[java-identity-provider] branch master updated: IDP-1562 - Audit field to log encryption algorithm used
Scott Cantor
cantor.2 at osu.edu
Wed Feb 26 18:46:34 EST 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=14fbfa0425c29c74ebdd4be2177ebea9d6ca324e
The following commit(s) were added to refs/heads/master by this push:
new 14fbfa0 IDP-1562 - Audit field to log encryption algorithm used
14fbfa0 is described below
commit 14fbfa0425c29c74ebdd4be2177ebea9d6ca324e
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Feb 26 18:46:29 2020 -0500
IDP-1562 - Audit field to log encryption algorithm used
https://issues.shibboleth.net/jira/browse/IDP-1562
---
idp-conf/src/main/resources/conf/audit.xml | 8 ++-
.../main/resources/system/conf/audit-system.xml | 6 ++
.../idp/saml/profile/SAMLAuditFields.java | 3 +
.../impl/EncryptionAlgorithmAuditExtractor.java | 72 ++++++++++++++++++++++
4 files changed, 88 insertions(+), 1 deletion(-)
diff --git a/idp-conf/src/main/resources/conf/audit.xml b/idp-conf/src/main/resources/conf/audit.xml
index 7245127..a9faf4c 100644
--- a/idp-conf/src/main/resources/conf/audit.xml
+++ b/idp-conf/src/main/resources/conf/audit.xml
@@ -14,7 +14,7 @@
This bean defines a mapping between audit log categories and formatting strings.
-->
<util:map id="shibboleth.AuditFormattingMap">
- <entry key="Shibboleth-Audit" value="%a|%ST|%T|%u|%SP|%i|%ac|%t|%attr|%n|%f|%SSO|%XX|%X|%b|%bb|%e|%S|%SS|%s|%UA" />
+ <entry key="Shibboleth-Audit" value="%a|%ST|%T|%u|%SP|%i|%ac|%t|%attr|%n|%f|%SSO|%XX|%XA|%b|%bb|%e|%S|%SS|%s|%UA" />
</util:map>
<!-- Override the format of date/time fields in the log and/or convert to default time zone. -->
@@ -40,6 +40,12 @@
<entry key="urn:oasis:names:tc:SAML:2.0:status:Success" value="Success" />
<entry key="urn:oasis:names:tc:SAML:2.0:status:Requester" value="Requester" />
<entry key="urn:oasis:names:tc:SAML:2.0:status:Responder" value="Responder" />
+ <entry key="http://www.w3.org/2009/xmlenc11#aes128-gcm" value="AES128-GCM" />
+ <entry key="http://www.w3.org/2009/xmlenc11#aes192-gcm" value="AES192-GCM" />
+ <entry key="http://www.w3.org/2009/xmlenc11#aes256-gcm" value="AES256-GCM" />
+ <entry key="http://www.w3.org/2001/04/xmlenc#aes128-cbc" value="AES128-CBC" />
+ <entry key="http://www.w3.org/2001/04/xmlenc#aes192-cbc" value="AES192-CBC" />
+ <entry key="http://www.w3.org/2001/04/xmlenc#aes256-cbc" value="AES256-CBC" />
</util:map>
</beans>
diff --git a/idp-conf/src/main/resources/system/conf/audit-system.xml b/idp-conf/src/main/resources/system/conf/audit-system.xml
index 1a4805b..4e66401 100644
--- a/idp-conf/src/main/resources/system/conf/audit-system.xml
+++ b/idp-conf/src/main/resources/system/conf/audit-system.xml
@@ -581,6 +581,12 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.ENCRYPTION_ALGORITHM"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.EncryptionAlgorithmAuditExtractor" />
+ </entry>
</map>
</property>
</bean>
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
index 3131858..8c613c1 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
@@ -107,6 +107,9 @@ public final class SAMLAuditFields {
/** Encryption field. */
@Nonnull @NotEmpty public static final String ENCRYPTION = "X";
+ /** Encryption algorithm field. */
+ @Nonnull @NotEmpty public static final String ENCRYPTION_ALGORITHM = "XA";
+
/** Constructor. */
private SAMLAuditFields() {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/EncryptionAlgorithmAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/EncryptionAlgorithmAuditExtractor.java
new file mode 100644
index 0000000..1f185fe
--- /dev/null
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/EncryptionAlgorithmAuditExtractor.java
@@ -0,0 +1,72 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.saml2.profile.context.EncryptionContext;
+
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/** {@link Function} that returns the data encryption algorithm used. */
+public class EncryptionAlgorithmAuditExtractor implements Function<ProfileRequestContext,String> {
+
+ /** Lookup strategy for {@link EncryptionContext}. */
+ @Nonnull private Function<ProfileRequestContext,EncryptionContext> encryptionContextLookupStrategy;
+
+ /** Constructor. */
+ public EncryptionAlgorithmAuditExtractor() {
+ encryptionContextLookupStrategy =
+ new ChildContextLookup<>(EncryptionContext.class).compose(
+ new ChildContextLookup<>(RelyingPartyContext.class));
+ }
+
+ /**
+ * Sets the lookup strategy for the {@link EncryptionContext}.
+ *
+ * @param strategy lookup strategy for context
+ */
+ public void setEncryptionContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,EncryptionContext> strategy) {
+ encryptionContextLookupStrategy =
+ Constraint.isNotNull(strategy, "EncryptionContext lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public String apply(@Nullable final ProfileRequestContext input) {
+
+ final EncryptionContext encryptionCtx = encryptionContextLookupStrategy.apply(input);
+ if (encryptionCtx != null) {
+ if (encryptionCtx.getAssertionEncryptionParameters() != null) {
+ return encryptionCtx.getAssertionEncryptionParameters().getDataEncryptionAlgorithm();
+ } else if (encryptionCtx.getAttributeEncryptionParameters() != null) {
+ return encryptionCtx.getAttributeEncryptionParameters().getDataEncryptionAlgorithm();
+ } else if (encryptionCtx.getIdentifierEncryptionParameters() != null) {
+ return encryptionCtx.getIdentifierEncryptionParameters().getDataEncryptionAlgorithm();
+ }
+ }
+ return null;
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list