[java-identity-provider] branch master updated: IDP-1456 - Apply attribute filtering code to inbound attributes
Scott Cantor
cantor.2 at osu.edu
Fri May 31 15:50:27 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=abc4ade272bf7acadb8780020c28043193c29934
The following commit(s) were added to refs/heads/master by this push:
new abc4ade IDP-1456 - Apply attribute filtering code to inbound attributes
abc4ade is described below
commit abc4ade272bf7acadb8780020c28043193c29934
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri May 31 15:50:21 2019 -0400
IDP-1456 - Apply attribute filtering code to inbound attributes
https://issues.shibboleth.net/jira/browse/IDP-1456
Add Inbound and Outbound directional policy rules.
---
.../filter/context/AttributeFilterContext.java | 45 +++++++++++++++
.../policyrule/impl/DirectionPolicyRule.java | 67 ++++++++++++++++++++++
.../impl/AttributeFilterNamespaceHandler.java | 5 ++
.../spring/policyrule/impl/InboundRuleParser.java | 53 +++++++++++++++++
.../spring/policyrule/impl/OutboundRuleParser.java | 53 +++++++++++++++++
.../filter/spring/policy/InboundRuleTest.java | 41 +++++++++++++
.../filter/spring/policy/OutboundRuleTest.java | 41 +++++++++++++
.../idp/attribute/filter/policyrule/inbound.xml | 4 ++
.../idp/attribute/filter/policyrule/outbound.xml | 4 ++
.../authn/impl/ValidateExternalAuthentication.java | 4 +-
.../resources/conf/authn/external-authn-config.xml | 2 +-
.../idp/profile/impl/FilterAttributes.java | 4 +-
.../src/main/resources/schema/shibboleth-afp.xsd | 27 ++++++---
13 files changed, 340 insertions(+), 10 deletions(-)
diff --git a/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java b/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java
index 72ad676..404bdf0 100644
--- a/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java
+++ b/idp-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterContext.java
@@ -31,6 +31,7 @@ import net.shibboleth.idp.attribute.IdPAttribute;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NullableElements;
import net.shibboleth.utilities.java.support.collection.CollectionSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
import org.opensaml.messaging.context.BaseContext;
import org.opensaml.profile.context.ProxiedRequesterContext;
@@ -43,6 +44,22 @@ import com.google.common.base.Predicates;
@NotThreadSafe
public final class AttributeFilterContext extends BaseContext {
+ /**
+ * Used to indicate the "direction" of filtering relative to the IdP.
+ *
+ * @since 4.0.0
+ */
+ public enum Direction {
+ /** Inbound filtering is used to control the acceptance of data from another party. */
+ INBOUND,
+
+ /** Outbound filtering is used to control the release of data to another party. */
+ OUTBOUND,
+ };
+
+ /** Direction of filtering. */
+ @Nonnull private Direction direction;
+
/** Attributes which are to be filtered. */
@Nonnull private Map<String,IdPAttribute> prefilteredAttributes;
@@ -89,6 +106,34 @@ public final class AttributeFilterContext extends BaseContext {
public AttributeFilterContext() {
prefilteredAttributes = new HashMap<>();
filteredAttributes = new HashMap<>();
+
+ direction = Direction.OUTBOUND;
+ }
+
+ /**
+ * Gets the direction of filtering.
+ *
+ * @return the direction
+ *
+ * @since 4.0.0
+ */
+ @Nonnull public Direction getDirection() {
+ return direction;
+ }
+
+ /**
+ * Sets the direction of filtering.
+ *
+ * @param dir the direction
+ *
+ * @return this context
+ *
+ * @since 4.0.0
+ */
+ @Nonnull public AttributeFilterContext setDirection(@Nonnull final Direction dir) {
+ direction = Constraint.isNotNull(dir, "Direction cannot be null");
+
+ return this;
}
/**
diff --git a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/impl/DirectionPolicyRule.java b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/impl/DirectionPolicyRule.java
new file mode 100644
index 0000000..aea060e
--- /dev/null
+++ b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/impl/DirectionPolicyRule.java
@@ -0,0 +1,67 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.policyrule.impl;
+
+import javax.annotation.Nonnull;
+
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext.Direction;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/** General {@link PolicyRule} for testing the filtering direction. */
+public class DirectionPolicyRule extends AbstractPolicyRule {
+
+ /** Direction to match for a positive evaluation. */
+ @NonnullAfterInit private Direction matchDirection;
+
+ /**
+ * Gets the {@link Direction} to match for a positive evaluation.
+ *
+ * @return direction to match
+ */
+ @NonnullAfterInit public Direction getMatchDirection() {
+ return matchDirection;
+ }
+
+ /**
+ * Sets the {@link Direction} to match for a positive evaluation.
+ *
+ * @param match match for a positive evaluation
+ */
+ public void setMatchDirection(@Nonnull final Direction match) {
+ matchDirection = Constraint.isNotNull(match, "Direction cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doInitialize() throws ComponentInitializationException {
+ super.doInitialize();
+
+ if (matchDirection == null) {
+ throw new ComponentInitializationException("Direction cannot be null");
+ }
+ }
+
+ /** {@inheritDoc} */
+ public Tristate matches(@Nonnull final AttributeFilterContext filterContext) {
+ return matchDirection.equals(filterContext.getDirection()) ? Tristate.TRUE : Tristate.FALSE;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
index f9d052a..5de75cf 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
@@ -34,7 +34,9 @@ import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.AttributeIssue
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.AttributeIssuerRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.AttributeRequesterRegexRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.AttributeRequesterRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.InboundRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.NumOfAttributeValuesRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.OutboundRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.PredicateRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.PrincipalNameRegexRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.PrincipalNameRuleParser;
@@ -83,6 +85,9 @@ public class AttributeFilterNamespaceHandler extends BaseSpringNamespaceHandler
registerBeanDefinitionParser(NotMatcherParser.SCHEMA_TYPE, new NotMatcherParser());
+ registerBeanDefinitionParser(InboundRuleParser.SCHEMA_TYPE, new InboundRuleParser());
+ registerBeanDefinitionParser(OutboundRuleParser.SCHEMA_TYPE, new OutboundRuleParser());
+
// Attribute/Matcher
registerBeanDefinitionParser(AttributeValueStringMatcherParser.SCHEMA_TYPE,
new AttributeValueStringMatcherParser());
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/InboundRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/InboundRuleParser.java
new file mode 100644
index 0000000..0c4d0d0
--- /dev/null
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/InboundRuleParser.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.spring.policyrule.impl;
+
+import javax.annotation.Nonnull;
+import javax.xml.namespace.QName;
+
+import org.springframework.beans.factory.support.BeanDefinitionBuilder;
+import org.springframework.beans.factory.xml.ParserContext;
+import org.w3c.dom.Element;
+
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext.Direction;
+import net.shibboleth.idp.attribute.filter.policyrule.impl.DirectionPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
+import net.shibboleth.idp.attribute.filter.spring.policyrule.BasePolicyRuleParser;
+
+/**
+ * Bean definition parser for {@link DirectionPolicyRule} using {@link Direction.INBOUND}.
+ */
+public class InboundRuleParser extends BasePolicyRuleParser {
+
+ /** Schema type. */
+ public static final QName SCHEMA_TYPE = new QName(BaseFilterParser.NAMESPACE, "Inbound");
+
+ /** {@inheritDoc} */
+ @Override @Nonnull protected Class<DirectionPolicyRule> getNativeBeanClass() {
+ return DirectionPolicyRule.class;
+ }
+
+ /** {@inheritDoc} */
+ @Override protected void doNativeParse(@Nonnull final Element config, @Nonnull final ParserContext parserContext,
+ @Nonnull final BeanDefinitionBuilder builder) {
+ super.doParse(config, builder);
+
+ builder.addPropertyValue("matchDirection", Direction.INBOUND);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/OutboundRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/OutboundRuleParser.java
new file mode 100644
index 0000000..3c884ff
--- /dev/null
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/OutboundRuleParser.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.spring.policyrule.impl;
+
+import javax.annotation.Nonnull;
+import javax.xml.namespace.QName;
+
+import org.springframework.beans.factory.support.BeanDefinitionBuilder;
+import org.springframework.beans.factory.xml.ParserContext;
+import org.w3c.dom.Element;
+
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext.Direction;
+import net.shibboleth.idp.attribute.filter.policyrule.impl.DirectionPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
+import net.shibboleth.idp.attribute.filter.spring.policyrule.BasePolicyRuleParser;
+
+/**
+ * Bean definition parser for {@link DirectionPolicyRule} using {@link Direction.OUTBOUND}.
+ */
+public class OutboundRuleParser extends BasePolicyRuleParser {
+
+ /** Schema type. */
+ public static final QName SCHEMA_TYPE = new QName(BaseFilterParser.NAMESPACE, "Outbound");
+
+ /** {@inheritDoc} */
+ @Override @Nonnull protected Class<DirectionPolicyRule> getNativeBeanClass() {
+ return DirectionPolicyRule.class;
+ }
+
+ /** {@inheritDoc} */
+ @Override protected void doNativeParse(@Nonnull final Element config, @Nonnull final ParserContext parserContext,
+ @Nonnull final BeanDefinitionBuilder builder) {
+ super.doParse(config, builder);
+
+ builder.addPropertyValue("matchDirection", Direction.OUTBOUND);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/InboundRuleTest.java b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/InboundRuleTest.java
new file mode 100644
index 0000000..76af812
--- /dev/null
+++ b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/InboundRuleTest.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.spring.policy;
+
+import static org.testng.Assert.assertEquals;
+
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.attribute.filter.PolicyRequirementRule;
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext.Direction;
+import net.shibboleth.idp.attribute.filter.policyrule.impl.DirectionPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseAttributeFilterParserTest;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+
+/**
+ * Test for Inbound policy Rule.
+ */
+public class InboundRuleTest extends BaseAttributeFilterParserTest {
+
+ @Test public void testPolicy() throws ComponentInitializationException {
+ PolicyRequirementRule policy = getPolicyRule("inbound.xml");
+ assertEquals(DirectionPolicyRule.class, policy.getClass());
+ assertEquals(((DirectionPolicyRule) policy).getMatchDirection(), Direction.INBOUND);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/OutboundRuleTest.java b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/OutboundRuleTest.java
new file mode 100644
index 0000000..fcd4d3b
--- /dev/null
+++ b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/OutboundRuleTest.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.spring.policy;
+
+import static org.testng.Assert.assertEquals;
+
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.attribute.filter.PolicyRequirementRule;
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext.Direction;
+import net.shibboleth.idp.attribute.filter.policyrule.impl.DirectionPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseAttributeFilterParserTest;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+
+/**
+ * Test for Outbound policy Rule.
+ */
+public class OutboundRuleTest extends BaseAttributeFilterParserTest {
+
+ @Test public void testPolicy() throws ComponentInitializationException {
+ PolicyRequirementRule policy = getPolicyRule("outbound.xml");
+ assertEquals(DirectionPolicyRule.class, policy.getClass());
+ assertEquals(((DirectionPolicyRule) policy).getMatchDirection(), Direction.OUTBOUND);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/inbound.xml b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/inbound.xml
new file mode 100644
index 0000000..53aa6f3
--- /dev/null
+++ b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/inbound.xml
@@ -0,0 +1,4 @@
+<AttributeFilterPolicy id="MostBasicExample" xmlns="urn:mace:shibboleth:2.0:afp" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
+ <PolicyRequirementRule xsi:type="Inbound" />
+</AttributeFilterPolicy>
diff --git a/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/outbound.xml b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/outbound.xml
new file mode 100644
index 0000000..05ea8f0
--- /dev/null
+++ b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/outbound.xml
@@ -0,0 +1,4 @@
+<AttributeFilterPolicy id="MostBasicExample" xmlns="urn:mace:shibboleth:2.0:afp" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
+ <PolicyRequirementRule xsi:type="Outbound" />
+</AttributeFilterPolicy>
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java
index 8573bab..eed3367 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java
@@ -31,6 +31,7 @@ import net.shibboleth.idp.attribute.context.AttributeContext;
import net.shibboleth.idp.attribute.filter.AttributeFilter;
import net.shibboleth.idp.attribute.filter.AttributeFilterException;
import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext.Direction;
import net.shibboleth.idp.authn.AbstractValidationAction;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
@@ -340,7 +341,8 @@ public class ValidateExternalAuthentication extends AbstractValidationAction {
*/
private void populateFilterContext(@Nonnull final AttributeFilterContext filterContext) {
- filterContext.setPrefilteredIdPAttributes(attributeContext.getIdPAttributes().values())
+ filterContext.setDirection(Direction.INBOUND)
+ .setPrefilteredIdPAttributes(attributeContext.getIdPAttributes().values())
.setMetadataResolver(metadataResolver)
.setRequesterMetadataContextLookupStrategy(null)
.setProxiedRequesterContextLookupStrategy(null);
diff --git a/idp-conf/src/main/resources/conf/authn/external-authn-config.xml b/idp-conf/src/main/resources/conf/authn/external-authn-config.xml
index 8b3a159..9d6652a 100644
--- a/idp-conf/src/main/resources/conf/authn/external-authn-config.xml
+++ b/idp-conf/src/main/resources/conf/authn/external-authn-config.xml
@@ -14,7 +14,7 @@
<!-- Servlet context-relative path to wherever your implementation lives. -->
<bean id="shibboleth.authn.External.externalAuthnPath" class="java.lang.String"
- c:_0="contextRelative:Authn/External" />
+ c:_0="contextRelative:external.jsp" />
<!--
Default is to always use the path in the bean above. If you want to determine it
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java
index 4c240f4..8c7172a 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/FilterAttributes.java
@@ -38,6 +38,7 @@ import net.shibboleth.idp.attribute.context.AttributeContext;
import net.shibboleth.idp.attribute.filter.AttributeFilter;
import net.shibboleth.idp.attribute.filter.AttributeFilterException;
import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext.Direction;
import net.shibboleth.idp.authn.context.SubjectContext;
import net.shibboleth.idp.authn.context.navigate.SubjectContextPrincipalLookupFunction;
import net.shibboleth.idp.profile.AbstractProfileAction;
@@ -402,7 +403,8 @@ public class FilterAttributes extends AbstractProfileAction {
private void populateFilterContext(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AttributeFilterContext filterContext) {
- filterContext.setMetadataResolver(metadataResolver)
+ filterContext.setDirection(Direction.OUTBOUND)
+ .setMetadataResolver(metadataResolver)
.setPrincipal(principalNameLookupStrategy.apply(profileRequestContext))
.setAttributeRecipientID(
recipientLookupStrategy != null ? recipientLookupStrategy.apply(profileRequestContext) : null)
diff --git a/idp-schema/src/main/resources/schema/shibboleth-afp.xsd b/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
index 49ea555..cbe858f 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
@@ -189,12 +189,6 @@
</attribute>
</complexType>
- <!--
-
- The old 'Basic' Schema
-
- -->
-
<!-- Blanket Match Function -->
<complexType name="ANY">
<annotation>
@@ -205,6 +199,25 @@
</complexContent>
</complexType>
+ <!-- Directional Match Functions -->
+ <complexType name="Inbound">
+ <annotation>
+ <documentation>A match function that evaluates to true.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:MatchFunctorType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="Outbound">
+ <annotation>
+ <documentation>A match function that evaluates to true.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:MatchFunctorType"/>
+ </complexContent>
+ </complexType>
+
<!-- Boolean Match Functions -->
<complexType name="AND">
<annotation>
@@ -579,7 +592,7 @@
</complexContent>
</complexType>
- <!-- The old 'SAML' schema -->
+ <!-- SAML-specific. -->
<complexType name="EntityAttributeExactMatch">
<annotation>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list