[java-identity-provider] branch master updated: IDP-1456 - Apply attribute filtering code to inbound attributes

Scott Cantor cantor.2 at osu.edu
Fri May 31 15:50:27 EDT 2019


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=abc4ade272bf7acadb8780020c28043193c29934

The following commit(s) were added to refs/heads/master by this push:
       new  abc4ade   IDP-1456 - Apply attribute filtering code to inbound attributes
abc4ade is described below

commit abc4ade272bf7acadb8780020c28043193c29934
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri May 31 15:50:21 2019 -0400

    IDP-1456 - Apply attribute filtering code to inbound attributes
    
    https://issues.shibboleth.net/jira/browse/IDP-1456
    
    Add Inbound and Outbound directional policy rules.
---
 .../filter/context/AttributeFilterContext.java     | 45 +++++++++++++++
 .../policyrule/impl/DirectionPolicyRule.java       | 67 ++++++++++++++++++++++
 .../impl/AttributeFilterNamespaceHandler.java      |  5 ++
 .../spring/policyrule/impl/InboundRuleParser.java  | 53 +++++++++++++++++
 .../spring/policyrule/impl/OutboundRuleParser.java | 53 +++++++++++++++++
 .../filter/spring/policy/InboundRuleTest.java      | 41 +++++++++++++
 .../filter/spring/policy/OutboundRuleTest.java     | 41 +++++++++++++
 .../idp/attribute/filter/policyrule/inbound.xml    |  4 ++
 .../idp/attribute/filter/policyrule/outbound.xml   |  4 ++
 .../authn/impl/ValidateExternalAuthentication.java |  4 +-
 .../resources/conf/authn/external-authn-config.xml |  2 +-
 .../idp/profile/impl/FilterAttributes.java         |  4 +-
 .../src/main/resources/schema/shibboleth-afp.xsd   | 27 ++++++---
 13 files changed, 340 insertions(+), 10 deletions(-)

diff --git a/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java b/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java
index 72ad676..404bdf0 100644
--- a/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java
+++ b/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java
@@ -31,6 +31,7 @@ import net.shibboleth.idp.attribute.IdPAttribute;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.NullableElements;
 import net.shibboleth.utilities.java.support.collection.CollectionSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
 
 import org.opensaml.messaging.context.BaseContext;
 import org.opensaml.profile.context.ProxiedRequesterContext;
@@ -43,6 +44,22 @@ import com.google.common.base.Predicates;
 @NotThreadSafe
 public final class AttributeFilterContext extends BaseContext {
 
+    /**
+     * Used to indicate the "direction" of filtering relative to the IdP.
+     * 
+     * @since 4.0.0
+     */
+    public enum Direction {
+        /** Inbound filtering is used to control the acceptance of data from another party. */
+        INBOUND, 
+        
+        /** Outbound filtering is used to control the release of data to another party. */
+        OUTBOUND,
+        };
+    
+    /** Direction of filtering. */
+    @Nonnull private Direction direction;
+        
     /** Attributes which are to be filtered. */
     @Nonnull private Map<String,IdPAttribute> prefilteredAttributes;
 
@@ -89,6 +106,34 @@ public final class AttributeFilterContext extends BaseContext {
     public AttributeFilterContext() {
         prefilteredAttributes = new HashMap<>();
         filteredAttributes = new HashMap<>();
+        
+        direction = Direction.OUTBOUND;
+    }
+    
+    /**
+     * Gets the direction of filtering.
+     * 
+     * @return the direction
+     * 
+     * @since 4.0.0
+     */
+    @Nonnull public Direction getDirection() {
+        return direction;
+    }
+    
+    /**
+     * Sets the direction of filtering.
+     * 
+     * @param dir the direction
+     * 
+     * @return this context
+     * 
+     * @since 4.0.0
+     */
+    @Nonnull public AttributeFilterContext setDirection(@Nonnull final Direction dir) {
+        direction = Constraint.isNotNull(dir, "Direction cannot be null");
+        
+        return this;
     }
 
     /**
diff --git a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/impl/DirectionPolicyRule.java b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/impl/DirectionPolicyRule.java
new file mode 100644
index 0000000..aea060e
--- /dev/null
+++ b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/impl/DirectionPolicyRule.java
@@ -0,0 +1,67 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.policyrule.impl;
+
+import javax.annotation.Nonnull;
+
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext.Direction;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/** General {@link PolicyRule} for testing the filtering direction. */
+public class DirectionPolicyRule extends AbstractPolicyRule {
+
+    /** Direction to match for a positive evaluation. */
+    @NonnullAfterInit private Direction matchDirection;
+    
+    /**
+     * Gets the {@link Direction} to match for a positive evaluation.
+     * 
+     * @return direction to match
+     */
+    @NonnullAfterInit public Direction getMatchDirection() {
+        return matchDirection;
+    }
+
+    /**
+     * Sets the {@link Direction} to match for a positive evaluation.
+     * 
+     * @param match match for a positive evaluation
+     */
+    public void setMatchDirection(@Nonnull final Direction match) {
+        matchDirection = Constraint.isNotNull(match, "Direction cannot be null");
+    }
+    
+    /** {@inheritDoc} */
+    @Override
+    protected void doInitialize() throws ComponentInitializationException {
+        super.doInitialize();
+        
+        if (matchDirection == null) {
+            throw new ComponentInitializationException("Direction cannot be null");
+        }
+    }
+    
+    /** {@inheritDoc} */
+    public Tristate matches(@Nonnull final AttributeFilterContext filterContext) {
+        return matchDirection.equals(filterContext.getDirection()) ? Tristate.TRUE : Tristate.FALSE;
+    }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
index f9d052a..5de75cf 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
@@ -34,7 +34,9 @@ import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.AttributeIssue
 import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.AttributeIssuerRuleParser;
 import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.AttributeRequesterRegexRuleParser;
 import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.AttributeRequesterRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.InboundRuleParser;
 import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.NumOfAttributeValuesRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.OutboundRuleParser;
 import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.PredicateRuleParser;
 import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.PrincipalNameRegexRuleParser;
 import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.PrincipalNameRuleParser;
@@ -83,6 +85,9 @@ public class AttributeFilterNamespaceHandler extends BaseSpringNamespaceHandler
 
         registerBeanDefinitionParser(NotMatcherParser.SCHEMA_TYPE, new NotMatcherParser());
 
+        registerBeanDefinitionParser(InboundRuleParser.SCHEMA_TYPE, new InboundRuleParser());
+        registerBeanDefinitionParser(OutboundRuleParser.SCHEMA_TYPE, new OutboundRuleParser());
+        
         // Attribute/Matcher
         registerBeanDefinitionParser(AttributeValueStringMatcherParser.SCHEMA_TYPE,
                 new AttributeValueStringMatcherParser());
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/InboundRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/InboundRuleParser.java
new file mode 100644
index 0000000..0c4d0d0
--- /dev/null
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/InboundRuleParser.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.spring.policyrule.impl;
+
+import javax.annotation.Nonnull;
+import javax.xml.namespace.QName;
+
+import org.springframework.beans.factory.support.BeanDefinitionBuilder;
+import org.springframework.beans.factory.xml.ParserContext;
+import org.w3c.dom.Element;
+
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext.Direction;
+import net.shibboleth.idp.attribute.filter.policyrule.impl.DirectionPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
+import net.shibboleth.idp.attribute.filter.spring.policyrule.BasePolicyRuleParser;
+
+/**
+ * Bean definition parser for {@link DirectionPolicyRule} using {@link Direction.INBOUND}.
+ */
+public class InboundRuleParser extends BasePolicyRuleParser {
+
+    /** Schema type. */
+    public static final QName SCHEMA_TYPE = new QName(BaseFilterParser.NAMESPACE, "Inbound");
+
+    /** {@inheritDoc} */
+    @Override @Nonnull protected Class<DirectionPolicyRule> getNativeBeanClass() {
+        return DirectionPolicyRule.class;
+    }
+
+    /** {@inheritDoc} */
+    @Override protected void doNativeParse(@Nonnull final Element config, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
+        super.doParse(config, builder);
+
+        builder.addPropertyValue("matchDirection", Direction.INBOUND);
+    }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/OutboundRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/OutboundRuleParser.java
new file mode 100644
index 0000000..3c884ff
--- /dev/null
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/OutboundRuleParser.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.spring.policyrule.impl;
+
+import javax.annotation.Nonnull;
+import javax.xml.namespace.QName;
+
+import org.springframework.beans.factory.support.BeanDefinitionBuilder;
+import org.springframework.beans.factory.xml.ParserContext;
+import org.w3c.dom.Element;
+
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext.Direction;
+import net.shibboleth.idp.attribute.filter.policyrule.impl.DirectionPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
+import net.shibboleth.idp.attribute.filter.spring.policyrule.BasePolicyRuleParser;
+
+/**
+ * Bean definition parser for {@link DirectionPolicyRule} using {@link Direction.OUTBOUND}.
+ */
+public class OutboundRuleParser extends BasePolicyRuleParser {
+
+    /** Schema type. */
+    public static final QName SCHEMA_TYPE = new QName(BaseFilterParser.NAMESPACE, "Outbound");
+
+    /** {@inheritDoc} */
+    @Override @Nonnull protected Class<DirectionPolicyRule> getNativeBeanClass() {
+        return DirectionPolicyRule.class;
+    }
+
+    /** {@inheritDoc} */
+    @Override protected void doNativeParse(@Nonnull final Element config, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
+        super.doParse(config, builder);
+
+        builder.addPropertyValue("matchDirection", Direction.OUTBOUND);
+    }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/InboundRuleTest.java b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/InboundRuleTest.java
new file mode 100644
index 0000000..76af812
--- /dev/null
+++ b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/InboundRuleTest.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.spring.policy;
+
+import static org.testng.Assert.assertEquals;
+
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.attribute.filter.PolicyRequirementRule;
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext.Direction;
+import net.shibboleth.idp.attribute.filter.policyrule.impl.DirectionPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseAttributeFilterParserTest;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+
+/**
+ * Test for Inbound policy Rule.
+ */
+public class InboundRuleTest extends BaseAttributeFilterParserTest {
+    
+    @Test public void testPolicy() throws ComponentInitializationException {
+        PolicyRequirementRule policy = getPolicyRule("inbound.xml");
+        assertEquals(DirectionPolicyRule.class, policy.getClass());
+        assertEquals(((DirectionPolicyRule) policy).getMatchDirection(), Direction.INBOUND);
+    }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/OutboundRuleTest.java b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/OutboundRuleTest.java
new file mode 100644
index 0000000..fcd4d3b
--- /dev/null
+++ b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/OutboundRuleTest.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.spring.policy;
+
+import static org.testng.Assert.assertEquals;
+
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.attribute.filter.PolicyRequirementRule;
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext.Direction;
+import net.shibboleth.idp.attribute.filter.policyrule.impl.DirectionPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseAttributeFilterParserTest;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+
+/**
+ * Test for Outbound policy Rule.
+ */
+public class OutboundRuleTest extends BaseAttributeFilterParserTest {
+    
+    @Test public void testPolicy() throws ComponentInitializationException {
+        PolicyRequirementRule policy = getPolicyRule("outbound.xml");
+        assertEquals(DirectionPolicyRule.class, policy.getClass());
+        assertEquals(((DirectionPolicyRule) policy).getMatchDirection(), Direction.OUTBOUND);
+    }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/inbound.xml b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/inbound.xml
new file mode 100644
index 0000000..53aa6f3
--- /dev/null
+++ b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/inbound.xml
@@ -0,0 +1,4 @@
+<AttributeFilterPolicy id="MostBasicExample" xmlns="urn:mace:shibboleth:2.0:afp" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
+    <PolicyRequirementRule xsi:type="Inbound" />
+</AttributeFilterPolicy>
diff --git a/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/outbound.xml b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/outbound.xml
new file mode 100644
index 0000000..05ea8f0
--- /dev/null
+++ b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/outbound.xml
@@ -0,0 +1,4 @@
+<AttributeFilterPolicy id="MostBasicExample" xmlns="urn:mace:shibboleth:2.0:afp" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
+    <PolicyRequirementRule xsi:type="Outbound" />
+</AttributeFilterPolicy>
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java
index 8573bab..eed3367 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java
@@ -31,6 +31,7 @@ import net.shibboleth.idp.attribute.context.AttributeContext;
 import net.shibboleth.idp.attribute.filter.AttributeFilter;
 import net.shibboleth.idp.attribute.filter.AttributeFilterException;
 import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext.Direction;
 import net.shibboleth.idp.authn.AbstractValidationAction;
 import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
@@ -340,7 +341,8 @@ public class ValidateExternalAuthentication extends AbstractValidationAction {
      */
     private void populateFilterContext(@Nonnull final AttributeFilterContext filterContext) {
         
-        filterContext.setPrefilteredIdPAttributes(attributeContext.getIdPAttributes().values())
+        filterContext.setDirection(Direction.INBOUND)
+            .setPrefilteredIdPAttributes(attributeContext.getIdPAttributes().values())
             .setMetadataResolver(metadataResolver)
             .setRequesterMetadataContextLookupStrategy(null)
             .setProxiedRequesterContextLookupStrategy(null);
diff --git a/idp-conf/src/main/resources/conf/authn/external-authn-config.xml b/idp-conf/src/main/resources/conf/authn/external-authn-config.xml
index 8b3a159..9d6652a 100644
--- a/idp-conf/src/main/resources/conf/authn/external-authn-config.xml
+++ b/idp-conf/src/main/resources/conf/authn/external-authn-config.xml
@@ -14,7 +14,7 @@
 
     <!-- Servlet context-relative path to wherever your implementation lives. -->
     <bean id="shibboleth.authn.External.externalAuthnPath" class="java.lang.String"
-        c:_0="contextRelative:Authn/External" />
+        c:_0="contextRelative:external.jsp" />
 
     <!--
     Default is to always use the path in the bean above. If you want to determine it
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java
index 4c240f4..8c7172a 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java
@@ -38,6 +38,7 @@ import net.shibboleth.idp.attribute.context.AttributeContext;
 import net.shibboleth.idp.attribute.filter.AttributeFilter;
 import net.shibboleth.idp.attribute.filter.AttributeFilterException;
 import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext.Direction;
 import net.shibboleth.idp.authn.context.SubjectContext;
 import net.shibboleth.idp.authn.context.navigate.SubjectContextPrincipalLookupFunction;
 import net.shibboleth.idp.profile.AbstractProfileAction;
@@ -402,7 +403,8 @@ public class FilterAttributes extends AbstractProfileAction {
     private void populateFilterContext(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull final AttributeFilterContext filterContext) {
         
-        filterContext.setMetadataResolver(metadataResolver)
+        filterContext.setDirection(Direction.OUTBOUND)
+            .setMetadataResolver(metadataResolver)
             .setPrincipal(principalNameLookupStrategy.apply(profileRequestContext))
             .setAttributeRecipientID(
                     recipientLookupStrategy != null ? recipientLookupStrategy.apply(profileRequestContext) : null)
diff --git a/idp-schema/src/main/resources/schema/shibboleth-afp.xsd b/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
index 49ea555..cbe858f 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
@@ -189,12 +189,6 @@
         </attribute>
     </complexType>
 
-    <!--  
-    
-        The old 'Basic' Schema 
-      
-      -->
-
     <!-- Blanket Match Function -->
     <complexType name="ANY">
         <annotation>
@@ -205,6 +199,25 @@
         </complexContent>
     </complexType>
 
+    <!-- Directional Match Functions -->
+    <complexType name="Inbound">
+        <annotation>
+            <documentation>A match function that evaluates to true.</documentation>
+        </annotation>
+        <complexContent>
+            <extension base="afp:MatchFunctorType"/>
+        </complexContent>
+    </complexType>
+
+    <complexType name="Outbound">
+        <annotation>
+            <documentation>A match function that evaluates to true.</documentation>
+        </annotation>
+        <complexContent>
+            <extension base="afp:MatchFunctorType"/>
+        </complexContent>
+    </complexType>
+
     <!--  Boolean Match Functions -->
     <complexType name="AND">
         <annotation>
@@ -579,7 +592,7 @@
         </complexContent>
     </complexType>
 
-    <!-- The old 'SAML' schema -->
+    <!-- SAML-specific. -->
 
     <complexType name="EntityAttributeExactMatch">
         <annotation>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list