLookupFunction.java
index fca862a..5cdc6ce 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/QualifiedNameIDFormatsLookupFunction.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/QualifiedNameIDFormatsLookupFunction.java
@@ -32,8 +32,6 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.google.common.collect.ImmutableList;
-
/**
* A function that returns the {@link org.opensaml.saml.saml2.core.NameID} Formats
* whose NameQualifier attributes should allow for defaulting based on the result of
@@ -54,7 +52,7 @@ public class QualifiedNameIDFormatsLookupFunction extends AbstractRelyingPartyLo
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
if (pc != null && pc instanceof SingleLogoutProfileConfiguration) {
- return ImmutableList.copyOf(((SingleLogoutProfileConfiguration) pc).getQualifiedNameIDFormats());
+ return ((SingleLogoutProfileConfiguration) pc).getQualifiedNameIDFormats(input);
}
}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/AbstractSAML1ArtifactAwareProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/AbstractSAML1ArtifactAwareProfileConfiguration.java
index 9078c54..0a8905c 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/AbstractSAML1ArtifactAwareProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/AbstractSAML1ArtifactAwareProfileConfiguration.java
@@ -28,21 +28,19 @@ import net.shibboleth.idp.saml.profile.config.AbstractSAMLProfileConfiguration;
import net.shibboleth.idp.saml.profile.config.SAMLArtifactAwareProfileConfiguration;
import net.shibboleth.idp.saml.profile.config.SAMLArtifactConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
* Configuration support for artifact-aware profiles.
*
* @since 3.4.0
*/
-public abstract class AbstractSAML1ArtifactAwareProfileConfiguration
- extends AbstractSAMLProfileConfiguration
+public abstract class AbstractSAML1ArtifactAwareProfileConfiguration extends AbstractSAMLProfileConfiguration
implements SAML1ProfileConfiguration, SAMLArtifactAwareProfileConfiguration {
-
- /** Explicitly set artifact configuration. */
- @Nullable private SAMLArtifactConfiguration artifactConfiguration;
/** Lookup function to supply <code>artifactConfiguration</code> property. */
- @Nullable private Function<ProfileRequestContext,SAMLArtifactConfiguration> artifactConfigurationLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext,SAMLArtifactConfiguration> artifactConfigurationLookupStrategy;
/**
* Constructor.
@@ -51,11 +49,14 @@ public abstract class AbstractSAML1ArtifactAwareProfileConfiguration
*/
protected AbstractSAML1ArtifactAwareProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
+
+ artifactConfigurationLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
- @Nullable public SAMLArtifactConfiguration getArtifactConfiguration() {
- return getIndirectProperty(artifactConfigurationLookupStrategy, artifactConfiguration);
+ @Nullable public SAMLArtifactConfiguration getArtifactConfiguration(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return artifactConfigurationLookupStrategy.apply(profileRequestContext);
}
/**
@@ -64,7 +65,7 @@ public abstract class AbstractSAML1ArtifactAwareProfileConfiguration
* @param config configuration to set
*/
public void setArtifactConfiguration(@Nullable final SAMLArtifactConfiguration config) {
- artifactConfiguration = config;
+ artifactConfigurationLookupStrategy = FunctionSupport.constant(config);
}
/**
@@ -75,8 +76,8 @@ public abstract class AbstractSAML1ArtifactAwareProfileConfiguration
* @since 3.3.0
*/
public void setArtifactConfigurationLookupStrategy(
- @Nullable final Function<ProfileRequestContext,SAMLArtifactConfiguration> strategy) {
- artifactConfigurationLookupStrategy = strategy;
+ @Nonnull final Function<ProfileRequestContext,SAMLArtifactConfiguration> strategy) {
+ artifactConfigurationLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/ArtifactResolutionProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/ArtifactResolutionProfileConfiguration.java
index e803c19..8e45e62 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/ArtifactResolutionProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/ArtifactResolutionProfileConfiguration.java
@@ -29,7 +29,7 @@ public class ArtifactResolutionProfileConfiguration
extends AbstractSAMLProfileConfiguration implements SAML1ProfileConfiguration {
/** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml1/query/artifact";
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml1/query/artifact";
/** Constructor. */
public ArtifactResolutionProfileConfiguration() {
@@ -43,7 +43,7 @@ public class ArtifactResolutionProfileConfiguration
*/
protected ArtifactResolutionProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- setSignResponses(new NoIntegrityMessageChannelPredicate());
+ setSignResponsesPredicate(new NoIntegrityMessageChannelPredicate());
}
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfiguration.java
index 930a8ec..2ee7b2c 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfiguration.java
@@ -24,11 +24,11 @@ import org.opensaml.profile.logic.NoIntegrityMessageChannelPredicate;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
/** Configuration support for SAML 1 attribute query requests. */
-public class AttributeQueryProfileConfiguration
- extends AbstractSAML1ArtifactAwareProfileConfiguration {
+public class AttributeQueryProfileConfiguration extends AbstractSAML1ArtifactAwareProfileConfiguration {
/** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml1/query/attribute";
+ @Nonnull @NotEmpty public static final String PROFILE_ID =
+ "http://shibboleth.net/ns/profiles/saml1/query/attribute";
/** Constructor. */
public AttributeQueryProfileConfiguration() {
@@ -42,7 +42,7 @@ public class AttributeQueryProfileConfiguration
*/
protected AttributeQueryProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- setSignResponses(new NoIntegrityMessageChannelPredicate());
+ setSignResponsesPredicate(new NoIntegrityMessageChannelPredicate());
}
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfiguration.java
index ad3809a..45b2222 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfiguration.java
@@ -61,17 +61,17 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML1ArtifactAwarePr
/** Whether to mandate forced authentication for the request. */
@Nonnull private Predicate<ProfileRequestContext> forceAuthnPredicate;
- /** Lookup function to supply {@link #defaultAuthenticationMethods} property. */
+ /** Lookup function to supply default authentication methods. */
@Nonnull private Function<ProfileRequestContext,Collection<AuthenticationMethodPrincipal>>
defaultAuthenticationMethodsLookupStrategy;
- /** Lookup function to supply {@link #authenticationFlows} property. */
+ /** Lookup function to supply authentication flows. */
@Nonnull private Function<ProfileRequestContext,Set<String>> authenticationFlowsLookupStrategy;
- /** Lookup function to supply {@link #postAuthenticationFlows} property. */
+ /** Lookup function to supply post authentication flows. */
@Nonnull private Function<ProfileRequestContext,Collection<String>> postAuthenticationFlowsLookupStrategy;
- /** Lookup function to supply {@link #nameIDFormatPrecedence} property. */
+ /** Lookup function to supply NameIdentifier formats. */
@Nonnull private Function<ProfileRequestContext,Collection<String>> nameIDFormatPrecedenceLookupStrategy;
/** Constructor. */
@@ -86,7 +86,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML1ArtifactAwarePr
*/
protected BrowserSSOProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- setSignResponses(Predicates.alwaysTrue());
+ setSignResponses(true);
resolveAttributesPredicate = Predicates.alwaysTrue();
includeAttributeStatementPredicate = Predicates.alwaysFalse();
authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
@@ -239,7 +239,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML1ArtifactAwarePr
}
/**
- * Set a lookup strategy for the {@link #authenticationFlows} property.
+ * Set a lookup strategy for the authentication flows to use.
*
* @param strategy lookup strategy
*
@@ -271,7 +271,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML1ArtifactAwarePr
}
/**
- * Set a lookup strategy for the {@link #postAuthenticationFlows} property.
+ * Set a lookup strategy for the post-authentication interceptor flows to enable.
*
* @param strategy lookup strategy
*
@@ -301,7 +301,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML1ArtifactAwarePr
}
/**
- * Set a lookup strategy for the {@link #nameIDFormatPrecedence} property.
+ * Set a lookup strategy for the name identifier formats to use.
*
* @param strategy lookup strategy
*
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ArtifactAwareProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ArtifactAwareProfileConfiguration.java
index e342ac2..1944288 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ArtifactAwareProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ArtifactAwareProfileConfiguration.java
@@ -32,21 +32,18 @@ import net.shibboleth.idp.saml.profile.config.SAMLArtifactConfiguration;
import net.shibboleth.idp.saml.profile.config.SAMLArtifactConsumerProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
/**
* Configuration support for artifact-aware profiles.
*
* @since 3.4.0
*/
-public abstract class AbstractSAML2ArtifactAwareProfileConfiguration
- extends AbstractSAML2ProfileConfiguration
+public abstract class AbstractSAML2ArtifactAwareProfileConfiguration extends AbstractSAML2ProfileConfiguration
implements SAMLArtifactAwareProfileConfiguration, SAMLArtifactConsumerProfileConfiguration {
-
- /** Explicitly set artifact configuration. */
- @Nullable private SAMLArtifactConfiguration artifactConfiguration;
/** Lookup function to supply <code>artifactConfiguration</code> property. */
- @Nullable private Function<ProfileRequestContext,SAMLArtifactConfiguration> artifactConfigurationLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext,SAMLArtifactConfiguration> artifactConfigurationLookupStrategy;
/** Predicate used to determine if artifact resolution requests should be signed. */
@Nonnull private Predicate<MessageContext> signArtifactRequestsPredicate;
@@ -61,13 +58,15 @@ public abstract class AbstractSAML2ArtifactAwareProfileConfiguration
*/
protected AbstractSAML2ArtifactAwareProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
+ artifactConfigurationLookupStrategy = FunctionSupport.constant(null);
signArtifactRequestsPredicate = new NoIntegrityMessageChannelPredicate();
clientTLSArtifactRequestsPredicate = new NoIntegrityMessageChannelPredicate().negate();
}
/** {@inheritDoc} */
- @Nullable public SAMLArtifactConfiguration getArtifactConfiguration() {
- return getIndirectProperty(artifactConfigurationLookupStrategy, artifactConfiguration);
+ @Nullable public SAMLArtifactConfiguration getArtifactConfiguration(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return artifactConfigurationLookupStrategy.apply(profileRequestContext);
}
/**
@@ -76,7 +75,7 @@ public abstract class AbstractSAML2ArtifactAwareProfileConfiguration
* @param config configuration to set
*/
public void setArtifactConfiguration(@Nullable final SAMLArtifactConfiguration config) {
- artifactConfiguration = config;
+ artifactConfigurationLookupStrategy = FunctionSupport.constant(config);
}
/**
@@ -87,8 +86,8 @@ public abstract class AbstractSAML2ArtifactAwareProfileConfiguration
* @since 3.3.0
*/
public void setArtifactConfigurationLookupStrategy(
- @Nullable final Function<ProfileRequestContext,SAMLArtifactConfiguration> strategy) {
- artifactConfigurationLookupStrategy = strategy;
+ @Nonnull final Function<ProfileRequestContext,SAMLArtifactConfiguration> strategy) {
+ artifactConfigurationLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
/** {@inheritDoc} */
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java
index 6d91605..57f23f2 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java
@@ -18,7 +18,6 @@
package net.shibboleth.idp.saml.saml2.profile.config;
import java.util.Collection;
-import java.util.Collections;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -29,17 +28,23 @@ import net.shibboleth.idp.saml.profile.config.AbstractSAMLProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
+import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+import net.shibboleth.utilities.java.support.collection.CollectionSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import com.google.common.base.Predicates;
-import com.google.common.collect.ImmutableList;
/** Base class for SAML 2 profile configurations. */
public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProfileConfiguration implements
SAML2ProfileConfiguration {
+
+ /** Default proxy count. */
+ @Nonnull public static final Long DEFAULT_PROXY_COUNT = 0L;
/** Whether encryption is optional in the face of no key, etc. */
@Nonnull private Predicate<ProfileRequestContext> encryptionOptionalPredicate;
@@ -54,16 +59,10 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
@Nonnull private Predicate<ProfileRequestContext> encryptAttributesPredicate;
/** Lookup function to supply {@link #proxyCount} property. */
- @Nullable private Function<ProfileRequestContext,Long> proxyCountLookupStrategy;
-
- /** Maximum proxy count for an assertion. Default value: 0 */
- private long proxyCount;
+ @Nonnull private Function<ProfileRequestContext,Long> proxyCountLookupStrategy;
- /** Lookup function to supply {@link #proxyAudiences} property. */
- @Nullable private Function<ProfileRequestContext,Collection<String>> proxyAudiencesLookupStrategy;
-
- /** Audiences for the proxy. */
- @Nonnull @NonnullElements private Collection<String> proxyAudiences;
+ /** Lookup function to supply proxy audiences. */
+ @Nonnull private Function<ProfileRequestContext,Collection<String>> proxyAudiencesLookupStrategy;
/**
* Constructor.
@@ -77,14 +76,16 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
encryptAssertionsPredicate = Predicates.alwaysFalse();
encryptNameIDsPredicate = Predicates.alwaysFalse();
encryptAttributesPredicate = Predicates.alwaysFalse();
- proxyCount = 0;
- proxyAudiences = Collections.emptyList();
+ proxyCountLookupStrategy = FunctionSupport.constant(DEFAULT_PROXY_COUNT);
+ proxyAudiencesLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
- @Override public long getProxyCount() {
- return Constraint.isGreaterThanOrEqual(0, getIndirectProperty(proxyCountLookupStrategy, proxyCount),
- "Proxy count must be greater than or equal to 0");
+ public long getProxyCount(@Nullable final ProfileRequestContext profileRequestContext) {
+ final Long count = proxyCountLookupStrategy.apply(profileRequestContext);
+ Constraint.isNotNull(count, "Proxy count cannot be null");
+ Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
+ return count;
}
/**
@@ -93,23 +94,25 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
* @param count maximum number of times an assertion may be proxied
*/
public void setProxyCount(@NonNegative final long count) {
- proxyCount = Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
+ proxyCountLookupStrategy = FunctionSupport.constant(
+ Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0"));
}
/**
- * Set a lookup strategy for the {@link #proxyCount} property.
+ * Set a lookup strategy for the maximum number of times an assertion may be proxied.
*
* @param strategy lookup strategy
*
* @since 3.3.0
*/
- public void setProxyCountLookupStrategy(@Nullable final Function<ProfileRequestContext,Long> strategy) {
- proxyCountLookupStrategy = strategy;
+ public void setProxyCountLookupStrategy(@Nonnull final Function<ProfileRequestContext,Long> strategy) {
+ proxyCountLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
/** {@inheritDoc} */
- @Override public Collection<String> getProxyAudiences() {
- return ImmutableList.copyOf(getIndirectProperty(proxyAudiencesLookupStrategy, proxyAudiences));
+ @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getProxyAudiences(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return CollectionSupport.buildImmutableList(proxyAudiencesLookupStrategy.apply(profileRequestContext));
}
/**
@@ -118,28 +121,28 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
* @param audiences proxy audiences to be added to responses
*/
public void setProxyAudiences(@Nullable @NonnullElements final Collection<String> audiences) {
- if (audiences == null) {
- proxyAudiences = Collections.emptyList();
+ if (audiences == null || audiences.isEmpty()) {
+ proxyAudiencesLookupStrategy = FunctionSupport.constant(null);
} else {
- proxyAudiences = StringSupport.normalizeStringCollection(audiences);
+ proxyAudiencesLookupStrategy = FunctionSupport.constant(StringSupport.normalizeStringCollection(audiences));
}
}
/**
- * Set a lookup strategy for the {@link #proxyAudiences} property.
+ * Set a lookup strategy for the proxy audiences to be added to responses.
*
* @param strategy lookup strategy
*
* @since 3.3.0
*/
public void setProxyAudiencesLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Collection<String>> strategy) {
- proxyAudiencesLookupStrategy = strategy;
+ @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
+ proxyAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
/** {@inheritDoc} */
- @Override public boolean isEncryptionOptional() {
- return encryptionOptionalPredicate.test(getProfileRequestContext());
+ public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
+ return encryptionOptionalPredicate.test(profileRequestContext);
}
/**
@@ -148,19 +151,7 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
* @param flag flag to set
*/
public void setEncryptionOptional(final boolean flag) {
- encryptionOptionalPredicate = flag ? Predicates.<ProfileRequestContext>alwaysTrue()
- : Predicates.<ProfileRequestContext>alwaysFalse();
- }
-
- /**
- * Get condition to determine whether encryption is optional in the face of a missing key, etc.
- *
- * @return condition
- *
- * @since 3.3.0
- */
- @Nonnull public Predicate<ProfileRequestContext> getEncryptionOptionalPredicate() {
- return encryptionOptionalPredicate;
+ encryptionOptionalPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
}
/**
@@ -175,51 +166,78 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
}
/** {@inheritDoc} */
- @Override @Nonnull public Predicate<ProfileRequestContext> getEncryptAssertions() {
- return encryptAssertionsPredicate;
+ public boolean isEncryptAssertions(@Nullable final ProfileRequestContext profileRequestContext) {
+ return encryptAssertionsPredicate.test(profileRequestContext);
}
/**
+ * Set whether assertions should be encrypted.
+ *
+ * @param flag flag to set
+ */
+ public void setEncryptAssertions(final boolean flag) {
+ encryptAssertionsPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
* Set the predicate used to determine if assertions should be encrypted.
*
* @param predicate predicate used to determine if assertions should be encrypted
+ *
+ * @since 4.0.0
*/
- public void setEncryptAssertions(@Nonnull final Predicate<ProfileRequestContext> predicate) {
- encryptAssertionsPredicate =
- Constraint.isNotNull(predicate,
- "Predicate to determine if assertions should be enecrypted cannot be null");
+ public void setEncryptAssertionsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+ encryptAssertionsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
}
/** {@inheritDoc} */
- @Override @Nonnull public Predicate<ProfileRequestContext> getEncryptNameIDs() {
- return encryptNameIDsPredicate;
+ public boolean isEncryptNameIDs(@Nullable final ProfileRequestContext profileRequestContext) {
+ return encryptNameIDsPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether name identifiers should be encrypted.
+ *
+ * @param flag flag to set
+ */
+ public void setEncryptNameIDs(final boolean flag) {
+ encryptNameIDsPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
}
/**
* Set the predicate used to determine if name identifiers should be encrypted.
*
* @param predicate predicate used to determine if name identifiers should be encrypted
+ *
+ * @since 4.0.0
*/
- public void setEncryptNameIDs(@Nonnull final Predicate<ProfileRequestContext> predicate) {
- encryptNameIDsPredicate =
- Constraint.isNotNull(predicate,
- "Predicate to determine if name identifiers should be encrypted cannot be null");
+ public void setEncryptNameIDsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+ encryptNameIDsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
}
/** {@inheritDoc} */
- @Override @Nonnull public Predicate<ProfileRequestContext> getEncryptAttributes() {
- return encryptAttributesPredicate;
+ public boolean isEncryptAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
+ return encryptAttributesPredicate.test(profileRequestContext);
}
/**
+ * Set whether attributes should be encrypted.
+ *
+ * @param flag flag to set
+ */
+ public void setEncryptAttributes(final boolean flag) {
+ encryptAttributesPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
* Set the predicate used to determine if attributes should be encrypted.
*
* @param predicate predicate used to determine if attributes should be encrypted
+ *
+ * @since 4.0.0
*/
- public void setEncryptAttributes(@Nonnull final Predicate<ProfileRequestContext> predicate) {
- encryptAttributesPredicate =
- Constraint.isNotNull(predicate,
- "Predicate to determine if attributes should be encrypted cannot be null");
+ public void setEncryptAttributesPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+ encryptAttributesPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
}
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
index 90d7427..38edcd5 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
@@ -28,7 +28,7 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
public class ArtifactResolutionProfileConfiguration extends AbstractSAML2ProfileConfiguration {
/** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/query/artifact";
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/query/artifact";
/** Constructor. */
public ArtifactResolutionProfileConfiguration() {
@@ -42,8 +42,8 @@ public class ArtifactResolutionProfileConfiguration extends AbstractSAML2Profile
*/
protected ArtifactResolutionProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- setSignResponses(new NoIntegrityMessageChannelPredicate());
- setEncryptAssertions(new NoConfidentialityMessageChannelPredicate());
+ setSignResponsesPredicate(new NoIntegrityMessageChannelPredicate());
+ setEncryptAssertionsPredicate(new NoConfidentialityMessageChannelPredicate());
}
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java
index d5037c3..ce14215 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java
@@ -28,7 +28,8 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
public class AttributeQueryProfileConfiguration extends AbstractSAML2ArtifactAwareProfileConfiguration {
/** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/query/attribute";
+ @Nonnull @NotEmpty public static final String PROFILE_ID =
+ "http://shibboleth.net/ns/profiles/saml2/query/attribute";
/** Constructor. */
public AttributeQueryProfileConfiguration() {
@@ -42,8 +43,8 @@ public class AttributeQueryProfileConfiguration extends AbstractSAML2ArtifactAwa
*/
protected AttributeQueryProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- setSignResponses(new NoIntegrityMessageChannelPredicate());
- setEncryptAssertions(new NoConfidentialityMessageChannelPredicate());
+ setSignResponsesPredicate(new NoIntegrityMessageChannelPredicate());
+ setEncryptAssertionsPredicate(new NoConfidentialityMessageChannelPredicate());
}
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index d569022..ac01345 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -53,6 +53,9 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
/** ID for this profile configuration. */
@Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/sso/browser";
+
+ /** Default maximum delegation chain length. */
+ @Nonnull public static final Long DEFAULT_DELEGATION_CHAIN_LENGTH = 1L;
/** Bit constant for RequestedAuthnContext feature. */
public static final int FEATURE_AUTHNCONTEXT = 0x1;
@@ -69,7 +72,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
/** Whether the response endpoint should be validated if the request is signed. */
@Nonnull private Predicate<ProfileRequestContext> skipEndpointValidationWhenSignedPredicate;
- /** Lookup function to supply {@link #maximumSPSessionLifetime} property. */
+ /** Lookup function to supply maximum session lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> maximumSPSessionLifetimeLookupStrategy;
/**
@@ -77,20 +80,20 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
*/
@Nonnull private Predicate<ProfileRequestContext> allowDelegationPredicate;
- /** Lookup function to supply {@link #maximumTokenDelegationChainLength} property. */
+ /** Lookup function to supply maximum delegation chain length. */
@Nonnull private Function<ProfileRequestContext,Long> maximumTokenDelegationChainLengthLookupStrategy;
- /** Lookup function to supply {@link #defaultAuthenticationContexts} property. */
+ /** Lookup function to supply default authentication methods. */
@Nonnull private Function<ProfileRequestContext,Collection<AuthnContextClassRefPrincipal>>
defaultAuthenticationContextsLookupStrategy;
- /** Lookup function to supply {@link #authenticationFlows} property. */
+ /** Lookup function to supply authentication flows. */
@Nonnull private Function<ProfileRequestContext,Set<String>> authenticationFlowsLookupStrategy;
- /** Lookup function to supply {@link #postAuthenticationFlows} property. */
+ /** Lookup function to supply post authentication flows. */
@Nonnull private Function<ProfileRequestContext,Collection<String>> postAuthenticationFlowsLookupStrategy;
- /** Lookup function to supply {@link #nameIDFormatPrecedence} property. */
+ /** Lookup function to supply NameID formats. */
@Nonnull private Function<ProfileRequestContext,Collection<String>> nameIDFormatPrecedenceLookupStrategy;
/** Constructor. */
@@ -105,14 +108,14 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
*/
protected BrowserSSOProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- setSignResponses(Predicates.alwaysTrue());
- setEncryptAssertions(Predicates.alwaysTrue());
+ setSignResponses(true);
+ setEncryptAssertions(true);
resolveAttributesPredicate = Predicates.alwaysTrue();
includeAttributeStatementPredicate = Predicates.alwaysTrue();
forceAuthnPredicate = Predicates.alwaysFalse();
skipEndpointValidationWhenSignedPredicate = Predicates.alwaysFalse();
maximumSPSessionLifetimeLookupStrategy = FunctionSupport.constant(null);
- maximumTokenDelegationChainLengthLookupStrategy = FunctionSupport.constant(1L);
+ maximumTokenDelegationChainLengthLookupStrategy = FunctionSupport.constant(DEFAULT_DELEGATION_CHAIN_LENGTH);
allowDelegationPredicate = Predicates.alwaysFalse();
authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
@@ -252,7 +255,10 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
* @return max lifetime of service provider should maintain a session
*/
@Nullable public Duration getMaximumSPSessionLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- return maximumSPSessionLifetimeLookupStrategy.apply(profileRequestContext);
+ final Duration lifetime = maximumSPSessionLifetimeLookupStrategy.apply(profileRequestContext);
+ Constraint.isFalse(lifetime != null && lifetime.isNegative(),
+ "Maximum SP session lifetime must be greater than or equal to 0");
+ return lifetime;
}
/**
@@ -321,8 +327,10 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
@Nullable final ProfileRequestContext profileRequestContext) {
final Long len = maximumTokenDelegationChainLengthLookupStrategy.apply(profileRequestContext);
- return Constraint.isGreaterThanOrEqual(0, len != null ? len : 1L,
- "Delegation chain length must be greater than or equal to 0");
+ Constraint.isNotNull(len, "Delegation chain length cannot be null");
+ Constraint.isGreaterThanOrEqual(0, len, "Delegation chain length must be greater than or equal to 0");
+
+ return len;
}
/**
@@ -337,7 +345,8 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
}
/**
- * Set a lookup strategy for the {@link #maximumTokenDelegationChainLength} property.
+ * Set a lookup strategy for the limits on the total number of delegates that
+ * may be derived from the initial SAML token.
*
* @param strategy lookup strategy
*
@@ -372,7 +381,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
}
/**
- * Set a lookup strategy for the {@link #defaultAuthenticationContexts} property.
+ * Set a lookup strategy for the authentication contexts to use, expressed as custom principals.
*
* @param strategy lookup strategy
*
@@ -404,7 +413,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
}
/**
- * Set a lookup strategy for the {@link #authenticationFlows} property.
+ * Set a lookup strategy for the authentication flows to use.
*
* @param strategy lookup strategy
*
@@ -436,7 +445,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
}
/**
- * Set a lookup strategy for the {@link #postAuthenticationFlows} property.
+ * Set a lookup strategy for the post-authentication interceptor flows to enable.
*
* @param strategy lookup strategy
*
@@ -466,7 +475,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
}
/**
- * Set a lookup strategy for the {@link #nameIDFormatPrecedence} property.
+ * Set a lookup strategy for the name identifier formats to use.
*
* @param strategy lookup strategy
*
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ECPProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ECPProfileConfiguration.java
index 7de5504..2534abc 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ECPProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ECPProfileConfiguration.java
@@ -18,7 +18,6 @@
package net.shibboleth.idp.saml.saml2.profile.config;
import java.util.Collection;
-import java.util.Collections;
import java.util.HashSet;
import java.util.Set;
import java.util.function.Function;
@@ -28,31 +27,29 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import com.google.common.collect.ImmutableSet;
-
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
+import net.shibboleth.utilities.java.support.collection.CollectionSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/** Configuration support for SAML 2 ECP. */
public class ECPProfileConfiguration extends BrowserSSOProfileConfiguration {
/** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/sso/ecp";
-
- /** Lookup function to supply {@link #localEvents} property. */
- @Nullable private Function<ProfileRequestContext,Set<String>> localEventsLookupStrategy;
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/sso/ecp";
- /** Local error events to handle without a SOAP fault. */
- @Nonnull @NonnullElements private Set<String> localEvents;
+ /** Lookup function to supply Local error events to handle without a SOAP fault. */
+ @Nonnull private Function<ProfileRequestContext,Set<String>> localEventsLookupStrategy;
/** Constructor. */
public ECPProfileConfiguration() {
this(PROFILE_ID);
- localEvents = Collections.emptySet();
+ localEventsLookupStrategy = FunctionSupport.constant(null);
}
/**
@@ -67,12 +64,15 @@ public class ECPProfileConfiguration extends BrowserSSOProfileConfiguration {
/**
* Get the set of local events to handle without a SOAP fault.
*
+ * @param profileRequestContext current profile request context
+ *
* @return truly local events
*
* @since 3.3.0
*/
- @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getLocalEvents() {
- return ImmutableSet.copyOf(getIndirectProperty(localEventsLookupStrategy, localEvents));
+ @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getLocalEvents(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return CollectionSupport.buildImmutableSet(localEventsLookupStrategy.apply(profileRequestContext));
}
/**
@@ -84,23 +84,23 @@ public class ECPProfileConfiguration extends BrowserSSOProfileConfiguration {
*/
public void setLocalEvents(@Nullable @NonnullElements final Collection<String> events) {
- if (events != null) {
- localEvents = new HashSet<>(StringSupport.normalizeStringCollection(events));
+ if (events != null && !events.isEmpty()) {
+ localEventsLookupStrategy = FunctionSupport.constant(
+ new HashSet<>(StringSupport.normalizeStringCollection(events)));
} else {
- localEvents = Collections.emptySet();
+ localEventsLookupStrategy = FunctionSupport.constant(null);
}
}
/**
- * Set a lookup strategy for the {@link #localEvents} property.
+ * Set a lookup strategy for the local events to handle without a SOAP fault.
*
* @param strategy lookup strategy
*
* @since 3.3.0
*/
- public void setLocalEventsLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Set<String>> strategy) {
- localEventsLookupStrategy = strategy;
+ public void setLocalEventsLookupStrategy(@Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
+ localEventsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
index 2164fc9..d31ddcb 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
@@ -18,9 +18,9 @@
package net.shibboleth.idp.saml.saml2.profile.config;
import java.util.Collection;
-import java.util.function.Predicate;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
@@ -37,16 +37,21 @@ public interface SAML2ProfileConfiguration {
/**
* Get the maximum number of times an assertion may be proxied.
*
+ * @param profileRequestContext profileRequestContext
+ *
* @return maximum number of times an assertion may be proxied
*/
- @NonNegative long getProxyCount();
+ @NonNegative long getProxyCount(@Nullable final ProfileRequestContext profileRequestContext);
/**
* Get the unmodifiable collection of audiences for a proxied assertion.
*
+ * @param profileRequestContext profileRequestContext
+ *
* @return audiences for a proxied assertion
*/
- @Nonnull @NonnullElements @NotLive @Unmodifiable Collection<String> getProxyAudiences();
+ @Nonnull @NonnullElements @NotLive @Unmodifiable Collection<String> getProxyAudiences(
+ @Nullable final ProfileRequestContext profileRequestContext);
/**
* Get whether to ignore an inability to encrypt due to external factors.
@@ -56,30 +61,38 @@ public interface SAML2ProfileConfiguration {
* algorithm, etc.</p>
*
* <p>Defaults to false.</p>
+ *
+ * @param profileRequestContext profileRequestContext
*
* @return true iff encryption should be treated as optional
*/
- boolean isEncryptionOptional();
+ boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext);
/**
* Get the predicate used to determine if assertions should be encrypted.
*
+ * @param profileRequestContext profileRequestContext
+ *
* @return predicate used to determine if assertions should be encrypted
*/
- @Nonnull Predicate<ProfileRequestContext> getEncryptAssertions();
+ boolean isEncryptAssertions(@Nullable final ProfileRequestContext profileRequestContext);
/**
* Get the predicate used to determine if name identifiers should be encrypted.
*
+ * @param profileRequestContext profileRequestContext
+ *
* @return predicate used to determine if name identifiers should be encrypted
*/
- @Nonnull Predicate<ProfileRequestContext> getEncryptNameIDs();
+ boolean isEncryptNameIDs(@Nullable final ProfileRequestContext profileRequestContext);
/**
* Get the predicate used to determine if attributes should be encrypted.
*
+ * @param profileRequestContext profileRequestContext
+ *
* @return predicate used to determine if attributes should be encrypted
*/
- @Nonnull Predicate<ProfileRequestContext> getEncryptAttributes();
+ boolean isEncryptAttributes(@Nullable final ProfileRequestContext profileRequestContext);
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfiguration.java
index 6248c0d..15b1890 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfiguration.java
@@ -18,7 +18,6 @@
package net.shibboleth.idp.saml.saml2.profile.config;
import java.util.Collection;
-import java.util.Collections;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -30,19 +29,19 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.logic.NoConfidentialityMessageChannelPredicate;
import org.opensaml.profile.logic.NoIntegrityMessageChannelPredicate;
-import com.google.common.collect.ImmutableList;
-
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
+import net.shibboleth.utilities.java.support.collection.CollectionSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
/** Configuration support for SAML 2 Single Logout. */
public class SingleLogoutProfileConfiguration extends AbstractSAML2ArtifactAwareProfileConfiguration {
/** ID for this profile configuration. */
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/logout";
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/logout";
/** Predicate used to determine if SOAP-based requests should be signed. */
@Nonnull private Predicate<MessageContext> signSOAPRequestsPredicate;
@@ -51,10 +50,7 @@ public class SingleLogoutProfileConfiguration extends AbstractSAML2ArtifactAware
@Nonnull private Predicate<MessageContext> clientTLSSOAPRequestsPredicate;
/** Lookup function to supply {@link #qualifiedNameIDFormats} property. */
- @Nullable private Function<ProfileRequestContext,Collection<String>> qualifiedNameIDFormatsLookupStrategy;
-
- /** NameID formats whose matching rules accommodate defaulted qualifiers. */
- @Nonnull @NonnullElements private Collection<String> qualifiedNameIDFormats;
+ @Nonnull private Function<ProfileRequestContext,Collection<String>> qualifiedNameIDFormatsLookupStrategy;
/** Constructor. */
public SingleLogoutProfileConfiguration() {
@@ -68,14 +64,14 @@ public class SingleLogoutProfileConfiguration extends AbstractSAML2ArtifactAware
*/
protected SingleLogoutProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- setSignRequests(new NoIntegrityMessageChannelPredicate());
- setSignResponses(new NoIntegrityMessageChannelPredicate());
- setEncryptNameIDs(new NoConfidentialityMessageChannelPredicate());
+ setSignRequestsPredicate(new NoIntegrityMessageChannelPredicate());
+ setSignResponsesPredicate(new NoIntegrityMessageChannelPredicate());
+ setEncryptNameIDsPredicate(new NoConfidentialityMessageChannelPredicate());
signSOAPRequestsPredicate = new org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate();
clientTLSSOAPRequestsPredicate = new org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate().negate();
- qualifiedNameIDFormats = Collections.emptyList();
+ qualifiedNameIDFormatsLookupStrategy = FunctionSupport.constant(null);
}
/**
@@ -131,14 +127,17 @@ public class SingleLogoutProfileConfiguration extends AbstractSAML2ArtifactAware
*
* <p>In the core standard, only the {@link org.opensaml.saml.saml2.core.NameIDType.PERSISTENT} and
* {@link org.opensaml.saml.saml2.core.NameIDType.TRANSIENT} Formats are defined in this manner. This
- * setting identifies <strong>additional</strong> Formats that should be handled in this way.</p>
+ * setting identifies <strong>additional</strong> Formats that should be handled in this way.</p>
+ *
+ * @param profileRequestContext current profile request context
*
* @return additional Formats for which defaulting of qualifiers is permissable
*
* @since 3.4.0
*/
- @Nonnull @NonnullElements @NotLive public Collection<String> getQualifiedNameIDFormats() {
- return ImmutableList.copyOf(getIndirectProperty(qualifiedNameIDFormatsLookupStrategy, qualifiedNameIDFormats));
+ @Nonnull @NonnullElements @NotLive public Collection<String> getQualifiedNameIDFormats(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return CollectionSupport.buildImmutableList(qualifiedNameIDFormatsLookupStrategy.apply(profileRequestContext));
}
/**
@@ -148,29 +147,32 @@ public class SingleLogoutProfileConfiguration extends AbstractSAML2ArtifactAware
*
* <p>In the core standard, only the {@link org.opensaml.saml.saml2.core.NameIDType.PERSISTENT} and
* {@link org.opensaml.saml.saml2.core.NameIDType.TRANSIENT} Formats are defined in this manner. This
- * setting identifies <strong>additional</strong> Formats that should be handled in this way.</p>
+ * setting identifies <strong>additional</strong> Formats that should be handled in this way.</p>
*
* @param formats additional Formats for which defaulting of qualifiers is permissable
*
* @since 3.4.0
*/
public void setQualifiedNameIDFormats(@Nullable @NonnullElements final Collection<String> formats) {
- if (formats == null) {
- qualifiedNameIDFormats = Collections.emptyList();
+ if (formats == null || formats.isEmpty()) {
+ qualifiedNameIDFormatsLookupStrategy = FunctionSupport.constant(null);
} else {
- qualifiedNameIDFormats = StringSupport.normalizeStringCollection(formats);
+ qualifiedNameIDFormatsLookupStrategy =
+ FunctionSupport.constant(StringSupport.normalizeStringCollection(formats));
}
}
/**
- * Set a lookup strategy for the {@link #qualifiedNameIDFormats} property.
+ * Set a lookup strategy for the Format values for which the use of the NameQualifier and SPNameQualifier
+ * attributes is defined to allow default/implicit values derived from the asserting and relying parties.
*
* @param strategy lookup strategy
*
* @since 3.4.0
*/
public void setQualifiedNameIDFormatsLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Collection<String>> strategy) {
- qualifiedNameIDFormatsLookupStrategy = strategy;
+ @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
+ qualifiedNameIDFormatsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/SOAPErrorPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/SOAPErrorPredicate.java
index e005456..f79ff33 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/SOAPErrorPredicate.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/SOAPErrorPredicate.java
@@ -85,7 +85,7 @@ public class SOAPErrorPredicate extends AbstractRelyingPartyPredicate {
}
final String event = eventCtx.getEvent().toString();
- if (((ECPProfileConfiguration) rpCtx.getProfileConfig()).getLocalEvents().contains(event)) {
+ if (((ECPProfileConfiguration) rpCtx.getProfileConfig()).getLocalEvents(input).contains(event)) {
log.debug("Error event {} will be handled locally", event);
return false;
} else {
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/idwsf/profile/config/SSOSProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/idwsf/profile/config/SSOSProfileConfigurationTest.java
index 709d043..476fe4f 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/idwsf/profile/config/SSOSProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/idwsf/profile/config/SSOSProfileConfigurationTest.java
@@ -19,12 +19,9 @@ package net.shibboleth.idp.saml.idwsf.profile.config;
import net.shibboleth.idp.saml.idwsf.profile.config.SSOSProfileConfiguration;
-import org.opensaml.profile.context.ProfileRequestContext;
import org.testng.Assert;
import org.testng.annotations.Test;
-import com.google.common.base.Predicates;
-
/** Unit test for {@link SSOSProfileConfiguration}. */
public class SSOSProfileConfigurationTest {
@@ -38,15 +35,11 @@ public class SSOSProfileConfigurationTest {
@Test
public void testDelegationPredicate() {
- ProfileRequestContext prc = new ProfileRequestContext<>();
-
SSOSProfileConfiguration config = new SSOSProfileConfiguration();
- Assert.assertNotNull(config.getDelegationPredicate());
- Assert.assertFalse(config.getDelegationPredicate().test(prc));
+ Assert.assertFalse(config.isDelegation(null));
- config.setDelegationPredicate(Predicates.<ProfileRequestContext>alwaysTrue());
- Assert.assertNotNull(config.getDelegationPredicate());
- Assert.assertTrue(config.getDelegationPredicate().test(prc));
+ config.setDelegation(true);
+ Assert.assertTrue(config.isDelegation(null));
}
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfigurationTest.java
index 7b783a0..4d76587 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfigurationTest.java
@@ -19,14 +19,12 @@ package net.shibboleth.idp.saml.profile.config;
import java.time.Duration;
import java.util.Arrays;
-import java.util.Collections;
import java.util.HashSet;
import java.util.Set;
import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-import org.opensaml.profile.context.ProfileRequestContext;
import org.testng.Assert;
import org.testng.annotations.Test;
@@ -37,13 +35,12 @@ public class AbstractSAMLProfileConfigurationTest {
@Test public void testSignAssertionsCriteria() {
final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
- Assert.assertNotNull(config.getSignAssertions());
- config.setSignAssertions(Predicates.<ProfileRequestContext> alwaysFalse());
- Assert.assertSame(config.getSignAssertions(), Predicates.<ProfileRequestContext> alwaysFalse());
+ config.setSignAssertions(false);
+ Assert.assertFalse(config.isSignAssertions(null));
try {
- config.setSignAssertions(null);
+ config.setSignAssertionsPredicate(null);
Assert.fail();
} catch (ConstraintViolationException e) {
// excepted this
@@ -52,13 +49,12 @@ public class AbstractSAMLProfileConfigurationTest {
@Test public void testSignResponsesCriteria() {
final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
- Assert.assertNotNull(config.getSignResponses());
- config.setSignResponses(Predicates.<ProfileRequestContext> alwaysFalse());
- Assert.assertSame(config.getSignResponses(), Predicates.<ProfileRequestContext> alwaysFalse());
+ config.setSignResponses(false);
+ Assert.assertFalse(config.isSignResponses(null));
try {
- config.setSignResponses(null);
+ config.setSignResponsesPredicate(null);
Assert.fail();
} catch (ConstraintViolationException e) {
// excepted this
@@ -67,13 +63,12 @@ public class AbstractSAMLProfileConfigurationTest {
@Test public void testSignRequestsCriteria() {
final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
- Assert.assertNotNull(config.getSignRequests());
- config.setSignRequests(Predicates.<ProfileRequestContext> alwaysFalse());
- Assert.assertSame(config.getSignRequests(), Predicates.<ProfileRequestContext> alwaysFalse());
+ config.setSignRequests(false);
+ Assert.assertFalse(config.isSignRequests(null));
try {
- config.setSignRequests(null);
+ config.setSignRequestsPredicate(null);
Assert.fail();
} catch (ConstraintViolationException e) {
// excepted this
@@ -82,10 +77,10 @@ public class AbstractSAMLProfileConfigurationTest {
@Test public void testAssertionLifetime() {
final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
- Assert.assertTrue(config.getAssertionLifetime().toMillis() > 0);
+ Assert.assertTrue(config.getAssertionLifetime(null).toMillis() > 0);
config.setAssertionLifetime(Duration.ofMillis(100));
- Assert.assertEquals(config.getAssertionLifetime(), Duration.ofMillis(100));
+ Assert.assertEquals(config.getAssertionLifetime(null), Duration.ofMillis(100));
try {
config.setAssertionLifetime(Duration.ZERO);
@@ -104,37 +99,41 @@ public class AbstractSAMLProfileConfigurationTest {
@Test public void testIndirectAssertionLifetime() {
final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
- config.setAssertionLifetimeLookupStrategy(
- FunctionSupport.<ProfileRequestContext,Duration>constant(Duration.ofMillis(500)));
- Assert.assertEquals(config.getAssertionLifetime(), Duration.ofMillis(500));
+ config.setAssertionLifetimeLookupStrategy(FunctionSupport.constant(Duration.ofMillis(500)));
+ Assert.assertEquals(config.getAssertionLifetime(null), Duration.ofMillis(500));
- config.setAssertionLifetimeLookupStrategy(FunctionSupport.<ProfileRequestContext,Duration>constant(null));
- Assert.assertEquals(config.getAssertionLifetime(), Duration.ofMinutes(5));
+ config.setAssertionLifetimeLookupStrategy(FunctionSupport.constant(null));
+ try {
+ config.getAssertionLifetime(null);
+ Assert.fail();
+ } catch (ConstraintViolationException e) {
+ // expected this
+ }
}
@Test public void testIncludeNotBefore() {
final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
- Assert.assertTrue(config.includeConditionsNotBefore());
+ Assert.assertTrue(config.isIncludeConditionsNotBefore(null));
config.setIncludeConditionsNotBefore(false);
- Assert.assertFalse(config.includeConditionsNotBefore());
+ Assert.assertFalse(config.isIncludeConditionsNotBefore(null));
}
@Test public void testIndirectIncludeNotBefore() {
final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
- config.setIncludeConditionsNotBeforePredicate(Predicates.<ProfileRequestContext>alwaysFalse());
- Assert.assertFalse(config.includeConditionsNotBefore());
+ config.setIncludeConditionsNotBeforePredicate(Predicates.alwaysFalse());
+ Assert.assertFalse(config.isIncludeConditionsNotBefore(null));
}
@Test public void testAdditionalAudiencesForAssertion() {
final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
- Assert.assertNotNull(config.getAdditionalAudiencesForAssertion());
- Assert.assertTrue(config.getAdditionalAudiencesForAssertion().isEmpty());
+ Assert.assertNotNull(config.getAdditionalAudiencesForAssertion(null));
+ Assert.assertTrue(config.getAdditionalAudiencesForAssertion(null).isEmpty());
config.setAdditionalAudiencesForAssertion(Arrays.asList("", null, " foo"));
- final Set<String> audiences = config.getAdditionalAudiencesForAssertion();
+ final Set<String> audiences = config.getAdditionalAudiencesForAssertion(null);
Assert.assertNotNull(audiences);
Assert.assertEquals(audiences.size(), 1);
Assert.assertTrue(audiences.contains("foo"));
@@ -146,9 +145,9 @@ public class AbstractSAMLProfileConfigurationTest {
// expected this
}
- config.setAdditionalAudiencesForAssertion(Collections.<String>emptyList());
- Assert.assertNotNull(config.getAdditionalAudiencesForAssertion());
- Assert.assertTrue(config.getAdditionalAudiencesForAssertion().isEmpty());
+ config.setAdditionalAudiencesForAssertion(null);
+ Assert.assertNotNull(config.getAdditionalAudiencesForAssertion(null));
+ Assert.assertTrue(config.getAdditionalAudiencesForAssertion(null).isEmpty());
}
@Test public void testIndirectAudiencesForAssertion() {
@@ -156,8 +155,8 @@ public class AbstractSAMLProfileConfigurationTest {
final Set<String> audiences = new HashSet<>();
audiences.add("foo");
audiences.add("bar");
- config.setAdditionalAudiencesForAssertion(audiences);
- Assert.assertEquals(config.getAdditionalAudiencesForAssertion(), audiences);
+ config.setAdditionalAudiencesForAssertionLookupStrategy(FunctionSupport.constant(audiences));
+ Assert.assertEquals(config.getAdditionalAudiencesForAssertion(null), audiences);
}
/** Mock class for test {@link AbstractSAMLProfileConfiguration}. */
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfigurationTest.java
index 391f994..a605cb9 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfigurationTest.java
@@ -41,12 +41,12 @@ public class AttributeQueryProfileConfigurationTest {
@Test
public void testArtifactConfiguration() {
final AttributeQueryProfileConfiguration config = new AttributeQueryProfileConfiguration();
- Assert.assertNull(config.getArtifactConfiguration());
+ Assert.assertNull(config.getArtifactConfiguration(null));
final SAMLArtifactConfiguration artifactConfiguration = new BasicSAMLArtifactConfiguration();
config.setArtifactConfiguration(artifactConfiguration);
- Assert.assertSame(config.getArtifactConfiguration(), artifactConfiguration);
+ Assert.assertSame(config.getArtifactConfiguration(null), artifactConfiguration);
}
@Test
@@ -57,7 +57,7 @@ public class AttributeQueryProfileConfigurationTest {
config.setArtifactConfigurationLookupStrategy(
FunctionSupport.<ProfileRequestContext,SAMLArtifactConfiguration>constant(artifactConfiguration));
- Assert.assertSame(config.getArtifactConfiguration(), artifactConfiguration);
+ Assert.assertSame(config.getArtifactConfiguration(null), artifactConfiguration);
}
}
\ No newline at end of file
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfigurationTest.java
index f596247..552c403 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfigurationTest.java
@@ -79,12 +79,12 @@ public class BrowserSSOProfileConfigurationTest {
@Test
public void testArtifactConfiguration() {
final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
- Assert.assertNull(config.getArtifactConfiguration());
+ Assert.assertNull(config.getArtifactConfiguration(null));
final SAMLArtifactConfiguration artifactConfiguration = new BasicSAMLArtifactConfiguration();
config.setArtifactConfiguration(artifactConfiguration);
- Assert.assertSame(config.getArtifactConfiguration(), artifactConfiguration);
+ Assert.assertSame(config.getArtifactConfiguration(null), artifactConfiguration);
}
@Test
@@ -95,7 +95,7 @@ public class BrowserSSOProfileConfigurationTest {
config.setArtifactConfigurationLookupStrategy(
FunctionSupport.<ProfileRequestContext,SAMLArtifactConfiguration>constant(artifactConfiguration));
- Assert.assertSame(config.getArtifactConfiguration(), artifactConfiguration);
+ Assert.assertSame(config.getArtifactConfiguration(null), artifactConfiguration);
}
@Test
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfigurationTest.java
index 99c31b6..6322819 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfigurationTest.java
@@ -18,13 +18,11 @@
package net.shibboleth.idp.saml.saml2.profile.config;
import java.util.ArrayList;
-import java.util.Collection;
import net.shibboleth.idp.saml.saml2.profile.config.AbstractSAML2ProfileConfiguration;
import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-import org.opensaml.profile.context.ProfileRequestContext;
import org.testng.Assert;
import org.testng.annotations.Test;
@@ -36,29 +34,28 @@ public class AbstractSAML2ProfileConfigurationTest {
@Test
public void testEncryptionOptional(){
final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
- Assert.assertFalse(config.isEncryptionOptional());
+ Assert.assertFalse(config.isEncryptionOptional(null));
config.setEncryptionOptional(true);
- Assert.assertTrue(config.isEncryptionOptional());
+ Assert.assertTrue(config.isEncryptionOptional(null));
}
@Test
public void testIndirectEncryptionOptional(){
final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
- config.setEncryptionOptionalPredicate(Predicates.<ProfileRequestContext>alwaysTrue());
- Assert.assertTrue(config.isEncryptionOptional());
+ config.setEncryptionOptionalPredicate(Predicates.alwaysTrue());
+ Assert.assertTrue(config.isEncryptionOptional(null));
}
@Test public void testEncryptNameIDsPredicate() {
final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
- Assert.assertNotNull(config.getEncryptNameIDs());
- config.setEncryptNameIDs(Predicates.<ProfileRequestContext> alwaysFalse());
- Assert.assertSame(config.getEncryptNameIDs(), Predicates.<ProfileRequestContext> alwaysFalse());
+ config.setEncryptNameIDs(true);
+ Assert.assertTrue(config.isEncryptNameIDs(null));
try {
- config.setEncryptNameIDs(null);
+ config.setEncryptNameIDsPredicate(null);
Assert.fail();
} catch (ConstraintViolationException e) {
// excepted this
@@ -67,13 +64,12 @@ public class AbstractSAML2ProfileConfigurationTest {
@Test public void testEncryptAssertionsPredicate() {
final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
- Assert.assertNotNull(config.getEncryptAssertions());
- config.setEncryptAssertions(Predicates.<ProfileRequestContext> alwaysFalse());
- Assert.assertSame(config.getEncryptAssertions(), Predicates.<ProfileRequestContext> alwaysFalse());
+ config.setEncryptAssertions(true);
+ Assert.assertTrue(config.isEncryptAssertions(null));
try {
- config.setEncryptAssertions(null);
+ config.setEncryptAssertionsPredicate(null);
Assert.fail();
} catch (ConstraintViolationException e) {
// excepted this
@@ -82,13 +78,12 @@ public class AbstractSAML2ProfileConfigurationTest {
@Test public void testEncryptAttributesPredicate() {
final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
- Assert.assertNotNull(config.getEncryptAttributes());
- config.setEncryptAttributes(Predicates.<ProfileRequestContext> alwaysFalse());
- Assert.assertSame(config.getEncryptAttributes(), Predicates.<ProfileRequestContext> alwaysFalse());
+ config.setEncryptAttributes(true);
+ Assert.assertTrue(config.isEncryptAttributes(null));
try {
- config.setEncryptAttributes(null);
+ config.setEncryptAttributesPredicate(null);
Assert.fail();
} catch (ConstraintViolationException e) {
// excepted this
@@ -97,23 +92,23 @@ public class AbstractSAML2ProfileConfigurationTest {
@Test public void testProxyCount() {
final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
- Assert.assertEquals(config.getProxyCount(), 0);
+ Assert.assertEquals(config.getProxyCount(null), 0);
config.setProxyCount(1);
- Assert.assertEquals(config.getProxyCount(), 1);
+ Assert.assertEquals(config.getProxyCount(null), 1);
}
@Test public void testIndirectProxyCount() {
final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
- config.setProxyCountLookupStrategy(FunctionSupport.<ProfileRequestContext,Long>constant(1L));
- Assert.assertEquals(config.getProxyCount(), 1);
+ config.setProxyCountLookupStrategy(FunctionSupport.constant(1L));
+ Assert.assertEquals(config.getProxyCount(null), 1);
}
@Test public void testProxyAudiences() {
final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
- Assert.assertNotNull(config.getProxyAudiences());
- Assert.assertTrue(config.getProxyAudiences().isEmpty());
+ Assert.assertNotNull(config.getProxyAudiences(null));
+ Assert.assertTrue(config.getProxyAudiences(null).isEmpty());
final ArrayList<String> audiences = new ArrayList<>();
audiences.add("foo");
@@ -121,11 +116,11 @@ public class AbstractSAML2ProfileConfigurationTest {
audiences.add("bar");
config.setProxyAudiences(audiences);
- Assert.assertNotSame(config.getProxyAudiences(), audiences);
- Assert.assertEquals(config.getProxyAudiences(), audiences);
+ Assert.assertNotSame(config.getProxyAudiences(null), audiences);
+ Assert.assertEquals(config.getProxyAudiences(null), audiences);
try {
- config.getProxyAudiences().add("baz");
+ config.getProxyAudiences(null).add("baz");
Assert.fail();
} catch (UnsupportedOperationException e) {
// expected this
@@ -140,13 +135,12 @@ public class AbstractSAML2ProfileConfigurationTest {
audiences.add("foo");
audiences.add("bar");
- config.setProxyAudiencesLookupStrategy(
- FunctionSupport.<ProfileRequestContext,Collection<String>>constant(audiences));
- Assert.assertNotSame(config.getProxyAudiences(), audiences);
- Assert.assertEquals(config.getProxyAudiences(), audiences);
+ config.setProxyAudiencesLookupStrategy(FunctionSupport.constant(audiences));
+ Assert.assertNotSame(config.getProxyAudiences(null), audiences);
+ Assert.assertEquals(config.getProxyAudiences(null), audiences);
try {
- config.getProxyAudiences().add("baz");
+ config.getProxyAudiences(null).add("baz");
Assert.fail();
} catch (UnsupportedOperationException e) {
// expected this
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java
index 348cc35..46fb32a 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java
@@ -17,8 +17,6 @@
package net.shibboleth.idp.saml.saml2.profile.config;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.context.ProfileRequestContext;
import org.testng.Assert;
import org.testng.annotations.Test;
@@ -43,12 +41,12 @@ public class AttributeQueryProfileConfigurationTest {
@Test
public void testArtifactConfiguration() {
final AttributeQueryProfileConfiguration config = new AttributeQueryProfileConfiguration();
- Assert.assertNull(config.getArtifactConfiguration());
+ Assert.assertNull(config.getArtifactConfiguration(null));
final SAMLArtifactConfiguration artifactConfiguration = new BasicSAMLArtifactConfiguration();
config.setArtifactConfiguration(artifactConfiguration);
- Assert.assertSame(config.getArtifactConfiguration(), artifactConfiguration);
+ Assert.assertSame(config.getArtifactConfiguration(null), artifactConfiguration);
}
@Test
@@ -56,26 +54,25 @@ public class AttributeQueryProfileConfigurationTest {
final AttributeQueryProfileConfiguration config = new AttributeQueryProfileConfiguration();
final SAMLArtifactConfiguration artifactConfiguration = new BasicSAMLArtifactConfiguration();
- config.setArtifactConfigurationLookupStrategy(
- FunctionSupport.<ProfileRequestContext,SAMLArtifactConfiguration>constant(artifactConfiguration));
+ config.setArtifactConfigurationLookupStrategy(FunctionSupport.constant(artifactConfiguration));
- Assert.assertSame(config.getArtifactConfiguration(), artifactConfiguration);
+ Assert.assertSame(config.getArtifactConfiguration(null), artifactConfiguration);
}
@Test
public void testSignArtifactRequests() {
final AttributeQueryProfileConfiguration config = new AttributeQueryProfileConfiguration();
- config.setSignArtifactRequests(Predicates.<MessageContext>alwaysTrue());
- Assert.assertSame(config.getSignArtifactRequests(), Predicates.<MessageContext>alwaysTrue());
+ config.setSignArtifactRequests(Predicates.alwaysTrue());
+ Assert.assertSame(config.getSignArtifactRequests(), Predicates.alwaysTrue());
}
@Test
public void testClientTLSArtifactRequests() {
final AttributeQueryProfileConfiguration config = new AttributeQueryProfileConfiguration();
- config.setClientTLSArtifactRequests(Predicates.<MessageContext>alwaysTrue());
- Assert.assertSame(config.getClientTLSArtifactRequests(), Predicates.<MessageContext>alwaysTrue());
+ config.setClientTLSArtifactRequests(Predicates.alwaysTrue());
+ Assert.assertSame(config.getClientTLSArtifactRequests(), Predicates.alwaysTrue());
}
}
\ No newline at end of file
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java
index b7b1135..ef53fb6 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java
@@ -153,12 +153,12 @@ public class BrowserSSOProfileConfigurationTest {
@Test
public void testArtifactConfiguration() {
final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
- Assert.assertNull(config.getArtifactConfiguration());
+ Assert.assertNull(config.getArtifactConfiguration(null));
final SAMLArtifactConfiguration artifactConfiguration = new BasicSAMLArtifactConfiguration();
config.setArtifactConfiguration(artifactConfiguration);
- Assert.assertSame(config.getArtifactConfiguration(), artifactConfiguration);
+ Assert.assertSame(config.getArtifactConfiguration(null), artifactConfiguration);
}
@Test
@@ -166,10 +166,9 @@ public class BrowserSSOProfileConfigurationTest {
final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
final SAMLArtifactConfiguration artifactConfiguration = new BasicSAMLArtifactConfiguration();
- config.setArtifactConfigurationLookupStrategy(
- FunctionSupport.<ProfileRequestContext,SAMLArtifactConfiguration>constant(artifactConfiguration));
+ config.setArtifactConfigurationLookupStrategy(FunctionSupport.constant(artifactConfiguration));
- Assert.assertSame(config.getArtifactConfiguration(), artifactConfiguration);
+ Assert.assertSame(config.getArtifactConfiguration(null), artifactConfiguration);
}
@Test
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfigurationTest.java
index be6dbfc..9d4767f 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfigurationTest.java
@@ -17,8 +17,6 @@
package net.shibboleth.idp.saml.saml2.profile.config;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.context.ProfileRequestContext;
import org.testng.Assert;
import org.testng.annotations.Test;
@@ -43,12 +41,12 @@ public class SingleLogoutProfileConfigurationTest {
@Test
public void testArtifactConfiguration() {
final SingleLogoutProfileConfiguration config = new SingleLogoutProfileConfiguration();
- Assert.assertNull(config.getArtifactConfiguration());
+ Assert.assertNull(config.getArtifactConfiguration(null));
final SAMLArtifactConfiguration artifactConfiguration = new BasicSAMLArtifactConfiguration();
config.setArtifactConfiguration(artifactConfiguration);
- Assert.assertSame(config.getArtifactConfiguration(), artifactConfiguration);
+ Assert.assertSame(config.getArtifactConfiguration(null), artifactConfiguration);
}
@Test
@@ -56,26 +54,25 @@ public class SingleLogoutProfileConfigurationTest {
final SingleLogoutProfileConfiguration config = new SingleLogoutProfileConfiguration();
final SAMLArtifactConfiguration artifactConfiguration = new BasicSAMLArtifactConfiguration();
- config.setArtifactConfigurationLookupStrategy(
- FunctionSupport.<ProfileRequestContext,SAMLArtifactConfiguration>constant(artifactConfiguration));
+ config.setArtifactConfigurationLookupStrategy(FunctionSupport.constant(artifactConfiguration));
- Assert.assertSame(config.getArtifactConfiguration(), artifactConfiguration);
+ Assert.assertSame(config.getArtifactConfiguration(null), artifactConfiguration);
}
@Test
public void testSignArtifactRequests() {
final SingleLogoutProfileConfiguration config = new SingleLogoutProfileConfiguration();
- config.setSignArtifactRequests(Predicates.<MessageContext>alwaysTrue());
- Assert.assertSame(config.getSignArtifactRequests(), Predicates.<MessageContext>alwaysTrue());
+ config.setSignArtifactRequests(Predicates.alwaysTrue());
+ Assert.assertSame(config.getSignArtifactRequests(), Predicates.alwaysTrue());
}
@Test
public void testClientTLSArtifactRequests() {
final SingleLogoutProfileConfiguration config = new SingleLogoutProfileConfiguration();
- config.setClientTLSArtifactRequests(Predicates.<MessageContext>alwaysTrue());
- Assert.assertSame(config.getClientTLSArtifactRequests(), Predicates.<MessageContext>alwaysTrue());
+ config.setClientTLSArtifactRequests(Predicates.alwaysTrue());
+ Assert.assertSame(config.getClientTLSArtifactRequests(), Predicates.alwaysTrue());
}
}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
index f44561f..3c16256 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
@@ -343,7 +343,8 @@ public class PopulateBindingAndEndpointContexts extends AbstractProfileAction {
(SAMLProfileConfiguration) rpContext.getProfileConfig();
if (profileConfiguration instanceof SAMLArtifactAwareProfileConfiguration) {
artifactConfiguration =
- ((SAMLArtifactAwareProfileConfiguration) profileConfiguration).getArtifactConfiguration();
+ ((SAMLArtifactAwareProfileConfiguration) profileConfiguration).getArtifactConfiguration(
+ profileRequestContext);
}
if (profileConfiguration instanceof BrowserSSOProfileConfiguration) {
skipValidationSinceSigned =
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/EvaluateDelegationPolicy.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/EvaluateDelegationPolicy.java
index b148318..9189721 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/EvaluateDelegationPolicy.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/EvaluateDelegationPolicy.java
@@ -19,7 +19,6 @@ package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
import java.util.List;
import java.util.function.Function;
-import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -28,6 +27,7 @@ import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.saml.idwsf.profile.config.SSOSProfileConfiguration;
+import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
import net.shibboleth.idp.saml.xmlobject.DelegationPolicy;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -76,9 +76,6 @@ import org.slf4j.LoggerFactory;
*/
public class EvaluateDelegationPolicy extends AbstractProfileAction {
- /** Default policy max chain length, when can't otherwise be derived. */
- @Nonnull public static final Long DEFAULT_POLICY_MAX_CHAIN_LENGTH = 1L;
-
/** Logger. */
@Nonnull private Logger log = LoggerFactory.getLogger(EvaluateDelegationPolicy.class);
@@ -104,8 +101,8 @@ public class EvaluateDelegationPolicy extends AbstractProfileAction {
/** The actual token delegation chain length. */
private Long tokenChainLength;
- /** The predicate used to determine whether the request is allowed to proceed. */
- private Predicate<ProfileRequestContext> delegationPredicate;
+ /** Whether the request is allowed to proceed. */
+ private boolean delegationAllowed;
/** Constructor. */
public EvaluateDelegationPolicy() {
@@ -204,8 +201,8 @@ public class EvaluateDelegationPolicy extends AbstractProfileAction {
}
if (relyingPartyContext.getProfileConfig() instanceof SSOSProfileConfiguration) {
- delegationPredicate = ((SSOSProfileConfiguration)relyingPartyContext.getProfileConfig())
- .getDelegationPredicate();
+ delegationAllowed = ((SSOSProfileConfiguration)relyingPartyContext.getProfileConfig()).isDelegation(
+ profileRequestContext);
} else {
log.warn("Relying party profile configuration was not SSOSProfileConfiguration");
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
@@ -224,14 +221,14 @@ public class EvaluateDelegationPolicy extends AbstractProfileAction {
}
/**
- * Apply policy control {@link SSOSProfileConfiguration#getDelegationPredicate()}.
+ * Apply policy control.
*
* @param profileRequestContext the current request context
*
* @return true if check passes, false if not
*/
protected boolean checkAllowedDelegate(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!delegationPredicate.test(profileRequestContext)) {
+ if (!delegationAllowed) {
log.warn("Delegation predicate eval indicates delegated token use NOT allowed");
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
return false;
@@ -333,8 +330,8 @@ public class EvaluateDelegationPolicy extends AbstractProfileAction {
return value;
} else {
log.debug("Returning default policy max token delegation chain length: {}",
- DEFAULT_POLICY_MAX_CHAIN_LENGTH);
- return DEFAULT_POLICY_MAX_CHAIN_LENGTH;
+ BrowserSSOProfileConfiguration.DEFAULT_DELEGATION_CHAIN_LENGTH);
+ return BrowserSSOProfileConfiguration.DEFAULT_DELEGATION_CHAIN_LENGTH;
}
}
@@ -348,7 +345,7 @@ public class EvaluateDelegationPolicy extends AbstractProfileAction {
* of the presented {@link Assertion} token.
* </p>
*/
- public class PolicyMaxChainLengthStrategy implements Function<ProfileRequestContext, Long> {
+ public class PolicyMaxChainLengthStrategy implements Function<ProfileRequestContext,Long> {
/** {@inheritDoc} */
@Nullable
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
index 4d61ac8..2214f81 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
@@ -274,13 +274,13 @@ public class PopulateEncryptionParameters extends AbstractProfileAction {
final SAML2ProfileConfiguration profileConfiguration = (SAML2ProfileConfiguration) rpContext.getProfileConfig();
if (!encryptIdentifiers) {
- encryptIdentifiers = profileConfiguration.getEncryptNameIDs().test(profileRequestContext);
+ encryptIdentifiers = profileConfiguration.isEncryptNameIDs(profileRequestContext);
// Encryption can only be optional if the request didn't specify it above.
- encryptionOptional = profileConfiguration.isEncryptionOptional();
+ encryptionOptional = profileConfiguration.isEncryptionOptional(profileRequestContext);
}
- encryptAssertions = profileConfiguration.getEncryptAssertions().test(profileRequestContext);
- encryptAttributes = profileConfiguration.getEncryptAttributes().test(profileRequestContext);
+ encryptAssertions = profileConfiguration.isEncryptAssertions(profileRequestContext);
+ encryptAttributes = profileConfiguration.isEncryptAttributes(profileRequestContext);
if (!encryptAssertions && !encryptIdentifiers && !encryptAttributes) {
log.debug("{} No encryption requested, nothing to do", getLogPrefix());
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list