[java-identity-provider] branch master updated: IDP-1547: Add a simple Map-based impl of JAASCredentialValidator ...
Brent Putman
putmanb at georgetown.edu
Thu Feb 6 21:55:48 EST 2020
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=b44d551706178b4c15e21ef90e2be6226ce448f1
The following commit(s) were added to refs/heads/master by this push:
new b44d551 IDP-1547: Add a simple Map-based impl of JAASCredentialValidator ...
b44d551 is described below
commit b44d551706178b4c15e21ef90e2be6226ce448f1
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Feb 6 21:55:27 2020 -0500
IDP-1547: Add a simple Map-based impl of JAASCredentialValidator ...
Add a simple Map-based impl of JAASCredentialValidator
loginConfigStrategy.
---
.../RelyingPartyMapJAASLoginConfigStrategy.java | 111 +++++++++++++++++++
...RelyingPartyMapJAASLoginConfigStrategyTest.java | 119 +++++++++++++++++++++
.../system/flows/authn/password-authn-beans.xml | 3 +
3 files changed, 233 insertions(+)
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RelyingPartyMapJAASLoginConfigStrategy.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RelyingPartyMapJAASLoginConfigStrategy.java
new file mode 100644
index 0000000..35af50b
--- /dev/null
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RelyingPartyMapJAASLoginConfigStrategy.java
@@ -0,0 +1,111 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.authn.impl;
+
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Map;
+
+import javax.annotation.Nonnull;
+import javax.security.auth.Subject;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.utilities.java.support.annotation.ParameterName;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.collection.Pair;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
+
+/**
+ * An implementation of the <code>loginConfigStrategy</code> for {@link JAASCredentialValidator}
+ * which uses a supplied map to resolve the JAAS config to use.
+ *
+ * <p>
+ * The map key is the relying party ID, the value is the JAAS config name.
+ * </p>
+ */
+public class RelyingPartyMapJAASLoginConfigStrategy
+ extends AbstractRelyingPartyLookupFunction<Collection<Pair<String,Subject>>> {
+
+ /** Logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(RelyingPartyMapJAASLoginConfigStrategy.class);
+
+ /** Map holding the relying party -> JAAS config name mappings. */
+ @Nonnull private Map<String, String> relyingPartyMap;
+
+ /** The default JAAS config name to use when no specific mapping configured. */
+ @Nonnull private String defaultConfigName;
+
+ /**
+ * Constructor.
+ *
+ * @param map the map of relying party ID to JAAS config name
+ */
+ public RelyingPartyMapJAASLoginConfigStrategy(final @Nonnull @ParameterName(name="map") Map<String,String> map) {
+ relyingPartyMap = Constraint.isNotNull(map, "Relying party map was null");
+
+ defaultConfigName = "ShibUserPassAuth";
+ }
+
+ /**
+ * Set the default JAAS config name returned when no specific one is configured for a particular
+ * relying party.
+ *
+ * <p>
+ * The default value is: ShibUserPassAuth.
+ * </p>
+ *
+ * @param name the default JAAS config name
+ */
+ public void setDefaultConfigName(final @Nonnull @NotEmpty String name) {
+ defaultConfigName = Constraint.isNotNull(StringSupport.trimOrNull(name),
+ "Default config name was null or empty");
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public Collection<Pair<String, Subject>> apply(
+ @Nonnull final ProfileRequestContext profileRequestContext) {
+
+ final RelyingPartyContext relyingPartyContext =
+ getRelyingPartyContextLookupStrategy().apply(profileRequestContext);
+ if (relyingPartyContext == null) {
+ log.warn("No RelyingPartyContext was available, using default config name");
+ return Collections.singleton(new Pair<>(defaultConfigName, (Subject)null));
+ }
+
+ final String relyingPartyId = relyingPartyContext.getRelyingPartyId();
+ if (relyingPartyId == null) {
+ log.warn("No relying party ID was available, using default config name");
+ return Collections.singleton(new Pair<>(defaultConfigName, (Subject)null));
+ }
+
+ final String config = StringSupport.trimOrNull(relyingPartyMap.get(relyingPartyId));
+ if (config != null) {
+ log.debug("For relying party ID '{}' resolved JAAS config name '{}'", relyingPartyId, config);
+ return Collections.singleton(new Pair<>(config, (Subject)null));
+ }
+ log.debug("For relying party ID '{}' resolved no JAAS config name, returning default", relyingPartyId);
+ return Collections.singleton(new Pair<>(defaultConfigName, (Subject)null));
+ }
+
+}
diff --git a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/RelyingPartyMapJAASLoginConfigStrategyTest.java b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/RelyingPartyMapJAASLoginConfigStrategyTest.java
new file mode 100644
index 0000000..a9bed56
--- /dev/null
+++ b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/RelyingPartyMapJAASLoginConfigStrategyTest.java
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.authn.impl;
+
+import java.util.Collection;
+import java.util.HashMap;
+
+import javax.security.auth.Subject;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.Assert;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.utilities.java.support.collection.Pair;
+import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
+
+public class RelyingPartyMapJAASLoginConfigStrategyTest {
+
+ private static final String DEFAULT_JAAS_CONFIG = "ShibUserPassAuth";
+
+ private RelyingPartyMapJAASLoginConfigStrategy strategy;
+
+ private ProfileRequestContext profileRequestContext;
+
+ private RelyingPartyContext relyingPartyContext;
+
+ private String entityID = "https://www.example.org/saml";
+
+ private HashMap<String, String> rpMap;
+
+ @BeforeMethod
+ public void setUp() {
+ profileRequestContext = new ProfileRequestContext();
+
+ relyingPartyContext = profileRequestContext.getSubcontext(RelyingPartyContext.class, true);
+ relyingPartyContext.setRelyingPartyId(entityID);
+
+ rpMap = new HashMap<>();
+ // Deliberately inserting some whitespace here to test trimming of result returned.
+ rpMap.put(entityID, " MyJAAS ");
+ }
+
+ @Test
+ public void testNoRelyingPartyContext() {
+ profileRequestContext.removeSubcontext(RelyingPartyContext.class);
+
+ strategy = new RelyingPartyMapJAASLoginConfigStrategy(rpMap);
+
+ Collection<Pair<String,Subject>> result = strategy.apply(profileRequestContext);
+ Assert.assertNotNull(result);
+ Assert.assertEquals(result.size(), 1);
+ Pair<String,Subject> resultPair = result.iterator().next();
+ Assert.assertNull(resultPair.getSecond());
+ Assert.assertEquals(resultPair.getFirst(), DEFAULT_JAAS_CONFIG);
+ }
+
+ @Test
+ public void testNoRelyingPartyId() {
+ relyingPartyContext.setRelyingPartyId(null);
+
+ strategy = new RelyingPartyMapJAASLoginConfigStrategy(rpMap);
+
+ Collection<Pair<String,Subject>> result = strategy.apply(profileRequestContext);
+ Assert.assertNotNull(result);
+ Assert.assertEquals(result.size(), 1);
+ Pair<String,Subject> resultPair = result.iterator().next();
+ Assert.assertNull(resultPair.getSecond());
+ Assert.assertEquals(resultPair.getFirst(), DEFAULT_JAAS_CONFIG);
+ }
+
+ @Test
+ public void testNoMappingFound() {
+ relyingPartyContext.setRelyingPartyId("SomeOtherRP");
+
+ strategy = new RelyingPartyMapJAASLoginConfigStrategy(rpMap);
+
+ Collection<Pair<String,Subject>> result = strategy.apply(profileRequestContext);
+ Assert.assertNotNull(result);
+ Assert.assertEquals(result.size(), 1);
+ Pair<String,Subject> resultPair = result.iterator().next();
+ Assert.assertNull(resultPair.getSecond());
+ Assert.assertEquals(resultPair.getFirst(), DEFAULT_JAAS_CONFIG);
+ }
+
+ @Test
+ public void testMappingFound() {
+ strategy = new RelyingPartyMapJAASLoginConfigStrategy(rpMap);
+
+ Collection<Pair<String,Subject>> result = strategy.apply(profileRequestContext);
+ Assert.assertNotNull(result);
+ Assert.assertEquals(result.size(), 1);
+ Pair<String,Subject> resultPair = result.iterator().next();
+ Assert.assertNull(resultPair.getSecond());
+ Assert.assertEquals(resultPair.getFirst(), "MyJAAS");
+ }
+
+ @Test(expectedExceptions=ConstraintViolationException.class)
+ public void testNullInputMap() {
+ strategy = new RelyingPartyMapJAASLoginConfigStrategy(null);
+ }
+
+}
diff --git a/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
index 3f0aa44..1ce91f9 100644
--- a/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
@@ -93,6 +93,9 @@
</property>
</bean>
+ <bean id="shibboleth.authn.JAAS.LoginConfigStrategy.RelyingPartyMap" abstract="true"
+ class="net.shibboleth.idp.authn.impl.RelyingPartyMapJAASLoginConfigStrategy" />
+
<bean id="ValidateUsernamePasswordAgainstKerberos" parent="shibboleth.CredentialValidator" lazy-init="true"
class="net.shibboleth.idp.authn.impl.KerberosCredentialValidator"
p:id="krb5"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list