[java-identity-provider] branch master updated: IDP-1585 - Add issuer-based NameIDFormat filter policy rule
Scott Cantor
cantor.2 at osu.edu
Mon Jul 6 19:55:36 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=2fc5765278dc8831d599db65df2eda6fc844a202
The following commit(s) were added to refs/heads/master by this push:
new 2fc576527 IDP-1585 - Add issuer-based NameIDFormat filter policy rule
2fc576527 is described below
commit 2fc5765278dc8831d599db65df2eda6fc844a202
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jul 6 15:55:39 2020 -0400
IDP-1585 - Add issuer-based NameIDFormat filter policy rule
https://issues.shibboleth.net/jira/browse/IDP-1585
---
...va => AbstractNameIDFormatExactPolicyRule.java} | 28 ++------
...AttributeIssuerNameIDFormatExactPolicyRule.java | 65 +++++++++++++++++
...ributeRequesterNameIDFormatExactPolicyRule.java | 81 +---------------------
...ibuteIssuerNameIDFormatExactPolicyRuleTest.java | 52 ++++++++++++++
.../policyrule/saml/impl/BaseMetadataTests.java | 4 --
.../filter/impl/saml/shibboleth.net-metadata.xml | 52 ++++++++++++++
.../impl/AttributeFilterNamespaceHandler.java | 10 ++-
...er.java => AbstractNameIDFormatRuleParser.java} | 18 +----
... => AttributeIssuerNameIDFormatRuleParser.java} | 28 ++------
... AttributeRequesterNameIDFormatRuleParser.java} | 18 +----
...AttributeIssuerNameIDFormatRuleParserTest.java} | 18 ++---
...ributeRequesterNameIDFormatRuleParserTest.java} | 9 +--
.../attribute/filter/policyrule/issuerNameId2.xml | 6 ++
.../src/main/resources/schema/shibboleth-afp.xsd | 14 +++-
14 files changed, 228 insertions(+), 175 deletions(-)
diff --git a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterNameIDFormatExactPolicyRule.java b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AbstractNameIDFormatExactPolicyRule.java
similarity index 80%
copy from idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterNameIDFormatExactPolicyRule.java
copy to idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AbstractNameIDFormatExactPolicyRule.java
index 3a682c133..57f809ea8 100644
--- a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterNameIDFormatExactPolicyRule.java
+++ b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AbstractNameIDFormatExactPolicyRule.java
@@ -30,18 +30,16 @@ import net.shibboleth.utilities.java.support.component.ComponentInitializationEx
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
import org.opensaml.saml.saml2.metadata.NameIDFormat;
-import org.opensaml.saml.saml2.metadata.RoleDescriptor;
import org.opensaml.saml.saml2.metadata.SSODescriptor;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
/** Checks if the attribute issuer supports the required NameID format. */
-public class AttributeRequesterNameIDFormatExactPolicyRule extends AbstractPolicyRule {
+public abstract class AbstractNameIDFormatExactPolicyRule extends AbstractPolicyRule {
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AttributeRequesterNameIDFormatExactPolicyRule.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractNameIDFormatExactPolicyRule.class);
/** The NameID format that needs to be supported by the entity. */
@NonnullAfterInit @NotEmpty private String nameIdFormat;
@@ -83,26 +81,8 @@ public class AttributeRequesterNameIDFormatExactPolicyRule extends AbstractPolic
*
* @return the SSO role descriptor of the entity or null if the entity does not have such a descriptor
*/
- @Nullable protected SSODescriptor getEntitySSODescriptor(@Nonnull final AttributeFilterContext filterContext) {
- final SAMLMetadataContext metadataContext = filterContext.getRequesterMetadataContext();
-
- if (null == metadataContext) {
- log.debug("{} No requester metadata context found", getLogPrefix());
- return null;
- }
- final RoleDescriptor role = metadataContext.getRoleDescriptor();
- if (null == role) {
- log.warn("{} Could not locate RoleDescriptor in requester metadata context", getLogPrefix());
- return null;
- }
-
- if (role instanceof SSODescriptor) {
- return (SSODescriptor) role;
- }
- log.warn("{} Located Role descriptor was of type {} and so could not be used", getLogPrefix(), role.getClass()
- .toString());
- return null;
- }
+ @Nullable protected abstract SSODescriptor getEntitySSODescriptor(
+ @Nonnull final AttributeFilterContext filterContext);
/**
* Checks to see if the metadata for the entity supports the required NameID format.
diff --git a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerNameIDFormatExactPolicyRule.java b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerNameIDFormatExactPolicyRule.java
new file mode 100644
index 000000000..e79e41936
--- /dev/null
+++ b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerNameIDFormatExactPolicyRule.java
@@ -0,0 +1,65 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.policyrule.saml.impl;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
+
+import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
+import org.opensaml.saml.saml2.metadata.RoleDescriptor;
+import org.opensaml.saml.saml2.metadata.SSODescriptor;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/** Checks if the attribute issuer supports the required NameID format. */
+public class AttributeIssuerNameIDFormatExactPolicyRule extends AbstractNameIDFormatExactPolicyRule {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AttributeIssuerNameIDFormatExactPolicyRule.class);
+
+ /**
+ * Gets the SSO role descriptor for the entity to be checked.
+ *
+ * @param filterContext current filtering context
+ *
+ * @return the SSO role descriptor of the entity or null if the entity does not have such a descriptor
+ */
+ @Nullable protected SSODescriptor getEntitySSODescriptor(@Nonnull final AttributeFilterContext filterContext) {
+ final SAMLMetadataContext metadataContext = filterContext.getIssuerMetadataContext();
+
+ if (null == metadataContext) {
+ log.debug("{} No requester metadata context found", getLogPrefix());
+ return null;
+ }
+ final RoleDescriptor role = metadataContext.getRoleDescriptor();
+ if (null == role) {
+ log.warn("{} Could not locate RoleDescriptor in requester metadata context", getLogPrefix());
+ return null;
+ }
+
+ if (role instanceof SSODescriptor) {
+ return (SSODescriptor) role;
+ }
+ log.warn("{} Located Role descriptor was of type {} and so could not be used", getLogPrefix(), role.getClass()
+ .toString());
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterNameIDFormatExactPolicyRule.java b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterNameIDFormatExactPolicyRule.java
index 3a682c133..1b352cfdd 100644
--- a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterNameIDFormatExactPolicyRule.java
+++ b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeRequesterNameIDFormatExactPolicyRule.java
@@ -17,65 +17,23 @@
package net.shibboleth.idp.attribute.filter.policyrule.saml.impl;
-import java.util.List;
-
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
-import net.shibboleth.idp.attribute.filter.policyrule.impl.AbstractPolicyRule;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
-import org.opensaml.saml.saml2.metadata.NameIDFormat;
import org.opensaml.saml.saml2.metadata.RoleDescriptor;
import org.opensaml.saml.saml2.metadata.SSODescriptor;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-/** Checks if the attribute issuer supports the required NameID format. */
-public class AttributeRequesterNameIDFormatExactPolicyRule extends AbstractPolicyRule {
+/** Checks if the attribute requester supports the required NameID format. */
+public class AttributeRequesterNameIDFormatExactPolicyRule extends AbstractNameIDFormatExactPolicyRule {
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(AttributeRequesterNameIDFormatExactPolicyRule.class);
- /** The NameID format that needs to be supported by the entity. */
- @NonnullAfterInit @NotEmpty private String nameIdFormat;
-
- /**
- * Get the NameID format that needs to be supported by the entity.
- *
- * @return NameID format that needs to be supported by the entity
- */
- @NonnullAfterInit @NotEmpty public String getNameIdFormat() {
- return nameIdFormat;
- }
-
- /**
- * Sets the NameID format that needs to be supported by the entity.
- *
- * @param format NameID format that needs to be supported by the entity
- */
- public void setNameIdFormat(@Nullable final String format) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- nameIdFormat = StringSupport.trimOrNull(format);
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (null == nameIdFormat) {
- throw new ComponentInitializationException(getLogPrefix() + " No NameID format specified");
- }
- }
-
/**
* Gets the SSO role descriptor for the entity to be checked.
*
@@ -104,39 +62,4 @@ public class AttributeRequesterNameIDFormatExactPolicyRule extends AbstractPolic
return null;
}
- /**
- * Checks to see if the metadata for the entity supports the required NameID format.
- *
- * @param filterContext current filter context
- *
- * @return true if the entity supports the required NameID format, false otherwise
- * {@inheritDoc}
- */
- @Override
- public Tristate matches(@Nonnull final AttributeFilterContext filterContext) {
- ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
-
- final SSODescriptor role = getEntitySSODescriptor(filterContext);
- if (role == null) {
- // logged in above
- return Tristate.FALSE;
- }
-
- final List<NameIDFormat> supportedFormats = role.getNameIDFormats();
- if (supportedFormats == null || supportedFormats.isEmpty()) {
- log.debug("{} Entity SSO role descriptor does not list any supported NameID formats", getLogPrefix());
- return Tristate.FALSE;
- }
-
- for (final NameIDFormat supportedFormat : supportedFormats) {
- if (nameIdFormat.equals(supportedFormat.getURI())) {
- log.debug("{} Entity does support the NameID format '{}'", getLogPrefix(), nameIdFormat);
- return Tristate.TRUE;
- }
- }
-
- log.debug("{} Entity does not support the NameID format '{}'", getLogPrefix(), nameIdFormat);
- return Tristate.FALSE;
- }
-
}
\ No newline at end of file
diff --git a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerNameIDFormatExactPolicyRuleTest.java b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerNameIDFormatExactPolicyRuleTest.java
new file mode 100644
index 000000000..763e6d293
--- /dev/null
+++ b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/AttributeIssuerNameIDFormatExactPolicyRuleTest.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.policyrule.saml.impl;
+
+import static org.testng.Assert.assertEquals;
+
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.attribute.filter.PolicyRequirementRule.Tristate;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+
+/**
+ * test for {@link AttributeIssuerNameIDFormatExactPolicyRule}.
+ */
+ at SuppressWarnings("javadoc")
+public class AttributeIssuerNameIDFormatExactPolicyRuleTest extends BaseMetadataTests {
+
+ private AttributeIssuerNameIDFormatExactPolicyRule getMatcher(String format) throws ComponentInitializationException {
+ AttributeIssuerNameIDFormatExactPolicyRule matcher = new AttributeIssuerNameIDFormatExactPolicyRule();
+ matcher.setId("matcher");
+ matcher.setNameIdFormat(format);
+ matcher.initialize();
+ return matcher;
+ }
+
+
+ @Test public void simple() throws ComponentInitializationException {
+ AttributeIssuerNameIDFormatExactPolicyRule matcher = getMatcher("https://example.org/foo");
+
+ assertEquals(matcher.getNameIdFormat(), "https://example.org/foo");
+
+ assertEquals(matcher.matches(issMetadataContext(noneEntity, "Principal")), Tristate.FALSE);
+ assertEquals(matcher.matches(issMetadataContext(idpEntity, "Principal")), Tristate.TRUE);
+ assertEquals(matcher.matches(issMetadataContext(jiraEntity, "Principal")), Tristate.FALSE);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/BaseMetadataTests.java b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/BaseMetadataTests.java
index 67c03d149..6a4c5a894 100644
--- a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/BaseMetadataTests.java
+++ b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/saml/impl/BaseMetadataTests.java
@@ -22,7 +22,6 @@ import java.util.Collections;
import net.shibboleth.ext.spring.service.MockApplicationContext;
import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
-import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeRequesterEntityAttributeExactPolicyRule;
import net.shibboleth.idp.attribute.transcoding.impl.AttributeTranscoderRegistryImpl;
import net.shibboleth.idp.saml.attribute.transcoding.AbstractSAML2AttributeTranscoder;
import net.shibboleth.idp.saml.metadata.impl.AttributeMappingNodeProcessor;
@@ -41,9 +40,6 @@ import org.opensaml.saml.saml2.metadata.EntitiesDescriptor;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
import org.testng.annotations.BeforeClass;
-/**
- * tests for {@link AttributeRequesterEntityAttributeExactPolicyRule}.
- */
@SuppressWarnings("javadoc")
public class BaseMetadataTests extends XMLObjectBaseTestCase {
diff --git a/idp-attribute-filter-impl/src/test/resources/net/shibboleth/idp/filter/impl/saml/shibboleth.net-metadata.xml b/idp-attribute-filter-impl/src/test/resources/net/shibboleth/idp/filter/impl/saml/shibboleth.net-metadata.xml
index 690b343e5..cccb6b207 100644
--- a/idp-attribute-filter-impl/src/test/resources/net/shibboleth/idp/filter/impl/saml/shibboleth.net-metadata.xml
+++ b/idp-attribute-filter-impl/src/test/resources/net/shibboleth/idp/filter/impl/saml/shibboleth.net-metadata.xml
@@ -78,6 +78,7 @@
</KeyDescriptor>
<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+ <NameIDFormat>https://example.org/foo</NameIDFormat>
<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idp.shibboleth.net/idp/profile/SAML2/POST/SSO"/>
@@ -318,6 +319,57 @@ NtrvvBkq2tvnd6wm1DJNDzZQB/nRpCadwp4a64Qa0XJiGCoxFUvkd1+RSHqbBsEF
<alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
</Extensions>
+ <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+
+ <Extensions>
+ <shibmd:Scope regexp="false">shibboleth.net</shibmd:Scope>
+
+ <mdui:UIInfo>
+ <mdui:DisplayName xml:lang="en">Shibboleth.net</mdui:DisplayName>
+ <mdui:Description xml:lang="en">An identity provider hosted and used by the developers of Shibboleth.</mdui:Description>
+ <mdui:Logo height="82" width="64">https://discovery.shibboleth.net/images/gryphon_64x82.png</mdui:Logo>
+ </mdui:UIInfo>
+ </Extensions>
+
+ <KeyDescriptor>
+ <ds:KeyInfo>
+ <ds:X509Data>
+ <ds:X509Certificate>
+ MIIDNDCCAhygAwIBAgIVAKyBWnv1/h1U11C7kHvV33FIrEsJMA0GCSqGSIb3DQEB
+ BQUAMB0xGzAZBgNVBAMTEmlkcC5zaGliYm9sZXRoLm5ldDAeFw0xMDEyMjkwMDA5
+ MTlaFw0zMDEyMjkwMDA5MTlaMB0xGzAZBgNVBAMTEmlkcC5zaGliYm9sZXRoLm5l
+ dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKjWAdpUx/82FUzrRMfA
+ M63PkZZYCm3RnT3eiL+DeJcbGdcEJx/o+32vgHXJgJOBt14YdVam5GErIYgk4SGq
+ 5Z5RYl0PpQn6HQG/9prGnYCu6p5zfb0557o51Eh8TcVehS6Y2ruyCjAF0jgVMwh5
+ /0Oh8EE9wG93pSpm70DAiiaTVCb8WoT1aZYtxbBmmuH10bU+wge/NMmaHuVAe599
+ pyezFIL4FoI2g+1Q6nG4Yl1Z07I81tTApXKVMWRt/4/M3m2D7PUMOQ9qsxthp2L/
+ LovIeNo0bTyeW290T2Y/JRZhKOgeDqkhuu82DPri2Vm5G/unB69KfRB7CF9QWIc3
+ y80CAwEAAaNrMGkwSAYDVR0RBEEwP4ISaWRwLnNoaWJib2xldGgubmV0hilodHRw
+ czovL2lkcC5zaGliYm9sZXRoLm5ldC9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4EFgQU
+ 3uZ32tKXJBzPCTp2dtHSLV0FvGgwDQYJKoZIhvcNAQEFBQADggEBAAYXYuzp0UTj
+ 3yLRvUCbEtaw9b80+weOELkVv3WFY3QAG8pIKEblrMMtzrzLFWZwYwwMZDab/HnH
+ egmgjZBthrOedEmoJ+OHRmIiS8zdZxVGEadJhTUaeIkO6kwK7Ht3nQePoiXV7TI5
+ +A9SpmZGoukC85Za4wGDw4xWGs5t5l6tBuuV+1s0oC6T8ih5n/NyThfpbihSW0d7
+ iBfSUickgpoM2BLM3FCnbO8HOsX1rGV4ypG9ZGDDvr2jrzalXXmc05gSlL2qd9ce
+ Q1M+9vavusPCqlj2zZf2/HfzhyiFcb/OgA0oTFWW2ynXji6UarIV5QaPoi/XmGmx
+ BXD36HfGBXk= </ds:X509Certificate>
+ </ds:X509Data>
+
+ </ds:KeyInfo>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
+ <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
+ </KeyDescriptor>
+
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idp.shibboleth.net/idp/profile/SAML2/POST/SSO"/>
+
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://idp.shibboleth.net/idp/profile/SAML2/POST-SimpleSign/SSO"/>
+
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.shibboleth.net/idp/profile/SAML2/Redirect/SSO"/>
+ </IDPSSODescriptor>
+
<SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol urn:oasis:names:tc:SAML:2.0:protocol">
<Extensions>
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
index bbb087551..c94653a7c 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
@@ -46,11 +46,12 @@ import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeInMetadataR
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeIssuerEntityAttributeExactRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeIssuerEntityAttributeRegexRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeIssuerInEntityGroupRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeIssuerNameIDFormatRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeIssuerRegistrationAuthorityRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterEntityAttributeExactRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterEntityAttributeRegexRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterInEntityGroupRuleParser;
-import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterNameIdFormatRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterNameIDFormatRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterRegistrationAuthorityRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.MappedAttributeInMetadataRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.ScopeMatchesShibMDScopeParser;
@@ -141,8 +142,11 @@ public class AttributeFilterNamespaceHandler extends BaseSpringNamespaceHandler
registerBeanDefinitionParser(AttributeIssuerEntityAttributeRegexRuleParser.SCHEMA_TYPE,
new AttributeIssuerEntityAttributeRegexRuleParser());
- registerBeanDefinitionParser(AttributeRequesterNameIdFormatRuleParser.SCHEMA_TYPE,
- new AttributeRequesterNameIdFormatRuleParser());
+ registerBeanDefinitionParser(AttributeRequesterNameIDFormatRuleParser.SCHEMA_TYPE,
+ new AttributeRequesterNameIDFormatRuleParser());
+
+ registerBeanDefinitionParser(AttributeIssuerNameIDFormatRuleParser.SCHEMA_TYPE,
+ new AttributeIssuerNameIDFormatRuleParser());
registerBeanDefinitionParser(AttributeRequesterInEntityGroupRuleParser.SCHEMA_TYPE,
new AttributeRequesterInEntityGroupRuleParser());
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterNameIdFormatRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AbstractNameIDFormatRuleParser.java
similarity index 69%
copy from idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterNameIdFormatRuleParser.java
copy to idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AbstractNameIDFormatRuleParser.java
index 50ddb07c5..21a816f81 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterNameIdFormatRuleParser.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AbstractNameIDFormatRuleParser.java
@@ -18,10 +18,7 @@
package net.shibboleth.idp.attribute.filter.spring.saml.impl;
import javax.annotation.Nonnull;
-import javax.xml.namespace.QName;
-import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeRequesterNameIDFormatExactPolicyRule;
-import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.BasePolicyRuleParser;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
@@ -30,18 +27,9 @@ import org.springframework.beans.factory.xml.ParserContext;
import org.w3c.dom.Element;
/**
- * Parser for {@link AttributeRequesterNameIDFormatExactPolicyRule}.
+ * Parser for NameIDFormat rules.
*/
-public class AttributeRequesterNameIdFormatRuleParser extends BasePolicyRuleParser {
-
- /** Schema type. */
- public static final QName SCHEMA_TYPE = new QName(BaseFilterParser.NAMESPACE,
- "NameIDFormatExactMatch");
-
- /** {@inheritDoc} */
- @Override @Nonnull protected Class<AttributeRequesterNameIDFormatExactPolicyRule> getNativeBeanClass() {
- return AttributeRequesterNameIDFormatExactPolicyRule.class;
- }
+public abstract class AbstractNameIDFormatRuleParser extends BasePolicyRuleParser {
/** {@inheritDoc} */
@Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
@@ -51,4 +39,4 @@ public class AttributeRequesterNameIdFormatRuleParser extends BasePolicyRulePars
StringSupport.trimOrNull(element.getAttributeNS(null, "nameIdFormat")));
}
-}
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterNameIdFormatRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeIssuerNameIDFormatRuleParser.java
similarity index 53%
copy from idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterNameIdFormatRuleParser.java
copy to idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeIssuerNameIDFormatRuleParser.java
index 50ddb07c5..055873ff2 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterNameIdFormatRuleParser.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeIssuerNameIDFormatRuleParser.java
@@ -20,35 +20,21 @@ package net.shibboleth.idp.attribute.filter.spring.saml.impl;
import javax.annotation.Nonnull;
import javax.xml.namespace.QName;
-import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeRequesterNameIDFormatExactPolicyRule;
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeIssuerNameIDFormatExactPolicyRule;
import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
-import net.shibboleth.idp.attribute.filter.spring.policyrule.BasePolicyRuleParser;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
/**
- * Parser for {@link AttributeRequesterNameIDFormatExactPolicyRule}.
+ * Parser for {@link AttributeIssuerNameIDFormatExactPolicyRule}.
*/
-public class AttributeRequesterNameIdFormatRuleParser extends BasePolicyRuleParser {
+public class AttributeIssuerNameIDFormatRuleParser extends AbstractNameIDFormatRuleParser {
/** Schema type. */
public static final QName SCHEMA_TYPE = new QName(BaseFilterParser.NAMESPACE,
- "NameIDFormatExactMatch");
+ "IssuerNameIDFormatExactMatch");
/** {@inheritDoc} */
- @Override @Nonnull protected Class<AttributeRequesterNameIDFormatExactPolicyRule> getNativeBeanClass() {
- return AttributeRequesterNameIDFormatExactPolicyRule.class;
- }
-
- /** {@inheritDoc} */
- @Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
- @Nonnull final BeanDefinitionBuilder builder) {
-
- builder.addPropertyValue("nameIdFormat",
- StringSupport.trimOrNull(element.getAttributeNS(null, "nameIdFormat")));
+ @Override @Nonnull protected Class<AttributeIssuerNameIDFormatExactPolicyRule> getNativeBeanClass() {
+ return AttributeIssuerNameIDFormatExactPolicyRule.class;
}
-}
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterNameIdFormatRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterNameIDFormatRuleParser.java
similarity index 67%
rename from idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterNameIdFormatRuleParser.java
rename to idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterNameIDFormatRuleParser.java
index 50ddb07c5..41f4a95ba 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterNameIdFormatRuleParser.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/saml/impl/AttributeRequesterNameIDFormatRuleParser.java
@@ -22,17 +22,11 @@ import javax.xml.namespace.QName;
import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeRequesterNameIDFormatExactPolicyRule;
import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
-import net.shibboleth.idp.attribute.filter.spring.policyrule.BasePolicyRuleParser;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
/**
* Parser for {@link AttributeRequesterNameIDFormatExactPolicyRule}.
*/
-public class AttributeRequesterNameIdFormatRuleParser extends BasePolicyRuleParser {
+public class AttributeRequesterNameIDFormatRuleParser extends AbstractNameIDFormatRuleParser {
/** Schema type. */
public static final QName SCHEMA_TYPE = new QName(BaseFilterParser.NAMESPACE,
@@ -43,12 +37,4 @@ public class AttributeRequesterNameIdFormatRuleParser extends BasePolicyRulePars
return AttributeRequesterNameIDFormatExactPolicyRule.class;
}
- /** {@inheritDoc} */
- @Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
- @Nonnull final BeanDefinitionBuilder builder) {
-
- builder.addPropertyValue("nameIdFormat",
- StringSupport.trimOrNull(element.getAttributeNS(null, "nameIdFormat")));
- }
-
-}
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeRequesterNameIdFormatRuleParserTest.java b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeIssuerNameIDFormatRuleParserTest.java
similarity index 73%
copy from idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeRequesterNameIdFormatRuleParserTest.java
copy to idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeIssuerNameIDFormatRuleParserTest.java
index 836d761ee..e20f8fe7c 100644
--- a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeRequesterNameIdFormatRuleParserTest.java
+++ b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeIssuerNameIDFormatRuleParserTest.java
@@ -21,20 +21,22 @@ import static org.testng.Assert.assertEquals;
import org.testng.annotations.Test;
-import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeRequesterNameIDFormatExactPolicyRule;
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeIssuerNameIDFormatExactPolicyRule;
import net.shibboleth.idp.attribute.filter.spring.BaseAttributeFilterParserTest;
-import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterNameIdFormatRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeIssuerNameIDFormatRuleParser;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
/**
- * test for {@link AttributeRequesterNameIdFormatRuleParser}.
+ * test for {@link AttributeIssuerNameIDFormatRuleParser}.
*/
-public class AttributeRequesterNameIdFormatRuleParserTest extends BaseAttributeFilterParserTest {
+public class AttributeIssuerNameIDFormatRuleParserTest extends BaseAttributeFilterParserTest {
- @SuppressWarnings("javadoc") @Test public void basic() throws ComponentInitializationException {
- final AttributeRequesterNameIDFormatExactPolicyRule rule =
- (AttributeRequesterNameIDFormatExactPolicyRule) getPolicyRule("requesterNameId2.xml");
+ @SuppressWarnings("javadoc")
+ @Test public void basic() throws ComponentInitializationException {
+ final AttributeIssuerNameIDFormatExactPolicyRule rule =
+ (AttributeIssuerNameIDFormatExactPolicyRule) getPolicyRule("issuerNameId2.xml");
assertEquals(rule.getNameIdFormat(), "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent");
}
-}
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeRequesterNameIdFormatRuleParserTest.java b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeRequesterNameIDFormatRuleParserTest.java
similarity index 91%
rename from idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeRequesterNameIdFormatRuleParserTest.java
rename to idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeRequesterNameIDFormatRuleParserTest.java
index 836d761ee..7e10a7646 100644
--- a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeRequesterNameIdFormatRuleParserTest.java
+++ b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/AttributeRequesterNameIDFormatRuleParserTest.java
@@ -23,13 +23,13 @@ import org.testng.annotations.Test;
import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AttributeRequesterNameIDFormatExactPolicyRule;
import net.shibboleth.idp.attribute.filter.spring.BaseAttributeFilterParserTest;
-import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterNameIdFormatRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeRequesterNameIDFormatRuleParser;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
/**
- * test for {@link AttributeRequesterNameIdFormatRuleParser}.
+ * test for {@link AttributeRequesterNameIDFormatRuleParser}.
*/
-public class AttributeRequesterNameIdFormatRuleParserTest extends BaseAttributeFilterParserTest {
+public class AttributeRequesterNameIDFormatRuleParserTest extends BaseAttributeFilterParserTest {
@SuppressWarnings("javadoc") @Test public void basic() throws ComponentInitializationException {
final AttributeRequesterNameIDFormatExactPolicyRule rule =
@@ -37,4 +37,5 @@ public class AttributeRequesterNameIdFormatRuleParserTest extends BaseAttributeF
assertEquals(rule.getNameIdFormat(), "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent");
}
-}
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/issuerNameId2.xml b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/issuerNameId2.xml
new file mode 100644
index 000000000..285a16410
--- /dev/null
+++ b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/issuerNameId2.xml
@@ -0,0 +1,6 @@
+<AttributeFilterPolicy id="MostBasicExample" xmlns="urn:mace:shibboleth:2.0:afp"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
+ <PolicyRequirementRule
+ xsi:type="IssuerNameIDFormatExactMatch" nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
+</AttributeFilterPolicy>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-afp.xsd b/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
index f8bbf7ba8..6aa5da5d7 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
@@ -3,7 +3,7 @@
xmlns:afp="urn:mace:shibboleth:2.0:afp"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
targetNamespace="urn:mace:shibboleth:2.0:afp"
- version="3.3.0"
+ version="4.1.0"
elementFormDefault="qualified">
<import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd"/>
@@ -713,6 +713,18 @@
</complexContent>
</complexType>
+ <complexType name="IssuerNameIDFormatExactMatch">
+ <annotation>
+ <documentation>
+ A match function that evaluates to true if the attribute issuer supports a specified
+ NameID format.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:NameIDFormatExactMatchType"/>
+ </complexContent>
+ </complexType>
+
<complexType name="NameIDFormatExactMatchType" abstract="true">
<complexContent>
<extension base="afp:MatchFunctorType">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list