[java-identity-provider] branch dev/IDP-1608 updated: IDP-1608 - Ability to supplement the list of default MetadataNodeProcessors
Scott Cantor
cantor.2 at osu.edu
Tue Jun 2 01:10:56 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch dev/IDP-1608
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f1dfc1b2558aa4e3e926786df0aa87599237d703
The following commit(s) were added to refs/heads/dev/IDP-1608 by this push:
new f1dfc1b25 IDP-1608 - Ability to supplement the list of default MetadataNodeProcessors
f1dfc1b25 is described below
commit f1dfc1b2558aa4e3e926786df0aa87599237d703
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jun 1 21:10:53 2020 -0400
IDP-1608 - Ability to supplement the list of default
MetadataNodeProcessors
https://issues.shibboleth.net/jira/browse/IDP-1608
Remove logic guarding attachment of default processors.
Move default set outside code into an overrideable bean.
---
.../system/conf/metadata-providers-system.xml | 12 ++-
.../NodeProcessingAttachingBeanPostProcessor.java | 117 +++++++--------------
2 files changed, 50 insertions(+), 79 deletions(-)
diff --git a/idp-conf/src/main/resources/system/conf/metadata-providers-system.xml b/idp-conf/src/main/resources/system/conf/metadata-providers-system.xml
index 5407fb850..c4246a7dc 100644
--- a/idp-conf/src/main/resources/system/conf/metadata-providers-system.xml
+++ b/idp-conf/src/main/resources/system/conf/metadata-providers-system.xml
@@ -18,8 +18,16 @@
p:enabled="%{idp.service.metadata.enableByReferenceFilters:true}" />
<bean class="net.shibboleth.idp.profile.spring.relyingparty.metadata.impl.NodeProcessingAttachingBeanPostProcessor"
- c:service-ref="shibboleth.AttributeRegistryService"
- p:enabled="%{idp.service.metadata.enableDefaultNodeProcessors:true}" />
+ p:nodeProcessors="#{getObject('shibboleth.MetadataNodeProcessors') ?: getObject('shibboleth.DefaultMetadataNodeProcessors')}" />
+
+ <util:list id="shibboleth.DefaultMetadataNodeProcessors">
+ <bean class="org.opensaml.saml.metadata.resolver.filter.impl.EntitiesDescriptorNameProcessor" />
+ <bean class="net.shibboleth.idp.saml.security.impl.KeyAuthorityNodeProcessor" />
+ <bean class="net.shibboleth.idp.saml.metadata.impl.ScopesNodeProcessor" />
+ <bean class="net.shibboleth.idp.saml.metadata.impl.UIInfoNodeProcessor" />
+ <bean class="net.shibboleth.idp.saml.metadata.impl.AttributeMappingNodeProcessor"
+ c:_0-ref="shibboleth.AttributeRegistryService" />
+ </util:list>
<!-- Signature Validation Criteria -->
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/NodeProcessingAttachingBeanPostProcessor.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/NodeProcessingAttachingBeanPostProcessor.java
index f9859d48e..4b6140f7a 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/NodeProcessingAttachingBeanPostProcessor.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/NodeProcessingAttachingBeanPostProcessor.java
@@ -17,10 +17,11 @@
package net.shibboleth.idp.profile.spring.relyingparty.metadata.impl;
-import java.util.ArrayList;
-import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
import java.util.List;
+import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.saml.metadata.resolver.ChainingMetadataResolver;
@@ -28,24 +29,17 @@ import org.opensaml.saml.metadata.resolver.MetadataResolver;
import org.opensaml.saml.metadata.resolver.filter.MetadataFilter;
import org.opensaml.saml.metadata.resolver.filter.MetadataFilterChain;
import org.opensaml.saml.metadata.resolver.filter.MetadataNodeProcessor;
-import org.opensaml.saml.metadata.resolver.filter.impl.EntitiesDescriptorNameProcessor;
import org.opensaml.saml.metadata.resolver.filter.impl.NodeProcessingMetadataFilter;
import org.springframework.beans.factory.BeanCreationException;
import org.springframework.beans.factory.config.BeanPostProcessor;
import org.springframework.core.Ordered;
-import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
-import net.shibboleth.idp.saml.metadata.impl.AttributeMappingNodeProcessor;
-import net.shibboleth.idp.saml.metadata.impl.ScopesNodeProcessor;
-import net.shibboleth.idp.saml.metadata.impl.UIInfoNodeProcessor;
-import net.shibboleth.idp.saml.security.impl.KeyAuthorityNodeProcessor;
-import net.shibboleth.utilities.java.support.annotation.ParameterName;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.service.ReloadableService;
/**
* A {@link BeanPostProcessor} for {@link MetadataResolver} beans that ensures a {@link NodeProcessingMetadataFilter}
- * containing a pair of default {@link MetadataNodeProcessor} plugins is attached.
+ * containing a set of default {@link MetadataNodeProcessor} plugins is attached.
*
* <p>
* This is done to ensure that other components function correctly, such as the PKIX trust engine and predicates that
@@ -54,21 +48,27 @@ import net.shibboleth.utilities.java.support.service.ReloadableService;
*/
public class NodeProcessingAttachingBeanPostProcessor implements BeanPostProcessor, Ordered {
- /** Whether to enable the processor. */
- private boolean enabled;
-
- /** The registry of decoding rules. */
- @Nullable private final ReloadableService<AttributeTranscoderRegistry> transcoderRegistry;
-
+ /** The processors to install. */
+ @Nonnull @NonnullElements private List<MetadataNodeProcessor> nodeProcessors;
+
+ /** Constructor. */
+ public NodeProcessingAttachingBeanPostProcessor() {
+ nodeProcessors = Collections.emptyList();
+ }
+
/**
- * Constructor.
- *
- * @param service the attribute resolver we use to map attributes
+ * Set the {@link MetadataNodeProcessor} instances to auto-attach.
+ *
+ * @param processors processors to auto-attach
+ *
+ * @since 4.1.0
*/
- public NodeProcessingAttachingBeanPostProcessor(
- @Nullable @ParameterName(name="service") final ReloadableService<AttributeTranscoderRegistry> service) {
- transcoderRegistry = service;
- enabled = true;
+ public void setNodeProcessors(@Nullable @NonnullElements final Collection<MetadataNodeProcessor> processors) {
+ if (processors != null) {
+ nodeProcessors = List.copyOf(processors);
+ } else {
+ nodeProcessors = Collections.emptyList();
+ }
}
/** {@inheritDoc} */
@@ -76,75 +76,38 @@ public class NodeProcessingAttachingBeanPostProcessor implements BeanPostProcess
return LOWEST_PRECEDENCE;
}
- /**
- * Set whether to enable the processor.
- *
- * @param flag flag to set
- */
- public void setEnabled(final boolean flag) {
- enabled = flag;
- }
-
- // Checkstyle: CyclomaticComplexity OFF
/** {@inheritDoc} */
@Override public Object postProcessBeforeInitialization(final Object bean, final String beanName) {
// Do not attach to beans which just include other ones.
- if (!enabled || !(bean instanceof MetadataResolver) || bean instanceof ChainingMetadataResolver) {
+ if (!(bean instanceof MetadataResolver) || bean instanceof ChainingMetadataResolver) {
return bean;
}
final MetadataResolver resolver = (MetadataResolver) bean;
- boolean filterAttached = false;
-
- final MetadataFilter filter = resolver.getMetadataFilter();
- if (filter != null) {
- if (filter instanceof NodeProcessingMetadataFilter) {
- filterAttached = true;
- } else if (filter instanceof MetadataFilterChain) {
- for (final MetadataFilter f : ((MetadataFilterChain) filter).getFilters()) {
- if (f instanceof NodeProcessingMetadataFilter) {
- filterAttached = true;
- break;
- }
- }
- }
+ final NodeProcessingMetadataFilter filterToAttach = new NodeProcessingMetadataFilter();
+ filterToAttach.setNodeProcessors(nodeProcessors);
+ try {
+ filterToAttach.initialize();
+ } catch (final ComponentInitializationException e) {
+ throw new BeanCreationException("Error initializing NodeProcessingMetadataFilter", e);
}
- if (!filterAttached) {
- final NodeProcessingMetadataFilter filterToAttach = new NodeProcessingMetadataFilter();
- final List<MetadataNodeProcessor> processors = new ArrayList<>(List.of(
- new EntitiesDescriptorNameProcessor(),
- new KeyAuthorityNodeProcessor(),
- new ScopesNodeProcessor(),
- new UIInfoNodeProcessor()));
- if (null != transcoderRegistry) {
- processors.add(new AttributeMappingNodeProcessor(transcoderRegistry));
- }
- filterToAttach.setNodeProcessors(processors);
- try {
- filterToAttach.initialize();
- } catch (final ComponentInitializationException e) {
- throw new BeanCreationException("Error initializing NodeProcessingMetadataFilter", e);
- }
-
- if (filter == null) {
- resolver.setMetadataFilter(filterToAttach);
- } else if (filter instanceof MetadataFilterChain) {
- ((MetadataFilterChain) filter).getFilters().add(filterToAttach);
- } else {
- final MetadataFilterChain chain = new MetadataFilterChain();
- chain.setFilters(Arrays.asList(filter, filterToAttach));
- resolver.setMetadataFilter(chain);
- }
+ final MetadataFilter filter = resolver.getMetadataFilter();
+ if (filter == null) {
+ resolver.setMetadataFilter(filterToAttach);
+ } else if (filter instanceof MetadataFilterChain) {
+ ((MetadataFilterChain) filter).getFilters().add(filterToAttach);
+ } else {
+ final MetadataFilterChain chain = new MetadataFilterChain();
+ chain.setFilters(List.of(filter, filterToAttach));
+ resolver.setMetadataFilter(chain);
}
return resolver;
}
- // Checkstyle: CyclomaticComplexity ON
-
/** {@inheritDoc} */
@Override public Object postProcessAfterInitialization(final Object bean, final String beanName) {
return bean;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list