[java-identity-provider] branch master updated: Add support for serializing NameID principals.
Scott Cantor
cantor.2 at osu.edu
Tue Nov 5 12:22:50 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=79dbc2e942c31c6b60fb3d13a2583a0c01b92527
The following commit(s) were added to refs/heads/master by this push:
new 79dbc2e Add support for serializing NameID principals.
79dbc2e is described below
commit 79dbc2e942c31c6b60fb3d13a2583a0c01b92527
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Nov 5 12:22:45 2019 -0500
Add support for serializing NameID principals.
---
.../resources/system/conf/general-authn-system.xml | 11 ++
.../principal/impl/NameIDPrincipalSerializer.java | 182 +++++++++++++++++++++
.../saml/authn/principal/impl/package-info.java | 22 +++
3 files changed, 215 insertions(+)
diff --git a/idp-conf/src/main/resources/system/conf/general-authn-system.xml b/idp-conf/src/main/resources/system/conf/general-authn-system.xml
index 9de5dae..f242de7 100644
--- a/idp-conf/src/main/resources/system/conf/general-authn-system.xml
+++ b/idp-conf/src/main/resources/system/conf/general-authn-system.xml
@@ -50,6 +50,7 @@
<bean class="net.shibboleth.idp.authn.principal.impl.PasswordPrincipalSerializer"
p:dataSealer="#{(systemProperties.contains('idp.sealer.storeResource') or systemProperties.contains('idp.sealer.keyStrategy')) ? getObject('shibboleth.DataSealer') : null}" />
<bean class="net.shibboleth.idp.authn.principal.impl.ProxyAuthenticationPrincipalSerializer" />
+ <bean class="net.shibboleth.idp.saml.authn.principal.impl.NameIDPrincipalSerializer" />
</list>
</property>
</bean>
@@ -111,6 +112,16 @@
<!-- Community-defined assurance profiles. -->
<entry key="http://id.incommon.org/assurance/silver" value="300" />
<entry key="http://id.incommon.org/assurance/bronze" value="301" />
+
+ <!-- NameID Formats. -->
+ <entry key="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" value="400" />
+ <entry key="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" value="401" />
+ <entry key="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName" value="402" />
+ <entry key="urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName" value="403" />
+ <entry key="urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos" value="404" />
+ <entry key="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" value="405" />
+ <entry key="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" value="406" />
+ <entry key="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" value="407" />
</map>
</property>
</bean>
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/NameIDPrincipalSerializer.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/NameIDPrincipalSerializer.java
new file mode 100644
index 0000000..65ac498
--- /dev/null
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/NameIDPrincipalSerializer.java
@@ -0,0 +1,182 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.authn.principal.impl;
+
+import java.io.IOException;
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.security.Principal;
+import java.util.regex.Pattern;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import javax.annotation.concurrent.ThreadSafe;
+import javax.json.Json;
+import javax.json.JsonBuilderFactory;
+import javax.json.JsonException;
+import javax.json.JsonObject;
+import javax.json.JsonReader;
+import javax.json.JsonString;
+import javax.json.JsonStructure;
+import javax.json.stream.JsonGenerator;
+
+import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
+import org.opensaml.saml.common.SAMLObjectBuilder;
+import org.opensaml.saml.saml2.core.NameID;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.google.common.base.Strings;
+
+import net.shibboleth.idp.authn.principal.AbstractPrincipalSerializer;
+import net.shibboleth.idp.saml.authn.principal.NameIDPrincipal;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Principal serializer for {@link NameIDPrincipal}.
+ */
+ at ThreadSafe
+public class NameIDPrincipalSerializer extends AbstractPrincipalSerializer<String> {
+
+ /** Field name of principal name. */
+ @Nonnull @NotEmpty private static final String PRINCIPAL_NAME_FIELD = "NID";
+
+ /** Field name of Format attribute. */
+ @Nonnull @NotEmpty private static final String FORMAT_FIELD = "F";
+
+ /** Field name of NameQualifier attribute. */
+ @Nonnull @NotEmpty private static final String NAME_QUALIFIER_FIELD = "NQ";
+
+ /** Field name of SPNameQualifier attribute. */
+ @Nonnull @NotEmpty private static final String SP_NAME_QUALIFIER_FIELD = "SPNQ";
+
+ /** Field name of SPProvidedID attribute. */
+ @Nonnull @NotEmpty private static final String SP_PROVIDED_ID_FIELD = "SPID";
+
+ /** Pattern used to determine if input is supported. */
+ private static final Pattern JSON_PATTERN = Pattern.compile("^\\{\"NID\":.*}$");
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(NameIDPrincipalSerializer.class);
+
+ /** JSON object bulder factory. */
+ @Nonnull private final JsonBuilderFactory objectBuilderFactory;
+
+ /** NameID builder. */
+ @Nonnull private final SAMLObjectBuilder<NameID> nameIDBuilder;
+
+ /** Constructor. */
+ public NameIDPrincipalSerializer() {
+ objectBuilderFactory = Json.createBuilderFactory(null);
+ nameIDBuilder = (SAMLObjectBuilder<NameID>)
+ XMLObjectProviderRegistrySupport.getBuilderFactory().<NameID>getBuilderOrThrow(
+ NameID.DEFAULT_ELEMENT_NAME);
+ }
+
+ /** {@inheritDoc} */
+ public boolean supports(@Nonnull final Principal principal) {
+ return principal instanceof NameIDPrincipal;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull @NotEmpty public String serialize(@Nonnull final Principal principal) throws IOException {
+
+ final NameID nameID = ((NameIDPrincipal) principal).getNameID();
+
+ final StringWriter sink = new StringWriter(128);
+ try (final JsonGenerator gen = getJsonGenerator(sink)) {
+ gen.writeStartObject()
+ .write(PRINCIPAL_NAME_FIELD, nameID.getValue());
+
+ if (nameID.getFormat() != null) {
+ gen.write(FORMAT_FIELD, nameID.getFormat());
+ }
+
+ if (nameID.getNameQualifier() != null) {
+ gen.write(NAME_QUALIFIER_FIELD, nameID.getNameQualifier());
+ }
+
+ if (nameID.getSPNameQualifier() != null) {
+ gen.write(SP_NAME_QUALIFIER_FIELD, nameID.getSPNameQualifier());
+ }
+
+ if (nameID.getSPProvidedID() != null) {
+ gen.write(SP_PROVIDED_ID_FIELD, nameID.getSPProvidedID());
+ }
+
+ gen.writeEnd();
+ }
+ return sink.toString();
+ }
+
+ /** {@inheritDoc} */
+ public boolean supports(@Nonnull @NotEmpty final String value) {
+ return JSON_PATTERN.matcher(value).matches();
+ }
+
+ /** {@inheritDoc} */
+// Checkstyle: CyclomaticComplexity OFF
+ @Nullable public NameIDPrincipal deserialize(@Nonnull @NotEmpty final String value) throws IOException {
+
+ try (final JsonReader reader = getJsonReader(new StringReader(value))) {
+
+ final JsonStructure st = reader.read();
+ if (!(st instanceof JsonObject)) {
+ throw new IOException("Found invalid data structure while parsing NameIDPrincipal");
+ }
+
+ final JsonObject obj = (JsonObject) st;
+ JsonString str = obj.getJsonString(PRINCIPAL_NAME_FIELD);
+
+ if (str != null && !Strings.isNullOrEmpty(str.getString())) {
+ final NameID nameID = nameIDBuilder.buildObject();
+ nameID.setValue(str.getString());
+
+ str = obj.getJsonString(FORMAT_FIELD);
+ if (str != null && !Strings.isNullOrEmpty(str.getString())) {
+ nameID.setFormat(str.getString());
+ }
+
+ str = obj.getJsonString(NAME_QUALIFIER_FIELD);
+ if (str != null && !Strings.isNullOrEmpty(str.getString())) {
+ nameID.setNameQualifier(str.getString());
+ }
+
+ str = obj.getJsonString(SP_NAME_QUALIFIER_FIELD);
+ if (str != null && !Strings.isNullOrEmpty(str.getString())) {
+ nameID.setSPNameQualifier(str.getString());
+ }
+
+ str = obj.getJsonString(SP_PROVIDED_ID_FIELD);
+ if (str != null && !Strings.isNullOrEmpty(str.getString())) {
+ nameID.setSPProvidedID(str.getString());
+ }
+
+ return new NameIDPrincipal(nameID);
+ }
+ log.warn("Skipping NameIDPrincipal missing identifier value");
+
+ return null;
+ } catch (final JsonException e) {
+ throw new IOException("Found invalid data structure while parsing NameIDPrincipal", e);
+ }
+ }
+// Checkstyle: CyclomaticComplexity ON
+
+
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/package-info.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/package-info.java
new file mode 100644
index 0000000..d40a8e6
--- /dev/null
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/package-info.java
@@ -0,0 +1,22 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Implementation classes supporting SAML-related Principal objects.
+ */
+
+package net.shibboleth.idp.saml.authn.principal.impl;
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list