[java-identity-provider] branch dev/IDP-1960 updated: Add extender to handle Subject injection into resolver/filter scripts.
Scott Cantor
cantor.2 at osu.edu
Wed Jul 6 15:48:15 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch dev/IDP-1960
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f563bb8d0673c930d2bb70afd0c9a92286dcf397
The following commit(s) were added to refs/heads/dev/IDP-1960 by this push:
new f563bb8d0 Add extender to handle Subject injection into resolver/filter scripts.
f563bb8d0 is described below
commit f563bb8d0673c930d2bb70afd0c9a92286dcf397
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jul 6 11:48:12 2022 -0400
Add extender to handle Subject injection into resolver/filter scripts.
---
idp-authn-impl/pom.xml | 4 +
.../context/impl/SubjectScriptContextExtender.java | 92 ++++++++++++++++++++++
.../idp/authn/context/impl/package-info.java | 22 ++++++
.../idp/conf/attribute-filter-system.xml | 3 +
.../idp/conf/attribute-resolver-system.xml | 3 +
idp-conf/pom.xml | 6 +-
.../test/resources/metadata/example-metadata.xml | 4 +
7 files changed, 131 insertions(+), 3 deletions(-)
diff --git a/idp-authn-impl/pom.xml b/idp-authn-impl/pom.xml
index 1e9029f14..286f9bd7f 100644
--- a/idp-authn-impl/pom.xml
+++ b/idp-authn-impl/pom.xml
@@ -56,6 +56,10 @@
<groupId>net.shibboleth</groupId>
<artifactId>shib-attribute-filter-api</artifactId>
</dependency>
+ <dependency>
+ <groupId>net.shibboleth</groupId>
+ <artifactId>shib-attribute-resolver-api</artifactId>
+ </dependency>
<dependency>
<groupId>${opensaml.groupId}</groupId>
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/SubjectScriptContextExtender.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/SubjectScriptContextExtender.java
new file mode 100644
index 000000000..6cf812790
--- /dev/null
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/SubjectScriptContextExtender.java
@@ -0,0 +1,92 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.authn.context.impl;
+
+import java.util.List;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.script.ScriptContext;
+import javax.security.auth.Subject;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.idp.attribute.filter.FilterScriptContextExtender;
+import net.shibboleth.idp.attribute.resolver.scripted.ResolverScriptContextExtender;
+import net.shibboleth.idp.authn.context.SubjectContext;
+import net.shibboleth.utilities.java.support.component.AbstractInitializableComponent;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * An extender that supplements an IdP {@link ScriptContext} with {@link Subject} information.
+ *
+ * @since 5.0.0
+ */
+public class SubjectScriptContextExtender extends AbstractInitializableComponent
+ implements ResolverScriptContextExtender, FilterScriptContextExtender {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(SubjectScriptContextExtender.class);
+
+ /** Strategy used to locate the {@link SubjectContext} to use. */
+ @Nonnull private Function<ProfileRequestContext,SubjectContext> subjectContextLookupStrategy;
+
+ /** Constructor. */
+ public SubjectScriptContextExtender() {
+ subjectContextLookupStrategy = new ChildContextLookup<>(SubjectContext.class);
+ }
+
+ /**
+ * Set the strategy used to locate the {@link SubjectContext}.
+ *
+ * @param strategy strategy used to locate the {@link SubjectContext}
+ */
+ public void setSubjectContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,SubjectContext> strategy) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+
+ subjectContextLookupStrategy = Constraint.isNotNull(strategy, "SubjectContext lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ public void extendContext(@Nonnull final ScriptContext scriptContext) {
+ ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+
+ final ProfileRequestContext prc = (ProfileRequestContext) scriptContext.getAttribute("profileContext");
+
+ final SubjectContext sc = subjectContextLookupStrategy.apply(prc);
+ if (null == sc) {
+ log.debug("SubjectScriptContextExtender could not locate SubjectContext");
+ } else {
+ final List<Subject> subjects = sc.getSubjects();
+ if (null == subjects) {
+ scriptContext.setAttribute("subjects", null, ScriptContext.ENGINE_SCOPE);
+ } else {
+ scriptContext.setAttribute(
+ "subjects", subjects.toArray(new Subject[subjects.size()]), ScriptContext.ENGINE_SCOPE);
+ }
+ }
+ }
+
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/package-info.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/package-info.java
new file mode 100644
index 000000000..2faa71cc8
--- /dev/null
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/package-info.java
@@ -0,0 +1,22 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Implementation classes related to authentication contexts.
+ */
+
+package net.shibboleth.idp.authn.context.impl;
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-filter-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-filter-system.xml
index 616653c7c..4167596cb 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-filter-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-filter-system.xml
@@ -12,6 +12,9 @@
default-init-method="initialize"
default-destroy-method="destroy">
+ <!-- This extends scripted plugins with access to the SubjectContext, if present. -->
+ <bean class="net.shibboleth.idp.authn.context.impl.SubjectScriptContextExtender" />
+
<!-- Wildcard import hook for plugins. -->
<import resource="classpath*:/META-INF/net/shibboleth/idp/service/attribute/filter/postconfig.xml" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-resolver-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-resolver-system.xml
index 880817870..229376bd6 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-resolver-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-resolver-system.xml
@@ -12,6 +12,9 @@
default-init-method="initialize"
default-destroy-method="destroy">
+ <!-- This extends scripted plugins with access to the SubjectContext, if present. -->
+ <bean class="net.shibboleth.idp.authn.context.impl.SubjectScriptContextExtender" />
+
<!-- Wildcard import hook for plugins. -->
<import resource="classpath*:/META-INF/net/shibboleth/idp/service/attribute/resolver/postconfig.xml" />
diff --git a/idp-conf/pom.xml b/idp-conf/pom.xml
index b1b8d5938..a7611e997 100644
--- a/idp-conf/pom.xml
+++ b/idp-conf/pom.xml
@@ -172,9 +172,9 @@
</activation>
<dependencies>
<dependency>
- <groupId>org.openjdk.nashorn</groupId>
- <artifactId>nashorn-core</artifactId>
- <version>${nashorn.jdk.version}</version>
+ <groupId>org.openjdk.nashorn</groupId>
+ <artifactId>nashorn-core</artifactId>
+ <version>${nashorn.jdk.version}</version>
<scope>test</scope>
</dependency>
</dependencies>
diff --git a/idp-conf/src/test/resources/metadata/example-metadata.xml b/idp-conf/src/test/resources/metadata/example-metadata.xml
index 3053295a4..c42695fa6 100644
--- a/idp-conf/src/test/resources/metadata/example-metadata.xml
+++ b/idp-conf/src/test/resources/metadata/example-metadata.xml
@@ -24,6 +24,10 @@
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml:AttributeValue>true</saml:AttributeValue>
</saml:Attribute>
+ <saml:Attribute Name="http://shibboleth.net/ns/profiles/saml1/sso/browser/includeAttributeStatement"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+ <saml:AttributeValue>false</saml:AttributeValue>
+ </saml:Attribute>
<saml:Attribute Name="http://shibboleth.net/ns/attributes/releaseAllValues"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml:AttributeValue>eduPersonPrincipalName</saml:AttributeValue>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list