[java-identity-provider] branch master updated: IDP-1492 - Log SPNameQualifier other than SP entityID
Scott Cantor
cantor.2 at osu.edu
Fri Feb 21 09:54:35 EST 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d4c933b4f0db65bd011147c7d1f3e7679a9e7006
The following commit(s) were added to refs/heads/master by this push:
new d4c933b IDP-1492 - Log SPNameQualifier other than SP entityID
d4c933b is described below
commit d4c933b4f0db65bd011147c7d1f3e7679a9e7006
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Feb 21 09:53:49 2020 -0500
IDP-1492 - Log SPNameQualifier other than SP entityID
https://issues.shibboleth.net/jira/browse/IDP-1492
---
.../main/resources/system/conf/audit-system.xml | 158 ++++++++++++++++++++-
.../idp/saml/profile/SAMLAuditFields.java | 11 +-
.../audit/impl/NameIDFormatAuditExtractor.java | 26 +++-
.../impl/NameIDPolicyFormatAuditExtractor.java | 69 +++++++++
.../NameIDPolicySPNameQualifierAuditExtractor.java | 69 +++++++++
.../audit/impl/SPNameQualifierAuditExtractor.java | 107 ++++++++++++++
6 files changed, 432 insertions(+), 8 deletions(-)
diff --git a/idp-conf/src/main/resources/system/conf/audit-system.xml b/idp-conf/src/main/resources/system/conf/audit-system.xml
index 721a893..1a4805b 100644
--- a/idp-conf/src/main/resources/system/conf/audit-system.xml
+++ b/idp-conf/src/main/resources/system/conf/audit-system.xml
@@ -236,6 +236,54 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEID_FORMAT"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.NameIDFormatAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SP_NAME_QUALIFIER"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.SPNameQualifierAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEIDPOLICY_FORMAT"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.NameIDPolicyFormatAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.AuthnRequest"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEIDPOLICY_SP_NAME_QUALIFIER"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.NameIDPolicySPNameQualifierAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.AuthnRequest"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
</map>
</property>
</bean>
@@ -308,7 +356,7 @@
<constructor-arg name="f">
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.ChildLookupOrCreate.SAMLMessageInfoContext"
- c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
</constructor-arg>
</bean>
</entry>
@@ -336,6 +384,54 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEID_FORMAT"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.NameIDFormatAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.AuthnRequest"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SP_NAME_QUALIFIER"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.SPNameQualifierAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.AuthnRequest"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEIDPOLICY_FORMAT"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.NameIDPolicyFormatAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.AuthnRequest"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEIDPOLICY_SP_NAME_QUALIFIER"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.NameIDPolicySPNameQualifierAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.AuthnRequest"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
</map>
</property>
</bean>
@@ -450,6 +546,18 @@
</entry>
<entry>
<key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SP_NAME_QUALIFIER"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.SPNameQualifierAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
<util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.ENCRYPTION"/>
</key>
<bean parent="shibboleth.Functions.Compose">
@@ -565,6 +673,18 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SP_NAME_QUALIFIER"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.SPNameQualifierAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
</map>
</property>
</bean>
@@ -916,6 +1036,18 @@
</entry>
<entry>
<key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SP_NAME_QUALIFIER"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.SPNameQualifierAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
<util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SESSION_INDEX"/>
</key>
<bean class="net.shibboleth.idp.saml.audit.impl.SessionIndexAuditExtractor">
@@ -986,6 +1118,30 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEID_FORMAT"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.NameIDFormatAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SP_NAME_QUALIFIER"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.SPNameQualifierAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
</map>
</property>
</bean>
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
index ebbd0ee..3131858 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
@@ -37,7 +37,7 @@ public final class SAMLAuditFields {
/** Request binding field. */
@Nonnull @NotEmpty public static final String REQUEST_BINDING = "b";
-
+
/** Response binding field. */
@Nonnull @NotEmpty public static final String RESPONSE_BINDING = "bb";
@@ -47,6 +47,15 @@ public final class SAMLAuditFields {
/** Name identifier Format field. */
@Nonnull @NotEmpty public static final String NAMEID_FORMAT = "f";
+ /** NameID SPNameQualifier field. @since 4.0.0 */
+ @Nonnull @NotEmpty public static final String SP_NAME_QUALIFIER = "SPQ";
+
+ /** Name identifier Format field. */
+ @Nonnull @NotEmpty public static final String NAMEIDPOLICY_FORMAT = "pf";
+
+ /** NameID SPNameQualifier field. @since 4.0.0 */
+ @Nonnull @NotEmpty public static final String NAMEIDPOLICY_SP_NAME_QUALIFIER = "PSPQ";
+
/** Assertion ID field. */
@Nonnull @NotEmpty public static final String ASSERTION_ID = "i";
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDFormatAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDFormatAuditExtractor.java
index aa2ea6d..990e4ef 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDFormatAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDFormatAuditExtractor.java
@@ -34,11 +34,11 @@ import org.opensaml.saml.saml2.core.LogoutRequest;
import net.shibboleth.utilities.java.support.logic.Constraint;
-/** {@link Function} that returns the Name Identifier Format from an assertion in a response. */
+/** {@link Function} that returns the Name Identifier Format from a SAML Subject. */
public class NameIDFormatAuditExtractor implements Function<ProfileRequestContext,String> {
/** Lookup strategy for message to read from. */
- @Nonnull private final Function<ProfileRequestContext,SAMLObject> responseLookupStrategy;
+ @Nonnull private final Function<ProfileRequestContext,SAMLObject> messageLookupStrategy;
/**
* Constructor.
@@ -46,13 +46,13 @@ public class NameIDFormatAuditExtractor implements Function<ProfileRequestContex
* @param strategy lookup strategy for message
*/
public NameIDFormatAuditExtractor(@Nonnull final Function<ProfileRequestContext,SAMLObject> strategy) {
- responseLookupStrategy = Constraint.isNotNull(strategy, "Response lookup strategy cannot be null");
+ messageLookupStrategy = Constraint.isNotNull(strategy, "Response lookup strategy cannot be null");
}
-// Checkstyle: CyclomaticComplexity OFF
+// Checkstyle: CyclomaticComplexity|ReturnCount OFF
/** {@inheritDoc} */
@Nullable public String apply(@Nullable final ProfileRequestContext input) {
- SAMLObject msg = responseLookupStrategy.apply(input);
+ SAMLObject msg = messageLookupStrategy.apply(input);
if (msg != null) {
// Step down into ArtifactResponses.
@@ -77,6 +77,7 @@ public class NameIDFormatAuditExtractor implements Function<ProfileRequestContex
}
} else if (msg instanceof AuthnRequest) {
+
if (((AuthnRequest) msg).getSubject() != null &&
((AuthnRequest) msg).getSubject().getNameID() != null) {
return ((AuthnRequest) msg).getSubject().getNameID().getFormat();
@@ -91,6 +92,19 @@ public class NameIDFormatAuditExtractor implements Function<ProfileRequestContex
return format;
}
}
+ } else if (msg instanceof org.opensaml.saml.saml2.core.SubjectQuery) {
+
+ if (((org.opensaml.saml.saml2.core.SubjectQuery) msg).getSubject() != null &&
+ ((org.opensaml.saml.saml2.core.SubjectQuery) msg).getSubject().getNameID() != null) {
+ return ((org.opensaml.saml.saml2.core.SubjectQuery) msg).getSubject().getNameID().getFormat();
+ }
+ } else if (msg instanceof org.opensaml.saml.saml1.core.SubjectQuery) {
+
+ if (((org.opensaml.saml.saml1.core.SubjectQuery) msg).getSubject() != null &&
+ ((org.opensaml.saml.saml1.core.SubjectQuery) msg).getSubject().getNameIdentifier() != null) {
+ return ((org.opensaml.saml.saml1.core.SubjectQuery)
+ msg).getSubject().getNameIdentifier().getFormat();
+ }
} else if (msg instanceof org.opensaml.saml.saml2.core.Assertion) {
return apply((org.opensaml.saml.saml2.core.Assertion) msg);
@@ -101,7 +115,7 @@ public class NameIDFormatAuditExtractor implements Function<ProfileRequestContex
return null;
}
-// Checkstyle: CyclomaticComplexity ON
+// Checkstyle: CyclomaticComplexity|ReturnCount ON
/**
* Apply function to an assertion.
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDPolicyFormatAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDPolicyFormatAuditExtractor.java
new file mode 100644
index 0000000..004687d
--- /dev/null
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDPolicyFormatAuditExtractor.java
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.SAMLObject;
+import org.opensaml.saml.saml2.core.ArtifactResponse;
+import org.opensaml.saml.saml2.core.AuthnRequest;
+
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/** {@link Function} that returns the NameID Format from a NameIDPolicy element. */
+public class NameIDPolicyFormatAuditExtractor implements Function<ProfileRequestContext,String> {
+
+ /** Lookup strategy for message to read from. */
+ @Nonnull private final Function<ProfileRequestContext,SAMLObject> messageLookupStrategy;
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for message
+ */
+ public NameIDPolicyFormatAuditExtractor(@Nonnull final Function<ProfileRequestContext,SAMLObject> strategy) {
+ messageLookupStrategy = Constraint.isNotNull(strategy, "Response lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public String apply(@Nullable final ProfileRequestContext input) {
+ SAMLObject msg = messageLookupStrategy.apply(input);
+ if (msg != null) {
+
+ // Step down into ArtifactResponses.
+ if (msg instanceof ArtifactResponse) {
+ msg = ((ArtifactResponse) msg).getMessage();
+ }
+
+ if (msg instanceof AuthnRequest) {
+ if (((AuthnRequest) msg).getNameIDPolicy() != null &&
+ ((AuthnRequest) msg).getNameIDPolicy().getFormat() != null) {
+ return ((AuthnRequest) msg).getNameIDPolicy().getFormat();
+ }
+
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDPolicySPNameQualifierAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDPolicySPNameQualifierAuditExtractor.java
new file mode 100644
index 0000000..458ad3e
--- /dev/null
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDPolicySPNameQualifierAuditExtractor.java
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.SAMLObject;
+import org.opensaml.saml.saml2.core.ArtifactResponse;
+import org.opensaml.saml.saml2.core.AuthnRequest;
+
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/** {@link Function} that returns the SPNameQualifier from a NameIDPolicy element. */
+public class NameIDPolicySPNameQualifierAuditExtractor implements Function<ProfileRequestContext,String> {
+
+ /** Lookup strategy for message to read from. */
+ @Nonnull private final Function<ProfileRequestContext,SAMLObject> messageLookupStrategy;
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for message
+ */
+ public NameIDPolicySPNameQualifierAuditExtractor(
+ @Nonnull final Function<ProfileRequestContext,SAMLObject> strategy) {
+ messageLookupStrategy = Constraint.isNotNull(strategy, "Response lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public String apply(@Nullable final ProfileRequestContext input) {
+ SAMLObject msg = messageLookupStrategy.apply(input);
+ if (msg != null) {
+
+ // Step down into ArtifactResponses.
+ if (msg instanceof ArtifactResponse) {
+ msg = ((ArtifactResponse) msg).getMessage();
+ }
+
+ if (msg instanceof AuthnRequest) {
+ if (((AuthnRequest) msg).getNameIDPolicy() != null &&
+ ((AuthnRequest) msg).getNameIDPolicy().getSPNameQualifier() != null) {
+ return ((AuthnRequest) msg).getNameIDPolicy().getSPNameQualifier();
+ }
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SPNameQualifierAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SPNameQualifierAuditExtractor.java
new file mode 100644
index 0000000..de75c44
--- /dev/null
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SPNameQualifierAuditExtractor.java
@@ -0,0 +1,107 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.SAMLObject;
+import org.opensaml.saml.saml2.core.ArtifactResponse;
+import org.opensaml.saml.saml2.core.Assertion;
+import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.core.LogoutRequest;
+import org.opensaml.saml.saml2.core.Response;
+import org.opensaml.saml.saml2.core.SubjectQuery;
+
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/** {@link Function} that returns the SPNameQualifier from a SAML Subject. */
+public class SPNameQualifierAuditExtractor implements Function<ProfileRequestContext,String> {
+
+ /** Lookup strategy for message to read from. */
+ @Nonnull private final Function<ProfileRequestContext,SAMLObject> messageLookupStrategy;
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for message
+ */
+ public SPNameQualifierAuditExtractor(@Nonnull final Function<ProfileRequestContext,SAMLObject> strategy) {
+ messageLookupStrategy = Constraint.isNotNull(strategy, "Response lookup strategy cannot be null");
+ }
+
+// Checkstyle: CyclomaticComplexity OFF
+ /** {@inheritDoc} */
+ @Nullable public String apply(@Nullable final ProfileRequestContext input) {
+ SAMLObject msg = messageLookupStrategy.apply(input);
+ if (msg != null) {
+
+ // Step down into ArtifactResponses.
+ if (msg instanceof ArtifactResponse) {
+ msg = ((ArtifactResponse) msg).getMessage();
+ }
+
+ if (msg instanceof Response) {
+ for (final Assertion assertion : ((Response) msg).getAssertions()) {
+ final String qualifier = apply(assertion);
+ if (qualifier != null) {
+ return qualifier;
+ }
+ }
+ } else if (msg instanceof LogoutRequest) {
+ if (((LogoutRequest) msg).getNameID() != null) {
+ return ((LogoutRequest) msg).getNameID().getSPNameQualifier();
+ }
+
+ } else if (msg instanceof AuthnRequest) {
+ if (((AuthnRequest) msg).getSubject() != null &&
+ ((AuthnRequest) msg).getSubject().getNameID() != null) {
+ return ((AuthnRequest) msg).getSubject().getNameID().getSPNameQualifier();
+ }
+ } else if (msg instanceof SubjectQuery) {
+ if (((SubjectQuery) msg).getSubject() != null &&
+ ((SubjectQuery) msg).getSubject().getNameID() != null) {
+ return ((SubjectQuery) msg).getSubject().getNameID().getSPNameQualifier();
+ }
+ } else if (msg instanceof Assertion) {
+ return apply((Assertion) msg);
+ }
+ }
+
+ return null;
+ }
+// Checkstyle: CyclomaticComplexity ON
+
+ /**
+ * Apply function to an assertion.
+ *
+ * @param assertion assertion to operate on
+ *
+ * @return the format, or null
+ */
+ @Nullable private String apply(@Nonnull final Assertion assertion) {
+ if (assertion.getSubject() != null && assertion.getSubject().getNameID() != null) {
+ return assertion.getSubject().getNameID().getSPNameQualifier();
+ }
+ return null;
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list