[java-identity-provider] branch master updated: Fix handling of new boolean property so property expressions work.
Scott Cantor
cantor.2 at osu.edu
Fri Nov 1 16:48:28 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=43853d22a4559afc59ec339d62e4223743d07de1
The following commit(s) were added to refs/heads/master by this push:
new 43853d2 Fix handling of new boolean property so property expressions work.
43853d2 is described below
commit 43853d22a4559afc59ec339d62e4223743d07de1
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Nov 1 16:48:25 2019 -0400
Fix handling of new boolean property so property expressions work.
---
.../SubjectDerivedAttributeValuesFunction.java | 24 ++++++++++++
.../ContextDerivedAttributeDefinitionTest.java | 44 +++++++++++++++++++++-
.../SubjectDerivedAttributeDefinitionParser.java | 14 ++-----
.../schema/shibboleth-attribute-resolver.xsd | 5 +--
4 files changed, 71 insertions(+), 16 deletions(-)
diff --git a/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/ad/impl/SubjectDerivedAttributeValuesFunction.java b/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/ad/impl/SubjectDerivedAttributeValuesFunction.java
index 891ceb6..3a768e5 100644
--- a/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/ad/impl/SubjectDerivedAttributeValuesFunction.java
+++ b/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/ad/impl/SubjectDerivedAttributeValuesFunction.java
@@ -29,7 +29,9 @@ import javax.annotation.Nullable;
import javax.security.auth.Subject;
import net.shibboleth.idp.attribute.IdPAttributeValue;
+import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
import net.shibboleth.idp.authn.context.SubjectContext;
+import net.shibboleth.idp.authn.context.navigate.SubjectCanonicalizationContextSubjectLookupFunction;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -51,6 +53,9 @@ public class SubjectDerivedAttributeValuesFunction extends AbstractIdentifiableI
/** Logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(ContextDerivedAttributeDefinition.class);
+ /** Flag denoting whether plugin is being used for subject c14n or standard usage. */
+ private boolean forCanonicalization;
+
/** Strategy used to locate the {@link SubjectContext} to use. */
@Nonnull private Function<ProfileRequestContext,SubjectContext> scLookupStrategy;
@@ -68,6 +73,18 @@ public class SubjectDerivedAttributeValuesFunction extends AbstractIdentifiableI
public SubjectDerivedAttributeValuesFunction() {
scLookupStrategy = new ChildContextLookup<>(SubjectContext.class);
}
+
+ /**
+ * Sets whether the definition is being used during Subject Canonicalization, causing
+ * auto-installation of an alternate Subject lookup strategy.
+ *
+ * @param flag flag to set
+ */
+ public void setForCanonicalization(final boolean flag) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ forCanonicalization = flag;
+ }
/**
* Sets the strategy used to locate the {@link SubjectContext} associated with a given
@@ -115,6 +132,13 @@ public class SubjectDerivedAttributeValuesFunction extends AbstractIdentifiableI
if (attributeValuesFunction == null) {
throw new ComponentInitializationException("Attribute value lookup strategy cannot be null");
}
+
+ if (forCanonicalization && subjectLookupStrategy == null) {
+ log.debug("{} Marked for use during canonicalication, auto-installing Subject lookup strategy",
+ getLogPrefix());
+ subjectLookupStrategy = new SubjectCanonicalizationContextSubjectLookupFunction().compose(
+ new ChildContextLookup<>(SubjectCanonicalizationContext.class));
+ }
}
/** {@inheritDoc} */
diff --git a/idp-attribute-resolver-impl/src/test/java/net/shibboleth/idp/attribute/resolver/ad/impl/ContextDerivedAttributeDefinitionTest.java b/idp-attribute-resolver-impl/src/test/java/net/shibboleth/idp/attribute/resolver/ad/impl/ContextDerivedAttributeDefinitionTest.java
index 7279761..c2a0c00 100644
--- a/idp-attribute-resolver-impl/src/test/java/net/shibboleth/idp/attribute/resolver/ad/impl/ContextDerivedAttributeDefinitionTest.java
+++ b/idp-attribute-resolver-impl/src/test/java/net/shibboleth/idp/attribute/resolver/ad/impl/ContextDerivedAttributeDefinitionTest.java
@@ -36,6 +36,7 @@ import net.shibboleth.idp.attribute.StringAttributeValue;
import net.shibboleth.idp.attribute.resolver.ResolutionException;
import net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext;
import net.shibboleth.idp.authn.AuthenticationResult;
+import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
import net.shibboleth.idp.authn.context.SubjectContext;
import net.shibboleth.idp.authn.principal.IdPAttributePrincipal;
import net.shibboleth.idp.saml.authn.principal.AuthenticationMethodPrincipal;
@@ -58,6 +59,7 @@ public class ContextDerivedAttributeDefinitionTest {
fn.setAttributeName("wibble");
fn.doInitialize();
ctxValueFunction.setAttributeValuesFunction(fn);
+ ctxValueFunction.initialize();
final ContextDerivedAttributeDefinition defn = new ContextDerivedAttributeDefinition();
defn.setAttributeValuesFunction(ctxValueFunction);
@@ -86,6 +88,7 @@ public class ContextDerivedAttributeDefinitionTest {
fn.setAttributeName("wibble");
fn.doInitialize();
ctxValueFunction.setAttributeValuesFunction(fn);
+ ctxValueFunction.initialize();
final ContextDerivedAttributeDefinition defn = new ContextDerivedAttributeDefinition();
defn.setAttributeValuesFunction(ctxValueFunction);
@@ -129,6 +132,7 @@ public class ContextDerivedAttributeDefinitionTest {
fn.setAttributeName("wibble");
fn.doInitialize();
ctxValueFunction.setAttributeValuesFunction(fn);
+ ctxValueFunction.initialize();
final ContextDerivedAttributeDefinition defn = new ContextDerivedAttributeDefinition();
defn.setAttributeValuesFunction(ctxValueFunction);
@@ -146,7 +150,44 @@ public class ContextDerivedAttributeDefinitionTest {
assertTrue(foo.contains(new StringAttributeValue(SIMPLE_VALUE + "2")));
}
-
+ @Test public void simpleValueViaSubjectC14N() throws ComponentInitializationException, ResolutionException {
+ final List<IdPAttributeValue> list = new ArrayList<>(2);
+ list.add(new StringAttributeValue(SIMPLE_VALUE));
+ list.add(new StringAttributeValue(SIMPLE_VALUE + "2"));
+
+ final IdPAttribute attr = new IdPAttribute("wibble");
+ attr.setValues(list);
+
+ final Subject subject = new Subject();
+ subject.getPrincipals().add(new IdPAttributePrincipal(attr));
+ subject.getPrincipals().add(new AuthenticationMethodPrincipal(SIMPLE_VALUE + "2"));
+
+ final SubjectDerivedAttributeValuesFunction ctxValueFunction = new SubjectDerivedAttributeValuesFunction();
+ ctxValueFunction.setId("pDaD");
+ ctxValueFunction.setForCanonicalization(true);
+ final IdPAttributePrincipalValuesFunction fn = new IdPAttributePrincipalValuesFunction();
+ fn.setAttributeName("wibble");
+ fn.doInitialize();
+ ctxValueFunction.setAttributeValuesFunction(fn);
+ ctxValueFunction.initialize();
+
+ final ContextDerivedAttributeDefinition defn = new ContextDerivedAttributeDefinition();
+ defn.setAttributeValuesFunction(ctxValueFunction);
+ defn.setId("pDAD");
+ defn.initialize();
+
+ final AttributeResolutionContext ctx =
+ TestSources.createResolutionContext(TestSources.PRINCIPAL_ID, TestSources.IDP_ENTITY_ID,
+ TestSources.SP_ENTITY_ID);
+ ctx.getParent().getSubcontext(SubjectCanonicalizationContext.class, true).setSubject(subject);
+
+ final List<IdPAttributeValue> foo = defn.resolve(ctx).getValues();
+
+ assertEquals(2, foo.size());
+ assertTrue(foo.contains(new StringAttributeValue(SIMPLE_VALUE)));
+ assertTrue(foo.contains(new StringAttributeValue(SIMPLE_VALUE + "2")));
+ }
+
@Test public void empty() throws ComponentInitializationException, ResolutionException {
final List<IdPAttributeValue> list = Collections.emptyList();
@@ -159,6 +200,7 @@ public class ContextDerivedAttributeDefinitionTest {
fn.setAttributeName("wibble");
fn.doInitialize();
ctxValueFunction.setAttributeValuesFunction(fn);
+ ctxValueFunction.initialize();
final ContextDerivedAttributeDefinition defn = new ContextDerivedAttributeDefinition();
defn.setAttributeValuesFunction(ctxValueFunction);
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/ad/impl/SubjectDerivedAttributeDefinitionParser.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/ad/impl/SubjectDerivedAttributeDefinitionParser.java
index 83c7972..033908b 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/ad/impl/SubjectDerivedAttributeDefinitionParser.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/ad/impl/SubjectDerivedAttributeDefinitionParser.java
@@ -20,7 +20,6 @@ package net.shibboleth.idp.attribute.resolver.spring.ad.impl;
import javax.annotation.Nonnull;
import javax.xml.namespace.QName;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.BeanCreationException;
@@ -33,10 +32,7 @@ import net.shibboleth.idp.attribute.resolver.ad.impl.IdPAttributePrincipalValues
import net.shibboleth.idp.attribute.resolver.ad.impl.SubjectDerivedAttributeValuesFunction;
import net.shibboleth.idp.attribute.resolver.spring.ad.BaseAttributeDefinitionParser;
import net.shibboleth.idp.attribute.resolver.spring.impl.AttributeResolverNamespaceHandler;
-import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
-import net.shibboleth.idp.authn.context.navigate.SubjectCanonicalizationContextSubjectLookupFunction;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import net.shibboleth.utilities.java.support.xml.AttributeSupport;
/** Spring Bean Definition Parser for attribute definitions derived from the Principal. */
public class SubjectDerivedAttributeDefinitionParser extends BaseAttributeDefinitionParser {
@@ -66,18 +62,14 @@ public class SubjectDerivedAttributeDefinitionParser extends BaseAttributeDefini
super.doParse(config, parserContext, builder);
final String attributeName = StringSupport.trimOrNull(config.getAttributeNS(null, "principalAttributeName"));
final String functionRef = StringSupport.trimOrNull(config.getAttributeNS(null, "attributeValuesFunctionRef"));
-
- final Boolean c14n = AttributeSupport.getAttributeValueAsBoolean(
- config.getAttributeNodeNS(null, "forCanonicalization"));
+ final String c14n = StringSupport.trimOrNull(config.getAttributeNS(null, "forCanonicalization"));
final BeanDefinitionBuilder contextFunctionBuilder =
BeanDefinitionBuilder.genericBeanDefinition(SubjectDerivedAttributeValuesFunction.class);
contextFunctionBuilder.addPropertyValue("id", getDefinitionId());
- if (c14n != null && c14n.booleanValue()) {
- contextFunctionBuilder.addPropertyValue("subjectLookupStrategy",
- new SubjectCanonicalizationContextSubjectLookupFunction().compose(
- new ChildContextLookup<>(SubjectCanonicalizationContext.class)));
+ if (c14n != null) {
+ contextFunctionBuilder.addPropertyValue("forCanonicalization", c14n);
}
if (null != attributeName) {
diff --git a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
index d15ac49..33c79a8 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
@@ -642,14 +642,11 @@
</documentation>
</annotation>
</attribute>
- <attribute name="forCanonicalization" type="boolean">
+ <attribute name="forCanonicalization" type="resolver:string">
<annotation>
<documentation>
If true, the source Subject is assumed to be undergoing C14N rather than the
usual post-authentication source. Defaults to false.
-
- This attribute is evaluated during parsing, so cannot be a property expression,
- only a literal boolean value.
</documentation>
</annotation>
</attribute>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list