[java-identity-provider] 06/06: IDP-2069 Null handling
Rod Widdowson
rdw at steadingsoftware.com
Fri Feb 10 13:50:23 UTC 2023
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=301c9018728ca6b702b1d210ffc4caae059b4cb5
commit 301c9018728ca6b702b1d210ffc4caae059b4cb5
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Fri Feb 10 11:29:41 2023 +0000
IDP-2069 Null handling
https://shibboleth.atlassian.net/browse/IDP-2069
Start to clean idp-cas-impl. Work still ongoing.
---
.../impl/CASScopedStringAttributeTranscoder.java | 8 ++--
.../impl/AbstractOutgoingSamlMessageAction.java | 2 +-
.../impl/BuildAuthenticationContextAction.java | 7 +++-
.../idp/cas/flow/impl/BuildProxyChainAction.java | 4 +-
.../flow/impl/BuildRelyingPartyContextAction.java | 6 +--
.../flow/impl/BuildSAMLMetadataContextAction.java | 12 ++++--
.../flow/impl/CheckProxyAuthorizationAction.java | 6 ++-
.../idp/cas/flow/impl/GrantProxyTicketAction.java | 32 +++++++++------
.../cas/flow/impl/GrantServiceTicketAction.java | 47 +++++++++++++---------
.../idp/cas/flow/impl/InitializeLoginAction.java | 3 +-
.../idp/cas/flow/impl/InitializeProxyAction.java | 3 +-
.../cas/flow/impl/InitializeValidateAction.java | 3 +-
.../cas/flow/impl/PopulateProtocolErrorAction.java | 3 +-
.../PrepareTicketValidationResponseAction.java | 22 ++++++----
.../cas/flow/impl/ProcessSamlMessageAction.java | 16 +++++---
.../flow/impl/PublishProtocolMessageAction.java | 3 +-
.../impl/UpdateIdPSessionWithSPSessionAction.java | 11 +++--
.../cas/flow/impl/ValidateProxyCallbackAction.java | 22 ++++++----
18 files changed, 135 insertions(+), 75 deletions(-)
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/attribute/transcoding/impl/CASScopedStringAttributeTranscoder.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/attribute/transcoding/impl/CASScopedStringAttributeTranscoder.java
index 5dcb61ef8..d17de8334 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/attribute/transcoding/impl/CASScopedStringAttributeTranscoder.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/attribute/transcoding/impl/CASScopedStringAttributeTranscoder.java
@@ -71,14 +71,16 @@ public class CASScopedStringAttributeTranscoder extends AbstractCASAttributeTran
}
final String scopeDelimiter = rule.getOrDefault(PROP_SCOPE_DELIMITER, String.class, "@");
+ assert scopeDelimiter != null;
final int offset = value.indexOf(scopeDelimiter);
if (offset < 0) {
log.warn("Ignoring value with no scope delimiter ({})", scopeDelimiter);
return null;
}
-
- return ScopedStringAttributeValue.valueOf(value.substring(0, offset),
- value.substring(offset + scopeDelimiter.length()));
+ final String valuePart = value.substring(0, offset);
+ final String scopePart = value.substring(offset + scopeDelimiter.length());
+ assert scopePart != null;
+ return ScopedStringAttributeValue.valueOf(valuePart, scopePart);
}
}
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractOutgoingSamlMessageAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractOutgoingSamlMessageAction.java
index 5f91830dc..c1320047b 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractOutgoingSamlMessageAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractOutgoingSamlMessageAction.java
@@ -96,7 +96,7 @@ public abstract class AbstractOutgoingSamlMessageAction extends
*
* @return SAML object
*/
- @Nonnull protected static <T extends SAMLObject> T newSAMLObject(final Class<T> type, final QName elementName) {
+ @Nonnull protected static <T extends SAMLObject> T newSAMLObject(final Class<T> type, @Nonnull final QName elementName) {
final SAMLObjectBuilder<T> builder = (SAMLObjectBuilder<T>) XMLObjectProviderRegistrySupport.getBuilderFactory()
.<T> getBuilderOrThrow(elementName);
return builder.buildObject();
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildAuthenticationContextAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildAuthenticationContextAction.java
index aa62f965a..65ca4e19e 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildAuthenticationContextAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildAuthenticationContextAction.java
@@ -69,7 +69,10 @@ public class BuildAuthenticationContextAction
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final AuthenticationContext ac = new AuthenticationContext();
- ac.setForceAuthn(request.isRenew());
+ final ServiceTicketRequest req = request;
+ assert req != null;
+
+ ac.setForceAuthn(req.isRenew());
final LoginConfiguration config = configLookupFunction.apply(profileRequestContext);
@@ -80,7 +83,7 @@ public class BuildAuthenticationContextAction
}
if (!ac.isForceAuthn()) {
- ac.setIsPassive(request.isGateway());
+ ac.setIsPassive(req.isGateway());
}
if (config != null) {
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildProxyChainAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildProxyChainAction.java
index 890f252ae..6f468bb93 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildProxyChainAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildProxyChainAction.java
@@ -91,11 +91,12 @@ public class BuildProxyChainAction
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!(ticket instanceof ProxyTicket)) {
+ if (ticket == null || !(ticket instanceof ProxyTicket)) {
ActionSupport.buildEvent(profileRequestContext, ProtocolError.InvalidTicketType.event(this));
return;
}
final ProxyTicket pt = (ProxyTicket) ticket;
+ assert pt != null;
ProxyGrantingTicket pgt;
String pgtId = pt.getPgtId();
do {
@@ -105,6 +106,7 @@ public class BuildProxyChainAction
ActionSupport.buildEvent(profileRequestContext, ProtocolError.BrokenProxyChain.event(this));
return;
}
+ assert response != null;
response.addProxy(pgt.getProxyCallbackUrl());
pgtId = pgt.getParentId();
} while (pgtId != null);
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildRelyingPartyContextAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildRelyingPartyContextAction.java
index b937ebb12..441cd94fd 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildRelyingPartyContextAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildRelyingPartyContextAction.java
@@ -17,7 +17,6 @@
package net.shibboleth.idp.cas.flow.impl;
-import java.util.Arrays;
import java.util.List;
import javax.annotation.Nonnull;
@@ -37,6 +36,7 @@ import net.shibboleth.idp.cas.service.ServiceRegistry;
import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -70,7 +70,7 @@ public class BuildRelyingPartyContextAction<RequestType,ResponseType>
* @param registries One or more service registries to query for CAS services.
*/
public BuildRelyingPartyContextAction(@Nonnull @NotEmpty final ServiceRegistry ... registries) {
- serviceRegistries = Arrays.asList(Constraint.isNotEmpty(registries, "Service registries cannot be null"));
+ serviceRegistries = CollectionSupport.listOf(Constraint.isNotEmpty(registries, "Service registries cannot be null"));
}
@Override
@@ -135,7 +135,7 @@ public class BuildRelyingPartyContextAction<RequestType,ResponseType>
*
* @return the result of the lookup or null
*/
- @Nullable private Service query(final String serviceURL) {
+ @Nullable private Service query(@Nonnull final String serviceURL) {
for (final ServiceRegistry registry : serviceRegistries) {
log.debug("Querying {} for CAS service URL {}", registry.getClass().getName(), serviceURL);
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSAMLMetadataContextAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSAMLMetadataContextAction.java
index efa6749d8..d99750847 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSAMLMetadataContextAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSAMLMetadataContextAction.java
@@ -96,16 +96,20 @@ public class BuildSAMLMetadataContextAction<RequestType,ResponseType>
protected void doExecute(final @Nonnull ProfileRequestContext profileRequestContext) {
final SAMLMetadataContext mdCtx = new SAMLMetadataContext();
- final EntityDescriptor entity = service.getEntityDescriptor() != null
- ? service.getEntityDescriptor()
- : new ServiceEntityDescriptor(service);
+ final Service svc = service;
+ assert svc != null;
+ final EntityDescriptor entity = svc.getEntityDescriptor() != null
+ ? svc.getEntityDescriptor()
+ : new ServiceEntityDescriptor(svc);
mdCtx.setEntityDescriptor(entity);
- mdCtx.setRoleDescriptor(service.getRoleDescriptor());
+ mdCtx.setRoleDescriptor(svc.getRoleDescriptor());
if (relyingPartyIdFromMetadata) {
+ assert rpCtx != null;
rpCtx.setRelyingPartyId(entity.getEntityID());
}
+ assert rpCtx != null;
rpCtx.setRelyingPartyIdContextTree(mdCtx);
}
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/CheckProxyAuthorizationAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/CheckProxyAuthorizationAction.java
index cfbe85049..db6e82f29 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/CheckProxyAuthorizationAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/CheckProxyAuthorizationAction.java
@@ -71,8 +71,10 @@ public class CheckProxyAuthorizationAction<RequestType,ResponseType>
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!service.isAuthorizedToProxy()) {
- log.info("{} Service '{}' is not authorized to proxy", getLogPrefix(), service.getName());
+ final Service svc = service;
+ assert svc != null;
+ if (!svc.isAuthorizedToProxy()) {
+ log.info("{} Service '{}' is not authorized to proxy", getLogPrefix(), svc.getName());
ActionSupport.buildEvent(profileRequestContext, ProtocolError.ProxyNotAuthorized.event(this));
}
}
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantProxyTicketAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantProxyTicketAction.java
index 347d94221..b2730f369 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantProxyTicketAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantProxyTicketAction.java
@@ -48,6 +48,7 @@ import net.shibboleth.idp.session.SessionException;
import net.shibboleth.idp.session.SessionResolver;
import net.shibboleth.idp.session.criterion.SessionIdCriterion;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -85,7 +86,7 @@ public class GrantProxyTicketAction extends AbstractCASProtocolAction<ProxyTicke
@Nullable private SecurityConfiguration securityConfig;
/** CAS ticket. */
- @Nullable private ProxyGrantingTicket pgt;
+ @Nullable private ProxyGrantingTicket proxyGrantingTicket;
/** CAS request. */
@Nullable private ProxyTicketRequest request;
@@ -101,7 +102,7 @@ public class GrantProxyTicketAction extends AbstractCASProtocolAction<ProxyTicke
casTicketService = Constraint.isNotNull(ticketService, "TicketService cannot be null");
sessionResolver = Constraint.isNotNull(resolver, "SessionResolver cannot be null");
- validateIdPSessionPredicate = Predicates.alwaysFalse();
+ validateIdPSessionPredicate = PredicateSupport.alwaysFalse();
configLookupFunction = new ConfigLookupFunction<>(ProxyConfiguration.class);
}
@@ -126,13 +127,13 @@ public class GrantProxyTicketAction extends AbstractCASProtocolAction<ProxyTicke
return false;
}
- proxyConfig = configLookupFunction.apply(profileRequestContext);
- if (proxyConfig == null) {
+ final ProxyConfiguration pCfg = proxyConfig = configLookupFunction.apply(profileRequestContext);
+ if (pCfg == null) {
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
return false;
}
- securityConfig = proxyConfig.getSecurityConfiguration(profileRequestContext);
+ securityConfig = pCfg.getSecurityConfiguration(profileRequestContext);
if (securityConfig == null) {
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
return false;
@@ -140,7 +141,7 @@ public class GrantProxyTicketAction extends AbstractCASProtocolAction<ProxyTicke
try {
request = getCASRequest(profileRequestContext);
- pgt = (ProxyGrantingTicket) getCASTicket(profileRequestContext);
+ proxyGrantingTicket = (ProxyGrantingTicket) getCASTicket(profileRequestContext);
} catch (final EventException e) {
ActionSupport.buildEvent(profileRequestContext, e.getEventID());
return false;
@@ -152,6 +153,8 @@ public class GrantProxyTicketAction extends AbstractCASProtocolAction<ProxyTicke
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ ProxyGrantingTicket pgt = proxyGrantingTicket;
+ assert pgt != null;
if (pgt.getExpirationInstant().isBefore(Instant.now())) {
ActionSupport.buildEvent(profileRequestContext, ProtocolError.TicketExpired.event(this));
return;
@@ -161,7 +164,8 @@ public class GrantProxyTicketAction extends AbstractCASProtocolAction<ProxyTicke
IdPSession session = null;
try {
log.debug("{} Attempting to retrieve session {}", getLogPrefix(), pgt.getSessionId());
- session = sessionResolver.resolveSingle(new CriteriaSet(new SessionIdCriterion(pgt.getSessionId())));
+ session = sessionResolver.resolveSingle(new CriteriaSet(new SessionIdCriterion(
+ Constraint.isNotNull(pgt.getSessionId(), "ProxyGrantingTicket session id was null"))));
} catch (final ResolverException e) {
log.warn("{} IdPSession resolution error: {}", getLogPrefix(), e);
}
@@ -183,13 +187,17 @@ public class GrantProxyTicketAction extends AbstractCASProtocolAction<ProxyTicke
}
}
final ProxyTicket pt;
+ final ProxyTicketRequest ptr = request;
+ final ProxyConfiguration pCfg = proxyConfig;
+ final SecurityConfiguration sCfg = securityConfig;
+ assert ptr != null && pCfg != null && sCfg != null;
try {
- log.debug("{} Granting proxy ticket for {}", getLogPrefix(), request.getTargetService());
+ log.debug("{} Granting proxy ticket for {}", getLogPrefix(), ptr.getTargetService());
pt = casTicketService.createProxyTicket(
- securityConfig.getIdGenerator().generateIdentifier(),
- Instant.now().plus(proxyConfig.getTicketValidityPeriod(profileRequestContext)),
+ sCfg.getIdGenerator().generateIdentifier(),
+ Instant.now().plus(pCfg.getTicketValidityPeriod(profileRequestContext)),
pgt,
- request.getTargetService());
+ ptr.getTargetService());
} catch (final RuntimeException e) {
log.error("Failed granting proxy ticket due to error.", e);
ActionSupport.buildEvent(profileRequestContext, ProtocolError.TicketCreationError.event(this));
@@ -203,7 +211,7 @@ public class GrantProxyTicketAction extends AbstractCASProtocolAction<ProxyTicke
return;
}
- log.info("{} Granted proxy ticket for {}", getLogPrefix(), request.getTargetService());
+ log.info("{} Granted proxy ticket for {}", getLogPrefix(), ptr.getTargetService());
}
}
\ No newline at end of file
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java
index 155c8eb13..a31b18be4 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java
@@ -144,13 +144,13 @@ public class GrantServiceTicketAction extends AbstractCASProtocolAction<ServiceT
return false;
}
- loginConfig = configLookupFunction.apply(profileRequestContext);
- if (loginConfig == null) {
+ final LoginConfiguration lCfg = loginConfig= configLookupFunction.apply(profileRequestContext);
+ if (lCfg == null) {
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
return false;
}
- securityConfig = loginConfig.getSecurityConfiguration(profileRequestContext);
+ securityConfig = lCfg.getSecurityConfiguration(profileRequestContext);
if (securityConfig == null) {
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
return false;
@@ -186,13 +186,13 @@ public class GrantServiceTicketAction extends AbstractCASProtocolAction<ServiceT
return false;
}
- if (loginConfig.getPostAuthenticationFlows(profileRequestContext).contains("attribute-release")) {
- attributeCtx = attributeContextLookupStrategy.apply(profileRequestContext);
- if (attributeCtx != null) {
- storeConsent = attributeCtx.isConsented() || loginConfig.isStoreConsentInTickets(profileRequestContext);
+ if (lCfg.getPostAuthenticationFlows(profileRequestContext).contains("attribute-release")) {
+ AttributeContext aCtx = attributeCtx = attributeContextLookupStrategy.apply(profileRequestContext);
+ if (aCtx != null) {
+ storeConsent = aCtx.isConsented() || lCfg.isStoreConsentInTickets(profileRequestContext);
if (storeConsent) {
log.debug("{} Storing consented attribute IDs into ticket: {}", getLogPrefix(),
- attributeCtx.getIdPAttributes().keySet());
+ aCtx.getIdPAttributes().keySet());
}
}
}
@@ -204,32 +204,40 @@ public class GrantServiceTicketAction extends AbstractCASProtocolAction<ServiceT
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final ServiceTicket ticket;
+ final ServiceTicketRequest stReq = request;
+ final AuthenticationResult aRes = authnResult;
+ final LoginConfiguration lCfg = loginConfig;
+ assert stReq != null && aRes != null && lCfg != null;
+
try {
- log.debug("{} Granting service ticket for {}", getLogPrefix(), request.getService());
+ log.debug("{} Granting service ticket for {}", getLogPrefix(), stReq.getService());
+ assert session != null;
final TicketState state = new TicketState(
- session.getId(),
+ Constraint.isNotNull(session.getId(), "Session ID was non null"),
getPrincipalName(profileRequestContext),
- authnResult.getAuthenticationInstant(),
- authnResult.getAuthenticationFlowId());
+ aRes.getAuthenticationInstant(),
+ aRes.getAuthenticationFlowId());
if (storeConsent) {
+ assert attributeCtx != null;
state.setConsentedAttributeIds(attributeCtx.getIdPAttributes().keySet());
}
+ assert securityConfig != null;
ticket = casTicketService.createServiceTicket(
securityConfig.getIdGenerator().generateIdentifier(),
- Instant.now().plus(loginConfig.getTicketValidityPeriod(profileRequestContext)),
- request.getService(),
+ Instant.now().plus(lCfg.getTicketValidityPeriod(profileRequestContext)),
+ stReq.getService(),
state,
- request.isRenew());
+ stReq.isRenew());
} catch (final RuntimeException e) {
log.error("{} Failed granting service ticket due to error.", getLogPrefix(), e);
ActionSupport.buildEvent(profileRequestContext, ProtocolError.TicketCreationError.event(this));
return;
}
- final ServiceTicketResponse response = new ServiceTicketResponse(request.getService(), ticket.getId());
- if (request.isSAML()) {
+ final ServiceTicketResponse response = new ServiceTicketResponse(stReq.getService(), ticket.getId());
+ if (stReq.isSAML()) {
response.setSaml(true);
}
@@ -240,7 +248,7 @@ public class GrantServiceTicketAction extends AbstractCASProtocolAction<ServiceT
return;
}
- log.info("{} Granted service ticket for {}", getLogPrefix(), request.getService());
+ log.info("{} Granted service ticket for {}", getLogPrefix(), stReq.getService());
}
/**
@@ -278,7 +286,8 @@ public class GrantServiceTicketAction extends AbstractCASProtocolAction<ServiceT
*/
@Nullable private AuthenticationResult getLatestAuthenticationResult() {
AuthenticationResult latest = null;
-
+
+ assert session != null;
for (final AuthenticationResult result : session.getAuthenticationResults()) {
if (latest == null || result.getAuthenticationInstant().isAfter(latest.getAuthenticationInstant())) {
latest = result;
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeLoginAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeLoginAction.java
index 8d3aa1b69..c97b6f047 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeLoginAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeLoginAction.java
@@ -18,6 +18,7 @@
package net.shibboleth.idp.cas.flow.impl;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import net.shibboleth.idp.cas.protocol.ProtocolError;
import net.shibboleth.idp.cas.protocol.ProtocolParam;
@@ -44,7 +45,7 @@ import org.springframework.webflow.execution.RequestContext;
public class InitializeLoginAction extends AbstractCASProtocolAction<ServiceTicketRequest, ServiceTicketResponse> {
@Override
- @Nonnull protected Event doExecute(@Nonnull final RequestContext springRequestContext,
+ @Nullable protected Event doExecute(@Nonnull final RequestContext springRequestContext,
@Nonnull final ProfileRequestContext profileRequestContext) {
final ParameterMap params = springRequestContext.getRequestParameters();
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeProxyAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeProxyAction.java
index 54518e7ff..eb882c34d 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeProxyAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeProxyAction.java
@@ -18,6 +18,7 @@
package net.shibboleth.idp.cas.flow.impl;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.profile.action.EventException;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -73,7 +74,7 @@ public class InitializeProxyAction extends AbstractCASProtocolAction<ProxyTicket
}
@Override
- @Nonnull protected Event doExecute(@Nonnull final RequestContext springRequestContext,
+ @Nullable protected Event doExecute(@Nonnull final RequestContext springRequestContext,
@Nonnull final ProfileRequestContext profileRequestContext) {
final ParameterMap params = springRequestContext.getRequestParameters();
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeValidateAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeValidateAction.java
index 4d7373015..4cfa2582a 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeValidateAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeValidateAction.java
@@ -18,6 +18,7 @@
package net.shibboleth.idp.cas.flow.impl;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import net.shibboleth.idp.cas.protocol.ProtocolError;
import net.shibboleth.idp.cas.protocol.ProtocolParam;
@@ -46,7 +47,7 @@ public class InitializeValidateAction extends
AbstractCASProtocolAction<TicketValidationRequest, TicketValidationResponse> {
@Override
- @Nonnull protected Event doExecute(@Nonnull final RequestContext springRequestContext,
+ @Nullable protected Event doExecute(@Nonnull final RequestContext springRequestContext,
@Nonnull final ProfileRequestContext profileRequestContext) {
final ParameterMap params = springRequestContext.getRequestParameters();
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PopulateProtocolErrorAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PopulateProtocolErrorAction.java
index f72d65e21..535e9fd0b 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PopulateProtocolErrorAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PopulateProtocolErrorAction.java
@@ -18,6 +18,7 @@
package net.shibboleth.idp.cas.flow.impl;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.profile.action.EventException;
import org.opensaml.profile.action.EventIds;
@@ -49,7 +50,7 @@ public class PopulateProtocolErrorAction<RequestType>
@Nonnull private final Logger log = LoggerFactory.getLogger(PopulateProtocolErrorAction.class);
@Override
- @Nonnull protected Event doExecute(@Nonnull final RequestContext springRequestContext,
+ @Nullable protected Event doExecute(@Nonnull final RequestContext springRequestContext,
@Nonnull final ProfileRequestContext profileRequestContext) {
final Object request;
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PrepareTicketValidationResponseAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PrepareTicketValidationResponseAction.java
index c3bfd384b..e1ad6babd 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PrepareTicketValidationResponseAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PrepareTicketValidationResponseAction.java
@@ -56,6 +56,7 @@ import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -103,7 +104,7 @@ public class PrepareTicketValidationResponseAction extends
@Nullable private ValidateConfiguration validateConfiguration;
/** CAS response. */
- @Nullable private TicketValidationResponse response;
+ @Nullable private TicketValidationResponse ticketValidationResponse;
/** Constructor. */
public PrepareTicketValidationResponseAction() {
@@ -136,7 +137,7 @@ public class PrepareTicketValidationResponseAction extends
final AttributeTranscoder<?> transcoder = new CASStringAttributeTranscoder();
transcoder.initialize();
defaultTranscodingRule = new TranscodingRule(
- Collections.singletonMap(AttributeTranscoderRegistry.PROP_TRANSCODER, transcoder));
+ CollectionSupport.singletonMap(AttributeTranscoderRegistry.PROP_TRANSCODER, transcoder));
}
@Override
@@ -160,7 +161,7 @@ public class PrepareTicketValidationResponseAction extends
}
try {
- response = getCASResponse(profileRequestContext);
+ ticketValidationResponse = getCASResponse(profileRequestContext);
final TicketState state = getCASTicket(profileRequestContext).getTicketState();
if (state != null) {
consentedAttributeIds = state.getConsentedAttributeIds();
@@ -178,10 +179,14 @@ public class PrepareTicketValidationResponseAction extends
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final String principal;
+ final AttributeContext aCtx = attributeContext;
+ TicketValidationResponse response = ticketValidationResponse;
+ assert aCtx != null && response != null;
+ assert validateConfiguration != null;
final String userAttributeName = validateConfiguration.getUserAttribute(profileRequestContext);
if (userAttributeName != null) {
log.debug("{} Using {} for CAS username", getLogPrefix(), userAttributeName);
- final IdPAttribute attribute = attributeContext.getIdPAttributes().get(userAttributeName);
+ final IdPAttribute attribute = aCtx.getIdPAttributes().get(userAttributeName);
if (attribute != null && !attribute.getValues().isEmpty()) {
final IdPAttributeValue value = attribute.getValues().get(0);
if (value instanceof ScopedStringAttributeValue) {
@@ -210,13 +215,15 @@ public class PrepareTicketValidationResponseAction extends
response.setUserName(principal);
- final Collection<IdPAttribute> inputAttributes = attributeContext.getIdPAttributes().values();
+ final Collection<IdPAttribute> inputAttributes = aCtx.getIdPAttributes().values();
final ArrayList<Attribute> encodedAttributes = new ArrayList<>(inputAttributes.size());
try (final ServiceableComponent<AttributeTranscoderRegistry> component =
transcoderRegistry.getServiceableComponent()) {
for (final IdPAttribute attribute : inputAttributes) {
- if (consentedAttributeIds == null || consentedAttributeIds.contains(attribute.getId())) {
+ assert attribute != null;
+ final Set<String> ids = consentedAttributeIds;
+ if (ids == null || ids.contains(attribute.getId())) {
encodeAttribute(component.getComponent(), profileRequestContext, attribute, encodedAttributes);
} else {
log.info("{} Skipping attribute {} not in stored consent list from ticket", getLogPrefix(),
@@ -229,7 +236,7 @@ public class PrepareTicketValidationResponseAction extends
return;
}
- encodedAttributes.forEach(a -> response.addAttribute(a));
+ encodedAttributes.forEach(a -> {assert a!=null; response.addAttribute(a);});
}
// Checkstyle: CyclomaticComplexity ON
@@ -257,6 +264,7 @@ public class PrepareTicketValidationResponseAction extends
int count = 0;
for (final TranscodingRule rules : transcodingRules) {
+ assert rules != null;
try {
final AttributeTranscoder<Attribute> transcoder = TranscoderSupport.<Attribute>getTranscoder(rules);
final Attribute encodedAttribute =
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ProcessSamlMessageAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ProcessSamlMessageAction.java
index 60a8bb4e5..1122f2079 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ProcessSamlMessageAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ProcessSamlMessageAction.java
@@ -18,6 +18,7 @@
package net.shibboleth.idp.cas.flow.impl;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.action.EventException;
@@ -36,6 +37,7 @@ import net.shibboleth.idp.cas.protocol.SamlParam;
import net.shibboleth.idp.cas.protocol.TicketValidationRequest;
import net.shibboleth.idp.cas.protocol.TicketValidationResponse;
import net.shibboleth.idp.profile.ActionSupport;
+import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
@@ -57,7 +59,7 @@ public class ProcessSamlMessageAction extends
@Nonnull private final Logger log = LoggerFactory.getLogger(ProcessSamlMessageAction.class);
@Override
- @Nonnull protected Event doExecute(@Nonnull final RequestContext springRequestContext,
+ @Nullable protected Event doExecute(@Nonnull final RequestContext springRequestContext,
@Nonnull final ProfileRequestContext profileRequestContext) {
profileRequestContext.setProfileId(ValidateConfiguration.PROFILE_ID);
@@ -69,16 +71,20 @@ public class ProcessSamlMessageAction extends
}
// Extract ticket from SAML request
- final MessageContext msgContext = profileRequestContext.getInboundMessageContext();
+ @Nonnull final MessageContext msgContext = Constraint.isNotNull(profileRequestContext.getInboundMessageContext(), "no inbound Context");
String ticket = null;
- if (msgContext.getMessage() instanceof Request) {
- final Request request = (Request) msgContext.getMessage();
+ final Object message = msgContext.getMessage();
+ if (message != null && message instanceof Request) {
+ final Request request = (Request) message;
for (final AssertionArtifact artifact : request.getAssertionArtifacts()) {
ticket = artifact.getValue();
break;
}
+ } else if (message == null) {
+ log.warn("{} Unexpected null message", getLogPrefix());
+ return ProtocolError.ProtocolViolation.event(this);
} else {
- log.warn("{} Unexpected SAMLObject type {}", getLogPrefix(), msgContext.getMessage().getClass().getName());
+ log.warn("{} Unexpected SAMLObject type {}", getLogPrefix(), message.getClass().getName());
return ProtocolError.ProtocolViolation.event(this);
}
if (ticket == null) {
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PublishProtocolMessageAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PublishProtocolMessageAction.java
index 481428c36..a67142485 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PublishProtocolMessageAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PublishProtocolMessageAction.java
@@ -18,6 +18,7 @@
package net.shibboleth.idp.cas.flow.impl;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.profile.action.EventException;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -54,7 +55,7 @@ public class PublishProtocolMessageAction<RequestType,ResponseType>
}
@Override
- @Nonnull protected Event doExecute(@Nonnull final RequestContext springRequestContext,
+ @Nullable protected Event doExecute(@Nonnull final RequestContext springRequestContext,
@Nonnull final ProfileRequestContext profileRequestContext) {
final Object message;
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/UpdateIdPSessionWithSPSessionAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/UpdateIdPSessionWithSPSessionAction.java
index 42c68e841..a75e8d859 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/UpdateIdPSessionWithSPSessionAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/UpdateIdPSessionWithSPSessionAction.java
@@ -107,19 +107,22 @@ public class UpdateIdPSessionWithSPSessionAction<RequestType,ResponseType>
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
IdPSession session = null;
+ final Ticket tckt = ticket;
+ assert tckt != null;
try {
- log.debug("{} Attempting to retrieve session {}", getLogPrefix(), ticket.getSessionId());
- session = sessionResolver.resolveSingle(new CriteriaSet(new SessionIdCriterion(ticket.getSessionId())));
+ log.debug("{} Attempting to retrieve session {}", getLogPrefix(), tckt.getSessionId());
+ session = sessionResolver.resolveSingle(new CriteriaSet(new SessionIdCriterion(
+ Constraint.isNotNull(tckt.getSessionId(), "Null Session Id"))));
} catch (final ResolverException e) {
log.warn("{} Possible sign of misconfiguration, IdPSession resolution error: {}", getLogPrefix(), e);
}
if (session != null) {
final Instant now = Instant.now();
final SPSession sps = new CASSPSession(
- ticket.getService(),
+ tckt.getService(),
now,
now.plus(sessionLifetime),
- ticket.getId());
+ tckt.getId());
log.debug("{} Created SP session {}", getLogPrefix(), sps);
try {
session.addSPSession(sps);
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateProxyCallbackAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateProxyCallbackAction.java
index ceaea0c0f..eccdd299c 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateProxyCallbackAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateProxyCallbackAction.java
@@ -119,6 +119,7 @@ public class ValidateProxyCallbackAction
return false;
}
+ assert validateConfig != null;
securityConfig = validateConfig.getSecurityConfiguration(profileRequestContext);
if (securityConfig == null) {
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
@@ -139,17 +140,24 @@ public class ValidateProxyCallbackAction
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- final IdentifierGenerationStrategy pgtGenerator = securityConfig.getIdGenerator();
- final IdentifierGenerationStrategy pgtIOUGenerator = validateConfig.getPGTIOUGenerator(profileRequestContext);
- final Instant expiration = Instant.now().plus(validateConfig.getTicketValidityPeriod(profileRequestContext));
- final String pgtId = pgtGenerator.generateIdentifier();
+ final ValidateConfiguration vCfg = validateConfig;
+ final SecurityConfiguration sCfg = securityConfig;
+ final Ticket tkt = ticket;
+ final TicketValidationRequest request = this.request;
+ final TicketValidationResponse response = this.response;
+ assert vCfg != null && sCfg != null && tkt != null && request != null && response != null;
+
+ @Nonnull final IdentifierGenerationStrategy pgtGenerator = sCfg.getIdGenerator();
+ @Nonnull final IdentifierGenerationStrategy pgtIOUGenerator = vCfg.getPGTIOUGenerator(profileRequestContext);
+ @Nonnull final Instant expiration = Instant.now().plus(vCfg.getTicketValidityPeriod(profileRequestContext));
+ @Nonnull final String pgtId = pgtGenerator.generateIdentifier();
final ProxyGrantingTicket pgt;
if (ticket instanceof ServiceTicket) {
pgt = casTicketService.createProxyGrantingTicket(
- pgtId, expiration, (ServiceTicket) ticket, request.getPgtUrl());
+ pgtId, expiration, (ServiceTicket) tkt, request.getPgtUrl());
} else {
pgt = casTicketService.createProxyGrantingTicket(
- pgtId, expiration, (ProxyTicket) ticket, request.getPgtUrl());
+ pgtId, expiration, (ProxyTicket) tkt, request.getPgtUrl());
}
// The ID of the proxy-granting ticket MAY be different from the generated value above.
// ALWAYS use the value from the ticket object.
@@ -165,7 +173,7 @@ public class ValidateProxyCallbackAction
ActionSupport.buildEvent(profileRequestContext, EventIds.RUNTIME_EXCEPTION);
return;
}
-
+ assert proxyCallbackUri != null;
try {
log.debug("{} Attempting proxy authentication to {}", getLogPrefix(), proxyCallbackUri);
proxyValidator.validate(profileRequestContext, proxyCallbackUri);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list