[java-idp-oidc] branch main updated: JOIDC-30 SAML metadata UIInfo handled inconsistently
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Feb 19 13:47:12 UTC 2021
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=bfe302af3ce6e37b936b92118a0c59923c49b84c
The following commit(s) were added to refs/heads/main by this push:
new bfe302af JOIDC-30 SAML metadata UIInfo handled inconsistently
bfe302af is described below
commit bfe302af3ce6e37b936b92118a0c59923c49b84c
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Feb 19 15:46:56 2021 +0200
JOIDC-30 SAML metadata UIInfo handled inconsistently
https://issues.shibboleth.net/jira/browse/JOIDC-30
---
...tboundAuthenticationResponseMessageContext.java | 105 +++++++++++++++------
...ndAuthenticationResponseMessageContextTest.java | 20 ++--
2 files changed, 86 insertions(+), 39 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java
index 30aafa98..8a745536 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContext.java
@@ -19,6 +19,8 @@ package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCMetadataContext;
import net.shibboleth.idp.profile.IdPEventIds;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.saml.profile.context.navigate.SAMLMetadataContextLookupFunction;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -37,9 +39,7 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
-import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
-import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
import org.opensaml.saml.ext.saml2mdui.DisplayName;
import org.opensaml.saml.ext.saml2mdui.InformationURL;
import org.opensaml.saml.ext.saml2mdui.Logo;
@@ -86,14 +86,24 @@ public class InitializeOutboundAuthenticationResponseMessageContext
@Nonnull
private final Logger log = LoggerFactory.getLogger(InitializeOutboundAuthenticationResponseMessageContext.class);
- /** Strategy function to create the {@link SAMLMetadataContext}. */
- @Nonnull private Function<ProfileRequestContext, SAMLMetadataContext> samlMetadataCtxCreateStrategy;
-
/** Strategy function to lookup the {@link OIDCMetadataContext}. */
@Nonnull private Function<ProfileRequestContext, OIDCMetadataContext> oidcMetadataCtxLookupStrategy;
+
+ /**
+ * Strategy used to locate the {@link RelyingPartyContext} associated with a given {@link ProfileRequestContext}.
+ */
+ @Nonnull private Function<ProfileRequestContext, RelyingPartyContext> relyingPartyCtxLookupStrategy;
+
+ /**
+ * Strategy used to locate the {@link SAMLMetadataContext} associated with a given {@link ProfileRequestContext}.
+ */
+ @Nonnull private Function<ProfileRequestContext, SAMLMetadataContext> samlMetadataCtxLookupStrategy;
/** The OIDC metadata context used as a source for the SAML metadata context. */
private OIDCMetadataContext oidcMetadataCtx;
+
+ /** The relying party context used for storing the SAML metadata context. */
+ private RelyingPartyContext relyingPartyCtx;
/** The default language when it has not been defined in the metadata. */
private String defaultLanguage;
@@ -102,57 +112,83 @@ public class InitializeOutboundAuthenticationResponseMessageContext
* Constructor.
*/
public InitializeOutboundAuthenticationResponseMessageContext() {
- samlMetadataCtxCreateStrategy =
- new ChildContextLookup<>(SAMLMetadataContext.class, true).compose(
- new ChildContextLookup<>(SAMLPeerEntityContext.class, true).compose(
- new OutboundMessageContextLookup()));
oidcMetadataCtxLookupStrategy = new ChildContextLookup<>(OIDCMetadataContext.class).compose(
new InboundMessageContextLookup());
+ relyingPartyCtxLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
+ samlMetadataCtxLookupStrategy = new SAMLMetadataContextLookupFunction();
defaultLanguage = "en";
}
/**
- * Get the mechanism to create the {@link SAMLMetadataContext} to the {@link ProfileRequestContext}.
+ * Get the mechanism to lookup the {@link OIDCMetadataContext} from the {@link ProfileRequestContext}.
*
- * @return The mechanism to create the {@link SAMLMetadataContext} to the {@link ProfileRequestContext}.
+ * @return The mechanism to lookup the {@link OIDCMetadataContext} from the {@link ProfileRequestContext}.
*/
@Nonnull
- public Function<ProfileRequestContext, SAMLMetadataContext> getSAMLMetadataContextCreateStrategy() {
- return samlMetadataCtxCreateStrategy;
+ public Function<ProfileRequestContext, OIDCMetadataContext> getOIDCMetadataContextLookupStrategy() {
+ return oidcMetadataCtxLookupStrategy;
}
/**
- * Set the mechanism to create the {@link OIDCMetadataContext} to the {@link ProfileRequestContext}.
+ * Set the mechanism to lookup the {@link OIDCMetadataContext} from the {@link ProfileRequestContext}.
*
* @param strgy What to set.
*/
- public void setSAMLMetadataContextCreateStrategy(
- @Nonnull final Function<ProfileRequestContext, SAMLMetadataContext> strgy) {
+ public void setOIDCMetadataContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, OIDCMetadataContext> strgy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- samlMetadataCtxCreateStrategy = Constraint.isNotNull(strgy, "Injected Metadata Strategy cannot be null");
+ oidcMetadataCtxLookupStrategy = Constraint.isNotNull(strgy, "Injected Metadata Strategy cannot be null");
}
/**
- * Get the mechanism to lookup the {@link OIDCMetadataContext} from the {@link ProfileRequestContext}.
+ * Get the mechanism to lookup the {@link RelyingPartyContext} from the {@link ProfileRequestContext}.
*
- * @return The mechanism to lookup the {@link OIDCMetadataContext} from the {@link ProfileRequestContext}.
+ * @return The mechanism to lookup the {@link RelyingPartyContext} from the {@link ProfileRequestContext}.
*/
@Nonnull
- public Function<ProfileRequestContext, OIDCMetadataContext> getOIDCMetadataContextLookupStrategy() {
- return oidcMetadataCtxLookupStrategy;
+ public Function<ProfileRequestContext, RelyingPartyContext> getRelyingPartyContextLookupStrategy() {
+ return relyingPartyCtxLookupStrategy;
}
/**
- * Set the mechanism to lookup the {@link OIDCMetadataContext} from the {@link ProfileRequestContext}.
+ * Set the strategy used to locate the {@link RelyingPartyContext} associated with a given
+ * {@link ProfileRequestContext}.
*
- * @param strgy What to set.
+ * @param strategy strategy used to locate the {@link RelyingPartyContext} associated with a given
+ * {@link ProfileRequestContext}
*/
- public void setOIDCMetadataContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, OIDCMetadataContext> strgy) {
+ public void setRelyingPartyContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- oidcMetadataCtxLookupStrategy = Constraint.isNotNull(strgy, "Injected Metadata Strategy cannot be null");
+ relyingPartyCtxLookupStrategy =
+ Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
+ }
+
+ /**
+ * Get the mechanism to lookup the {@link SAMLMetadataContext} from the {@link ProfileRequestContext}.
+ *
+ * @return The mechanism to lookup the {@link SAMLMetadataContext} from the {@link ProfileRequestContext}.
+ */
+ @Nonnull
+ public Function<ProfileRequestContext, SAMLMetadataContext> getSAMLMetadataContextLookupStrategy() {
+ return samlMetadataCtxLookupStrategy;
+ }
+
+ /**
+ * Set the strategy used to locate the {@link SAMLMetadataContext} associated with a given
+ * {@link ProfileRequestContext}.
+ *
+ * @param strategy strategy used to locate the {@link SAMLMetadataContext} associated with a given
+ * {@link ProfileRequestContext}
+ */
+ public void setSAMLMetadataContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, SAMLMetadataContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ samlMetadataCtxLookupStrategy =
+ Constraint.isNotNull(strategy, "SAMLMetadataContext lookup strategy cannot be null");
}
/**
@@ -181,6 +217,13 @@ public class InitializeOutboundAuthenticationResponseMessageContext
return false;
}
+ relyingPartyCtx = relyingPartyCtxLookupStrategy.apply(profileRequestContext);
+ if (relyingPartyCtx == null) {
+ log.error("{} No relying party context", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
+ return false;
+ }
+
return true;
}
@@ -188,7 +231,13 @@ public class InitializeOutboundAuthenticationResponseMessageContext
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
super.doExecute(profileRequestContext);
- final SAMLMetadataContext samlContext = samlMetadataCtxCreateStrategy.apply(profileRequestContext);
+
+ if (samlMetadataCtxLookupStrategy.apply(profileRequestContext) != null) {
+ log.debug("{} SAML metadata context already found", getLogPrefix());
+ return;
+ }
+
+ final SAMLMetadataContext samlContext = new SAMLMetadataContext();
final EntityDescriptor entityDescriptor = new EntityDescriptorBuilder().buildObject();
entityDescriptor.setEntityID(oidcMetadataCtx.getClientInformation().getID().getValue());
final OIDCClientMetadata oidcMetadata = oidcMetadataCtx.getClientInformation().getOIDCMetadata();
@@ -245,5 +294,7 @@ public class InitializeOutboundAuthenticationResponseMessageContext
spDescriptor.setExtensions(extensions);
samlContext.setEntityDescriptor(entityDescriptor);
samlContext.setRoleDescriptor(spDescriptor);
+
+ relyingPartyCtx.setRelyingPartyIdContextTree(samlContext);
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContextTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContextTest.java
index fb811aec..3ea02b72 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContextTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/InitializeOutboundAuthenticationResponseMessageContextTest.java
@@ -18,10 +18,11 @@
package net.shibboleth.idp.plugin.oidc.op.profile.impl;
import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCMetadataContext;
-import net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundAuthenticationResponseMessageContext;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
+import net.shibboleth.idp.saml.profile.context.navigate.SAMLMetadataContextLookupFunction;
import java.net.URI;
import java.net.URISyntaxException;
@@ -31,7 +32,6 @@ import java.util.Date;
import org.opensaml.core.xml.XMLObject;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
-import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
import org.opensaml.saml.ext.saml2mdui.UIInfo;
import org.opensaml.saml.saml2.metadata.Extensions;
import org.springframework.webflow.execution.Event;
@@ -68,6 +68,7 @@ public class InitializeOutboundAuthenticationResponseMessageContextTest {
action.initialize();
requestCtx = new RequestContextBuilder().setInboundMessage(request).buildRequestContext();
prc = new WebflowRequestContextProfileRequestContextLookup().apply(requestCtx);
+ prc.getSubcontext(RelyingPartyContext.class, true);
metadataCtx = (OIDCMetadataContext) prc.getInboundMessageContext().addSubcontext(new OIDCMetadataContext());
OIDCClientInformation information =
new OIDCClientInformation(new ClientID("clientId"), new Date(), new OIDCClientMetadata(), new Secret());
@@ -109,8 +110,7 @@ public class InitializeOutboundAuthenticationResponseMessageContextTest {
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertNotNull(prc.getOutboundMessageContext());
- SAMLMetadataContext ctx = prc.getOutboundMessageContext().getSubcontext(SAMLPeerEntityContext.class)
- .getSubcontext(SAMLMetadataContext.class);
+ SAMLMetadataContext ctx = new SAMLMetadataContextLookupFunction().apply(prc);
final Extensions exts = ctx.getRoleDescriptor().getExtensions();
if (exts != null) {
for (final XMLObject object : exts.getOrderedChildren()) {
@@ -130,8 +130,7 @@ public class InitializeOutboundAuthenticationResponseMessageContextTest {
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertNotNull(prc.getOutboundMessageContext());
- SAMLMetadataContext ctx = prc.getOutboundMessageContext().getSubcontext(SAMLPeerEntityContext.class)
- .getSubcontext(SAMLMetadataContext.class);
+ SAMLMetadataContext ctx = new SAMLMetadataContextLookupFunction().apply(prc);
final Extensions exts = ctx.getRoleDescriptor().getExtensions();
if (exts != null) {
for (final XMLObject object : exts.getOrderedChildren()) {
@@ -153,8 +152,7 @@ public class InitializeOutboundAuthenticationResponseMessageContextTest {
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertNotNull(prc.getOutboundMessageContext());
- SAMLMetadataContext ctx = prc.getOutboundMessageContext().getSubcontext(SAMLPeerEntityContext.class)
- .getSubcontext(SAMLMetadataContext.class);
+ SAMLMetadataContext ctx = new SAMLMetadataContextLookupFunction().apply(prc);
final Extensions exts = ctx.getRoleDescriptor().getExtensions();
if (exts != null) {
for (final XMLObject object : exts.getOrderedChildren()) {
@@ -177,8 +175,7 @@ public class InitializeOutboundAuthenticationResponseMessageContextTest {
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertNotNull(prc.getOutboundMessageContext());
- SAMLMetadataContext ctx = prc.getOutboundMessageContext().getSubcontext(SAMLPeerEntityContext.class)
- .getSubcontext(SAMLMetadataContext.class);
+ SAMLMetadataContext ctx = new SAMLMetadataContextLookupFunction().apply(prc);
Assert.assertEquals(2, ctx.getEntityDescriptor().getContactPersons().size());
Assert.assertEquals("mailto:contact1 at example.com",
ctx.getEntityDescriptor().getContactPersons().get(0).getEmailAddresses().get(0).getURI());
@@ -193,8 +190,7 @@ public class InitializeOutboundAuthenticationResponseMessageContextTest {
final Event event = action.execute(requestCtx);
ActionTestingSupport.assertProceedEvent(event);
Assert.assertNotNull(prc.getOutboundMessageContext());
- SAMLMetadataContext ctx = prc.getOutboundMessageContext().getSubcontext(SAMLPeerEntityContext.class)
- .getSubcontext(SAMLMetadataContext.class);
+ SAMLMetadataContext ctx = new SAMLMetadataContextLookupFunction().apply(prc);
final Extensions exts = ctx.getRoleDescriptor().getExtensions();
if (exts != null) {
for (final XMLObject object : exts.getOrderedChildren()) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list