[java-identity-provider] branch master updated: IDP-1456 - Apply attribute filtering code to inbound attributes
Scott Cantor
cantor.2 at osu.edu
Tue May 28 18:28:45 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=e348f0daaf1081b30f5c8d18b84ceb52dab63268
The following commit(s) were added to refs/heads/master by this push:
new e348f0d IDP-1456 - Apply attribute filtering code to inbound attributes
e348f0d is described below
commit e348f0daaf1081b30f5c8d18b84ceb52dab63268
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue May 28 18:28:41 2019 -0400
IDP-1456 - Apply attribute filtering code to inbound attributes
https://issues.shibboleth.net/jira/browse/IDP-1456
Extend FilterAttributes action to prepare for inbound use.
---
.../filter/context/AttributeFilterContext.java | 71 +++++++++----
.../idp/profile/impl/FilterAttributes.java | 115 +++++++++++++--------
2 files changed, 124 insertions(+), 62 deletions(-)
diff --git a/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java b/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java
index c409900..72ad676 100644
--- a/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java
+++ b/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java
@@ -31,7 +31,6 @@ import net.shibboleth.idp.attribute.IdPAttribute;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NullableElements;
import net.shibboleth.utilities.java.support.collection.CollectionSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
import org.opensaml.messaging.context.BaseContext;
import org.opensaml.profile.context.ProxiedRequesterContext;
@@ -97,7 +96,7 @@ public final class AttributeFilterContext extends BaseContext {
*
* @return attributes to be filtered
*/
- @Nonnull @NonnullElements public Map<String, IdPAttribute> getPrefilteredIdPAttributes() {
+ @Nonnull @NonnullElements public Map<String,IdPAttribute> getPrefilteredIdPAttributes() {
return prefilteredAttributes;
}
@@ -105,8 +104,11 @@ public final class AttributeFilterContext extends BaseContext {
* Sets the attributes which are to be filtered.
*
* @param attributes attributes which are to be filtered
+ *
+ * @return this context;
*/
- public void setPrefilteredIdPAttributes(@Nullable @NullableElements final Collection<IdPAttribute> attributes) {
+ @Nonnull public AttributeFilterContext setPrefilteredIdPAttributes(
+ @Nullable @NullableElements final Collection<IdPAttribute> attributes) {
final Collection<IdPAttribute> checkedAttributes = new ArrayList<>();
CollectionSupport.addIf(checkedAttributes, attributes, Predicates.notNull());
@@ -115,6 +117,8 @@ public final class AttributeFilterContext extends BaseContext {
for (final IdPAttribute attribute : checkedAttributes) {
prefilteredAttributes.put(attribute.getId(), attribute);
}
+
+ return this;
}
/**
@@ -158,10 +162,14 @@ public final class AttributeFilterContext extends BaseContext {
*
* @param resolver metadata resolver
*
+ * @return this context
+ *
* @since 3.4.0
*/
- public void setMetadataResolver(@Nullable final MetadataResolver resolver) {
+ @Nonnull public AttributeFilterContext setMetadataResolver(@Nullable final MetadataResolver resolver) {
metadataResolver = resolver;
+
+ return this;
}
/**
@@ -176,10 +184,14 @@ public final class AttributeFilterContext extends BaseContext {
/**
* Gets the principal associated with the filtering.
*
- * @param who The principal to set.
+ * @param who principal to set
+ *
+ * @return this context
*/
- public void setPrincipal(@Nullable final String who) {
+ @Nonnull public AttributeFilterContext setPrincipal(@Nullable final String who) {
principal = who;
+
+ return this;
}
/**
@@ -195,9 +207,13 @@ public final class AttributeFilterContext extends BaseContext {
* Sets the attribute issuer (me) associated with this filtering.
*
* @param value the attribute issuer associated with this filtering
+ *
+ * @return this context
*/
- @Nullable public void setAttributeIssuerID(@Nullable final String value) {
+ @Nonnull public AttributeFilterContext setAttributeIssuerID(@Nullable final String value) {
attributeIssuerID = value;
+
+ return this;
}
/**
@@ -213,9 +229,13 @@ public final class AttributeFilterContext extends BaseContext {
* Sets the attribute recipient (her) associated with this filtering.
*
* @param value the attribute recipient associated with this filtering
+ *
+ * @return this context
*/
- @Nullable public void setAttributeRecipientID(@Nullable final String value) {
+ @Nonnull public AttributeFilterContext setAttributeRecipientID(@Nullable final String value) {
attributeRecipientID = value;
+
+ return this;
}
/**
@@ -241,7 +261,7 @@ public final class AttributeFilterContext extends BaseContext {
*
* @since 3.4.0
*/
- @Nullable public AttributeFilterContext setAttributeRecipientGroupID(@Nullable final String value) {
+ @Nonnull public AttributeFilterContext setAttributeRecipientGroupID(@Nullable final String value) {
attributeRecipientGroupID = value;
return this;
@@ -261,12 +281,15 @@ public final class AttributeFilterContext extends BaseContext {
*
* @param strategy lookup strategy
*
+ * @return this context
+ *
* @since 4.0.0
*/
- public void setIssuerMetadataContextLookupStrategy(
- @Nonnull final Function<AttributeFilterContext,SAMLMetadataContext> strategy) {
- issuerMetadataContextLookupStrategy =
- Constraint.isNotNull(strategy, "MetadataContext lookup strategy cannot be null");
+ @Nonnull public AttributeFilterContext setIssuerMetadataContextLookupStrategy(
+ @Nullable final Function<AttributeFilterContext,SAMLMetadataContext> strategy) {
+ issuerMetadataContextLookupStrategy = strategy;
+
+ return this;
}
/**
@@ -284,11 +307,14 @@ public final class AttributeFilterContext extends BaseContext {
* Set the strategy used to locate the SP's metadata context.
*
* @param strategy lookup strategy
+ *
+ * @return this context
*/
- public void setRequesterMetadataContextLookupStrategy(
- @Nonnull final Function<AttributeFilterContext,SAMLMetadataContext> strategy) {
- requesterMetadataContextLookupStrategy =
- Constraint.isNotNull(strategy, "MetadataContext lookup strategy cannot be null");
+ @Nonnull public AttributeFilterContext setRequesterMetadataContextLookupStrategy(
+ @Nullable final Function<AttributeFilterContext,SAMLMetadataContext> strategy) {
+ requesterMetadataContextLookupStrategy = strategy;
+
+ return this;
}
/**
@@ -308,12 +334,15 @@ public final class AttributeFilterContext extends BaseContext {
*
* @param strategy lookup strategy
*
+ * @return this context
+ *
* @since 3.4.0
*/
- public void setProxiedRequesterContextLookupStrategy(
- @Nonnull final Function<AttributeFilterContext,ProxiedRequesterContext> strategy) {
- proxiedRequesterContextLookupStrategy =
- Constraint.isNotNull(strategy, "ProxiedRequesterContext lookup strategy cannot be null");
+ @Nonnull public AttributeFilterContext setProxiedRequesterContextLookupStrategy(
+ @Nullable final Function<AttributeFilterContext,ProxiedRequesterContext> strategy) {
+ proxiedRequesterContextLookupStrategy = strategy;
+
+ return this;
}
/** Get the Issuer Metadata context.
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java
index ad9b1a0..4c240f4 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java
@@ -86,26 +86,47 @@ public class FilterAttributes extends AbstractProfileAction {
@Nonnull private Function<ProfileRequestContext,String> principalNameLookupStrategy;
/**
- * Strategy used to locate the {@link SAMLMetadataContext} associated with a given {@link ProfileRequestContext}.
+ * Strategy to locate the effectively rooted {@link ProfileRequestContext} from the
+ * {@link AttributeFilterContext}.
+ */
+ @Nonnull
+ private Function<AttributeFilterContext,ProfileRequestContext> profileRequestContextFromFilterLookupStrategy;
+
+ /**
+ * Strategy used to locate the {@link SAMLMetadataContext} for the issuer
+ * associated with a given {@link ProfileRequestContext}.
+ */
+ @Nullable private Function<ProfileRequestContext,SAMLMetadataContext> issuerMetadataContextLookupStrategy;
+
+ /**
+ * Strategy used to locate the {@link SAMLMetadataContext} for the issuer
+ * associated with a given {@link AttributeFilterContext}.
+ */
+ @Nullable private Function<AttributeFilterContext,SAMLMetadataContext> issuerMetadataFromFilterLookupStrategy;
+
+ /**
+ * Strategy used to locate the {@link SAMLMetadataContext} for the recipient
+ * associated with a given {@link ProfileRequestContext}.
*/
- @Nonnull private Function<ProfileRequestContext,SAMLMetadataContext> metadataContextLookupStrategy;
+ @Nullable private Function<ProfileRequestContext,SAMLMetadataContext> metadataContextLookupStrategy;
/**
- * Strategy used to locate the {@link SAMLMetadataContext} associated with a given {@link AttributeFilterContext}.
+ * Strategy used to locate the {@link SAMLMetadataContext} for the recipient
+ * associated with a given {@link AttributeFilterContext}.
*/
- @Nonnull private Function<AttributeFilterContext,SAMLMetadataContext> metadataFromFilterLookupStrategy;
+ @Nullable private Function<AttributeFilterContext,SAMLMetadataContext> metadataFromFilterLookupStrategy;
/**
* Strategy used to locate the {@link ProxiedRequesterContext} associated with a given
* {@link ProfileRequestContext}.
*/
- @Nonnull private Function<ProfileRequestContext,ProxiedRequesterContext> proxiedRequesterContextLookupStrategy;
+ @Nullable private Function<ProfileRequestContext,ProxiedRequesterContext> proxiedRequesterContextLookupStrategy;
/**
* Strategy used to locate the {@link ProxiedRequesterContext} associated with a given
* {@link AttributeFilterContext}.
*/
- @Nonnull private Function<AttributeFilterContext,ProxiedRequesterContext> proxiesFromFilterLookupStrategy;
+ @Nullable private Function<AttributeFilterContext,ProxiedRequesterContext> proxiesFromFilterLookupStrategy;
/** Whether to treat resolver errors as equivalent to resolving no attributes. */
private boolean maskFailures;
@@ -130,22 +151,27 @@ public class FilterAttributes extends AbstractProfileAction {
principalNameLookupStrategy =
new SubjectContextPrincipalLookupFunction().compose(
new ChildContextLookup<>(SubjectContext.class));
-
+
+ // Default is to locate the overall root.
+ profileRequestContextFromFilterLookupStrategy = new RootContextLookup<>();
+
// Default: inbound msg context -> SAMLPeerEntityContext -> SAMLMetadataContext
metadataContextLookupStrategy =
new ChildContextLookup<>(SAMLMetadataContext.class).compose(
new ChildContextLookup<>(SAMLPeerEntityContext.class).compose(
new InboundMessageContextLookup()));
-
- // This is always set to navigate to the root context and then apply the previous function.
- metadataFromFilterLookupStrategy = metadataContextLookupStrategy.compose(new RootContextLookup<>());
+
+ // This is always set to navigate to the PRC and then apply the previous function.
+ metadataFromFilterLookupStrategy = metadataContextLookupStrategy.compose(
+ profileRequestContextFromFilterLookupStrategy);
// Default: inbound msg context -> child
proxiedRequesterContextLookupStrategy =
new ChildContextLookup<>(ProxiedRequesterContext.class).compose(new InboundMessageContextLookup());
- // This is always set to navigate to the root context and then apply the previous function.
- proxiesFromFilterLookupStrategy = proxiedRequesterContextLookupStrategy.compose(new RootContextLookup<>());
+ // This is always set to navigate to the PRC and then apply the previous function.
+ proxiesFromFilterLookupStrategy = proxiedRequesterContextLookupStrategy.compose(
+ profileRequestContextFromFilterLookupStrategy);
// Defaults to ProfileRequestContext -> RelyingPartyContext -> AttributeFilterContext.
filterContextCreationStrategy = new ChildContextLookup<>(AttributeFilterContext.class, true).compose(
@@ -229,23 +255,39 @@ public class FilterAttributes extends AbstractProfileAction {
}
/**
- * Set the strategy used to locate the {@link SAMLMetadataContext} associated with a given
- * {@link ProfileRequestContext}. Also sets the strategy to find the {@link SAMLMetadataContext}
+ * Sets the strategy used to locate the {@link SAMLMetadataContext} for the issuer associated with a
+ * given {@link ProfileRequestContext}. Also sets the strategy to find the {@link SAMLMetadataContext}
+ * from the {@link AttributeFilterContext}.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setIssuerMetadataContextLookupStrategy(
+ @Nullable final Function<ProfileRequestContext,SAMLMetadataContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ issuerMetadataContextLookupStrategy = strategy;
+ issuerMetadataFromFilterLookupStrategy = strategy != null ?
+ issuerMetadataContextLookupStrategy.compose(profileRequestContextFromFilterLookupStrategy) : null;
+ }
+
+ /**
+ * Sets the strategy used to locate the {@link SAMLMetadataContext} for the recipient associated with a
+ * given {@link ProfileRequestContext}. Also sets the strategy to find the {@link SAMLMetadataContext}
* from the {@link AttributeFilterContext}.
*
* @param strategy lookup strategy
*/
public void setMetadataContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,SAMLMetadataContext> strategy) {
+ @Nullable final Function<ProfileRequestContext,SAMLMetadataContext> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- metadataContextLookupStrategy =
- Constraint.isNotNull(strategy, "MetadataContext lookup strategy cannot be null");
- metadataFromFilterLookupStrategy = metadataContextLookupStrategy.compose(new RootContextLookup<>());
+ metadataContextLookupStrategy = strategy;
+ metadataFromFilterLookupStrategy = strategy != null ?
+ metadataContextLookupStrategy.compose(profileRequestContextFromFilterLookupStrategy) : null;
}
/**
- * Set the strategy used to locate the {@link ProxiedRequesterContext} associated with a given
+ * Sets the strategy used to locate the {@link ProxiedRequesterContext} associated with a given
* {@link ProfileRequestContext}. Also sets the strategy to find the {@link ProxiedRequesterContext}
* from the {@link AttributeFilterContext}.
*
@@ -254,12 +296,12 @@ public class FilterAttributes extends AbstractProfileAction {
* @since 3.4.0
*/
public void setProxiedRequesterContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,ProxiedRequesterContext> strategy) {
+ @Nullable final Function<ProfileRequestContext,ProxiedRequesterContext> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- proxiedRequesterContextLookupStrategy =
- Constraint.isNotNull(strategy, "ProxiedRequesterContext lookup strategy cannot be null");
- proxiesFromFilterLookupStrategy = proxiedRequesterContextLookupStrategy.compose(new RootContextLookup<>());
+ proxiedRequesterContextLookupStrategy = strategy;
+ proxiesFromFilterLookupStrategy = strategy != null ?
+ proxiedRequesterContextLookupStrategy.compose(profileRequestContextFromFilterLookupStrategy) : null;
}
/**
@@ -360,24 +402,15 @@ public class FilterAttributes extends AbstractProfileAction {
private void populateFilterContext(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AttributeFilterContext filterContext) {
- filterContext.setMetadataResolver(metadataResolver);
-
- filterContext.setPrincipal(principalNameLookupStrategy.apply(profileRequestContext));
-
- if (recipientLookupStrategy != null) {
- filterContext.setAttributeRecipientID(recipientLookupStrategy.apply(profileRequestContext));
- } else {
- filterContext.setAttributeRecipientID(null);
- }
-
- if (issuerLookupStrategy != null) {
- filterContext.setAttributeIssuerID(issuerLookupStrategy.apply(profileRequestContext));
- } else {
- filterContext.setAttributeIssuerID(null);
- }
-
- filterContext.setRequesterMetadataContextLookupStrategy(metadataFromFilterLookupStrategy);
- filterContext.setProxiedRequesterContextLookupStrategy(proxiesFromFilterLookupStrategy);
+ filterContext.setMetadataResolver(metadataResolver)
+ .setPrincipal(principalNameLookupStrategy.apply(profileRequestContext))
+ .setAttributeRecipientID(
+ recipientLookupStrategy != null ? recipientLookupStrategy.apply(profileRequestContext) : null)
+ .setAttributeIssuerID(
+ issuerLookupStrategy != null ? issuerLookupStrategy.apply(profileRequestContext) : null)
+ .setIssuerMetadataContextLookupStrategy(issuerMetadataFromFilterLookupStrategy)
+ .setRequesterMetadataContextLookupStrategy(metadataFromFilterLookupStrategy)
+ .setProxiedRequesterContextLookupStrategy(proxiesFromFilterLookupStrategy);
// If the filter context doesn't have a set of attributes to filter already
// then look for them in the AttributeContext.
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list