[java-oidc-common] branch main updated: JCOMOIDC-28 - Support for metadata policies
Henri Mikkonen
henri.mikkonen at iki.fi
Wed Mar 9 12:34:07 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=61955ae66f9a92b4c271e2ee4ad45ce771a84369
The following commit(s) were added to refs/heads/main by this push:
new 61955ae JCOMOIDC-28 - Support for metadata policies
61955ae is described below
commit 61955ae66f9a92b4c271e2ee4ad45ce771a84369
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Mar 9 14:33:50 2022 +0200
JCOMOIDC-28 - Support for metadata policies
https://shibboleth.atlassian.net/browse/JCOMOIDC-28
Improved 'one_of' handling to be compatible with lists.
---
.../policy/impl/DefaultMetadataPolicyEnforcer.java | 22 ++++++++++--
.../impl/DefaultMetadataPolicyEnforcerTest.java | 42 ++++++++++++++++++++++
2 files changed, 61 insertions(+), 3 deletions(-)
diff --git a/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/policy/impl/DefaultMetadataPolicyEnforcer.java b/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/policy/impl/DefaultMetadataPolicyEnforcer.java
index c50a1b3..3664215 100644
--- a/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/policy/impl/DefaultMetadataPolicyEnforcer.java
+++ b/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/policy/impl/DefaultMetadataPolicyEnforcer.java
@@ -141,9 +141,25 @@ public class DefaultMetadataPolicyEnforcer implements Function<Pair<Object, Meta
if (candidate != null) {
final List<Object> oneOfValues = policy.getOneOfValues();
- if (oneOfValues != null && !oneOfValues.contains(candidate)) {
- log.warn("The candidate {} does not contain a value required by one_of {}", candidate, oneOfValues);
- validation = false;
+ if (oneOfValues != null) {
+ if (candidate instanceof List) {
+ final List<?> list = (List<?>) candidate;
+ if (list.size() > 1) {
+ log.warn("The candidate {} contains multiple values, not compatible with one_of", candidate);
+ validation = false;
+ } else {
+ if (oneOfValues != null && !MetadataPolicyHelper.isSubsetOfValues(candidate, oneOfValues)) {
+ log.warn("The candidate {} is not compatible with one_of {}", candidate, oneOfValues);
+ validation = false;
+ }
+ }
+ } else {
+ if (!oneOfValues.contains(candidate)) {
+ log.warn("The candidate {} does not contain a value required by one_of {}", candidate,
+ oneOfValues);
+ validation = false;
+ }
+ }
}
final List<Object> subsetOfValues = policy.getSubsetOfValues();
if (subsetOfValues != null && !MetadataPolicyHelper.isSubsetOfValues(candidate, subsetOfValues)) {
diff --git a/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/policy/impl/DefaultMetadataPolicyEnforcerTest.java b/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/policy/impl/DefaultMetadataPolicyEnforcerTest.java
index 410ab6b..638cf56 100644
--- a/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/policy/impl/DefaultMetadataPolicyEnforcerTest.java
+++ b/oidc-common-metadata-impl/src/test/java/net/shibboleth/oidc/metadata/policy/impl/DefaultMetadataPolicyEnforcerTest.java
@@ -203,6 +203,14 @@ public class DefaultMetadataPolicyEnforcerTest {
applier.apply(new Pair<>("existing", new MetadataPolicy.Builder().withOneOfValues(List.of("existing",
"another")).build())),
"existing");
+ assertResultEquals(
+ applier.apply(new Pair<>(List.of("existing"), new MetadataPolicy.Builder().withOneOfValues(
+ List.of("existing")).build())),
+ List.of("existing"));
+ assertResultEquals(
+ applier.apply(new Pair<>(List.of("existing"), new MetadataPolicy.Builder().withOneOfValues(
+ List.of("existing", "another")).build())),
+ List.of("existing"));
assertResultEquals(
applier.apply(new Pair<>(123, new MetadataPolicy.Builder().withOneOfValues(List.of(123))
.build())),
@@ -211,6 +219,14 @@ public class DefaultMetadataPolicyEnforcerTest {
applier.apply(new Pair<>(123, new MetadataPolicy.Builder().withOneOfValues(List.of(123, 321))
.build())),
123);
+ assertResultEquals(
+ applier.apply(new Pair<>(List.of(123), new MetadataPolicy.Builder().withOneOfValues(List.of(123))
+ .build())),
+ List.of(123));
+ assertResultEquals(
+ applier.apply(new Pair<>(List.of(123), new MetadataPolicy.Builder().withOneOfValues(List.of(123, 321))
+ .build())),
+ List.of(123));
assertResultEquals(
applier.apply(new Pair<>(true, new MetadataPolicy.Builder().withOneOfValues(List.of(true))
.build())),
@@ -219,10 +235,24 @@ public class DefaultMetadataPolicyEnforcerTest {
applier.apply(new Pair<>(true, new MetadataPolicy.Builder().withOneOfValues(List.of(true, false))
.build())),
true);
+ assertResultEquals(
+ applier.apply(new Pair<>(List.of(true), new MetadataPolicy.Builder().withOneOfValues(List.of(true))
+ .build())),
+ List.of(true));
+ assertResultEquals(
+ applier.apply(new Pair<>(List.of(true), new MetadataPolicy.Builder().withOneOfValues(List.of(true,
+ false)).build())),
+ List.of(true));
}
@Test
public void apply_whenOneOfNotMeetingValue_resultIsFalse() {
+ assertResultFalse(
+ applier.apply(new Pair<>(List.of("existing", "another"), new MetadataPolicy.Builder().withOneOfValues(
+ List.of("existing", "another")).build())));
+ assertResultFalse(
+ applier.apply(new Pair<>(List.of("not"), new MetadataPolicy.Builder().withOneOfValues(
+ List.of("existing", "another")).build())));
assertResultFalse(
applier.apply(new Pair<>("not", new MetadataPolicy.Builder().withOneOfValues(List.of("existing"))
.build())));
@@ -235,12 +265,24 @@ public class DefaultMetadataPolicyEnforcerTest {
assertResultFalse(
applier.apply(new Pair<>(123, new MetadataPolicy.Builder().withOneOfValues(List.of(321, 322))
.build())));
+ assertResultFalse(
+ applier.apply(new Pair<>(List.of(123), new MetadataPolicy.Builder().withOneOfValues(List.of(321))
+ .build())));
+ assertResultFalse(
+ applier.apply(new Pair<>(List.of(123), new MetadataPolicy.Builder().withOneOfValues(List.of(321, 322))
+ .build())));
assertResultFalse(
applier.apply(new Pair<>(true, new MetadataPolicy.Builder().withOneOfValues(List.of(false))
.build())));
assertResultFalse(
applier.apply(new Pair<>(false, new MetadataPolicy.Builder().withOneOfValues(List.of(true))
.build())));
+ assertResultFalse(
+ applier.apply(new Pair<>(List.of(true), new MetadataPolicy.Builder().withOneOfValues(List.of(false))
+ .build())));
+ assertResultFalse(
+ applier.apply(new Pair<>(List.of(false), new MetadataPolicy.Builder().withOneOfValues(List.of(true))
+ .build())));
}
@Test
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list