[java-identity-provider] branch main updated: IDP-1837 - Add audit fields related to proxying
Scott Cantor
cantor.2 at osu.edu
Tue Mar 22 16:11:32 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=8ae0f00cc330169d9417036a214997699a3f9944
The following commit(s) were added to refs/heads/main by this push:
new 8ae0f00cc IDP-1837 - Add audit fields related to proxying
8ae0f00cc is described below
commit 8ae0f00cc330169d9417036a214997699a3f9944
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Mar 22 12:11:28 2022 -0400
IDP-1837 - Add audit fields related to proxying
https://shibboleth.atlassian.net/browse/IDP-1837
ProxyRestriction condition fields.
---
.../net/shibboleth/idp/conf/audit-system.xml | 52 ++++++++++++-
.../idp/saml/profile/SAMLAuditFields.java | 6 ++
.../AbstractProxyRestrictionAuditExtractor.java | 90 ++++++++++++++++++++++
...actor.java => ProxyAudienceAuditExtractor.java} | 31 ++++----
.../saml/audit/impl/ProxyCountAuditExtractor.java | 26 +++----
.../audit/impl/ScopingIdPListAuditExtractor.java | 9 +--
...r.java => ScopingProxyCountAuditExtractor.java} | 13 +---
.../impl/ScopingRequesterListAuditExtractor.java | 9 +--
8 files changed, 178 insertions(+), 58 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/audit-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/audit-system.xml
index be88e667d..c757365cc 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/audit-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/audit-system.xml
@@ -256,7 +256,7 @@
<key>
<util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SCOPING_PROXY_COUNT"/>
</key>
- <bean class="net.shibboleth.idp.saml.audit.impl.ProxyCountAuditExtractor">
+ <bean class="net.shibboleth.idp.saml.audit.impl.ScopingProxyCountAuditExtractor">
<constructor-arg>
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.MessageLookup.AuthnRequest"
@@ -440,7 +440,7 @@
<key>
<util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.SCOPING_PROXY_COUNT"/>
</key>
- <bean class="net.shibboleth.idp.saml.audit.impl.ProxyCountAuditExtractor">
+ <bean class="net.shibboleth.idp.saml.audit.impl.ScopingProxyCountAuditExtractor">
<constructor-arg>
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.MessageLookup.AuthnRequest"
@@ -644,6 +644,30 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.PROXY_COUNT"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.ProxyCountAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.PROXY_AUDIENCE"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.ProxyAudienceAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Outbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
<entry>
<key>
<util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.ENCRYPTION"/>
@@ -779,6 +803,30 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.PROXY_COUNT"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.ProxyCountAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.PROXY_AUDIENCE"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.ProxyAudienceAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
</map>
</property>
</bean>
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
index 37665de66..5ce1c55ab 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/SAMLAuditFields.java
@@ -113,6 +113,12 @@ public final class SAMLAuditFields {
/** Scoping RequesterID list field. @since 4.2.0 */
@Nonnull @NotEmpty public static final String SCOPING_REQ_LIST = "SCR";
+ /** ProxyRestriction ProxyCount field. @since 4.2.0 */
+ @Nonnull @NotEmpty public static final String PROXY_COUNT = "PRC";
+
+ /** ProxyRestriction Audience field. @since 4.2.0 */
+ @Nonnull @NotEmpty public static final String PROXY_AUDIENCE = "PRA";
+
/** Signed inbound message field. @since 4.0.0 */
@Nonnull @NotEmpty public static final String SIGNING = "XX";
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AbstractProxyRestrictionAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AbstractProxyRestrictionAuditExtractor.java
new file mode 100644
index 000000000..f10aa134f
--- /dev/null
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AbstractProxyRestrictionAuditExtractor.java
@@ -0,0 +1,90 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.SAMLObject;
+import org.opensaml.saml.saml2.core.ArtifactResponse;
+import org.opensaml.saml.saml2.core.Assertion;
+import org.opensaml.saml.saml2.core.ProxyRestriction;
+import org.opensaml.saml.saml2.core.Response;
+
+import net.shibboleth.utilities.java.support.logic.Constraint;
+
+/**
+ * Base class for {@link Function} that returns content from the {@link ProxyRestriction} element.
+ *
+ * @param <T> type of field being extracted
+ *
+ * @since 4.2.0
+ */
+public abstract class AbstractProxyRestrictionAuditExtractor<T> implements Function<ProfileRequestContext,T> {
+
+ /** Lookup strategy for message to read from. */
+ @Nonnull private final Function<ProfileRequestContext,SAMLObject> responseLookupStrategy;
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for message
+ */
+ protected AbstractProxyRestrictionAuditExtractor(
+ @Nonnull final Function<ProfileRequestContext,SAMLObject> strategy) {
+ responseLookupStrategy = Constraint.isNotNull(strategy, "Response lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public T apply(@Nullable final ProfileRequestContext input) {
+ SAMLObject response = responseLookupStrategy.apply(input);
+ if (response != null) {
+
+ // Step down into ArtifactResponses.
+ if (response instanceof ArtifactResponse) {
+ response = ((ArtifactResponse) response).getMessage();
+ }
+
+ if (response instanceof Response) {
+ for (final Assertion assertion : ((Response) response).getAssertions()) {
+ if (assertion.getConditions() != null) {
+ final ProxyRestriction condition = assertion.getConditions().getProxyRestriction();
+ if (condition != null) {
+ return doApply(condition);
+ }
+ }
+ }
+ }
+ }
+
+ return null;
+ }
+
+ /**
+ * Override point to do the extraction.
+ *
+ * @param condition the input object
+ *
+ * @return the extracted value
+ */
+ @Nullable protected abstract T doApply(@Nullable final ProxyRestriction condition);
+
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingRequesterListAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyAudienceAuditExtractor.java
similarity index 64%
copy from idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingRequesterListAuditExtractor.java
copy to idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyAudienceAuditExtractor.java
index a74533330..fa0618703 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingRequesterListAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyAudienceAuditExtractor.java
@@ -25,38 +25,33 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.AuthnRequest;
-import org.opensaml.saml.saml2.core.RequesterID;
-import org.opensaml.saml.saml2.core.Scoping;
+import org.opensaml.saml.common.SAMLObject;
+import org.opensaml.saml.saml2.core.Audience;
+import org.opensaml.saml.saml2.core.ProxyRestriction;
/**
- * {@link Function} that returns {@link Scoping#getRequesterIDs()} from an {@link AuthnRequest}.
+ * {@link Function} that returns {@link ProxyRestriction#getAudiences()}.
*
* @since 4.2.0
*/
-public class ScopingRequesterListAuditExtractor extends AbstractScopingAuditExtractor<Collection<String>> {
+public class ProxyAudienceAuditExtractor extends AbstractProxyRestrictionAuditExtractor<Collection<String>> {
/**
* Constructor.
*
* @param strategy lookup strategy for message
*/
- public ScopingRequesterListAuditExtractor(@Nonnull final Function<ProfileRequestContext,AuthnRequest> strategy) {
+ public ProxyAudienceAuditExtractor(
+ @Nonnull final Function<ProfileRequestContext,SAMLObject> strategy) {
super(strategy);
}
- /**
- * Override point to do the extraction.
- *
- * @param scoping the input object
- *
- * @return the extracted value
- */
- @Nullable protected Collection<String> doApply(@Nullable final Scoping scoping) {
- if (scoping != null) {
- return scoping.getRequesterIDs().stream()
- .map(RequesterID::getURI)
- .filter(s -> s != null)
+ /** {@inheritDoc} */
+ @Override
+ @Nullable protected Collection<String> doApply(@Nullable final ProxyRestriction condition) {
+ if (condition != null) {
+ return condition.getAudiences().stream()
+ .map(Audience::getURI)
.collect(Collectors.toUnmodifiableList());
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyCountAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyCountAuditExtractor.java
index d6621b203..1904cba18 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyCountAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyCountAuditExtractor.java
@@ -23,35 +23,31 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.AuthnRequest;
-import org.opensaml.saml.saml2.core.Scoping;
+import org.opensaml.saml.common.SAMLObject;
+import org.opensaml.saml.saml2.core.ProxyRestriction;
/**
- * {@link Function} that returns {@link Scoping#getProxyCount()} from an {@link AuthnRequest}.
+ * {@link Function} that returns {@link ProxyRestriction#getProxyCount()}.
*
* @since 4.2.0
*/
-public class ProxyCountAuditExtractor extends AbstractScopingAuditExtractor<Integer> {
+public class ProxyCountAuditExtractor extends AbstractProxyRestrictionAuditExtractor<Integer> {
/**
* Constructor.
*
* @param strategy lookup strategy for message
*/
- public ProxyCountAuditExtractor(@Nonnull final Function<ProfileRequestContext,AuthnRequest> strategy) {
+ public ProxyCountAuditExtractor(
+ @Nonnull final Function<ProfileRequestContext,SAMLObject> strategy) {
super(strategy);
}
- /**
- * Override point to do the extraction.
- *
- * @param scoping the input object
- *
- * @return the extracted value
- */
- @Nullable protected Integer doApply(@Nullable final Scoping scoping) {
- if (scoping != null) {
- return scoping.getProxyCount();
+ /** {@inheritDoc} */
+ @Override
+ @Nullable protected Integer doApply(@Nullable final ProxyRestriction condition) {
+ if (condition != null) {
+ return condition.getProxyCount();
}
return null;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingIdPListAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingIdPListAuditExtractor.java
index e7ef2d775..c2316e744 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingIdPListAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingIdPListAuditExtractor.java
@@ -45,13 +45,8 @@ public class ScopingIdPListAuditExtractor extends AbstractScopingAuditExtractor<
super(strategy);
}
- /**
- * Override point to do the extraction.
- *
- * @param scoping the input object
- *
- * @return the extracted value
- */
+ /** {@inheritDoc} */
+ @Override
@Nullable protected Collection<String> doApply(@Nullable final Scoping scoping) {
if (scoping != null && scoping.getIDPList() != null) {
return scoping.getIDPList().getIDPEntrys().stream()
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyCountAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingProxyCountAuditExtractor.java
similarity index 82%
copy from idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyCountAuditExtractor.java
copy to idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingProxyCountAuditExtractor.java
index d6621b203..b2eb7a676 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyCountAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingProxyCountAuditExtractor.java
@@ -31,24 +31,19 @@ import org.opensaml.saml.saml2.core.Scoping;
*
* @since 4.2.0
*/
-public class ProxyCountAuditExtractor extends AbstractScopingAuditExtractor<Integer> {
+public class ScopingProxyCountAuditExtractor extends AbstractScopingAuditExtractor<Integer> {
/**
* Constructor.
*
* @param strategy lookup strategy for message
*/
- public ProxyCountAuditExtractor(@Nonnull final Function<ProfileRequestContext,AuthnRequest> strategy) {
+ public ScopingProxyCountAuditExtractor(@Nonnull final Function<ProfileRequestContext,AuthnRequest> strategy) {
super(strategy);
}
- /**
- * Override point to do the extraction.
- *
- * @param scoping the input object
- *
- * @return the extracted value
- */
+ /** {@inheritDoc} */
+ @Override
@Nullable protected Integer doApply(@Nullable final Scoping scoping) {
if (scoping != null) {
return scoping.getProxyCount();
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingRequesterListAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingRequesterListAuditExtractor.java
index a74533330..e31dae1d4 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingRequesterListAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingRequesterListAuditExtractor.java
@@ -45,13 +45,8 @@ public class ScopingRequesterListAuditExtractor extends AbstractScopingAuditExtr
super(strategy);
}
- /**
- * Override point to do the extraction.
- *
- * @param scoping the input object
- *
- * @return the extracted value
- */
+ /** {@inheritDoc} */
+ @Override
@Nullable protected Collection<String> doApply(@Nullable final Scoping scoping) {
if (scoping != null) {
return scoping.getRequesterIDs().stream()
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list