[java-identity-provider] 25/27: Switch SAML 2 query filtering to registry.
Scott Cantor
cantor.2 at osu.edu
Fri May 3 14:32:15 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch feature/IDP-1434
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=9c851905cd1493ad1fa741d6eb6a953300c11fad
commit 9c851905cd1493ad1fa741d6eb6a953300c11fad
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu May 2 16:56:20 2019 -0400
Switch SAML 2 query filtering to registry.
---
.../system/flows/saml/saml-abstract-beans.xml | 4 -
.../flows/saml/saml2/attribute-query-beans.xml | 4 +
.../flows/saml2/SAML2AttributeQueryFlowTest.java | 5 -
.../impl/FilterByQueriedAttributeDesignators.java | 2 +-
.../profile/impl/FilterByQueriedAttributes.java | 111 ++++++++++++---
.../impl/FilterByQueriedAttributesTest.java | 77 +++++++++--
.../idp/saml/impl/profile/AttributeQuery.xml | 6 +-
...tributeQuery.xml => UnmappedAttributeQuery.xml} | 7 +-
.../idp/saml/impl/profile/saml2Mapper.xml | 150 +++++++++------------
9 files changed, 234 insertions(+), 132 deletions(-)
diff --git a/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml b/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
index 183f3d9..980a299 100644
--- a/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
@@ -239,10 +239,6 @@
p:maskFailures="%{idp.service.attribute.filter.maskFailures:true}"
p:metadataResolver-ref="shibboleth.MetadataResolver" />
- <bean id="FilterByQueriedAttributes"
- class="net.shibboleth.idp.saml.saml2.profile.impl.FilterByQueriedAttributes" scope="prototype"
- c:mapper-ref="shibboleth.SAML2AttributesMapperService" />
-
<bean id="PopulatePostAuthnInterceptContext"
class="net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext" scope="prototype"
p:availableFlows-ref="shibboleth.AvailableInterceptFlows">
diff --git a/idp-conf/src/main/resources/system/flows/saml/saml2/attribute-query-beans.xml b/idp-conf/src/main/resources/system/flows/saml/saml2/attribute-query-beans.xml
index 9fe154e..27bd70d 100644
--- a/idp-conf/src/main/resources/system/flows/saml/saml2/attribute-query-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/saml/saml2/attribute-query-beans.xml
@@ -41,6 +41,10 @@
class="net.shibboleth.utilities.java.support.logic.FunctionSupport" factory-method="constant"
c:_0-ref="shibboleth.OutgoingSOAPBindings" />
+ <bean id="FilterByQueriedAttributes"
+ class="net.shibboleth.idp.saml.saml2.profile.impl.FilterByQueriedAttributes" scope="prototype"
+ p:transcoderRegistry-ref="shibboleth.AttributeRegistryService" />
+
<bean id="CopyNameIDFromRequest"
class="org.opensaml.saml.saml2.profile.impl.CopyNameIDFromRequest" scope="prototype" />
diff --git a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2AttributeQueryFlowTest.java b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2AttributeQueryFlowTest.java
index e16930d..40af557 100644
--- a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2AttributeQueryFlowTest.java
+++ b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2AttributeQueryFlowTest.java
@@ -170,11 +170,6 @@ public class SAML2AttributeQueryFlowTest extends AbstractSAML2FlowTest {
XSAny value = valueBuilder.buildObject(AttributeValue.DEFAULT_ELEMENT_NAME);
value.setTextContent("jdoe at example.org");
designator.getAttributeValues().add(value);
-
- designator = designatorBuilder.buildObject();
- designator.setNameFormat(Attribute.URI_REFERENCE);
- designator.setName("urn:mace:dir:attribute-def:foo");
- attributeQuery.getAttributes().add(designator);
}
final Envelope envelope = buildSOAP11Envelope(attributeQuery);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java
index 8c6c388..6c1069e 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java
@@ -224,7 +224,7 @@ public class FilterByQueriedAttributeDesignators extends AbstractProfileAction {
*
* @throws AttributeDecodingException if an error occurs or no results were obtained
*/
- protected void decodeAttributeDesignator(@Nonnull final AttributeTranscoderRegistry registry,
+ private void decodeAttributeDesignator(@Nonnull final AttributeTranscoderRegistry registry,
@Nonnull final ProfileRequestContext profileRequestContext, @Nonnull final AttributeDesignator input,
@Nonnull @NonnullElements @Live final Collection<String> results)
throws AttributeDecodingException {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java
index f2c303f..c6e159c 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java
@@ -19,6 +19,7 @@ package net.shibboleth.idp.saml.saml2.profile.impl;
import java.util.ArrayList;
import java.util.Collection;
+import java.util.Properties;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -26,6 +27,8 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.messaging.context.navigate.MessageLookup;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.opensaml.saml.saml2.core.Attribute;
@@ -33,17 +36,26 @@ import org.opensaml.saml.saml2.core.AttributeQuery;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import com.google.common.collect.HashMultimap;
import com.google.common.collect.Multimap;
+import net.shibboleth.idp.attribute.AttributeDecodingException;
import net.shibboleth.idp.attribute.IdPAttribute;
import net.shibboleth.idp.attribute.IdPAttributeValue;
import net.shibboleth.idp.attribute.context.AttributeContext;
+import net.shibboleth.idp.attribute.transcoding.AttributeTranscoder;
+import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
+import net.shibboleth.idp.attribute.transcoding.TranscoderSupport;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.saml.attribute.mapping.AttributesMapper;
+import net.shibboleth.utilities.java.support.annotation.constraint.Live;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.service.ReloadableService;
+import net.shibboleth.utilities.java.support.service.ServiceableComponent;
/**
* Action that filters a set of attributes against the {@link org.opensaml.saml.saml2.core.Attribute} objects in
@@ -56,8 +68,8 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(FilterByQueriedAttributes.class);
- /** Service used to get the engine used to filter attributes. */
- @Nonnull private final AttributesMapper<Attribute, IdPAttribute> mapper;
+ /** Transcoder registry service object. */
+ @NonnullAfterInit private ReloadableService<AttributeTranscoderRegistry> transcoderRegistry;
/** Strategy used to locate the {@link AttributeQuery} to filter against. */
@Nonnull private Function<ProfileRequestContext,AttributeQuery> queryLookupStrategy;
@@ -71,14 +83,8 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
/** AttributeContext to filter. */
@Nullable private AttributeContext attributeContext;
- /**
- * Constructor.
- *
- * @param theMapper mapper used to consume designators
- */
- public FilterByQueriedAttributes(@Nonnull final AttributesMapper<Attribute, IdPAttribute> theMapper) {
- mapper = Constraint.isNotNull(theMapper, "Mapper cannot be null");
-
+ /** Constructor. */
+ public FilterByQueriedAttributes() {
attributeContextLookupStrategy = new ChildContextLookup<>(AttributeContext.class).compose(
new ChildContextLookup<>(RelyingPartyContext.class));
@@ -86,6 +92,17 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
}
/**
+ * Sets the registry of transcoding rules to apply to encode attributes.
+ *
+ * @param registry registry service interface
+ */
+ public void setTranscoderRegistry(@Nonnull final ReloadableService<AttributeTranscoderRegistry> registry) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ transcoderRegistry = Constraint.isNotNull(registry, "AttributeTranscoderRegistry cannot be null");
+ }
+
+ /**
* Set the strategy used to locate the {@link AttributeQuery} associated with a given {@link ProfileRequestContext}.
*
* @param strategy lookup strategy
@@ -112,6 +129,16 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
/** {@inheritDoc} */
@Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (transcoderRegistry == null) {
+ throw new ComponentInitializationException("AttributeTranscoderRegistry cannot be null");
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
if (!super.doPreExecute(profileRequestContext)) {
@@ -142,11 +169,35 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
/** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- final Collection<IdPAttribute> keepers = new ArrayList<>(query.getAttributes().size());
-
- final Multimap<String,IdPAttribute> mapped = mapper.mapAttributes(query.getAttributes());
+
+ final Multimap<String,IdPAttribute> mapped = HashMultimap.create();
+
+ ServiceableComponent<AttributeTranscoderRegistry> component = null;
+ try {
+ component = transcoderRegistry.getServiceableComponent();
+ if (component == null) {
+ log.error("Attribute transcoder service unavailable");
+ ActionSupport.buildEvent(profileRequestContext, EventIds.MESSAGE_PROC_ERROR);
+ return;
+ }
+
+ for (final Attribute designator : query.getAttributes()) {
+ decodeAttribute(component.getComponent(), profileRequestContext, designator, mapped);
+ }
+
+ } catch (final AttributeDecodingException e) {
+ log.error("{} Error decoding queried Attribute, cannot process query", getLogPrefix(), e);
+ ActionSupport.buildEvent(profileRequestContext, EventIds.MESSAGE_PROC_ERROR);
+ return;
+ } finally {
+ if (component != null) {
+ component.unpinComponent();
+ }
+ }
+
log.debug("{} Query content mapped to attribute IDs: {}", getLogPrefix(), mapped.keySet());
+
+ final Collection<IdPAttribute> keepers = new ArrayList<>(query.getAttributes().size());
for (final IdPAttribute attribute : attributeContext.getIdPAttributes().values()) {
@@ -174,6 +225,36 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
}
/**
+ * Access the registry of transcoding rules to decode the input {@link Attribute}.
+ *
+ * @param registry registry of transcoding rules
+ * @param profileRequestContext current profile request context
+ * @param input input object
+ * @param results collection to add results to
+ *
+ * @throws AttributeDecodingException if an error occurs or no results were obtained
+ */
+ protected void decodeAttribute(@Nonnull final AttributeTranscoderRegistry registry,
+ @Nonnull final ProfileRequestContext profileRequestContext, @Nonnull final Attribute input,
+ @Nonnull @NonnullElements @Live final Multimap<String,IdPAttribute> results)
+ throws AttributeDecodingException {
+
+ final Collection<Properties> transcodingRules = registry.getTranscodingProperties(input);
+ if (transcodingRules.isEmpty()) {
+ throw new AttributeDecodingException("Attribute '" + input.getName() +
+ "' does not have transcoding rules, cannot process query");
+ }
+
+ for (final Properties rules : transcodingRules) {
+ final AttributeTranscoder<Attribute> transcoder = TranscoderSupport.getTranscoder(rules);
+ final IdPAttribute decodedAttribute = transcoder.decode(profileRequestContext, input, rules);
+ if (decodedAttribute != null) {
+ results.put(decodedAttribute.getId(), decodedAttribute);
+ }
+ }
+ }
+
+ /**
* Adjust an input attribute's values based on any values requested.
*
* @param attribute attribute to filter
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributesTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributesTest.java
index 4c6d0c5..1f08241 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributesTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributesTest.java
@@ -22,10 +22,12 @@ import static org.testng.Assert.assertEquals;
import java.util.Collection;
import java.util.List;
+import javax.annotation.Nullable;
+
import org.opensaml.core.xml.XMLObjectBaseTestCase;
import org.opensaml.core.xml.io.UnmarshallingException;
+import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.Attribute;
import org.opensaml.saml.saml2.core.AttributeQuery;
import org.springframework.beans.factory.xml.XmlBeanDefinitionReader;
import org.springframework.context.support.GenericApplicationContext;
@@ -41,13 +43,16 @@ import net.shibboleth.idp.attribute.IdPAttribute;
import net.shibboleth.idp.attribute.ScopedStringAttributeValue;
import net.shibboleth.idp.attribute.StringAttributeValue;
import net.shibboleth.idp.attribute.context.AttributeContext;
+import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
+import net.shibboleth.idp.attribute.transcoding.impl.AttributeTranscoderRegistryImpl;
import net.shibboleth.idp.profile.ActionTestingSupport;
import net.shibboleth.idp.profile.RequestContextBuilder;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
-import net.shibboleth.idp.saml.attribute.mapping.AttributesMapper;
-import net.shibboleth.idp.saml.attribute.mapping.impl.SAML2AttributesMapper;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.service.AbstractReloadableService;
+import net.shibboleth.utilities.java.support.service.ReloadableService;
+import net.shibboleth.utilities.java.support.service.ServiceableComponent;
import net.shibboleth.utilities.java.support.xml.XMLParserException;
/** Tests for {@link FilterByQueriedAttributes} */
@@ -57,7 +62,7 @@ public class FilterByQueriedAttributesTest extends XMLObjectBaseTestCase {
private AttributeQuery query;
- private AttributesMapper<Attribute, IdPAttribute> mapper;
+ private ReloadableService<AttributeTranscoderRegistry> registry;
private FilterByQueriedAttributes action;
@@ -86,16 +91,18 @@ public class FilterByQueriedAttributesTest extends XMLObjectBaseTestCase {
}
}
- @BeforeClass public void setup() throws XMLParserException, UnmarshallingException {
- query = unmarshallElement(PATH + "AttributeQuery.xml", true);
- mapper = getBean(PATH + "saml2Mapper.xml", SAML2AttributesMapper.class);
+ @BeforeClass public void setup() {
+ registry = new RegistryService(getBean(PATH + "saml2Mapper.xml", AttributeTranscoderRegistryImpl.class));
}
- @BeforeMethod public void setUpMethod() throws ComponentInitializationException {
- action = new FilterByQueriedAttributes(mapper);
+ @BeforeMethod public void setUpMethod() throws ComponentInitializationException, XMLParserException, UnmarshallingException {
+ query = unmarshallElement(PATH + "AttributeQuery.xml", true);
+ action = new FilterByQueriedAttributes();
+ action.setTranscoderRegistry(registry);
+ action.initialize();
+
rc = new RequestContextBuilder().setInboundMessage(query).buildRequestContext();
prc = new WebflowRequestContextProfileRequestContextLookup().apply(rc);
- action.initialize();
}
@Test public void noAttributes() {
@@ -104,10 +111,31 @@ public class FilterByQueriedAttributesTest extends XMLObjectBaseTestCase {
ActionTestingSupport.assertProceedEvent(event);
}
+ @Test public void unmappedAttributes() throws XMLParserException, UnmarshallingException {
+ query = unmarshallElement(PATH + "UnmappedAttributeQuery.xml", true);
+
+ prc.getInboundMessageContext().setMessage(query);
+
+ final RelyingPartyContext rpc = prc.getSubcontext(RelyingPartyContext.class,true);
+ final AttributeContext ac = rpc.getSubcontext(AttributeContext.class,true);
+ final List<IdPAttribute> attributes = List.of(
+ new IdPAttribute("eduPersonAssurance"),
+ new IdPAttribute("flooby"),
+ new IdPAttribute("eduPersonScopedAffiliation"),
+ new IdPAttribute("eduPersonTargetedID"));
+ ac.setIdPAttributes(attributes);
+ final Event event = action.execute(rc);
+ ActionTestingSupport.assertEvent(event, EventIds.MESSAGE_PROC_ERROR);
+ }
+
@Test public void noValues() {
final RelyingPartyContext rpc = prc.getSubcontext(RelyingPartyContext.class,true);
final AttributeContext ac = rpc.getSubcontext(AttributeContext.class,true);
- final List<IdPAttribute> attributes = List.of(new IdPAttribute("eduPersonAssurance"), new IdPAttribute("flooby"), new IdPAttribute("eduPersonScopedAffiliation"), new IdPAttribute("eduPersonTargetedID"));
+ final List<IdPAttribute> attributes = List.of(
+ new IdPAttribute("eduPersonAssurance"),
+ new IdPAttribute("flooby"),
+ new IdPAttribute("eduPersonScopedAffiliation"),
+ new IdPAttribute("eduPersonTargetedID"));
ac.setIdPAttributes(attributes);
final Event event = action.execute(rc);
ActionTestingSupport.assertProceedEvent(event);
@@ -131,4 +159,29 @@ public class FilterByQueriedAttributesTest extends XMLObjectBaseTestCase {
assertEquals(ac.getIdPAttributes().size(), 2);
}
-}
+ private static class RegistryService extends AbstractReloadableService<AttributeTranscoderRegistry> {
+
+ private ServiceableComponent<AttributeTranscoderRegistry> component;
+
+ protected RegistryService(ServiceableComponent<AttributeTranscoderRegistry> what) {
+ component = what;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public ServiceableComponent<AttributeTranscoderRegistry> getServiceableComponent() {
+ if (null == component) {
+ return null;
+ }
+ component.pinComponent();
+ return component;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected boolean shouldReload() {
+ return false;
+ }
+ }
+
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/profile/AttributeQuery.xml b/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/profile/AttributeQuery.xml
index d1d5b4e..578b4f3 100644
--- a/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/profile/AttributeQuery.xml
+++ b/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/profile/AttributeQuery.xml
@@ -8,11 +8,11 @@
<Subject>
<NameID>you</NameID>
</Subject>
- <Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" FriendlyName="eduPersonAssurance">
+ <Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAssurance">
<AttributeValue xsi:type="xs:string">turquoise</AttributeValue>
</Attribute>
- <Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" FriendlyName="eduPersonScopedAffiliation">
+ <Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonScopedAffiliation">
<AttributeValue xsi:type="xs:string">blue#yellow</AttributeValue>
</Attribute>
- <Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" FriendlyName="eduPersonTargetedID"/>
+ <Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonTargetedID"/>
</saml2p:AttributeQuery>
diff --git a/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/profile/AttributeQuery.xml b/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/profile/UnmappedAttributeQuery.xml
similarity index 51%
copy from idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/profile/AttributeQuery.xml
copy to idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/profile/UnmappedAttributeQuery.xml
index d1d5b4e..3edbf78 100644
--- a/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/profile/AttributeQuery.xml
+++ b/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/profile/UnmappedAttributeQuery.xml
@@ -8,11 +8,12 @@
<Subject>
<NameID>you</NameID>
</Subject>
- <Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" FriendlyName="eduPersonAssurance">
+ <Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonAssurance">
<AttributeValue xsi:type="xs:string">turquoise</AttributeValue>
</Attribute>
- <Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" FriendlyName="eduPersonScopedAffiliation">
+ <Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonScopedAffiliation">
<AttributeValue xsi:type="xs:string">blue#yellow</AttributeValue>
</Attribute>
- <Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" FriendlyName="eduPersonTargetedID"/>
+ <Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonTargetedID"/>
+ <Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" FriendlyName="eduPersonTargetedIDWithWrongNameFormat"/>
</saml2p:AttributeQuery>
diff --git a/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/profile/saml2Mapper.xml b/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/profile/saml2Mapper.xml
index 0dc5069..fc33dd2 100644
--- a/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/profile/saml2Mapper.xml
+++ b/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/profile/saml2Mapper.xml
@@ -1,96 +1,68 @@
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+ default-init-method="initialize"
+ default-destroy-method="destroy">
- <!-- This is what we are trying to reverse map (note bi-directional aliasing, just to confuse things. And me.
-
- <AttributeDefinition xsi:type="ad:Simple" id="eduPersonAssurance" >
- <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" friendlyName="eduPersonAssurance" />
- <AttributeEncoder xsi:type="SAML2String" nameFormat="http://example.org/Format" name="http://example.org/name/for/Attribute" friendlyName="otherSAMLName" />
- </AttributeDefinition>
+ <bean id="shibboleth.IdentifiableBeanPostProcessor"
+ class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" />
- <AttributeDefinition xsi:type="ad:Simple" id="otherPersonAssurance" >
- <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" friendlyName="eduPersonAssurance" />
- </AttributeDefinition>
-
- <AttributeDefinition xsi:type="ad:Scoped" id="eduPersonScopedAffiliation" scope="example.org" >
- <AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" friendlyName="eduPersonScopedAffiliation"
- scopeDelimiter='#'/>
- </AttributeDefinition>
-
- <AttributeDefinition xsi:type="ad:SAML2NameID" id="eduPersonTargetedID"
- nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">
- <AttributeEncoder xsi:type="SAML2XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" />
- </AttributeDefinition>
-
-
+ <bean id="SAML2StringTranscoder"
+ class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML2StringAttributeTranscoder" />
+ <bean id="SAML2ScopedStringTranscoder"
+ class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML2ScopedStringAttributeTranscoder" />
+ <bean id="SAML2XMLObjectTranscoder"
+ class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML2XMLObjectAttributeTranscoder" />
+
+ <util:list id="DefaultAttributeRegistry">
- -->
-
- <bean id="abstractStringMapper" init-method="initialize" abstract="true"
- class="net.shibboleth.idp.saml.attribute.mapping.impl.SAML2AttributeMapper">
- <property name="valueMapper">
- <bean
- class="net.shibboleth.idp.saml.attribute.mapping.impl.StringAttributeValueMapper" />
- </property>
- </bean>
+ <map>
+ <entry key="id" value="eduPersonAssurance" />
+ <entry key="transcoder" value-ref="SAML2StringTranscoder" />
+ <entry key="name" value="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" />
+ </map>
+
+ <map>
+ <entry key="id" value="eduPersonAssurance" />
+ <entry key="transcoder" value-ref="SAML2StringTranscoder" />
+ <entry key="name" value="http://example.org/name/for/Attribute" />
+ <entry key="nameFormat" value="http://example.org/Format" />
+ </map>
+
+ <map>
+ <entry key="id" value="otherPersonAssurance" />
+ <entry key="transcoder" value-ref="SAML2StringTranscoder" />
+ <entry key="name" value="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" />
+ </map>
+
+ <map>
+ <entry key="id" value="eduPersonScopedAffiliation" />
+ <entry key="transcoder" value-ref="SAML2ScopedStringTranscoder" />
+ <entry key="scopeDelimiter" value="#" />
+ <entry key="name" value="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" />
+ </map>
+
+ <map>
+ <entry key="id" value="eduPersonTargetedID" />
+ <entry key="transcoder" value-ref="SAML2XMLObjectTranscoder" />
+ <entry key="name" value="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
+ </map>
+
+ </util:list>
+
+ <util:map id="DefaultNamingRegistry">
+ <entry key="#{T(org.opensaml.saml.saml2.core.Attribute)}">
+ <bean class="net.shibboleth.idp.saml.attribute.transcoding.AbstractSAML2AttributeTranscoder.NamingFunction" />
+ </entry>
+ </util:map>
+
- <bean id="AttributesMapper"
- class="net.shibboleth.idp.saml.attribute.mapping.impl.SAML2AttributesMapper"
- init-method="initialize" p:id="SAML2AttributesMapper">
- <property name="mappers">
- <list>
- <bean parent="abstractStringMapper">
- <property name="id" value="eduPersonAssurance" />
- <property name="SAMLName" value="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" />
- <property name="attributeIds">
- <list>
- <value>eduPersonAssurance</value>
- <value>otherPersonAssurance</value>
- </list>
- </property>
- </bean>
- <bean parent="abstractStringMapper">
- <property name="SAMLName" value="http://example.org/name/for/Attribute" />
- <property name="id" value="otherSAMLName" />
- <property name="attributeFormat" value="http://example.org/Format " />
- <property name="attributeIds">
- <list>
- <value>eduPersonAssurance</value>
- </list>
- </property>
- </bean>
- <bean parent="abstractStringMapper">
- <property name="sAMLName" value="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" />
- <property name="id" value="eduPersonScopedAffiliation" />
- <property name="attributeFormat" value=" format " />
- <property name="valueMapper">
- <bean
- class="net.shibboleth.idp.saml.attribute.mapping.impl.ScopedStringAttributeValueMapper"
- p:delimiter="#" />
- </property>
- <property name="attributeIds">
- <list>
- <value>eduPersonScopedAffiliation</value>
- </list>
- </property>
- </bean>
- <bean parent="abstractStringMapper">
- <property name="attributeFormat" value="format"/>
- <property name="sAMLName" value="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"/>
- <property name="id" value="eduPersonTargetedID"/>
- <property name="valueMapper">
- <bean
- class="net.shibboleth.idp.saml.attribute.mapping.impl.XMLObjectAttributeValueMapper" />
- </property>
- <property name="attributeIds">
- <list>
- <value>eduPersonTargetedID</value>
- </list>
- </property>
- </bean>
- </list>
- </property>
- </bean>
+ <bean id="AttributeTranscoderRegistry" class="net.shibboleth.idp.attribute.transcoding.impl.AttributeTranscoderRegistryImpl"
+ p:namingRegistry-ref="DefaultNamingRegistry"
+ p:transcoderRegistry-ref="DefaultAttributeRegistry" />
+
</beans>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list