[java-identity-provider] branch main updated: IDP-1686 - Looping detection

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=4d223aae8ad60499042e2f70c14fbbfd309a22b5

The following commit(s) were added to refs/heads/main by this push:
       new  4d223aae8 IDP-1686 - Looping detection
4d223aae8 is described below

commit 4d223aae8ad60499042e2f70c14fbbfd309a22b5
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Feb 23 19:57:48 2021 -0500

    IDP-1686 - Looping detection
    
    https://issues.shibboleth.net/jira/browse/IDP-1686
    
    Forgot to include username in metric name to isolate loops by user.
---
 .../idp/profile/logic/LoopDetectionPredicate.java   | 21 +++++++++++++++++++--
 .../profile/logic/LoopDetectionPredicateTest.java   |  2 ++
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/LoopDetectionPredicate.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/LoopDetectionPredicate.java
index edfcb9f86..0eda3c4bb 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/LoopDetectionPredicate.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/LoopDetectionPredicate.java
@@ -19,6 +19,7 @@ package net.shibboleth.idp.profile.logic;
 
 import java.util.Collections;
 import java.util.Map;
+import java.util.function.Function;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -37,6 +38,7 @@ import net.shibboleth.idp.profile.context.RelyingPartyContext;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
 import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
 
 /**
  * A condition that relies on a {@link Meter} to detect looping SPs. 
@@ -54,10 +56,14 @@ public class LoopDetectionPredicate extends AbstractRelyingPartyPredicate {
     /** Map of RP names to meter names. */
     @Nonnull @NonnullElements private Map<String,String> relyingPartyMap;
     
+    /** Lookup strategy to obtain subject name. */
+    @Nonnull private Function<ProfileRequestContext,String> usernameLookupStrategy;
+    
     /** Constructor. */
     public LoopDetectionPredicate() {
         threshold = 20;
         relyingPartyMap = Collections.emptyMap();
+        usernameLookupStrategy = FunctionSupport.constant(null);
     }
     
     /**
@@ -84,15 +90,26 @@ public class LoopDetectionPredicate extends AbstractRelyingPartyPredicate {
         }
     }
     
+    /**
+     * Set lookup strategy to obtain username.
+     * 
+     * @param strategy lookup strategy
+     */
+    public void setUsernameLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+        usernameLookupStrategy = Constraint.isNotNull(strategy, "Username lookup strategy cannot be null");
+    }
+    
     /** {@inheritDoc} */
     public boolean test(@Nullable final ProfileRequestContext input) {
         
+        final String username = usernameLookupStrategy.apply(input);
         final RelyingPartyContext rpCtx = getRelyingPartyContextLookupStrategy().apply(input);
-        if (rpCtx != null) {
+        
+        if (username != null && rpCtx != null && rpCtx.getRelyingPartyId() != null) {
             final String meterName = relyingPartyMap.get(rpCtx.getRelyingPartyId());
             if (meterName != null) {
                 final Meter meter = MetricsSupport.getMetricRegistry().meter(
-                        MetricRegistry.name("net.shibboleth.idp.loopDetection", meterName),
+                        MetricRegistry.name("net.shibboleth.idp.loopDetection", meterName, username.replace(".","")),
                         new MetricSupplier<Meter>() {
                             public Meter newMetric() {
                                 return new Meter(new SlidingTimeWindowMovingAverages());
diff --git a/idp-profile-api/src/test/java/net/shibboleth/idp/profile/logic/LoopDetectionPredicateTest.java b/idp-profile-api/src/test/java/net/shibboleth/idp/profile/logic/LoopDetectionPredicateTest.java
index a1f8959f9..93f595c1a 100644
--- a/idp-profile-api/src/test/java/net/shibboleth/idp/profile/logic/LoopDetectionPredicateTest.java
+++ b/idp-profile-api/src/test/java/net/shibboleth/idp/profile/logic/LoopDetectionPredicateTest.java
@@ -20,6 +20,7 @@ package net.shibboleth.idp.profile.logic;
 import java.util.Map;
 
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.utilities.java.support.logic.FunctionSupport;
 
 import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
 import org.opensaml.profile.context.ProfileRequestContext;
@@ -39,6 +40,7 @@ public class LoopDetectionPredicateTest extends OpenSAMLInitBaseTestCase {
         prc = new ProfileRequestContext();
         rpCtx = prc.getSubcontext(RelyingPartyContext.class, true);
         pred = new LoopDetectionPredicate();
+        pred.setUsernameLookupStrategy(FunctionSupport.constant("jdoe.1"));
     }
     
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.