[java-identity-provider] branch main updated: JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
Scott Cantor
cantor.2 at osu.edu
Thu Feb 16 18:08:00 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=8a5381b10e84513b519db73831e0080bc6f2b139
The following commit(s) were added to refs/heads/main by this push:
new 8a5381b10 JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
8a5381b10 is described below
commit 8a5381b10e84513b519db73831e0080bc6f2b139
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Feb 16 13:07:56 2023 -0500
JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
https://shibboleth.atlassian.net/browse/JSPROF-1
Slave IdP profiles to shared interfaces and move out supporting code.
Move some SSO-specific settings out of IdP's SAML 2 base interface.
---
.../shibboleth/idp/conf/relying-party-mddriven.xml | 14 +--
.../net/shibboleth/idp/conf/soap-client.xml | 4 +-
.../idp/flows/authn/saml-authn-beans.xml | 4 +-
.../shibboleth/idp/flows/saml/security-beans.xml | 2 +-
.../ClientTLSSOAPLogoutRequestsPredicate.java | 46 --------
.../messaging/SignSOAPLogoutRequestsPredicate.java | 46 --------
.../config/logic/messaging/package-info.java | 22 ----
.../QualifiedNameIDFormatsLookupFunction.java | 62 -----------
.../SAMLMetadataContextLookupFunction.java | 51 ---------
.../context/navigate/messaging/package-info.java | 22 ----
.../profile/config/SAML1ProfileConfiguration.java | 4 +-
.../config/AbstractSAML2ProfileConfiguration.java | 104 +++--------------
.../config/BrowserSSOProfileConfiguration.java | 123 +++++++++++++++++++--
.../profile/config/SAML2ProfileConfiguration.java | 67 +----------
.../config/SingleLogoutProfileConfiguration.java | 44 +-------
.../config/logic/CheckAddressPredicate.java | 53 ---------
.../logic/IgnoreRequestSignaturesPredicate.java | 57 ----------
.../MaximumTimeSinceAuthnLookupFunction.java | 53 ---------
.../config/navigate/ProxyCountLookupFunction.java | 53 ---------
.../navigate/ProxyRestrictionLookupFunction.java | 8 +-
.../AbstractSAML2ProfileConfigurationTest.java | 59 ----------
.../config/BrowserSSOProfileConfigurationTest.java | 55 +++++++++
.../impl/InitializeAuthenticationContext.java | 2 +-
.../saml2/profile/impl/ProcessLogoutRequest.java | 2 +-
24 files changed, 210 insertions(+), 747 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
index 3f25e5305..17f89ee50 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
@@ -84,7 +84,7 @@
<bean class="org.opensaml.saml.common.messaging.context.navigate.EntityDescriptorLookupFunction" />
</constructor-arg>
<constructor-arg name="f">
- <bean class="net.shibboleth.idp.saml.profile.context.navigate.messaging.SAMLMetadataContextLookupFunction" />
+ <bean class="net.shibboleth.saml.profile.context.navigate.messaging.SAMLMetadataContextLookupFunction" />
</constructor-arg>
</bean>
@@ -219,12 +219,6 @@
<constructor-arg value="false" />
</bean>
</property>
- <property name="proxyCountLookupStrategy">
- <bean parent="shibboleth.MDDrivenIntProperty" p:propertyName="proxyCount" />
- </property>
- <property name="proxyAudiencesLookupStrategy">
- <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="proxyAudiences" />
- </property>
</bean>
<bean id="AbstractMDDrivenCASProfile" parent="AbstractMDDrivenProfile" abstract="true">
@@ -427,6 +421,12 @@
<constructor-arg value="false" />
</bean>
</property>
+ <property name="proxyCountLookupStrategy">
+ <bean parent="shibboleth.MDDrivenIntProperty" p:propertyName="proxyCount" />
+ </property>
+ <property name="proxyAudiencesLookupStrategy">
+ <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="proxyAudiences" />
+ </property>
<property name="proxiedAuthnInstantPredicate">
<bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/soap-client.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/soap-client.xml
index e840c4163..312b0b819 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/soap-client.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/soap-client.xml
@@ -199,7 +199,7 @@
<bean class="net.shibboleth.saml.profile.config.logic.messaging.ClientTLSArtifactRequestsPredicate" />
</entry>
<entry key="SAML2.Logout">
- <bean class="net.shibboleth.idp.saml.profile.config.logic.messaging.ClientTLSSOAPLogoutRequestsPredicate" />
+ <bean class="net.shibboleth.saml.saml2.profile.config.logic.messaging.ClientTLSSOAPLogoutRequestsPredicate" />
</entry>
</map>
</constructor-arg>
@@ -213,7 +213,7 @@
<bean class="net.shibboleth.saml.profile.config.logic.messaging.SignArtifactRequestsPredicate" />
</entry>
<entry key="SAML2.Logout">
- <bean class="net.shibboleth.idp.saml.profile.config.logic.messaging.SignSOAPLogoutRequestsPredicate" />
+ <bean class="net.shibboleth.saml.saml2.profile.config.logic.messaging.SignSOAPLogoutRequestsPredicate" />
</entry>
</map>
</constructor-arg>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
index 10e071749..4ba564d83 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
@@ -386,10 +386,10 @@
<property name="clockSkew" value="%{idp.policy.clockSkew:PT3M}" />
<property name="lifetime" value="%{idp.policy.assertionLifetime:PT3M}" />
<property name="checkAddress">
- <bean class="net.shibboleth.idp.saml.saml2.profile.config.logic.CheckAddressPredicate" />
+ <bean class="net.shibboleth.saml.saml2.profile.config.logic.CheckAddressPredicate" />
</property>
<property name="maximumTimeSinceAuthn">
- <bean class="net.shibboleth.idp.saml.saml2.profile.config.navigate.MaximumTimeSinceAuthnLookupFunction" />
+ <bean class="net.shibboleth.saml.saml2.profile.config.navigate.MaximumTimeSinceAuthnLookupFunction" />
</property>
<property name="additionalAudiences">
<bean class="net.shibboleth.idp.saml.profile.config.navigate.AdditionalAudiencesForAssertionLookupFunction" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/security-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/security-beans.xml
index 3d414c7da..bfeeb5abd 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/security-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/security-beans.xml
@@ -117,7 +117,7 @@
<bean id="NotIgnoreRequestSignaturesPredicate" parent="shibboleth.Conditions.NOT">
<constructor-arg>
- <bean class="net.shibboleth.idp.saml.saml2.profile.config.logic.IgnoreRequestSignaturesPredicate" />
+ <bean class="net.shibboleth.saml.saml2.profile.config.logic.IgnoreRequestSignaturesPredicate" />
</constructor-arg>
</bean>
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/messaging/ClientTLSSOAPLogoutRequestsPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/messaging/ClientTLSSOAPLogoutRequestsPredicate.java
deleted file mode 100644
index dff7c30c8..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/messaging/ClientTLSSOAPLogoutRequestsPredicate.java
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.profile.config.logic.messaging;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.MessageContext;
-
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.logic.messaging.AbstractRelyingPartyPredicate;
-import net.shibboleth.idp.saml.saml2.profile.config.SingleLogoutProfileConfiguration;
-
-/** A predicate implementation that forwards to
- * {@link SingleLogoutProfileConfiguration#isClientTLSSOAPRequests(MessageContext)}. */
-public class ClientTLSSOAPLogoutRequestsPredicate extends AbstractRelyingPartyPredicate {
-
- /** {@inheritDoc} */
- public boolean test(@Nullable final MessageContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContext(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof SingleLogoutProfileConfiguration) {
- return ((SingleLogoutProfileConfiguration) pc).isClientTLSSOAPRequests(input);
- }
- }
-
- return false;
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/messaging/SignSOAPLogoutRequestsPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/messaging/SignSOAPLogoutRequestsPredicate.java
deleted file mode 100644
index 25ff2a7de..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/messaging/SignSOAPLogoutRequestsPredicate.java
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.profile.config.logic.messaging;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.MessageContext;
-
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.logic.messaging.AbstractRelyingPartyPredicate;
-import net.shibboleth.idp.saml.saml2.profile.config.SingleLogoutProfileConfiguration;
-
-/** A predicate implementation that forwards to
- * {@link SingleLogoutProfileConfiguration#isSignSOAPRequests(MessageContext)}. */
-public class SignSOAPLogoutRequestsPredicate extends AbstractRelyingPartyPredicate {
-
- /** {@inheritDoc} */
- public boolean test(@Nullable final MessageContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContext(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof SingleLogoutProfileConfiguration) {
- return ((SingleLogoutProfileConfiguration) pc).isSignSOAPRequests(input);
- }
- }
-
- return false;
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/messaging/package-info.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/messaging/package-info.java
deleted file mode 100644
index 57014f50a..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/messaging/package-info.java
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Implementations of logic/conditional SAML profile configuration components.
- */
-
-package net.shibboleth.idp.saml.profile.config.logic.messaging;
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/QualifiedNameIDFormatsLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/QualifiedNameIDFormatsLookupFunction.java
deleted file mode 100644
index f27061873..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/QualifiedNameIDFormatsLookupFunction.java
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.profile.config.navigate;
-
-import java.util.Collection;
-import java.util.Collections;
-
-import javax.annotation.Nullable;
-
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.idp.saml.saml2.profile.config.SingleLogoutProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-/**
- * A function that returns the {@link org.opensaml.saml.saml2.core.NameID} Formats
- * whose NameQualifier attributes should allow for defaulting based on the result of
- * {@link SingleLogoutProfileConfiguration#getQualifiedNameIDFormats(ProfileRequestContext)}
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
- * by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, no values are returned.</p>
- *
- * @since 3.4.0
- */
-public class QualifiedNameIDFormatsLookupFunction extends AbstractRelyingPartyLookupFunction<Collection<String>> {
-
- /** {@inheritDoc} */
- @Nullable @NonnullElements @NotLive @Unmodifiable public Collection<String> apply(
- @Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof SingleLogoutProfileConfiguration) {
- return ((SingleLogoutProfileConfiguration) pc).getQualifiedNameIDFormats(input);
- }
- }
-
- return Collections.emptyList();
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/context/navigate/messaging/SAMLMetadataContextLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/context/navigate/messaging/SAMLMetadataContextLookupFunction.java
deleted file mode 100644
index 812534716..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/context/navigate/messaging/SAMLMetadataContextLookupFunction.java
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.profile.context.navigate.messaging;
-
-import javax.annotation.Nullable;
-
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.messaging.AbstractRelyingPartyLookupFunction;
-
-import org.opensaml.messaging.context.BaseContext;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
-
-/**
- * A function to access a {@link SAMLMetadataContext} underlying a {@link RelyingPartyContext} located via a
- * lookup function.
- */
-public class SAMLMetadataContextLookupFunction extends AbstractRelyingPartyLookupFunction<SAMLMetadataContext> {
-
- /** {@inheritDoc} */
- @Nullable public SAMLMetadataContext apply(@Nullable final MessageContext input) {
- final RelyingPartyContext rpCtx = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpCtx != null) {
- final BaseContext peer = rpCtx.getRelyingPartyIdContextTree();
- if (peer != null) {
- if (peer instanceof SAMLMetadataContext) {
- return (SAMLMetadataContext) peer;
- }
- return peer.getSubcontext(SAMLMetadataContext.class);
- }
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/context/navigate/messaging/package-info.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/context/navigate/messaging/package-info.java
deleted file mode 100644
index 1ea1c075b..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/context/navigate/messaging/package-info.java
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Functions for navigating SAML message context objects.
- */
-
-package net.shibboleth.idp.saml.profile.context.navigate.messaging;
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/SAML1ProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/SAML1ProfileConfiguration.java
index 7bf9d0f5b..43a97fcb1 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/SAML1ProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/SAML1ProfileConfiguration.java
@@ -17,9 +17,11 @@
package net.shibboleth.idp.saml.saml1.profile.config;
+import net.shibboleth.idp.saml.profile.config.SAMLProfileConfiguration;
+
/**
* Marker interface for SAML 1.x profile configuration interfaces, currently empty.
*/
-public interface SAML1ProfileConfiguration {
+public interface SAML1ProfileConfiguration extends SAMLProfileConfiguration {
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java
index 085e728dc..5e2fe695e 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java
@@ -17,28 +17,19 @@
package net.shibboleth.idp.saml.saml2.profile.config;
-import java.util.Collection;
-import java.util.List;
-import java.util.Set;
-import java.util.function.Function;
+import java.util.function.BiConsumer;
import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.idp.saml.profile.config.AbstractSAMLProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonNegative;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.logic.PredicateSupport;
-import net.shibboleth.shared.primitive.StringSupport;
import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.saml2.core.RequestAbstractType;
/** Base class for SAML 2 profile configurations. */
public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProfileConfiguration implements
@@ -59,12 +50,6 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
/** Predicate used to determine if attributes should be encrypted. */
@Nonnull private Predicate<ProfileRequestContext> encryptAttributesPredicate;
- /** Lookup function to supply proxyCount property. */
- @Nonnull private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy;
-
- /** Lookup function to supply proxy audiences. */
- @Nonnull private Function<ProfileRequestContext,Collection<String>> proxyAudiencesLookupStrategy;
-
/**
* Constructor.
*
@@ -78,76 +63,6 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
encryptAssertionsPredicate = PredicateSupport.alwaysFalse();
encryptNameIDsPredicate = PredicateSupport.alwaysFalse();
encryptAttributesPredicate = PredicateSupport.alwaysFalse();
- proxyCountLookupStrategy = FunctionSupport.constant(null);
- proxyAudiencesLookupStrategy = FunctionSupport.constant(null);
- }
-
- /** {@inheritDoc} */
- @Nullable public Integer getProxyCount(@Nullable final ProfileRequestContext profileRequestContext) {
- final Integer count = proxyCountLookupStrategy.apply(profileRequestContext);
- if (count != null) {
- Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
- }
- return count;
- }
-
- /**
- * Set the maximum number of times an assertion may be proxied.
- *
- * @param count maximum number of times an assertion may be proxied
- */
- public void setProxyCount(@Nullable @NonNegative final Integer count) {
- if (count != null) {
- Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
- }
- proxyCountLookupStrategy = FunctionSupport.constant(count);
- }
-
- /**
- * Set a lookup strategy for the maximum number of times an assertion may be proxied.
- *
- * @param strategy lookup strategy
- *
- * @since 3.3.0
- */
- public void setProxyCountLookupStrategy(@Nonnull final Function<ProfileRequestContext,Integer> strategy) {
- proxyCountLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getProxyAudiences(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Collection<String> audiences = proxyAudiencesLookupStrategy.apply(profileRequestContext);
- if (audiences != null) {
- return Set.copyOf(audiences);
- }
- return CollectionSupport.emptySet();
- }
-
- /**
- * Set the proxy audiences to be added to responses.
- *
- * @param audiences proxy audiences to be added to responses
- */
- public void setProxyAudiences(@Nullable @NonnullElements final Collection<String> audiences) {
- if (audiences == null || audiences.isEmpty()) {
- proxyAudiencesLookupStrategy = FunctionSupport.constant(null);
- } else {
- proxyAudiencesLookupStrategy = FunctionSupport.constant(
- List.copyOf(StringSupport.normalizeStringCollection(audiences)));
- }
- }
-
- /**
- * Set a lookup strategy for the proxy audiences to be added to responses.
- *
- * @param strategy lookup strategy
- *
- * @since 3.3.0
- */
- public void setProxyAudiencesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
- proxyAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
/** {@inheritDoc} */
@@ -276,5 +191,18 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
public void setEncryptAttributesPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
encryptAttributesPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
}
-
+
+ /**
+ * Get a decorator for the SAML request.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return request decorator
+ */
+ @Nullable public BiConsumer<ProfileRequestContext,? extends RequestAbstractType> getRequestDecorator(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ // TODO: implement this feature....
+ return null;
+ }
+
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index 01912a710..a4548c15e 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -52,22 +52,15 @@ import org.opensaml.saml.saml2.core.AuthenticatingAuthority;
import org.opensaml.saml.saml2.core.AuthnContext;
import org.opensaml.saml.saml2.core.AuthnContextComparisonTypeEnumeration;
import org.opensaml.saml.saml2.core.SubjectLocality;
+import org.opensaml.saml.saml2.metadata.RequestedAttribute;
-/** Configuration support for SAML 2 Browser SSO. */
+/** Configuration support for IdP and proxied SAML 2.0 Browser SSO. */
public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwareProfileConfiguration
- implements AuthenticationProfileConfiguration, AttributeResolvingProfileConfiguration {
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/sso/browser";
+ implements AuthenticationProfileConfiguration, AttributeResolvingProfileConfiguration,
+ net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration{
/** Default maximum delegation chain length. */
@Nonnull public static final Long DEFAULT_DELEGATION_CHAIN_LENGTH = 1L;
-
- /** Bit constant for RequestedAuthnContext feature. */
- public static final int FEATURE_AUTHNCONTEXT = 0x1;
-
- /** Bit constant for Scoping feature. */
- public static final int FEATURE_SCOPING = 0x2;
/** Whether attributes should be resolved in the course of the profile. */
@Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
@@ -87,6 +80,12 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
/** Whether the response endpoint should be validated if the request is signed. */
@Nonnull private Predicate<ProfileRequestContext> skipEndpointValidationWhenSignedPredicate;
+ /** Lookup function to supply proxyCount property. */
+ @Nonnull private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy;
+
+ /** Lookup function to supply proxy audiences. */
+ @Nonnull private Function<ProfileRequestContext,Collection<String>> proxyAudiencesLookupStrategy;
+
/** Whether authentication results should carry the proxied AuthnInstant. */
@Nonnull private Predicate<ProfileRequestContext> proxiedAuthnInstantPredicate;
@@ -156,6 +155,8 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
forceAuthnPredicate = new ProxyAwareForceAuthnPredicate();
checkAddressPredicate = PredicateSupport.alwaysTrue();
skipEndpointValidationWhenSignedPredicate = PredicateSupport.alwaysFalse();
+ proxyCountLookupStrategy = FunctionSupport.constant(null);
+ proxyAudiencesLookupStrategy = FunctionSupport.constant(null);
proxiedAuthnInstantPredicate = PredicateSupport.alwaysTrue();
suppressAuthenticatingAuthorityPredicate = PredicateSupport.alwaysFalse();
requireSignedRequestsPredicate = PredicateSupport.alwaysFalse();
@@ -362,6 +363,82 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
skipEndpointValidationWhenSignedPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /**
+ * Gets the maximum number of times an assertion may be proxied.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return maximum number of times an assertion may be proxied
+ */
+ @Nullable public Integer getProxyCount(@Nullable final ProfileRequestContext profileRequestContext) {
+ final Integer count = proxyCountLookupStrategy.apply(profileRequestContext);
+ if (count != null) {
+ Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
+ }
+ return count;
+ }
+
+ /**
+ * Set the maximum number of times an assertion may be proxied.
+ *
+ * @param count maximum number of times an assertion may be proxied
+ */
+ public void setProxyCount(@Nullable @NonNegative final Integer count) {
+ if (count != null) {
+ Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
+ }
+ proxyCountLookupStrategy = FunctionSupport.constant(count);
+ }
+
+ /**
+ * Set a lookup strategy for the maximum number of times an assertion may be proxied.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setProxyCountLookupStrategy(@Nonnull final Function<ProfileRequestContext,Integer> strategy) {
+ proxyCountLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
+ * Gets the unmodifiable collection of audiences for a proxied assertion.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return audiences for a proxied assertion
+ */
+ @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getProxyAudiences(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ final Collection<String> audiences = proxyAudiencesLookupStrategy.apply(profileRequestContext);
+ if (audiences != null) {
+ return CollectionSupport.copyToSet(audiences);
+ }
+ return CollectionSupport.emptySet();
+ }
+
+ /**
+ * Set the proxy audiences to be added to responses.
+ *
+ * @param audiences proxy audiences to be added to responses
+ */
+ public void setProxyAudiences(@Nullable @NonnullElements final Collection<String> audiences) {
+ if (audiences == null || audiences.isEmpty()) {
+ proxyAudiencesLookupStrategy = FunctionSupport.constant(null);
+ } else {
+ proxyAudiencesLookupStrategy = FunctionSupport.constant(
+ List.copyOf(StringSupport.normalizeStringCollection(audiences)));
+ }
+ }
+
+ /**
+ * Set a lookup strategy for the proxy audiences to be added to responses.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setProxyAudiencesLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
+ proxyAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
/**
* Gets whether to suppress inclusion of {@link AuthenticatingAuthority} element.
*
@@ -527,7 +604,8 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
*
* @since 4.0.0
*/
- @Nullable public Duration getMaximumTimeSinceAuthn(@Nullable final ProfileRequestContext profileRequestContext) {
+ @NonNegative @Nullable public Duration getMaximumTimeSinceAuthn(
+ @Nullable final ProfileRequestContext profileRequestContext) {
final Duration amount = maximumTimeSinceAuthnLookupStrategy.apply(profileRequestContext);
Constraint.isFalse(amount != null && amount.isNegative(),
"Maximum time since authentication must be greater than or equal to 0");
@@ -951,4 +1029,25 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwarePr
nameIDFormatPrecedenceLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ @Nullable
+ public String getNameQualifier(@Nullable final ProfileRequestContext profileRequestContext) {
+ // TODO Auto-generated method stub
+ return null;
+ }
+
+ /** {@inheritDoc} */
+ @Nullable
+ public String getAttributeIndex(@Nullable final ProfileRequestContext profileRequestContext) {
+ // TODO Auto-generated method stub
+ return null;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public Collection<RequestedAttribute> getRequestedAttributes(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ // TODO Auto-generated method stub
+ return CollectionSupport.emptyList();
+ }
+
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
index adb292491..af6231c72 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
@@ -17,70 +17,14 @@
package net.shibboleth.idp.saml.saml2.profile.config;
-import java.util.Set;
-
-import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
-import net.shibboleth.shared.annotation.constraint.NonNegative;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-
/**
* Base interface for SAML 2 profile configurations.
*/
-public interface SAML2ProfileConfiguration {
-
- /**
- * Gets the maximum number of times an assertion may be proxied.
- *
- * @param profileRequestContext current profile request context
- *
- * @return maximum number of times an assertion may be proxied
- */
- @NonNegative @Nullable Integer getProxyCount(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Gets the unmodifiable collection of audiences for a proxied assertion.
- *
- * @param profileRequestContext current profile request context
- *
- * @return audiences for a proxied assertion
- */
- @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getProxyAudiences(
- @Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Gets whether to bypass verification of request signatures.
- *
- * <p>This is typically of use to deal with broken services or to allow a
- * signer's key to be bypassed in the event that it is managed improperly.</p>
- *
- * @param profileRequestContext current profile request context
- *
- * @return true iff request signatures should be ignored
- *
- * @since 4.0.0
- */
- boolean isIgnoreRequestSignatures(@Nonnull final ProfileRequestContext profileRequestContext);
-
- /**
- * Gets whether to ignore an inability to encrypt due to external factors.
- *
- * <p>This allows a deployer to signal that encryption is "best effort" and
- * can be omitted if a relying party doesn't possess a key, support a compatible
- * algorithm, etc.</p>
- *
- * <p>Defaults to false.</p>
- *
- * @param profileRequestContext current profile request context
- *
- * @return true iff encryption should be treated as optional
- */
- boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext);
+public interface SAML2ProfileConfiguration extends net.shibboleth.saml.saml2.profile.config.SAML2ProfileConfiguration {
/**
* Gets the predicate used to determine if assertions should be encrypted.
@@ -91,15 +35,6 @@ public interface SAML2ProfileConfiguration {
*/
boolean isEncryptAssertions(@Nullable final ProfileRequestContext profileRequestContext);
- /**
- * Gets the predicate used to determine if name identifiers should be encrypted.
- *
- * @param profileRequestContext current profile request context
- *
- * @return predicate used to determine if name identifiers should be encrypted
- */
- boolean isEncryptNameIDs(@Nullable final ProfileRequestContext profileRequestContext);
-
/**
* Gets the predicate used to determine if attributes should be encrypted.
*
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfiguration.java
index c4d782367..890a40126 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SingleLogoutProfileConfiguration.java
@@ -39,11 +39,9 @@ import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.primitive.StringSupport;
-/** Configuration support for SAML 2 Single Logout. */
-public class SingleLogoutProfileConfiguration extends AbstractSAML2ArtifactAwareProfileConfiguration {
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/logout";
+/** Configuration support for IdP SAML 2 Single Logout. */
+public class SingleLogoutProfileConfiguration extends AbstractSAML2ArtifactAwareProfileConfiguration
+ implements net.shibboleth.saml.saml2.profile.config.SingleLogoutProfileConfiguration {
/** Predicate used to determine if SOAP-based requests should be signed. */
@Nonnull private Predicate<MessageContext> signSOAPRequestsPredicate;
@@ -76,15 +74,7 @@ public class SingleLogoutProfileConfiguration extends AbstractSAML2ArtifactAware
qualifiedNameIDFormatsLookupStrategy = FunctionSupport.constant(null);
}
- /**
- * Get whether SOAP-based requests should be signed.
- *
- * @param messageContext current message context
- *
- * @return whether SOAP-based requests should be signed
- *
- * @since 4.0.0
- */
+ /** {@inheritDoc} */
public boolean isSignSOAPRequests(@Nullable final MessageContext messageContext) {
return signSOAPRequestsPredicate.test(messageContext);
}
@@ -112,15 +102,7 @@ public class SingleLogoutProfileConfiguration extends AbstractSAML2ArtifactAware
"Predicate used to determine SOAP-based signing cannot be null");
}
- /**
- * Get whether SOAP-based requests should use client TLS.
- *
- * @param messageContext current message context
- *
- * @return whether SOAP-based requests should use client TLS
- *
- * @since 4.0.0
- */
+ /** {@inheritDoc} */
public boolean isClientTLSSOAPRequests(@Nullable final MessageContext messageContext) {
return clientTLSSOAPRequestsPredicate.test(messageContext);
}
@@ -148,21 +130,7 @@ public class SingleLogoutProfileConfiguration extends AbstractSAML2ArtifactAware
"Predicate used to determine SOAP-based client TLS use cannot be null");
}
- /**
- * Get a collection of {@link org.opensaml.saml.saml2.core.NameID} Format values for which the use of
- * the NameQualifier and SPNameQualifier attributes is defined to allow default/implicit values
- * derived from the asserting and relying parties.
- *
- * <p>In the core standard, only the {@link org.opensaml.saml.saml2.core.NameIDType#PERSISTENT} and
- * {@link org.opensaml.saml.saml2.core.NameIDType#TRANSIENT} Formats are defined in this manner. This
- * setting identifies <strong>additional</strong> Formats that should be handled in this way.</p>
- *
- * @param profileRequestContext current profile request context
- *
- * @return additional Formats for which defaulting of qualifiers is permissable
- *
- * @since 3.4.0
- */
+ /** {@inheritDoc} */
@Nonnull @NonnullElements @NotLive public Collection<String> getQualifiedNameIDFormats(
@Nullable final ProfileRequestContext profileRequestContext) {
final Collection<String> formats = qualifiedNameIDFormatsLookupStrategy.apply(profileRequestContext);
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/CheckAddressPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/CheckAddressPredicate.java
deleted file mode 100644
index 042593796..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/CheckAddressPredicate.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.config.logic;
-
-import javax.annotation.Nullable;
-
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-/**
- * A predicate that evaluates a {@link ProfileRequestContext} and extracts the effective
- * setting of {@link BrowserSSOProfileConfiguration#isCheckAddress(ProfileRequestContext)}.
- *
- * <p>Defaults to true.</p>
- *
- * @since 4.0.0
- */
-public class CheckAddressPredicate extends AbstractRelyingPartyPredicate {
-
- /** {@inheritDoc} */
- public boolean test(@Nullable final ProfileRequestContext input) {
-
- final RelyingPartyContext rpc = getRelyingPartyContext(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof BrowserSSOProfileConfiguration) {
- return ((BrowserSSOProfileConfiguration) pc).isCheckAddress(input);
- }
- }
-
- return true;
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/IgnoreRequestSignaturesPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/IgnoreRequestSignaturesPredicate.java
deleted file mode 100644
index f4d9d6296..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/IgnoreRequestSignaturesPredicate.java
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.config.logic;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.idp.saml.saml2.profile.config.SAML2ProfileConfiguration;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-import org.slf4j.Logger;
-
-/** Predicate that decides whether to ignore a request signature. */
-public class IgnoreRequestSignaturesPredicate extends AbstractRelyingPartyPredicate {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(IgnoreRequestSignaturesPredicate.class);
-
- /** {@inheritDoc} */
- public boolean test(@Nullable final ProfileRequestContext input) {
-
- final RelyingPartyContext rpCtx = getRelyingPartyContext(input);
- if (input == null || rpCtx == null) {
- log.debug("No RelyingPartyContext found, assuming signatures should be checked");
- return false;
- }
-
- final ProfileConfiguration pc = rpCtx.getProfileConfig();
- if (!(pc instanceof SAML2ProfileConfiguration)) {
- log.debug("No SAML 2 profile configuration found, assuming signatures should be checked");
- return false;
- }
-
- return ((SAML2ProfileConfiguration) pc).isIgnoreRequestSignatures(input);
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/MaximumTimeSinceAuthnLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/MaximumTimeSinceAuthnLookupFunction.java
deleted file mode 100644
index 4228fc713..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/MaximumTimeSinceAuthnLookupFunction.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.config.navigate;
-
-import java.time.Duration;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
-
-/**
- * A function that returns {@link BrowserSSOProfileConfiguration#getMaximumTimeSinceAuthn(ProfileRequestContext)}
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
- * by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class MaximumTimeSinceAuthnLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
-
- /** {@inheritDoc} */
- @Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof BrowserSSOProfileConfiguration) {
- return ((BrowserSSOProfileConfiguration) pc).getMaximumTimeSinceAuthn(input);
- }
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyCountLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyCountLookupFunction.java
deleted file mode 100644
index 400955f56..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyCountLookupFunction.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.config.navigate;
-
-import javax.annotation.Nullable;
-
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.idp.saml.saml2.profile.config.SAML2ProfileConfiguration;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-/**
- * A function that returns the allowable proxy count based on the result of
- * {@link SAML2ProfileConfiguration#getProxyCount(ProfileRequestContext)},
- * if such a profile is available
- * from a {@link RelyingPartyContext} obtained via a lookup function,
- * by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, a null is returned.</p>
- */
-public class ProxyCountLookupFunction extends AbstractRelyingPartyLookupFunction<Integer> {
-
- /** {@inheritDoc} */
- @Nullable public Integer apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof SAML2ProfileConfiguration) {
- return ((SAML2ProfileConfiguration) pc).getProxyCount(input);
- }
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyRestrictionLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyRestrictionLookupFunction.java
index 64dac8c94..927f6c9d4 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyRestrictionLookupFunction.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyRestrictionLookupFunction.java
@@ -27,10 +27,10 @@ import javax.annotation.Nullable;
import net.shibboleth.idp.authn.context.SubjectContext;
import net.shibboleth.idp.authn.principal.ProxyAuthenticationPrincipal;
+import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.idp.saml.saml2.profile.config.SAML2ProfileConfiguration;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.collection.Pair;
import net.shibboleth.shared.logic.Constraint;
@@ -77,9 +77,9 @@ public class ProxyRestrictionLookupFunction extends AbstractRelyingPartyLookupFu
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof SAML2ProfileConfiguration) {
- proxyCount = ((SAML2ProfileConfiguration) pc).getProxyCount(input);
- final Set<String> configAudiences = ((SAML2ProfileConfiguration) pc).getProxyAudiences(input);
+ if (pc != null && pc instanceof BrowserSSOProfileConfiguration) {
+ proxyCount = ((BrowserSSOProfileConfiguration) pc).getProxyCount(input);
+ final Set<String> configAudiences = ((BrowserSSOProfileConfiguration) pc).getProxyAudiences(input);
if (configAudiences != null && !configAudiences.isEmpty()) {
audiences.addAll(configAudiences);
}
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfigurationTest.java
index ef197b48e..edb9a397c 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfigurationTest.java
@@ -17,10 +17,6 @@
package net.shibboleth.idp.saml.saml2.profile.config;
-import java.util.HashSet;
-import java.util.Set;
-
-import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.logic.PredicateSupport;
import org.testng.Assert;
@@ -67,61 +63,6 @@ public class AbstractSAML2ProfileConfigurationTest {
config.setEncryptAttributes(true);
Assert.assertTrue(config.isEncryptAttributes(null));
}
-
- @Test public void testProxyCount() {
- final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
- Assert.assertNull(config.getProxyCount(null));
-
- config.setProxyCount(1);
- Assert.assertEquals(config.getProxyCount(null), Integer.valueOf(1));
- }
-
- @Test public void testIndirectProxyCount() {
- final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
-
- config.setProxyCountLookupStrategy(FunctionSupport.constant(1));
- Assert.assertEquals(config.getProxyCount(null), Integer.valueOf(1));
- }
-
- @Test public void testProxyAudiences() {
- final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
- Assert.assertNotNull(config.getProxyAudiences(null));
- Assert.assertTrue(config.getProxyAudiences(null).isEmpty());
-
- final Set<String> audiences = new HashSet<>();
- audiences.add("foo");
- audiences.add("bar");
-
- config.setProxyAudiences(audiences);
- Assert.assertNotSame(config.getProxyAudiences(null), audiences);
- Assert.assertEquals(config.getProxyAudiences(null), audiences);
-
- try {
- config.getProxyAudiences(null).add("baz");
- Assert.fail();
- } catch (UnsupportedOperationException e) {
- // expected this
- }
- }
-
- @Test public void testIndirectProxyAudiences() {
- final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
-
- final Set<String> audiences = new HashSet<>();
- audiences.add("foo");
- audiences.add("bar");
-
- config.setProxyAudiencesLookupStrategy(FunctionSupport.constant(audiences));
- Assert.assertNotSame(config.getProxyAudiences(null), audiences);
- Assert.assertEquals(config.getProxyAudiences(null), audiences);
-
- try {
- config.getProxyAudiences(null).add("baz");
- Assert.fail();
- } catch (UnsupportedOperationException e) {
- // expected this
- }
- }
/** Mock class for testing {@link AbstractSAML2ProfileConfiguration}. */
private static class MockSAML2ProfileConfiguration extends AbstractSAML2ProfileConfiguration {
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java
index 7153a6d5c..1e35898d3 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java
@@ -250,5 +250,60 @@ public class BrowserSSOProfileConfigurationTest {
Assert.assertTrue(config.isClientTLSArtifactRequests(null));
}
+
+ @Test public void testProxyCount() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+ Assert.assertNull(config.getProxyCount(null));
+
+ config.setProxyCount(1);
+ Assert.assertEquals(config.getProxyCount(null), Integer.valueOf(1));
+ }
+
+ @Test public void testIndirectProxyCount() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+
+ config.setProxyCountLookupStrategy(FunctionSupport.constant(1));
+ Assert.assertEquals(config.getProxyCount(null), Integer.valueOf(1));
+ }
+
+ @Test public void testProxyAudiences() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+ Assert.assertNotNull(config.getProxyAudiences(null));
+ Assert.assertTrue(config.getProxyAudiences(null).isEmpty());
+
+ final Set<String> audiences = new HashSet<>();
+ audiences.add("foo");
+ audiences.add("bar");
+
+ config.setProxyAudiences(audiences);
+ Assert.assertNotSame(config.getProxyAudiences(null), audiences);
+ Assert.assertEquals(config.getProxyAudiences(null), audiences);
+
+ try {
+ config.getProxyAudiences(null).add("baz");
+ Assert.fail();
+ } catch (UnsupportedOperationException e) {
+ // expected this
+ }
+ }
+
+ @Test public void testIndirectProxyAudiences() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+
+ final Set<String> audiences = new HashSet<>();
+ audiences.add("foo");
+ audiences.add("bar");
+
+ config.setProxyAudiencesLookupStrategy(FunctionSupport.constant(audiences));
+ Assert.assertNotSame(config.getProxyAudiences(null), audiences);
+ Assert.assertEquals(config.getProxyAudiences(null), audiences);
+
+ try {
+ config.getProxyAudiences(null).add("baz");
+ Assert.fail();
+ } catch (UnsupportedOperationException e) {
+ // expected this
+ }
+ }
}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
index 3558d77bc..2d33c5d2f 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
@@ -43,8 +43,8 @@ import net.shibboleth.idp.authn.context.SubjectContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
import net.shibboleth.idp.saml.saml2.profile.config.logic.IgnoreScopingProfileConfigPredicate;
-import net.shibboleth.idp.saml.saml2.profile.config.navigate.ProxyCountLookupFunction;
import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.saml.saml2.profile.config.navigate.ProxyCountLookupFunction;
import net.shibboleth.shared.logic.Constraint;
/**
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java
index 16c0d2876..4b2bfcafe 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java
@@ -46,7 +46,6 @@ import com.google.common.base.Predicates;
import net.shibboleth.idp.authn.context.SubjectContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
-import net.shibboleth.idp.saml.profile.config.navigate.QualifiedNameIDFormatsLookupFunction;
import net.shibboleth.idp.saml.session.SAML2SPSession;
import net.shibboleth.idp.session.IdPSession;
import net.shibboleth.idp.session.SPSession;
@@ -55,6 +54,7 @@ import net.shibboleth.idp.session.context.LogoutContext;
import net.shibboleth.idp.session.context.SessionContext;
import net.shibboleth.idp.session.criterion.SPSessionCriterion;
import net.shibboleth.profile.context.navigate.RelyingPartyIdLookupFunction;
+import net.shibboleth.saml.saml2.profile.config.navigate.QualifiedNameIDFormatsLookupFunction;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list