[java-opensaml] 02/11: Support additional Audience values for SAML 2 Assertion validation

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch master
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=eae2cdddb2536b0405a1c936748a8a1411b703a5

commit eae2cdddb2536b0405a1c936748a8a1411b703a5
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Jan 29 16:38:48 2020 -0500

    Support additional Audience values for SAML 2 Assertion validation
---
 .../DefaultAssertionValidationContextBuilder.java  | 43 +++++++++++++++++++++-
 1 file changed, 41 insertions(+), 2 deletions(-)

diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java
index c375527..0763973 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java
@@ -94,6 +94,9 @@ public class DefaultAssertionValidationContextBuilder
     /** Predicate for determining whether to include the self entityID as a valid Recipient. */
     private Predicate<ProfileRequestContext> includeSelfEntityIDAsRecipient;
     
+    /** Function for determining additional valid audience values. */
+    private Function<ProfileRequestContext, Set<String>> additionalAudiences;
+
     /** Resolver for security parameters context. */
     private Function<ProfileRequestContext, SecurityParametersContext> securityParametersLookupStrategy;
 
@@ -208,6 +211,32 @@ public class DefaultAssertionValidationContextBuilder
     }
 
     /**
+     * Get the function for determining additional audience values.
+     *
+     * <p>
+     * Defaults to null.
+     * </p>
+     *
+     * @return the function
+     */
+    public Function<ProfileRequestContext,Set<String>> getAdditionalAudiences() {
+        return additionalAudiences;
+    }
+
+    /**
+     * Set the function for determining additional audience values.
+     *
+     * <p>
+     * Defaults to null.
+     * </p>
+     *
+     * @param function the function, may be null
+     */
+    public void setAdditionalAudiences(final @Nonnull Function<ProfileRequestContext,Set<String>> function) {
+        additionalAudiences = function;
+    }
+
+    /**
      * Get the function for determining the max allowed time since authentication.
      *
      * <p>
@@ -565,9 +594,12 @@ public class DefaultAssertionValidationContextBuilder
      * Get the valid audiences for attestation.
      * 
      * <p>
-     * This implementation returns a set containing the single entityID held by the message context's 
-     * {@link SAMLSelfEntityContext#getEntityId()}, if present.  Otherwise an empty set is returned.
+     * This implementation returns a set containing the union of:
      * </p>
+     * <ol>
+     * <li>the result of {@link #getSelfEntityID(AssertionValidationInput)}, if non-null</li>
+     * <li>the result of evaluating {@link #getAdditionalAudiences()}, if non-null</li>
+     * </ol>
      * 
      * @param input the assertion validation input
      * 
@@ -581,6 +613,13 @@ public class DefaultAssertionValidationContextBuilder
             validAudiences.add(selfEntityID);
         }
         
+        if (getAdditionalAudiences() != null) {
+            final Set<String> additional = getAdditionalAudiences().apply(input.getProfileRequestContext());
+            if (additional != null) {
+                validAudiences.addAll(additional);
+            }
+        }
+        
         log.debug("Resolved valid audiences set: {}", validAudiences);
         return validAudiences;
     }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.