[java-identity-provider] branch main updated: IDP-1652 - Support easier integration into configuration by plugins
Scott Cantor
cantor.2 at osu.edu
Thu Nov 5 19:51:59 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=b5cf9b34a2d7f6c929c5621c842a99898ffdc878
The following commit(s) were added to refs/heads/main by this push:
new b5cf9b34a IDP-1652 - Support easier integration into configuration by plugins
b5cf9b34a is described below
commit b5cf9b34a2d7f6c929c5621c842a99898ffdc878
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Nov 5 14:51:50 2020 -0500
IDP-1652 - Support easier integration into configuration by plugins
https://issues.shibboleth.net/jira/browse/IDP-1652
Auto-wiring of authn comparison map.
---
.../PrincipalEvalPredicateFactoryRegistration.java | 74 ++++++++++++++++++++++
.../PrincipalEvalPredicateFactoryRegistry.java | 44 +++++++++++++
.../net/shibboleth/idp/conf/authn-system.xml | 38 ++++++++++-
.../main/resources/conf/authn/authn-comparison.xml | 57 -----------------
4 files changed, 153 insertions(+), 60 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalEvalPredicateFactoryRegistration.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalEvalPredicateFactoryRegistration.java
new file mode 100644
index 000000000..aeda2c204
--- /dev/null
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalEvalPredicateFactoryRegistration.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.authn.principal;
+
+import java.security.Principal;
+
+import javax.annotation.Nonnull;
+
+import net.shibboleth.utilities.java.support.annotation.ParameterName;
+import net.shibboleth.utilities.java.support.collection.Pair;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * Wraps the association of a {@link PrincipalEvalPredicateFactory} against a particular
+ * {@link Principal} subtype and a string operator.
+ *
+ * <p>Used to support auto-wiring of factories into a
+ * {@link PrincipalEvalPredicateFactoryRegistry}.</p>
+ */
+public class PrincipalEvalPredicateFactoryRegistration {
+
+ /** The class and operator pair. */
+ @Nonnull private Pair<Class<? extends Principal>,String> typeAndOperator;
+
+ /** Predicate factory. */
+ @Nonnull private PrincipalEvalPredicateFactory predicateFactory;
+
+ /**
+ * Constructor.
+ *
+ * @param key type and operator
+ * @param value predicate factory
+ */
+ public PrincipalEvalPredicateFactoryRegistration(
+ @Nonnull @ParameterName(name="key") final Pair<Class<? extends Principal>, String> key,
+ @Nonnull @ParameterName(name="value") final PrincipalEvalPredicateFactory value) {
+ typeAndOperator = Constraint.isNotNull(key, "Type/operator pair cannot be null");
+ predicateFactory = Constraint.isNotNull(value, "PrincipalEvalPredicateFactory cannot be null");
+ }
+
+ /**
+ * Gets the type and operator pair for this registration.
+ *
+ * @return type and operator pair
+ */
+ @Nonnull public Pair<Class<? extends Principal>,String> getTypeAndOperator() {
+ return typeAndOperator;
+ }
+
+ /**
+ * Gets the factory for this registration.
+ *
+ * @return registration
+ */
+ @Nonnull public PrincipalEvalPredicateFactory getPredicateFactory() {
+ return predicateFactory;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalEvalPredicateFactoryRegistry.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalEvalPredicateFactoryRegistry.java
index 785235a1c..141efc5e1 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalEvalPredicateFactoryRegistry.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalEvalPredicateFactoryRegistry.java
@@ -18,6 +18,7 @@
package net.shibboleth.idp.authn.principal;
import java.security.Principal;
+import java.util.Collection;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
@@ -33,6 +34,7 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
/**
* A registry of mappings between a custom {@link Principal} subtype with a matching operator
@@ -53,16 +55,58 @@ public final class PrincipalEvalPredicateFactoryRegistry {
registry = new ConcurrentHashMap<>();
}
+ /**
+ * Constructor.
+ *
+ * <p>Used to auto-wire {@link PrincipalEvalPredicateFactoryRegistration} wrappers.</p>
+ *
+ * @param registrations wrapped registration information
+ *
+ * @since 4.1.0
+ */
+ @Autowired
+ public PrincipalEvalPredicateFactoryRegistry(@Nullable @NonnullElements @ParameterName(name="registrations")
+ final Collection<PrincipalEvalPredicateFactoryRegistration> registrations) {
+ registry = new ConcurrentHashMap<>();
+ if (registrations != null) {
+ log.debug("Auto-wiring {} registration(s)", registrations.size());
+ registrations.forEach(r -> registry.put(r.getTypeAndOperator(), r.getPredicateFactory()));
+ }
+ }
+
/**
* Constructor.
*
* @param fromMap map to populate registry with
+ *
+ * @deprecated
*/
+ @Deprecated(since="4.1.0", forRemoval=true)
public PrincipalEvalPredicateFactoryRegistry(@Nonnull @NonnullElements @ParameterName(name="fromMap") final
Map<Pair<Class<? extends Principal>, String>, PrincipalEvalPredicateFactory> fromMap) {
registry = new ConcurrentHashMap<>(Constraint.isNotNull(fromMap, "Source map cannot be null"));
}
+ /**
+ * Add registrations from a map, overwriting any previously matching entries.
+ *
+ * @param fromMap map entries to add
+ *
+ * @since 4.1.0
+ */
+ public void setRegistrations(@Nullable @NonnullElements
+ final Map<Pair<Class<? extends Principal>, String>, PrincipalEvalPredicateFactory> fromMap) {
+ if (fromMap != null) {
+ fromMap.entrySet().forEach(entry -> {
+ if (registry.containsKey(entry.getKey())) {
+ log.info("Replacing auto-wired entry for principal type '{}' and operator '{}'",
+ entry.getKey().getFirst().getName(), entry.getKey().getSecond());
+ }
+ registry.put(entry.getKey(), entry.getValue());
+ });
+ }
+ }
+
/**
* Get a registered predicate factory for a given principal type and operator string, if any.
*
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml
index 5033c01b8..b48ce21a9 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml
@@ -434,12 +434,44 @@
<!-- Registry of comparison rules configured by deployer and injected into authentication flow. -->
<bean id="shibboleth.AuthnComparisonRegistry"
- class="net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry"
- c:fromMap-ref="shibboleth.AuthnComparisonRules" />
+ class="net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry"
+ p:registrations="#{getObject('shibboleth.AuthnComparisonRules')}" />
+
+ <!-- Parent bean for auto-registration of rules. -->
+ <bean id="shibboleth.AuthnComparisonRegistration" abstract="true"
+ class="net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistration" />
+
+ <!-- Exact matching rules. -->
+ <bean parent="shibboleth.AuthnComparisonRegistration"
+ c:key-ref="shibboleth.SAMLAuthnMethodExact" c:value-ref="shibboleth.ExactMatchFactory" />
+ <bean parent="shibboleth.AuthnComparisonRegistration"
+ c:key-ref="shibboleth.SAMLACClassRefExact" c:value-ref="shibboleth.ExactMatchFactory" />
+ <bean parent="shibboleth.AuthnComparisonRegistration"
+ c:key-ref="shibboleth.SAMLACDeclRefExact" c:value-ref="shibboleth.ExactMatchFactory" />
+
+ <!-- Min/max rules degenerating by default into exact matching. -->
+ <bean parent="shibboleth.AuthnComparisonRegistration"
+ c:key-ref="shibboleth.SAMLACClassRefMinimum" c:value-ref="shibboleth.ExactMatchFactory" />
+ <bean parent="shibboleth.AuthnComparisonRegistration"
+ c:key-ref="shibboleth.SAMLACDeclRefMinimum" c:value-ref="shibboleth.ExactMatchFactory" />
+ <bean parent="shibboleth.AuthnComparisonRegistration"
+ c:key-ref="shibboleth.SAMLACClassRefMaximum" c:value-ref="shibboleth.ExactMatchFactory" />
+ <bean parent="shibboleth.AuthnComparisonRegistration"
+ c:key-ref="shibboleth.SAMLACDeclRefMaximum" c:value-ref="shibboleth.ExactMatchFactory" />
+
+ <!-- Empty default matching rules for "better" operator. -->
+ <bean id="shibboleth.DefaultBetterClassRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
+ <bean id="shibboleth.DefaultBetterDeclRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
+
+ <!-- "better" rules that default to failure. -->
+ <bean parent="shibboleth.AuthnComparisonRegistration"
+ c:key-ref="shibboleth.SAMLACClassRefBetter" c:value-ref="shibboleth.DefaultBetterClassRefMatchFactory" />
+ <bean parent="shibboleth.AuthnComparisonRegistration"
+ c:key-ref="shibboleth.SAMLACDeclRefBetter" c:value-ref="shibboleth.DefaultBetterDeclRefMatchFactory" />
<!-- Exact matching for SAML AC Classes and Declarations (or anything else really). -->
<bean id="shibboleth.ExactMatchFactory"
- class="net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory"/>
+ class="net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory" />
<!-- Parent bean for inexact matching factories defined by deployer. -->
<bean id="shibboleth.InexactMatchFactory" abstract="true"
diff --git a/idp-conf/src/main/resources/conf/authn/authn-comparison.xml b/idp-conf/src/main/resources/conf/authn/authn-comparison.xml
index 4aeecbc4f..21ea8eb25 100644
--- a/idp-conf/src/main/resources/conf/authn/authn-comparison.xml
+++ b/idp-conf/src/main/resources/conf/authn/authn-comparison.xml
@@ -29,64 +29,7 @@
<value>1</value>
</entry>
</util:map>
-
- <!--
- These beans can be used in the AuthnComparisonRules map below instead of the defaults to
- support more advanced matching rules. The top example shows how to configure a matching rule,
- in this case a rule that the two listed classes are "better" than the password class.
-
- To use these beans, configure the matchingRules map as desired, and then reference the bean id in the
- desired value-ref slot in the AuthnComparisonRules map.
- -->
-
- <bean id="shibboleth.BetterClassRefMatchFactory" parent="shibboleth.InexactMatchFactory">
- <!--
- <property name="matchingRules">
- <map>
- <entry key="urn:oasis:names:tc:SAML:2.0:ac:classes:Password">
- <list>
- <value>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</value>
- <value>urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken</value>
- </list>
- </entry>
- </map>
- </property>
- -->
- </bean>
-
- <bean id="shibboleth.MinimumClassRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
-
- <bean id="shibboleth.MaximumClassRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
-
- <!-- DeclRefs are rarely used in SAML, so you likely won't bother with these. -->
- <bean id="shibboleth.BetterDeclRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
- <bean id="shibboleth.MinimumDeclRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
- <bean id="shibboleth.MaximumDeclRefMatchFactory" parent="shibboleth.InexactMatchFactory" />
-
-
- <!-- Registry of matching rules. -->
-
- <util:map id="shibboleth.AuthnComparisonRules">
-
- <!-- Exact matching, should be left alone to avoid tricking the IdP into behaving incorrectly. -->
- <entry key-ref="shibboleth.SAMLAuthnMethodExact" value-ref="shibboleth.ExactMatchFactory"/>
- <entry key-ref="shibboleth.SAMLACClassRefExact" value-ref="shibboleth.ExactMatchFactory"/>
- <entry key-ref="shibboleth.SAMLACDeclRefExact" value-ref="shibboleth.ExactMatchFactory"/>
-
- <!-- Minimum matching, leave to allow degeneration into exact, or replace with custom rules. -->
- <entry key-ref="shibboleth.SAMLACClassRefMinimum" value-ref="shibboleth.ExactMatchFactory"/>
- <entry key-ref="shibboleth.SAMLACDeclRefMinimum" value-ref="shibboleth.ExactMatchFactory"/>
-
- <!-- Maximum matching, leave to allow degeneration into exact, or replace with custom rules. -->
- <entry key-ref="shibboleth.SAMLACClassRefMaximum" value-ref="shibboleth.ExactMatchFactory"/>
- <entry key-ref="shibboleth.SAMLACDeclRefMaximum" value-ref="shibboleth.ExactMatchFactory"/>
-
- <!-- Better matching, refers to empty ruleset that has to be populated to work. -->
- <entry key-ref="shibboleth.SAMLACClassRefBetter" value-ref="shibboleth.BetterClassRefMatchFactory"/>
- <entry key-ref="shibboleth.SAMLACDeclRefBetter" value-ref="shibboleth.BetterDeclRefMatchFactory"/>
- </util:map>
-
<!-- List of context classes or declarations to ignore if an SP requests them. -->
<util:list id="shibboleth.IgnoredContexts">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list