[java-identity-provider] branch feature/IDP-1434 updated: Driving to completion.
Scott Cantor
cantor.2 at osu.edu
Thu May 9 13:10:10 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch feature/IDP-1434
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f2c1a2a3d24e2bf6836acef69776c866973b3645
The following commit(s) were added to refs/heads/feature/IDP-1434 by this push:
new f2c1a2a Driving to completion.
f2c1a2a is described below
commit f2c1a2a3d24e2bf6836acef69776c866973b3645
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu May 9 13:10:06 2019 -0400
Driving to completion.
---
.../idp/attribute/transcoding/TranscodingRule.java | 2 +
.../transcoding/impl/TranscodingRuleLoader.java | 95 ++++++++++++++++++++++
.../impl/AttributeRegistryServiceStrategy.java | 14 +++-
.../attributes/saml1/eduPersonPrincipalName.txt | 4 +
.../saml1/eduPersonScopedAffiliation.txt | 4 +
.../src/main/resources/attributes/saml1/mail.txt | 4 +
.../src/main/resources/attributes/saml1/uid.txt | 4 +
.../attributes/saml2/eduPersonPrincipalName.txt | 4 +
.../saml2/eduPersonScopedAffiliation.txt | 4 +
.../src/main/resources/attributes/saml2/mail.txt | 4 +
.../src/main/resources/attributes/saml2/uid.txt | 4 +
.../src/main/resources/conf/attribute-registry.xml | 19 +----
.../src/main/resources/conf/attribute-resolver.xml | 11 +--
.../src/main/resources/conf/services.properties | 9 +-
idp-conf/src/main/resources/conf/services.xml | 9 +-
.../system/conf/attribute-registry-system.xml | 3 +
.../main/resources/system/conf/services-system.xml | 1 -
.../resources/system/flows/admin/status-beans.xml | 1 +
idp-war/src/main/webapp/WEB-INF/jsp/status.jsp | 1 +
19 files changed, 161 insertions(+), 36 deletions(-)
diff --git a/idp-attribute-api/src/main/java/net/shibboleth/idp/attribute/transcoding/TranscodingRule.java b/idp-attribute-api/src/main/java/net/shibboleth/idp/attribute/transcoding/TranscodingRule.java
index b6d9134..89bcf88 100644
--- a/idp-attribute-api/src/main/java/net/shibboleth/idp/attribute/transcoding/TranscodingRule.java
+++ b/idp-attribute-api/src/main/java/net/shibboleth/idp/attribute/transcoding/TranscodingRule.java
@@ -108,6 +108,8 @@ public class TranscodingRule {
final Object value = rule.get(key);
if (type.isInstance(value)) {
return (T) value;
+ } else if (type == Boolean.class && value instanceof String) {
+ return (T) Boolean.valueOf((String) value);
} else {
return null;
}
diff --git a/idp-attribute-impl/src/main/java/net/shibboleth/idp/attribute/transcoding/impl/TranscodingRuleLoader.java b/idp-attribute-impl/src/main/java/net/shibboleth/idp/attribute/transcoding/impl/TranscodingRuleLoader.java
new file mode 100644
index 0000000..844e40c
--- /dev/null
+++ b/idp-attribute-impl/src/main/java/net/shibboleth/idp/attribute/transcoding/impl/TranscodingRuleLoader.java
@@ -0,0 +1,95 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.transcoding.impl;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.DirectoryStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Map;
+
+import javax.annotation.Nonnull;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.core.io.FileSystemResource;
+
+import net.shibboleth.idp.attribute.transcoding.TranscodingRule;
+import net.shibboleth.utilities.java.support.annotation.ParameterName;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+
+/**
+ * Wrapper around a {@link Map} representing a rule for transcoding, used to
+ * detect and load the rules at runtime from a Spring context.
+ */
+public class TranscodingRuleLoader {
+
+ /** Class logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(TranscodingRuleLoader.class);
+
+ /** Rules loaded. */
+ private @Nonnull @NonnullElements final Collection<TranscodingRule> rules;
+
+ /**
+ * Load rules from all files found below a directory root.
+ *
+ * <p>Individual rules that fail to load will be skipped.</p>
+ *
+ * @param dir root to search
+ *
+ * @throws IOException if an error occurs
+ */
+ public TranscodingRuleLoader(@Nonnull @ParameterName(name="dir") final Path dir) throws IOException {
+
+ log.debug("Loading rules from directory ({})", dir);
+ rules = new ArrayList<>();
+
+ try (final DirectoryStream<Path> dirstream = Files.newDirectoryStream(dir)) {
+ for (final Path child : dirstream) {
+ final File file = child.toFile();
+ if (file.isDirectory()) {
+ try {
+ rules.addAll(new TranscodingRuleLoader(child).getRules());
+ } catch (final IOException e) {
+ log.error("Failed to load rules from directory ({})", file, e);
+ }
+ } else {
+ log.debug("Loading rule from property set in file ({})", file);
+ try {
+ rules.add(TranscodingRule.fromResource(new FileSystemResource(file)));
+ } catch (final IOException e) {
+ log.error("Failed to load rule from file ({})", file, e);
+ }
+ }
+ }
+ }
+ }
+
+ /**
+ * Get the rules loaded by this object.
+ *
+ * @return collection of rules
+ */
+ @Nonnull @NonnullElements public Collection<TranscodingRule> getRules() {
+ return rules;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/transcoding/spring/impl/AttributeRegistryServiceStrategy.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/transcoding/spring/impl/AttributeRegistryServiceStrategy.java
index 5bb291d..c290c23 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/transcoding/spring/impl/AttributeRegistryServiceStrategy.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/transcoding/spring/impl/AttributeRegistryServiceStrategy.java
@@ -17,6 +17,7 @@
package net.shibboleth.idp.attribute.transcoding.spring.impl;
+import java.util.ArrayList;
import java.util.Collection;
import java.util.Map;
import java.util.function.Function;
@@ -31,6 +32,7 @@ import org.springframework.context.ApplicationContext;
import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
import net.shibboleth.idp.attribute.transcoding.TranscodingRule;
import net.shibboleth.idp.attribute.transcoding.impl.AttributeTranscoderRegistryImpl;
+import net.shibboleth.idp.attribute.transcoding.impl.TranscodingRuleLoader;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -69,12 +71,22 @@ public class AttributeRegistryServiceStrategy extends AbstractIdentifiableInitia
final Map<Class<?>,Function<?,String>> namingRegistryBean = appContext.getBean(namingRegistry, Map.class);
final Collection<TranscodingRule> mappingBeans = appContext.getBeansOfType(TranscodingRule.class).values();
+ final Collection<TranscodingRuleLoader> loaderBeans =
+ appContext.getBeansOfType(TranscodingRuleLoader.class).values();
+ final Collection<TranscodingRule> holder = new ArrayList<>();
+ if (mappingBeans != null) {
+ holder.addAll(mappingBeans);
+ }
+ if (loaderBeans != null) {
+ loaderBeans.forEach(loader -> holder.addAll(loader.getRules()));
+ }
+
final AttributeTranscoderRegistryImpl registry = new AttributeTranscoderRegistryImpl();
registry.setId(getId());
registry.setApplicationContext(appContext);
registry.setNamingRegistry(namingRegistryBean);
- registry.setTranscoderRegistry(mappingBeans);
+ registry.setTranscoderRegistry(holder);
try {
registry.initialize();
diff --git a/idp-conf/src/main/resources/attributes/saml1/eduPersonPrincipalName.txt b/idp-conf/src/main/resources/attributes/saml1/eduPersonPrincipalName.txt
new file mode 100644
index 0000000..008831d
--- /dev/null
+++ b/idp-conf/src/main/resources/attributes/saml1/eduPersonPrincipalName.txt
@@ -0,0 +1,4 @@
+id = eduPersonPrincipalName
+transcoder_bean = SAML1ScopedStringTranscoder
+name = urn:mace:dir:attribute-def:eduPersonPrincipalName
+encodeType = false
diff --git a/idp-conf/src/main/resources/attributes/saml1/eduPersonScopedAffiliation.txt b/idp-conf/src/main/resources/attributes/saml1/eduPersonScopedAffiliation.txt
new file mode 100644
index 0000000..e6c505b
--- /dev/null
+++ b/idp-conf/src/main/resources/attributes/saml1/eduPersonScopedAffiliation.txt
@@ -0,0 +1,4 @@
+id = eduPersonScopedAffiliation
+transcoder_bean = SAML1ScopedStringTranscoder
+name = urn:mace:dir:attribute-def:eduPersonScopedAffiliation
+encodeType = false
diff --git a/idp-conf/src/main/resources/attributes/saml1/mail.txt b/idp-conf/src/main/resources/attributes/saml1/mail.txt
new file mode 100644
index 0000000..22f4da9
--- /dev/null
+++ b/idp-conf/src/main/resources/attributes/saml1/mail.txt
@@ -0,0 +1,4 @@
+id = mail
+transcoder_bean = SAML1StringTranscoder
+name = urn:mace:dir:attribute-def:mail
+encodeType = false
diff --git a/idp-conf/src/main/resources/attributes/saml1/uid.txt b/idp-conf/src/main/resources/attributes/saml1/uid.txt
new file mode 100644
index 0000000..209d6a0
--- /dev/null
+++ b/idp-conf/src/main/resources/attributes/saml1/uid.txt
@@ -0,0 +1,4 @@
+id = uid
+transcoder_bean = SAML1StringTranscoder
+name = urn:mace:dir:attribute-def:uid
+encodeType = false
diff --git a/idp-conf/src/main/resources/attributes/saml2/eduPersonPrincipalName.txt b/idp-conf/src/main/resources/attributes/saml2/eduPersonPrincipalName.txt
new file mode 100644
index 0000000..970f0da
--- /dev/null
+++ b/idp-conf/src/main/resources/attributes/saml2/eduPersonPrincipalName.txt
@@ -0,0 +1,4 @@
+id = eduPersonPrincipalName
+transcoder_bean = SAML2ScopedStringTranscoder
+name = urn:oid:1.3.6.1.4.1.5923.1.1.1.6
+encodeType = false
diff --git a/idp-conf/src/main/resources/attributes/saml2/eduPersonScopedAffiliation.txt b/idp-conf/src/main/resources/attributes/saml2/eduPersonScopedAffiliation.txt
new file mode 100644
index 0000000..aedfcb5
--- /dev/null
+++ b/idp-conf/src/main/resources/attributes/saml2/eduPersonScopedAffiliation.txt
@@ -0,0 +1,4 @@
+id = eduPersonScopedAffiliation
+transcoder_bean = SAML2ScopedStringTranscoder
+name = urn:oid:1.3.6.1.4.1.5923.1.1.1.9
+encodeType = false
diff --git a/idp-conf/src/main/resources/attributes/saml2/mail.txt b/idp-conf/src/main/resources/attributes/saml2/mail.txt
new file mode 100644
index 0000000..8e28190
--- /dev/null
+++ b/idp-conf/src/main/resources/attributes/saml2/mail.txt
@@ -0,0 +1,4 @@
+id = mail
+transcoder_bean = SAML2StringTranscoder
+name = urn:oid:0.9.2342.19200300.100.1.3
+encodeType = false
diff --git a/idp-conf/src/main/resources/attributes/saml2/uid.txt b/idp-conf/src/main/resources/attributes/saml2/uid.txt
new file mode 100644
index 0000000..0f259a9
--- /dev/null
+++ b/idp-conf/src/main/resources/attributes/saml2/uid.txt
@@ -0,0 +1,4 @@
+id = uid
+transcoder_bean = SAML2StringTranscoder
+name = urn:oid:0.9.2342.19200300.100.1.1
+encodeType = false
diff --git a/idp-conf/src/main/resources/conf/attribute-registry.xml b/idp-conf/src/main/resources/conf/attribute-registry.xml
index 675aca4..da86845 100644
--- a/idp-conf/src/main/resources/conf/attribute-registry.xml
+++ b/idp-conf/src/main/resources/conf/attribute-registry.xml
@@ -12,22 +12,7 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <!--
- <util:list id="DefaultAttributeRegistry">
-
- <map>
- <entry key="id" value="uid" />
- <entry key="transcoder" value-ref="SAML2StringTranscoder" />
- <entry key="name" value="urn:oid:0.9.2342.19200300.100.1.1" />
- </map>
-
- <map>
- <entry key="id" value="uid" />
- <entry key="transcoder" value-ref="SAML1StringTranscoder" />
- <entry key="name" value="urn:mace:dir:attribute-def:uid" />
- </map>
-
- </util:list>
- -->
+ <!-- Default location for mappings. -->
+ <bean parent="shibboleth.TranscodingRuleLoader" c:_0="%{idp.home}/attributes" />
</beans>
diff --git a/idp-conf/src/main/resources/conf/attribute-resolver.xml b/idp-conf/src/main/resources/conf/attribute-resolver.xml
index 471bf0b..d6b479e 100644
--- a/idp-conf/src/main/resources/conf/attribute-resolver.xml
+++ b/idp-conf/src/main/resources/conf/attribute-resolver.xml
@@ -32,8 +32,6 @@
-->
<AttributeDefinition id="eduPersonPrincipalName" xsi:type="Scoped" scope="%{idp.scope}">
<InputAttributeDefinition ref="uid" />
- <AttributeEncoder xsi:type="SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" encodeType="false" />
- <AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonPrincipalName" encodeType="false" />
</AttributeDefinition>
<!--
@@ -41,10 +39,7 @@
representing a local username, but you should generally *never*
expose uid to federated services, as it is rarely globally unique.
-->
- <AttributeDefinition id="uid" xsi:type="PrincipalName">
- <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:uid" encodeType="false" />
- <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" encodeType="false" />
- </AttributeDefinition>
+ <AttributeDefinition id="uid" xsi:type="PrincipalName" />
<!--
In the rest of the world, the email address is the standard identifier,
@@ -53,8 +48,6 @@
-->
<AttributeDefinition id="mail" xsi:type="Template">
<InputAttributeDefinition ref="uid" />
- <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" />
- <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" />
<Template>
<![CDATA[
${uid}@example.org
@@ -68,8 +61,6 @@
-->
<AttributeDefinition id="eduPersonScopedAffiliation" xsi:type="Scoped" scope="%{idp.scope}">
<InputDataConnector ref="staticAttributes" attributeNames="affiliation" />
- <AttributeEncoder xsi:type="SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" encodeType="false" />
- <AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" friendlyName="eduPersonScopedAffiliation" encodeType="false" />
</AttributeDefinition>
diff --git a/idp-conf/src/main/resources/conf/services.properties b/idp-conf/src/main/resources/conf/services.properties
index dfe42f4..257dade 100644
--- a/idp-conf/src/main/resources/conf/services.properties
+++ b/idp-conf/src/main/resources/conf/services.properties
@@ -21,16 +21,17 @@ idp.service.relyingparty.checkInterval = PT15M
#idp.service.metadata.failFast = false
#idp.service.metadata.checkInterval = PT0S
+# Set to shibboleth.LegacyAttributeRegistryResources to support only AttributeEncoders
+#idp.service.attribute.registry.resources = shibboleth.AttributeRegistryResources
+#idp.service.attribute.registry.failFast = false
+idp.service.attribute.registry.checkInterval = PT15M
+
#idp.service.attribute.resolver.resources = shibboleth.AttributeResolverResources
#idp.service.attribute.resolver.failFast = false
idp.service.attribute.resolver.checkInterval = PT15M
#idp.service.attribute.resolver.maskFailures = true
#idp.service.attribute.resolver.stripNulls = false
-#idp.service.attribute.registry.resources = shibboleth.AttributeRegistryResources
-#idp.service.attribute.registry.failFast = false
-idp.service.attribute.registry.checkInterval = PT15M
-
#idp.service.attribute.filter.resources = shibboleth.AttributeFilterResources
# NOTE: Failing the filter fast leaves no filters enabled.
#idp.service.attribute.filter.failFast = false
diff --git a/idp-conf/src/main/resources/conf/services.xml b/idp-conf/src/main/resources/conf/services.xml
index 11f70b3..558ae50 100644
--- a/idp-conf/src/main/resources/conf/services.xml
+++ b/idp-conf/src/main/resources/conf/services.xml
@@ -69,14 +69,17 @@
<value>%{idp.home}/conf/attribute-resolver.xml</value>
</util:list>
- <!--
- TODO: uncomment this for release, leaving out to test upgrades for now.
+ <!-- This set of resources relies on (at least) the new registry mappings. -->
<util:list id ="shibboleth.AttributeRegistryResources">
<value>%{idp.home}/conf/attribute-registry.xml</value>
<value>%{idp.home}/system/conf/attribute-registry-system.xml</value>
+ </util:list>
+
+ <!-- This set of resources uses only AttributeEncoders for compatibility. -->
+ <util:list id ="shibboleth.LegacyAttributeRegistryResources">
<value>%{idp.home}/conf/attribute-resolver.xml</value>
+ <value>%{idp.home}/system/conf/attribute-registry-system.xml</value>
</util:list>
- -->
<util:list id ="shibboleth.AttributeFilterResources">
<value>%{idp.home}/conf/attribute-filter.xml</value>
diff --git a/idp-conf/src/main/resources/system/conf/attribute-registry-system.xml b/idp-conf/src/main/resources/system/conf/attribute-registry-system.xml
index 003c49a..cf21b80 100644
--- a/idp-conf/src/main/resources/system/conf/attribute-registry-system.xml
+++ b/idp-conf/src/main/resources/system/conf/attribute-registry-system.xml
@@ -41,5 +41,8 @@
<bean id="shibboleth.TranscodingRule"
class="net.shibboleth.idp.attribute.transcoding.TranscodingRule" abstract="true" />
+
+ <bean id="shibboleth.TranscodingRuleLoader"
+ class="net.shibboleth.idp.attribute.transcoding.impl.TranscodingRuleLoader" abstract="true" />
</beans>
diff --git a/idp-conf/src/main/resources/system/conf/services-system.xml b/idp-conf/src/main/resources/system/conf/services-system.xml
index 0178d45..8062fdc 100644
--- a/idp-conf/src/main/resources/system/conf/services-system.xml
+++ b/idp-conf/src/main/resources/system/conf/services-system.xml
@@ -72,7 +72,6 @@
<util:list id ="shibboleth.DefaultAttributeRegistryResources">
<value>%{idp.home}/conf/attribute-registry.xml</value>
<value>%{idp.home}/system/conf/attribute-registry-system.xml</value>
- <value>%{idp.home}/conf/attribute-resolver.xml</value>
</util:list>
<bean id="shibboleth.NameIdentifierGenerationService" class="net.shibboleth.ext.spring.service.ReloadableSpringService"
diff --git a/idp-conf/src/main/resources/system/flows/admin/status-beans.xml b/idp-conf/src/main/resources/system/flows/admin/status-beans.xml
index 3428e17..75da1bf 100644
--- a/idp-conf/src/main/resources/system/flows/admin/status-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/admin/status-beans.xml
@@ -32,6 +32,7 @@
<ref bean="shibboleth.MetadataResolverService" />
<ref bean="shibboleth.RelyingPartyResolverService" />
<ref bean="shibboleth.NameIdentifierGenerationService" />
+ <ref bean="shibboleth.AttributeRegistryService" />
<ref bean="shibboleth.AttributeResolverService" />
<ref bean="shibboleth.AttributeFilterService" />
<ref bean="shibboleth.ReloadableCASServiceRegistry" />
diff --git a/idp-war/src/main/webapp/WEB-INF/jsp/status.jsp b/idp-war/src/main/webapp/WEB-INF/jsp/status.jsp
index 7371f15..5e41cde 100644
--- a/idp-war/src/main/webapp/WEB-INF/jsp/status.jsp
+++ b/idp-war/src/main/webapp/WEB-INF/jsp/status.jsp
@@ -13,6 +13,7 @@
<%@ page import="net.shibboleth.idp.Version" %>
<%@ page import="net.shibboleth.idp.saml.metadata.RelyingPartyMetadataProvider" %>
<%@ page import="net.shibboleth.idp.attribute.resolver.AttributeResolver" %>
+<%@ page import="net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl" %>
<%@ page import="net.shibboleth.idp.attribute.resolver.DataConnector" %>
<%@ page import="net.shibboleth.utilities.java.support.component.IdentifiedComponent" %>
<%@ page import="net.shibboleth.utilities.java.support.service.ReloadableService" %>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list