[java-opensaml] branch main updated: IDP-1296 - Non-standard extension to discriminate logout endpoints
Scott Cantor
cantor.2 at osu.edu
Tue Jun 8 20:28:09 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=7ee5c049173edebe7d5bdc6338b7b50194f68b83
The following commit(s) were added to refs/heads/main by this push:
new 7ee5c0491 IDP-1296 - Non-standard extension to discriminate logout endpoints
7ee5c0491 is described below
commit 7ee5c049173edebe7d5bdc6338b7b50194f68b83
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jun 8 16:28:06 2021 -0400
IDP-1296 - Non-standard extension to discriminate logout endpoints
https://issues.shibboleth.net/jira/browse/IDP-1296
Add optional BestMatch criterion and support in endpoint resolver.
---
.../common/binding/AbstractEndpointResolver.java | 40 +++++++++-
.../saml/criterion/BestMatchLocationCriterion.java | 90 ++++++++++++++++++++++
.../binding/impl/DefaultEndpointResolver.java | 9 ++-
.../binding/impl/DefaultEndpointResolverTest.java | 36 +++++++++
.../opensaml/saml/common/binding/SPWithVhosts.xml | 7 ++
5 files changed, 175 insertions(+), 7 deletions(-)
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java
index 881111af0..b4959e2c5 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java
@@ -34,6 +34,7 @@ import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
+import org.opensaml.saml.criterion.BestMatchLocationCriterion;
import org.opensaml.saml.criterion.BindingCriterion;
import org.opensaml.saml.criterion.EndpointCriterion;
import org.opensaml.saml.criterion.RoleDescriptorCriterion;
@@ -59,6 +60,10 @@ import org.slf4j.LoggerFactory;
* will be used in matching candidate endpoints for suitability, such as index, binding, location, etc. If so
* marked, it may also be resolved as a trusted endpoint without additional verification required.</dd>
*
+ * <dt>{@link BestMatchLocationCriterion}</dt>
+ * <dd>Prioritizes endpoint whose Location matches the most characters of the input criterion location. Only
+ * applied to the {@link #resolveSingle(CriteriaSet)} method.</dd>
+ *
* <dt>{@link BindingCriterion}</dt>
* <dd>Ordered list of bindings to filter and sort the endpoints. This overrides the ordering from the
* metadata and possibly overrides the normal default endpoint in favor of higher-precedence bindings.</dd>
@@ -118,7 +123,6 @@ public abstract class AbstractEndpointResolver<EndpointType extends Endpoint>
}
/** {@inheritDoc} */
- @Override
@Nonnull @NonnullElements public Iterable<EndpointType> resolve(@Nullable final CriteriaSet criteria)
throws ResolverException {
validateCriteria(criteria);
@@ -144,8 +148,8 @@ public abstract class AbstractEndpointResolver<EndpointType extends Endpoint>
return candidates;
}
+// Checkstyle: CyclomaticComplexity OFF
/** {@inheritDoc} */
- @Override
@Nullable public EndpointType resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
validateCriteria(criteria);
@@ -158,15 +162,45 @@ public abstract class AbstractEndpointResolver<EndpointType extends Endpoint>
return null;
}
+ // Starting at -1 ensures the first candidate automatically starts as the best match.
+ int bestMatchLen = -1;
+ EndpointType bestMatch = null;
+
+ final BestMatchLocationCriterion startsWith = criteria.get(BestMatchLocationCriterion.class);
+
for (final EndpointType candidate : getCandidatesFromMetadata(criteria)) {
if (doCheckEndpoint(criteria, candidate)) {
- return candidate;
+ if (startsWith != null) {
+ // Evaluate how good a match it is.
+ final String candidateLocation = candidate.getLocation() != null ?
+ candidate.getLocation() : candidate.getResponseLocation();
+ int i = 0;
+ for (; i < candidateLocation.length() && i < startsWith.getLocation().length(); ++i) {
+ if (candidateLocation.charAt(i) != startsWith.getLocation().charAt(i)) {
+ break;
+ }
+ }
+
+ // If the match is better, reset.
+ if (i > bestMatchLen) {
+ bestMatchLen = i;
+ bestMatch = candidate;
+ }
+ } else {
+ // Not testing for overlap with input criterion, so just return the first match.
+ return candidate;
+ }
}
}
+ if (bestMatch != null) {
+ return bestMatch;
+ }
+
log.debug("{} No candidate endpoints met criteria", getLogPrefix());
return null;
}
+// Checkstyle: CyclomaticComplexity ON
/**
* Apply the supplied criteria to a candidate endpoint to determine its suitability.
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/BestMatchLocationCriterion.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/BestMatchLocationCriterion.java
new file mode 100644
index 000000000..1cde2d0df
--- /dev/null
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/BestMatchLocationCriterion.java
@@ -0,0 +1,90 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.saml.criterion;
+
+import javax.annotation.Nonnull;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
+import net.shibboleth.utilities.java.support.resolver.Criterion;
+
+/**
+ * {@link Criterion} representing a SAML binding location to compare to candidate endpoints
+ * such that the best match is the one with the largest number of leading characters in common.
+ *
+ * @since 4.2.0
+ */
+public final class BestMatchLocationCriterion implements Criterion {
+
+ /** The binding location URI. */
+ @Nonnull @NotEmpty private final String location;
+
+ /**
+ * Constructor.
+ *
+ * @param locationUri the binding location URI
+ */
+ public BestMatchLocationCriterion(@Nonnull @NotEmpty final String locationUri) {
+ location = Constraint.isNotNull(StringSupport.trimOrNull(locationUri), "Location cannot be null or empty");
+ }
+
+ /**
+ * Get the binding location URI.
+ *
+ * @return the binding location URI
+ */
+ @Nonnull @NotEmpty public String getLocation() {
+ return location;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public String toString() {
+ final StringBuilder builder = new StringBuilder();
+ builder.append("BestMatchLocation [location=");
+ builder.append(location);
+ builder.append("]");
+ return builder.toString();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public int hashCode() {
+ return location.hashCode();
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public boolean equals(final Object obj) {
+ if (this == obj) {
+ return true;
+ }
+
+ if (obj == null) {
+ return false;
+ }
+
+ if (obj instanceof BestMatchLocationCriterion) {
+ return location.equals(((BestMatchLocationCriterion) obj).location);
+ }
+
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/DefaultEndpointResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/DefaultEndpointResolver.java
index 8f483c0aa..0dcbed4ec 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/DefaultEndpointResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/DefaultEndpointResolver.java
@@ -26,6 +26,7 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import org.opensaml.saml.common.binding.AbstractEndpointResolver;
import org.opensaml.saml.criterion.BindingCriterion;
import org.opensaml.saml.criterion.EndpointCriterion;
+import org.opensaml.saml.criterion.StartsWithLocationCriterion;
import org.opensaml.saml.saml2.metadata.Endpoint;
import org.opensaml.saml.saml2.metadata.IndexedEndpoint;
import org.slf4j.Logger;
@@ -37,11 +38,11 @@ import org.slf4j.LoggerFactory;
* <p>The supported {@link net.shibboleth.utilities.java.support.resolver.Criterion} types and their use follows:</p>
*
* <dl>
- * <dt> {@link EndpointCriterion}
- * <dd> Requires that the candidate endpoint's various attributes match the attributes found in the criterion.
+ * <dt> {@link EndpointCriterion} </dt>
+ * <dd> Requires that the candidate endpoint's various attributes match the attributes found in the criterion. </dd>
*
- * <dt> {@link BindingCriterion}
- * <dd> Requires that the candidate endpoint's Binding attribute is among the bindings included in the criterion.
+ * <dt> {@link BindingCriterion} </dt>
+ * <dd> Requires that the candidate endpoint's Binding attribute is among the bindings included in the criterion. </dd>
* </dl>
*
* @param <EndpointType> type of endpoint
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/DefaultEndpointResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/DefaultEndpointResolverTest.java
index 8fe5f46ef..b64621bf0 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/DefaultEndpointResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/DefaultEndpointResolverTest.java
@@ -39,12 +39,14 @@ import org.opensaml.core.testing.XMLObjectBaseTestCase;
import org.opensaml.core.xml.io.Unmarshaller;
import org.opensaml.core.xml.io.UnmarshallingException;
import org.opensaml.saml.common.xml.SAMLConstants;
+import org.opensaml.saml.criterion.BestMatchLocationCriterion;
import org.opensaml.saml.criterion.BindingCriterion;
import org.opensaml.saml.criterion.EndpointCriterion;
import org.opensaml.saml.criterion.RoleDescriptorCriterion;
import org.opensaml.saml.saml2.metadata.AssertionConsumerService;
import org.opensaml.saml.saml2.metadata.Endpoint;
import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
+import org.opensaml.saml.saml2.metadata.SingleLogoutService;
import org.testng.Assert;
import org.testng.annotations.BeforeClass;
import org.testng.annotations.BeforeMethod;
@@ -354,6 +356,40 @@ public class DefaultEndpointResolverTest extends XMLObjectBaseTestCase {
Assert.assertEquals(eps.size(), 2);
}
+ /**
+ * Get the "best" endpoint.
+ *
+ * @throws UnmarshallingException ...
+ * @throws ResolverException ...
+ */
+ @Test
+ public void testBestMatch() throws UnmarshallingException, ResolverException {
+
+ endpointCrit.getEndpoint().setLocation(null);
+ final RoleDescriptorCriterion roleCrit =
+ new RoleDescriptorCriterion(loadMetadata("/org/opensaml/saml/common/binding/SPWithVhosts.xml"));
+
+ CriteriaSet crits = new CriteriaSet(endpointCrit, roleCrit, new BestMatchLocationCriterion("https://sp.example.org/Foo"));
+ AssertionConsumerService ep = resolver.resolveSingle(crits);
+ Assert.assertNotNull(ep);
+ Assert.assertEquals(ep.getLocation(), "https://sp.example.org/POST");
+
+ crits = new CriteriaSet(endpointCrit, roleCrit, new BestMatchLocationCriterion("https://sp2.example.org/Foo"));
+ ep = resolver.resolveSingle(crits);
+ Assert.assertNotNull(ep);
+ Assert.assertEquals(ep.getLocation(), "https://sp2.example.org/POST");
+
+ crits = new CriteriaSet(endpointCrit, roleCrit, new BestMatchLocationCriterion("https://sp2.example.org/bar/Foo"));
+ ep = resolver.resolveSingle(crits);
+ Assert.assertNotNull(ep);
+ Assert.assertEquals(ep.getLocation(), "https://sp2.example.org/POST");
+
+ crits = new CriteriaSet(endpointCrit, roleCrit, new BestMatchLocationCriterion("https://sp2.example.org/sub/Foo"));
+ ep = resolver.resolveSingle(crits);
+ Assert.assertNotNull(ep);
+ Assert.assertEquals(ep.getLocation(), "https://sp2.example.org/sub/POST");
+ }
+
@Nonnull private SPSSODescriptor loadMetadata(@Nonnull @NotEmpty final String path) throws UnmarshallingException {
try {
diff --git a/opensaml-saml-impl/src/test/resources/org/opensaml/saml/common/binding/SPWithVhosts.xml b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/common/binding/SPWithVhosts.xml
new file mode 100644
index 000000000..2558b8cfe
--- /dev/null
+++ b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/common/binding/SPWithVhosts.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<md:SPSSODescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
+ <md:AssertionConsumerService index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sp.example.org/POST" />
+ <md:AssertionConsumerService index="3" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://sp2.example.org/POST" />
+ <md:AssertionConsumerService index="3" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sp2.example.org/POST" />
+ <md:AssertionConsumerService index="4" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sp2.example.org/sub/POST" />
+</md:SPSSODescriptor>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list