[java-identity-provider] branch master updated: IDP-1624 - Preventing exporting DataConnectors from running during c14n
Scott Cantor
cantor.2 at osu.edu
Tue Jun 23 19:59:04 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=0a6499e605d6bf911d2cf0187eb58c897d42ad5e
The following commit(s) were added to refs/heads/master by this push:
new 0a6499e60 IDP-1624 - Preventing exporting DataConnectors from running during c14n
0a6499e60 is described below
commit 0a6499e605d6bf911d2cf0187eb58c897d42ad5e
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jun 23 15:58:55 2020 -0400
IDP-1624 - Preventing exporting DataConnectors from running during c14n
https://issues.shibboleth.net/jira/browse/IDP-1624
Add exclusion predicate shortcuts.
---
.../resolver/spring/BaseResolverPluginParser.java | 107 +++++++++++++++------
.../spring/ad/SimpleAttributeParserTest.java | 56 ++++++++++-
.../spring/ad/resolver/excludeRelyingParties.xml | 8 ++
.../spring/ad/resolver/excludeResolutionPhases.xml | 8 ++
.../schema/shibboleth-attribute-resolver.xsd | 18 +++-
5 files changed, 165 insertions(+), 32 deletions(-)
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/BaseResolverPluginParser.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/BaseResolverPluginParser.java
index 92f2c2f1e..5b3722be2 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/BaseResolverPluginParser.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/BaseResolverPluginParser.java
@@ -20,6 +20,7 @@ package net.shibboleth.idp.attribute.resolver.spring;
import java.util.List;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import net.shibboleth.ext.spring.util.SpringSupport;
import net.shibboleth.idp.attribute.resolver.logic.ResolutionLabelPredicate;
@@ -57,7 +58,7 @@ public abstract class BaseResolverPluginParser extends AbstractSingleBeanDefinit
return defnId;
}
-// Checkstyle: CyclomaticComplexity|MethodLength OFF
+// Checkstyle: CyclomaticComplexity OFF
/** {@inheritDoc} */
@Override protected void doParse(@Nonnull final Element config, @Nonnull final ParserContext parserContext,
@Nonnull final BeanDefinitionBuilder builder) {
@@ -72,38 +73,18 @@ public abstract class BaseResolverPluginParser extends AbstractSingleBeanDefinit
builder.setDestroyMethodName("destroy");
if (config.hasAttributeNS(null, "activationConditionRef")) {
- if (config.hasAttributeNS(null, "relyingParties") || config.hasAttributeNS(null, "resolutionPhases")) {
- log.warn("relyingParties/resolutionPhases ignored, using activationConditionRef");
+ if (config.hasAttributeNS(null, "relyingParties") ||
+ config.hasAttributeNS(null, "resolutionPhases") ||
+ config.hasAttributeNS(null, "excludeRelyingParties") ||
+ config.hasAttributeNS(null, "excludeResolutionPhases")) {
+ log.warn("relyingParties/resolutionPhases and variants ignored, using activationConditionRef");
}
builder.addPropertyReference("activationCondition",
StringSupport.trimOrNull(config.getAttributeNS(null, "activationConditionRef")));
} else {
- BeanDefinitionBuilder rpBuilder = null;
- BeanDefinitionBuilder phasesBuilder = null;
- if (config.hasAttributeNS(null, "relyingParties")) {
- rpBuilder = BeanDefinitionBuilder.genericBeanDefinition(RelyingPartyIdPredicate.class);
- rpBuilder.setFactoryMethod("fromCandidates");
- rpBuilder.addConstructorArgValue(
- SpringSupport.getAttributeValueAsList(config.getAttributeNodeNS(null, "relyingParties")));
- }
-
- if (config.hasAttributeNS(null, "resolutionPhases")) {
- phasesBuilder = BeanDefinitionBuilder.genericBeanDefinition(ResolutionLabelPredicate.class);
- phasesBuilder.addConstructorArgValue(
- SpringSupport.getAttributeValueAsList(config.getAttributeNodeNS(null, "resolutionPhases")));
- }
-
- if (rpBuilder != null && phasesBuilder != null) {
- final BeanDefinitionBuilder andBuilder =
- BeanDefinitionBuilder.genericBeanDefinition(PredicateSupport.class);
- andBuilder.setFactoryMethod("and");
- andBuilder.addConstructorArgValue(rpBuilder.getBeanDefinition());
- andBuilder.addConstructorArgValue(phasesBuilder.getBeanDefinition());
- builder.addPropertyValue("activationCondition", andBuilder.getBeanDefinition());
- } else if (rpBuilder != null) {
- builder.addPropertyValue("activationCondition", rpBuilder.getBeanDefinition());
- } else if (phasesBuilder != null) {
- builder.addPropertyValue("activationCondition", phasesBuilder.getBeanDefinition());
+ final BeanDefinitionBuilder condition = getActivationCondition(config);
+ if (condition != null) {
+ builder.addPropertyValue("activationCondition", condition.getBeanDefinition());
}
}
@@ -136,7 +117,73 @@ public abstract class BaseResolverPluginParser extends AbstractSingleBeanDefinit
builder.addPropertyValue("dataConnectorDependencies",
SpringSupport.parseCustomElements(dataConnectorDependencyElements, parserContext, builder));
}
-// Checkstyle: CyclomaticComplexity|MethodLength ON
+
+ /**
+ * Get the effective activation condition to inject.
+ *
+ * @param config configuration element
+ *
+ * @return condition bean definition builder, or null
+ */
+ @Nullable protected BeanDefinitionBuilder getActivationCondition(@Nonnull final Element config) {
+
+ BeanDefinitionBuilder rpBuilder = null;
+ BeanDefinitionBuilder phasesBuilder = null;
+
+ if (config.hasAttributeNS(null, "relyingParties")) {
+ if (config.hasAttributeNS(null, "excludeRelyingParties")) {
+ log.warn("excludeRelyingParties ignored, using relyingParties");
+ }
+ rpBuilder = BeanDefinitionBuilder.genericBeanDefinition(RelyingPartyIdPredicate.class);
+ rpBuilder.setFactoryMethod("fromCandidates");
+ rpBuilder.addConstructorArgValue(
+ SpringSupport.getAttributeValueAsList(config.getAttributeNodeNS(null, "relyingParties")));
+ } else if (config.hasAttributeNS(null, "excludeRelyingParties")) {
+ final BeanDefinitionBuilder unnegated =
+ BeanDefinitionBuilder.genericBeanDefinition(RelyingPartyIdPredicate.class);
+ unnegated.setFactoryMethod("fromCandidates");
+ unnegated.addConstructorArgValue(
+ SpringSupport.getAttributeValueAsList(
+ config.getAttributeNodeNS(null, "excludeRelyingParties")));
+ rpBuilder = BeanDefinitionBuilder.genericBeanDefinition(PredicateSupport.class);
+ rpBuilder.setFactoryMethod("not");
+ rpBuilder.addConstructorArgValue(unnegated.getBeanDefinition());
+ }
+
+ if (config.hasAttributeNS(null, "resolutionPhases")) {
+ if (config.hasAttributeNS(null, "excludeResolutionPhases")) {
+ log.warn("excludeResolutionPhases ignored, using resolutionPhases");
+ }
+ phasesBuilder = BeanDefinitionBuilder.genericBeanDefinition(ResolutionLabelPredicate.class);
+ phasesBuilder.addConstructorArgValue(
+ SpringSupport.getAttributeValueAsList(config.getAttributeNodeNS(null, "resolutionPhases")));
+ } else if (config.hasAttributeNS(null, "excludeResolutionPhases")) {
+ final BeanDefinitionBuilder unnegated =
+ BeanDefinitionBuilder.genericBeanDefinition(ResolutionLabelPredicate.class);
+ unnegated.addConstructorArgValue(
+ SpringSupport.getAttributeValueAsList(
+ config.getAttributeNodeNS(null, "excludeResolutionPhases")));
+ phasesBuilder = BeanDefinitionBuilder.genericBeanDefinition(PredicateSupport.class);
+ phasesBuilder.setFactoryMethod("not");
+ phasesBuilder.addConstructorArgValue(unnegated.getBeanDefinition());
+ }
+
+ if (rpBuilder != null && phasesBuilder != null) {
+ final BeanDefinitionBuilder andBuilder =
+ BeanDefinitionBuilder.genericBeanDefinition(PredicateSupport.class);
+ andBuilder.setFactoryMethod("and");
+ andBuilder.addConstructorArgValue(rpBuilder.getBeanDefinition());
+ andBuilder.addConstructorArgValue(phasesBuilder.getBeanDefinition());
+ return andBuilder;
+ } else if (rpBuilder != null) {
+ return rpBuilder;
+ } else if (phasesBuilder != null) {
+ return phasesBuilder;
+ }
+
+ return null;
+ }
+// Checkstyle: CyclomaticComplexity ON
/** Controls parsing of Dependencies.
*
diff --git a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/ad/SimpleAttributeParserTest.java b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/ad/SimpleAttributeParserTest.java
index 897a40bae..15680fcda 100644
--- a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/ad/SimpleAttributeParserTest.java
+++ b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/ad/SimpleAttributeParserTest.java
@@ -134,6 +134,33 @@ public class SimpleAttributeParserTest extends BaseAttributeDefinitionParserTest
assertTrue(pre.test(prc));
}
+ @Test public void excludeRelyingParties() throws ComponentInitializationException {
+ final GenericApplicationContext context = new FilesystemGenericApplicationContext();
+ final MutablePropertySources propertySources = context.getEnvironment().getPropertySources();
+ final MockPropertySource mockEnvVars = new MockPropertySource();
+ mockEnvVars.setProperty("prop1", "p1");
+ mockEnvVars.setProperty("prop2", "p2 p3");
+ mockEnvVars.setProperty("prop3", "");
+ propertySources.replace(StandardEnvironment.SYSTEM_PROPERTIES_PROPERTY_SOURCE_NAME, mockEnvVars);
+
+ final PropertySourcesPlaceholderConfigurer placeholderConfig = new PropertySourcesPlaceholderConfigurer();
+ placeholderConfig.setPlaceholderPrefix("%{");
+ placeholderConfig.setPlaceholderSuffix("}");
+ placeholderConfig.setPropertySources(propertySources);
+ context.addBeanFactoryPostProcessor(placeholderConfig);
+
+ final AttributeDefinition attr = getAttributeDefn("resolver/excludeRelyingParties.xml", SimpleAttributeDefinition.class, context);
+ final Predicate<ProfileRequestContext> pre = attr.getActivationCondition();
+ final ProfileRequestContext prc = new ProfileRequestContext();
+ final RelyingPartyContext rpContext = prc.getSubcontext(RelyingPartyContext.class, true);
+ rpContext.setRelyingPartyId("p1");
+ assertFalse(pre.test(prc));
+ rpContext.setRelyingPartyId("p2 p3");
+ assertTrue(pre.test(prc));
+ rpContext.setRelyingPartyId("p3");
+ assertFalse(pre.test(prc));
+ }
+
@Test public void resolutionPhases() throws ComponentInitializationException {
final GenericApplicationContext context = new FilesystemGenericApplicationContext();
final MutablePropertySources propertySources = context.getEnvironment().getPropertySources();
@@ -160,7 +187,34 @@ public class SimpleAttributeParserTest extends BaseAttributeDefinitionParserTest
resContext.setResolutionLabel("p3");
assertTrue(pre.test(prc));
}
-
+
+ @Test public void excludeResolutionPhases() throws ComponentInitializationException {
+ final GenericApplicationContext context = new FilesystemGenericApplicationContext();
+ final MutablePropertySources propertySources = context.getEnvironment().getPropertySources();
+ final MockPropertySource mockEnvVars = new MockPropertySource();
+ mockEnvVars.setProperty("prop1", "p1");
+ mockEnvVars.setProperty("prop2", "p2 p3");
+ mockEnvVars.setProperty("prop3", "");
+ propertySources.replace(StandardEnvironment.SYSTEM_PROPERTIES_PROPERTY_SOURCE_NAME, mockEnvVars);
+
+ final PropertySourcesPlaceholderConfigurer placeholderConfig = new PropertySourcesPlaceholderConfigurer();
+ placeholderConfig.setPlaceholderPrefix("%{");
+ placeholderConfig.setPlaceholderSuffix("}");
+ placeholderConfig.setPropertySources(propertySources);
+ context.addBeanFactoryPostProcessor(placeholderConfig);
+
+ final AttributeDefinition attr = getAttributeDefn("resolver/excludeResolutionPhases.xml", SimpleAttributeDefinition.class, context);
+ final Predicate<ProfileRequestContext> pre = attr.getActivationCondition();
+ final ProfileRequestContext prc = new ProfileRequestContext();
+ final AttributeResolutionContext resContext = prc.getSubcontext(AttributeResolutionContext.class, true);
+ resContext.setResolutionLabel("p1");
+ assertFalse(pre.test(prc));
+ resContext.setResolutionLabel("p2 p3");
+ assertTrue(pre.test(prc));
+ resContext.setResolutionLabel("p3");
+ assertFalse(pre.test(prc));
+ }
+
@Test public void phasesAndParties() throws ComponentInitializationException {
final GenericApplicationContext context = new FilesystemGenericApplicationContext();
final MutablePropertySources propertySources = context.getEnvironment().getPropertySources();
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/ad/resolver/excludeRelyingParties.xml b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/ad/resolver/excludeRelyingParties.xml
new file mode 100644
index 000000000..7a4d890d0
--- /dev/null
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/ad/resolver/excludeRelyingParties.xml
@@ -0,0 +1,8 @@
+ <AttributeDefinition
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns="urn:mace:shibboleth:2.0:resolver"
+ xsi:type="Simple" id="attry"
+ excludeRelyingParties="%{prop1} %{prop2} %{prop3}"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd">
+ <InputAttributeDefinition ref="fii"/>
+</AttributeDefinition>
\ No newline at end of file
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/ad/resolver/excludeResolutionPhases.xml b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/ad/resolver/excludeResolutionPhases.xml
new file mode 100644
index 000000000..783b1e5aa
--- /dev/null
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/ad/resolver/excludeResolutionPhases.xml
@@ -0,0 +1,8 @@
+ <AttributeDefinition
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns="urn:mace:shibboleth:2.0:resolver"
+ xsi:type="Simple" id="attry"
+ excludeResolutionPhases="%{prop1} %{prop2} %{prop3}"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd">
+ <InputAttributeDefinition ref="fii"/>
+</AttributeDefinition>
\ No newline at end of file
diff --git a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
index e5ab13afa..1bec5e739 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
@@ -202,7 +202,7 @@
<annotation>
<documentation>
A reference to a predicate to decide whether this plugin is applicable.
- Mutually exclusive with relyingParties and resolutionPhases.
+ Mutually exclusive with [exclude]relyingParties and [exclude]resolutionPhases.
</documentation>
</annotation>
</attribute>
@@ -214,6 +214,14 @@
</documentation>
</annotation>
</attribute>
+ <attribute name="excludeRelyingParties" type="resolver:string">
+ <annotation>
+ <documentation>
+ A (space separated) list of entities for which this plugin is to be inactive.
+ Mutually exclusive with activationConditionRef.
+ </documentation>
+ </annotation>
+ </attribute>
<attribute name="resolutionPhases" type="resolver:string">
<annotation>
<documentation>
@@ -222,6 +230,14 @@
</documentation>
</annotation>
</attribute>
+ <attribute name="excludeResolutionPhases" type="resolver:string">
+ <annotation>
+ <documentation>
+ A (space separated) list of resolution "phases" for which this plugin is to be inactive.
+ Mutually exclusive with activationConditionRef.
+ </documentation>
+ </annotation>
+ </attribute>
<attribute name="profileContextStrategyRef" type="resolver:string">
<annotation>
<documentation>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list