[java-sp-server] branch main updated: Add SLO profile config.
Scott Cantor
cantor.2 at osu.edu
Fri Feb 3 20:00:56 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-sp-server.
View the commit online:
http://git.shibboleth.net/view/?p=java-sp-server.git;a=commit;h=c010d5d6e17dc68036c5a7ad0425cc302354cbab
The following commit(s) were added to refs/heads/main by this push:
new c010d5d Add SLO profile config.
c010d5d is described below
commit c010d5d6e17dc68036c5a7ad0425cc302354cbab
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Feb 3 15:00:53 2023 -0500
Add SLO profile config.
---
.../config/SingleLogoutProfileConfiguration.java | 243 +++++++++++++++++++++
1 file changed, 243 insertions(+)
diff --git a/sp-saml-api/src/main/java/net/shibboleth/sp/saml2/config/SingleLogoutProfileConfiguration.java b/sp-saml-api/src/main/java/net/shibboleth/sp/saml2/config/SingleLogoutProfileConfiguration.java
new file mode 100644
index 0000000..941c70e
--- /dev/null
+++ b/sp-saml-api/src/main/java/net/shibboleth/sp/saml2/config/SingleLogoutProfileConfiguration.java
@@ -0,0 +1,243 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.saml2.config;
+
+import java.util.Collection;
+import java.util.List;
+import java.util.function.Function;
+import java.util.function.Predicate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.profile.logic.NoConfidentialityMessageChannelPredicate;
+import org.opensaml.profile.logic.NoIntegrityMessageChannelPredicate;
+import org.opensaml.saml.ext.saml2aslo.Asynchronous;
+import org.opensaml.saml.saml2.core.NameID;
+import org.opensaml.saml.saml2.core.NameIDType;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.logic.PredicateSupport;
+import net.shibboleth.shared.primitive.StringSupport;
+
+/** Configuration support for SAML 2 Single Logout. */
+public class SingleLogoutProfileConfiguration extends AbstractSAML2ArtifactConsumerProfileConfiguration {
+
+ /** ID for this profile configuration. */
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/logout";
+
+ /** Predicate used to determine if SOAP-based requests should be signed. */
+ @Nonnull private Predicate<MessageContext> signSOAPRequestsPredicate;
+
+ /** Predicate used to determine if SOAP-based requests should use client TLS. */
+ @Nonnull private Predicate<MessageContext> clientTLSSOAPRequestsPredicate;
+
+ /** Predicate used to determine whether requests should carry the {@link Asynchronous} extension. */
+ @Nonnull private Predicate<ProfileRequestContext> asynchronousPredicate;
+
+ /** Lookup function to supply qualifiedNameIDFormats property. */
+ @Nonnull private Function<ProfileRequestContext,Collection<String>> qualifiedNameIDFormatsLookupStrategy;
+
+ /** Constructor. */
+ public SingleLogoutProfileConfiguration() {
+ this(PROFILE_ID);
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param profileId unique ID for this profile
+ */
+ protected SingleLogoutProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
+ super(profileId);
+ setSignRequestsPredicate(new NoIntegrityMessageChannelPredicate());
+ setSignResponsesPredicate(new NoIntegrityMessageChannelPredicate());
+ setEncryptNameIDsPredicate(new NoConfidentialityMessageChannelPredicate());
+
+ signSOAPRequestsPredicate = new org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate();
+ clientTLSSOAPRequestsPredicate = new org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate().negate();
+
+ asynchronousPredicate = PredicateSupport.alwaysTrue();
+
+ qualifiedNameIDFormatsLookupStrategy = FunctionSupport.constant(null);
+ }
+
+ /**
+ * Get whether SOAP-based requests should be signed.
+ *
+ * @param messageContext current message context
+ *
+ * @return whether SOAP-based requests should be signed
+ *
+ * @since 4.0.0
+ */
+ public boolean isSignSOAPRequests(@Nullable final MessageContext messageContext) {
+ return signSOAPRequestsPredicate.test(messageContext);
+ }
+
+ /**
+ * Set whether SOAP-based requests should be signed.
+ *
+ * @param flag flag to set
+ *
+ * @since 4.0.0
+ */
+ public void setSignSOAPRequests(final boolean flag) {
+ signSOAPRequestsPredicate = PredicateSupport.constant(flag);
+ }
+
+ /**
+ * Set the predicate used to determine if SOAP-based requests should be signed.
+ *
+ * @param predicate the predicate
+ *
+ * @since 4.0.0
+ */
+ public void setSignSOAPRequestsPredicate(@Nonnull final Predicate<MessageContext> predicate) {
+ signSOAPRequestsPredicate = Constraint.isNotNull(predicate,
+ "Predicate used to determine SOAP-based signing cannot be null");
+ }
+
+ /**
+ * Get whether SOAP-based requests should use client TLS.
+ *
+ * @param messageContext current message context
+ *
+ * @return whether SOAP-based requests should use client TLS
+ *
+ * @since 4.0.0
+ */
+ public boolean isClientTLSSOAPRequests(@Nullable final MessageContext messageContext) {
+ return clientTLSSOAPRequestsPredicate.test(messageContext);
+ }
+
+ /**
+ * Set whether SOAP-based requests should use client TLS.
+ *
+ * @param flag flag to set
+ *
+ * @since 4.0.0
+ */
+ public void setClientTLSSOAPRequests(final boolean flag) {
+ clientTLSSOAPRequestsPredicate = PredicateSupport.constant(flag);
+ }
+
+ /**
+ * Set the predicate used to determine if SOAP-based requests should use client TLS.
+ *
+ * @param predicate the predicate
+ *
+ * @since 4.0.0
+ */
+ public void setClientTLSSOAPRequestsPredicate(@Nonnull final Predicate<MessageContext> predicate) {
+ clientTLSSOAPRequestsPredicate = Constraint.isNotNull(predicate,
+ "Predicate used to determine SOAP-based client TLS use cannot be null");
+ }
+
+ /**
+ * Get whether to include the {@link Asynchronous} extension in requests.
+ *
+ * <p>Defaults to true.</p>
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return true iff the extension should be included in requests
+ */
+ public boolean isAsynchronous(@Nullable final ProfileRequestContext profileRequestContext) {
+ return asynchronousPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to include the {@link Asynchronous} extension in requests.
+ *
+ * @param flag flag to set
+ */
+ public void setAsynchronous(final boolean flag) {
+ asynchronousPredicate = PredicateSupport.constant(flag);
+ }
+
+ /**
+ * Set a condition to determine whether to include the {@link Asynchronous} extension in requests.
+ *
+ * @param condition condition set set
+ */
+ public void setAsynchronousPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ asynchronousPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /**
+ * Get a collection of {@link NameID} Format values for which the use of the NameQualifier and
+ * SPNameQualifier attributes is defined to allow default/implicit values derived from the
+ * asserting and relying parties.
+ *
+ * <p>In the core standard, only the {@link NameIDType#PERSISTENT} and {@link NameIDType#TRANSIENT}
+ * Formats are defined in this manner. This setting identifies <strong>additional</strong> Formats
+ * that should be handled in this way.</p>
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return additional Formats for which defaulting of qualifiers is permissable
+ */
+ @Nonnull @NonnullElements @NotLive public Collection<String> getQualifiedNameIDFormats(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ final Collection<String> formats = qualifiedNameIDFormatsLookupStrategy.apply(profileRequestContext);
+ if (formats != null) {
+ return CollectionSupport.copyToList(formats);
+ }
+ return CollectionSupport.emptyList();
+ }
+
+ /**
+ * Set a collection of {@link NameID} Format values for which the use of the NameQualifier and
+ * SPNameQualifier attributes is defined to allow default/implicit values derived from the
+ * asserting and relying parties.
+ *
+ * <p>In the core standard, only the {@link NameIDType#PERSISTENT} and {@link NameIDType#TRANSIENT}
+ * Formats are defined in this manner. This setting identifies <strong>additional</strong> Formats
+ * that should be handled in this way.</p>
+ *
+ * @param formats additional Formats for which defaulting of qualifiers is permissable
+ */
+ public void setQualifiedNameIDFormats(@Nullable @NonnullElements final Collection<String> formats) {
+ if (formats == null || formats.isEmpty()) {
+ qualifiedNameIDFormatsLookupStrategy = FunctionSupport.constant(null);
+ } else {
+ qualifiedNameIDFormatsLookupStrategy =
+ FunctionSupport.constant(List.copyOf(StringSupport.normalizeStringCollection(formats)));
+ }
+ }
+
+ /**
+ * Set a lookup strategy for the Format values for which the use of the NameQualifier and SPNameQualifier
+ * attributes is defined to allow default/implicit values derived from the asserting and relying parties.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setQualifiedNameIDFormatsLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
+ qualifiedNameIDFormatsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list