[cpp-sp] branch master updated: SSPCPP-892 - Sync up filter schema with IdP
Scott Cantor
cantor.2 at osu.edu
Thu Mar 19 13:41:51 EDT 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=333c28a98c7c6ce73278d2cfbe83440f5295a03b
The following commit(s) were added to refs/heads/master by this push:
new 333c28a SSPCPP-892 - Sync up filter schema with IdP
333c28a is described below
commit 333c28a98c7c6ce73278d2cfbe83440f5295a03b
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Mar 19 13:40:39 2020 -0400
SSPCPP-892 - Sync up filter schema with IdP
https://issues.shibboleth.net/jira/browse/SSPCPP-892
Deprecation warnings for old namespace.
Fix Boolean rules to handle both namespaces.
Update default policy.
---
configs/attribute-policy.xml | 6 +++---
shibsp/attribute/filtering/impl/AndMatchFunctor.cpp | 19 +++++++++++++++++--
shibsp/attribute/filtering/impl/NotMatchFunctor.cpp | 19 +++++++++++++++++--
shibsp/attribute/filtering/impl/OrMatchFunctor.cpp | 19 +++++++++++++++++--
.../attribute/filtering/impl/XMLAttributeFilter.cpp | 7 +++++++
5 files changed, 61 insertions(+), 9 deletions(-)
diff --git a/configs/attribute-policy.xml b/configs/attribute-policy.xml
index e701471..64274a9 100644
--- a/configs/attribute-policy.xml
+++ b/configs/attribute-policy.xml
@@ -22,7 +22,7 @@
<Rule xsi:type="NOT">
<Rule xsi:type="ValueRegex" regex="@"/>
</Rule>
- <Rule xsi:type="saml:AttributeScopeMatchesShibMDScope"/>
+ <Rule xsi:type="ScopeMatchesShibMDScope"/>
</PermitValueRule>
<AttributeFilterPolicy>
@@ -61,12 +61,12 @@
<!-- Require NameQualifier/SPNameQualifier match IdP and SP entityID respectively. -->
<AttributeRule attributeID="persistent-id">
- <PermitValueRule xsi:type="saml:NameIDQualifierString"/>
+ <PermitValueRule xsi:type="NameIDQualifierString"/>
</AttributeRule>
<!-- Enforce that the values of schacHomeOrganization are a valid Scope. -->
<AttributeRule attributeID="schacHomeOrganization">
- <PermitValueRule xsi:type="saml:AttributeValueMatchesShibMDScope" />
+ <PermitValueRule xsi:type="ValueMatchesShibMDScope" />
</AttributeRule>
<!-- Catch-all that passes everything else through unmolested. -->
diff --git a/shibsp/attribute/filtering/impl/AndMatchFunctor.cpp b/shibsp/attribute/filtering/impl/AndMatchFunctor.cpp
index 7816d01..cabe4d3 100644
--- a/shibsp/attribute/filtering/impl/AndMatchFunctor.cpp
+++ b/shibsp/attribute/filtering/impl/AndMatchFunctor.cpp
@@ -92,10 +92,17 @@ AndMatchFunctor::AndMatchFunctor(const pair<const FilterPolicyContext*,const DOM
const DOMElement* e = XMLHelper::getFirstChildElement(p.second);
while (e) {
func = nullptr;
- if (XMLHelper::isNodeNamed(e, shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS, Rule)) {
+
+ if (XMLString::equals(e->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS)) {
+ auto_ptr_char ns(e->getNamespaceURI());
+ Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter.AND").warn(
+ "Legacy filter namespace '%s' is DEPRECATED and will be removed from a future version.", ns.get());
+ }
+
+ if (XMLString::equals(e->getLocalName(), Rule)) {
func = buildFunctor(e, p.first, deprecationSupport);
}
- else if (XMLHelper::isNodeNamed(e, shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS, RuleReference)) {
+ else if (XMLString::equals(e->getLocalName(), RuleReference)) {
string ref = XMLHelper::getAttrString(e, nullptr, _ref);
if (!ref.empty()) {
multimap<string,MatchFunctor*>::const_iterator rule = p.first->getMatchFunctors().find(ref);
@@ -121,6 +128,14 @@ MatchFunctor* AndMatchFunctor::buildFunctor(const DOMElement* e, const FilterPol
if (!type)
throw ConfigurationException("Child Rule found with no xsi:type.");
+ if (XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS) ||
+ XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_SAML_NS)) {
+
+ auto_ptr_char ns(type->getNamespaceURI());
+ Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter.AND").warn(
+ "Legacy filter namespace '%s' is DEPRECATED and will be removed from a future version.", ns.get());
+ }
+
auto_ptr<MatchFunctor> func(SPConfig::getConfig().MatchFunctorManager.newPlugin(*type, make_pair(functorMap,e), deprecationSupport));
functorMap->getMatchFunctors().insert(multimap<string,MatchFunctor*>::value_type(id, func.get()));
return func.release();
diff --git a/shibsp/attribute/filtering/impl/NotMatchFunctor.cpp b/shibsp/attribute/filtering/impl/NotMatchFunctor.cpp
index 24b7f45..2873e6a 100644
--- a/shibsp/attribute/filtering/impl/NotMatchFunctor.cpp
+++ b/shibsp/attribute/filtering/impl/NotMatchFunctor.cpp
@@ -81,10 +81,17 @@ NotMatchFunctor::NotMatchFunctor(const pair<const FilterPolicyContext*,const DOM
{
const DOMElement* e = XMLHelper::getFirstChildElement(p.second);
if (e) {
- if (XMLHelper::isNodeNamed(e, shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS, Rule)) {
+
+ if (XMLString::equals(e->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS)) {
+ auto_ptr_char ns(e->getNamespaceURI());
+ Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter.NOT").warn(
+ "Legacy filter namespace '%s' is DEPRECATED and will be removed from a future version.", ns.get());
+ }
+
+ if (XMLString::equals(e->getLocalName(), Rule)) {
m_functor = buildFunctor(e, p.first, deprecationSupport);
}
- else if (XMLHelper::isNodeNamed(e, shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS, RuleReference)) {
+ else if (XMLString::equals(e->getLocalName(), RuleReference)) {
string ref = XMLHelper::getAttrString(e, nullptr, _ref);
if (!ref.empty()) {
multimap<string,MatchFunctor*>::const_iterator rule = p.first->getMatchFunctors().find(ref);
@@ -108,6 +115,14 @@ MatchFunctor* NotMatchFunctor::buildFunctor(const DOMElement* e, const FilterPol
if (!type)
throw ConfigurationException("Child Rule found with no xsi:type.");
+ if (XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS) ||
+ XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_SAML_NS)) {
+
+ auto_ptr_char ns(type->getNamespaceURI());
+ Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter.NOT").warn(
+ "Legacy filter namespace '%s' is DEPRECATED and will be removed from a future version.", ns.get());
+ }
+
auto_ptr<MatchFunctor> func(SPConfig::getConfig().MatchFunctorManager.newPlugin(*type, make_pair(functorMap,e), deprecationSupport));
functorMap->getMatchFunctors().insert(multimap<string,MatchFunctor*>::value_type(id, func.get()));
return func.release();
diff --git a/shibsp/attribute/filtering/impl/OrMatchFunctor.cpp b/shibsp/attribute/filtering/impl/OrMatchFunctor.cpp
index 52b2919..293c6a9 100644
--- a/shibsp/attribute/filtering/impl/OrMatchFunctor.cpp
+++ b/shibsp/attribute/filtering/impl/OrMatchFunctor.cpp
@@ -88,10 +88,17 @@ OrMatchFunctor::OrMatchFunctor(const pair<const FilterPolicyContext*,const DOMEl
const DOMElement* e = XMLHelper::getFirstChildElement(p.second);
while (e) {
func = nullptr;
- if (XMLHelper::isNodeNamed(e, shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS, Rule)) {
+
+ if (XMLString::equals(e->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS)) {
+ auto_ptr_char ns(e->getNamespaceURI());
+ Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter.OR").warn(
+ "Legacy filter namespace '%s' is DEPRECATED and will be removed from a future version.", ns.get());
+ }
+
+ if (XMLString::equals(e->getLocalName(), Rule)) {
func = buildFunctor(e, p.first, deprecationSupport);
}
- else if (XMLHelper::isNodeNamed(e, shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS, RuleReference)) {
+ else if (XMLString::equals(e->getLocalName(), RuleReference)) {
string ref = XMLHelper::getAttrString(e, nullptr, _ref);
if (!ref.empty()) {
multimap<string,MatchFunctor*>::const_iterator rule = p.first->getMatchFunctors().find(ref);
@@ -117,6 +124,14 @@ MatchFunctor* OrMatchFunctor::buildFunctor(const DOMElement* e, const FilterPoli
if (!type)
throw ConfigurationException("Child Rule found with no xsi:type.");
+ if (XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS) ||
+ XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_SAML_NS)) {
+
+ auto_ptr_char ns(type->getNamespaceURI());
+ Category::getInstance(SHIBSP_LOGCAT ".AttributeFilter.OR").warn(
+ "Legacy filter namespace '%s' is DEPRECATED and will be removed from a future version.", ns.get());
+ }
+
auto_ptr<MatchFunctor> func(SPConfig::getConfig().MatchFunctorManager.newPlugin(*type, make_pair(functorMap,e), deprecationSupport));
functorMap->getMatchFunctors().insert(multimap<string,MatchFunctor*>::value_type(id, func.get()));
return func.release();
diff --git a/shibsp/attribute/filtering/impl/XMLAttributeFilter.cpp b/shibsp/attribute/filtering/impl/XMLAttributeFilter.cpp
index 98803b6..3bce0bb 100644
--- a/shibsp/attribute/filtering/impl/XMLAttributeFilter.cpp
+++ b/shibsp/attribute/filtering/impl/XMLAttributeFilter.cpp
@@ -247,6 +247,13 @@ MatchFunctor* XMLFilterImpl::buildFunctor(
scoped_ptr<xmltooling::QName> type(XMLHelper::getXSIType(e));
if (type) {
+ if (XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_BASIC_NS) ||
+ XMLString::equals(type->getNamespaceURI(), shibspconstants::SHIB2ATTRIBUTEFILTER_MF_SAML_NS)) {
+
+ auto_ptr_char ns(type->getNamespaceURI());
+ m_log.warn("Legacy filter namespace '%s' is DEPRECATED and will be removed from a future version.", ns.get());
+ }
+
try {
auto_ptr<MatchFunctor> func(SPConfig::getConfig().MatchFunctorManager.newPlugin(*type, make_pair(&functorMap,e), deprecationSupport));
functorMap.getMatchFunctors().insert(multimap<string,MatchFunctor*>::value_type(id, func.get()));
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list