[java-identity-provider] branch master updated: IDP-1456 - Apply attribute filtering code to inbound attributes
Scott Cantor
cantor.2 at osu.edu
Thu May 23 15:39:11 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=364dfb6930cc12eb3d3ef51eb01495eecc8a7158
The following commit(s) were added to refs/heads/master by this push:
new 364dfb6 IDP-1456 - Apply attribute filtering code to inbound attributes
364dfb6 is described below
commit 364dfb6930cc12eb3d3ef51eb01495eecc8a7158
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu May 23 15:39:05 2019 -0400
IDP-1456 - Apply attribute filtering code to inbound attributes
https://issues.shibboleth.net/jira/browse/IDP-1456
Refactor and add issuer-side RegistrationAuthority rules.
---
...> AbstractRegistrationAuthorityPolicyRule.java} | 51 +++++++++++----------
...ibuteIssuerRegistrationAuthorityPolicyRule.java | 49 ++++++++++++++++++++
...teRequesterRegistrationAuthorityPolicyRule.java | 49 ++++++++++++++++++++
...eIssuerEntityAttributeExactPolicyRuleTest.java} | 52 +++++++++++-----------
...eIssuerEntityAttributeRegexPolicyRuleTest.java} | 16 +++----
... AttributeIssuerRegistrationAuthorityTest.java} | 31 ++++++-------
...equesterEntityAttributeExactPolicyRuleTest.java | 34 +++++++-------
...equesterEntityAttributeRegexPolicyRuleTest.java | 4 +-
...ributeRequesterInEntityGroupPolicyRuleTest.java | 8 ++--
...teRequesterNameIDFormatExactPolicyRuleTest.java | 10 ++---
...tributeRequesterRegistrationAuthorityTest.java} | 29 ++++++------
.../policyrule/saml/impl/BaseMetadataTests.java | 25 ++++++++---
.../impl/AttributeFilterNamespaceHandler.java | 10 +++--
...> AbstractRegistrationAuthorityRuleParser.java} | 27 ++++-------
...ibuteIssuerRegistrationAuthorityRuleParser.java | 38 ++++++++++++++++
...teRequesterRegistrationAuthorityRuleParser.java | 38 ++++++++++++++++
...IssuerRegistrationAuthorityRuleParserTest.java} | 20 +++++----
...uesterRegistrationAuthorityRuleParserTest.java} | 20 +++++----
.../filter/policyrule/issuerAuthorityOne.xml | 9 ++++
.../filter/policyrule/issuerAuthorityTwo.xml | 9 ++++
.../src/main/resources/schema/shibboleth-afp.xsd | 10 ++---
21 files changed, 373 insertions(+), 166 deletions(-)
diff --git a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/RegistrationAuthorityPolicyRule.java b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AbstractRegistrationAuthorityPolicyRule.java
similarity index 79%
rename from idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/RegistrationAuthorityPolicyRule.java
rename to idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AbstractRegistrationAuthorityPolicyRule.java
index 9cb8cf3..33be09c 100644
--- a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/RegistrationAuthorityPolicyRule.java
+++ b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AbstractRegistrationAuthorityPolicyRule.java
@@ -33,7 +33,6 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import org.opensaml.core.xml.XMLObject;
-import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
import org.opensaml.saml.ext.saml2mdrpi.RegistrationInfo;
import org.opensaml.saml.saml2.metadata.EntitiesDescriptor;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
@@ -44,41 +43,41 @@ import org.slf4j.LoggerFactory;
import com.google.common.collect.ImmutableSet;
/**
- * This filter filters on mdrpi in the SP's metadata.
+ * Base class for rules operating on the RPI extension in metadata.
*/
-public class RegistrationAuthorityPolicyRule extends AbstractPolicyRule {
+public abstract class AbstractRegistrationAuthorityPolicyRule extends AbstractPolicyRule {
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(RegistrationAuthorityPolicyRule.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractRegistrationAuthorityPolicyRule.class);
- /** The issuers to match against. */
- @Nonnull @NonnullElements private Set<String> issuers;
+ /** The registrars to match against. */
+ @Nonnull @NonnullElements private Set<String> registrars;
/** What to say if no MDRPI is present. */
private boolean matchIfMetadataSilent;
/**
- * Get the candidate issuers.
+ * Get the candidate registrars.
*
* @return the issuers
*/
- @Nonnull @NonnullElements @Unmodifiable @NotLive public Set<String> getIssuers() {
- return ImmutableSet.copyOf(issuers);
+ @Nonnull @NonnullElements @Unmodifiable @NotLive public Set<String> getRegistrars() {
+ return ImmutableSet.copyOf(registrars);
}
/**
- * Set the candidate issuers.
+ * Set the candidate registrars.
*
- * @param theIssuers candidate issuers
+ * @param theIssuers candidate registrars
*/
- public void setIssuers(@Nonnull @NonnullElements final Collection<String> theIssuers) {
- Constraint.isNotNull(theIssuers, "Issuer collection cannot be null");
+ public void setRegistrars(@Nonnull @NonnullElements final Collection<String> theIssuers) {
+ Constraint.isNotNull(theIssuers, "Registrar collection cannot be null");
- issuers = new LinkedHashSet<>(theIssuers.size());
+ registrars = new LinkedHashSet<>(theIssuers.size());
for (final String s : theIssuers) {
final String trimmed = StringSupport.trimOrNull(s);
if (trimmed != null) {
- issuers.add(trimmed);
+ registrars.add(trimmed);
}
}
}
@@ -102,6 +101,16 @@ public class RegistrationAuthorityPolicyRule extends AbstractPolicyRule {
}
/**
+ * Gets the entity descriptor for the rule to check.
+ *
+ * @param filterContext current filter request context
+ *
+ * @return entity descriptor for the entity to check or null if not found
+ */
+ @Nullable protected abstract EntityDescriptor getEntityMetadata(
+ @Nonnull final AttributeFilterContext filterContext);
+
+ /**
* Look for the {@link RegistrationInfo} inside the peer's entity description.
*
* @param filterContext the context of the operation
@@ -109,15 +118,9 @@ public class RegistrationAuthorityPolicyRule extends AbstractPolicyRule {
*/
@Nullable private RegistrationInfo getRegistrationInfo(@Nonnull final AttributeFilterContext filterContext) {
- final SAMLMetadataContext metadataContext = filterContext.getRequesterMetadataContext();
- if (null == metadataContext) {
- log.debug("{} Filtering on registration, but no metadata context available", getLogPrefix());
- return null;
- }
-
- final EntityDescriptor spEntity = metadataContext.getEntityDescriptor();
+ final EntityDescriptor spEntity = getEntityMetadata(filterContext);
if (null == spEntity) {
- log.debug("Filtering on registration, but no peer metadata available");
+ log.debug("{} Filtering on registration, but no peer metadata available", getLogPrefix());
return null;
}
@@ -162,7 +165,7 @@ public class RegistrationAuthorityPolicyRule extends AbstractPolicyRule {
final String authority = info.getRegistrationAuthority();
log.debug("{} Peer's metadata has registration authority: {}", getLogPrefix(), authority);
- if (issuers.contains(authority)) {
+ if (registrars.contains(authority)) {
log.debug("{} Peer's metadata registration authority matches", getLogPrefix());
return Tristate.TRUE;
}
diff --git a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerRegistrationAuthorityPolicyRule.java b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerRegistrationAuthorityPolicyRule.java
new file mode 100644
index 0000000..1bcce86
--- /dev/null
+++ b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerRegistrationAuthorityPolicyRule.java
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.policyrule.saml.impl;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
+
+import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
+import org.opensaml.saml.saml2.metadata.EntityDescriptor;
+
+/**
+ * Rule based on RPI extension in attribute issuer's metadata.
+ */
+public class AttributeIssuerRegistrationAuthorityPolicyRule extends AbstractRegistrationAuthorityPolicyRule {
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable protected EntityDescriptor getEntityMetadata(@Nonnull final AttributeFilterContext filterContext) {
+ final SAMLMetadataContext metadataContext = filterContext.getIssuerMetadataContext();
+ if (null == metadataContext) {
+ return null;
+ }
+
+ final EntityDescriptor spEntity = metadataContext.getEntityDescriptor();
+ if (null == spEntity) {
+ return null;
+ }
+
+ return spEntity;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterRegistrationAuthorityPolicyRule.java b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterRegistrationAuthorityPolicyRule.java
new file mode 100644
index 0000000..96e79a3
--- /dev/null
+++ b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterRegistrationAuthorityPolicyRule.java
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.policyrule.saml.impl;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
+
+import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
+import org.opensaml.saml.saml2.metadata.EntityDescriptor;
+
+/**
+ * Rule based on RPI extension in attribute requester's metadata.
+ */
+public class AttributeRequesterRegistrationAuthorityPolicyRule extends AbstractRegistrationAuthorityPolicyRule {
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable protected EntityDescriptor getEntityMetadata(@Nonnull final AttributeFilterContext filterContext) {
+ final SAMLMetadataContext metadataContext = filterContext.getRequesterMetadataContext();
+ if (null == metadataContext) {
+ return null;
+ }
+
+ final EntityDescriptor spEntity = metadataContext.getEntityDescriptor();
+ if (null == spEntity) {
+ return null;
+ }
+
+ return spEntity;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterEntityAttributeExactPolicyRuleTest.java b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerEntityAttributeExactPolicyRuleTest.java
similarity index 57%
copy from idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterEntityAttributeExactPolicyRuleTest.java
copy to idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerEntityAttributeExactPolicyRuleTest.java
index 7e2e924..10328dc 100644
--- a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterEntityAttributeExactPolicyRuleTest.java
+++ b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerEntityAttributeExactPolicyRuleTest.java
@@ -26,17 +26,17 @@ import net.shibboleth.idp.attribute.filter.matcher.impl.DataSources;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
/**
- * test for {@link AttributeRequesterEntityAttributeExactPolicyRule}.
+ * test for {@link AttributeIssuerEntityAttributeExactPolicyRule}.
*/
-public class AttributeRequesterEntityAttributeExactPolicyRuleTest extends BaseMetadataTests {
+public class AttributeIssuerEntityAttributeExactPolicyRuleTest extends BaseMetadataTests {
- private AttributeRequesterEntityAttributeExactPolicyRule getMatcher() throws ComponentInitializationException {
+ private AttributeIssuerEntityAttributeExactPolicyRule getMatcher() throws ComponentInitializationException {
return getMatcher("urn:example.org:policies", "urn:example.org:policy:1234", null, false);
}
- private AttributeRequesterEntityAttributeExactPolicyRule getMatcher(String attributeName, String attributeValue,
+ private AttributeIssuerEntityAttributeExactPolicyRule getMatcher(String attributeName, String attributeValue,
String attributeNameFormat, boolean ignoreUnmapped) throws ComponentInitializationException {
- AttributeRequesterEntityAttributeExactPolicyRule matcher = new AttributeRequesterEntityAttributeExactPolicyRule();
+ AttributeIssuerEntityAttributeExactPolicyRule matcher = new AttributeIssuerEntityAttributeExactPolicyRule();
matcher.setId("matcher");
matcher.setAttributeName(attributeName);
matcher.setValue(attributeValue);
@@ -48,56 +48,56 @@ public class AttributeRequesterEntityAttributeExactPolicyRuleTest extends BaseMe
@Test public void testValue() throws ComponentInitializationException {
- AttributeRequesterEntityAttributeExactPolicyRule matcher = getMatcher();
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.TRUE);
+ AttributeIssuerEntityAttributeExactPolicyRule matcher = getMatcher();
+ assertEquals(matcher.matches(issMetadataContext(idpEntity, "Principal")), Tristate.TRUE);
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(issMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
}
@Test public void testFormat() throws ComponentInitializationException {
- AttributeRequesterEntityAttributeExactPolicyRule matcher =
+ AttributeIssuerEntityAttributeExactPolicyRule matcher =
getMatcher("urn:example.org:entitlements", "urn:example.org:entitlements:1234", null, true);
assertEquals(matcher.getValue(), "urn:example.org:entitlements:1234");
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.TRUE);
+ assertEquals(matcher.matches(issMetadataContext(idpEntity, "Principal")), Tristate.TRUE);
- assertEquals(matcher.matches(metadataContext(wikiEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(issMetadataContext(wikiEntity, "Principal")), Tristate.FALSE);
matcher = getMatcher("urn:example.org:entitlements", "urn:example.org:entitlements:1234", "foo", true);
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(issMetadataContext(idpEntity, "Principal")), Tristate.FALSE);
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(issMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
matcher =
getMatcher("urn:example.org:entitlements", "urn:example.org:entitlements:1234",
"urn:oasis:names:tc:SAML:2.0:attrname-format:uri", true);
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.TRUE);
+ assertEquals(matcher.matches(issMetadataContext(idpEntity, "Principal")), Tristate.TRUE);
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(issMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
}
@Test public void testNoMatch() throws ComponentInitializationException {
- AttributeRequesterEntityAttributeExactPolicyRule matcher =
+ AttributeIssuerEntityAttributeExactPolicyRule matcher =
getMatcher("urn:example.org:policies", "urn:example.org:policy:1235", null, false);
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.FALSE);
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(issMetadataContext(idpEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(issMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
matcher = getMatcher("urn:example.org:policiess", "urn:example.org:policy:1234", null, false);
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.FALSE);
- assertEquals(matcher.matches(metadataContext(noneEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(issMetadataContext(idpEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(issMetadataContext(noneEntity, "Principal")), Tristate.FALSE);
}
@Test public void testSplitAttribute() throws ComponentInitializationException {
- AttributeRequesterEntityAttributeExactPolicyRule matcher =
+ AttributeIssuerEntityAttributeExactPolicyRule matcher =
getMatcher("urn:example.org:policies", "urn:example.org:policy:1234", null, false);
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.TRUE);
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(issMetadataContext(idpEntity, "Principal")), Tristate.TRUE);
+ assertEquals(matcher.matches(issMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
matcher = getMatcher("urn:example.org:policies", "urn:example.org:policy:5678", null, false);
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.TRUE);
- assertEquals(matcher.matches(metadataContext(noneEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(issMetadataContext(idpEntity, "Principal")), Tristate.TRUE);
+ assertEquals(matcher.matches(issMetadataContext(noneEntity, "Principal")), Tristate.FALSE);
}
@Test public void testUnpopulated()
@@ -107,6 +107,6 @@ public class AttributeRequesterEntityAttributeExactPolicyRuleTest extends BaseMe
@Test public void testNoMetadata()
throws ComponentInitializationException {
- assertEquals(getMatcher().matches(metadataContext(null, "Principal")), Tristate.FALSE);
+ assertEquals(getMatcher().matches(issMetadataContext(null, "Principal")), Tristate.FALSE);
}
}
diff --git a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterEntityAttributeRegexPolicyRuleTest.java b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerEntityAttributeRegexPolicyRuleTest.java
similarity index 70%
copy from idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterEntityAttributeRegexPolicyRuleTest.java
copy to idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerEntityAttributeRegexPolicyRuleTest.java
index 89f2cfd..3d6e865 100644
--- a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterEntityAttributeRegexPolicyRuleTest.java
+++ b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerEntityAttributeRegexPolicyRuleTest.java
@@ -27,18 +27,18 @@ import net.shibboleth.idp.attribute.filter.PolicyRequirementRule.Tristate;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
/**
- * test for {@link AttributeRequesterEntityAttributeRegexPolicyRule}.
+ * test for {@link AttributeIssuerEntityAttributeRegexPolicyRule}.
*/
-public class AttributeRequesterEntityAttributeRegexPolicyRuleTest extends BaseMetadataTests {
+public class AttributeIssuerEntityAttributeRegexPolicyRuleTest extends BaseMetadataTests {
- private AttributeRequesterEntityAttributeRegexPolicyRule getMatcher() throws ComponentInitializationException {
+ private AttributeIssuerEntityAttributeRegexPolicyRule getMatcher() throws ComponentInitializationException {
Pattern pattern = Pattern.compile("urn\\:example.org\\:policy\\:56.*");
return getMatcher("urn:example.org:policies", pattern, null);
}
- private AttributeRequesterEntityAttributeRegexPolicyRule getMatcher(String attributeName, Pattern attributeValuePattern,
+ private AttributeIssuerEntityAttributeRegexPolicyRule getMatcher(String attributeName, Pattern attributeValuePattern,
String attributeNameFormat) throws ComponentInitializationException {
- AttributeRequesterEntityAttributeRegexPolicyRule matcher = new AttributeRequesterEntityAttributeRegexPolicyRule();
+ AttributeIssuerEntityAttributeRegexPolicyRule matcher = new AttributeIssuerEntityAttributeRegexPolicyRule();
matcher.setId("matcher");
matcher.setAttributeName(attributeName);
matcher.setValueRegex(attributeValuePattern);
@@ -49,10 +49,10 @@ public class AttributeRequesterEntityAttributeRegexPolicyRuleTest extends BaseM
@Test public void simple() throws ComponentInitializationException {
- AttributeRequesterEntityAttributeRegexPolicyRule matcher = getMatcher();
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.TRUE);
+ AttributeIssuerEntityAttributeRegexPolicyRule matcher = getMatcher();
+ assertEquals(matcher.matches(issMetadataContext(idpEntity, "Principal")), Tristate.TRUE);
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(issMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
}
diff --git a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/RegistrationAuthorityTest.java b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerRegistrationAuthorityTest.java
similarity index 72%
copy from idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/RegistrationAuthorityTest.java
copy to idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerRegistrationAuthorityTest.java
index dcdf48d..4fccd85 100644
--- a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/RegistrationAuthorityTest.java
+++ b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerRegistrationAuthorityTest.java
@@ -30,8 +30,8 @@ import org.testng.annotations.Test;
import net.shibboleth.idp.attribute.filter.PolicyRequirementRule.Tristate;
import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
-/** {@link RegistrationAuthorityPolicyRule} unit test. */
-public class RegistrationAuthorityTest extends BaseMetadataTests {
+/** {@link AttributeIssuerRegistrationAuthorityPolicyRule} unit test. */
+public class AttributeIssuerRegistrationAuthorityTest extends BaseMetadataTests {
private static final String REQUESTED_REG_INFO = "http://www.swamid.se/";
@@ -41,7 +41,7 @@ public class RegistrationAuthorityTest extends BaseMetadataTests {
private static final String NO_REGINFO_SP = "https://issues.shibboleth.net/shibboleth";
- private final String SWAMID = "https://sp-test.swamid.se/shibboleth";
+ private final String SWAMID = "https://swamid.user.uu.se/idp/shibboleth";
private EntitiesDescriptor metadata;
@@ -61,38 +61,39 @@ public class RegistrationAuthorityTest extends BaseMetadataTests {
@Test public void swamid() throws Exception {
- AttributeFilterContext context = metadataContext(getEntity(SWAMID), "principal");
- final RegistrationAuthorityPolicyRule filter = new RegistrationAuthorityPolicyRule();
+ AttributeFilterContext context = issMetadataContext(getEntity(SWAMID), "principal");
+ final AttributeIssuerRegistrationAuthorityPolicyRule filter = new AttributeIssuerRegistrationAuthorityPolicyRule();
String[] array = {REQUESTED_REG_INFO, "foo",};
- filter.setIssuers(Arrays.asList(array));
+ filter.setRegistrars(Arrays.asList(array));
assertEquals(filter.matches(context), Tristate.TRUE);
array[0] = INCOMMON_REG_INFO;
- filter.setIssuers(Arrays.asList(array));
+ filter.setRegistrars(Arrays.asList(array));
assertEquals(filter.matches(context), Tristate.FALSE);
}
@Test public void ligo() {
- AttributeFilterContext context = metadataContext(getEntity(INCOMMON_SP), "principal");
- final RegistrationAuthorityPolicyRule filter = new RegistrationAuthorityPolicyRule();
+ AttributeFilterContext context = issMetadataContext(getEntity(INCOMMON_SP), "principal");
+ final AttributeIssuerRegistrationAuthorityPolicyRule filter = new AttributeIssuerRegistrationAuthorityPolicyRule();
String[] array = {REQUESTED_REG_INFO, "foo",};
- filter.setIssuers(Arrays.asList(array));
+ filter.setRegistrars(Arrays.asList(array));
assertEquals(filter.matches(context), Tristate.FALSE);
array[0] = INCOMMON_REG_INFO;
- filter.setIssuers(Arrays.asList(array));
+ filter.setRegistrars(Arrays.asList(array));
assertEquals(filter.matches(context), Tristate.TRUE);
}
@Test public void none() {
- AttributeFilterContext context = metadataContext(getEntity(NO_REGINFO_SP), "principal");
- final RegistrationAuthorityPolicyRule filter = new RegistrationAuthorityPolicyRule();
+ AttributeFilterContext context = issMetadataContext(getEntity(NO_REGINFO_SP), "principal");
+ final AttributeIssuerRegistrationAuthorityPolicyRule filter = new AttributeIssuerRegistrationAuthorityPolicyRule();
String[] array = {REQUESTED_REG_INFO, INCOMMON_REG_INFO, "foo",};
- filter.setIssuers(Arrays.asList(array));
+ filter.setRegistrars(Arrays.asList(array));
filter.setMatchIfMetadataSilent(true);
assertEquals(filter.matches(context), Tristate.TRUE);
filter.setMatchIfMetadataSilent(false);
assertEquals(filter.matches(context), Tristate.FALSE);
}
-}
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterEntityAttributeExactPolicyRuleTest.java b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterEntityAttributeExactPolicyRuleTest.java
index 7e2e924..03acce8 100644
--- a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterEntityAttributeExactPolicyRuleTest.java
+++ b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterEntityAttributeExactPolicyRuleTest.java
@@ -49,9 +49,9 @@ public class AttributeRequesterEntityAttributeExactPolicyRuleTest extends BaseMe
@Test public void testValue() throws ComponentInitializationException {
AttributeRequesterEntityAttributeExactPolicyRule matcher = getMatcher();
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.TRUE);
+ assertEquals(matcher.matches(reqMetadataContext(idpEntity, "Principal")), Tristate.TRUE);
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
}
@Test public void testFormat() throws ComponentInitializationException {
@@ -59,45 +59,45 @@ public class AttributeRequesterEntityAttributeExactPolicyRuleTest extends BaseMe
AttributeRequesterEntityAttributeExactPolicyRule matcher =
getMatcher("urn:example.org:entitlements", "urn:example.org:entitlements:1234", null, true);
assertEquals(matcher.getValue(), "urn:example.org:entitlements:1234");
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.TRUE);
+ assertEquals(matcher.matches(reqMetadataContext(idpEntity, "Principal")), Tristate.TRUE);
- assertEquals(matcher.matches(metadataContext(wikiEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(wikiEntity, "Principal")), Tristate.FALSE);
matcher = getMatcher("urn:example.org:entitlements", "urn:example.org:entitlements:1234", "foo", true);
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(idpEntity, "Principal")), Tristate.FALSE);
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
matcher =
getMatcher("urn:example.org:entitlements", "urn:example.org:entitlements:1234",
"urn:oasis:names:tc:SAML:2.0:attrname-format:uri", true);
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.TRUE);
+ assertEquals(matcher.matches(reqMetadataContext(idpEntity, "Principal")), Tristate.TRUE);
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
}
@Test public void testNoMatch() throws ComponentInitializationException {
AttributeRequesterEntityAttributeExactPolicyRule matcher =
getMatcher("urn:example.org:policies", "urn:example.org:policy:1235", null, false);
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.FALSE);
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(idpEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
matcher = getMatcher("urn:example.org:policiess", "urn:example.org:policy:1234", null, false);
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.FALSE);
- assertEquals(matcher.matches(metadataContext(noneEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(idpEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(noneEntity, "Principal")), Tristate.FALSE);
}
@Test public void testSplitAttribute() throws ComponentInitializationException {
AttributeRequesterEntityAttributeExactPolicyRule matcher =
getMatcher("urn:example.org:policies", "urn:example.org:policy:1234", null, false);
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.TRUE);
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(idpEntity, "Principal")), Tristate.TRUE);
+ assertEquals(matcher.matches(reqMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
matcher = getMatcher("urn:example.org:policies", "urn:example.org:policy:5678", null, false);
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.TRUE);
- assertEquals(matcher.matches(metadataContext(noneEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(idpEntity, "Principal")), Tristate.TRUE);
+ assertEquals(matcher.matches(reqMetadataContext(noneEntity, "Principal")), Tristate.FALSE);
}
@Test public void testUnpopulated()
@@ -107,6 +107,6 @@ public class AttributeRequesterEntityAttributeExactPolicyRuleTest extends BaseMe
@Test public void testNoMetadata()
throws ComponentInitializationException {
- assertEquals(getMatcher().matches(metadataContext(null, "Principal")), Tristate.FALSE);
+ assertEquals(getMatcher().matches(reqMetadataContext(null, "Principal")), Tristate.FALSE);
}
}
diff --git a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterEntityAttributeRegexPolicyRuleTest.java b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterEntityAttributeRegexPolicyRuleTest.java
index 89f2cfd..a6831c4 100644
--- a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterEntityAttributeRegexPolicyRuleTest.java
+++ b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterEntityAttributeRegexPolicyRuleTest.java
@@ -50,9 +50,9 @@ public class AttributeRequesterEntityAttributeRegexPolicyRuleTest extends BaseM
@Test public void simple() throws ComponentInitializationException {
AttributeRequesterEntityAttributeRegexPolicyRule matcher = getMatcher();
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.TRUE);
+ assertEquals(matcher.matches(reqMetadataContext(idpEntity, "Principal")), Tristate.TRUE);
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
}
diff --git a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRuleTest.java b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRuleTest.java
index d51cbe9..887b93d 100644
--- a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRuleTest.java
+++ b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterInEntityGroupPolicyRuleTest.java
@@ -41,11 +41,11 @@ public class AttributeRequesterInEntityGroupPolicyRuleTest extends BaseMetadataT
@Test public void parent() throws ComponentInitializationException {
AttributeRequesterInEntityGroupPolicyRule matcher = getMatcher("http://shibboleth.net");
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.TRUE);
- assertEquals(matcher.matches(metadataContext(null, null)), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(jiraEntity, "Principal")), Tristate.TRUE);
+ assertEquals(matcher.matches(reqMetadataContext(null, null)), Tristate.FALSE);
matcher = getMatcher("urn:otherstuff");
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
}
@Test public void getter() throws ComponentInitializationException {
@@ -56,6 +56,6 @@ public class AttributeRequesterInEntityGroupPolicyRuleTest extends BaseMetadataT
AttributeRequesterInEntityGroupPolicyRule matcher = new AttributeRequesterInEntityGroupPolicyRule();
matcher.setId("matcher");
matcher.initialize();
- assertEquals(matcher.matches(metadataContext(null, null)), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(null, null)), Tristate.FALSE);
}
}
diff --git a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterNameIDFormatExactPolicyRuleTest.java b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterNameIDFormatExactPolicyRuleTest.java
index 312ff09..61e179a 100644
--- a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterNameIDFormatExactPolicyRuleTest.java
+++ b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterNameIDFormatExactPolicyRuleTest.java
@@ -43,13 +43,13 @@ public class AttributeRequesterNameIDFormatExactPolicyRuleTest extends BaseMetad
assertEquals(matcher.getNameIdFormat(), "https://example.org/foo");
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.TRUE);
- assertEquals(matcher.matches(metadataContext(null, "Principal")), Tristate.FALSE);
- assertEquals(matcher.matches(metadataContext(idpEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(jiraEntity, "Principal")), Tristate.TRUE);
+ assertEquals(matcher.matches(reqMetadataContext(null, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(idpEntity, "Principal")), Tristate.FALSE);
matcher = getMatcher("urn:otherstuff");
- assertEquals(matcher.matches(metadataContext(jiraEntity, "Principal")), Tristate.FALSE);
- assertEquals(matcher.matches(metadataContext(wikiEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(reqMetadataContext(wikiEntity, "Principal")), Tristate.FALSE);
}
diff --git a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/RegistrationAuthorityTest.java b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterRegistrationAuthorityTest.java
similarity index 74%
rename from idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/RegistrationAuthorityTest.java
rename to idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterRegistrationAuthorityTest.java
index dcdf48d..983d6a9 100644
--- a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/RegistrationAuthorityTest.java
+++ b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterRegistrationAuthorityTest.java
@@ -30,8 +30,8 @@ import org.testng.annotations.Test;
import net.shibboleth.idp.attribute.filter.PolicyRequirementRule.Tristate;
import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
-/** {@link RegistrationAuthorityPolicyRule} unit test. */
-public class RegistrationAuthorityTest extends BaseMetadataTests {
+/** {@link AttributeRequesterRegistrationAuthorityPolicyRule} unit test. */
+public class AttributeRequesterRegistrationAuthorityTest extends BaseMetadataTests {
private static final String REQUESTED_REG_INFO = "http://www.swamid.se/";
@@ -61,38 +61,39 @@ public class RegistrationAuthorityTest extends BaseMetadataTests {
@Test public void swamid() throws Exception {
- AttributeFilterContext context = metadataContext(getEntity(SWAMID), "principal");
- final RegistrationAuthorityPolicyRule filter = new RegistrationAuthorityPolicyRule();
+ AttributeFilterContext context = reqMetadataContext(getEntity(SWAMID), "principal");
+ final AttributeRequesterRegistrationAuthorityPolicyRule filter = new AttributeRequesterRegistrationAuthorityPolicyRule();
String[] array = {REQUESTED_REG_INFO, "foo",};
- filter.setIssuers(Arrays.asList(array));
+ filter.setRegistrars(Arrays.asList(array));
assertEquals(filter.matches(context), Tristate.TRUE);
array[0] = INCOMMON_REG_INFO;
- filter.setIssuers(Arrays.asList(array));
+ filter.setRegistrars(Arrays.asList(array));
assertEquals(filter.matches(context), Tristate.FALSE);
}
@Test public void ligo() {
- AttributeFilterContext context = metadataContext(getEntity(INCOMMON_SP), "principal");
- final RegistrationAuthorityPolicyRule filter = new RegistrationAuthorityPolicyRule();
+ AttributeFilterContext context = reqMetadataContext(getEntity(INCOMMON_SP), "principal");
+ final AttributeRequesterRegistrationAuthorityPolicyRule filter = new AttributeRequesterRegistrationAuthorityPolicyRule();
String[] array = {REQUESTED_REG_INFO, "foo",};
- filter.setIssuers(Arrays.asList(array));
+ filter.setRegistrars(Arrays.asList(array));
assertEquals(filter.matches(context), Tristate.FALSE);
array[0] = INCOMMON_REG_INFO;
- filter.setIssuers(Arrays.asList(array));
+ filter.setRegistrars(Arrays.asList(array));
assertEquals(filter.matches(context), Tristate.TRUE);
}
@Test public void none() {
- AttributeFilterContext context = metadataContext(getEntity(NO_REGINFO_SP), "principal");
- final RegistrationAuthorityPolicyRule filter = new RegistrationAuthorityPolicyRule();
+ AttributeFilterContext context = reqMetadataContext(getEntity(NO_REGINFO_SP), "principal");
+ final AttributeRequesterRegistrationAuthorityPolicyRule filter = new AttributeRequesterRegistrationAuthorityPolicyRule();
String[] array = {REQUESTED_REG_INFO, INCOMMON_REG_INFO, "foo",};
- filter.setIssuers(Arrays.asList(array));
+ filter.setRegistrars(Arrays.asList(array));
filter.setMatchIfMetadataSilent(true);
assertEquals(filter.matches(context), Tristate.TRUE);
filter.setMatchIfMetadataSilent(false);
assertEquals(filter.matches(context), Tristate.FALSE);
}
-}
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/BaseMetadataTests.java b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/BaseMetadataTests.java
index 0f77a6d..b9d40fa 100644
--- a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/BaseMetadataTests.java
+++ b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/BaseMetadataTests.java
@@ -90,7 +90,7 @@ public class BaseMetadataTests extends XMLObjectBaseTestCase {
}
}
- static protected AttributeFilterContext metadataContext(EntityDescriptor sp, String principal) {
+ static protected AttributeFilterContext reqMetadataContext(EntityDescriptor sp, String principal) {
AttributeFilterContext filterContext = new AttributeFilterContext();
SAMLMetadataContext metadataContext = filterContext.getSubcontext(SAMLMetadataContext.class, true);
@@ -102,9 +102,24 @@ public class BaseMetadataTests extends XMLObjectBaseTestCase {
}
filterContext.setPrincipal(principal);
- filterContext
- .setRequesterMetadataContextLookupStrategy(new ChildContextLookup<AttributeFilterContext, SAMLMetadataContext>(
- SAMLMetadataContext.class, false));
+ filterContext.setRequesterMetadataContextLookupStrategy(new ChildContextLookup<>(SAMLMetadataContext.class, false));
return filterContext;
}
-}
+
+ static protected AttributeFilterContext issMetadataContext(EntityDescriptor idp, String principal) {
+
+ AttributeFilterContext filterContext = new AttributeFilterContext();
+ SAMLMetadataContext metadataContext = filterContext.getSubcontext(SAMLMetadataContext.class, true);
+
+ metadataContext.setEntityDescriptor(idp);
+ if (idp != null) {
+ metadataContext.setRoleDescriptor(idp.getIDPSSODescriptor("urn:oasis:names:tc:SAML:2.0:protocol"));
+ filterContext.setAttributeIssuerID(idp.getEntityID());
+ }
+
+ filterContext.setPrincipal(principal);
+ filterContext.setIssuerMetadataContextLookupStrategy(new ChildContextLookup<>(SAMLMetadataContext.class, false));
+ return filterContext;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
index 84ab742..0c617ea 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
@@ -43,12 +43,13 @@ import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.ProxiedRequest
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeInMetadataRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeIssuerEntityAttributeExactRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeIssuerEntityAttributeRegexRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeIssuerRegistrationAuthorityRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterEntityAttributeExactRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterEntityAttributeRegexRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterInEntityGroupRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterNameIdFormatRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterRegistrationAuthorityRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.MappedAttributeInMetadataRuleParser;
-import net.shibboleth.idp.attribute.filter.spring.saml.impl.RegistrationAuthorityRuleParser;
/** Namespace handler for the attribute filtering engine. */
public class AttributeFilterNamespaceHandler extends BaseSpringNamespaceHandler {
@@ -144,8 +145,11 @@ public class AttributeFilterNamespaceHandler extends BaseSpringNamespaceHandler
registerBeanDefinitionParser(MappedAttributeInMetadataRuleParser.SCHEMA_TYPE,
new MappedAttributeInMetadataRuleParser());
- registerBeanDefinitionParser(RegistrationAuthorityRuleParser.SCHEMA_TYPE,
- new RegistrationAuthorityRuleParser());
+ registerBeanDefinitionParser(AttributeRequesterRegistrationAuthorityRuleParser.SCHEMA_TYPE,
+ new AttributeRequesterRegistrationAuthorityRuleParser());
+
+ registerBeanDefinitionParser(AttributeIssuerRegistrationAuthorityRuleParser.SCHEMA_TYPE,
+ new AttributeIssuerRegistrationAuthorityRuleParser());
}
// Checkstyle: MethodLength ON
}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/RegistrationAuthorityRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AbstractRegistrationAuthorityRuleParser.java
similarity index 71%
rename from idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/RegistrationAuthorityRuleParser.java
rename to idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AbstractRegistrationAuthorityRuleParser.java
index f27e050..747317c 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/RegistrationAuthorityRuleParser.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AbstractRegistrationAuthorityRuleParser.java
@@ -18,7 +18,6 @@
package net.shibboleth.idp.attribute.filter.spring.saml.impl;
import javax.annotation.Nonnull;
-import javax.xml.namespace.QName;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -29,17 +28,11 @@ import org.w3c.dom.Attr;
import org.w3c.dom.Element;
import net.shibboleth.ext.spring.util.SpringSupport;
-import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.RegistrationAuthorityPolicyRule;
-import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.BasePolicyRuleParser;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
-/** Spring bean definition parser that creates {@link RegistrationAuthorityPolicyRule} beans. */
-public class RegistrationAuthorityRuleParser extends BasePolicyRuleParser {
-
- /** Schema type. */
- public static final QName SCHEMA_TYPE = new QName(BaseFilterParser.NAMESPACE,
- "RegistrationAuthority");
+/** Spring bean definition parser that creates RegistrationAuthorityPolicyRule beans. */
+public abstract class AbstractRegistrationAuthorityRuleParser extends BasePolicyRuleParser {
/** Name of the attribute carrying the Issuers list. */
public static final String REGISTRARS_ATTR_NAME = "registrars";
@@ -48,12 +41,7 @@ public class RegistrationAuthorityRuleParser extends BasePolicyRuleParser {
public static final String MATCH_IF_METADATA_SILENT_ATTR_NAME = "matchIfMetadataSilent";
/** Class logger. */
- private final Logger log = LoggerFactory.getLogger(RegistrationAuthorityRuleParser.class);
-
- /** {@inheritDoc} */
- @Override protected Class<RegistrationAuthorityPolicyRule> getNativeBeanClass() {
- return RegistrationAuthorityPolicyRule.class;
- }
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractRegistrationAuthorityRuleParser.class);
/** {@inheritDoc} */
@Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
@@ -68,9 +56,10 @@ public class RegistrationAuthorityRuleParser extends BasePolicyRuleParser {
final Attr attr = element.getAttributeNodeNS(null, REGISTRARS_ATTR_NAME);
if (attr != null) {
- final AbstractBeanDefinition issuers = SpringSupport.getAttributeValueAsList(attr);
- log.debug("Registration Authority Filter: Issuers = {}", attr.getValue());
- builder.addPropertyValue("issuers", issuers);
+ final AbstractBeanDefinition registrars = SpringSupport.getAttributeValueAsList(attr);
+ log.debug("Registration Authority Filter: registrars = {}", attr.getValue());
+ builder.addPropertyValue("registrars", registrars);
}
}
-}
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeIssuerRegistrationAuthorityRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeIssuerRegistrationAuthorityRuleParser.java
new file mode 100644
index 0000000..75475f1
--- /dev/null
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeIssuerRegistrationAuthorityRuleParser.java
@@ -0,0 +1,38 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.spring.saml.impl;
+
+import javax.annotation.Nonnull;
+import javax.xml.namespace.QName;
+
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeIssuerRegistrationAuthorityPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
+
+/** Spring bean definition parser that creates {@link AttributeIssuerRegistrationAuthorityPolicyRule} beans. */
+public class AttributeIssuerRegistrationAuthorityRuleParser extends AbstractRegistrationAuthorityRuleParser {
+
+ /** Schema type. */
+ @Nonnull public static final QName SCHEMA_TYPE = new QName(BaseFilterParser.NAMESPACE,
+ "IssuerRegistrationAuthority");
+
+ /** {@inheritDoc} */
+ @Override protected Class<AttributeIssuerRegistrationAuthorityPolicyRule> getNativeBeanClass() {
+ return AttributeIssuerRegistrationAuthorityPolicyRule.class;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterRegistrationAuthorityRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterRegistrationAuthorityRuleParser.java
new file mode 100644
index 0000000..b3e3aa9
--- /dev/null
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterRegistrationAuthorityRuleParser.java
@@ -0,0 +1,38 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.spring.saml.impl;
+
+import javax.annotation.Nonnull;
+import javax.xml.namespace.QName;
+
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeRequesterRegistrationAuthorityPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
+
+/** Spring bean definition parser that creates {@link AttributeRequesterRegistrationAuthorityPolicyRule} beans. */
+public class AttributeRequesterRegistrationAuthorityRuleParser extends AbstractRegistrationAuthorityRuleParser {
+
+ /** Schema type. */
+ @Nonnull public static final QName SCHEMA_TYPE = new QName(BaseFilterParser.NAMESPACE,
+ "RegistrationAuthority");
+
+ /** {@inheritDoc} */
+ @Override protected Class<AttributeRequesterRegistrationAuthorityPolicyRule> getNativeBeanClass() {
+ return AttributeRequesterRegistrationAuthorityPolicyRule.class;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/RegistrationAuthorityRuleParserTest.java b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeIssuerRegistrationAuthorityRuleParserTest.java
similarity index 75%
copy from idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/RegistrationAuthorityRuleParserTest.java
copy to idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeIssuerRegistrationAuthorityRuleParserTest.java
index a55b791..1d284d9 100644
--- a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/RegistrationAuthorityRuleParserTest.java
+++ b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeIssuerRegistrationAuthorityRuleParserTest.java
@@ -24,22 +24,22 @@ import java.util.Set;
import org.testng.annotations.Test;
-import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.RegistrationAuthorityPolicyRule;
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeIssuerRegistrationAuthorityPolicyRule;
import net.shibboleth.idp.attribute.filter.spring.BaseAttributeFilterParserTest;
-import net.shibboleth.idp.attribute.filter.spring.saml.impl.RegistrationAuthorityRuleParser;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
/**
- * test for {@link RegistrationAuthorityRuleParser}.
+ * test for {@link AttributeIssuerRegistrationAuthorityRuleParser}.
*/
-public class RegistrationAuthorityRuleParserTest extends BaseAttributeFilterParserTest {
+public class AttributeIssuerRegistrationAuthorityRuleParserTest extends BaseAttributeFilterParserTest {
@Test public void silentTrue() throws ComponentInitializationException {
- final RegistrationAuthorityPolicyRule rule = (RegistrationAuthorityPolicyRule) getPolicyRule("registrationAuthorityOne.xml");
+ final AttributeIssuerRegistrationAuthorityPolicyRule rule =
+ (AttributeIssuerRegistrationAuthorityPolicyRule) getPolicyRule("issuerAuthorityOne.xml");
assertTrue(rule.isMatchIfMetadataSilent());
- final Set<String> issuers = rule.getIssuers();
+ final Set<String> issuers = rule.getRegistrars();
assertEquals(issuers.size(), 2);
assertTrue(issuers.contains("https://example.org/SilentTrue/One"));
@@ -47,14 +47,16 @@ public class RegistrationAuthorityRuleParserTest extends BaseAttributeFilterPars
}
@Test public void silentFalse() throws ComponentInitializationException {
- final RegistrationAuthorityPolicyRule rule = (RegistrationAuthorityPolicyRule) getPolicyRule("registrationAuthorityTwo.xml");
+ final AttributeIssuerRegistrationAuthorityPolicyRule rule
+ = (AttributeIssuerRegistrationAuthorityPolicyRule) getPolicyRule("issuerAuthorityTwo.xml");
assertTrue(rule.isMatchIfMetadataSilent());
- final Set<String> issuers = rule.getIssuers();
+ final Set<String> issuers = rule.getRegistrars();
assertEquals(issuers.size(), 3);
assertTrue(issuers.contains("https://example.org/SilentFalse/One"));
assertTrue(issuers.contains("https://example.org/SilentFalse/Two"));
assertTrue(issuers.contains("https://example.org/SilentFalse/Three"));
}
-}
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/RegistrationAuthorityRuleParserTest.java b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeRequesterRegistrationAuthorityRuleParserTest.java
similarity index 74%
rename from idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/RegistrationAuthorityRuleParserTest.java
rename to idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeRequesterRegistrationAuthorityRuleParserTest.java
index a55b791..3a1d4ac 100644
--- a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/RegistrationAuthorityRuleParserTest.java
+++ b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeRequesterRegistrationAuthorityRuleParserTest.java
@@ -24,22 +24,22 @@ import java.util.Set;
import org.testng.annotations.Test;
-import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.RegistrationAuthorityPolicyRule;
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeRequesterRegistrationAuthorityPolicyRule;
import net.shibboleth.idp.attribute.filter.spring.BaseAttributeFilterParserTest;
-import net.shibboleth.idp.attribute.filter.spring.saml.impl.RegistrationAuthorityRuleParser;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
/**
- * test for {@link RegistrationAuthorityRuleParser}.
+ * test for {@link AttributeRequesterRegistrationAuthorityRuleParser}.
*/
-public class RegistrationAuthorityRuleParserTest extends BaseAttributeFilterParserTest {
+public class AttributeRequesterRegistrationAuthorityRuleParserTest extends BaseAttributeFilterParserTest {
@Test public void silentTrue() throws ComponentInitializationException {
- final RegistrationAuthorityPolicyRule rule = (RegistrationAuthorityPolicyRule) getPolicyRule("registrationAuthorityOne.xml");
+ final AttributeRequesterRegistrationAuthorityPolicyRule rule =
+ (AttributeRequesterRegistrationAuthorityPolicyRule) getPolicyRule("registrationAuthorityOne.xml");
assertTrue(rule.isMatchIfMetadataSilent());
- final Set<String> issuers = rule.getIssuers();
+ final Set<String> issuers = rule.getRegistrars();
assertEquals(issuers.size(), 2);
assertTrue(issuers.contains("https://example.org/SilentTrue/One"));
@@ -47,14 +47,16 @@ public class RegistrationAuthorityRuleParserTest extends BaseAttributeFilterPars
}
@Test public void silentFalse() throws ComponentInitializationException {
- final RegistrationAuthorityPolicyRule rule = (RegistrationAuthorityPolicyRule) getPolicyRule("registrationAuthorityTwo.xml");
+ final AttributeRequesterRegistrationAuthorityPolicyRule rule
+ = (AttributeRequesterRegistrationAuthorityPolicyRule) getPolicyRule("registrationAuthorityTwo.xml");
assertTrue(rule.isMatchIfMetadataSilent());
- final Set<String> issuers = rule.getIssuers();
+ final Set<String> issuers = rule.getRegistrars();
assertEquals(issuers.size(), 3);
assertTrue(issuers.contains("https://example.org/SilentFalse/One"));
assertTrue(issuers.contains("https://example.org/SilentFalse/Two"));
assertTrue(issuers.contains("https://example.org/SilentFalse/Three"));
}
-}
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/issuerAuthorityOne.xml b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/issuerAuthorityOne.xml
new file mode 100644
index 0000000..525ec4b
--- /dev/null
+++ b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/issuerAuthorityOne.xml
@@ -0,0 +1,9 @@
+<AttributeFilterPolicy id="MostBasicExample" xmlns="urn:mace:shibboleth:2.0:afp"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
+
+ <PolicyRequirementRule
+ xsi:type="IssuerRegistrationAuthority" id="SilentTRUE"
+ matchIfMetadataSilent="true"
+ registrars="https://example.org/SilentTrue/One https://example.org/SilentTrue/Two" />
+</AttributeFilterPolicy>
diff --git a/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/issuerAuthorityTwo.xml b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/issuerAuthorityTwo.xml
new file mode 100644
index 0000000..50eab41
--- /dev/null
+++ b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/issuerAuthorityTwo.xml
@@ -0,0 +1,9 @@
+<AttributeFilterPolicy id="MostBasicExample" xmlns="urn:mace:shibboleth:2.0:afp"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
+
+ <PolicyRequirementRule
+ xsi:type="IssuerRegistrationAuthority" id="SilentTRUE"
+ matchIfMetadataSilent="true"
+ registrars="https://example.org/SilentFalse/One https://example.org/SilentFalse/Two https://example.org/SilentFalse/Three" />
+</AttributeFilterPolicy>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-afp.xsd b/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
index 96352ec..1f8085b 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
@@ -745,12 +745,10 @@
</complexContent>
</complexType>
- <complexType name="AttributeIssuerRegistrationAuthority">
+ <complexType name="RegistrationAuthority">
<annotation>
<documentation>
- A match function that matches the attribute issuer's MDRPI content against a list of potential values.
-
- Not supported in V3.
+ A match function that matches the SP (requester) MDRPI against a list of potential values.
</documentation>
</annotation>
<complexContent>
@@ -758,10 +756,10 @@
</complexContent>
</complexType>
- <complexType name="RegistrationAuthority">
+ <complexType name="IssuerRegistrationAuthority">
<annotation>
<documentation>
- A match function that matches the SP (requester) MDRPI against a list of potential values.
+ A match function that matches the attribute issuer's MDRPI content against a list of potential values.
</documentation>
</annotation>
<complexContent>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list