[java-identity-provider] branch main updated: IDP-1837 - Add audit fields related to proxying
Scott Cantor
cantor.2 at osu.edu
Tue Mar 22 15:13:45 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=6aa985d152ffaf2a44ac1f0796651d6603ebe4df
The following commit(s) were added to refs/heads/main by this push:
new 6aa985d15 IDP-1837 - Add audit fields related to proxying
6aa985d15 is described below
commit 6aa985d152ffaf2a44ac1f0796651d6603ebe4df
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Mar 22 11:13:41 2022 -0400
IDP-1837 - Add audit fields related to proxying
https://shibboleth.atlassian.net/browse/IDP-1837
Add three Scoping fields.
---
.../net/shibboleth/idp/conf/audit-system.xml | 72 ++++++++++++++++++++++
idp-conf/src/main/resources/conf/audit.xml | 4 ++
.../idp/saml/profile/SAMLAuditFields.java | 9 +++
.../audit/impl/AbstractScopingAuditExtractor.java | 71 +++++++++++++++++++++
.../saml/audit/impl/ProxyCountAuditExtractor.java | 60 ++++++++++++++++++
.../audit/impl/ScopingIdPListAuditExtractor.java | 66 ++++++++++++++++++++
.../impl/ScopingRequesterListAuditExtractor.java | 66 ++++++++++++++++++++
7 files changed, 348 insertions(+)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/audit-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/audit-system.xml
index eb4d025e2..be88e667d 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/audit-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/audit-system.xml
@@ -252,6 +252,42 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SCOPING_PROXY_COUNT"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.ProxyCountAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.AuthnRequest"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SCOPING_IDP_LIST"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.ScopingIdPListAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.AuthnRequest"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SCOPING_REQ_LIST"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.ScopingRequesterListAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.AuthnRequest"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
<entry>
<key>
<util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEID_FORMAT"/>
@@ -400,6 +436,42 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SCOPING_PROXY_COUNT"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.ProxyCountAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.AuthnRequest"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SCOPING_IDP_LIST"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.ScopingIdPListAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.AuthnRequest"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SCOPING_REQ_LIST"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.ScopingRequesterListAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.AuthnRequest"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
<entry>
<key>
<util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.NAMEID_FORMAT"/>
diff --git a/idp-conf/src/main/resources/conf/audit.xml b/idp-conf/src/main/resources/conf/audit.xml
index 42d82b877..3c9c408e7 100644
--- a/idp-conf/src/main/resources/conf/audit.xml
+++ b/idp-conf/src/main/resources/conf/audit.xml
@@ -29,6 +29,10 @@
<value>http://shibboleth.net/ns/profiles/mdquery</value>
</util:list>
+ <!--
+ You can freely add/change this map to map constants or frequently appearing strings into
+ shorter values in the audit log.
+ -->
<util:map id="shibboleth.AuditFieldReplacementMap">
<entry key="urn:oasis:names:tc:SAML:1.0:am:password" value="password" />
<entry key="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" value="password" />
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
index b687d47c1..37665de66 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
@@ -104,6 +104,15 @@ public final class SAMLAuditFields {
/** ForceAuthn requested field. */
@Nonnull @NotEmpty public static final String FORCE_AUTHN = "fauth";
+ /** Scoping ProxyCount field. @since 4.2.0 */
+ @Nonnull @NotEmpty public static final String SCOPING_PROXY_COUNT = "SCC";
+
+ /** Scoping IdP list field. @since 4.2.0 */
+ @Nonnull @NotEmpty public static final String SCOPING_IDP_LIST = "SCI";
+
+ /** Scoping RequesterID list field. @since 4.2.0 */
+ @Nonnull @NotEmpty public static final String SCOPING_REQ_LIST = "SCR";
+
/** Signed inbound message field. @since 4.0.0 */
@Nonnull @NotEmpty public static final String SIGNING = "XX";
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AbstractScopingAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AbstractScopingAuditExtractor.java
new file mode 100644
index 000000000..9186c43d7
--- /dev/null
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AbstractScopingAuditExtractor.java
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.core.Scoping;
+
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * Base class for {@link Function} that returns content from the {@link Scoping} element from an {@link AuthnRequest}.
+ *
+ * @param <T> type of field being extracted
+ *
+ * @since 4.2.0
+ */
+public abstract class AbstractScopingAuditExtractor<T> implements Function<ProfileRequestContext,T> {
+
+ /** Lookup strategy for message to read from. */
+ @Nonnull private final Function<ProfileRequestContext,AuthnRequest> requestLookupStrategy;
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for message
+ */
+ protected AbstractScopingAuditExtractor(@Nonnull final Function<ProfileRequestContext,AuthnRequest> strategy) {
+ requestLookupStrategy = Constraint.isNotNull(strategy, "AuthnRequest lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public T apply(@Nullable final ProfileRequestContext input) {
+ final AuthnRequest request = requestLookupStrategy.apply(input);
+ if (request != null) {
+ return doApply(request.getScoping());
+ }
+
+ return null;
+ }
+
+ /**
+ * Override point to do the extraction.
+ *
+ * @param scoping the input object
+ *
+ * @return the extracted value
+ */
+ @Nullable protected abstract T doApply(@Nullable final Scoping scoping);
+
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyCountAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyCountAuditExtractor.java
new file mode 100644
index 000000000..d6621b203
--- /dev/null
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyCountAuditExtractor.java
@@ -0,0 +1,60 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.core.Scoping;
+
+/**
+ * {@link Function} that returns {@link Scoping#getProxyCount()} from an {@link AuthnRequest}.
+ *
+ * @since 4.2.0
+ */
+public class ProxyCountAuditExtractor extends AbstractScopingAuditExtractor<Integer> {
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for message
+ */
+ public ProxyCountAuditExtractor(@Nonnull final Function<ProfileRequestContext,AuthnRequest> strategy) {
+ super(strategy);
+ }
+
+ /**
+ * Override point to do the extraction.
+ *
+ * @param scoping the input object
+ *
+ * @return the extracted value
+ */
+ @Nullable protected Integer doApply(@Nullable final Scoping scoping) {
+ if (scoping != null) {
+ return scoping.getProxyCount();
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingIdPListAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingIdPListAuditExtractor.java
new file mode 100644
index 000000000..e7ef2d775
--- /dev/null
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingIdPListAuditExtractor.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.audit.impl;
+
+import java.util.Collection;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.core.IDPEntry;
+import org.opensaml.saml.saml2.core.Scoping;
+
+/**
+ * {@link Function} that returns {@link Scoping#getIDPList()} from an {@link AuthnRequest}.
+ *
+ * @since 4.2.0
+ */
+public class ScopingIdPListAuditExtractor extends AbstractScopingAuditExtractor<Collection<String>> {
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for message
+ */
+ public ScopingIdPListAuditExtractor(@Nonnull final Function<ProfileRequestContext,AuthnRequest> strategy) {
+ super(strategy);
+ }
+
+ /**
+ * Override point to do the extraction.
+ *
+ * @param scoping the input object
+ *
+ * @return the extracted value
+ */
+ @Nullable protected Collection<String> doApply(@Nullable final Scoping scoping) {
+ if (scoping != null && scoping.getIDPList() != null) {
+ return scoping.getIDPList().getIDPEntrys().stream()
+ .map(IDPEntry::getProviderID)
+ .filter(s -> s != null)
+ .collect(Collectors.toUnmodifiableList());
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingRequesterListAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingRequesterListAuditExtractor.java
new file mode 100644
index 000000000..a74533330
--- /dev/null
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingRequesterListAuditExtractor.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.audit.impl;
+
+import java.util.Collection;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.core.RequesterID;
+import org.opensaml.saml.saml2.core.Scoping;
+
+/**
+ * {@link Function} that returns {@link Scoping#getRequesterIDs()} from an {@link AuthnRequest}.
+ *
+ * @since 4.2.0
+ */
+public class ScopingRequesterListAuditExtractor extends AbstractScopingAuditExtractor<Collection<String>> {
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for message
+ */
+ public ScopingRequesterListAuditExtractor(@Nonnull final Function<ProfileRequestContext,AuthnRequest> strategy) {
+ super(strategy);
+ }
+
+ /**
+ * Override point to do the extraction.
+ *
+ * @param scoping the input object
+ *
+ * @return the extracted value
+ */
+ @Nullable protected Collection<String> doApply(@Nullable final Scoping scoping) {
+ if (scoping != null) {
+ return scoping.getRequesterIDs().stream()
+ .map(RequesterID::getURI)
+ .filter(s -> s != null)
+ .collect(Collectors.toUnmodifiableList());
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list