[java-shib-profile] branch main updated: JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
Scott Cantor
cantor.2 at osu.edu
Thu Feb 16 18:04:26 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-shib-profile.
View the commit online:
http://git.shibboleth.net/view/?p=java-shib-profile.git;a=commit;h=c36bdf01d35850734a2b4bb8b06e1b6f1e0b0dae
The following commit(s) were added to refs/heads/main by this push:
new c36bdf0 JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
c36bdf0 is described below
commit c36bdf01d35850734a2b4bb8b06e1b6f1e0b0dae
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Feb 16 13:04:24 2023 -0500
JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
https://shibboleth.atlassian.net/browse/JSPROF-1
Create new SAML 2 profile interfaces and move in lookup
functions/conditions.
---
.../SAMLMetadataContextLookupFunction.java | 51 ++++++++
.../context/navigate/messaging/package-info.java | 21 +++
.../config/BrowserSSOProfileConfiguration.java | 141 +++++++++++++++++++++
.../profile/config/SAML2ProfileConfiguration.java | 81 ++++++++++++
.../config/SingleLogoutProfileConfiguration.java | 76 +++++++++++
.../config/logic/CheckAddressPredicate.java | 53 ++++++++
.../logic/IgnoreRequestSignaturesPredicate.java | 57 +++++++++
.../ClientTLSSOAPLogoutRequestsPredicate.java | 46 +++++++
.../messaging/SignSOAPLogoutRequestsPredicate.java | 46 +++++++
.../config/logic/messaging/package-info.java | 21 +++
.../saml2/profile/config/logic/package-info.java | 21 +++
.../MaximumTimeSinceAuthnLookupFunction.java | 53 ++++++++
.../config/navigate/ProxyCountLookupFunction.java | 51 ++++++++
.../QualifiedNameIDFormatsLookupFunction.java | 62 +++++++++
.../profile/config/navigate/package-info.java | 21 +++
.../saml/saml2/profile/config/package-info.java | 21 +++
16 files changed, 822 insertions(+)
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/context/navigate/messaging/SAMLMetadataContextLookupFunction.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/context/navigate/messaging/SAMLMetadataContextLookupFunction.java
new file mode 100644
index 0000000..9f0f6ef
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/context/navigate/messaging/SAMLMetadataContextLookupFunction.java
@@ -0,0 +1,51 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.profile.context.navigate.messaging;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.messaging.AbstractRelyingPartyLookupFunction;
+
+import org.opensaml.messaging.context.BaseContext;
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
+
+/**
+ * A function to access a {@link SAMLMetadataContext} underlying a {@link RelyingPartyContext} located via a
+ * lookup function.
+ */
+public class SAMLMetadataContextLookupFunction extends AbstractRelyingPartyLookupFunction<SAMLMetadataContext> {
+
+ /** {@inheritDoc} */
+ @Nullable public SAMLMetadataContext apply(@Nullable final MessageContext input) {
+ final RelyingPartyContext rpCtx = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpCtx != null) {
+ final BaseContext peer = rpCtx.getRelyingPartyIdContextTree();
+ if (peer != null) {
+ if (peer instanceof SAMLMetadataContext) {
+ return (SAMLMetadataContext) peer;
+ }
+ return peer.getSubcontext(SAMLMetadataContext.class);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/context/navigate/messaging/package-info.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/context/navigate/messaging/package-info.java
new file mode 100644
index 0000000..23a4899
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/context/navigate/messaging/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Functions for navigating SAML message context objects.
+ */
+package net.shibboleth.saml.profile.context.navigate.messaging;
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
new file mode 100644
index 0000000..e86de00
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -0,0 +1,141 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.saml2.profile.config;
+
+import java.time.Duration;
+import java.util.Collection;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.saml.profile.config.SAMLArtifactConsumerProfileConfiguration;
+import net.shibboleth.shared.annotation.constraint.NonNegative;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.saml2.core.AuthnContextComparisonTypeEnumeration;
+import org.opensaml.saml.saml2.core.SubjectLocality;
+import org.opensaml.saml.saml2.metadata.RequestedAttribute;
+
+/** Configuration for SAML 2.0 Browser SSO. */
+public interface BrowserSSOProfileConfiguration extends SAMLArtifactConsumerProfileConfiguration,
+ SAML2ProfileConfiguration {
+
+ /** ID for this profile configuration. */
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/sso/browser";
+
+ /** Bit constant for RequestedAuthnContext feature. */
+ public static final int FEATURE_AUTHNCONTEXT = 0x1;
+
+ /** Bit constant for Scoping feature. */
+ public static final int FEATURE_SCOPING = 0x2;
+
+ /** Bit constant for NameIDPolicy Format feature. */
+ public static final int FEATURE_NAMEIDFORMAT = 0x4;
+
+ /** Bit constant for NameIDPolicy SPNameQualifier feature. */
+ public static final int FEATURE_SPNAMEQUALIFIER = 0x8;
+
+ /** Bit constant for ForceAuthn feature. */
+ public static final int FEATURE_FORCEAUTHN = 0x10;
+
+ /**
+ * Get whether a fresh user presence proof should be required for this request.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return true iff a fresh user presence proof should be required for this request
+ */
+ boolean isForceAuthn(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether the client's address must match the address in an inbound {@link SubjectLocality}
+ * element during inbound SSO.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether to compare addresses
+ */
+ boolean isCheckAddress(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the maximum amount of time allowed to have elapsed since an incoming AuthnInstant.
+ *
+ * <p>A null or 0 is interpreted as an unlimited amount.</p>
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return max time since inbound AuthnInstant
+ */
+ @NonNegative @Nullable Duration getMaximumTimeSinceAuthn(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Gets the maximum number of times an assertion may be proxied to signal in the SAML request.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return maximum number of times an assertion may be proxied
+ */
+ @NonNegative @Nullable Integer getProxyCount(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the comparison operator to use when issuing SAML requests containing requested context classes.
+ *
+ * <p>The actual context(s) requested is left to IdP- and SP-specific interfaces because of the differences
+ * in representation.</p>
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return comparison value or null
+ */
+ @Nullable AuthnContextComparisonTypeEnumeration getAuthnContextComparison(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the SPNameQualifier to include in the SAML request.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return requested SPNameQualifier
+ */
+ @Nullable String getNameQualifier(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the AttributeConsumingServiceIndex to include in the SAML request.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return the AttributeConsumingServiceIndex
+ */
+ @Nullable String getAttributeIndex(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the list of {@link RequestedAttribute} objects to include in the SAML request (via extension).
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return the requested attributes
+ */
+ @Nonnull @NonnullElements @Unmodifiable @NotLive Collection<RequestedAttribute> getRequestedAttributes(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/SAML2ProfileConfiguration.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/SAML2ProfileConfiguration.java
new file mode 100644
index 0000000..2a08326
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/SAML2ProfileConfiguration.java
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.saml2.profile.config;
+
+import java.util.function.BiConsumer;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.saml2.core.RequestAbstractType;
+
+import net.shibboleth.saml.profile.config.SAMLProfileConfiguration;
+
+/**
+ * Base interface for SAML 2 profile configurations.
+ */
+public interface SAML2ProfileConfiguration extends SAMLProfileConfiguration {
+
+ /**
+ * Gets whether to bypass verification of request signatures.
+ *
+ * <p>This is typically of use to deal with broken services or to allow a
+ * signer's key to be bypassed in the event that it is managed improperly.</p>
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return true iff request signatures should be ignored
+ */
+ boolean isIgnoreRequestSignatures(@Nonnull final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Gets whether to ignore an inability to encrypt due to external factors.
+ *
+ * <p>This allows a deployer to signal that encryption is "best effort" and
+ * can be omitted if a relying party doesn't possess a key, support a compatible
+ * algorithm, etc.</p>
+ *
+ * <p>Defaults to false.</p>
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return true iff encryption should be treated as optional
+ */
+ boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Gets the predicate used to determine if name identifiers should be encrypted.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return predicate used to determine if name identifiers should be encrypted
+ */
+ boolean isEncryptNameIDs(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get a decorator for the SAML request.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return request decorator
+ */
+ @Nullable BiConsumer<ProfileRequestContext,? extends RequestAbstractType> getRequestDecorator(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/SingleLogoutProfileConfiguration.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/SingleLogoutProfileConfiguration.java
new file mode 100644
index 0000000..497808d
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/SingleLogoutProfileConfiguration.java
@@ -0,0 +1,76 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.saml2.profile.config;
+
+import java.util.Collection;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.saml.profile.config.SAMLArtifactConsumerProfileConfiguration;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+
+/** Configuration support for SAML 2 Single Logout. */
+public interface SingleLogoutProfileConfiguration extends SAML2ProfileConfiguration,
+ SAMLArtifactConsumerProfileConfiguration {
+
+ /** ID for this profile configuration. */
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/logout";
+
+ /**
+ * Get whether SOAP-based requests should be signed.
+ *
+ * @param messageContext current message context
+ *
+ * @return whether SOAP-based requests should be signed
+ */
+ boolean isSignSOAPRequests(@Nullable final MessageContext messageContext);
+
+ /**
+ * Get whether SOAP-based requests should use client TLS.
+ *
+ * @param messageContext current message context
+ *
+ * @return whether SOAP-based requests should use client TLS
+ */
+ boolean isClientTLSSOAPRequests(@Nullable final MessageContext messageContext);
+
+ /**
+ * Get a collection of {@link org.opensaml.saml.saml2.core.NameID} Format values for which the use of
+ * the NameQualifier and SPNameQualifier attributes is defined to allow default/implicit values
+ * derived from the asserting and relying parties.
+ *
+ * <p>In the core standard, only the {@link org.opensaml.saml.saml2.core.NameIDType#PERSISTENT} and
+ * {@link org.opensaml.saml.saml2.core.NameIDType#TRANSIENT} Formats are defined in this manner. This
+ * setting identifies <strong>additional</strong> Formats that should be handled in this way.</p>
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return additional Formats for which defaulting of qualifiers is permissable
+ *
+ * @since 3.4.0
+ */
+ @Nonnull @NonnullElements @NotLive Collection<String> getQualifiedNameIDFormats(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/CheckAddressPredicate.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/CheckAddressPredicate.java
new file mode 100644
index 0000000..405847e
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/CheckAddressPredicate.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.saml2.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * A predicate that evaluates a {@link ProfileRequestContext} and extracts the effective
+ * setting of {@link BrowserSSOProfileConfiguration#isCheckAddress(ProfileRequestContext)}.
+ *
+ * <p>Defaults to true.</p>
+ *
+ * @since 4.0.0
+ */
+public class CheckAddressPredicate extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ public boolean test(@Nullable final ProfileRequestContext input) {
+
+ final RelyingPartyContext rpc = getRelyingPartyContext(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof BrowserSSOProfileConfiguration) {
+ return ((BrowserSSOProfileConfiguration) pc).isCheckAddress(input);
+ }
+ }
+
+ return true;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/IgnoreRequestSignaturesPredicate.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/IgnoreRequestSignaturesPredicate.java
new file mode 100644
index 0000000..cfb9117
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/IgnoreRequestSignaturesPredicate.java
@@ -0,0 +1,57 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.saml2.profile.config.logic;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.saml.saml2.profile.config.SAML2ProfileConfiguration;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
+import org.slf4j.Logger;
+
+/** Predicate that decides whether to ignore a request signature. */
+public class IgnoreRequestSignaturesPredicate extends AbstractRelyingPartyPredicate {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(IgnoreRequestSignaturesPredicate.class);
+
+ /** {@inheritDoc} */
+ public boolean test(@Nullable final ProfileRequestContext input) {
+
+ final RelyingPartyContext rpCtx = getRelyingPartyContext(input);
+ if (input == null || rpCtx == null) {
+ log.debug("No RelyingPartyContext found, assuming signatures should be checked");
+ return false;
+ }
+
+ final ProfileConfiguration pc = rpCtx.getProfileConfig();
+ if (!(pc instanceof SAML2ProfileConfiguration)) {
+ log.debug("No SAML 2 profile configuration found, assuming signatures should be checked");
+ return false;
+ }
+
+ return ((SAML2ProfileConfiguration) pc).isIgnoreRequestSignatures(input);
+ }
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/messaging/ClientTLSSOAPLogoutRequestsPredicate.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/messaging/ClientTLSSOAPLogoutRequestsPredicate.java
new file mode 100644
index 0000000..98de07f
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/messaging/ClientTLSSOAPLogoutRequestsPredicate.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.saml2.profile.config.logic.messaging;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.messaging.AbstractRelyingPartyPredicate;
+import net.shibboleth.saml.saml2.profile.config.SingleLogoutProfileConfiguration;
+
+/** A predicate implementation that forwards to
+ * {@link SingleLogoutProfileConfiguration#isClientTLSSOAPRequests(MessageContext)}. */
+public class ClientTLSSOAPLogoutRequestsPredicate extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ public boolean test(@Nullable final MessageContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContext(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null && pc instanceof SingleLogoutProfileConfiguration) {
+ return ((SingleLogoutProfileConfiguration) pc).isClientTLSSOAPRequests(input);
+ }
+ }
+
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/messaging/SignSOAPLogoutRequestsPredicate.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/messaging/SignSOAPLogoutRequestsPredicate.java
new file mode 100644
index 0000000..654c2bf
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/messaging/SignSOAPLogoutRequestsPredicate.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.saml2.profile.config.logic.messaging;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.messaging.AbstractRelyingPartyPredicate;
+import net.shibboleth.saml.saml2.profile.config.SingleLogoutProfileConfiguration;
+
+/** A predicate implementation that forwards to
+ * {@link SingleLogoutProfileConfiguration#isSignSOAPRequests(MessageContext)}. */
+public class SignSOAPLogoutRequestsPredicate extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ public boolean test(@Nullable final MessageContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContext(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null && pc instanceof SingleLogoutProfileConfiguration) {
+ return ((SingleLogoutProfileConfiguration) pc).isSignSOAPRequests(input);
+ }
+ }
+
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/messaging/package-info.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/messaging/package-info.java
new file mode 100644
index 0000000..612aa45
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/messaging/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Predicates based on message contexts and SAML 2.0 profile configuration.
+ */
+package net.shibboleth.saml.saml2.profile.config.logic.messaging;
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/package-info.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/package-info.java
new file mode 100644
index 0000000..4ecf70d
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/logic/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Predicates based on SAML 2.0 profile configuration.
+ */
+package net.shibboleth.saml.saml2.profile.config.logic;
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/navigate/MaximumTimeSinceAuthnLookupFunction.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/navigate/MaximumTimeSinceAuthnLookupFunction.java
new file mode 100644
index 0000000..d475737
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/navigate/MaximumTimeSinceAuthnLookupFunction.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.saml2.profile.config.navigate;
+
+import java.time.Duration;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
+
+/**
+ * A function that returns {@link BrowserSSOProfileConfiguration#getMaximumTimeSinceAuthn(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class MaximumTimeSinceAuthnLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
+
+ /** {@inheritDoc} */
+ @Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null && pc instanceof BrowserSSOProfileConfiguration) {
+ return ((BrowserSSOProfileConfiguration) pc).getMaximumTimeSinceAuthn(input);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/navigate/ProxyCountLookupFunction.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/navigate/ProxyCountLookupFunction.java
new file mode 100644
index 0000000..fa2ea18
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/navigate/ProxyCountLookupFunction.java
@@ -0,0 +1,51 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.saml2.profile.config.navigate;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * A function that returns the allowable proxy count based on the result of
+ * {@link BrowserSSOProfileConfiguration#getProxyCount(ProfileRequestContext)},
+ * if such a profile is available
+ * from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ */
+public class ProxyCountLookupFunction extends AbstractRelyingPartyLookupFunction<Integer> {
+
+ /** {@inheritDoc} */
+ @Nullable public Integer apply(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof BrowserSSOProfileConfiguration) {
+ return ((BrowserSSOProfileConfiguration) pc).getProxyCount(input);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/navigate/QualifiedNameIDFormatsLookupFunction.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/navigate/QualifiedNameIDFormatsLookupFunction.java
new file mode 100644
index 0000000..0857c4b
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/navigate/QualifiedNameIDFormatsLookupFunction.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.saml2.profile.config.navigate;
+
+import java.util.Collection;
+import java.util.Collections;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.saml.saml2.profile.config.SingleLogoutProfileConfiguration;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * A function that returns the {@link org.opensaml.saml.saml2.core.NameID} Formats
+ * whose NameQualifier attributes should allow for defaulting based on the result of
+ * {@link SingleLogoutProfileConfiguration#getQualifiedNameIDFormats(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, no values are returned.</p>
+ *
+ * @since 3.4.0
+ */
+public class QualifiedNameIDFormatsLookupFunction extends AbstractRelyingPartyLookupFunction<Collection<String>> {
+
+ /** {@inheritDoc} */
+ @Nullable @NonnullElements @NotLive @Unmodifiable public Collection<String> apply(
+ @Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null && pc instanceof SingleLogoutProfileConfiguration) {
+ return ((SingleLogoutProfileConfiguration) pc).getQualifiedNameIDFormats(input);
+ }
+ }
+
+ return Collections.emptyList();
+ }
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/navigate/package-info.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/navigate/package-info.java
new file mode 100644
index 0000000..3416b15
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/navigate/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Functions that access SAML 2.0 profile configuration.
+ */
+package net.shibboleth.saml.saml2.profile.config.navigate;
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/package-info.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/package-info.java
new file mode 100644
index 0000000..9bbbc26
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * SAML 2.0 profile configuration classes.
+ */
+package net.shibboleth.saml.saml2.profile.config;
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list