[java-opensaml] 04/06: Add support for disabling check of SubjectConfirmationData at Address.

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch master
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=b980fb01ffadea0525faaa84bdb8a42ac5782847

commit b980fb01ffadea0525faaa84bdb8a42ac5782847
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Jan 22 22:26:18 2020 -0500

    Add support for disabling check of SubjectConfirmationData at Address.
---
 .../SAML2AssertionValidationParameters.java          |  6 ++++++
 .../impl/AbstractSubjectConfirmationValidator.java   | 20 ++++++++++++++++++--
 .../AbstractSubjectConfirmationValidatorTest.java    | 12 ++++++++++++
 3 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML2AssertionValidationParameters.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML2AssertionValidationParameters.java
index c346d6c..02f2fca 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML2AssertionValidationParameters.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML2AssertionValidationParameters.java
@@ -77,6 +77,12 @@ public final class SAML2AssertionValidationParameters {
     public static final String SC_VALID_RECIPIENTS = STD_PREFIX + SC_INFIX + ".ValidRecipients";
 
     /**
+     * Carries a {@link java.lang.Boolean} flag which indicates whether the
+     * {@link org.opensaml.saml.saml2.core.SubjectConfirmationData} address should be checked.
+     */
+    public static final String SC_CHECK_ADDRESS = STD_PREFIX + SC_INFIX + ".CheckAddress";
+
+    /**
      * Carries a {@link java.util.Set}<code><</code>{@link java.net.InetAddress}<code>></code>
      * whose values are the acceptable 
      * {@link org.opensaml.saml.saml2.core.SubjectConfirmationData} addresses.
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java
index 071208d..4047b52 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidator.java
@@ -52,8 +52,13 @@ import org.slf4j.LoggerFactory;
  * </p>
  * <ul>
  * <li>
+ * {@link SAML2AssertionValidationParameters#SC_CHECK_ADDRESS}:
+ * Optional.
+ * </li>
+ * <li>
  * {@link SAML2AssertionValidationParameters#SC_VALID_ADDRESSES}:
- * Required.
+ * Required if {@link SAML2AssertionValidationParameters#SC_CHECK_ADDRESS} is true or omitted,
+ * otherwise optional.
  * </li>
  * <li>
  * {@link SAML2AssertionValidationParameters#SC_VALID_RECIPIENTS}:
@@ -239,14 +244,24 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
      * 
      * @throws AssertionValidationException thrown if there is a problem determining the validity of the address
      */
+    // Checkstyle: CyclomaticComplexity OFF
     @Nonnull protected ValidationResult validateAddress(@Nonnull final SubjectConfirmation confirmation, 
             @Nonnull final Assertion assertion, @Nonnull final ValidationContext context) 
                     throws AssertionValidationException {
+
+        final Boolean checkAddress =
+                (Boolean) context.getStaticParameters().get(SAML2AssertionValidationParameters.SC_CHECK_ADDRESS);
+
+        if (checkAddress != null && !checkAddress) {
+            log.debug("SubjectConfirmationData at Address check is disabled, skipping");
+            return ValidationResult.VALID;
+        }
+
         final String address = StringSupport.trimOrNull(confirmation.getSubjectConfirmationData().getAddress());
         if (address == null) {
             return ValidationResult.VALID;
         }
-        
+
         log.debug("Evaluating SubjectConfirmationData at Address of : {}", address);
 
         final InetAddress[] confirmingAddresses;
@@ -297,6 +312,7 @@ public abstract class AbstractSubjectConfirmationValidator implements SubjectCon
                         .getID()));
         return ValidationResult.INVALID;
     }
+    // Checkstyle: CyclomaticComplexity ON
 
     /**
      * Performs any further validation required for the specific confirmation method implementation.
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidatorTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidatorTest.java
index f4aa843..5fea727 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidatorTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AbstractSubjectConfirmationValidatorTest.java
@@ -79,6 +79,18 @@ public class AbstractSubjectConfirmationValidatorTest extends BaseAssertionValid
     }
     
     @Test
+    public void testInvalidAddressWithAddressCheckDisabled() throws AssertionValidationException {
+        subjectConfirmation.getSubjectConfirmationData().setAddress("1.2.3.4");
+
+        Map<String,Object> staticParams = buildBasicStaticParameters();
+        staticParams.put(SAML2AssertionValidationParameters.SC_CHECK_ADDRESS, Boolean.FALSE);
+        ValidationContext validationContext = new ValidationContext(staticParams);
+
+        Assert.assertEquals(validator.validate(subjectConfirmation, getAssertion(), validationContext),
+                ValidationResult.VALID);
+    }
+
+    @Test
     public void testInvalidAddressParamType() throws AssertionValidationException {
         Map<String,Object> staticParams = buildBasicStaticParameters();
         // It should be a Set<String>, not a String

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.