[java-shib-attribute] branch main updated: IDP-2154 - Investigate MDDriven tags on EntitiesDescriptor

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-shib-attribute.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-attribute.git;a=commit;h=aee89b5761c445a65a28b0929eef5f5cba8c661b

The following commit(s) were added to refs/heads/main by this push:
     new aee89b576 IDP-2154 - Investigate MDDriven tags on EntitiesDescriptor
aee89b576 is described below

commit aee89b5761c445a65a28b0929eef5f5cba8c661b
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Aug 14 10:44:47 2023 -0400

    IDP-2154 - Investigate MDDriven tags on EntitiesDescriptor
    
    https://shibboleth.atlassian.net/browse/IDP-2154
    
    Data connector was not processing the parent extensions.
---
 .../impl/EntityAttributesDataConnector.java        | 63 ++++++++++++++--------
 1 file changed, 41 insertions(+), 22 deletions(-)

diff --git a/shib-saml-attribute-impl/src/main/java/net/shibboleth/idp/saml/attribute/resolver/impl/EntityAttributesDataConnector.java b/shib-saml-attribute-impl/src/main/java/net/shibboleth/idp/saml/attribute/resolver/impl/EntityAttributesDataConnector.java
index 3e3ee3294..91d6c6753 100644
--- a/shib-saml-attribute-impl/src/main/java/net/shibboleth/idp/saml/attribute/resolver/impl/EntityAttributesDataConnector.java
+++ b/shib-saml-attribute-impl/src/main/java/net/shibboleth/idp/saml/attribute/resolver/impl/EntityAttributesDataConnector.java
@@ -23,12 +23,14 @@ import java.util.function.Function;
 import javax.annotation.Nonnull;
 import javax.annotation.concurrent.ThreadSafe;
 
+import org.opensaml.core.xml.XMLObject;
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
 import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
 import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
 import org.opensaml.saml.ext.saml2mdattr.EntityAttributes;
+import org.opensaml.saml.saml2.metadata.EntitiesDescriptor;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
 import org.slf4j.Logger;
 
@@ -94,38 +96,55 @@ public class EntityAttributesDataConnector extends AbstractDataConnector {
             log.debug("Specified metadata source was absent.");
             return CollectionSupport.emptyMap();
         }
+
+        final Map<String,IdPAttribute> results = new HashMap<>();
+
+        try {
+            resolveMappedTags(entity, results);
+        } catch (final CloneNotSupportedException e) {
+            throw new ResolutionException(e);
+        }
         
-        final List<AttributesMapContainer> containerList = entity.getObjectMetadata().get(AttributesMapContainer.class);
+        XMLObject parent = entity.getParent();
+        while (parent instanceof EntitiesDescriptor entities) {
+            try {
+                resolveMappedTags(entities, results);
+            } catch (final CloneNotSupportedException e) {
+                throw new ResolutionException(e);
+            }
+            parent = parent.getParent();
+        }
+
+        if (results.isEmpty()) {
+            log.trace("{} No entity attributes resolved", getLogPrefix());
+            return CollectionSupport.emptyMap();
+        }
+        
+        log.trace("{} Resolved attributes: {}", getLogPrefix(), results);
+        return results;
+    }
+    
+    private void resolveMappedTags(@Nonnull final XMLObject parent, @Nonnull final Map<String,IdPAttribute> results)
+            throws CloneNotSupportedException {
+        final List<AttributesMapContainer> containerList = parent.getObjectMetadata().get(AttributesMapContainer.class);
         if (containerList != null && !containerList.isEmpty()) {
             final AttributesMapContainer container = containerList.get(0);
             final Multimap<String,IdPAttribute> tags = container.get();
             if (!tags.isEmpty()) {
-                final Map<String,IdPAttribute> results = new HashMap<>();
-
                 for (final IdPAttribute attribute : tags.values()) {
-                    try {
-                        if (results.containsKey(attribute.getId())) {
-                            final IdPAttribute existing = results.get(attribute.getId());
-                            final List<IdPAttributeValue> union = new ArrayList<>(existing.getValues());
-                            union.addAll(attribute.getValues());
-                            existing.setValues(union);
-                        } else {
-                            // We have to clone because of the other branch of this conditional,
-                            // we might need to mutate the values by combining them with a leter set.
-                            results.put(attribute.getId(), attribute.clone());
-                        }
-                    } catch(final CloneNotSupportedException e) {
-                        throw new ResolutionException(e);
+                    if (results.containsKey(attribute.getId())) {
+                        final IdPAttribute existing = results.get(attribute.getId());
+                        final List<IdPAttributeValue> union = new ArrayList<>(existing.getValues());
+                        union.addAll(attribute.getValues());
+                        existing.setValues(union);
+                    } else {
+                        // We have to clone because of the other branch of this conditional,
+                        // we might need to mutate the values by combining them with a leter set.
+                        results.put(attribute.getId(), attribute.clone());
                     }
                 }
-                
-                log.trace("{} Resolved attributes: {}", getLogPrefix(), results);
-                return results;
             }
         }
-        
-        log.trace("{} No entity attributes resolved", getLogPrefix());
-        return CollectionSupport.emptyMap();
     }
     
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.