[java-idp-oidc] branch main updated: JOIDC-61 - Support metadata policies in the dyn. reg. profile configuration

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=cee2aaada2139579aa306e72da21475c5a4b0790

The following commit(s) were added to refs/heads/main by this push:
     new cee2aaad JOIDC-61 - Support metadata policies in the dyn. reg. profile configuration
cee2aaad is described below

commit cee2aaada2139579aa306e72da21475c5a4b0790
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Mar 4 16:03:16 2022 +0200

    JOIDC-61 - Support metadata policies in the dyn. reg. profile configuration
    
    https://shibboleth.atlassian.net/browse/JOIDC-61
    
    Populate OIDCClientRegistrationMetadataPolicyContext.enforcedMetadata also when
    metadata policy has not been configured for the profile (or in the access token).
---
 .../impl/ValidateRegistrationRequestMetadata.java  | 26 +++++++++++-----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationRequestMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationRequestMetadata.java
index ebd18c00..6bd7f14e 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationRequestMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/ValidateRegistrationRequestMetadata.java
@@ -40,7 +40,6 @@ import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCClientRegistratio
 import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
 import net.shibboleth.oidc.metadata.policy.impl.DefaultMetadataPolicyEnforcer;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.utilities.java.support.collection.Pair;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -57,20 +56,20 @@ public class ValidateRegistrationRequestMetadata extends AbstractProfileAction {
     private final Logger log = LoggerFactory.getLogger(ValidateRegistrationRequestMetadata.class);
     
     /** Strategy that will return {@link OIDCClientRegistrationMetadataPolicyContext}. */
-    @NonnullAfterInit private Function<MessageContext, OIDCClientRegistrationMetadataPolicyContext>
+    @Nonnull private Function<MessageContext, OIDCClientRegistrationMetadataPolicyContext>
         registrationMetadataPolicyContextLookupStrategy;
     
     /** Function used for enforcing the metadata policy. */
-    @NonnullAfterInit private Function<Pair<Object, MetadataPolicy>, Pair<Object, Boolean>> metadataPolicyEnforcer;
+    @Nonnull private Function<Pair<Object, MetadataPolicy>, Pair<Object, Boolean>> metadataPolicyEnforcer;
 
     /** The OIDCClientRegistrationRequest to validate. */
     @Nullable private OIDCClientRegistrationRequest request;
     
     /** The metadata policy context to operate on. */
-    private OIDCClientRegistrationMetadataPolicyContext registrationMetadataPolicyContext;
+    @Nullable private OIDCClientRegistrationMetadataPolicyContext registrationMetadataPolicyContext;
 
     /** The metadata policy used for validation. */
-    private Map<String, MetadataPolicy> metadataPolicy;   
+    @Nullable private Map<String, MetadataPolicy> metadataPolicy;
     
     /**
      * Constructor.
@@ -138,10 +137,6 @@ public class ValidateRegistrationRequestMetadata extends AbstractProfileAction {
             return false;                        
         }
         metadataPolicy = registrationMetadataPolicyContext.getMetadataPolicy();
-        if (metadataPolicy == null || metadataPolicy.isEmpty()) {
-            log.debug("{} No metadata policy found, nothing to do", getLogPrefix());
-            return false;
-        }
         
         return true;
     }
@@ -149,16 +144,22 @@ public class ValidateRegistrationRequestMetadata extends AbstractProfileAction {
     /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-        log.debug("{} Metadata policy to be validated: {}", getLogPrefix(), metadataPolicy);
+        if (metadataPolicy == null || metadataPolicy.isEmpty()) {
+            log.debug("{} No metadata policy found, setting the request as policy enforced", getLogPrefix());
+            registrationMetadataPolicyContext.setPolicyEnforcedMetadata(request.getOIDCClientMetadata());
+            return;
+        }
+        log.debug("{} Metadata policy used for the request validation: {}", getLogPrefix(), metadataPolicy);
+
         boolean compliant = true;
 
         final JSONObject requestMetadata = request.getOIDCClientMetadata().toJSONObject();
 
         for (final String claim : metadataPolicy.keySet()) {
-            log.trace("{} Analysing claim {}", getLogPrefix(), claim);
             final MetadataPolicy policy = metadataPolicy.get(claim);
             final Object value = requestMetadata.get(claim);
-            log.debug("{} The claim {} set in policy included in the request", getLogPrefix(), claim);
+            log.debug("{} The claim {} set in policy included in the request: {}", getLogPrefix(), claim,
+                    value == null);
             final Pair<Object, MetadataPolicy> candidate = new Pair<>(value, policy);
             final Pair<Object, Boolean> result = metadataPolicyEnforcer.apply(candidate);
                 
@@ -167,7 +168,6 @@ public class ValidateRegistrationRequestMetadata extends AbstractProfileAction {
                 compliant = false;
             } else {
                 log.trace("{} validation result is OK for claim {}", getLogPrefix(), claim);
-                log.trace("{} policy {} value {} result {}", getLogPrefix(), policy, value, result.getFirst());
                 requestMetadata.put(claim, result.getFirst());
             }
         }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.