[java-identity-provider] branch maint-4 updated: IDP-2054 - Add per-SP salt for computedId connector

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch maint-4
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=637f1ef7b4a8707acbfbd0f42fb0e55dd35bab1a

The following commit(s) were added to refs/heads/maint-4 by this push:
     new 637f1ef7b IDP-2054 - Add per-SP salt for computedId connector
637f1ef7b is described below

commit 637f1ef7b4a8707acbfbd0f42fb0e55dd35bab1a
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Dec 14 13:22:24 2022 -0500

    IDP-2054 - Add per-SP salt for computedId connector
    
    https://shibboleth.atlassian.net/browse/IDP-2054
    
    Rework solution to allow PRC access in this release.
---
 idp-attribute-impl/pom.xml                         |  6 +++++
 .../attribute/impl/ComputedPairwiseIdStore.java    | 27 +++++++++++++++++++++-
 .../net/shibboleth/idp/conf/saml-nameid-system.xml |  1 +
 3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/idp-attribute-impl/pom.xml b/idp-attribute-impl/pom.xml
index 0cf7bf757..60fbd0cc7 100644
--- a/idp-attribute-impl/pom.xml
+++ b/idp-attribute-impl/pom.xml
@@ -66,7 +66,13 @@
             <groupId>com.google.guava</groupId>
             <artifactId>guava</artifactId>
         </dependency>
+        
         <!-- Provided Dependencies -->
+        <dependency>
+            <groupId>javax.servlet</groupId>
+            <artifactId>javax.servlet-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
 
         <!-- Runtime Dependencies -->
 
diff --git a/idp-attribute-impl/src/main/java/net/shibboleth/idp/attribute/impl/ComputedPairwiseIdStore.java b/idp-attribute-impl/src/main/java/net/shibboleth/idp/attribute/impl/ComputedPairwiseIdStore.java
index 8a4bb261b..f297fa99f 100644
--- a/idp-attribute-impl/src/main/java/net/shibboleth/idp/attribute/impl/ComputedPairwiseIdStore.java
+++ b/idp-attribute-impl/src/main/java/net/shibboleth/idp/attribute/impl/ComputedPairwiseIdStore.java
@@ -27,6 +27,7 @@ import java.util.function.BiFunction;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
+import javax.servlet.http.HttpServletRequest;
 
 import net.shibboleth.idp.attribute.PairwiseId;
 import net.shibboleth.idp.attribute.PairwiseIdStore;
@@ -40,6 +41,7 @@ import net.shibboleth.utilities.java.support.component.AbstractInitializableComp
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.primitive.NonnullSupplier;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
 import org.opensaml.profile.context.ProfileRequestContext;
@@ -95,6 +97,9 @@ public class ComputedPairwiseIdStore extends AbstractInitializableComponent impl
     /** Optional source of salt for request. */
     @Nullable BiFunction<ProfileRequestContext,PairwiseId,String> saltLookupStrategy;
     
+    /** Servlet request supplier. */
+    @Nullable NonnullSupplier<HttpServletRequest> httpServletRequestSupplier;
+    
     /** Constructor. */
     public ComputedPairwiseIdStore() {
         algorithm = "SHA";
@@ -247,6 +252,17 @@ public class ComputedPairwiseIdStore extends AbstractInitializableComponent impl
         
         saltLookupStrategy = strategy;
     }
+    
+    /**
+     * Sets a supplier for the servlet request by which the {@link ProfileRequestContext} can be obtained.
+     * 
+     * @param supplier
+     * 
+     * @since 4.3.0
+     */
+    public void setHttpServletRequestSupplier(@Nullable final NonnullSupplier<HttpServletRequest> supplier) {
+        httpServletRequestSupplier = supplier;
+    }
 
     /** {@inheritDoc} */
     @Override
@@ -341,7 +357,16 @@ public class ComputedPairwiseIdStore extends AbstractInitializableComponent impl
         }
         
         if (saltLookupStrategy != null) {
-            final String derivedSalt = saltLookupStrategy.apply(null, pid);
+            
+            final ProfileRequestContext prc;
+            if (httpServletRequestSupplier != null) {
+                prc = (ProfileRequestContext) httpServletRequestSupplier.get().getAttribute(
+                        ProfileRequestContext.BINDING_KEY);
+            } else {
+                prc = null;
+            }
+            
+            final String derivedSalt = saltLookupStrategy.apply(prc, pid);
             if (derivedSalt != null) {
                 return derivedSalt.getBytes();
             }
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-nameid-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-nameid-system.xml
index 2ba7ab2f1..009ac6c2d 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-nameid-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-nameid-system.xml
@@ -63,6 +63,7 @@
         p:encodedSalt="%{idp.persistentId.encodedSalt:}"
         p:exceptionMap="#{getObject('%{idp.persistentId.exceptionMap:shibboleth.ComputedIdExceptionMap}'.trim())}"
         p:saltLookupStrategy="#{getObject('shibboleth.ComputedIdSaltLookupStrategy')}"
+        p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"
         p:algorithm="%{idp.persistentId.algorithm:SHA}"
         p:encoding="#{ T(net.shibboleth.idp.attribute.impl.ComputedPairwiseIdStore.Encoding).%{idp.persistentId.encoding:BASE64} }" />
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.