[java-identity-provider] branch main updated: IDP-1981 - Build Predicate based on RevocationCache
Scott Cantor
cantor.2 at osu.edu
Fri Jul 29 16:50:57 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=e3b353c4475e7a0d086a65251e6d5d562e923db5
The following commit(s) were added to refs/heads/main by this push:
new e3b353c44 IDP-1981 - Build Predicate based on RevocationCache
e3b353c44 is described below
commit e3b353c4475e7a0d086a65251e6d5d562e923db5
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Jul 29 12:40:50 2022 -0400
IDP-1981 - Build Predicate based on RevocationCache
https://shibboleth.atlassian.net/browse/IDP-1981
Move condition into impl and get rid of RevocationContext.
---
.../idp/authn/context/RevocationContext.java | 54 ----------------------
.../revocation/impl/RevocationCacheCondition.java | 24 +++++-----
.../idp/authn/revocation/impl}/package-info.java | 2 +-
.../impl/RevocationCacheConditionTest.java} | 19 ++++----
.../net/shibboleth/idp/conf/authn-system.xml | 2 +-
5 files changed, 24 insertions(+), 77 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RevocationContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RevocationContext.java
deleted file mode 100644
index f62bd07e5..000000000
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RevocationContext.java
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.authn.context;
-
-import java.util.ArrayList;
-import java.util.Collection;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.messaging.context.BaseContext;
-
-import net.shibboleth.utilities.java.support.annotation.constraint.Live;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-
-/**
- * Context for caching information about revocation of authentication results.
- *
- * @since 4.3.0
- */
-public class RevocationContext extends BaseContext {
-
- /** Revocation records. */
- @Nonnull @NonnullElements private final Collection<String> revocationRecords;
-
- /** Constructor. */
- public RevocationContext() {
- revocationRecords = new ArrayList<>(2);
- }
-
- /**
- * Gets the modifiable collection of revocation records.
- *
- * @return modifiable revocation record collection
- */
- @Nonnull @NonnullElements @Live public Collection<String> getRevocationRecords() {
- return revocationRecords;
- }
-
-}
\ No newline at end of file
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/logic/RevocationCondition.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/RevocationCacheCondition.java
similarity index 89%
rename from idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/logic/RevocationCondition.java
rename to idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/RevocationCacheCondition.java
index 2c4f17e9a..f6c48eb23 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/logic/RevocationCondition.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/RevocationCacheCondition.java
@@ -15,10 +15,11 @@
* limitations under the License.
*/
-package net.shibboleth.idp.authn.context.logic;
+package net.shibboleth.idp.authn.revocation.impl;
import java.io.IOException;
import java.time.Instant;
+import java.util.ArrayList;
import java.util.Collection;
import java.util.function.BiPredicate;
import java.util.function.Function;
@@ -27,13 +28,13 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import jakarta.servlet.http.HttpServletRequest;
+import org.opensaml.messaging.context.ScratchContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.storage.RevocationCache;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import net.shibboleth.idp.authn.AuthenticationResult;
-import net.shibboleth.idp.authn.context.RevocationContext;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -42,11 +43,11 @@ import net.shibboleth.utilities.java.support.component.ComponentInitializationEx
import net.shibboleth.utilities.java.support.logic.Constraint;
/**
- * A condition for login flows that checks for revocation.
+ * A condition for login flows that checks for revocation against a {@link RevocationCache}.
*
* @since 4.3.0
*/
-public class RevocationCondition extends AbstractInitializableComponent
+public class RevocationCacheCondition extends AbstractInitializableComponent
implements BiPredicate<ProfileRequestContext,AuthenticationResult> {
/** Revocation context. */
@@ -59,7 +60,7 @@ public class RevocationCondition extends AbstractInitializableComponent
@Nonnull @NotEmpty public static final String ADDRESS_REVOCATION_PREFIX = "addr:";
/** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(RevocationCondition.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(RevocationCacheCondition.class);
/** Cache to use. */
@NonnullAfterInit private RevocationCache revocationCache;
@@ -132,8 +133,8 @@ public class RevocationCondition extends AbstractInitializableComponent
log.debug("Checking revocation for principal name {} for {} result", principal,
input2.getAuthenticationFlowId());
- RevocationContext context = input.getSubcontext(RevocationContext.class);
- if (context == null) {
+ final ScratchContext context = input.getSubcontext(ScratchContext.class, true);
+ if (!context.getMap().containsKey(getClass())) {
try {
final String principalRecord = revocationCache.getRevocationRecord(REVOCATION_CONTEXT,
PRINCIPAL_REVOCATION_PREFIX + principal);
@@ -141,13 +142,14 @@ public class RevocationCondition extends AbstractInitializableComponent
revocationCache.getRevocationRecord(REVOCATION_CONTEXT,
ADDRESS_REVOCATION_PREFIX + httpServletRequest.getRemoteAddr()) :
null;
- context = input.getSubcontext(RevocationContext.class, true);
+ final Collection<String> records = new ArrayList<>(2);
if (principalRecord != null) {
- context.getRevocationRecords().add(principalRecord);
+ records.add(principalRecord);
}
if (addressRecord != null) {
- context.getRevocationRecords().add(addressRecord);
+ records.add(addressRecord);
}
+ context.getMap().put(getClass(), records);
} catch (final IOException e) {
log.error("Error checking revocation cache for principal {}, treating as revoked",
principal, e);
@@ -155,7 +157,7 @@ public class RevocationCondition extends AbstractInitializableComponent
}
}
- return isRevoked(principal, input2, context.getRevocationRecords());
+ return isRevoked(principal, input2, (Collection<String>) context.getMap().get(getClass()));
}
/**
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/logic/package-info.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/package-info.java
similarity index 94%
rename from idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/logic/package-info.java
rename to idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/package-info.java
index 6237f69a5..8c0471a45 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/logic/package-info.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/package-info.java
@@ -19,4 +19,4 @@
* Predicates related to authentication.
*/
-package net.shibboleth.idp.authn.context.logic;
\ No newline at end of file
+package net.shibboleth.idp.authn.revocation.impl;
\ No newline at end of file
diff --git a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/RevocationConditionTest.java b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/revocation/impl/RevocationCacheConditionTest.java
similarity index 86%
rename from idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/RevocationConditionTest.java
rename to idp-authn-impl/src/test/java/net/shibboleth/idp/authn/revocation/impl/RevocationCacheConditionTest.java
index 5afc5f8c1..9a1021526 100644
--- a/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/impl/RevocationConditionTest.java
+++ b/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/revocation/impl/RevocationCacheConditionTest.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.authn.impl;
+package net.shibboleth.idp.authn.revocation.impl;
import java.time.Duration;
import java.util.Arrays;
@@ -24,7 +24,6 @@ import javax.security.auth.Subject;
import net.shibboleth.idp.authn.AuthenticationResult;
import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.idp.authn.context.logic.RevocationCondition;
import net.shibboleth.idp.authn.impl.testing.BaseAuthenticationContextTest;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.logic.FunctionSupport;
@@ -37,12 +36,12 @@ import org.testng.annotations.AfterMethod;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
-/** {@link RevocationCondition} unit test. */
-public class RevocationConditionTest extends BaseAuthenticationContextTest {
+/** {@link RevocationCacheCondition} unit test. */
+public class RevocationCacheConditionTest extends BaseAuthenticationContextTest {
private MemoryStorageService storageService;
private RevocationCache revocationCache;
- private RevocationCondition condition;
+ private RevocationCacheCondition condition;
@BeforeMethod
public void setUp() throws ComponentInitializationException {
@@ -58,7 +57,7 @@ public class RevocationConditionTest extends BaseAuthenticationContextTest {
revocationCache.setId("test");
revocationCache.initialize();
- condition = new RevocationCondition();
+ condition = new RevocationCacheCondition();
condition.setRevocationCache(revocationCache);
condition.setPrincipalNameLookupStrategy(FunctionSupport.constant("jdoe"));
condition.initialize();
@@ -87,8 +86,8 @@ public class RevocationConditionTest extends BaseAuthenticationContextTest {
final AuthenticationContext authCtx = prc.getSubcontext(AuthenticationContext.class);
authCtx.setActiveResults(Arrays.asList(active));
- revocationCache.revoke(RevocationCondition.REVOCATION_CONTEXT,
- RevocationCondition.PRINCIPAL_REVOCATION_PREFIX + "jdoe",
+ revocationCache.revoke(RevocationCacheCondition.REVOCATION_CONTEXT,
+ RevocationCacheCondition.PRINCIPAL_REVOCATION_PREFIX + "jdoe",
Long.toString(Instant.now().getMillis() / 1000 + 3600L),
Duration.ofDays(1));
@@ -100,8 +99,8 @@ public class RevocationConditionTest extends BaseAuthenticationContextTest {
final AuthenticationContext authCtx = prc.getSubcontext(AuthenticationContext.class);
authCtx.setActiveResults(Arrays.asList(active));
- revocationCache.revoke(RevocationCondition.REVOCATION_CONTEXT,
- RevocationCondition.PRINCIPAL_REVOCATION_PREFIX + "jdoe",
+ revocationCache.revoke(RevocationCacheCondition.REVOCATION_CONTEXT,
+ RevocationCacheCondition.PRINCIPAL_REVOCATION_PREFIX + "jdoe",
Long.toString(Instant.now().getMillis() / 1000 - 3600L),
Duration.ofDays(1));
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml
index 918cafb22..ab7d82961 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/authn-system.xml
@@ -536,7 +536,7 @@
<!-- Revocation feature. -->
- <bean id="shibboleth.RevocationCondition" class="net.shibboleth.idp.authn.context.logic.RevocationCondition" lazy-init="true"
+ <bean id="shibboleth.RevocationCondition" class="net.shibboleth.idp.authn.revocation.impl.RevocationCacheCondition" lazy-init="true"
p:revocationCache-ref="%{idp.authn.revocation.cache:shibboleth.AuthnRevocationCache}"
p:httpServletRequest="#{%{idp.authn.revocation.addressBased:false} ? getObject('shibboleth.HttpServletRequest') : null}"
p:principalNameLookupStrategy-ref="shibboleth.RevocationPrincipalLookupStrategy" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list