[java-identity-provider] branch main updated: IDP-1822 - ScopedAttributePredicate
Scott Cantor
cantor.2 at osu.edu
Tue Nov 9 19:35:38 UTC 2021
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=301e64e105d4882891d5c4dbc224c450fa7c7e5c
The following commit(s) were added to refs/heads/main by this push:
new 301e64e10 IDP-1822 - ScopedAttributePredicate
301e64e10 is described below
commit 301e64e105d4882891d5c4dbc224c450fa7c7e5c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Nov 9 14:35:34 2021 -0500
IDP-1822 - ScopedAttributePredicate
https://shibboleth.atlassian.net/browse/IDP-1822
Added scope into existing SimpleAttributePredicate.
---
.../idp/attribute/logic/package-info.java | 22 ++++
.../profile/logic/SimpleAttributePredicate.java | 44 ++++++--
.../logic/SimpleAttributePredicateTest.java | 115 +++++++++++++++++++++
3 files changed, 174 insertions(+), 7 deletions(-)
diff --git a/idp-attribute-api/src/main/java/net/shibboleth/idp/attribute/logic/package-info.java b/idp-attribute-api/src/main/java/net/shibboleth/idp/attribute/logic/package-info.java
new file mode 100644
index 000000000..44ea08d6f
--- /dev/null
+++ b/idp-attribute-api/src/main/java/net/shibboleth/idp/attribute/logic/package-info.java
@@ -0,0 +1,22 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Attribute-related predicates.
+ */
+
+package net.shibboleth.idp.attribute.logic;
\ No newline at end of file
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/SimpleAttributePredicate.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/SimpleAttributePredicate.java
index b31a56c9d..916f92e3d 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/SimpleAttributePredicate.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/logic/SimpleAttributePredicate.java
@@ -21,9 +21,11 @@ import java.util.Collection;
import java.util.Map;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import net.shibboleth.idp.attribute.IdPAttribute;
import net.shibboleth.idp.attribute.IdPAttributeValue;
+import net.shibboleth.idp.attribute.ScopedStringAttributeValue;
import net.shibboleth.idp.attribute.StringAttributeValue;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -43,7 +45,7 @@ import com.google.common.collect.ListMultimap;
* <p>A map to a collection of strings is used to represent the attribute(s) and value(s) to evaluate.
* The values are evaluated as a disjunction (OR) and the attributes are evaluated as a conjunction (AND).</p>
*
- * <p>This handles only simple string-valued data.</p>
+ * <p>This handles only simple string-valued data, or if scope is supplied, requires scoped values.</p>
*
* <p>For the special case of checking for an attribute's presence, regardless of values, the '*' value is
* supported. Note that this does NOT exclude pathological cases such as empty or null values. A more
@@ -57,6 +59,9 @@ public class SimpleAttributePredicate extends AbstractAttributePredicate {
/** Map of attribute IDs to values. */
@Nonnull @NonnullElements private ListMultimap<String,String> attributeValueMap;
+ /** Optional scope to check. */
+ @Nullable @NotEmpty private String scope;
+
/** Constructor. */
public SimpleAttributePredicate() {
attributeValueMap = ArrayListMultimap.create();
@@ -76,11 +81,25 @@ public class SimpleAttributePredicate extends AbstractAttributePredicate {
attributeValueMap.putAll(attributeId, StringSupport.normalizeStringCollection(entry.getValue()));
}
}
+
+ /**
+ * Set a scope to check for.
+ *
+ * <p>If set, values that "match" must be scoped with this value. A "*" will match any scope, but
+ * one must exist.</p>
+ *
+ * @param s scope to check for
+ *
+ * @since 4.2.0
+ */
+ public void setScope(@Nullable @NotEmpty final String s) {
+ scope = StringSupport.trimOrNull(s);
+ }
/** {@inheritDoc} */
@Override
protected boolean allowNullAttributeContext() {
- return attributeValueMap.isEmpty();
+ return attributeValueMap.isEmpty() && scope == null;
}
/** {@inheritDoc} */
@@ -120,15 +139,25 @@ public class SimpleAttributePredicate extends AbstractAttributePredicate {
*
* @return true iff the value is one of the attribute's values
*/
+// Checkstyle: CyclomaticComplexity OFF
protected boolean findMatch(@Nonnull @NotEmpty final String toMatch, @Nonnull final IdPAttribute attribute) {
- if ("*".equals(toMatch)) {
+ if ("*".equals(toMatch) && scope == null) {
log.debug("Wildcard (*) value rule for attribute {}", attribute.getId());
return true;
}
+
for (final IdPAttributeValue value : attribute.getValues()) {
- if (value instanceof StringAttributeValue) {
- if (toMatch.equals(((StringAttributeValue)value).getValue())) {
+ if (scope != null && value instanceof ScopedStringAttributeValue) {
+ if ("*".equals(toMatch) || toMatch.equals(((ScopedStringAttributeValue) value).getValue())) {
+ if ("*".equals(scope) || scope.equals(((ScopedStringAttributeValue) value).getScope())) {
+ log.debug("Found matching value ({}) and scope ({}) in attribute {}", toMatch, scope,
+ attribute.getId());
+ return true;
+ }
+ }
+ } else if (scope == null && value instanceof StringAttributeValue) {
+ if (toMatch.equals(((StringAttributeValue) value).getValue())) {
log.debug("Found matching value ({}) in attribute {}", toMatch, attribute.getId());
return true;
}
@@ -137,5 +166,6 @@ public class SimpleAttributePredicate extends AbstractAttributePredicate {
return false;
}
-
-}
+// Checkstyle: CyclomaticComplexity ON
+
+}
\ No newline at end of file
diff --git a/idp-profile-api/src/test/java/net/shibboleth/idp/profile/logic/SimpleAttributePredicateTest.java b/idp-profile-api/src/test/java/net/shibboleth/idp/profile/logic/SimpleAttributePredicateTest.java
new file mode 100644
index 000000000..24fced5d4
--- /dev/null
+++ b/idp-profile-api/src/test/java/net/shibboleth/idp/profile/logic/SimpleAttributePredicateTest.java
@@ -0,0 +1,115 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.profile.logic;
+
+import net.shibboleth.idp.attribute.IdPAttribute;
+import net.shibboleth.idp.attribute.IdPAttributeValue;
+import net.shibboleth.idp.attribute.ScopedStringAttributeValue;
+import net.shibboleth.idp.attribute.StringAttributeValue;
+import net.shibboleth.idp.attribute.context.AttributeContext;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.annotations.Test;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+
+import static org.testng.Assert.*;
+
+/**
+ * Unit test for {@link SimpleAttributePredicate}.
+ */
+public class SimpleAttributePredicateTest {
+
+ @Test
+ public void testString() {
+ final ProfileRequestContext prc = createProfileRequestContext("foo", List.of("bar", "baz"));
+ SimpleAttributePredicate predicate = new SimpleAttributePredicate();
+
+ predicate.setAttributeValueMap(Map.of("foo2", List.of("bar")));
+ assertFalse(predicate.test(prc));
+
+ predicate.setAttributeValueMap(Map.of("foo2", List.of("*")));
+ assertFalse(predicate.test(prc));
+
+ predicate.setAttributeValueMap(Map.of("foo", List.of("*")));
+ assertTrue(predicate.test(prc));
+
+ predicate.setAttributeValueMap(Map.of("foo", List.of("bar", "baz")));
+ assertTrue(predicate.test(prc));
+
+ predicate.setScope("zorkmid");
+ assertFalse(predicate.test(prc));
+ }
+
+ @Test
+ public void testScoped() {
+ final ProfileRequestContext prc = createProfileRequestContext("foo", List.of("bar at scope1", "baz at scope2"));
+ SimpleAttributePredicate predicate = new SimpleAttributePredicate();
+
+ predicate.setAttributeValueMap(Map.of("foo", List.of("bar")));
+ assertTrue(predicate.test(prc));
+
+ predicate.setAttributeValueMap(Map.of("foo", List.of("*")));
+ assertTrue(predicate.test(prc));
+
+ predicate.setScope("zorkmid");
+ assertFalse(predicate.test(prc));
+
+ predicate.setScope("*");
+ assertTrue(predicate.test(prc));
+
+ predicate.setAttributeValueMap(Map.of("foo", List.of("bar", "baz")));
+ assertTrue(predicate.test(prc));
+
+ predicate.setScope("scope1");
+ assertTrue(predicate.test(prc));
+
+ predicate.setScope("scope2");
+ assertTrue(predicate.test(prc));
+
+ predicate.setAttributeValueMap(Map.of("foo", List.of("bar")));
+ assertFalse(predicate.test(prc));
+ }
+
+ private ProfileRequestContext createProfileRequestContext(final String name, final Collection<String> values) {
+ final ProfileRequestContext prc = new ProfileRequestContext();
+ final RelyingPartyContext rpc = new RelyingPartyContext();
+ final IdPAttribute attribute = new IdPAttribute(name);
+ final List<IdPAttributeValue> attributeValues = new ArrayList<>();
+ for (final String value : values) {
+ final int i = value.indexOf('@');
+ if (i == -1) {
+ attributeValues.add(new StringAttributeValue(value));
+ } else {
+ attributeValues.add(new ScopedStringAttributeValue(value.substring(0,i), value.substring(i + 1)));
+ }
+ }
+ attribute.setValues(attributeValues);
+ final AttributeContext ac = new AttributeContext();
+ ac.setIdPAttributes(Collections.singletonList(attribute));
+ ac.setUnfilteredIdPAttributes(Collections.singletonList(attribute));
+ rpc.addSubcontext(ac);
+ prc.addSubcontext(rpc);
+ return prc;
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list