[java-identity-provider] branch main updated: IDP-1902 - Support alternative RP ctx lookup in RP config resolver
Scott Cantor
cantor.2 at osu.edu
Tue Feb 8 16:26:17 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=db1e7a85925d86243845e4343a79ed8aa3480611
The following commit(s) were added to refs/heads/main by this push:
new db1e7a859 IDP-1902 - Support alternative RP ctx lookup in RP config resolver
db1e7a859 is described below
commit db1e7a85925d86243845e4343a79ed8aa3480611
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Feb 8 11:26:11 2022 -0500
IDP-1902 - Support alternative RP ctx lookup in RP config resolver
https://shibboleth.atlassian.net/browse/IDP-1902
---
.../idp/profile/context/RelyingPartyContext.java | 2 +
.../context/RelyingPartyResolverContext.java | 64 ++++++++++++++++++++++
.../impl/SelectRelyingPartyConfiguration.java | 16 ++++--
.../DefaultRelyingPartyConfigurationResolver.java | 21 ++++++-
4 files changed, 96 insertions(+), 7 deletions(-)
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/context/RelyingPartyContext.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/context/RelyingPartyContext.java
index b6bf67dcb..3ece7269b 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/context/RelyingPartyContext.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/context/RelyingPartyContext.java
@@ -158,6 +158,7 @@ public final class RelyingPartyContext extends BaseContext {
@Nonnull public RelyingPartyContext setVerificationLookupStrategy(
@Nonnull final Function<RelyingPartyContext,Boolean> strategy) {
verificationLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ verified = null;
return this;
}
@@ -180,6 +181,7 @@ public final class RelyingPartyContext extends BaseContext {
@Nonnull public RelyingPartyContext setRelyingPartyIdLookupStrategy(
@Nonnull final Function<RelyingPartyContext,String> strategy) {
relyingPartyIdLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ relyingPartyId = null;
return this;
}
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/context/RelyingPartyResolverContext.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/context/RelyingPartyResolverContext.java
new file mode 100644
index 000000000..93fd851d2
--- /dev/null
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/context/RelyingPartyResolverContext.java
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.profile.context;
+
+import java.util.function.Predicate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
+
+import org.opensaml.messaging.context.BaseContext;
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * A {@link BaseContext} which holds working instructions for the {@link RelyingPartyConfigurationResolver}
+ * to use in lieu of fixing it to take pluggable criteria.
+ *
+ * @since 4.2.0
+ */
+public final class RelyingPartyResolverContext extends BaseContext {
+
+ /** How to determine verified status. */
+ @Nullable private Predicate<ProfileRequestContext> verificationCondition;
+
+ /**
+ * Get the condition to apply to determine whether the relying party is verified.
+ *
+ * @return condition
+ */
+ @Nullable public Predicate<ProfileRequestContext> getVerificationPredicate() {
+ return verificationCondition;
+ }
+
+ /**
+ * Set the condition to apply to determine whether the relying party is verified.
+ *
+ * @param condition condition
+ *
+ * @return this context
+ */
+ @Nonnull public RelyingPartyResolverContext setVerificationPredicate(
+ @Nullable final Predicate<ProfileRequestContext> condition) {
+ verificationCondition = condition;
+
+ return this;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/SelectRelyingPartyConfiguration.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/SelectRelyingPartyConfiguration.java
index 5f49309ac..a9c3dcc5d 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/SelectRelyingPartyConfiguration.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/SelectRelyingPartyConfiguration.java
@@ -28,6 +28,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.RelyingPartyResolverContext;
import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
@@ -129,19 +130,24 @@ public final class SelectRelyingPartyConfiguration extends AbstractProfileAction
@Override
public void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ final RelyingPartyResolverContext workContext = new RelyingPartyResolverContext();
+ workContext.setVerificationPredicate(prc -> relyingPartyCtx.isVerified());
+ profileRequestContext.addSubcontext(workContext, true);
+
try {
final RelyingPartyConfiguration config = rpConfigResolver.resolveSingle(profileRequestContext);
- if (config == null) {
+ if (config != null) {
+ log.debug("{} Found relying party configuration {} for request", getLogPrefix(), config.getId());
+ relyingPartyCtx.setConfiguration(config);
+ } else {
log.debug("{} No relying party configuration applies to this request", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CONFIG);
- return;
}
-
- log.debug("{} Found relying party configuration {} for request", getLogPrefix(), config.getId());
- relyingPartyCtx.setConfiguration(config);
} catch (final ResolverException e) {
log.error("{} Error trying to resolve relying party configuration", getLogPrefix(), e);
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CONFIG);
}
+
+ profileRequestContext.removeSubcontext(workContext);
}
}
\ No newline at end of file
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java
index 956846a4a..b169783c6 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java
@@ -29,6 +29,7 @@ import javax.annotation.Nullable;
import net.shibboleth.ext.spring.service.AbstractServiceableComponent;
import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyResolverContext;
import net.shibboleth.idp.profile.logic.VerifiedProfilePredicate;
import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
@@ -210,8 +211,16 @@ public class DefaultRelyingPartyConfigurationResolver
return Collections.emptyList();
}
+ final Predicate<ProfileRequestContext> condition;
+ final RelyingPartyResolverContext resolverCtx = context.getSubcontext(RelyingPartyResolverContext.class);
+ if (resolverCtx != null && resolverCtx.getVerificationPredicate() != null) {
+ condition = resolverCtx.getVerificationPredicate();
+ } else {
+ condition = getVerificationPredicate();
+ }
+
log.debug("Resolving relying party configuration");
- if (!verificationPredicate.test(context)) {
+ if (!condition.test(context)) {
if (getUnverifiedConfiguration() == null) {
log.warn("Profile request was unverified, but no such configuration is available");
return Collections.emptyList();
@@ -250,8 +259,16 @@ public class DefaultRelyingPartyConfigurationResolver
return null;
}
+ final Predicate<ProfileRequestContext> condition;
+ final RelyingPartyResolverContext resolverCtx = context.getSubcontext(RelyingPartyResolverContext.class);
+ if (resolverCtx != null && resolverCtx.getVerificationPredicate() != null) {
+ condition = resolverCtx.getVerificationPredicate();
+ } else {
+ condition = getVerificationPredicate();
+ }
+
log.debug("Resolving relying party configuration");
- if (!verificationPredicate.test(context)) {
+ if (!condition.test(context)) {
if (getUnverifiedConfiguration() == null) {
log.warn("Profile request was unverified, but no such configuration is available");
return null;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list