[java-identity-provider] branch master updated: IDP-1494 - Login flow for proxied authentication

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=3ff74f5a75beadc815a77ea7406813716f1854fd

The following commit(s) were added to refs/heads/master by this push:
       new  3ff74f5   IDP-1494 - Login flow for proxied authentication
3ff74f5 is described below

commit 3ff74f5a75beadc815a77ea7406813716f1854fd
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Nov 5 19:13:19 2019 -0500

    IDP-1494 - Login flow for proxied authentication
    
    https://issues.shibboleth.net/jira/browse/IDP-1494
    
    Add a custom attribute extraction hook.
---
 .../system/flows/authn/proxy/saml-proxy-beans.xml  |  3 +-
 .../profile/impl/ValidateSAMLAuthentication.java   | 38 +++++++++++++++++++++-
 2 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
index ea3db5b..5a8c1d3 100644
--- a/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/proxy/saml-proxy-beans.xml
@@ -276,6 +276,7 @@
         p:requesterLookupStrategy-ref="shibboleth.ResponderIdLookup.Simple"
         p:transcoderRegistry-ref="shibboleth.AttributeRegistryService"
         p:attributeFilter-ref="shibboleth.AttributeFilterService"
-        p:metadataResolver-ref="shibboleth.MetadataResolver" />
+        p:metadataResolver-ref="shibboleth.MetadataResolver"
+        p:attributeExtractionStrategy="#{getObject('shibboleth.authn.SAML.attributeExtractionStrategy')}" />
 
 </beans>
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
index dfa30c5..4cb2938 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
@@ -17,7 +17,9 @@
 
 package net.shibboleth.idp.saml.saml2.profile.impl;
 
+import java.util.ArrayList;
 import java.util.Collection;
+import java.util.function.Function;
 import java.util.stream.Collectors;
 
 import javax.annotation.Nonnull;
@@ -99,6 +101,9 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
     /** Optional supplemental metadata source for filtering. */
     @Nullable private MetadataResolver metadataResolver;
     
+    /** Pluggable strategy function for generalized extraction of data. */
+    @Nullable private Function<ProfileRequestContext,Collection<IdPAttribute>> attributeExtractionStrategy;
+    
     /** Context containing the result to validate. */
     @Nullable private SAMLAuthnContext samlAuthnContext;
     
@@ -121,7 +126,6 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
         transcoderRegistry = registry;
     }
     
-
     /**
      * Sets the filter service to use for inbound attributes.
      *
@@ -143,6 +147,19 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
         
         metadataResolver = resolver;
     }
+    
+    /**
+     * Sets the strategy function to invoke for generalized extraction of data into
+     * {@link IdPAttribute} objects for inclusion in the {@link AuthenticationResult}.
+     * 
+     * @param strategy extraction strategy
+     */
+    public void setAttributeExtractionStrategy(
+            @Nullable final Function<ProfileRequestContext,Collection<IdPAttribute>> strategy) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        attributeExtractionStrategy = strategy;
+    }
 
     /** {@inheritDoc} */
     @Override
@@ -189,6 +206,25 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
             processAttributes(profileRequestContext);
         }
         
+        if (attributeExtractionStrategy != null) {
+            log.debug("{} Applying custom extraction strategy function", getLogPrefix());
+            if (attributeContext == null) {
+                attributeContext = profileRequestContext
+                        .getSubcontext(RelyingPartyContext.class)
+                        .getSubcontext(AttributeContext.class, true);
+            }
+            final Collection<IdPAttribute> attributes = new ArrayList<>(attributeContext.getIdPAttributes().values());
+            final Collection<IdPAttribute> newAttributes = attributeExtractionStrategy.apply(profileRequestContext);
+            if (newAttributes != null) {
+                if (log.isDebugEnabled()) {
+                    log.debug("{} Extracted attributes with custom strategy: {}", getLogPrefix(),
+                            newAttributes.stream().map(IdPAttribute::getId).collect(Collectors.toUnmodifiableList()));
+                }
+                attributes.addAll(newAttributes);
+                attributeContext.setIdPAttributes(attributes);
+            }
+        }
+        
         buildAuthenticationResult(profileRequestContext, authenticationContext);
         
         if (authenticationContext.getAuthenticationResult() != null) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.