[java-identity-provider] 02/08: Support additional Audience values for SAML 2 Assertion validation

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=0288fa78eee6b7631c9dd13b332c23e57198d76e

commit 0288fa78eee6b7631c9dd13b332c23e57198d76e
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Jan 29 16:39:21 2020 -0500

    Support additional Audience values for SAML 2 Assertion validation
---
 .../system/flows/authn/saml-authn-beans.xml        |  3 ++
 ...itionalAudiencesForAssertionLookupFunction.java | 53 ++++++++++++++++++++++
 2 files changed, 56 insertions(+)

diff --git a/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml
index 3729a29..6405a48 100644
--- a/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml
@@ -335,6 +335,9 @@
         <property name="maximumTimeSinceAuthn">
             <bean class="net.shibboleth.idp.saml.saml2.profile.config.navigate.MaximumTimeSinceAuthnLookupFunction" />
         </property>
+        <property name="additionalAudiences">
+            <bean class="net.shibboleth.idp.saml.profile.config.navigate.AdditionalAudiencesForAssertionLookupFunction" />
+        </property>
         <property name="signatureRequired">
             <bean parent="shibboleth.Conditions.NOT">
                 <constructor-arg>
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AdditionalAudiencesForAssertionLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AdditionalAudiencesForAssertionLookupFunction.java
new file mode 100644
index 0000000..b1efd79
--- /dev/null
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AdditionalAudiencesForAssertionLookupFunction.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.profile.config.navigate;
+
+import java.util.Set;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.profile.config.ProfileConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.idp.saml.profile.config.SAMLProfileConfiguration;
+
+/**
+ * A function that returns {@link SAMLProfileConfiguration#getAdditionalAudiencesForAssertion(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ * 
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class AdditionalAudiencesForAssertionLookupFunction extends AbstractRelyingPartyLookupFunction<Set<String>> {
+
+    /** {@inheritDoc} */
+    @Nullable public Set<String> apply(@Nullable final ProfileRequestContext input) {
+        final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+        if (rpc != null) {
+            final ProfileConfiguration pc = rpc.getProfileConfig();
+            if (pc != null && pc instanceof SAMLProfileConfiguration) {
+                return ((SAMLProfileConfiguration) pc).getAdditionalAudiencesForAssertion(input);
+            }
+        }
+        
+        return null;
+    }
+
+}
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.