[java-identity-provider] branch main updated: IDP-2057 - Support transcoders that derive SAML naming from metadata
Scott Cantor
cantor.2 at osu.edu
Tue Dec 12 14:33:49 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f5d0a58ca08d33777e42f3ecccab5dcc31e579e4
The following commit(s) were added to refs/heads/main by this push:
new f5d0a58ca IDP-2057 - Support transcoders that derive SAML naming from metadata
f5d0a58ca is described below
commit f5d0a58ca08d33777e42f3ecccab5dcc31e579e4
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Dec 12 09:33:46 2023 -0500
IDP-2057 - Support transcoders that derive SAML naming from metadata
https://shibboleth.atlassian.net/browse/IDP-2057
Add CAS support.
Wire up tag support for all transcoders.
---
.../attribute/AbstractCASAttributeTranscoder.java | 39 ++++++++++++++--
.../idp/cas/attribute/CASAttributeTranscoder.java | 14 ++++++
.../idp/conf/attribute-registry-system.xml | 54 +++++++++++++++++-----
3 files changed, 92 insertions(+), 15 deletions(-)
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/AbstractCASAttributeTranscoder.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/AbstractCASAttributeTranscoder.java
index bd0d745d8..2fdea5475 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/AbstractCASAttributeTranscoder.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/AbstractCASAttributeTranscoder.java
@@ -34,6 +34,7 @@ import net.shibboleth.idp.attribute.transcoding.AbstractAttributeTranscoder;
import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
import net.shibboleth.idp.attribute.transcoding.TranscodingRule;
import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
/**
* Base class for transcoders that support CAS attributes.
@@ -73,9 +74,7 @@ public abstract class AbstractCASAttributeTranscoder<EncodedType extends IdPAttr
log.trace("Beginning to encode attribute {}", attributeId);
- final String name = rule.getOrDefault(PROP_NAME, String.class, attributeId);
- // by construction if attribute id is nonnnul then the so if name.
- assert name != null;
+ final String name = getEncodedName(profileRequestContext, attribute, rule);
final Attribute casAttribute = new Attribute(name);
for (final IdPAttributeValue o : attribute.getValues()) {
@@ -140,6 +139,38 @@ public abstract class AbstractCASAttributeTranscoder<EncodedType extends IdPAttr
}
return buildIdPAttribute(profileRequestContext, input, rule, idpAttributeValues);
}
+
+ /**
+ * Obtain the encoded name of the CAS Attribute either from metadata or statically.
+ *
+ * <p>With CAS, there's always a name to use because it will fallback to using the attribute ID.</p>
+ *
+ * @param profileRequestContext profile request context
+ * @param attribute attribute to encode
+ * @param rule trancoding rule
+ *
+ * @return the encoded name
+ *
+ * @since 5.1.0
+ */
+ @Nonnull protected String getEncodedName(@Nullable final ProfileRequestContext profileRequestContext,
+ @Nonnull final IdPAttribute attribute, @Nonnull final TranscodingRule rule) {
+
+ // Use metadata tag to derive name of Attribute?
+ final Boolean useMetadata = rule.getOrDefault(PROP_NAME_FROM_METADATA, Boolean.class, false);
+ if (useMetadata != null && useMetadata) {
+ final String tagValue = StringSupport.trimOrNull(
+ getNameFromMetadata(profileRequestContext, attribute.getId()));
+ if (tagValue != null) {
+ return tagValue;
+ }
+ }
+
+ final String staticName = rule.getOrDefault(PROP_NAME, String.class, attribute.getId());
+ // Has to be non-null because default value is.
+ assert staticName != null;
+ return staticName;
+ }
/**
* Checks if the given value can be handled by the transcoder.
@@ -232,4 +263,4 @@ public abstract class AbstractCASAttributeTranscoder<EncodedType extends IdPAttr
}
-}
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/CASAttributeTranscoder.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/CASAttributeTranscoder.java
index 6a71addd4..f4c1c8e51 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/CASAttributeTranscoder.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/CASAttributeTranscoder.java
@@ -27,4 +27,18 @@ public interface CASAttributeTranscoder extends AttributeTranscoder<Attribute> {
/** The attribute name. */
@Nonnull @NotEmpty static final String PROP_NAME = "cas.name";
+ /**
+ * Flag to signal use of metadata to override name to encode.
+ *
+ * @since 5.1.0
+ */
+ @Nonnull @NotEmpty static final String PROP_NAME_FROM_METADATA = "cas.nameFromMetadata";
+
+ /**
+ * Name of metadata tag/attribute to check for in the event that {@link #PROP_NAME_FROM_METADATA} is used.
+ *
+ * @since 5.1.0
+ */
+ @Nonnull @NotEmpty static final String METADATA_TAG_NAME = "http://shibboleth.net/ns/attributes/naming/cas";
+
}
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-registry-system.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-registry-system.xml
index 72c127f88..5b7af53ec 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-registry-system.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/attribute-registry-system.xml
@@ -15,30 +15,62 @@
<!-- Pull in class rewrite rules. -->
<bean parent="shibboleth.RelocatedBeanFactoryPostProcessor" />
+ <bean id="SAML2MetadataNamingStrategy" parent="shibboleth.TagLookupSet"
+ p:profileMetadataLookupStrategy-ref="shibboleth.EntityDescriptorLookup.RelyingParty"
+ p:propertyName="#{T(net.shibboleth.idp.saml.attribute.transcoding.SAML2AttributeTranscoder).METADATA_TAG_NAME}"
+ p:strictNameFormat="true"
+ p:explicitPropertyName="true"
+ p:ignoreUnmappedEntityAttributes="true" />
+
<bean id="SAML2StringTranscoder"
- class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML2StringAttributeTranscoder" />
+ class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML2StringAttributeTranscoder"
+ p:nameFromMetadataLookupStrategy-ref="SAML2MetadataNamingStrategy" />
<bean id="SAML2ScopedStringTranscoder"
- class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML2ScopedStringAttributeTranscoder" />
+ class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML2ScopedStringAttributeTranscoder"
+ p:nameFromMetadataLookupStrategy-ref="SAML2MetadataNamingStrategy" />
<bean id="SAML2ByteTranscoder"
- class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML2ByteAttributeTranscoder" />
+ class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML2ByteAttributeTranscoder"
+ p:nameFromMetadataLookupStrategy-ref="SAML2MetadataNamingStrategy" />
<bean id="SAML2XMLObjectTranscoder"
- class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML2XMLObjectAttributeTranscoder" />
+ class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML2XMLObjectAttributeTranscoder"
+ p:nameFromMetadataLookupStrategy-ref="SAML2MetadataNamingStrategy" />
<bean id="SAML2DateTimeTranscoder"
- class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML2DateTimeAttributeTranscoder" />
+ class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML2DateTimeAttributeTranscoder"
+ p:nameFromMetadataLookupStrategy-ref="SAML2MetadataNamingStrategy" />
+
+ <bean id="SAML1MetadataNamingStrategy" parent="shibboleth.TagLookupSet"
+ p:profileMetadataLookupStrategy-ref="shibboleth.EntityDescriptorLookup.RelyingParty"
+ p:propertyName="#{T(net.shibboleth.idp.saml.attribute.transcoding.SAML1AttributeTranscoder).METADATA_TAG_NAME}"
+ p:strictNameFormat="true"
+ p:explicitPropertyName="true"
+ p:ignoreUnmappedEntityAttributes="true" />
<bean id="SAML1StringTranscoder"
- class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML1StringAttributeTranscoder" />
+ class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML1StringAttributeTranscoder"
+ p:nameFromMetadataLookupStrategy-ref="SAML1MetadataNamingStrategy" />
<bean id="SAML1ScopedStringTranscoder"
- class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML1ScopedStringAttributeTranscoder" />
+ class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML1ScopedStringAttributeTranscoder"
+ p:nameFromMetadataLookupStrategy-ref="SAML1MetadataNamingStrategy" />
<bean id="SAML1ByteTranscoder"
- class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML1ByteAttributeTranscoder" />
+ class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML1ByteAttributeTranscoder"
+ p:nameFromMetadataLookupStrategy-ref="SAML1MetadataNamingStrategy" />
<bean id="SAML1XMLObjectTranscoder"
- class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML1XMLObjectAttributeTranscoder" />
+ class="net.shibboleth.idp.saml.attribute.transcoding.impl.SAML1XMLObjectAttributeTranscoder"
+ p:nameFromMetadataLookupStrategy-ref="SAML1MetadataNamingStrategy" />
+
+ <bean id="CASMetadataNamingStrategy" parent="shibboleth.TagLookupSet"
+ p:profileMetadataLookupStrategy-ref="shibboleth.EntityDescriptorLookup.RelyingParty"
+ p:propertyName="#{T(net.shibboleth.idp.cas.attribute.CASAttributeTranscoder).METADATA_TAG_NAME}"
+ p:strictNameFormat="true"
+ p:explicitPropertyName="true"
+ p:ignoreUnmappedEntityAttributes="true" />
<bean id="CASStringTranscoder"
- class="net.shibboleth.idp.cas.attribute.transcoding.impl.CASStringAttributeTranscoder" />
+ class="net.shibboleth.idp.cas.attribute.transcoding.impl.CASStringAttributeTranscoder"
+ p:nameFromMetadataLookupStrategy-ref="CASMetadataNamingStrategy" />
<bean id="CASScopedStringTranscoder"
- class="net.shibboleth.idp.cas.attribute.transcoding.impl.CASScopedStringAttributeTranscoder" />
+ class="net.shibboleth.idp.cas.attribute.transcoding.impl.CASScopedStringAttributeTranscoder"
+ p:nameFromMetadataLookupStrategy-ref="CASMetadataNamingStrategy" />
<bean id="shibboleth.TranscodingRule"
class="net.shibboleth.idp.attribute.transcoding.TranscodingRule" abstract="true" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list