[java-identity-provider] branch master updated: Sync OpenSAML lookup function changes to saml-authn-beans.xml.

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d0e0932ff5e114626613e201f8a52c358ffdc60b

The following commit(s) were added to refs/heads/master by this push:
       new  d0e0932   Sync OpenSAML lookup function changes to saml-authn-beans.xml.
d0e0932 is described below

commit d0e0932ff5e114626613e201f8a52c358ffdc60b
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Fri Jan 31 23:51:10 2020 -0500

    Sync OpenSAML lookup function changes to saml-authn-beans.xml.
    
    For entityID lookups Uses composition of simpler functions rather
    than monolithic complex one.
    
    Add copyContextStrategy to SAMLMetadataLookupHandler.
---
 .../system/flows/authn/saml-authn-beans.xml        | 79 ++++++++++++++++------
 1 file changed, 60 insertions(+), 19 deletions(-)

diff --git a/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml
index ca48520..4fe5160 100644
--- a/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml
@@ -238,6 +238,58 @@
         </constructor-arg>
     </bean>
 
+    <bean id="OutboundSAMLMetadataContextLookup" parent="shibboleth.Functions.Compose">
+        <constructor-arg name="g">
+            <bean class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+                  c:type="#{ T(org.opensaml.saml.common.messaging.context.SAMLMetadataContext) }" />
+        </constructor-arg>
+        <constructor-arg name="f">
+            <bean parent="shibboleth.Functions.Compose">
+                <constructor-arg name="g">
+                    <bean class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+                          c:type="#{ T(org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext) }" />
+                </constructor-arg>
+                <constructor-arg name="f">
+                    <bean class="org.opensaml.messaging.context.navigate.MessageContextLookup" c:direction="OUTBOUND" />
+                </constructor-arg>
+            </bean>
+        </constructor-arg>
+    </bean>
+
+    <bean id="OutboundEntityIDLookup" parent="shibboleth.Functions.Compose">
+        <constructor-arg name="g">
+            <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLEntityIDFunction" />
+        </constructor-arg>
+        <constructor-arg name="f">
+            <bean parent="shibboleth.Functions.Compose">
+                <constructor-arg name="g">
+                    <bean class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+                          c:type="#{ T(org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext) }" />
+                </constructor-arg>
+                <constructor-arg name="f">
+                    <bean class="org.opensaml.messaging.context.navigate.MessageContextLookup" c:direction="OUTBOUND" />
+                </constructor-arg>
+            </bean>
+        </constructor-arg>
+    </bean>
+
+    <bean id="InboundEntityIDLookup" parent="shibboleth.Functions.Compose">
+        <constructor-arg name="g">
+            <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLEntityIDFunction" />
+        </constructor-arg>
+        <constructor-arg name="f">
+            <bean parent="shibboleth.Functions.Compose">
+                <constructor-arg name="g">
+                    <bean class="org.opensaml.messaging.context.navigate.ChildContextLookup"
+                          c:type="#{ T(org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext) }" />
+                </constructor-arg>
+                <constructor-arg name="f">
+                    <bean class="org.opensaml.messaging.context.navigate.MessageContextLookup" c:direction="INBOUND" />
+                </constructor-arg>
+            </bean>
+        </constructor-arg>
+    </bean>
+
     <bean id="HandleResponse" parent="NestedWebFlowMessageHandlerAdaptor" scope="prototype" c:executionDirection="INBOUND">
         <constructor-arg>
             <bean class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain">
@@ -249,12 +301,9 @@
                         <bean class="org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler" scope="prototype"
                             p:protocol-ref="shibboleth.MetadataLookup.Protocol"
                             p:role-ref="shibboleth.MetadataLookup.Role" />
-                        <bean class="org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler" scope="prototype">
-                            <property name="roleDescriptorResolver">
-                                <bean class="org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver"
-                                      c:mdResolver-ref="shibboleth.MetadataResolver" />
-                            </property>
-                        </bean>
+                        <bean class="org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler" scope="prototype"
+                              p:roleDescriptorResolver-ref="shibboleth.RoleDescriptorResolver"
+                              p:copyContextStrategy-ref="OutboundSAMLMetadataContextLookup" />
                         <bean class="org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler" scope="prototype"
                             p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
                         <bean class="org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler" scope="prototype"
@@ -268,19 +317,11 @@
                             p:httpServletRequest-ref="shibboleth.HttpServletRequest"
                             p:parser-ref="shibboleth.ParserPool"
                             p:keyInfoResolver-ref="shibboleth.KeyInfoCredentialResolver" />
-                        <bean class="org.opensaml.messaging.handler.impl.CheckMandatoryIssuer" scope="prototype">
-                            <property name="issuerLookupStrategy">
-                                <bean class="org.opensaml.saml.common.binding.security.impl.MessageContextEntityIDLookup" p:direction="INBOUND" />
-                            </property>
-                        </bean>
-                        <bean class="org.opensaml.messaging.handler.impl.CheckExpectedIssuer" scope="prototype">
-                            <property name="issuerLookupStrategy">
-                                <bean class="org.opensaml.saml.common.binding.security.impl.MessageContextEntityIDLookup" p:direction="INBOUND" />
-                            </property>
-                            <property name="expectedIssuerLookupStrategy">
-                                <bean class="org.opensaml.saml.common.binding.security.impl.MessageContextEntityIDLookup" p:direction="OUTBOUND" />
-                            </property>
-                        </bean>
+                        <bean class="org.opensaml.messaging.handler.impl.CheckMandatoryIssuer" scope="prototype"
+                            p:issuerLookupStrategy-ref="InboundEntityIDLookup" />
+                        <bean class="org.opensaml.messaging.handler.impl.CheckExpectedIssuer" scope="prototype"
+                            p:issuerLookupStrategy-ref="InboundEntityIDLookup"
+                            p:expectedIssuerLookupStrategy-ref="OutboundEntityIDLookup" />
                     </list>
                 </property>
 		     </bean>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.