[java-opensaml] branch main updated: Add interface for "generic" assertion validation as extension point.
Scott Cantor
cantor.2 at osu.edu
Fri Jan 8 22:00:13 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=a3a9d3c01b37d057927bf5fd445024cdcb963fe1
The following commit(s) were added to refs/heads/main by this push:
new a3a9d3c01 Add interface for "generic" assertion validation as extension point.
a3a9d3c01 is described below
commit a3a9d3c01b37d057927bf5fd445024cdcb963fe1
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Jan 8 17:00:10 2021 -0500
Add interface for "generic" assertion validation as extension point.
---
...itionValidator.java => AssertionValidator.java} | 29 +++++-----
.../saml/saml2/assertion/ConditionValidator.java | 4 +-
.../saml2/assertion/SAML20AssertionValidator.java | 61 +++++++++++++++++++---
.../saml/saml2/assertion/StatementValidator.java | 4 +-
.../assertion/SubjectConfirmationValidator.java | 5 +-
5 files changed, 73 insertions(+), 30 deletions(-)
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/ConditionValidator.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/AssertionValidator.java
similarity index 66%
copy from opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/ConditionValidator.java
copy to opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/AssertionValidator.java
index 0bac96176..63d0b364a 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/ConditionValidator.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/AssertionValidator.java
@@ -19,37 +19,34 @@ package org.opensaml.saml.saml2.assertion;
import javax.annotation.Nonnull;
import javax.annotation.concurrent.ThreadSafe;
-import javax.xml.namespace.QName;
import org.opensaml.saml.common.assertion.AssertionValidationException;
import org.opensaml.saml.common.assertion.ValidationContext;
import org.opensaml.saml.common.assertion.ValidationResult;
import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.Condition;
-/** A validator that evaluates a {@link Condition} within an {@link Assertion}. */
+/**
+ * A validator that evaluates an {@link Assertion} generically.
+ *
+ * <p>This is a generic extension point for deployer-provided logic outside normal constraints.</p>
+ *
+ * @since 4.1.0
+ */
@ThreadSafe
-public interface ConditionValidator {
-
- /**
- * Gets the element or schema type QName of the condition handled by this validator.
- *
- * @return element or schema type QName of the statement handled by this validator
- */
- @Nonnull public QName getServicedCondition();
+public interface AssertionValidator {
/**
- * Validates the given condition.
+ * Validates the given assertion.
*
- * @param condition condition to be evaluated
- * @param assertion assertion bearing the condition
+ * @param assertion assertion being evaluated
* @param context current Assertion validation context
*
- * @return the result of the condition evaluation
+ * @return the result of the evaluation
*
* @throws AssertionValidationException if there is a problem processing the validation operation
*/
- @Nonnull public ValidationResult validate(@Nonnull final Condition condition, @Nonnull final Assertion assertion,
+ @Nonnull ValidationResult validate(@Nonnull final Assertion assertion,
@Nonnull final ValidationContext context) throws AssertionValidationException;
+
}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/ConditionValidator.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/ConditionValidator.java
index 0bac96176..9b81e0bc5 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/ConditionValidator.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/ConditionValidator.java
@@ -37,7 +37,7 @@ public interface ConditionValidator {
*
* @return element or schema type QName of the statement handled by this validator
*/
- @Nonnull public QName getServicedCondition();
+ @Nonnull QName getServicedCondition();
/**
* Validates the given condition.
@@ -50,6 +50,6 @@ public interface ConditionValidator {
*
* @throws AssertionValidationException if there is a problem processing the validation operation
*/
- @Nonnull public ValidationResult validate(@Nonnull final Condition condition, @Nonnull final Assertion assertion,
+ @Nonnull ValidationResult validate(@Nonnull final Condition condition, @Nonnull final Assertion assertion,
@Nonnull final ValidationContext context) throws AssertionValidationException;
}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML20AssertionValidator.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML20AssertionValidator.java
index 692447bf1..b8815781c 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML20AssertionValidator.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML20AssertionValidator.java
@@ -27,6 +27,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.xml.namespace.QName;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.collection.LazyMap;
import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
@@ -128,19 +129,22 @@ public class SAML20AssertionValidator {
@Nonnull private final Logger log = LoggerFactory.getLogger(SAML20AssertionValidator.class);
/** Registered {@link Condition} validators. */
- private LazyMap<QName, ConditionValidator> conditionValidators;
+ @Nonnull @NonnullElements private LazyMap<QName, ConditionValidator> conditionValidators;
/** Registered {@link SubjectConfirmation} validators. */
- private LazyMap<String, SubjectConfirmationValidator> subjectConfirmationValidators;
+ @Nonnull @NonnullElements private LazyMap<String, SubjectConfirmationValidator> subjectConfirmationValidators;
/** Registered {@link Statement} validators. */
- private LazyMap<QName, StatementValidator> statementValidators;
+ @Nonnull @NonnullElements private LazyMap<QName, StatementValidator> statementValidators;
+
+ /** Generic validator. */
+ @Nullable private AssertionValidator assertionValidator;
/** Trust engine for signature evaluation. */
- private SignatureTrustEngine trustEngine;
+ @Nullable private SignatureTrustEngine trustEngine;
/** SAML signature profile validator.*/
- private SignaturePrevalidator signaturePrevalidator;
+ @Nullable private SignaturePrevalidator signaturePrevalidator;
/**
* Constructor.
@@ -149,15 +153,19 @@ public class SAML20AssertionValidator {
* @param newConfirmationValidators validators used to validate {@link SubjectConfirmation} methods within the
* assertion
* @param newStatementValidators validators used to validate {@link Statement}s within the assertion
+ * @param newAssertionValidator generic validator extension point
* @param newTrustEngine the trust used to validate the Assertion signature
* @param newSignaturePrevalidator the signature pre-validator used to pre-validate the Assertion signature
+ *
+ * @since 4.1.0
*/
public SAML20AssertionValidator(@Nullable final Collection<ConditionValidator> newConditionValidators,
@Nullable final Collection<SubjectConfirmationValidator> newConfirmationValidators,
- @Nullable final Collection<StatementValidator> newStatementValidators,
+ @Nullable final Collection<StatementValidator> newStatementValidators,
+ @Nullable final AssertionValidator newAssertionValidator,
@Nullable final SignatureTrustEngine newTrustEngine,
@Nullable final SignaturePrevalidator newSignaturePrevalidator) {
-
+
conditionValidators = new LazyMap<>();
if (newConditionValidators != null) {
for (final ConditionValidator validator : newConditionValidators) {
@@ -185,9 +193,37 @@ public class SAML20AssertionValidator {
}
}
+ assertionValidator = newAssertionValidator;
+
trustEngine = newTrustEngine;
signaturePrevalidator = newSignaturePrevalidator;
}
+
+ /**
+ * Constructor.
+ *
+ * @param newConditionValidators validators used to validate the {@link Condition}s within the assertion
+ * @param newConfirmationValidators validators used to validate {@link SubjectConfirmation} methods within the
+ * assertion
+ * @param newStatementValidators validators used to validate {@link Statement}s within the assertion
+ * @param newTrustEngine the trust used to validate the Assertion signature
+ * @param newSignaturePrevalidator the signature pre-validator used to pre-validate the Assertion signature
+ *
+ * @deprecated
+ */
+ @Deprecated
+ public SAML20AssertionValidator(@Nullable final Collection<ConditionValidator> newConditionValidators,
+ @Nullable final Collection<SubjectConfirmationValidator> newConfirmationValidators,
+ @Nullable final Collection<StatementValidator> newStatementValidators,
+ @Nullable final SignatureTrustEngine newTrustEngine,
+ @Nullable final SignaturePrevalidator newSignaturePrevalidator) {
+
+ this(newConditionValidators, newConfirmationValidators, newStatementValidators, null,
+ newTrustEngine, newSignaturePrevalidator);
+
+ DeprecationSupport.warn(ObjectType.METHOD, "SAML20AssertionValidator 5 argument constructor", null,
+ "SAML20AssertionValidator 6 argument constructor");
+ }
/**
* Gets the clock skew from the {@link ValidationContext#getStaticParameters()} parameters. If the parameter is not
@@ -265,7 +301,16 @@ public class SAML20AssertionValidator {
return result;
}
- return validateStatements(assertion, context);
+ result = validateStatements(assertion, context);
+ if (result != ValidationResult.VALID) {
+ return result;
+ }
+
+ if (assertionValidator != null) {
+ return assertionValidator.validate(assertion, context);
+ }
+
+ return ValidationResult.VALID;
}
/**
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/StatementValidator.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/StatementValidator.java
index d8c9aabcc..bedf46348 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/StatementValidator.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/StatementValidator.java
@@ -37,7 +37,7 @@ public interface StatementValidator {
*
* @return element or schema type QName of the statement handled by this validator
*/
- @Nonnull public QName getServicedStatement();
+ @Nonnull QName getServicedStatement();
/**
* Validates the given statement.
@@ -50,7 +50,7 @@ public interface StatementValidator {
*
* @throws AssertionValidationException if there is a problem processing the validation operation
*/
- @Nonnull public ValidationResult validate(@Nonnull final Statement statement,
+ @Nonnull ValidationResult validate(@Nonnull final Statement statement,
@Nonnull final Assertion assertion, @Nonnull final ValidationContext context)
throws AssertionValidationException;
}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SubjectConfirmationValidator.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SubjectConfirmationValidator.java
index 679b33882..438d22267 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SubjectConfirmationValidator.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SubjectConfirmationValidator.java
@@ -18,6 +18,7 @@
package org.opensaml.saml.saml2.assertion;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.saml.common.assertion.AssertionValidationException;
@@ -39,7 +40,7 @@ public interface SubjectConfirmationValidator {
*
* @return subject confirmation method handled by this validator
*/
- public String getServicedMethod();
+ @Nullable String getServicedMethod();
/**
* Confirms the {@link org.opensaml.saml.saml2.core.Subject}
@@ -53,7 +54,7 @@ public interface SubjectConfirmationValidator {
*
* @throws AssertionValidationException if there is a problem processing the validation operation
*/
- @Nonnull public ValidationResult validate(@Nonnull final SubjectConfirmation confirmation,
+ @Nonnull ValidationResult validate(@Nonnull final SubjectConfirmation confirmation,
@Nonnull final Assertion assertion, @Nonnull final ValidationContext context)
throws AssertionValidationException;
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list