[java-identity-provider] branch master updated: IDP-1619 - Deprecate terms from classes and configuration
Scott Cantor
cantor.2 at osu.edu
Tue Jun 9 22:55:58 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=1d511ead1ec3ef084aca2ec46e43f02c72d2055a
The following commit(s) were added to refs/heads/master by this push:
new 1d511ead1 IDP-1619 - Deprecate terms from classes and configuration
1d511ead1 is described below
commit 1d511ead1ec3ef084aca2ec46e43f02c72d2055a
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jun 9 18:55:56 2020 -0400
IDP-1619 - Deprecate terms from classes and configuration
https://issues.shibboleth.net/jira/browse/IDP-1619
Rename allow/deny lists in RemoteUserInternal flow.
---
.../idp/authn/impl/ValidateRemoteUser.java | 37 +++++++++++-----------
.../idp/authn/impl/ValidateRemoteUserTest.java | 6 ++--
.../authn/remoteuser-internal-authn-config.xml | 10 +++---
.../authn/remoteuser-internal-authn-beans.xml | 4 +--
4 files changed, 28 insertions(+), 29 deletions(-)
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateRemoteUser.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateRemoteUser.java
index 53d89b930..843e912c3 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateRemoteUser.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateRemoteUser.java
@@ -19,7 +19,6 @@ package net.shibboleth.idp.authn.impl;
import java.util.Collection;
import java.util.Collections;
-import java.util.HashSet;
import java.util.Set;
import java.util.regex.Pattern;
@@ -64,11 +63,11 @@ public class ValidateRemoteUser extends AbstractValidationAction {
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(ValidateRemoteUser.class);
- /** A whitelist of usernames to accept. */
- @Nonnull @NonnullElements private Set<String> whitelistedUsernames;
+ /** Usernames to accept. */
+ @Nonnull @NonnullElements private Set<String> allowedUsernames;
- /** A blacklist of usernames to deny. */
- @Nonnull @NonnullElements private Set<String> blacklistedUsernames;
+ /** Usernames to deny. */
+ @Nonnull @NonnullElements private Set<String> deniedUsernames;
/** A regular expression to apply for acceptance testing. */
@Nullable private Pattern matchExpression;
@@ -78,31 +77,31 @@ public class ValidateRemoteUser extends AbstractValidationAction {
/** Constructor. */
public ValidateRemoteUser() {
- whitelistedUsernames = Collections.emptySet();
- blacklistedUsernames = Collections.emptySet();
+ allowedUsernames = Collections.emptySet();
+ deniedUsernames = Collections.emptySet();
setMetricName(DEFAULT_METRIC_NAME);
}
/**
- * Set the whitelisted usernames.
+ * Set the allowed usernames.
*
- * @param whitelist whitelist to set
+ * @param allowed usernames to allow
*/
- public void setWhitelistedUsernames(@Nonnull @NonnullElements final Collection<String> whitelist) {
+ public void setAllowedUsernames(@Nullable @NonnullElements final Collection<String> allowed) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- whitelistedUsernames = new HashSet<>(StringSupport.normalizeStringCollection(whitelist));
+ allowedUsernames = Set.copyOf(StringSupport.normalizeStringCollection(allowed));
}
/**
- * Set the blacklisted usernames.
+ * Set the denied usernames.
*
- * @param blacklist blacklist to set
+ * @param denied usernames to deny
*/
- public void setBlacklistedUsernames(@Nonnull @NonnullElements final Collection<String> blacklist) {
+ public void setDeniedUsernames(@Nullable @NonnullElements final Collection<String> denied) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- blacklistedUsernames = new HashSet<>(StringSupport.normalizeStringCollection(blacklist));
+ deniedUsernames = Set.copyOf(StringSupport.normalizeStringCollection(denied));
}
/**
@@ -166,16 +165,16 @@ public class ValidateRemoteUser extends AbstractValidationAction {
*/
private boolean isAuthenticated(@Nonnull @NotEmpty final String username) {
- if (!whitelistedUsernames.isEmpty() && !whitelistedUsernames.contains(username)) {
- // Not in whitelist. Only accept if a regexp applies.
+ if (!allowedUsernames.isEmpty() && !allowedUsernames.contains(username)) {
+ // Not in allowed set. Only accept if a regexp applies.
if (matchExpression == null) {
return false;
}
return matchExpression.matcher(username).matches();
}
- // In whitelist (or none). Check blacklist, and if necessary a regexp.
- return !blacklistedUsernames.contains(username)
+ // In allowed set (or none). Check deny set, and if necessary a regexp.
+ return !deniedUsernames.contains(username)
&& (matchExpression == null || matchExpression.matcher(username).matches());
}
diff --git a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ValidateRemoteUserTest.java b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ValidateRemoteUserTest.java
index 58d3b45a2..774c86686 100644
--- a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ValidateRemoteUserTest.java
+++ b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/ValidateRemoteUserTest.java
@@ -44,8 +44,8 @@ public class ValidateRemoteUserTest extends BaseAuthenticationContextTest {
super.setUp();
action = new ValidateRemoteUser();
- action.setWhitelistedUsernames(Arrays.asList("bar", "baz"));
- action.setBlacklistedUsernames(Arrays.asList("foo"));
+ action.setAllowedUsernames(Arrays.asList("bar", "baz"));
+ action.setDeniedUsernames(Arrays.asList("foo"));
action.setMatchExpression(Pattern.compile("^ba(r|z|n)$"));
action.setHttpServletRequest((HttpServletRequest) src.getExternalContext().getNativeRequest());
action.initialize();
@@ -99,7 +99,7 @@ public class ValidateRemoteUserTest extends BaseAuthenticationContextTest {
UsernamePrincipal.class).iterator().next().getName(), "baz");
}
- @Test public void testBlacklist() throws ComponentInitializationException {
+ @Test public void testDenyist() throws ComponentInitializationException {
((MockHttpServletRequest) action.getHttpServletRequest()).setRemoteUser("foo");
final AuthenticationContext ac = prc.getSubcontext(AuthenticationContext.class, false);
diff --git a/idp-conf/src/main/resources/conf/authn/remoteuser-internal-authn-config.xml b/idp-conf/src/main/resources/conf/authn/remoteuser-internal-authn-config.xml
index 9e68c854b..d23d45dde 100644
--- a/idp-conf/src/main/resources/conf/authn/remoteuser-internal-authn-config.xml
+++ b/idp-conf/src/main/resources/conf/authn/remoteuser-internal-authn-config.xml
@@ -41,19 +41,19 @@
-->
</util:list>
- <!-- Uncomment/configure to install username whitelist, blacklist, and/or match expressions. -->
+ <!-- Uncomment/configure to install username allow set, deny set, and/or match expressions. -->
- <util:list id="shibboleth.authn.RemoteUser.whitelistedUsernames">
+ <util:set id="shibboleth.authn.RemoteUser.allowedUsernames">
<!--
<value>goodguy</value>
-->
- </util:list>
+ </util:set>
- <util:list id="shibboleth.authn.RemoteUser.blacklistedUsernames">
+ <util:set id="shibboleth.authn.RemoteUser.deniedUsernames">
<!--
<value>badguy</value>
-->
- </util:list>
+ </util:set>
<!--
<bean id="shibboleth.authn.RemoteUser.matchExpression" class="java.util.regex.Pattern" factory-method="compile"
diff --git a/idp-conf/src/main/resources/system/flows/authn/remoteuser-internal-authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/remoteuser-internal-authn-beans.xml
index 5dc5489e3..fe7701867 100644
--- a/idp-conf/src/main/resources/system/flows/authn/remoteuser-internal-authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/remoteuser-internal-authn-beans.xml
@@ -32,8 +32,8 @@
<bean id="ValidateRemoteUser" class="net.shibboleth.idp.authn.impl.ValidateRemoteUser" scope="prototype"
p:matchExpression="#{getObject('shibboleth.authn.RemoteUser.matchExpression')}"
- p:whitelistedUsernames-ref="shibboleth.authn.RemoteUser.whitelistedUsernames"
- p:blacklistedUsernames-ref="shibboleth.authn.RemoteUser.blacklistedUsernames"
+ p:allowedUsernames="#{getObject('shibboleth.authn.RemoteUser.allowedUsernames') ?: getObject('shibboleth.authn.RemoteUser.whitelistedUsernames')}"
+ p:deniedUsernames="#{getObject('shibboleth.authn.RemoteUser.deniedUsernames') ?: getObject('shibboleth.authn.RemoteUser.blacklistedUsernames')}"
p:addDefaultPrincipals="#{getObject('shibboleth.authn.RemoteUser.addDefaultPrincipals') ?: true}"
p:resultCachingPredicate="#{getObject('shibboleth.authn.RemoteUser.resultCachingPredicate')}" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list