[java-identity-provider] branch main updated: IDP-1902 - Support alternative RP ctx lookup in RP config resolver

Scott Cantor cantor.2 at osu.edu
Tue Feb 8 16:26:17 UTC 2022


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=db1e7a85925d86243845e4343a79ed8aa3480611

The following commit(s) were added to refs/heads/main by this push:
     new db1e7a859 IDP-1902 - Support alternative RP ctx lookup in RP config resolver
db1e7a859 is described below

commit db1e7a85925d86243845e4343a79ed8aa3480611
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Feb 8 11:26:11 2022 -0500

    IDP-1902 - Support alternative RP ctx lookup in RP config resolver
    
    https://shibboleth.atlassian.net/browse/IDP-1902
---
 .../idp/profile/context/RelyingPartyContext.java   |  2 +
 .../context/RelyingPartyResolverContext.java       | 64 ++++++++++++++++++++++
 .../impl/SelectRelyingPartyConfiguration.java      | 16 ++++--
 .../DefaultRelyingPartyConfigurationResolver.java  | 21 ++++++-
 4 files changed, 96 insertions(+), 7 deletions(-)

diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/context/RelyingPartyContext.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/context/RelyingPartyContext.java
index b6bf67dcb..3ece7269b 100644
--- a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/context/RelyingPartyContext.java
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/context/RelyingPartyContext.java
@@ -158,6 +158,7 @@ public final class RelyingPartyContext extends BaseContext {
     @Nonnull public RelyingPartyContext setVerificationLookupStrategy(
             @Nonnull final Function<RelyingPartyContext,Boolean> strategy) {
         verificationLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+        verified = null;
         return this;
     }
     
@@ -180,6 +181,7 @@ public final class RelyingPartyContext extends BaseContext {
     @Nonnull public RelyingPartyContext setRelyingPartyIdLookupStrategy(
             @Nonnull final Function<RelyingPartyContext,String> strategy) {
         relyingPartyIdLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+        relyingPartyId = null;
         return this;
     }
     
diff --git a/idp-profile-api/src/main/java/net/shibboleth/idp/profile/context/RelyingPartyResolverContext.java b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/context/RelyingPartyResolverContext.java
new file mode 100644
index 000000000..93fd851d2
--- /dev/null
+++ b/idp-profile-api/src/main/java/net/shibboleth/idp/profile/context/RelyingPartyResolverContext.java
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.profile.context;
+
+import java.util.function.Predicate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
+
+import org.opensaml.messaging.context.BaseContext;
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * A {@link BaseContext} which holds working instructions for the {@link RelyingPartyConfigurationResolver}
+ * to use in lieu of fixing it to take pluggable criteria.
+ * 
+ * @since 4.2.0
+ */
+public final class RelyingPartyResolverContext extends BaseContext {
+
+    /** How to determine verified status. */
+    @Nullable private Predicate<ProfileRequestContext> verificationCondition;
+
+    /**
+     * Get the condition to apply to determine whether the relying party is verified.
+     * 
+     * @return condition
+     */
+    @Nullable public Predicate<ProfileRequestContext> getVerificationPredicate() {
+        return verificationCondition;
+    }
+
+    /**
+     * Set the condition to apply to determine whether the relying party is verified.
+     * 
+     * @param condition condition
+     * 
+     * @return this context
+     */
+    @Nonnull public RelyingPartyResolverContext setVerificationPredicate(
+            @Nullable final Predicate<ProfileRequestContext> condition) {
+        verificationCondition = condition;
+        
+        return this;
+    }
+    
+}
\ No newline at end of file
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/SelectRelyingPartyConfiguration.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/SelectRelyingPartyConfiguration.java
index 5f49309ac..a9c3dcc5d 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/SelectRelyingPartyConfiguration.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/profile/impl/SelectRelyingPartyConfiguration.java
@@ -28,6 +28,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
 import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.idp.profile.IdPEventIds;
 import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.idp.profile.context.RelyingPartyResolverContext;
 import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
 import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
@@ -129,19 +130,24 @@ public final class SelectRelyingPartyConfiguration extends AbstractProfileAction
     @Override
     public void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
 
+        final RelyingPartyResolverContext workContext = new RelyingPartyResolverContext();
+        workContext.setVerificationPredicate(prc -> relyingPartyCtx.isVerified());
+        profileRequestContext.addSubcontext(workContext, true);
+        
         try {
             final RelyingPartyConfiguration config = rpConfigResolver.resolveSingle(profileRequestContext);
-            if (config == null) {
+            if (config != null) {
+                log.debug("{} Found relying party configuration {} for request", getLogPrefix(), config.getId());
+                relyingPartyCtx.setConfiguration(config);
+            } else {
                 log.debug("{} No relying party configuration applies to this request", getLogPrefix());
                 ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CONFIG);
-                return;
             }
-
-            log.debug("{} Found relying party configuration {} for request", getLogPrefix(), config.getId());
-            relyingPartyCtx.setConfiguration(config);
         } catch (final ResolverException e) {
             log.error("{} Error trying to resolve relying party configuration", getLogPrefix(), e);
             ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CONFIG);
         }
+        
+        profileRequestContext.removeSubcontext(workContext);
     }
 }
\ No newline at end of file
diff --git a/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java b/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java
index 956846a4a..b169783c6 100644
--- a/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java
+++ b/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java
@@ -29,6 +29,7 @@ import javax.annotation.Nullable;
 
 import net.shibboleth.ext.spring.service.AbstractServiceableComponent;
 import net.shibboleth.idp.profile.config.SecurityConfiguration;
+import net.shibboleth.idp.profile.context.RelyingPartyResolverContext;
 import net.shibboleth.idp.profile.logic.VerifiedProfilePredicate;
 import net.shibboleth.idp.relyingparty.RelyingPartyConfiguration;
 import net.shibboleth.idp.relyingparty.RelyingPartyConfigurationResolver;
@@ -210,8 +211,16 @@ public class DefaultRelyingPartyConfigurationResolver
             return Collections.emptyList();
         }
 
+        final Predicate<ProfileRequestContext> condition;
+        final RelyingPartyResolverContext resolverCtx = context.getSubcontext(RelyingPartyResolverContext.class);
+        if (resolverCtx != null && resolverCtx.getVerificationPredicate() != null) {
+            condition = resolverCtx.getVerificationPredicate();
+        } else {
+            condition = getVerificationPredicate();
+        }
+        
         log.debug("Resolving relying party configuration");
-        if (!verificationPredicate.test(context)) {
+        if (!condition.test(context)) {
             if (getUnverifiedConfiguration() == null) {
                 log.warn("Profile request was unverified, but no such configuration is available");
                 return Collections.emptyList();
@@ -250,8 +259,16 @@ public class DefaultRelyingPartyConfigurationResolver
             return null;
         }
         
+        final Predicate<ProfileRequestContext> condition;
+        final RelyingPartyResolverContext resolverCtx = context.getSubcontext(RelyingPartyResolverContext.class);
+        if (resolverCtx != null && resolverCtx.getVerificationPredicate() != null) {
+            condition = resolverCtx.getVerificationPredicate();
+        } else {
+            condition = getVerificationPredicate();
+        }
+        
         log.debug("Resolving relying party configuration");
-        if (!verificationPredicate.test(context)) {
+        if (!condition.test(context)) {
             if (getUnverifiedConfiguration() == null) {
                 log.warn("Profile request was unverified, but no such configuration is available");
                 return null;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list