[java-shib-profile] branch main updated: JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
Scott Cantor
cantor.2 at osu.edu
Tue Feb 14 16:33:33 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-shib-profile.
View the commit online:
http://git.shibboleth.net/view/?p=java-shib-profile.git;a=commit;h=bbf0a7df1b7a56f111eaf189cda13aa425830562
The following commit(s) were added to refs/heads/main by this push:
new bbf0a7d JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
bbf0a7d is described below
commit bbf0a7df1b7a56f111eaf189cda13aa425830562
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Feb 14 11:33:30 2023 -0500
JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
https://shibboleth.atlassian.net/browse/JSPROF-1
Replace IdP impl CredentialResolvers with a unified API resolver.
---
shib-profile-api/pom.xml | 5 +
.../RelyingPartyCredentialResolver.java | 116 +++++++++++++++++++++
shib-profile-impl/pom.xml | 1 -
3 files changed, 121 insertions(+), 1 deletion(-)
diff --git a/shib-profile-api/pom.xml b/shib-profile-api/pom.xml
index e5c8f2c..109ae0f 100644
--- a/shib-profile-api/pom.xml
+++ b/shib-profile-api/pom.xml
@@ -35,6 +35,11 @@
<artifactId>opensaml-security-api</artifactId>
</dependency>
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-service</artifactId>
+ </dependency>
+
<!-- Provided Dependencies -->
<!-- Runtime Dependencies -->
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/relyingparty/RelyingPartyCredentialResolver.java b/shib-profile-api/src/main/java/net/shibboleth/profile/relyingparty/RelyingPartyCredentialResolver.java
new file mode 100644
index 0000000..6f1b900
--- /dev/null
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/relyingparty/RelyingPartyCredentialResolver.java
@@ -0,0 +1,116 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.profile.relyingparty;
+
+import java.util.ArrayList;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.CredentialResolver;
+import org.opensaml.security.credential.UsageType;
+import org.opensaml.security.criteria.UsageCriterion;
+import org.slf4j.Logger;
+
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.component.IdentifiableComponent;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
+import net.shibboleth.shared.resolver.CriteriaSet;
+import net.shibboleth.shared.resolver.ResolverException;
+import net.shibboleth.shared.service.ReloadableService;
+import net.shibboleth.shared.service.ServiceException;
+import net.shibboleth.shared.service.ServiceableComponent;
+
+/**
+ * Credential resolver whose purpose is to resolve configured IdP signing credentials.
+ */
+public class RelyingPartyCredentialResolver implements CredentialResolver, IdentifiableComponent {
+
+ /** Logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(RelyingPartyCredentialResolver.class);
+
+ /** The reloading resolver which is the source of the credentials. */
+ @Nonnull private ReloadableService<RelyingPartyConfigurationResolver> service;
+
+ /** Component ID. */
+ @Nullable private String id;
+
+ /**
+ * Constructor.
+ *
+ * @param resolverService the Spring service exposing the relying party configuration service
+ */
+ public RelyingPartyCredentialResolver(
+ @Nonnull final ReloadableService<RelyingPartyConfigurationResolver> resolverService) {
+ service = Constraint.isNotNull(resolverService,
+ "ReloadableSpringService for RelyingPartyConfigurationResolver cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public String getId() {
+ return id;
+ }
+
+ /** {@inheritDoc} */
+ public void setId(@Nonnull @NotEmpty final String componentId) {
+ id = Constraint.isNotNull(StringSupport.trimOrNull(componentId), "Component ID can not be null or empty");
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
+ final Iterable<Credential> creds = resolve(criteriaSet);
+ if (creds.iterator().hasNext()) {
+ return creds.iterator().next();
+ }
+ return null;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public Iterable<Credential> resolve(@Nullable final CriteriaSet criteria)
+ throws ResolverException {
+
+ final UsageCriterion usage = criteria != null ? criteria.get(UsageCriterion.class) : null;
+
+ try (final ServiceableComponent<RelyingPartyConfigurationResolver> component = service.getServiceableComponent()) {
+ final RelyingPartyConfigurationResolver resolver = component.getComponent();
+
+ if (usage != null) {
+ if (UsageType.SIGNING.equals(usage.getUsage())) {
+ return resolver.getSigningCredentials();
+ } else if (UsageType.ENCRYPTION.equals(usage.getUsage())) {
+ return resolver.getEncryptionCredentials();
+ }
+ }
+
+ final ArrayList<Credential> combined = new ArrayList<>();
+ combined.addAll(resolver.getSigningCredentials());
+ combined.addAll(resolver.getEncryptionCredentials());
+ return combined;
+
+ } catch (final ServiceException e) {
+ log.error("CredentialsResolver '{}': Invalid RelyingPartyResolver configuration", getId(), e);
+ }
+
+ return CollectionSupport.emptyList();
+ }
+
+}
\ No newline at end of file
diff --git a/shib-profile-impl/pom.xml b/shib-profile-impl/pom.xml
index 595f6fc..6c2c320 100644
--- a/shib-profile-impl/pom.xml
+++ b/shib-profile-impl/pom.xml
@@ -31,7 +31,6 @@
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>shib-metadata-spring</artifactId>
- <version>${shib-metadata.version}</version>
</dependency>
<dependency>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list