[java-opensaml] branch master updated: Adjust proxy restriction lookup to allow for necessary IdP changes.
Scott Cantor
cantor.2 at osu.edu
Fri Nov 22 09:57:03 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=564e9b2a4a3c2817680ff8ae01f875ac5c434627
The following commit(s) were added to refs/heads/master by this push:
new 564e9b2 Adjust proxy restriction lookup to allow for necessary IdP changes.
564e9b2 is described below
commit 564e9b2a4a3c2817680ff8ae01f875ac5c434627
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Nov 22 09:56:59 2019 -0500
Adjust proxy restriction lookup to allow for necessary IdP changes.
---
.../impl/AddProxyRestrictionToAssertions.java | 52 ++++++++----------
.../impl/AddProxyRestrictionToAssertionsTest.java | 61 ++++++++++++++++------
2 files changed, 66 insertions(+), 47 deletions(-)
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddProxyRestrictionToAssertions.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddProxyRestrictionToAssertions.java
index 16762ac..1889f2d 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddProxyRestrictionToAssertions.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddProxyRestrictionToAssertions.java
@@ -17,7 +17,7 @@
package org.opensaml.saml.saml2.profile.impl;
-import java.util.Collection;
+import java.util.Set;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -29,6 +29,7 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
+import net.shibboleth.utilities.java.support.collection.Pair;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -61,11 +62,8 @@ public class AddProxyRestrictionToAssertions extends AbstractConditionalProfileA
/** Strategy used to locate the Response to operate on. */
@Nonnull private Function<ProfileRequestContext,Response> responseLookupStrategy;
- /** Strategy used to obtain the audiences to add. */
- @Nullable private Function<ProfileRequestContext,Collection<String>> proxyAudiencesLookupStrategy;
-
- /** Strategy used to obtain the proxy count to add. */
- @Nullable private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy;
+ /** Strategy used to obtain the material to add. */
+ @Nullable private Function<ProfileRequestContext,Pair<Integer,Set<String>>> proxyRestrictionLookupStrategy;
/** Response to modify. */
@Nullable private Response response;
@@ -74,7 +72,7 @@ public class AddProxyRestrictionToAssertions extends AbstractConditionalProfileA
@Nullable private Integer proxyCount;
/** Audiences to add. */
- @Nullable private Collection<String> audiences;
+ @Nullable private Set<String> audiences;
/** Constructor. */
public AddProxyRestrictionToAssertions() {
@@ -97,23 +95,12 @@ public class AddProxyRestrictionToAssertions extends AbstractConditionalProfileA
*
* @param strategy lookup strategy
*/
- public void setProxyAudiencesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- proxyAudiencesLookupStrategy =
- Constraint.isNotNull(strategy, "Proxy restriction audiences lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to obtain the proxy count to apply.
- *
- * @param strategy lookup strategy
- */
- public void setProxyCountLookupStrategy(@Nonnull final Function<ProfileRequestContext,Integer> strategy) {
+ public void setProxyRestrictionLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Pair<Integer,Set<String>>> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- proxyCountLookupStrategy = Constraint.isNotNull(strategy, "Proxy count lookup strategy cannot be null");
+ proxyRestrictionLookupStrategy =
+ Constraint.isNotNull(strategy, "Proxy restriction lookup strategy cannot be null");
}
/** {@inheritDoc} */
@@ -121,10 +108,8 @@ public class AddProxyRestrictionToAssertions extends AbstractConditionalProfileA
protected void doInitialize() throws ComponentInitializationException {
super.doInitialize();
- if (proxyAudiencesLookupStrategy == null) {
- throw new ComponentInitializationException("Proxy restriction audience lookup strategy cannot be null");
- } else if (proxyCountLookupStrategy == null) {
- throw new ComponentInitializationException("Proxy count lookup strategy cannot be null");
+ if (proxyRestrictionLookupStrategy == null) {
+ throw new ComponentInitializationException("Proxy restriction lookup strategy cannot be null");
}
}
@@ -136,16 +121,18 @@ public class AddProxyRestrictionToAssertions extends AbstractConditionalProfileA
return false;
}
- proxyCount = proxyCountLookupStrategy.apply(profileRequestContext);
- audiences = proxyAudiencesLookupStrategy.apply(profileRequestContext);
+ final Pair<Integer,Set<String>> result = proxyRestrictionLookupStrategy.apply(profileRequestContext);
+ if (result != null) {
+ proxyCount = result.getFirst();
+ audiences = result.getSecond();
+ }
if (proxyCount == null && (audiences == null || audiences.isEmpty())) {
log.debug("{} No restrictions to add, nothing to do", getLogPrefix());
return false;
}
- log.debug("{} Attempting to add an ProxyRestriction to every Assertion in Response",
- getLogPrefix());
+ log.debug("{} Attempting to add an ProxyRestriction to every Assertion in Response", getLogPrefix());
response = responseLookupStrategy.apply(profileRequestContext);
if (response == null) {
@@ -182,6 +169,11 @@ public class AddProxyRestrictionToAssertions extends AbstractConditionalProfileA
final ProxyRestriction condition = getProxyRestriction(conditions);
condition.setProxyCount(proxyCount);
+ if (proxyCount != null && proxyCount == 0) {
+ // Count is zero, so audiences are irrelevant.
+ return;
+ }
+
if (audiences != null && !audiences.isEmpty()) {
final SAMLObjectBuilder<Audience> audienceBuilder = (SAMLObjectBuilder<Audience>)
XMLObjectProviderRegistrySupport.getBuilderFactory().<Audience>getBuilderOrThrow(
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/profile/impl/AddProxyRestrictionToAssertionsTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/profile/impl/AddProxyRestrictionToAssertionsTest.java
index 59571c8..d14b227 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/profile/impl/AddProxyRestrictionToAssertionsTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/profile/impl/AddProxyRestrictionToAssertionsTest.java
@@ -17,10 +17,12 @@
package org.opensaml.saml.saml2.profile.impl;
+import net.shibboleth.utilities.java.support.collection.Pair;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-import java.util.List;
+import java.util.Set;
+import java.util.stream.Collectors;
import org.opensaml.core.OpenSAMLInitBaseTestCase;
import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
@@ -30,6 +32,7 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.common.SAMLObjectBuilder;
import org.opensaml.saml.saml2.core.Assertion;
+import org.opensaml.saml.saml2.core.Audience;
import org.opensaml.saml.saml2.core.Conditions;
import org.opensaml.saml.saml2.core.ProxyRestriction;
import org.opensaml.saml.saml2.core.Response;
@@ -48,8 +51,7 @@ public class AddProxyRestrictionToAssertionsTest extends OpenSAMLInitBaseTestCas
@BeforeMethod public void setUp() {
action = new AddProxyRestrictionToAssertions();
- action.setProxyAudiencesLookupStrategy(FunctionSupport.constant(List.of(AUDIENCE1, AUDIENCE2)));
- action.setProxyCountLookupStrategy(FunctionSupport.constant(1));
+ action.setProxyRestrictionLookupStrategy(FunctionSupport.constant(new Pair<>(1,Set.of(AUDIENCE1, AUDIENCE2))));
}
/** Test that action errors out properly if there is no response. */
@@ -73,6 +75,35 @@ public class AddProxyRestrictionToAssertionsTest extends OpenSAMLInitBaseTestCas
/**
* Test that the condition is properly added if there is a single assertion, without a Conditions element, in the
+ * response with a count of zero.
+ *
+ * @throws ComponentInitializationException
+ */
+ @Test public void testZeroCount() throws ComponentInitializationException {
+ final Assertion assertion = SAML2ActionTestingSupport.buildAssertion();
+
+ final Response response = SAML2ActionTestingSupport.buildResponse();
+ response.getAssertions().add(assertion);
+
+ final ProfileRequestContext prc = new RequestContextBuilder().setOutboundMessage(response).buildProfileRequestContext();
+
+ action.setProxyRestrictionLookupStrategy(FunctionSupport.constant(new Pair<>(0,Set.of(AUDIENCE1, AUDIENCE2))));
+ action.initialize();
+ action.execute(prc);
+ ActionTestingSupport.assertProceedEvent(prc);
+
+ Assert.assertNotNull(response.getAssertions());
+ Assert.assertEquals(response.getAssertions().size(), 1);
+
+ Assert.assertNotNull(assertion.getConditions());
+ Assert.assertNotNull(assertion.getConditions().getProxyRestriction());
+ final ProxyRestriction proxy = assertion.getConditions().getProxyRestriction();
+ Assert.assertEquals(proxy.getProxyCount(), Integer.valueOf(0));
+ Assert.assertTrue(proxy.getAudiences().isEmpty());
+ }
+
+ /**
+ * Test that the condition is properly added if there is a single assertion, without a Conditions element, in the
* response with no audiences.
*
* @throws ComponentInitializationException
@@ -85,7 +116,7 @@ public class AddProxyRestrictionToAssertionsTest extends OpenSAMLInitBaseTestCas
final ProfileRequestContext prc = new RequestContextBuilder().setOutboundMessage(response).buildProfileRequestContext();
- action.setProxyAudiencesLookupStrategy(FunctionSupport.constant(null));
+ action.setProxyRestrictionLookupStrategy(FunctionSupport.constant(new Pair<>(1,null)));
action.initialize();
action.execute(prc);
ActionTestingSupport.assertProceedEvent(prc);
@@ -114,7 +145,7 @@ public class AddProxyRestrictionToAssertionsTest extends OpenSAMLInitBaseTestCas
final ProfileRequestContext prc = new RequestContextBuilder().setOutboundMessage(response).buildProfileRequestContext();
- action.setProxyCountLookupStrategy(FunctionSupport.constant(null));
+ action.setProxyRestrictionLookupStrategy(FunctionSupport.constant(new Pair<>(null, Set.of(AUDIENCE1, AUDIENCE2))));
action.initialize();
action.execute(prc);
ActionTestingSupport.assertProceedEvent(prc);
@@ -126,9 +157,8 @@ public class AddProxyRestrictionToAssertionsTest extends OpenSAMLInitBaseTestCas
Assert.assertNotNull(assertion.getConditions().getProxyRestriction());
final ProxyRestriction proxy = assertion.getConditions().getProxyRestriction();
Assert.assertNull(proxy.getProxyCount());
- Assert.assertEquals(proxy.getAudiences().size(), 2);
- Assert.assertEquals(proxy.getAudiences().get(0).getURI(), AUDIENCE1);
- Assert.assertEquals(proxy.getAudiences().get(1).getURI(), AUDIENCE2);
+ Assert.assertEquals(proxy.getAudiences().stream().map(Audience::getURI).collect(Collectors.toUnmodifiableSet()),
+ Set.of(AUDIENCE1, AUDIENCE2));
}
/**
@@ -156,9 +186,8 @@ public class AddProxyRestrictionToAssertionsTest extends OpenSAMLInitBaseTestCas
Assert.assertNotNull(assertion.getConditions().getProxyRestriction());
final ProxyRestriction proxy = assertion.getConditions().getProxyRestriction();
Assert.assertEquals(proxy.getProxyCount(), Integer.valueOf(1));
- Assert.assertEquals(proxy.getAudiences().size(), 2);
- Assert.assertEquals(proxy.getAudiences().get(0).getURI(), AUDIENCE1);
- Assert.assertEquals(proxy.getAudiences().get(1).getURI(), AUDIENCE2);
+ Assert.assertEquals(proxy.getAudiences().stream().map(Audience::getURI).collect(Collectors.toUnmodifiableSet()),
+ Set.of(AUDIENCE1, AUDIENCE2));
}
/**
@@ -189,9 +218,8 @@ public class AddProxyRestrictionToAssertionsTest extends OpenSAMLInitBaseTestCas
Assert.assertNotNull(assertion.getConditions().getProxyRestriction());
final ProxyRestriction proxy = assertion.getConditions().getProxyRestriction();
Assert.assertEquals(proxy.getProxyCount(), Integer.valueOf(1));
- Assert.assertEquals(proxy.getAudiences().size(), 2);
- Assert.assertEquals(proxy.getAudiences().get(0).getURI(), AUDIENCE1);
- Assert.assertEquals(proxy.getAudiences().get(1).getURI(), AUDIENCE2);
+ Assert.assertEquals(proxy.getAudiences().stream().map(Audience::getURI).collect(Collectors.toUnmodifiableSet()),
+ Set.of(AUDIENCE1, AUDIENCE2));
}
/** Test that the condition is properly added if there are multiple assertions in the response.
@@ -218,9 +246,8 @@ public class AddProxyRestrictionToAssertionsTest extends OpenSAMLInitBaseTestCas
Assert.assertNotNull(assertion.getConditions().getProxyRestriction());
final ProxyRestriction proxy = assertion.getConditions().getProxyRestriction();
Assert.assertEquals(proxy.getProxyCount(), Integer.valueOf(1));
- Assert.assertEquals(proxy.getAudiences().size(), 2);
- Assert.assertEquals(proxy.getAudiences().get(0).getURI(), AUDIENCE1);
- Assert.assertEquals(proxy.getAudiences().get(1).getURI(), AUDIENCE2);
+ Assert.assertEquals(proxy.getAudiences().stream().map(Audience::getURI).collect(Collectors.toUnmodifiableSet()),
+ Set.of(AUDIENCE1, AUDIENCE2));
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list