[java-identity-provider] branch main updated: IDP-1652 - Redesign handling of lists of descriptors
Scott Cantor
cantor.2 at osu.edu
Wed Aug 19 17:11:55 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=780963921a16166a301219c0be267e599d04a9a4
The following commit(s) were added to refs/heads/main by this push:
new 780963921 IDP-1652 - Redesign handling of lists of descriptors
780963921 is described below
commit 780963921a16166a301219c0be267e599d04a9a4
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Aug 19 13:11:47 2020 -0400
IDP-1652 - Redesign handling of lists of descriptors
https://issues.shibboleth.net/jira/browse/IDP-1652
Support auto-wired AdministrativeFlowDescriptors.
Revamp properties and move flow descriptors internal.
Remove legacy config.
---
.../impl/AdministrativeFlowDescriptorManager.java | 46 ++++++++++++
.../shibboleth/idp/conf/general-admin-system.xml | 63 +++++++++++++++-
.../idp/flows/admin/admin-abstract-beans.xml | 2 +-
.../src/main/resources/conf/admin/admin.properties | 28 +++++++
.../main/resources/conf/admin/general-admin.xml | 86 ----------------------
idp-conf/src/main/resources/conf/idp.properties | 2 +-
6 files changed, 138 insertions(+), 89 deletions(-)
diff --git a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/AdministrativeFlowDescriptorManager.java b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/AdministrativeFlowDescriptorManager.java
new file mode 100644
index 000000000..6b4d771f4
--- /dev/null
+++ b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/AdministrativeFlowDescriptorManager.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.admin.impl;
+
+import java.util.Collection;
+
+import javax.annotation.Nullable;
+
+import org.springframework.beans.factory.annotation.Autowired;
+
+import net.shibboleth.ext.spring.util.IdentifiedComponentManager;
+import net.shibboleth.idp.admin.AdministrativeFlowDescriptor;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+
+/**
+ * Manager of {@link AdministrativeFlowDescriptor} objects.
+ */
+public class AdministrativeFlowDescriptorManager extends IdentifiedComponentManager<AdministrativeFlowDescriptor> {
+
+ /**
+ * Constructor.
+ *
+ * @param freeObjects free-standing objects
+ */
+ @Autowired
+ public AdministrativeFlowDescriptorManager(
+ @Nullable @NonnullElements final Collection<AdministrativeFlowDescriptor> freeObjects) {
+ super(freeObjects);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/general-admin-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/general-admin-system.xml
index 7f78e7530..c4eebb5c1 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/general-admin-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/general-admin-system.xml
@@ -12,10 +12,71 @@
default-init-method="initialize"
default-destroy-method="destroy">
- <import resource="${idp.home}/conf/admin/general-admin.xml" />
+ <import resource="conditional:${idp.home}/conf/admin/general-admin.xml" />
<import resource="${idp.home}/conf/admin/metrics.xml" />
<import resource="conditional:${idp.home}/conf/admin/unlock-keys.xml" />
+ <!-- Management bean to collect and expose AdministrativeFlowDescriptors. -->
+
+ <bean id="shibboleth.AdministrativeFlowDescriptorManager"
+ class="net.shibboleth.idp.admin.impl.AdministrativeFlowDescriptorManager"
+ p:components="#{getObject('shibboleth.AvailableAdminFlows')}" />
+
+ <!-- Built-in flow descriptors. -->
+
+ <bean parent="shibboleth.AdminFlow"
+ c:id="http://shibboleth.net/ns/profiles/status"
+ p:loggingId="%{idp.status.logging:Status}"
+ p:policyName="%{idp.status.accessPolicy:AccessByIPAddress}" />
+
+ <bean parent="shibboleth.AdminFlow"
+ c:id="http://shibboleth.net/ns/profiles/reload-service-configuration"
+ p:loggingId="%{idp.reload.logging:Reload}"
+ p:policyName="%{idp.reload.accessPolicy:AccessByIPAddress}" />
+
+ <bean parent="shibboleth.AdminFlow"
+ c:id="http://shibboleth.net/ns/profiles/reload-metadata"
+ p:loggingId="%{idp.reload.logging:Reload}"
+ p:policyName="%{idp.reload.accessPolicy:AccessByIPAddress}" />
+
+ <bean parent="shibboleth.AdminFlow"
+ c:id="http://shibboleth.net/ns/profiles/resolvertest"
+ p:loggingId="%{idp.resolvertest.logging:ResolverTest}"
+ p:policyName="%{idp.resolvertest.accessPolicy:AccessByIPAddress}" />
+
+ <bean parent="shibboleth.AdminFlow"
+ c:id="http://shibboleth.net/ns/profiles/mdquery"
+ p:loggingId="%{idp.mdquery.logging:MetadataQuery}"
+ p:policyName="%{idp.mdquery.accessPolicy:AccessByIPAddress}" />
+
+ <bean parent="shibboleth.AdminFlow"
+ c:id="http://shibboleth.net/ns/profiles/metrics"
+ p:loggingId="%{idp.metrics.logging:Metrics}"
+ p:policyNameLookupStrategy-ref="shibboleth.metrics.AccessPolicyStrategy" />
+
+ <bean parent="shibboleth.AdminFlow"
+ c:id="http://shibboleth.net/ns/profiles/hello"
+ p:loggingId="%{idp.hello.logging:Hello}"
+ p:policyName="%{idp.hello.accessPolicy:AccessByAdminUser}"
+ p:authenticated="true"
+ p:resolveAttributes="true" />
+
+ <bean parent="shibboleth.AdminFlow"
+ c:id="http://shibboleth.net/ns/profiles/lockout-manager"
+ p:loggingId="%{idp.lockout.logging:Lockout}"
+ p:policyName="%{idp.lockout.accessPolicy:AccessDenied}" />
+
+ <bean parent="shibboleth.AdminFlow"
+ c:id="http://shibboleth.net/ns/profiles/storage"
+ p:loggingId="%{idp.storage.logging:Storage}"
+ p:policyName="%{idp.storage.accessPolicy:AccessDenied}" />
+
+ <bean parent="shibboleth.OneTimeAdminFlow"
+ c:id="http://shibboleth.net/ns/profiles/unlock-keys"
+ p:loggingId="%{idp.unlock.logging:UnlockKeys}"
+ p:policyName="%{idp.unlock.accessPolicy:AccessDenied}"
+ p:authenticated="%{idp.unlock.authenticated:true}" />
+
<!-- Parent beans to default some of the flow boilerplate. -->
<bean id="shibboleth.AdminFlow" abstract="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/admin-abstract-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/admin-abstract-beans.xml
index 1f29cf93a..c6fb9bd4b 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/admin-abstract-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/admin-abstract-beans.xml
@@ -36,7 +36,7 @@
<bean id="InitializeAdministrativeProfileContextTree"
class="net.shibboleth.idp.admin.impl.InitializeAdministrativeProfileContextTree" scope="prototype"
p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:administrativeFlowDescriptor="#{@'shibboleth.AvailableAdminFlows'.?[id == @'shibboleth.AdminProfileId']}">
+ p:administrativeFlowDescriptor="#{@'shibboleth.AdministrativeFlowDescriptorManager'.getComponents().?[id == @'shibboleth.AdminProfileId']}">
<property name="fallbackLanguages">
<bean parent="shibboleth.CommaDelimStringArray" c:_0="#{'%{idp.ui.fallbackLanguages:}'.trim()}" />
</property>
diff --git a/idp-conf/src/main/resources/conf/admin/admin.properties b/idp-conf/src/main/resources/conf/admin/admin.properties
new file mode 100644
index 000000000..2f1c0bf2e
--- /dev/null
+++ b/idp-conf/src/main/resources/conf/admin/admin.properties
@@ -0,0 +1,28 @@
+# Configure properties controlling administrative features
+
+#idp.status.logging = Status
+#idp.status.accessPolicy = AccessByIPAddress
+
+#idp.reload.logging = Reload
+#idp.reload.accessPolicy = AccessByIPAddress
+
+#idp.resolvertest.logging = ResolverTest
+#idp.resolvertest.accessPolicy = AccessByIPAddress
+
+#idp.mdquery.logging = MetadataQuery
+#idp.mdquery.accessPolicy = AccessByIPAddress
+
+#idp.metrics.logging = Metrics
+
+#idp.hello.logging = Hello
+#idp.hello.accessPolicy = AccessByAdminUser
+
+#idp.lockout.logging = Lockout
+#idp.lockout.accessPolicy = AccessDenied
+
+#idp.storage.logging = Storage
+#idp.storage.accessPolicy = AccessDenied
+
+#idp.unlock.logging = UnlockKeys
+#idp.unlock.accessPolicy = AccessDenied
+#idp.unlock.authenticated = true
diff --git a/idp-conf/src/main/resources/conf/admin/general-admin.xml b/idp-conf/src/main/resources/conf/admin/general-admin.xml
deleted file mode 100644
index 7eb146f50..000000000
--- a/idp-conf/src/main/resources/conf/admin/general-admin.xml
+++ /dev/null
@@ -1,86 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <util:list id="shibboleth.AvailableAdminFlows">
-
- <!-- Status Page -->
- <bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/status"
- p:loggingId="%{idp.service.logging.status:Status}"
- p:policyName="%{idp.status.accessPolicy:AccessByIPAddress}" />
-
- <!-- Service Reload -->
- <bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/reload-service-configuration"
- p:loggingId="%{idp.service.logging.serviceReload:Reload}"
- p:policyName="%{idp.reload.accessPolicy:AccessByIPAddress}" />
-
- <!-- MetadataResolver Reload -->
- <bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/reload-metadata"
- p:loggingId="%{idp.service.logging.serviceReload:Reload}"
- p:policyName="%{idp.reload.accessPolicy:AccessByIPAddress}" />
-
- <!-- AttributeResolver Debugging -->
- <bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/resolvertest"
- p:loggingId="%{idp.service.logging.resolvertest:ResolverTest}"
- p:policyName="%{idp.resolvertest.accessPolicy:AccessByIPAddress}" />
-
- <!-- Metadata Query -->
- <bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/mdquery"
- p:loggingId="MetadataQuery"
- p:policyName="AccessByIPAddress" />
-
- <!-- REST Interface to Metrics -->
- <bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/metrics"
- p:loggingId="Metrics"
- p:policyNameLookupStrategy-ref="shibboleth.metrics.AccessPolicyStrategy" />
-
- <!-- Hello World -->
- <bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/hello"
- p:loggingId="Hello"
- p:authenticated="true"
- p:resolveAttributes="true"
- p:policyName="AccessByAdminUser" />
-
- <!-- REST AccountLockoutManager Access -->
- <!--
- <bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/lockout-manager"
- p:loggingId="Lockout"
- p:policyName="AccessByIPAddress" />
- -->
-
- <!-- REST StorageService Access -->
- <!--
- <bean parent="shibboleth.AdminFlow"
- c:id="http://shibboleth.net/ns/profiles/storage"
- p:loggingId="Storage"
- p:policyName="AccessByIPAddress" />
- -->
-
- <!-- Attended Startup Unlock -->
- <!--
- <bean parent="shibboleth.OneTimeAdminFlow"
- c:id="http://shibboleth.net/ns/profiles/unlock-keys"
- p:loggingId="UnlockKeys"
- p:authenticated="true"
- p:policyName="AccessByAdminUser" />
- -->
-
- </util:list>
-
-</beans>
diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index b35276edf..76e3ff7fc 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -1,5 +1,5 @@
# Load any additional property resources from a comma-delimited list
-idp.additionalProperties = /conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/authn/duo.properties, /credentials/secrets.properties
+idp.additionalProperties = /conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/admin/admin.properties, /conf/authn/duo.properties, /credentials/secrets.properties
# In most cases (and unless noted in the surrounding comments) the
# commented settings in the distributed files document default behavior.
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list