[java-identity-provider] branch main updated: IDP-1642 - Migrate configuration into jars where feasible
Scott Cantor
cantor.2 at osu.edu
Tue Sep 22 22:27:20 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=fba2b53a32c933c8d5921873b11a829dd2662c7f
The following commit(s) were added to refs/heads/main by this push:
new fba2b53a3 IDP-1642 - Migrate configuration into jars where feasible
fba2b53a3 is described below
commit fba2b53a32c933c8d5921873b11a829dd2662c7f
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Sep 22 18:26:58 2020 -0400
IDP-1642 - Migrate configuration into jars where feasible
https://issues.shibboleth.net/jira/browse/IDP-1642
Convert consent flows into module.
Migrate some settings into properties.
---
.../idp/module/intercept/impl/Consent.java | 41 ++++++++++++++++++++++
.../services/net.shibboleth.idp.module.IdPModule | 1 +
.../idp/conf/profile-intercept-system.xml | 2 +-
.../flows/intercept/attribute-release-beans.xml | 11 ++++--
.../idp/flows/intercept/terms-of-use-beans.xml | 15 +++++---
.../conf/intercept/consent-intercept-config.xml | 27 +-------------
.../idp/module/intercept/impl/module.properties | 11 ++++++
.../module}/views/intercept/attribute-release.vm | 0
.../idp/module}/views/intercept/terms-of-use.vm | 0
idp-conf/src/main/resources/conf/idp.properties | 4 +++
.../idp/consent/logic/impl/AttributePredicate.java | 4 +--
11 files changed, 79 insertions(+), 37 deletions(-)
diff --git a/idp-conf-impl/src/main/java/net/shibboleth/idp/module/intercept/impl/Consent.java b/idp-conf-impl/src/main/java/net/shibboleth/idp/module/intercept/impl/Consent.java
new file mode 100644
index 000000000..0107f5da9
--- /dev/null
+++ b/idp-conf-impl/src/main/java/net/shibboleth/idp/module/intercept/impl/Consent.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.module.intercept.impl;
+
+import java.io.IOException;
+
+import net.shibboleth.idp.module.IdPModule;
+import net.shibboleth.idp.module.ModuleException;
+import net.shibboleth.idp.module.PropertyDrivenIdPModule;
+
+/**
+ * {@link IdPModule} implementation.
+ */
+public final class Consent extends PropertyDrivenIdPModule {
+
+ /**
+ * Constructor.
+ *
+ * @throws ModuleException on error
+ * @throws IOException on error
+ */
+ public Consent() throws IOException, ModuleException {
+ super(Consent.class);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule b/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
index 1a1736798..63ae430ca 100644
--- a/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
+++ b/idp-conf-impl/src/main/resources/META-INF/services/net.shibboleth.idp.module.IdPModule
@@ -12,6 +12,7 @@ net.shibboleth.idp.module.authn.impl.X509
net.shibboleth.idp.module.admin.impl.Hello
net.shibboleth.idp.module.admin.impl.UnlockKeys
+net.shibboleth.idp.module.intercept.impl.Consent
net.shibboleth.idp.module.intercept.impl.ContextCheck
net.shibboleth.idp.module.intercept.impl.ExpiringPassword
net.shibboleth.idp.module.intercept.impl.Impersonate
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/profile-intercept-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/profile-intercept-system.xml
index e22f91a28..a2b6cc355 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/profile-intercept-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/profile-intercept-system.xml
@@ -163,7 +163,7 @@
replacements that shrink the size of results saved to client-side storage such as cookies.
-->
<bean id="shibboleth.consent.DefaultAttributeSymbolics"
- class="org.springframework.beans.factory.config.MapFactoryBean" abstract="true">
+ class="org.springframework.beans.factory.config.MapFactoryBean">
<property name="sourceMap">
<map>
<!-- Attribute resolver core schema attributes -->
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-beans.xml
index e8e21f616..5fb96a7e7 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/attribute-release-beans.xml
@@ -14,7 +14,12 @@
<bean class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" />
<bean class="net.shibboleth.idp.profile.impl.ProfileActionBeanPostProcessor" />
- <import resource="%{idp.home}/conf/intercept/consent-intercept-config.xml" />
+ <!-- Default audit format. -->
+ <util:map id="DefaultAuditFormattingMap">
+ <entry key="Shibboleth-Consent-Audit" value="#{'%{idp.consent.attribute-release.auditFormat:%T|%SP|%e|%u|%CCI|%CCV|%CCA}'.trim()}" />
+ </util:map>
+
+ <import resource="conditional:%{idp.home}/conf/intercept/consent-intercept-config.xml" />
<bean class="net.shibboleth.ext.spring.util.DeprecatedBeanDetector" c:_1="consent-intercept-config.xml">
<constructor-arg index="0">
@@ -96,7 +101,7 @@
<bean id="AttributeReleaseAuditFormattingMapParser"
class="net.shibboleth.idp.profile.audit.impl.PopulateAuditContext.FormattingMapParser"
- c:_0-ref="shibboleth.consent.attribute-release.AuditFormattingMap" />
+ c:_0="#{getObject('shibboleth.consent.attribute-release.AuditFormattingMap') ?: getObject('DefaultAuditFormattingMap')}" />
<!-- Action beans -->
@@ -167,7 +172,7 @@
<bean id="WriteAttributeReleaseConsentAuditLog"
class="net.shibboleth.idp.profile.audit.impl.WriteAuditLog" scope="prototype"
p:auditContextLookupStrategy-ref="shibboleth.consent.ChildLookup.ConsentAuditContext"
- p:formattingMap-ref="shibboleth.consent.attribute-release.AuditFormattingMap"
+ p:formattingMap="#{getObject('shibboleth.consent.attribute-release.AuditFormattingMap') ?: getObject('DefaultAuditFormattingMap')}"
p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/terms-of-use-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/terms-of-use-beans.xml
index 7f9e2b73e..e580c082c 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/terms-of-use-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/intercept/terms-of-use-beans.xml
@@ -14,11 +14,16 @@
<bean class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" />
<bean class="net.shibboleth.idp.profile.impl.ProfileActionBeanPostProcessor" />
- <import resource="%{idp.home}/conf/intercept/consent-intercept-config.xml" />
+ <!-- Default audit format. -->
+ <util:map id="DefaultAuditFormattingMap">
+ <entry key="Shibboleth-Consent-Audit" value="#{'%{idp.consent.terms-of-use.auditFormat:%T|%SP|%e|%u|%CCI|%CCV|%CCA}'.trim()}" />
+ </util:map>
+
+ <import resource="conditional:%{idp.home}/conf/intercept/consent-intercept-config.xml" />
<bean id="TermsOfUseConsentFunction"
class="net.shibboleth.idp.consent.logic.impl.MessageSourceConsentFunction"
- p:consentKeyLookupStrategy-ref="shibboleth.consent.terms-of-use.Key"
+ p:consentKeyLookupStrategy="#{getObject('shibboleth.consent.terms-of-use.Key') ?: getObject('shibboleth.RelyingPartyIdLookup.Simple')}"
p:consentValueMessageCodeSuffix="%{idp.consent.terms-of-use.consentValueMessageCodeSuffix:.text}" />
<bean id="IsConsentRequiredPredicate"
@@ -44,7 +49,7 @@
<bean id="shibboleth.consent.UserAndTermsStorageKey"
class="net.shibboleth.idp.consent.logic.impl.JoinFunction"
c:functionA-ref="shibboleth.consent.UserStorageKey"
- c:functionB-ref="shibboleth.consent.terms-of-use.Key" />
+ c:functionB="#{getObject('shibboleth.consent.terms-of-use.Key') ?: getObject('shibboleth.RelyingPartyIdLookup.Simple')}" />
<!--
Function to return the storage key of the index record containing all storage keys
@@ -65,7 +70,7 @@
<bean id="TermsOfUseAuditFormattingMapParser"
class="net.shibboleth.idp.profile.audit.impl.PopulateAuditContext.FormattingMapParser"
- c:_0-ref="shibboleth.consent.terms-of-use.AuditFormattingMap" />
+ c:_0="#{getObject('shibboleth.consent.terms-of-use.AuditFormattingMap') ?: getObject('DefaultAuditFormattingMap')}" />
<!-- Action beans -->
@@ -101,7 +106,7 @@
<bean id="WriteConsentAuditLog" class="net.shibboleth.idp.profile.audit.impl.WriteAuditLog" scope="prototype"
p:auditContextLookupStrategy-ref="shibboleth.consent.ChildLookup.ConsentAuditContext"
- p:formattingMap-ref="shibboleth.consent.terms-of-use.AuditFormattingMap"
+ p:formattingMap="#{getObject('shibboleth.consent.terms-of-use.AuditFormattingMap') ?: getObject('DefaultAuditFormattingMap')}"
p:dateTimeFormat="#{getObject('shibboleth.AuditDateTimeFormat')}"
p:useDefaultTimeZone="#{getObject('shibboleth.AuditDefaultTimeZone') ?: false}"
p:httpServletRequest-ref="shibboleth.HttpServletRequest" />
diff --git a/idp-conf/src/main/resources/conf/intercept/consent-intercept-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/consent-intercept-config.xml
similarity index 77%
rename from idp-conf/src/main/resources/conf/intercept/consent-intercept-config.xml
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/consent-intercept-config.xml
index 26172a23e..a76d5809f 100644
--- a/idp-conf/src/main/resources/conf/intercept/consent-intercept-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/intercept/consent-intercept-config.xml
@@ -17,12 +17,10 @@
<!--
Terms of use is driven by a lookup function returning a key into messages/consent-messages.properties
- The default mapping returns the relying party / SP name as the key. The second example below
+ The default mapping returns the relying party / SP name as the key. The example below
demonstrates use of a custom mapping table from the relying party name to the key to use.
-->
- <alias alias="shibboleth.consent.terms-of-use.Key" name="shibboleth.RelyingPartyIdLookup.Simple" />
-
<!--
<bean id="shibboleth.consent.terms-of-use.Key" parent="shibboleth.Functions.Compose">
<constructor-arg name="g">
@@ -73,29 +71,6 @@
</util:list>
-->
- <!--
- These beans define mappings between audit log categories and formatting strings.
- -->
-
- <!--
- For terms-of-use acceptance, the default entry is :
- 'YYYYMMDDTHHMMSSZ|TermsAccepted|jdoe|example-tou-1|rHo...rrw=|true'
-
- For terms-of-use refusal, the default entry is :
- 'YYYYMMDDTHHMMSSZ|TermsRejected|jdoe|example-tou-1|rHo...rrw=|false'
- -->
- <util:map id="shibboleth.consent.terms-of-use.AuditFormattingMap">
- <entry key="Shibboleth-Consent-Audit" value="%T|%SP|%e|%u|%CCI|%CCV|%CCA" />
- </util:map>
-
- <!--
- For attribute-release consent, the default entry is :
- 'YYYYMMDDTHHMMSSZ|https://sp.example.org|AttributeReleaseConsent|jdoe|email,eduPersonAffiliation|rHo...rrw=,rHo...rrw=|false,false'
- -->
- <util:map id="shibboleth.consent.attribute-release.AuditFormattingMap">
- <entry key="Shibboleth-Consent-Audit" value="%T|%SP|%e|%u|%CCI|%CCV|%CCA" />
- </util:map>
-
<!--
Specify custom symbolic replacements for attribute names to shrink the size of results saved to client-side storage
such as cookies.
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/intercept/impl/module.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/intercept/impl/module.properties
index 839f693d3..a9d94abd9 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/intercept/impl/module.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/intercept/impl/module.properties
@@ -1,11 +1,22 @@
# Properties defining interceptor modules
# Class to Module ID mappings
+net.shibboleth.idp.module.intercept.impl.Consent = idp.intercept.Consent
net.shibboleth.idp.module.intercept.impl.ContextCheck = idp.intercept.ContextCheck
net.shibboleth.idp.module.intercept.impl.ExpiringPassword = idp.intercept.ExpiringPassword
net.shibboleth.idp.module.intercept.impl.Impersonate = idp.intercept.Impersonate
net.shibboleth.idp.module.intercept.impl.Warning = idp.intercept.Warning
+idp.intercept.Consent.name = Consent Interceptors
+idp.intercept.Consent.desc = Interceptor flows for attribute and terms of use consent
+idp.intercept.Consent.url = https://wiki.shibboleth.net/confluence/display/IDP4/ConsentConfiguration
+idp.intercept.Consent.1.src = /net/shibboleth/idp/module/conf/intercept/consent-intercept-config.xml
+idp.intercept.Consent.1.dest = conf/intercept/consent-intercept-config.xml
+idp.intercept.Consent.2.src = /net/shibboleth/idp/module/views/intercept/attribute-release.vm
+idp.intercept.Consent.2.dest = views/intercept/attribute-release.vm
+idp.intercept.Consent.3.src = /net/shibboleth/idp/module/views/intercept/terms-of-use.vm
+idp.intercept.Consent.3.dest = views/intercept/terms-of-use.vm
+
idp.intercept.ContextCheck.name = Context Checking Interceptor
idp.intercept.ContextCheck.desc = Interceptor flow for authorization based on request state
idp.intercept.ContextCheck.url = https://wiki.shibboleth.net/confluence/display/IDP4/ContextCheckInterceptConfiguration
diff --git a/idp-conf/src/main/resources/views/intercept/attribute-release.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/attribute-release.vm
similarity index 100%
rename from idp-conf/src/main/resources/views/intercept/attribute-release.vm
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/attribute-release.vm
diff --git a/idp-conf/src/main/resources/views/intercept/terms-of-use.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/terms-of-use.vm
similarity index 100%
rename from idp-conf/src/main/resources/views/intercept/terms-of-use.vm
rename to idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/intercept/terms-of-use.vm
diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index 2f5c04d2c..c42c09d68 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -130,6 +130,10 @@ idp.session.secondaryServiceIndex = true
# Set to "shibboleth.StorageService" or custom bean for alternate storage of consent
#idp.consent.StorageService = shibboleth.ClientPersistentStorageService
+# Default consent auditing formats
+#idp.consent.terms-of-use.auditFormat = %T|%SP|%e|%u|%CCI|%CCV|%CCA
+#idp.consent.attribute-release.auditFormat = %T|%SP|%e|%u|%CCI|%CCV|%CCA
+
# Set to "shibboleth.consent.AttributeConsentStorageKey" to use an attribute
# to key user consent storage records (and set the attribute name)
#idp.consent.attribute-release.userStorageKey = shibboleth.consent.PrincipalConsentStorageKey
diff --git a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/AttributePredicate.java b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/AttributePredicate.java
index ac0dff684..b56751b16 100644
--- a/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/AttributePredicate.java
+++ b/idp-consent-impl/src/main/java/net/shibboleth/idp/consent/logic/impl/AttributePredicate.java
@@ -60,7 +60,7 @@ public class AttributePredicate extends AbstractInitializableComponent implement
*
* @param prompted prompted attribute IDs
*/
- public void setPromptedAttributeIds(@Nonnull @NonnullElements final Collection<String> prompted) {
+ public void setPromptedAttributeIds(@Nullable @NonnullElements final Collection<String> prompted) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
promptedAttributeIds = new HashSet<>(StringSupport.normalizeStringCollection(prompted));
@@ -71,7 +71,7 @@ public class AttributePredicate extends AbstractInitializableComponent implement
*
* @param ignored ignored attribute IDs
*/
- public void setIgnoredAttributeIds(@Nonnull @NonnullElements final Collection<String> ignored) {
+ public void setIgnoredAttributeIds(@Nullable @NonnullElements final Collection<String> ignored) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
ignoredAttributeIds = new HashSet<>(StringSupport.normalizeStringCollection(ignored));
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list