[java-identity-provider] branch main updated: IDP-1904 - Additional policy rules for attribute filter
Scott Cantor
cantor.2 at osu.edu
Wed Feb 16 18:57:36 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=449f711718e7578cde3addc7d4b2d207e11b4d80
The following commit(s) were added to refs/heads/main by this push:
new 449f71171 IDP-1904 - Additional policy rules for attribute filter
449f71171 is described below
commit 449f711718e7578cde3addc7d4b2d207e11b4d80
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Feb 16 13:57:33 2022 -0500
IDP-1904 - Additional policy rules for attribute filter
https://shibboleth.atlassian.net/browse/IDP-1904
Add Policy rule and parser.
---
.../filtercontext/impl/ProfilePolicyRule.java | 94 +++++++++++++++++++++
.../attribute/filter/matcher/impl/DataSources.java | 9 +-
.../filtercontext/impl/ProfilePolicyRuleTest.java | 97 ++++++++++++++++++++++
.../impl/AttributeFilterNamespaceHandler.java | 3 +
.../spring/policyrule/impl/ProfileRuleParser.java | 39 +++++++++
.../spring/policy/ProfileRuleParserTest.java | 43 ++++++++++
.../idp/attribute/filter/policyrule/profile.xml | 5 ++
.../src/main/resources/schema/shibboleth-afp.xsd | 11 ++-
8 files changed, 296 insertions(+), 5 deletions(-)
diff --git a/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/filtercontext/impl/ProfilePolicyRule.java b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/filtercontext/impl/ProfilePolicyRule.java
new file mode 100644
index 000000000..5b00db30a
--- /dev/null
+++ b/idp-attribute-filter-impl/src/main/java/net/shibboleth/idp/attribute/filter/policyrule/filtercontext/impl/ProfilePolicyRule.java
@@ -0,0 +1,94 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.policyrule.filtercontext.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
+import net.shibboleth.idp.attribute.filter.policyrule.impl.AbstractStringPolicyRule;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+import org.opensaml.messaging.context.navigate.ParentContextLookup;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Compare the profile identifier for this resolution with the provided string.
+ *
+ * @since 4.2.0
+ */
+public class ProfilePolicyRule extends AbstractStringPolicyRule {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ProfilePolicyRule.class);
+
+
+ /** How to get to the {@link ProfileRequestContext} from the {@link AttributeFilterContext}. */
+ @Nonnull private Function<AttributeFilterContext,ProfileRequestContext> profileContextStrategy;
+
+ /** Constructor. */
+ public ProfilePolicyRule() {
+ profileContextStrategy =
+ new ParentContextLookup<>(ProfileRequestContext.class).compose(
+ new ParentContextLookup<>(RelyingPartyContext.class));
+ }
+
+ /**
+ * Set the context location strategy we'll use.
+ *
+ * @return Returns the strategy.
+ */
+ public Function<AttributeFilterContext, ProfileRequestContext> getProfileContextStrategy() {
+ return profileContextStrategy;
+ }
+
+ /**
+ * Get the context location strategy we'll use.
+ *
+ * @param strategy what to set.
+ */
+ public void setProfileContextStrategy(final Function<AttributeFilterContext,ProfileRequestContext> strategy) {
+ profileContextStrategy = Constraint.isNotNull(strategy, "ProfileContext lookup strategy cannot be null");
+ }
+
+ /**
+ * Compare the principal name for this resolution with the provided string.
+ *
+ * @param filterContext the context
+ * @return whether it matches
+ *
+ * {@inheritDoc}
+ */
+ @Override public Tristate matches(@Nonnull final AttributeFilterContext filterContext) {
+ ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
+
+ final ProfileRequestContext pc = profileContextStrategy.apply(filterContext);
+ if (null == pc) {
+ log.warn("{} Could not locate profile context", getLogPrefix());
+ return Tristate.FAIL;
+ }
+
+ return stringCompare(pc.getProfileId());
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/matcher/impl/DataSources.java b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/matcher/impl/DataSources.java
index 222ef33d0..d9e7cb668 100644
--- a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/matcher/impl/DataSources.java
+++ b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/matcher/impl/DataSources.java
@@ -27,7 +27,7 @@ import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
import net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext;
import net.shibboleth.idp.saml.impl.testing.TestSources;
-import org.opensaml.messaging.context.BaseContext;
+import org.opensaml.profile.context.ProfileRequestContext;
/**
* Strings and such used for testing.
@@ -69,7 +69,7 @@ public abstract class DataSources {
public static AttributeFilterContext populatedFilterContext(String principal, String issuerID, String recipientId) {
- BaseContext parent = new BaseContext() {};
+ final ProfileRequestContext parent = new ProfileRequestContext();
parent.addSubcontext(TestSources.createResolutionContext(principal, issuerID, recipientId));
AttributeFilterContext retVal = parent.getSubcontext(AttributeFilterContext.class, true);
retVal.setPrincipal(principal);
@@ -80,8 +80,9 @@ public abstract class DataSources {
public static AttributeFilterContext unPopulatedFilterContext() {
- BaseContext parent = new BaseContext() {};
+ final ProfileRequestContext parent = new ProfileRequestContext();
parent.addSubcontext(new AttributeResolutionContext());
return parent.getSubcontext(AttributeFilterContext.class, true);
}
-}
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/filtercontext/impl/ProfilePolicyRuleTest.java b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/filtercontext/impl/ProfilePolicyRuleTest.java
new file mode 100644
index 000000000..ce0e4ee7e
--- /dev/null
+++ b/idp-attribute-filter-impl/src/test/java/net/shibboleth/idp/attribute/filter/policyrule/filtercontext/impl/ProfilePolicyRuleTest.java
@@ -0,0 +1,97 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.policyrule.filtercontext.impl;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.fail;
+
+import org.opensaml.messaging.context.navigate.ParentContextLookup;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.attribute.filter.PolicyRequirementRule.Tristate;
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
+import net.shibboleth.idp.attribute.filter.matcher.impl.DataSources;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+import net.shibboleth.utilities.java.support.component.UninitializedComponentException;
+
+
+/**
+ * Tests for {@link ProfilePolicyRule}.
+ */
+ at SuppressWarnings("javadoc")
+public class ProfilePolicyRuleTest {
+
+ private ProfilePolicyRule getMatcher(final boolean caseSensitive) throws ComponentInitializationException {
+ ProfilePolicyRule matcher = new ProfilePolicyRule();
+ matcher.setMatchString("https://shibboleth.net/profile");
+ matcher.setCaseSensitive(caseSensitive);
+ matcher.setId("Test");
+ matcher.setProfileContextStrategy(new ParentContextLookup<>(ProfileRequestContext.class));
+ matcher.initialize();
+ return matcher;
+ }
+
+ @Test public void testNull() throws ComponentInitializationException {
+
+ try {
+ new ProfilePolicyRule().matches(null);
+ fail();
+ } catch (UninitializedComponentException ex) {
+ // OK
+ }
+ }
+
+ @Test public void testUnpopulated() throws ComponentInitializationException {
+ final ProfilePolicyRule matcher = getMatcher(true);
+ assertEquals(matcher.matches(DataSources.unPopulatedFilterContext()), Tristate.FALSE);
+ }
+
+ @Test public void testNoProfile() throws ComponentInitializationException {
+ final ProfilePolicyRule matcher = getMatcher(true);
+ final AttributeFilterContext afc = DataSources.populatedFilterContext(null, null, null);
+
+ assertEquals(matcher.matches(afc), Tristate.FALSE);
+ }
+
+ @Test public void testCaseSensitive() throws ComponentInitializationException {
+
+ final ProfilePolicyRule matcher = getMatcher(true);
+ final AttributeFilterContext afc = DataSources.populatedFilterContext(null, null, null);
+
+ ((ProfileRequestContext) afc.getParent()).setProfileId("https://shibboleth.net/Profile");
+ assertEquals(matcher.matches(afc), Tristate.FALSE);
+
+ ((ProfileRequestContext) afc.getParent()).setProfileId("https://shibboleth.net/profile");
+ assertEquals(matcher.matches(afc), Tristate.TRUE);
+ }
+
+
+ @Test public void testCaseInsensitive() throws ComponentInitializationException {
+
+ final ProfilePolicyRule matcher = getMatcher(false);
+ final AttributeFilterContext afc = DataSources.populatedFilterContext(null, null, null);
+
+ ((ProfileRequestContext) afc.getParent()).setProfileId("https://shibboleth.net/Profile");
+ assertEquals(matcher.matches(afc), Tristate.TRUE);
+
+ ((ProfileRequestContext) afc.getParent()).setProfileId("https://shibboleth.net/profile");
+ assertEquals(matcher.matches(afc), Tristate.TRUE);
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
index a1c6b8941..06ad06187 100644
--- a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
@@ -40,6 +40,7 @@ import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.OutboundRulePa
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.PredicateRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.PrincipalNameRegexRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.PrincipalNameRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.ProfileRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.ProxiedRequesterRegexRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.ProxiedRequesterRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeInMetadataRuleParser;
@@ -133,6 +134,8 @@ public class AttributeFilterNamespaceHandler extends BaseSpringNamespaceHandler
registerBeanDefinitionParser(PredicateRuleParser.SCHEMA_TYPE, new PredicateRuleParser());
+ registerBeanDefinitionParser(ProfileRuleParser.SCHEMA_TYPE, new ProfileRuleParser());
+
// SAML -
registerBeanDefinitionParser(RequesterEntityAttributeExactRuleParser.SCHEMA_TYPE,
new RequesterEntityAttributeExactRuleParser());
diff --git a/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/ProfileRuleParser.java b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/ProfileRuleParser.java
new file mode 100644
index 000000000..5bedeb057
--- /dev/null
+++ b/idp-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/ProfileRuleParser.java
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.spring.policyrule.impl;
+
+import javax.annotation.Nonnull;
+import javax.xml.namespace.QName;
+
+import net.shibboleth.idp.attribute.filter.policyrule.filtercontext.impl.ProfilePolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
+
+/**
+ * Bean definition parser for {@link ProfilePolicyRule}.
+ */
+public class ProfileRuleParser extends AbstractStringPolicyRuleParser {
+
+ /** Schema type. */
+ public static final QName SCHEMA_TYPE = new QName(BaseFilterParser.NAMESPACE, "Profile");
+
+ /** {@inheritDoc} */
+ @Override @Nonnull protected Class<ProfilePolicyRule> getNativeBeanClass() {
+ return ProfilePolicyRule.class;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/ProfileRuleParserTest.java b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/ProfileRuleParserTest.java
new file mode 100644
index 000000000..79beac56c
--- /dev/null
+++ b/idp-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/policy/ProfileRuleParserTest.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.spring.policy;
+
+import static org.testng.Assert.assertEquals;
+
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.attribute.filter.policyrule.filtercontext.impl.ProfilePolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.ProfileRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.testing.BaseAttributeFilterParserTest;
+import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
+
+/** Unit test for {@link ProfileRuleParser}. */
+public class ProfileRuleParserTest extends BaseAttributeFilterParserTest {
+
+ /**
+ * Basic test.
+ *
+ * @throws ComponentInitializationException
+ */
+ @Test public void policy() throws ComponentInitializationException {
+
+ final ProfilePolicyRule arRule = (ProfilePolicyRule) getPolicyRule("profile.xml");
+ assertEquals(arRule.getMatchString(), "https://shibboleth.net/profile");
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/profile.xml b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/profile.xml
new file mode 100644
index 000000000..235fb7fce
--- /dev/null
+++ b/idp-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/profile.xml
@@ -0,0 +1,5 @@
+<AttributeFilterPolicy id="MostBasicExample" xmlns="urn:mace:shibboleth:2.0:afp" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
+ <PolicyRequirementRule xsi:type="Profile" value="https://shibboleth.net/profile" />
+
+</AttributeFilterPolicy>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-afp.xsd b/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
index fe7f11a6b..3c9ad032a 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-afp.xsd
@@ -3,7 +3,7 @@
xmlns:afp="urn:mace:shibboleth:2.0:afp"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
targetNamespace="urn:mace:shibboleth:2.0:afp"
- version="4.1.0"
+ version="4.2.0"
elementFormDefault="qualified">
<import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd"/>
@@ -353,6 +353,15 @@
</complexContent>
</complexType>
+ <complexType name="Profile">
+ <annotation>
+ <documentation>A match function that matches the active profile identifier against the specified value.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:StringMatchType"/>
+ </complexContent>
+ </complexType>
+
<complexType name="Value">
<annotation>
<documentation>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list