[java-oidc-common] branch main updated: Refactor resolve attributes profile config handling.
Scott Cantor
cantor.2 at osu.edu
Thu Mar 10 15:28:53 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=22c9f5593b35b26a5a6f4af62ae23ecc6c1143fb
The following commit(s) were added to refs/heads/main by this push:
new 22c9f55 Refactor resolve attributes profile config handling.
22c9f55 is described below
commit 22c9f5593b35b26a5a6f4af62ae23ecc6c1143fb
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Mar 10 10:28:50 2022 -0500
Refactor resolve attributes profile config handling.
---
.../config/AbstractOIDCSSOConfiguration.java | 18 +++-----
.../profile/config/OIDCUserInfoConfiguration.java | 30 ++++++++++++-
.../config/logic/ResolveAttributesPredicate.java | 50 ----------------------
.../config/OAuth2TokenAudienceConfiguration.java | 13 ++----
4 files changed, 37 insertions(+), 74 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
index 288f714..ce49d2c 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/AbstractOIDCSSOConfiguration.java
@@ -32,6 +32,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import com.google.common.base.Predicates;
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
+import net.shibboleth.idp.profile.config.AttributeResolvingProfileConfiguration;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.AbstractOAuth2FlowAwareProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
@@ -46,7 +47,8 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* Base class for profiles that support OIDC's concept of SSO, which spans multiple endpoints.
*/
public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwareProfileConfiguration
- implements OIDCProfileConfiguration, AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration {
+ implements OIDCProfileConfiguration, AuthenticationProfileConfiguration, OverriddenIssuerProfileConfiguration,
+ AttributeResolvingProfileConfiguration {
/** OIDC base protocol URI. */
@Nonnull @NotEmpty public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
@@ -125,18 +127,8 @@ public abstract class AbstractOIDCSSOConfiguration extends AbstractOAuth2FlowAwa
public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
}
-
- /**
- * Get whether attributes should be resolved during the profile.
- *
- * <p>Default is true</p>
- *
- * <p>This flag is NOT honored by the authorization endpoint, only the token endpoint.</p>
- *
- * @param profileRequestContext current profile request context
- *
- * @return true iff attributes should be resolved
- */
+
+ /** {@inheritDoc} */
public boolean isResolveAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
return resolveAttributesPredicate.test(profileRequestContext);
}
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
index 5d51bd4..27b8f86 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCUserInfoConfiguration.java
@@ -31,6 +31,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import com.google.common.base.Predicates;
import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
+import net.shibboleth.idp.profile.config.AttributeResolvingProfileConfiguration;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -43,7 +44,7 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* Profile configuration for the OpenID Connect core protocol userinfo endpoint.
*/
public class OIDCUserInfoConfiguration extends AbstractConditionalProfileConfiguration
- implements OIDCProfileConfiguration, OverriddenIssuerProfileConfiguration {
+ implements OIDCProfileConfiguration, OverriddenIssuerProfileConfiguration, AttributeResolvingProfileConfiguration {
/** OIDC base protocol URI. */
@Nonnull @NotEmpty public static final String PROTOCOL_URI = "http://openid.net/specs/openid-connect-core-1_0.html";
@@ -54,6 +55,9 @@ public class OIDCUserInfoConfiguration extends AbstractConditionalProfileConfigu
/** Lookup function to override issuer value. */
@Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
+ /** Whether attributes should be resolved in the course of the profile. */
+ @Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
+
/** Whether encryption is optional in the face of no key, etc. */
@Nonnull private Predicate<ProfileRequestContext> encryptionOptionalPredicate;
@@ -76,6 +80,7 @@ public class OIDCUserInfoConfiguration extends AbstractConditionalProfileConfigu
super(profileId);
issuerLookupStrategy = FunctionSupport.constant(null);
+ resolveAttributesPredicate = Predicates.alwaysTrue();
encryptionOptionalPredicate = Predicates.alwaysTrue();
deniedUserInfoAttributesLookupStrategy = FunctionSupport.constant(null);
}
@@ -103,6 +108,29 @@ public class OIDCUserInfoConfiguration extends AbstractConditionalProfileConfigu
issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ public boolean isResolveAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
+ return resolveAttributesPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether attributes should be resolved during the profile.
+ *
+ * @param flag flag to set
+ */
+ public void setResolveAttributes(final boolean flag) {
+ resolveAttributesPredicate = flag ? Predicates.alwaysTrue() : Predicates.alwaysFalse();
+ }
+
+ /**
+ * Set a condition to determine whether attributes should be resolved during the profile.
+ *
+ * @param condition condition to set
+ */
+ public void setResolveAttributesPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ resolveAttributesPredicate = Constraint.isNotNull(condition, "Resolve attributes predicate cannot be null");
+ }
+
/**
* Get whether encryption is optional in the face of a missing key, etc.
*
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ResolveAttributesPredicate.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ResolveAttributesPredicate.java
deleted file mode 100644
index e556a34..0000000
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/logic/ResolveAttributesPredicate.java
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.oidc.profile.config.logic;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.oidc.profile.config.AbstractOIDCSSOConfiguration;
-import net.shibboleth.oidc.profile.oauth2.config.OAuth2TokenAudienceConfiguration;
-
-/**
- * A predicate implementation that forwards to
- * {@link AbstractOIDCSSOConfiguration#isResolveAttributes(ProfileRequestContext)}.
- */
-public class ResolveAttributesPredicate extends AbstractRelyingPartyPredicate {
-
- /** {@inheritDoc} */
- public boolean test(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof AbstractOIDCSSOConfiguration) {
- return ((AbstractOIDCSSOConfiguration) pc).isResolveAttributes(input);
- } else if (pc instanceof OAuth2TokenAudienceConfiguration) {
- return ((OAuth2TokenAudienceConfiguration) pc).isResolveAttributes(input);
- }
- }
- return false;
- }
-
-}
\ No newline at end of file
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java
index 4e53f71..f15a2cc 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/oauth2/config/OAuth2TokenAudienceConfiguration.java
@@ -29,6 +29,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import com.google.common.base.Predicates;
import net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration;
+import net.shibboleth.idp.profile.config.AttributeResolvingProfileConfiguration;
import net.shibboleth.idp.profile.config.OverriddenIssuerProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
@@ -43,7 +44,7 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* to the parties intended to process them, as distinct from the clients that use them.</p>
*/
public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfileConfiguration
- implements OAuth2ProfileConfiguration, OverriddenIssuerProfileConfiguration {
+ implements OAuth2ProfileConfiguration, OverriddenIssuerProfileConfiguration, AttributeResolvingProfileConfiguration {
/** OAuth2 Token Revocation URI. */
@Nonnull @NotEmpty public static final String PROTOCOL_URI = "https://tools.ietf.org/html/rfc6749";
@@ -111,15 +112,7 @@ public class OAuth2TokenAudienceConfiguration extends AbstractConditionalProfil
issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
}
- /**
- * Get whether attributes should be resolved during the profile.
- *
- * <p>Default is true.</p>
- *
- * @param profileRequestContext current profile request context
- *
- * @return true iff attributes should be resolved
- */
+ /** {@inheritDoc} */
public boolean isResolveAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
return resolveAttributesPredicate.test(profileRequestContext);
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list