[java-shib-profile] branch main updated: JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
Scott Cantor
cantor.2 at osu.edu
Tue Feb 14 19:20:39 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-shib-profile.
View the commit online:
http://git.shibboleth.net/view/?p=java-shib-profile.git;a=commit;h=52a420c3149b939746302e9e6c67360c0c13b6f2
The following commit(s) were added to refs/heads/main by this push:
new 52a420c JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
52a420c is described below
commit 52a420c3149b939746302e9e6c67360c0c13b6f2
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Feb 14 14:20:36 2023 -0500
JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
https://shibboleth.atlassian.net/browse/JSPROF-1
Migrate down subset of relying party lookup functions and base classes.
---
shib-profile-api/pom.xml | 15 +++
...DefaultSecurityConfigurationLookupFunction.java | 73 ++++++++++++
...ntTLSValidationConfigurationLookupFunction.java | 70 ++++++++++++
.../DecryptionConfigurationLookupFunction.java | 71 ++++++++++++
.../EncryptionConfigurationLookupFunction.java | 71 ++++++++++++
...IdentifierGenerationStrategyLookupFunction.java | 77 +++++++++++++
...ignatureSigningConfigurationLookupFunction.java | 72 ++++++++++++
...atureValidationConfigurationLookupFunction.java | 72 ++++++++++++
.../profile/config/navigate/package-info.java | 21 ++++
.../AbstractRelyingPartyLookupFunction.java | 84 ++++++++++++++
.../navigate/RelyingPartyIdLookupFunction.java | 46 ++++++++
.../profile/context/navigate/package-info.java | 21 ++++
.../profile/logic/RelyingPartyIdPredicate.java | 111 ++++++++++++++++++
.../net/shibboleth/profile/logic/package-info.java | 21 ++++
.../profile/logic/RelyingPartyIdPredicateTest.java | 127 +++++++++++++++++++++
.../profile/logic/relyingPartyIdPredicates.xml | 34 ++++++
shib-profile-impl/pom.xml | 5 +
.../RelyingPartiesActivationConditionFactory.java | 71 ++++++++++++
.../profile/logic/impl/package-info.java | 21 ++++
19 files changed, 1083 insertions(+)
diff --git a/shib-profile-api/pom.xml b/shib-profile-api/pom.xml
index 109ae0f..fcd35ad 100644
--- a/shib-profile-api/pom.xml
+++ b/shib-profile-api/pom.xml
@@ -34,6 +34,10 @@
<groupId>${opensaml.groupId}</groupId>
<artifactId>opensaml-security-api</artifactId>
</dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-xmlsec-api</artifactId>
+ </dependency>
<dependency>
<groupId>${shib-shared.groupId}</groupId>
@@ -45,6 +49,17 @@
<!-- Runtime Dependencies -->
<!-- Test Dependencies -->
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-spring</artifactId>
+ <scope>test</scope>
+ </dependency>
+
+ <dependency>
+ <groupId>${spring.groupId}</groupId>
+ <artifactId>spring-context</artifactId>
+ <scope>test</scope>
+ </dependency>
</dependencies>
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/AbstractDefaultSecurityConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/AbstractDefaultSecurityConfigurationLookupFunction.java
new file mode 100644
index 0000000..50131f2
--- /dev/null
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/AbstractDefaultSecurityConfigurationLookupFunction.java
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.profile.config.navigate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.security.config.SecurityConfiguration;
+import org.slf4j.Logger;
+
+import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.profile.relyingparty.RelyingPartyConfigurationResolver;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.service.ReloadableService;
+import net.shibboleth.shared.service.ServiceException;
+import net.shibboleth.shared.service.ServiceableComponent;
+
+/**
+ * Base class for lookup functions that require access to the default security configuration
+ * for a profile via the {@link RelyingPartyConfigurationResolver} interface.
+ *
+ * @param <T> function return type
+ */
+public abstract class AbstractDefaultSecurityConfigurationLookupFunction<T>
+ extends AbstractRelyingPartyLookupFunction<T> {
+
+ /** Class logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(AbstractDefaultSecurityConfigurationLookupFunction.class);
+
+ /** A resolver for default security configurations. */
+ @Nullable private ReloadableService<RelyingPartyConfigurationResolver> rpResolver;
+
+ /**
+ * Set the resolver for default security configurations.
+ *
+ * @param resolver the resolver to use
+ */
+ public void setRelyingPartyConfigurationResolver(
+ @Nullable final ReloadableService<RelyingPartyConfigurationResolver> resolver) {
+ rpResolver = resolver;
+ }
+
+ @Nullable protected SecurityConfiguration getDefaultSecurityConfiguration(
+ @Nonnull @NotEmpty final String profileId) {
+
+ if (rpResolver != null) {
+ try (final ServiceableComponent<RelyingPartyConfigurationResolver> component =
+ rpResolver.getServiceableComponent()) {
+ return component.getComponent().getDefaultSecurityConfiguration(profileId);
+ } catch (final ServiceException e) {
+ log.error("RelyingPartyConfigurationResolver was invalid", e.getMessage());
+ }
+ }
+
+ return null;
+ }
+}
\ No newline at end of file
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/ClientTLSValidationConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/ClientTLSValidationConfigurationLookupFunction.java
new file mode 100644
index 0000000..d5bce7c
--- /dev/null
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/ClientTLSValidationConfigurationLookupFunction.java
@@ -0,0 +1,70 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.profile.config.navigate;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+
+import org.opensaml.core.config.ConfigurationService;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.security.config.SecurityConfiguration;
+import org.opensaml.security.x509.tls.ClientTLSValidationConfiguration;
+
+/**
+ * A function that returns a {@link ClientTLSValidationConfiguration} list by way of various lookup strategies.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class ClientTLSValidationConfigurationLookupFunction
+ extends AbstractDefaultSecurityConfigurationLookupFunction<List<ClientTLSValidationConfiguration>> {
+
+ /** {@inheritDoc} */
+ @Nullable public List<ClientTLSValidationConfiguration> apply(@Nullable final ProfileRequestContext input) {
+
+ final List<ClientTLSValidationConfiguration> configs = new ArrayList<>();
+
+ final RelyingPartyContext rpc = getRelyingPartyContext(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null) {
+ final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
+ if (sc != null && sc.getClientTLSValidationConfiguration() != null) {
+ configs.add(sc.getClientTLSValidationConfiguration());
+ }
+ }
+ }
+
+ // Check for a per-profile default (relying party independent) config.
+ if (input != null) {
+ final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(input.getProfileId());
+ if (defaultConfig != null && defaultConfig.getClientTLSValidationConfiguration() != null) {
+ configs.add(defaultConfig.getClientTLSValidationConfiguration());
+ }
+ }
+
+ configs.add(ConfigurationService.get(ClientTLSValidationConfiguration.class));
+
+ return configs;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/DecryptionConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/DecryptionConfigurationLookupFunction.java
new file mode 100644
index 0000000..79144d7
--- /dev/null
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/DecryptionConfigurationLookupFunction.java
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.profile.config.navigate;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.security.config.SecurityConfiguration;
+import org.opensaml.xmlsec.DecryptionConfiguration;
+import org.opensaml.xmlsec.SecurityConfigurationSupport;
+import org.opensaml.xmlsec.config.XMLSecurityConfiguration;
+
+/**
+ * A function that returns a {@link DecryptionConfiguration} list by way of various lookup strategies.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class DecryptionConfigurationLookupFunction
+ extends AbstractDefaultSecurityConfigurationLookupFunction<List<DecryptionConfiguration>> {
+
+ /** {@inheritDoc} */
+ @Nullable public List<DecryptionConfiguration> apply(@Nullable final ProfileRequestContext input) {
+
+ final List<DecryptionConfiguration> configs = new ArrayList<>();
+
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null) {
+ final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
+ if (sc instanceof XMLSecurityConfiguration xsc && xsc.getDecryptionConfiguration() != null) {
+ configs.add(xsc.getDecryptionConfiguration());
+ }
+ }
+ }
+
+ // Check for a per-profile default (relying party independent) config.
+ if (input != null) {
+ final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(input.getProfileId());
+ if (defaultConfig instanceof XMLSecurityConfiguration xsc && xsc.getDecryptionConfiguration() != null) {
+ configs.add(xsc.getDecryptionConfiguration());
+ }
+ }
+
+ configs.add(SecurityConfigurationSupport.getGlobalDecryptionConfiguration());
+
+ return configs;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/EncryptionConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/EncryptionConfigurationLookupFunction.java
new file mode 100644
index 0000000..4d1c6a4
--- /dev/null
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/EncryptionConfigurationLookupFunction.java
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.profile.config.navigate;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.security.config.SecurityConfiguration;
+import org.opensaml.xmlsec.EncryptionConfiguration;
+import org.opensaml.xmlsec.SecurityConfigurationSupport;
+import org.opensaml.xmlsec.config.XMLSecurityConfiguration;
+
+/**
+ * A function that returns a {@link EncryptionConfiguration} list using injected lookup strategies.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class EncryptionConfigurationLookupFunction
+ extends AbstractDefaultSecurityConfigurationLookupFunction<List<EncryptionConfiguration>> {
+
+ /** {@inheritDoc} */
+ @Nullable public List<EncryptionConfiguration> apply(@Nullable final ProfileRequestContext input) {
+
+ final List<EncryptionConfiguration> configs = new ArrayList<>();
+
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null) {
+ final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
+ if (sc instanceof XMLSecurityConfiguration xsc && xsc.getEncryptionConfiguration() != null) {
+ configs.add(xsc.getEncryptionConfiguration());
+ }
+ }
+ }
+
+ // Check for a per-profile default (relying party independent) config.
+ if (input != null) {
+ final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(input.getProfileId());
+ if (defaultConfig instanceof XMLSecurityConfiguration xsc && xsc.getEncryptionConfiguration() != null) {
+ configs.add(xsc.getEncryptionConfiguration());
+ }
+ }
+
+ configs.add(SecurityConfigurationSupport.getGlobalEncryptionConfiguration());
+
+ return configs;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/IdentifierGenerationStrategyLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/IdentifierGenerationStrategyLookupFunction.java
new file mode 100644
index 0000000..4fbf090
--- /dev/null
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/IdentifierGenerationStrategyLookupFunction.java
@@ -0,0 +1,77 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.profile.config.navigate;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.security.IdentifierGenerationStrategy;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.security.config.SecurityConfiguration;
+
+/**
+ * A function that returns an {@link IdentifierGenerationStrategy} by way of a {@link RelyingPartyContext}
+ * obtained via a lookup function, by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a default generator can be returned.</p>
+ */
+public class IdentifierGenerationStrategyLookupFunction
+ extends AbstractDefaultSecurityConfigurationLookupFunction<IdentifierGenerationStrategy> {
+
+ /** Default strategy to return. */
+ @Nullable private IdentifierGenerationStrategy defaultGenerator;
+
+ /**
+ * Set the default {@link IdentifierGenerationStrategy} to return.
+ *
+ * @param strategy default generation strategy;
+ */
+ public void setDefaultIdentifierGenerationStrategy(@Nullable final IdentifierGenerationStrategy strategy) {
+ defaultGenerator = strategy;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public IdentifierGenerationStrategy apply(@Nullable final ProfileRequestContext input) {
+ if (input != null) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null) {
+ final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
+ if (sc != null) {
+ return sc.getIdGenerator();
+ }
+ }
+ }
+ }
+
+ // Check for a per-profile default (relying party independent) config.
+ if (input != null) {
+ final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(input.getProfileId());
+ if (defaultConfig != null && defaultConfig.getIdGenerator() != null) {
+ return defaultConfig.getIdGenerator();
+ }
+ }
+
+ return defaultGenerator;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/SignatureSigningConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/SignatureSigningConfigurationLookupFunction.java
new file mode 100644
index 0000000..a1991b4
--- /dev/null
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/SignatureSigningConfigurationLookupFunction.java
@@ -0,0 +1,72 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.profile.config.navigate;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.security.config.SecurityConfiguration;
+import org.opensaml.xmlsec.SignatureSigningConfiguration;
+import org.opensaml.xmlsec.config.XMLSecurityConfiguration;
+import org.opensaml.xmlsec.SecurityConfigurationSupport;
+
+/**
+ * A function that returns a {@link SignatureSigningConfiguration} list by way of various lookup strategies.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class SignatureSigningConfigurationLookupFunction
+ extends AbstractDefaultSecurityConfigurationLookupFunction<List<SignatureSigningConfiguration>> {
+
+ /** {@inheritDoc} */
+ @Nullable public List<SignatureSigningConfiguration> apply(@Nullable final ProfileRequestContext input) {
+
+ final List<SignatureSigningConfiguration> configs = new ArrayList<>();
+
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null) {
+ final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
+ if (sc instanceof XMLSecurityConfiguration xsc && xsc.getSignatureSigningConfiguration() != null) {
+ configs.add(xsc.getSignatureSigningConfiguration());
+ }
+ }
+ }
+
+ // Check for a per-profile default (relying party independent) config.
+ if (input != null) {
+ final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(input.getProfileId());
+ if (defaultConfig instanceof XMLSecurityConfiguration xsc &&
+ xsc.getSignatureSigningConfiguration() != null) {
+ configs.add(xsc.getSignatureSigningConfiguration());
+ }
+ }
+
+ configs.add(SecurityConfigurationSupport.getGlobalSignatureSigningConfiguration());
+
+ return configs;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/SignatureValidationConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/SignatureValidationConfigurationLookupFunction.java
new file mode 100644
index 0000000..afd42b3
--- /dev/null
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/SignatureValidationConfigurationLookupFunction.java
@@ -0,0 +1,72 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.profile.config.navigate;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.security.config.SecurityConfiguration;
+import org.opensaml.xmlsec.SignatureValidationConfiguration;
+import org.opensaml.xmlsec.config.XMLSecurityConfiguration;
+import org.opensaml.xmlsec.SecurityConfigurationSupport;
+
+/**
+ * A function that returns a {@link SignatureValidationConfiguration} list by way of various lookup strategies.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class SignatureValidationConfigurationLookupFunction
+ extends AbstractDefaultSecurityConfigurationLookupFunction<List<SignatureValidationConfiguration>> {
+
+ /** {@inheritDoc} */
+ @Nullable public List<SignatureValidationConfiguration> apply(@Nullable final ProfileRequestContext input) {
+
+ final List<SignatureValidationConfiguration> configs = new ArrayList<>();
+
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null) {
+ final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
+ if (sc instanceof XMLSecurityConfiguration xsc && xsc.getSignatureValidationConfiguration() != null) {
+ configs.add(xsc.getSignatureValidationConfiguration());
+ }
+ }
+ }
+
+ // Check for a per-profile default (relying party independent) config.
+ if (input != null) {
+ final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(input.getProfileId());
+ if (defaultConfig instanceof XMLSecurityConfiguration xsc &&
+ xsc.getSignatureValidationConfiguration() != null) {
+ configs.add(xsc.getSignatureValidationConfiguration());
+ }
+ }
+
+ configs.add(SecurityConfigurationSupport.getGlobalSignatureValidationConfiguration());
+
+ return configs;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/package-info.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/package-info.java
new file mode 100644
index 0000000..ed3ed5c
--- /dev/null
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Lookup functions for accessing profile configuration and related settings.
+ */
+package net.shibboleth.profile.config.navigate;
\ No newline at end of file
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/context/navigate/AbstractRelyingPartyLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/context/navigate/AbstractRelyingPartyLookupFunction.java
new file mode 100644
index 0000000..e2c64e5
--- /dev/null
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/context/navigate/AbstractRelyingPartyLookupFunction.java
@@ -0,0 +1,84 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.profile.context.navigate;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.logic.Constraint;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * Abstract base class for a function that requires a {@link RelyingPartyContext}
+ * obtained via a lookup function, by default a child of the {@link ProfileRequestContext}.
+ *
+ * @param <ResultType> return type of function
+ */
+public abstract class AbstractRelyingPartyLookupFunction<ResultType>
+ implements ContextDataLookupFunction<ProfileRequestContext,ResultType> {
+
+ /**
+ * Strategy used to locate the {@link RelyingPartyContext} associated with a given {@link ProfileRequestContext}.
+ */
+ @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
+
+ /** Constructor. */
+ public AbstractRelyingPartyLookupFunction() {
+ relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
+ }
+
+ /**
+ * Set the strategy used to locate the {@link RelyingPartyContext} associated with a given
+ * {@link ProfileRequestContext}.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setRelyingPartyContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,RelyingPartyContext> strategy) {
+ relyingPartyContextLookupStrategy =
+ Constraint.isNotNull(strategy, "RelyingPartyContext lookup strategy cannot be null");
+ }
+
+ /**
+ * Get the strategy used to locate the {@link RelyingPartyContext} associated with a given
+ * {@link ProfileRequestContext}.
+ *
+ * @return lookup strategy
+ */
+ @Nonnull public Function<ProfileRequestContext,RelyingPartyContext> getRelyingPartyContextLookupStrategy() {
+ return relyingPartyContextLookupStrategy;
+ }
+
+ /**
+ * Invokes the installed lookup function to locate the {@link RelyingPartyContext}.
+ *
+ * @param input profile request context
+ *
+ * @return the {@link RelyingPartyContext} or null
+ */
+ @Nullable protected RelyingPartyContext getRelyingPartyContext(@Nullable final ProfileRequestContext input) {
+ return relyingPartyContextLookupStrategy.apply(input);
+ }
+
+}
\ No newline at end of file
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/context/navigate/RelyingPartyIdLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/context/navigate/RelyingPartyIdLookupFunction.java
new file mode 100644
index 0000000..a3dcf2f
--- /dev/null
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/context/navigate/RelyingPartyIdLookupFunction.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.profile.context.navigate;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.context.RelyingPartyContext;
+
+/**
+ * A function that returns {@link RelyingPartyContext#getRelyingPartyId()} from a
+ * {@link RelyingPartyContext} obtained via a lookup function, by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class RelyingPartyIdLookupFunction extends AbstractRelyingPartyLookupFunction<String> {
+
+ /** {@inheritDoc} */
+ @Nullable public String apply(@Nullable final ProfileRequestContext input) {
+ if (input != null) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ return rpc.getRelyingPartyId();
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/context/navigate/package-info.java b/shib-profile-api/src/main/java/net/shibboleth/profile/context/navigate/package-info.java
new file mode 100644
index 0000000..381aa04
--- /dev/null
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/context/navigate/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Context lookup functions that navigate profile contexts.
+ */
+package net.shibboleth.profile.context.navigate;
\ No newline at end of file
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/logic/RelyingPartyIdPredicate.java b/shib-profile-api/src/main/java/net/shibboleth/profile/logic/RelyingPartyIdPredicate.java
new file mode 100644
index 0000000..491f699
--- /dev/null
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/logic/RelyingPartyIdPredicate.java
@@ -0,0 +1,111 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.profile.logic;
+
+import java.util.Collection;
+import java.util.function.Predicate;
+
+import javax.annotation.Nonnull;
+
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.RelyingPartyIdLookupFunction;
+import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.logic.StrategyIndirectedPredicate;
+import net.shibboleth.shared.primitive.StringSupport;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * Predicate that evaluates a {@link ProfileRequestContext} by looking for a relying party ID
+ * that matches one of a designated set, or a generic predicate. The ID is obtained from a
+ * {@link RelyingPartyContext} child of the profile request context.
+ */
+public class RelyingPartyIdPredicate extends StrategyIndirectedPredicate<ProfileRequestContext,String> {
+
+ /**
+ * Constructor.
+ *
+ * @param candidates hardwired set of values to check against
+ */
+ public RelyingPartyIdPredicate(
+ @Nonnull @NonnullElements @ParameterName(name="candidates") final Collection<String> candidates) {
+ super(new RelyingPartyIdLookupFunction(), StringSupport.normalizeStringCollection(candidates));
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param candidate a single value to check against
+ */
+ public RelyingPartyIdPredicate(@Nonnull @NotEmpty @ParameterName(name="candidate") final String candidate) {
+ this(CollectionSupport.singleton(candidate));
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param pred generalized predicate
+ */
+ public RelyingPartyIdPredicate(@Nonnull @ParameterName(name="pred") final Predicate<String> pred) {
+ super(new RelyingPartyIdLookupFunction(), pred);
+ }
+
+ /**
+ * Workaround for Spring type conversion ambiguities.
+ *
+ * @param candidates hardwired set of values to check against
+ *
+ * @return the predicate
+ *
+ * @since 3.4.0
+ */
+ @Nonnull public static RelyingPartyIdPredicate fromCandidates(
+ @Nonnull @NonnullElements final Collection<String> candidates) {
+ return new RelyingPartyIdPredicate(candidates);
+ }
+
+ /**
+ * Workaround for Spring type conversion ambiguities.
+ *
+ * @param candidate a single value to check against
+ *
+ * @return the predicate
+ *
+ * @since 3.4.0
+ */
+ @Nonnull public static RelyingPartyIdPredicate fromCandidate(@Nonnull @NotEmpty final String candidate) {
+ return new RelyingPartyIdPredicate(candidate);
+ }
+
+ /**
+ * Workaround for Spring type conversion ambiguities.
+ *
+ * @param pred generalized predicate
+ *
+ * @return the predicate
+ *
+ * @since 3.4.0
+ */
+ @Nonnull public static RelyingPartyIdPredicate fromPredicate(@Nonnull final Predicate<String> pred) {
+ return new RelyingPartyIdPredicate(pred);
+ }
+
+}
\ No newline at end of file
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/logic/package-info.java b/shib-profile-api/src/main/java/net/shibboleth/profile/logic/package-info.java
new file mode 100644
index 0000000..79cd221
--- /dev/null
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/logic/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Predicates that test against profile request state.
+ */
+package net.shibboleth.profile.logic;
\ No newline at end of file
diff --git a/shib-profile-api/src/test/java/net/shibboleth/profile/logic/RelyingPartyIdPredicateTest.java b/shib-profile-api/src/test/java/net/shibboleth/profile/logic/RelyingPartyIdPredicateTest.java
new file mode 100644
index 0000000..607b0cf
--- /dev/null
+++ b/shib-profile-api/src/test/java/net/shibboleth/profile/logic/RelyingPartyIdPredicateTest.java
@@ -0,0 +1,127 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.profile.logic;
+
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.spring.context.FilesystemGenericApplicationContext;
+import net.shibboleth.shared.spring.custom.SchemaTypeAwareXMLBeanDefinitionReader;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.springframework.context.support.GenericApplicationContext;
+import org.testng.Assert;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+/** Unit test for {@link RelyingPartyIdPredicate}. */
+ at SuppressWarnings("javadoc")
+public class RelyingPartyIdPredicateTest {
+
+ private ProfileRequestContext prc;
+
+ private RelyingPartyContext rpCtx;
+
+ @BeforeMethod
+ public void setUp() {
+ prc = new ProfileRequestContext();
+ rpCtx = prc.getSubcontext(RelyingPartyContext.class, true);
+ }
+
+ @Test
+ public void testNone() throws ComponentInitializationException {
+ final RelyingPartyIdPredicate pred = new RelyingPartyIdPredicate(CollectionSupport.emptySet());
+
+ Assert.assertFalse(pred.test(prc));
+
+ rpCtx.setRelyingPartyId("foo");
+ Assert.assertFalse(pred.test(prc));
+ }
+
+ @Test
+ public void testMatch() throws ComponentInitializationException {
+ final RelyingPartyIdPredicate pred = new RelyingPartyIdPredicate(CollectionSupport.singleton("foo"));
+
+ Assert.assertFalse(pred.test(prc));
+
+ rpCtx.setRelyingPartyId("foo");
+ Assert.assertTrue(pred.test(prc));
+ }
+
+ @Test
+ public void testNoMatch() throws ComponentInitializationException {
+ final RelyingPartyIdPredicate pred = new RelyingPartyIdPredicate(CollectionSupport.singleton("bar"));
+
+ Assert.assertFalse(pred.test(prc));
+
+ rpCtx.setRelyingPartyId("foo");
+ Assert.assertFalse(pred.test(prc));
+ }
+
+ @Test
+ public void springConstructors() {
+ try (final GenericApplicationContext context = new FilesystemGenericApplicationContext()) {
+ context.setDisplayName("ApplicationContext: Matcher");
+ final SchemaTypeAwareXMLBeanDefinitionReader beanDefinitionReader =
+ new SchemaTypeAwareXMLBeanDefinitionReader(context);
+
+ beanDefinitionReader.loadBeanDefinitions("net/shibboleth/profile/logic/relyingPartyIdPredicates.xml");
+
+ context.refresh();
+
+ RelyingPartyIdPredicate bean = context.getBean("candidate", RelyingPartyIdPredicate.class);
+ Assert.assertTrue(testCandidate(bean, "Single"));
+ Assert.assertFalse(testCandidate(bean, "Double"));
+ Assert.assertFalse(testCandidate(bean, "Elephant"));
+
+ bean = context.getBean("candidates", RelyingPartyIdPredicate.class);
+ Assert.assertTrue(testCandidate(bean, "Single"));
+ Assert.assertTrue(testCandidate(bean, "Double"));
+ Assert.assertFalse(testCandidate(bean, "Elephant"));
+
+ bean = context.getBean("pred", RelyingPartyIdPredicate.class);
+ Assert.assertTrue(testCandidate(bean, "Single"));
+ Assert.assertTrue(testCandidate(bean, "Double"));
+ Assert.assertTrue(testCandidate(bean, "Elephant"));
+
+ bean = context.getBean("candidate_0", RelyingPartyIdPredicate.class);
+ Assert.assertTrue(testCandidate(bean, "Single"));
+ Assert.assertFalse(testCandidate(bean, "Double"));
+ Assert.assertFalse(testCandidate(bean, "Elephant"));
+
+ bean = context.getBean("candidates_0", RelyingPartyIdPredicate.class);
+ Assert.assertTrue(testCandidate(bean, "Single"));
+ Assert.assertTrue(testCandidate(bean, "Double"));
+ Assert.assertFalse(testCandidate(bean, "Elephant"));
+
+ bean = context.getBean("pred_0", RelyingPartyIdPredicate.class);
+ Assert.assertTrue(testCandidate(bean, "Single"));
+ Assert.assertTrue(testCandidate(bean, "Double"));
+ Assert.assertTrue(testCandidate(bean, "Elephant"));
+ }
+ }
+
+ private boolean testCandidate(final RelyingPartyIdPredicate rpIdPredicate, final String rpId) {
+ final ProfileRequestContext prc = new ProfileRequestContext();
+ final RelyingPartyContext rpc = prc.getSubcontext(RelyingPartyContext.class, true);
+ assert rpc != null;
+ rpc.setRelyingPartyId(rpId);
+ return rpIdPredicate.test(prc);
+ }
+
+}
\ No newline at end of file
diff --git a/shib-profile-api/src/test/resources/net/shibboleth/profile/logic/relyingPartyIdPredicates.xml b/shib-profile-api/src/test/resources/net/shibboleth/profile/logic/relyingPartyIdPredicates.xml
new file mode 100644
index 0000000..811b4cb
--- /dev/null
+++ b/shib-profile-api/src/test/resources/net/shibboleth/profile/logic/relyingPartyIdPredicates.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:util="http://www.springframework.org/schema/util" xmlns:c="http://www.springframework.org/schema/c" xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">
+
+ <!-- This bean MUST be called "conversionService" to work properly. -->
+ <bean id="conversionService" class="org.springframework.context.support.ConversionServiceFactoryBean">
+ <property name="converters">
+ <set>
+ <bean class="net.shibboleth.shared.spring.config.StringToIPRangeConverter" />
+ <bean class="net.shibboleth.shared.spring.config.BooleanToPredicateConverter" />
+ <bean class="net.shibboleth.shared.spring.config.StringBooleanToPredicateConverter" />
+ <bean class="net.shibboleth.shared.spring.config.StringToResourceConverter" />
+ </set>
+ </property>
+ </bean>
+
+ <bean class="net.shibboleth.profile.logic.RelyingPartyIdPredicate" id="candidate" c:candidate="Single"/>
+
+ <bean class="net.shibboleth.profile.logic.RelyingPartyIdPredicate" id="candidates" c:candidates="#{ {'Single', 'Double'} }"/>
+
+ <bean class="net.shibboleth.profile.logic.RelyingPartyIdPredicate" id="pred" c:pred="true"/>
+
+ <bean class="net.shibboleth.profile.logic.RelyingPartyIdPredicate" id="candidate_0" c:candidate="Single"/>
+
+ <bean class="net.shibboleth.profile.logic.RelyingPartyIdPredicate" id="candidates_0" c:candidates="#{ {'Single', 'Double'} }"/>
+
+ <bean class="net.shibboleth.profile.logic.RelyingPartyIdPredicate" id="pred_0" c:pred="true"/>
+
+</beans>
+
\ No newline at end of file
diff --git a/shib-profile-impl/pom.xml b/shib-profile-impl/pom.xml
index 6c2c320..ddd234d 100644
--- a/shib-profile-impl/pom.xml
+++ b/shib-profile-impl/pom.xml
@@ -28,6 +28,11 @@
<version>${project.version}</version>
</dependency>
+ <dependency>
+ <groupId>${project.groupId}</groupId>
+ <artifactId>shib-attribute-api</artifactId>
+ </dependency>
+
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>shib-metadata-spring</artifactId>
diff --git a/shib-profile-impl/src/main/java/net/shibboleth/profile/logic/impl/RelyingPartiesActivationConditionFactory.java b/shib-profile-impl/src/main/java/net/shibboleth/profile/logic/impl/RelyingPartiesActivationConditionFactory.java
new file mode 100644
index 0000000..e6ca28c
--- /dev/null
+++ b/shib-profile-impl/src/main/java/net/shibboleth/profile/logic/impl/RelyingPartiesActivationConditionFactory.java
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.profile.logic.impl;
+
+import java.util.Collection;
+import java.util.Map;
+import java.util.function.Function;
+import java.util.function.Predicate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+
+import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
+import net.shibboleth.profile.logic.RelyingPartyIdPredicate;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
+
+/**
+ * Factory function for manufacturing activation conditions based on
+ * {@link AttributeTranscoderRegistry#PROP_RELYINGPARTIES}.
+ *
+ * @since 5.0.0
+ */
+public class RelyingPartiesActivationConditionFactory
+ implements Function<Map<String,Object>,Predicate<ProfileRequestContext>> {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(RelyingPartiesActivationConditionFactory.class);
+
+ /** {@inheritDoc} */
+ @SuppressWarnings("unchecked")
+ @Nullable public Predicate<ProfileRequestContext> apply(@Nullable final Map<String,Object> rule) {
+ if (rule == null) {
+ return null;
+ }
+
+ final Object relyingParties = rule.get(AttributeTranscoderRegistry.PROP_RELYINGPARTIES);
+
+ if (relyingParties instanceof Collection) {
+ return new RelyingPartyIdPredicate((Collection<String>) relyingParties);
+ } else if (relyingParties instanceof String) {
+ final Collection<String> parsed = StringSupport.normalizeStringCollection(
+ StringSupport.stringToList((String) relyingParties, " "));
+ return new RelyingPartyIdPredicate(parsed);
+ } else if (relyingParties != null) {
+ log.error("{} property did not contain a Collection or String, ignored",
+ AttributeTranscoderRegistry.PROP_RELYINGPARTIES);
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-profile-impl/src/main/java/net/shibboleth/profile/logic/impl/package-info.java b/shib-profile-impl/src/main/java/net/shibboleth/profile/logic/impl/package-info.java
new file mode 100644
index 0000000..85190d0
--- /dev/null
+++ b/shib-profile-impl/src/main/java/net/shibboleth/profile/logic/impl/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Implementation classes supporting profile predicates.
+ */
+package net.shibboleth.profile.logic.impl;
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list