[java-opensaml] branch main updated: OSJ-384: HTTP client changes to allow for preemptive basic auth
Brent Putman
putmanb at georgetown.edu
Tue Aug 1 06:31:22 UTC 2023
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch main
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=1233a330c78f73598d8c04ba15514239bdd7b6ca
The following commit(s) were added to refs/heads/main by this push:
new 1233a330c OSJ-384: HTTP client changes to allow for preemptive basic auth
1233a330c is described below
commit 1233a330c78f73598d8c04ba15514239bdd7b6ca
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Tue Aug 1 02:12:38 2023 -0400
OSJ-384: HTTP client changes to allow for preemptive basic auth
Add support for preemptive basic auth map to
HttpClientSecurityConfiguration and -Resolver.
---
.../HttpClientSecurityConfiguration.java | 15 +++++++++
.../impl/BasicHttpClientSecurityConfiguration.java | 39 ++++++++++++++++++++++
.../BasicHttpClientSecurityParametersResolver.java | 3 ++
...icHttpClientSecurityParametersResolverTest.java | 8 +++++
4 files changed, 65 insertions(+)
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java
index 9a4bccbb5..e16c89502 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java
@@ -18,14 +18,20 @@
package org.opensaml.security.httpclient;
import java.util.List;
+import java.util.Map;
import javax.annotation.Nullable;
import javax.net.ssl.HostnameVerifier;
import org.apache.hc.client5.http.auth.CredentialsProvider;
+import org.apache.hc.client5.http.auth.UsernamePasswordCredentials;
+import org.apache.hc.core5.http.HttpHost;
import org.opensaml.security.trust.TrustEngine;
import org.opensaml.security.x509.X509Credential;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+
/**
* The security configuration information to use when performing HTTP client requests.
*/
@@ -38,6 +44,15 @@ public interface HttpClientSecurityConfiguration {
*/
@Nullable CredentialsProvider getCredentialsProvider();
+ /**
+ * Get the map of rules for preemptive basic authentication using the supplied hosts and credentials.
+ *
+ * @return basic-auth rule map or null
+ *
+ * @since 5.0.0
+ */
+ @Nullable @Unmodifiable @NotLive Map<HttpHost,UsernamePasswordCredentials> getPreemptiveBasicAuthMap();
+
/**
* Sets the optional trust engine used in evaluating server TLS credentials.
*
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java
index bdb071c1e..8c6b0fca5 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java
@@ -19,6 +19,7 @@ package org.opensaml.security.httpclient.impl;
import java.util.Collection;
import java.util.List;
+import java.util.Map;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -28,10 +29,16 @@ import org.apache.hc.client5.http.auth.AuthScope;
import org.apache.hc.client5.http.auth.CredentialsProvider;
import org.apache.hc.client5.http.auth.UsernamePasswordCredentials;
import org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider;
+import org.apache.hc.client5.http.protocol.HttpClientContext;
+import org.apache.hc.core5.http.HttpHost;
import org.opensaml.security.httpclient.HttpClientSecurityConfiguration;
+import org.opensaml.security.httpclient.HttpClientSecurityParameters;
+import org.opensaml.security.httpclient.HttpClientSecuritySupport;
import org.opensaml.security.trust.TrustEngine;
import org.opensaml.security.x509.X509Credential;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.primitive.StringSupport;
@@ -43,6 +50,9 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
/** HttpClient credentials provider. */
@Nullable private CredentialsProvider credentialsProvider;
+ /** Map of host specifications to basic-auth credentials to be applied preemptively. */
+ @Nullable private Map<HttpHost,UsernamePasswordCredentials> preemptiveBasicAuthMap;
+
/** Optional trust engine used in evaluating server TLS credentials. */
@Nullable private TrustEngine<? super X509Credential> tlsTrustEngine;
@@ -85,6 +95,35 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
return this;
}
+ /**
+ * Get the map of rules for preemptive basic authentication using the supplied hosts and credentials.
+ *
+ * @return basic-auth rule map or null
+ *
+ * @since 5.0.0
+ */
+ @Nullable @Unmodifiable @NotLive public Map<HttpHost,UsernamePasswordCredentials> getPreemptiveBasicAuthMap() {
+ return preemptiveBasicAuthMap;
+ }
+
+ /**
+ * Install a map of rules for preemptive basic authentication using the supplied hosts and credentials.
+ *
+ * <p>Use of this feature requires that the eventual {@link HttpClientContext} used be built using
+ * {@link HttpClientSecuritySupport#buildHttpClientContext(HttpClientSecurityParameters)}.</p>
+ *
+ * @param map preemptive basic-auth map
+ *
+ * @return this object
+ *
+ * @since 5.0.0
+ */
+ @Nonnull public BasicHttpClientSecurityConfiguration setPreemptiveBasicAuthMap(
+ @Nullable final Map<HttpHost,UsernamePasswordCredentials> map) {
+ preemptiveBasicAuthMap = map != null ? CollectionSupport.copyToMap(map) : null;
+ return this;
+ }
+
/**
* A convenience method to set a (single) username and password used for BASIC authentication.
* To disable BASIC authentication pass null for the credentials instance.
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
index 0cbd339f6..391233d9c 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
@@ -107,6 +107,8 @@ public class BasicHttpClientSecurityParametersResolver implements HttpClientSecu
config.getClientTLSCredential()));
params.setCredentialsProvider(ObjectSupport.firstNonNull(params.getCredentialsProvider(),
config.getCredentialsProvider()));
+ params.setPreemptiveBasicAuthMap(ObjectSupport.firstNonNull(params.getPreemptiveBasicAuthMap(),
+ config.getPreemptiveBasicAuthMap()));
params.setHostnameVerifier(ObjectSupport.firstNonNull(params.getHostnameVerifier(),
config.getHostnameVerifier()));
params.setTLSCipherSuites(ObjectSupport.firstNonNull(params.getTLSCipherSuites(),
@@ -164,6 +166,7 @@ public class BasicHttpClientSecurityParametersResolver implements HttpClientSecu
log.debug("\tAuthCache: {}", params.getAuthCache() != null ? "present" : "null");
log.debug("\tCredentialsProvider: {}", params.getCredentialsProvider() != null ? "present" : "null");
+ log.debug("\tPreEmptive Basic Auth Map: {}", params.getPreemptiveBasicAuthMap());
}
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
index 4d4db0cfc..9d3308422 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
@@ -25,8 +25,10 @@ import java.security.cert.CertificateException;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.apache.hc.client5.http.auth.UsernamePasswordCredentials;
import org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider;
import org.apache.hc.client5.http.ssl.DefaultHostnameVerifier;
+import org.apache.hc.core5.http.HttpHost;
import org.opensaml.security.SecurityException;
import org.opensaml.security.credential.CredentialSupport;
import org.opensaml.security.crypto.KeySupport;
@@ -79,6 +81,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
Assert.assertNull(params.getAuthCache());
Assert.assertNotNull(params.getClientTLSCredential());
Assert.assertNotNull(params.getCredentialsProvider());
+ Assert.assertNotNull(params.getPreemptiveBasicAuthMap());
Assert.assertNotNull(params.getHostnameVerifier());
Assert.assertNotNull(params.getTLSCipherSuites());
Assert.assertNull(params.getTLSCriteriaSet());
@@ -98,6 +101,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
Assert.assertNull(params.getAuthCache());
Assert.assertNull(params.getClientTLSCredential());
Assert.assertNull(params.getCredentialsProvider());
+ Assert.assertNull(params.getPreemptiveBasicAuthMap());
Assert.assertNull(params.getHostnameVerifier());
Assert.assertNull(params.getTLSCipherSuites());
Assert.assertNull(params.getTLSCriteriaSet());
@@ -122,6 +126,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
Assert.assertNull(params.getAuthCache());
Assert.assertNotNull(params.getClientTLSCredential());
Assert.assertNotNull(params.getCredentialsProvider());
+ Assert.assertNotNull(params.getPreemptiveBasicAuthMap());
Assert.assertNotNull(params.getHostnameVerifier());
Assert.assertNotNull(params.getTLSCipherSuites());
Assert.assertNull(params.getTLSCriteriaSet());
@@ -140,6 +145,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
Assert.assertNull(params.getAuthCache());
Assert.assertNotNull(params.getClientTLSCredential());
Assert.assertNotNull(params.getCredentialsProvider());
+ Assert.assertNotNull(params.getPreemptiveBasicAuthMap());
Assert.assertNotNull(params.getHostnameVerifier());
Assert.assertNotNull(params.getTLSCipherSuites());
Assert.assertNull(params.getTLSCriteriaSet());
@@ -158,6 +164,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
Assert.assertNull(params.getAuthCache());
Assert.assertNotNull(params.getClientTLSCredential());
Assert.assertNotNull(params.getCredentialsProvider());
+ Assert.assertNotNull(params.getPreemptiveBasicAuthMap());
Assert.assertNotNull(params.getHostnameVerifier());
Assert.assertNotNull(params.getTLSCipherSuites());
Assert.assertNull(params.getTLSCriteriaSet());
@@ -232,6 +239,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
BasicHttpClientSecurityConfiguration config = new BasicHttpClientSecurityConfiguration();
config.setClientTLSCredential(x509Credential);
config.setCredentialsProvider(new BasicCredentialsProvider());
+ config.setPreemptiveBasicAuthMap(CollectionSupport.singletonMap(new HttpHost("test"), new UsernamePasswordCredentials("test", "test".toCharArray())));
config.setHostnameVerifier(new DefaultHostnameVerifier());
config.setTLSCipherSuites(CollectionSupport.singletonList("test"));
config.setTLSProtocols(CollectionSupport.singletonList("test"));
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list