[java-identity-provider] branch main updated: IDP-1728 - Add support for mapping proxied Attribute into AuthnContext
Scott Cantor
cantor.2 at osu.edu
Mon Jan 4 20:05:33 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=fada92adc319fe80b8fe40cbd02dfd75684c76fc
The following commit(s) were added to refs/heads/main by this push:
new fada92adc IDP-1728 - Add support for mapping proxied Attribute into AuthnContext
fada92adc is described below
commit fada92adc319fe80b8fe40cbd02dfd75684c76fc
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jan 4 15:05:30 2021 -0500
IDP-1728 - Add support for mapping proxied Attribute into AuthnContext
https://issues.shibboleth.net/jira/browse/IDP-1728
---
.../shibboleth/idp/conf/relying-party-mddriven.xml | 5 ++
.../config/BrowserSSOProfileConfiguration.java | 61 +++++++++++++++++++++-
.../profile/impl/ValidateSAMLAuthentication.java | 17 +++++-
3 files changed, 80 insertions(+), 3 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
index be1d2a8cd..d098e6be7 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
@@ -430,6 +430,11 @@
</property>
</bean>
</property>
+ <property name="authnContextTranslationStrategyExLookupStrategy">
+ <bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="authnContextTranslationStrategyEx"
+ p:propertyType="#{T(java.util.function.Function)}">
+ </bean>
+ </property>
<property name="authnContextComparisonLookupStrategy">
<bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="authnContextComparison">
<property name="defaultValueStrategy">
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index fe37c8e7c..93d5d77de 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -104,7 +104,11 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
/** Lookup function to supply the strategy function for translating SAML 2.0 AuthnContext data. */
@Nonnull private Function<ProfileRequestContext,Function<AuthnContext,Collection<Principal>>>
authnContextTranslationStrategyLookupStrategy;
-
+
+ /** Lookup function to supply the strategy function for translating fully-generic data. */
+ @Nonnull private Function<ProfileRequestContext,Function<ProfileRequestContext,Collection<Principal>>>
+ authnContextTranslationStrategyExLookupStrategy;
+
/** Lookup function for requested AC operator. */
@Nonnull private Function<ProfileRequestContext,String> authnContextComparisonLookupStrategy;
@@ -149,6 +153,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
authenticationFlowsLookupStrategy = FunctionSupport.constant(null);
postAuthenticationFlowsLookupStrategy = FunctionSupport.constant(null);
authnContextTranslationStrategyLookupStrategy = FunctionSupport.constant(null);
+ authnContextTranslationStrategyExLookupStrategy = FunctionSupport.constant(null);
authnContextComparisonLookupStrategy = new ProxyAwareAuthnContextComparisonLookupFunction();
defaultAuthenticationContextsLookupStrategy = new ProxyAwareDefaultAuthenticationMethodsLookupFunction();
nameIDFormatPrecedenceLookupStrategy = FunctionSupport.constant(null);
@@ -587,11 +592,63 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
* @since 4.0.0
*/
public void setAuthnContextTranslationStrategyLookupStrategy(
- @Nullable final Function<ProfileRequestContext,Function<AuthnContext,Collection<Principal>>> strategy) {
+ @Nonnull final Function<ProfileRequestContext,Function<AuthnContext,Collection<Principal>>> strategy) {
authnContextTranslationStrategyLookupStrategy =
Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /**
+ * Get the function to use to translate an inbound proxied response into the appropriate
+ * set of custom {@link Principal} objects to populate into the subject.
+ *
+ * <p>This differs from the original in that the input is the entire {@link ProfileRequestContext}
+ * of the proxied authentication state rather than the SAML {@link AuthnContext} directly.</p>
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return translation function
+ *
+ * @since 4.1.0
+ */
+ @Nullable public Function<ProfileRequestContext,Collection<Principal>> getAuthnContextTranslationStrategyEx(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return authnContextTranslationStrategyExLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the function to use to translate an inbound proxied response into the appropriate
+ * set of custom {@link Principal} objects to populate into the subject.
+ *
+ * <p>This differs from the original in that the input is the entire {@link ProfileRequestContext}
+ * of the proxied authentication state rather than the SAML {@link AuthnContext} directly.</p>
+ *
+ * @param strategy translation function
+ *
+ * @since 4.1.0
+ */
+ public void setAuthnContextTranslationStrategyEx(
+ @Nullable final Function<ProfileRequestContext,Collection<Principal>> strategy) {
+ authnContextTranslationStrategyExLookupStrategy = FunctionSupport.constant(strategy);
+ }
+
+ /**
+ * Set a lookup strategy for the function to use to translate an inbound proxied response
+ * into the appropriate set of custom {@link Principal} objects to populate into the subject.
+ *
+ * <p>This differs from the original in that the input is the entire {@link ProfileRequestContext}
+ * of the proxied authentication state rather than the SAML {@link AuthnContext} directly.</p>
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 4.1.0
+ */
+ public void setAuthnContextTranslationStrategyExLookupStrategy(
+ @Nonnull
+ final Function<ProfileRequestContext,Function<ProfileRequestContext,Collection<Principal>>> strategy) {
+ authnContextTranslationStrategyExLookupStrategy =
+ Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
/**
* Get the comparison operator to use when issuing SAML requests containing requested context classes.
*
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
index a5e89aad8..00781f4c3 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
@@ -127,6 +127,9 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
/** Incoming context translation function. */
@Nullable private Function<AuthnContext,Collection<Principal>> authnContextTranslator;
+ /** Incoming context extended translation function. */
+ @Nullable private Function<ProfileRequestContext,Collection<Principal>> authnContextTranslatorEx;
+
/** Context for externally supplied inbound attributes. */
@Nullable private AttributeContext attributeContext;
@@ -269,6 +272,7 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
}
authnContextTranslator = profileConfiguration.getAuthnContextTranslationStrategy(profileRequestContext);
+ authnContextTranslatorEx = profileConfiguration.getAuthnContextTranslationStrategyEx(profileRequestContext);
buildAuthenticationResult(profileRequestContext, authenticationContext);
@@ -294,7 +298,18 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
final AuthnContext authnContext = samlAuthnContext.getAuthnStatement().getAuthnContext();
- if (authnContextTranslator != null) {
+ if (authnContextTranslatorEx != null) {
+ // PRC is two levels above SAMLAuthnContext.
+ final Collection<Principal> translated = authnContextTranslatorEx.apply(
+ (ProfileRequestContext) samlAuthnContext.getParent().getParent());
+ if (translated != null) {
+ subject.getPrincipals().addAll(translated);
+ if (log.isDebugEnabled()) {
+ log.debug("{} Added translated Principals: {}", getLogPrefix(),
+ translated.stream().map(Principal::getName).collect(Collectors.toUnmodifiableList()));
+ }
+ }
+ } else if (authnContextTranslator != null) {
final Collection<Principal> translated = authnContextTranslator.apply(authnContext);
if (translated != null) {
subject.getPrincipals().addAll(translated);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list