[java-opensaml] 02/03: IDP-1870: Detect duplicate entityIDs when ingesting metadata
Brent Putman
putmanb at georgetown.edu
Thu Dec 2 03:56:11 UTC 2021
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch main
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=46f6ffdaf759d9cd8f8301b9a4efd73a16809433
commit 46f6ffdaf759d9cd8f8301b9a4efd73a16809433
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Dec 1 21:59:57 2021 -0500
IDP-1870: Detect duplicate entityIDs when ingesting metadata
Update SAML metadata lookup handler to support new criterion.
---
.../SAMLMetadataLookupParametersContext.java | 51 ++++++++++++++++++++++
.../binding/impl/SAMLMetadataLookupHandler.java | 15 ++++++-
.../impl/SAMLMetadataLookupHandlerTest.java | 35 +++++++++++++++
3 files changed, 100 insertions(+), 1 deletion(-)
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/SAMLMetadataLookupParametersContext.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/SAMLMetadataLookupParametersContext.java
new file mode 100644
index 000000000..5a207d3b8
--- /dev/null
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/SAMLMetadataLookupParametersContext.java
@@ -0,0 +1,51 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.saml.common.messaging.context;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.BaseContext;
+import org.opensaml.saml.metadata.resolver.DetectDuplicateEntityIDs;
+
+/**
+ * Context for operational parameters that influence the lookup of SAML metadata.
+ */
+public class SAMLMetadataLookupParametersContext extends BaseContext {
+
+ /** The strategy for duplicate entityID detection. */
+ @Nullable private DetectDuplicateEntityIDs detectDuplicateEntityIDs;
+
+ /**
+ * Get the strategy for duplicate entityID detection.
+ *
+ * @return strategy for duplicate entityID detection
+ */
+ @Nullable public DetectDuplicateEntityIDs getDetectDuplicateEntityIDs() {
+ return detectDuplicateEntityIDs;
+ }
+
+ /**
+ * Set the strategy for duplicate entityID detection.
+ *
+ * @param strategy the strategy for duplicate entityID detection
+ */
+ public void setDetectDuplicateEntityIDs(@Nullable final DetectDuplicateEntityIDs strategy) {
+ detectDuplicateEntityIDs = strategy;
+ }
+
+}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLMetadataLookupHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLMetadataLookupHandler.java
index f2288be02..1ae13e076 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLMetadataLookupHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLMetadataLookupHandler.java
@@ -37,10 +37,12 @@ import org.opensaml.messaging.handler.AbstractMessageHandler;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.saml.common.messaging.context.AbstractSAMLEntityContext;
import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
+import org.opensaml.saml.common.messaging.context.SAMLMetadataLookupParametersContext;
import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
import org.opensaml.saml.common.messaging.context.SAMLProtocolContext;
import org.opensaml.saml.criterion.EntityRoleCriterion;
import org.opensaml.saml.criterion.ProtocolCriterion;
+import org.opensaml.saml.metadata.criteria.entity.DetectDuplicateEntityIDsCriterion;
import org.opensaml.saml.metadata.resolver.RoleDescriptorResolver;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
import org.opensaml.saml.saml2.metadata.RoleDescriptor;
@@ -159,7 +161,18 @@ public class SAMLMetadataLookupHandler extends AbstractMessageHandler {
protocolCriterion = new ProtocolCriterion(protocolCtx.getProtocol());
}
- final CriteriaSet criteria = new CriteriaSet(entityIdCriterion, protocolCriterion, roleCriterion);
+ final SAMLMetadataLookupParametersContext lookupParamsContext =
+ messageContext.getSubcontext(SAMLMetadataLookupParametersContext.class);
+
+ DetectDuplicateEntityIDsCriterion detectDuplicatesCriterion = null;
+ if (lookupParamsContext != null && lookupParamsContext.getDetectDuplicateEntityIDs() != null) {
+ detectDuplicatesCriterion =
+ new DetectDuplicateEntityIDsCriterion(lookupParamsContext.getDetectDuplicateEntityIDs());
+ }
+
+ final CriteriaSet criteria = new CriteriaSet(entityIdCriterion, protocolCriterion, roleCriterion,
+ detectDuplicatesCriterion);
+
try {
final RoleDescriptor roleMetadata = metadataResolver.resolveSingle(criteria);
if (roleMetadata == null) {
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/SAMLMetadataLookupHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/SAMLMetadataLookupHandlerTest.java
index 927d59d90..e622f7422 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/SAMLMetadataLookupHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/SAMLMetadataLookupHandlerTest.java
@@ -26,10 +26,13 @@ import org.opensaml.core.testing.XMLObjectBaseTestCase;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
+import org.opensaml.saml.common.messaging.context.SAMLMetadataLookupParametersContext;
import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
import org.opensaml.saml.common.messaging.context.SAMLPresenterEntityContext;
import org.opensaml.saml.common.messaging.context.SAMLProtocolContext;
import org.opensaml.saml.common.xml.SAMLConstants;
+import org.opensaml.saml.metadata.criteria.entity.DetectDuplicateEntityIDsCriterion;
+import org.opensaml.saml.metadata.resolver.DetectDuplicateEntityIDs;
import org.opensaml.saml.metadata.resolver.impl.FilesystemMetadataResolver;
import org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver;
import org.opensaml.saml.saml1.core.AttributeQuery;
@@ -48,6 +51,7 @@ import org.testng.annotations.Test;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
/**
@@ -352,6 +356,37 @@ public class SAMLMetadataLookupHandlerTest extends XMLObjectBaseTestCase {
Assert.assertNotNull(mdCtx.getEntityDescriptor());
Assert.assertNotSame(mdCtx.getEntityDescriptor(), existingMetadataContext.getEntityDescriptor());
}
+
+ @Test
+ public void testDetectDuplicateEntityIDs() throws ComponentInitializationException, MessageHandlerException {
+ handler.setRoleDescriptorResolver(roleResolver);
+ handler.initialize();
+
+ SAMLPeerEntityContext peerContext = messageContext.getSubcontext(SAMLPeerEntityContext.class, true);
+ peerContext.setRole(IDPSSODescriptor.DEFAULT_ELEMENT_NAME);
+ messageContext.getSubcontext(SAMLProtocolContext.class, true).setProtocol(SAMLConstants.SAML11P_NS);
+
+ messageContext.getSubcontext(SAMLMetadataLookupParametersContext.class, true).setDetectDuplicateEntityIDs(DetectDuplicateEntityIDs.Batch);
+
+ Request request = SAML1ActionTestingSupport.buildAttributeQueryRequest(null);
+ ((AttributeQuery) request.getQuery()).setResource("urn:mace:incommon:osu.edu");
+ messageContext.setMessage(request);
+
+ // The context data/criterion won't influence the actual results, so just test that criterion has been added as expected.
+ CriteriaSet criteria = handler.buildLookupCriteria(messageContext);
+ Assert.assertNotNull(criteria);
+ Assert.assertTrue(criteria.contains(DetectDuplicateEntityIDsCriterion.class));
+ Assert.assertEquals(criteria.get(DetectDuplicateEntityIDsCriterion.class).getValue(), DetectDuplicateEntityIDs.Batch);
+
+ // For good measure actually test resolution and that hasn't caused any failures due to side effects, etc.
+ handler.invoke(messageContext);
+
+ SAMLMetadataContext mdCtx = peerContext.getSubcontext(SAMLMetadataContext.class, false);
+ Assert.assertNotNull(mdCtx);
+ Assert.assertNotNull(mdCtx.getRoleDescriptor());
+ Assert.assertNotNull(mdCtx.getEntityDescriptor());
+
+ }
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list