[java-identity-provider] branch main updated: IDP-1716 - X509 flow within MFA and subject canonicalization
Scott Cantor
cantor.2 at osu.edu
Thu Jan 21 23:16:53 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=e6d4db849a2d0ed39310ba6702f75c97368b66d4
The following commit(s) were added to refs/heads/main by this push:
new e6d4db849 IDP-1716 - X509 flow within MFA and subject canonicalization
e6d4db849 is described below
commit e6d4db849a2d0ed39310ba6702f75c97368b66d4
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jan 21 18:16:11 2021 -0500
IDP-1716 - X509 flow within MFA and subject canonicalization
https://issues.shibboleth.net/jira/browse/IDP-1716
Add X500Principal serialization.
---
.../principal/impl/X500PrincipalSerializer.java | 147 +++++++++++++++++++++
.../impl/X500PrincipalSerializerTest.java | 52 ++++++++
.../net/shibboleth/idp/conf/authn-system.xml | 7 +
3 files changed, 206 insertions(+)
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/X500PrincipalSerializer.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/X500PrincipalSerializer.java
new file mode 100644
index 000000000..bf7ad93e7
--- /dev/null
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/X500PrincipalSerializer.java
@@ -0,0 +1,147 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.authn.principal.impl;
+
+import java.io.IOException;
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.security.Principal;
+import java.util.regex.Pattern;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import javax.annotation.concurrent.ThreadSafe;
+import javax.json.Json;
+import javax.json.JsonArrayBuilder;
+import javax.json.JsonBuilderFactory;
+import javax.json.JsonException;
+import javax.json.JsonObject;
+import javax.json.JsonObjectBuilder;
+import javax.json.JsonReader;
+import javax.json.JsonString;
+import javax.json.JsonStructure;
+import javax.json.JsonValue;
+import javax.json.JsonValue.ValueType;
+import javax.json.stream.JsonGenerator;
+import javax.security.auth.x500.X500Principal;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.idp.authn.principal.AbstractPrincipalSerializer;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.codec.Base64Support;
+import net.shibboleth.utilities.java.support.codec.DecodingException;
+import net.shibboleth.utilities.java.support.codec.EncodingException;
+
+/**
+ * Principal serializer for {@link X500Principal}.
+ *
+ * @since 4.1.0
+ */
+ at ThreadSafe
+public class X500PrincipalSerializer extends AbstractPrincipalSerializer<String> {
+
+ /** Field name of X.500 name. */
+ @Nonnull @NotEmpty private static final String X500_NAME_FIELD = "X500";
+
+ /** Pattern used to determine if input is supported. */
+ private static final Pattern JSON_PATTERN = Pattern.compile("^\\{\"X500\":.*\\}$");
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(X500PrincipalSerializer.class);
+
+ /** JSON object bulder factory. */
+ @Nonnull private final JsonBuilderFactory objectBuilderFactory;
+
+ /** Constructor. */
+ public X500PrincipalSerializer() {
+ objectBuilderFactory = Json.createBuilderFactory(null);
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean supports(@Nonnull final Principal principal) {
+ return principal instanceof X500Principal;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull @NotEmpty public String serialize(@Nonnull final Principal principal) throws IOException {
+
+ final X500Principal x500Principal = (X500Principal) principal;
+
+ final String name;
+ try {
+ name = Base64Support.encode(x500Principal.getEncoded(), false);
+ } catch (final EncodingException e) {
+ throw new IOException(e);
+ }
+
+ final StringWriter sink = new StringWriter(32);
+
+ try (final JsonGenerator gen = getJsonGenerator(sink)) {
+ gen.writeStartObject().write(X500_NAME_FIELD, name).writeEnd();
+ }
+ return sink.toString();
+ }
+
+ /** {@inheritDoc} */
+ public boolean supports(@Nonnull @NotEmpty final String value) {
+ return JSON_PATTERN.matcher(value).matches();
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public X500Principal deserialize(@Nonnull @NotEmpty final String value)
+ throws IOException {
+
+ try (final JsonReader reader = getJsonReader(new StringReader(value))) {
+ final JsonStructure st = reader.read();
+ if (!(st instanceof JsonObject)) {
+ throw new IOException("Found invalid data structure while parsing X500Principal");
+ }
+
+ final JsonValue jsonValue = ((JsonObject) st).get(X500_NAME_FIELD);
+ if (jsonValue != null && ValueType.STRING.equals(jsonValue.getValueType())) {
+ return new X500Principal(Base64Support.decode(((JsonString) jsonValue).getString()));
+ }
+
+ throw new IOException("Serialized X500Principal missing name field");
+ } catch (final JsonException | DecodingException | IllegalArgumentException e) {
+ throw new IOException("Found invalid data while parsing X500Principal", e);
+ }
+ }
+
+ /**
+ * Get a {@link JsonObjectBuilder} in a thread-safe manner.
+ *
+ * @return an object builder
+ */
+ @Nonnull private synchronized JsonObjectBuilder getJsonObjectBuilder() {
+ return objectBuilderFactory.createObjectBuilder();
+ }
+
+ /**
+ * Get a {@link JsonArrayBuilder} in a thread-safe manner.
+ *
+ * @return an array builder
+ */
+ @Nonnull private synchronized JsonArrayBuilder getJsonArrayBuilder() {
+ return objectBuilderFactory.createArrayBuilder();
+ }
+
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/principal/impl/X500PrincipalSerializerTest.java b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/principal/impl/X500PrincipalSerializerTest.java
new file mode 100644
index 000000000..40da72ed4
--- /dev/null
+++ b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/principal/impl/X500PrincipalSerializerTest.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.authn.principal.impl;
+
+import java.io.IOException;
+
+import javax.security.auth.x500.X500Principal;
+
+import org.testng.Assert;
+import org.testng.annotations.BeforeClass;
+import org.testng.annotations.Test;
+
+/** Unit test for {@link X500PrincipalSerializer}. */
+public class X500PrincipalSerializerTest {
+
+ X500PrincipalSerializer serializer;
+
+ @BeforeClass
+ public void setUp() {
+ serializer = new X500PrincipalSerializer();
+ }
+
+ @Test
+ public void testRoundTrip() throws IOException {
+
+ final X500Principal p1 = new X500Principal("DC=net, DC=shibboleth, CN=jdoe");
+
+ final String s = serializer.serialize(p1);
+ Assert.assertTrue(serializer.supports(s));
+
+ final X500Principal p2 = serializer.deserialize(s);
+ Assert.assertEquals(p1, p2);
+
+ Assert.assertEquals(p2.getName(), "DC=net,DC=shibboleth,CN=jdoe");
+ }
+
+}
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml
index 9291a611b..b99fff872 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml
@@ -368,6 +368,13 @@
<bean class="net.shibboleth.idp.authn.principal.impl.ProxyAuthenticationPrincipalSerializer" />
</constructor-arg>
</bean>
+
+ <bean p:id="x500" class="net.shibboleth.idp.authn.principal.GenericPrincipalService"
+ c:claz="javax.security.auth.x500.X500Principal">
+ <constructor-arg name="serializer">
+ <bean class="net.shibboleth.idp.authn.principal.impl.X500PrincipalSerializer" />
+ </constructor-arg>
+ </bean>
<!--
Defining this allows us to specify symbolic text replacements that shrink the size of results
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list