[java-identity-provider] branch master updated: Block parsing of filters inside chaining providers.
Scott Cantor
cantor.2 at osu.edu
Fri Oct 18 13:49:49 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=098f016beba88074bcbf42c26343d18270e141f2
The following commit(s) were added to refs/heads/master by this push:
new 098f016 Block parsing of filters inside chaining providers.
098f016 is described below
commit 098f016beba88074bcbf42c26343d18270e141f2
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Oct 18 13:49:46 2019 -0400
Block parsing of filters inside chaining providers.
---
.../metadata/AbstractMetadataProviderParser.java | 63 +++++++++++++---------
.../main/resources/schema/shibboleth-metadata.xsd | 4 +-
2 files changed, 40 insertions(+), 27 deletions(-)
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/AbstractMetadataProviderParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/AbstractMetadataProviderParser.java
index cd07395..02c2b1c 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/AbstractMetadataProviderParser.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/AbstractMetadataProviderParser.java
@@ -33,6 +33,7 @@ import org.w3c.dom.Element;
import org.w3c.dom.Node;
import net.shibboleth.ext.spring.util.SpringSupport;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import net.shibboleth.utilities.java.support.xml.DOMTypeSupport;
import net.shibboleth.utilities.java.support.xml.ElementSupport;
@@ -46,20 +47,23 @@ import net.shibboleth.utilities.java.support.xml.ElementSupport;
public abstract class AbstractMetadataProviderParser extends AbstractSingleBeanDefinitionParser {
/** Namespace for Security. */
- public static final String SECURITY_NAMESPACE = "urn:mace:shibboleth:2.0:security";
+ @Nonnull @NotEmpty public static final String SECURITY_NAMESPACE = "urn:mace:shibboleth:2.0:security";
+
/** Namespace for Metadata. */
- public static final String METADATA_NAMESPACE = "urn:mace:shibboleth:2.0:metadata";
+ @Nonnull @NotEmpty public static final String METADATA_NAMESPACE = "urn:mace:shibboleth:2.0:metadata";
/** MetadataFilter Element name. */
- public static final QName METADATA_FILTER_ELEMENT_NAME = new QName(METADATA_NAMESPACE, "MetadataFilter");
+ @Nonnull public static final QName METADATA_FILTER_ELEMENT_NAME = new QName(METADATA_NAMESPACE, "MetadataFilter");
+
/** ChainingMetadataProviderElement name. */
- public static final QName CHAINING_PROVIDER_ELEMENT_NAME =
+ @Nonnull public static final QName CHAINING_PROVIDER_ELEMENT_NAME =
new QName(METADATA_NAMESPACE, "ChainingMetadataProvider");
+
/** RelyingPartyGroup Element name. */
- public static final QName TRUST_ENGINE_ELEMENT_NAME = new QName(SECURITY_NAMESPACE, "TrustEngine");
+ @Nonnull public static final QName TRUST_ENGINE_ELEMENT_NAME = new QName(SECURITY_NAMESPACE, "TrustEngine");
/** Logger. */
- private final Logger log = LoggerFactory.getLogger(AbstractMetadataProviderParser.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractMetadataProviderParser.class);
/**
* Handle attributes which are inappropriate for specific implementations. The chaining metadata provider cannot
@@ -75,14 +79,23 @@ public abstract class AbstractMetadataProviderParser extends AbstractSingleBeanD
if (!element.hasAttributeNS(null, attribute)) {
return false;
- }
-
- if (CHAINING_PROVIDER_ELEMENT_NAME.equals(DOMTypeSupport.getXSIType(element))) {
+ } else if (isChaining(element)) {
log.warn("{} is not valid for {}", attribute, CHAINING_PROVIDER_ELEMENT_NAME.getLocalPart());
return false;
}
return true;
}
+
+ /**
+ * Is this a chaining resolver?
+ *
+ * @param element root element of resolver
+ *
+ * @return whether the type is Chaining
+ */
+ private boolean isChaining(@Nonnull final Element element) {
+ return CHAINING_PROVIDER_ELEMENT_NAME.equals(DOMTypeSupport.getXSIType(element));
+ }
/**
* Is this the element at the top of the file? Yes, if it has no parent. In
@@ -174,21 +187,23 @@ public abstract class AbstractMetadataProviderParser extends AbstractSingleBeanD
processPredicateOptions(element, parserContext, builder);
- final List<Element> filters =
- ElementSupport.getChildElements(element, METADATA_FILTER_ELEMENT_NAME);
-
- if (null != filters) {
- if (filters.size() == 1) {
- // Install directly.
- builder.addPropertyValue("metadataFilter",
- SpringSupport.parseCustomElement(filters.get(0), parserContext, builder, false));
- } else if (filters.size() > 1) {
- // Wrap in a chaining filter.
- final BeanDefinitionBuilder chainBuilder =
- BeanDefinitionBuilder.genericBeanDefinition(MetadataFilterChain.class);
- chainBuilder.addPropertyValue("filters", SpringSupport.parseCustomElements(filters, parserContext,
- chainBuilder));
- builder.addPropertyValue("metadataFilter", chainBuilder.getBeanDefinition());
+ if (!isChaining(element)) {
+ final List<Element> filters =
+ ElementSupport.getChildElements(element, METADATA_FILTER_ELEMENT_NAME);
+
+ if (null != filters) {
+ if (filters.size() == 1) {
+ // Install directly.
+ builder.addPropertyValue("metadataFilter",
+ SpringSupport.parseCustomElement(filters.get(0), parserContext, builder, false));
+ } else if (filters.size() > 1) {
+ // Wrap in a chaining filter.
+ final BeanDefinitionBuilder chainBuilder =
+ BeanDefinitionBuilder.genericBeanDefinition(MetadataFilterChain.class);
+ chainBuilder.addPropertyValue("filters", SpringSupport.parseCustomElements(filters, parserContext,
+ chainBuilder));
+ builder.addPropertyValue("metadataFilter", chainBuilder.getBeanDefinition());
+ }
}
}
}
diff --git a/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd b/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd
index 7dde13f..7e47a90 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd
@@ -28,9 +28,7 @@
<documentation>
A metadata provider that composes other metadata providers. During a lookup operation member providers
are searched in the order they listed in this providers configuration until one provides a response to
- the lookup. That response is then returned, no subsequent member providers are inspected. Note, that
- metadata filters and the require valid metadata flag expressed on this configuration overrides those
- settings on member providers.
+ the lookup. That response is then returned, no subsequent member providers are inspected.
</documentation>
</annotation>
<complexContent>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list