[java-idp-oidc] branch main updated: Rely on existing constants to define audit fields to prevent drift.
Scott Cantor
cantor.2 at osu.edu
Tue Mar 2 23:40:35 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=b9ec31abeb0221cced02fe8577706a0da314214c
The following commit(s) were added to refs/heads/main by this push:
new b9ec31ab Rely on existing constants to define audit fields to prevent drift.
b9ec31ab is described below
commit b9ec31abeb0221cced02fe8577706a0da314214c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Mar 2 18:40:33 2021 -0500
Rely on existing constants to define audit fields to prevent drift.
---
idp-oidc-extension-api/pom.xml | 5 ++++
.../idp/plugin/oidc/op/audit/AuditFields.java | 29 +++++++++++-----------
.../oidc/op/audit/impl/ClaimsAuditExtractor.java | 10 +++-----
.../flows/oidc/abstract/oidc-abstract-beans.xml | 3 ++-
4 files changed, 24 insertions(+), 23 deletions(-)
diff --git a/idp-oidc-extension-api/pom.xml b/idp-oidc-extension-api/pom.xml
index f6de488a..04c5de96 100644
--- a/idp-oidc-extension-api/pom.xml
+++ b/idp-oidc-extension-api/pom.xml
@@ -43,6 +43,11 @@
<artifactId>idp-authn-api</artifactId>
<scope>provided</scope>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth.idp</groupId>
+ <artifactId>idp-saml-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
<dependency>
<groupId>org.opensaml</groupId>
<artifactId>opensaml-security-api</artifactId>
diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/AuditFields.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/AuditFields.java
index 5760050a..620ca6a3 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/AuditFields.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/AuditFields.java
@@ -19,46 +19,45 @@ package net.shibboleth.idp.plugin.oidc.op.audit;
import javax.annotation.Nonnull;
+import net.shibboleth.idp.profile.context.AuditContext;
+import net.shibboleth.idp.saml.profile.SAMLAuditFields;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-/**
- * Constants to use for audit logging fields stored in an {@link net.shibboleth.idp.profile.context.AuditContext}.
- */
+/** Constants to use for audit logging fields stored in an {@link AuditContext}. */
public final class AuditFields {
-
/** OIDC client ID. */
- @Nonnull @NotEmpty public static final String CLIENT_ID = "SP";
+ @Nonnull @NotEmpty public static final String CLIENT_ID = SAMLAuditFields.SERVICE_PROVIDER;
/** OIDC issuer. */
- @Nonnull @NotEmpty public static final String ISSUER = "IDP";
+ @Nonnull @NotEmpty public static final String ISSUER = SAMLAuditFields.IDENTITY_PROVIDER;
/** The inbound (Nimbus) message class. */
- @Nonnull @NotEmpty public static final String INBOUND_MESSAGE_CLASS = "b";
+ @Nonnull @NotEmpty public static final String INBOUND_MESSAGE_CLASS = SAMLAuditFields.REQUEST_BINDING;
/** The outbound (Nimbus) message class. */
- @Nonnull @NotEmpty public static final String OUTBOUND_MESSAGE_CLASS = "bb";
+ @Nonnull @NotEmpty public static final String OUTBOUND_MESSAGE_CLASS = SAMLAuditFields.RESPONSE_BINDING;
/** The authentication context reference value. */
- @Nonnull @NotEmpty public static final String ACR = "ac";
+ @Nonnull @NotEmpty public static final String ACR = SAMLAuditFields.AUTHN_CONTEXT;
/** The subject value. */
- @Nonnull @NotEmpty public static final String SUB_VALUE = "n";
+ @Nonnull @NotEmpty public static final String SUB_VALUE = SAMLAuditFields.NAMEID;
/** The subject format (public/pairwise). */
- @Nonnull @NotEmpty public static final String SUB_FORMAT = "f";
+ @Nonnull @NotEmpty public static final String SUB_FORMAT = SAMLAuditFields.NAMEID_FORMAT;
/** The flag whether the id_token is encrypted. */
- @Nonnull @NotEmpty public static final String ENCRYPTED_ID_TOKEN = "X";
+ @Nonnull @NotEmpty public static final String ENCRYPTED_ID_TOKEN = SAMLAuditFields.ENCRYPTION;
/** prompt=none requested field. */
- @Nonnull @NotEmpty public static final String IS_PASSIVE = "pasv";
+ @Nonnull @NotEmpty public static final String IS_PASSIVE = SAMLAuditFields.IS_PASSIVE;
/** prompt=login requested field. */
- @Nonnull @NotEmpty public static final String FORCE_AUTHN = "fauth";
+ @Nonnull @NotEmpty public static final String FORCE_AUTHN = SAMLAuditFields.FORCE_AUTHN;
/** Revoked Token. */
- @Nonnull @NotEmpty public static final String REVOKED_TOKEN = "i";
+ @Nonnull @NotEmpty public static final String REVOKED_TOKEN = "R";
/**
* Constructor.
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/ClaimsAuditExtractor.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/ClaimsAuditExtractor.java
index e95cd273..efee6e39 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/ClaimsAuditExtractor.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/audit/impl/ClaimsAuditExtractor.java
@@ -36,12 +36,10 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
public class ClaimsAuditExtractor implements Function<ProfileRequestContext, Collection<String>> {
/** Lookup strategy for id token claims to read from. */
- @Nonnull
- private final Function<ProfileRequestContext, ClaimsSet> idTokenClaimsLookupStrategy;
+ @Nonnull private final Function<ProfileRequestContext, ClaimsSet> idTokenClaimsLookupStrategy;
/** Lookup strategy for user info claims to read from. */
- @Nonnull
- private final Function<ProfileRequestContext, ClaimsSet> userInfoClaimsLookupStrategy;
+ @Nonnull private final Function<ProfileRequestContext, ClaimsSet> userInfoClaimsLookupStrategy;
/** Constructor. */
@@ -66,9 +64,7 @@ public class ClaimsAuditExtractor implements Function<ProfileRequestContext, Col
}
/** {@inheritDoc} */
- @Override
- @Nullable
- public Collection<String> apply(@Nullable final ProfileRequestContext input) {
+ @Nullable public Collection<String> apply(@Nullable final ProfileRequestContext input) {
ClaimsSet claims = idTokenClaimsLookupStrategy.apply(input);
if (claims != null) {
return claims.toJSONObject().keySet();
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
index 0e9e736d..71b78a4a 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract/oidc-abstract-beans.xml
@@ -117,7 +117,8 @@
</entry>
<entry>
<key>
- <util:constant static-field="net.shibboleth.idp.plugin.oidc.op.audit.AuditFields.REVOKED_TOKEN"/>
+ <util:constant
+ static-field="net.shibboleth.idp.plugin.oidc.op.audit.AuditFields.REVOKED_TOKEN"/>
</key>
<bean class="net.shibboleth.idp.plugin.oidc.op.audit.impl.RevokedTokenAuditExtractor">
<constructor-arg>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list