[java-identity-provider] branch main updated: Move assertion/attribute encryption off of base interface.
Scott Cantor
cantor.2 at osu.edu
Thu Feb 16 19:36:14 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=7f99006b4abc21bfcec893c36f5cf57c6dd2ee53
The following commit(s) were added to refs/heads/main by this push:
new 7f99006b4 Move assertion/attribute encryption off of base interface.
7f99006b4 is described below
commit 7f99006b4abc21bfcec893c36f5cf57c6dd2ee53
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Feb 16 14:36:11 2023 -0500
Move assertion/attribute encryption off of base interface.
---
.../shibboleth/idp/conf/relying-party-mddriven.xml | 32 +++----
idp-conf/src/test/resources/conf/global.xml | 4 +
.../src/test/resources/conf/metadata-providers.xml | 2 +
.../src/test/resources/metadata/duo-metadata.xml | 34 +++++++
...AML2AssertionProducingProfileConfiguration.java | 105 +++++++++++++++++++++
.../config/AbstractSAML2ProfileConfiguration.java | 59 +-----------
.../ArtifactResolutionProfileConfiguration.java | 66 ++++++++++++-
.../config/AttributeQueryProfileConfiguration.java | 2 +-
.../config/BrowserSSOProfileConfiguration.java | 2 +-
.../profile/config/SAML2ProfileConfiguration.java | 47 ---------
.../AbstractSAML2ProfileConfigurationTest.java | 14 ---
...ArtifactResolutionProfileConfigurationTest.java | 17 +++-
.../AttributeQueryProfileConfigurationTest.java | 14 +++
.../profile/impl/PopulateEncryptionParameters.java | 15 ++-
.../impl/PopulateEncryptionParametersTest.java | 2 +-
15 files changed, 267 insertions(+), 148 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
index 17f89ee50..6eeb9a874 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
@@ -195,14 +195,6 @@
<constructor-arg value="%{idp.encryption.optional:false}" />
</bean>
</property>
- <property name="encryptAssertionsPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptAssertions" />
- </constructor-arg>
- <constructor-arg value="false" />
- </bean>
- </property>
<property name="encryptNameIDsPredicate">
<bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
@@ -211,14 +203,6 @@
<constructor-arg value="false" />
</bean>
</property>
- <property name="encryptAttributesPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptAttributes" />
- </constructor-arg>
- <constructor-arg value="false" />
- </bean>
- </property>
</bean>
<bean id="AbstractMDDrivenCASProfile" parent="AbstractMDDrivenProfile" abstract="true">
@@ -614,6 +598,14 @@
</constructor-arg>
</bean>
</property>
+ <property name="encryptAttributesPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptAttributes" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
</bean>
<bean id="SAML2.ArtifactResolution.MDDriven" parent="AbstractMDDrivenSAML2Profile" lazy-init="true"
@@ -638,6 +630,14 @@
</constructor-arg>
</bean>
</property>
+ <property name="encryptAttributesPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptAttributes" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
</bean>
<!-- Remove in V6. -->
diff --git a/idp-conf/src/test/resources/conf/global.xml b/idp-conf/src/test/resources/conf/global.xml
index b10b4795f..b2fe5a4f9 100644
--- a/idp-conf/src/test/resources/conf/global.xml
+++ b/idp-conf/src/test/resources/conf/global.xml
@@ -72,6 +72,10 @@
<bean id="exampleMetadata-sp123" class="org.springframework.core.io.ClassPathResource">
<constructor-arg value="/metadata/example-sp123-metadata.xml"/>
</bean>
+
+ <bean id="duoMetadata" class="org.springframework.core.io.ClassPathResource">
+ <constructor-arg value="/metadata/duo-metadata.xml"/>
+ </bean>
<util:list id="testbed.MetadataResolverResources">
<value>%{idp.home}/conf/metadata-providers.xml</value>
diff --git a/idp-conf/src/test/resources/conf/metadata-providers.xml b/idp-conf/src/test/resources/conf/metadata-providers.xml
index 67faf6ac9..465fdac9c 100644
--- a/idp-conf/src/test/resources/conf/metadata-providers.xml
+++ b/idp-conf/src/test/resources/conf/metadata-providers.xml
@@ -56,6 +56,8 @@
<MetadataProvider id="SP123MD" xsi:type="ResourceBackedMetadataProvider" maxRefreshDelay="PT5M" indexesRef="testbed.MetadataIndexes" resourceRef="exampleMetadata-sp123"/>
+ <MetadataProvider id="DuoSSO" xsi:type="ResourceBackedMetadataProvider" maxRefreshDelay="PT5M" indexesRef="testbed.MetadataIndexes" resourceRef="duoMetadata"/>
+
<!--
<MetadataProvider id="ICMDQ" xsi:type="DynamicHTTPMetadataProvider"
minCacheDuration="PT5M" maxCacheDuration="PT24H" maxIdleEntityData="PT1H">
diff --git a/idp-conf/src/test/resources/metadata/duo-metadata.xml b/idp-conf/src/test/resources/metadata/duo-metadata.xml
new file mode 100644
index 000000000..921873cdf
--- /dev/null
+++ b/idp-conf/src/test/resources/metadata/duo-metadata.xml
@@ -0,0 +1,34 @@
+<md:EntityDescriptor xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://sso-12f40691.sso.duosecurity.com/saml2/sp/DIN7BJQ33RL6ECKXGGIQ/metadata">
+ <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+ <md:KeyDescriptor use="signing">
+ <ds:KeyInfo>
+ <ds:X509Data>
+ <ds:X509Certificate>MIIDDTCCAfWgAwIBAgIUNge/GUspTMgWbSzRjzZfrw6o6QowDQYJKoZIhvcNAQEL
+BQAwNjEVMBMGA1UECgwMRHVvIFNlY3VyaXR5MR0wGwYDVQQDDBRESU43QkpRMzNS
+TDZFQ0tYR0dJUTAeFw0yMjExMDgxNDEyMjRaFw0zODAxMTkwMzE0MDdaMDYxFTAT
+BgNVBAoMDER1byBTZWN1cml0eTEdMBsGA1UEAwwURElON0JKUTMzUkw2RUNLWEdH
+SVEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHhLSLfhdMyJR6rDQC
+acugPPti2tB3VZHmfzxHOUAtdptXK5NmeZKJ37p55ix1f+xlOb1DGt1i1alu9Gmp
+EEZoLZQLUxnLfgl3zFNHuXsKD7P42X9tJ8+CHhnz4XVs43SCLQEwDzFvhzYVakiW
+NrelB+mmLfJOx9dS0cKXA08W4yPUpft/xp9BFB/5E1gCTFRdgX3Qz08dQ1eOidc6
+BRXNwu4kKHT2HkA5AEuKIG/RsAKbTUmYIUUcqyXSxLLMi00mP7m/w/pEcwqeOPBe
+ctu1CT4jg9cEsau668k0ptrPjttYtGbpeRjsADOOhZAIye6rB5OmQlEpwwDW9R97
+n8vHAgMBAAGjEzARMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
+AAVNpuUdXSM2Id41jN7XUYW2dVe1Q/oOJzE5fWuTy7lwR+9H7HU/EQMocv2uIUiM
+8HM62s6dq4ku5sAos7kCatlCCTx2e4YVqCuWKFaucjcUNjKywiv7exNhWUn16zrE
+6dOLSXSs003AjAI/INLMOznqvn0OLDNSL8xZihpWLvLxObfKQ67tId1/9GCYrHfq
+7VI3I8KblNi5ExjapDl6GAqP9RHDhm8ozgrWaN5uS7R9iu1ScNK0tGYGYTy2dSto
+kSQJHp75v1Hn2FYEn4PV7d6TLcDfbiRcemZq1k3SYCUsdKC+zeKkcFdxMr1xLWGx
+BaQ+kE99owTCSvwjcon8BDs=
+</ds:X509Certificate>
+ </ds:X509Data>
+ </ds:KeyInfo>
+ </md:KeyDescriptor>
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
+ <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sso-12f40691.sso.duosecurity.com/saml2/sp/DIN7BJQ33RL6ECKXGGIQ/sso"/>
+ <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://sso-12f40691.sso.duosecurity.com/saml2/sp/DIN7BJQ33RL6ECKXGGIQ/sso"/>
+ </md:IDPSSODescriptor>
+</md:EntityDescriptor>
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2AssertionProducingProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2AssertionProducingProfileConfiguration.java
new file mode 100644
index 000000000..85fddb1fe
--- /dev/null
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2AssertionProducingProfileConfiguration.java
@@ -0,0 +1,105 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.saml2.profile.config;
+
+import java.util.function.Predicate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.saml.saml2.profile.config.SAML2AssertionProducingProfileConfiguration;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/** Base class for SAML 2 profile configurations. */
+public abstract class AbstractSAML2AssertionProducingProfileConfiguration
+ extends AbstractSAML2ArtifactAwareProfileConfiguration
+ implements SAML2AssertionProducingProfileConfiguration {
+
+ /** Predicate used to determine if assertions should be encrypted. */
+ @Nonnull private Predicate<ProfileRequestContext> encryptAssertionsPredicate;
+
+ /** Predicate used to determine if attributes should be encrypted. */
+ @Nonnull private Predicate<ProfileRequestContext> encryptAttributesPredicate;
+
+ /**
+ * Constructor.
+ *
+ * @param profileId ID of the communication profile, never null or empty
+ */
+ public AbstractSAML2AssertionProducingProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
+ super(profileId);
+
+ encryptAssertionsPredicate = PredicateSupport.alwaysFalse();
+ encryptAttributesPredicate = PredicateSupport.alwaysFalse();
+ }
+
+ /** {@inheritDoc} */
+ public boolean isEncryptAssertions(@Nullable final ProfileRequestContext profileRequestContext) {
+ return encryptAssertionsPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether assertions should be encrypted.
+ *
+ * @param flag flag to set
+ */
+ public void setEncryptAssertions(final boolean flag) {
+ encryptAssertionsPredicate = PredicateSupport.constant(flag);
+ }
+
+ /**
+ * Set the predicate used to determine if assertions should be encrypted.
+ *
+ * @param predicate predicate used to determine if assertions should be encrypted
+ *
+ * @since 4.0.0
+ */
+ public void setEncryptAssertionsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+ encryptAssertionsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ public boolean isEncryptAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
+ return encryptAttributesPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether attributes should be encrypted.
+ *
+ * @param flag flag to set
+ */
+ public void setEncryptAttributes(final boolean flag) {
+ encryptAttributesPredicate = PredicateSupport.constant(flag);
+ }
+
+ /**
+ * Set the predicate used to determine if attributes should be encrypted.
+ *
+ * @param predicate predicate used to determine if attributes should be encrypted
+ *
+ * @since 4.0.0
+ */
+ public void setEncryptAttributesPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+ encryptAttributesPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
+ }
+
+}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java
index 5e2fe695e..38089a94c 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfiguration.java
@@ -24,6 +24,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.idp.saml.profile.config.AbstractSAMLProfileConfiguration;
+import net.shibboleth.saml.saml2.profile.config.SAML2ProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.PredicateSupport;
@@ -41,15 +42,9 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
/** Whether encryption is optional in the face of no key, etc. */
@Nonnull private Predicate<ProfileRequestContext> encryptionOptionalPredicate;
- /** Predicate used to determine if assertions should be encrypted. */
- @Nonnull private Predicate<ProfileRequestContext> encryptAssertionsPredicate;
-
/** Predicate used to determine if name identifiers should be encrypted. */
@Nonnull private Predicate<ProfileRequestContext> encryptNameIDsPredicate;
- /** Predicate used to determine if attributes should be encrypted. */
- @Nonnull private Predicate<ProfileRequestContext> encryptAttributesPredicate;
-
/**
* Constructor.
*
@@ -60,9 +55,7 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
ignoreRequestSignaturesPredicate = PredicateSupport.alwaysFalse();
encryptionOptionalPredicate = PredicateSupport.alwaysFalse();
- encryptAssertionsPredicate = PredicateSupport.alwaysFalse();
encryptNameIDsPredicate = PredicateSupport.alwaysFalse();
- encryptAttributesPredicate = PredicateSupport.alwaysFalse();
}
/** {@inheritDoc} */
@@ -117,31 +110,6 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
encryptionOptionalPredicate = Constraint.isNotNull(condition, "Encryption optional predicate cannot be null");
}
- /** {@inheritDoc} */
- public boolean isEncryptAssertions(@Nullable final ProfileRequestContext profileRequestContext) {
- return encryptAssertionsPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether assertions should be encrypted.
- *
- * @param flag flag to set
- */
- public void setEncryptAssertions(final boolean flag) {
- encryptAssertionsPredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set the predicate used to determine if assertions should be encrypted.
- *
- * @param predicate predicate used to determine if assertions should be encrypted
- *
- * @since 4.0.0
- */
- public void setEncryptAssertionsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
- encryptAssertionsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
- }
-
/** {@inheritDoc} */
public boolean isEncryptNameIDs(@Nullable final ProfileRequestContext profileRequestContext) {
return encryptNameIDsPredicate.test(profileRequestContext);
@@ -166,31 +134,6 @@ public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProf
public void setEncryptNameIDsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
encryptNameIDsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
}
-
- /** {@inheritDoc} */
- public boolean isEncryptAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
- return encryptAttributesPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether attributes should be encrypted.
- *
- * @param flag flag to set
- */
- public void setEncryptAttributes(final boolean flag) {
- encryptAttributesPredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set the predicate used to determine if attributes should be encrypted.
- *
- * @param predicate predicate used to determine if attributes should be encrypted
- *
- * @since 4.0.0
- */
- public void setEncryptAttributesPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
- encryptAttributesPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
- }
/**
* Get a decorator for the SAML request.
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
index b110ad366..140301a70 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
@@ -17,22 +17,38 @@
package net.shibboleth.idp.saml.saml2.profile.config;
+import java.util.function.Predicate;
+
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.logic.NoConfidentialityMessageChannelPredicate;
import org.opensaml.profile.logic.NoIntegrityMessageChannelPredicate;
+import net.shibboleth.saml.saml2.profile.config.SAML2AssertionProducingProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
/** Configuration support for SAML 2 artifact resolution requests. */
-public class ArtifactResolutionProfileConfiguration extends AbstractSAML2ProfileConfiguration {
+public class ArtifactResolutionProfileConfiguration extends AbstractSAML2ProfileConfiguration
+ implements SAML2AssertionProducingProfileConfiguration {
/** ID for this profile configuration. */
@Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/query/artifact";
+ /** Predicate used to determine if assertions should be encrypted. */
+ @Nonnull private Predicate<ProfileRequestContext> encryptAssertionsPredicate;
+
+ /** Predicate used to determine if attributes should be encrypted. */
+ @Nonnull private Predicate<ProfileRequestContext> encryptAttributesPredicate;
+
/** Constructor. */
public ArtifactResolutionProfileConfiguration() {
this(PROFILE_ID);
+ encryptAssertionsPredicate = PredicateSupport.alwaysFalse();
+ encryptAttributesPredicate = PredicateSupport.alwaysFalse();
}
/**
@@ -44,6 +60,54 @@ public class ArtifactResolutionProfileConfiguration extends AbstractSAML2Profile
super(profileId);
setSignResponsesPredicate(new NoIntegrityMessageChannelPredicate());
setEncryptAssertionsPredicate(new NoConfidentialityMessageChannelPredicate());
+ encryptAssertionsPredicate = PredicateSupport.alwaysFalse();
+ encryptAttributesPredicate = PredicateSupport.alwaysFalse();
+ }
+
+ /** {@inheritDoc} */
+ public boolean isEncryptAssertions(@Nullable final ProfileRequestContext profileRequestContext) {
+ return encryptAssertionsPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether assertions should be encrypted.
+ *
+ * @param flag flag to set
+ */
+ public void setEncryptAssertions(final boolean flag) {
+ encryptAssertionsPredicate = PredicateSupport.constant(flag);
}
+ /**
+ * Set the predicate used to determine if assertions should be encrypted.
+ *
+ * @param predicate predicate used to determine if assertions should be encrypted
+ */
+ public void setEncryptAssertionsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+ encryptAssertionsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ public boolean isEncryptAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
+ return encryptAttributesPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether attributes should be encrypted.
+ *
+ * @param flag flag to set
+ */
+ public void setEncryptAttributes(final boolean flag) {
+ encryptAttributesPredicate = PredicateSupport.constant(flag);
+ }
+
+ /**
+ * Set the predicate used to determine if attributes should be encrypted.
+ *
+ * @param predicate predicate used to determine if attributes should be encrypted
+ */
+ public void setEncryptAttributesPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+ encryptAttributesPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
+ }
+
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java
index 053d5a3fc..fe08fb06b 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java
@@ -25,7 +25,7 @@ import org.opensaml.profile.logic.NoIntegrityMessageChannelPredicate;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
/** Configuration support for SAML 2 attribute query requests. */
-public class AttributeQueryProfileConfiguration extends AbstractSAML2ArtifactAwareProfileConfiguration {
+public class AttributeQueryProfileConfiguration extends AbstractSAML2AssertionProducingProfileConfiguration {
/** ID for this profile configuration. */
@Nonnull @NotEmpty public static final String PROFILE_ID =
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index a4548c15e..26612053a 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -55,7 +55,7 @@ import org.opensaml.saml.saml2.core.SubjectLocality;
import org.opensaml.saml.saml2.metadata.RequestedAttribute;
/** Configuration support for IdP and proxied SAML 2.0 Browser SSO. */
-public class BrowserSSOProfileConfiguration extends AbstractSAML2ArtifactAwareProfileConfiguration
+public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProducingProfileConfiguration
implements AuthenticationProfileConfiguration, AttributeResolvingProfileConfiguration,
net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration{
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
deleted file mode 100644
index af6231c72..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.config;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-/**
- * Base interface for SAML 2 profile configurations.
- */
-public interface SAML2ProfileConfiguration extends net.shibboleth.saml.saml2.profile.config.SAML2ProfileConfiguration {
-
- /**
- * Gets the predicate used to determine if assertions should be encrypted.
- *
- * @param profileRequestContext current profile request context
- *
- * @return predicate used to determine if assertions should be encrypted
- */
- boolean isEncryptAssertions(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Gets the predicate used to determine if attributes should be encrypted.
- *
- * @param profileRequestContext current profile request context
- *
- * @return predicate used to determine if attributes should be encrypted
- */
- boolean isEncryptAttributes(@Nullable final ProfileRequestContext profileRequestContext);
-
-}
\ No newline at end of file
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfigurationTest.java
index edb9a397c..0da2852c2 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2ProfileConfigurationTest.java
@@ -50,20 +50,6 @@ public class AbstractSAML2ProfileConfigurationTest {
Assert.assertTrue(config.isEncryptNameIDs(null));
}
- @Test public void testEncryptAssertionsPredicate() {
- final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
-
- config.setEncryptAssertions(true);
- Assert.assertTrue(config.isEncryptAssertions(null));
- }
-
- @Test public void testEncryptAttributesPredicate() {
- final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
-
- config.setEncryptAttributes(true);
- Assert.assertTrue(config.isEncryptAttributes(null));
- }
-
/** Mock class for testing {@link AbstractSAML2ProfileConfiguration}. */
private static class MockSAML2ProfileConfiguration extends AbstractSAML2ProfileConfiguration {
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfigurationTest.java
index 830a06960..25b9a0d96 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfigurationTest.java
@@ -29,7 +29,22 @@ public class ArtifactResolutionProfileConfigurationTest {
Assert.assertEquals(ArtifactResolutionProfileConfiguration.PROFILE_ID,
"http://shibboleth.net/ns/profiles/saml2/query/artifact");
- ArtifactResolutionProfileConfiguration config = new ArtifactResolutionProfileConfiguration();
+ final ArtifactResolutionProfileConfiguration config = new ArtifactResolutionProfileConfiguration();
Assert.assertEquals(config.getId(), ArtifactResolutionProfileConfiguration.PROFILE_ID);
}
+
+ @Test public void testEncryptAssertionsPredicate() {
+ final ArtifactResolutionProfileConfiguration config = new ArtifactResolutionProfileConfiguration();
+
+ config.setEncryptAssertions(true);
+ Assert.assertTrue(config.isEncryptAssertions(null));
+ }
+
+ @Test public void testEncryptAttributesPredicate() {
+ final ArtifactResolutionProfileConfiguration config = new ArtifactResolutionProfileConfiguration();
+
+ config.setEncryptAttributes(true);
+ Assert.assertTrue(config.isEncryptAttributes(null));
+ }
+
}
\ No newline at end of file
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java
index 6f5bf9598..5c50a457d 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java
@@ -74,4 +74,18 @@ public class AttributeQueryProfileConfigurationTest {
Assert.assertTrue(config.isClientTLSArtifactRequests(null));
}
+ @Test public void testEncryptAssertionsPredicate() {
+ final AttributeQueryProfileConfiguration config = new AttributeQueryProfileConfiguration();
+
+ config.setEncryptAssertions(true);
+ Assert.assertTrue(config.isEncryptAssertions(null));
+ }
+
+ @Test public void testEncryptAttributesPredicate() {
+ final AttributeQueryProfileConfiguration config = new AttributeQueryProfileConfiguration();
+
+ config.setEncryptAttributes(true);
+ Assert.assertTrue(config.isEncryptAttributes(null));
+ }
+
}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
index 2df408ed7..41ba14611 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
@@ -50,9 +50,10 @@ import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.idp.saml.saml2.profile.config.SAML2ProfileConfiguration;
import net.shibboleth.idp.saml.saml2.profile.config.SingleLogoutProfileConfiguration;
import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.saml.saml2.profile.config.SAML2AssertionProducingProfileConfiguration;
+import net.shibboleth.saml.saml2.profile.config.SAML2ProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.component.ComponentInitializationException;
@@ -240,10 +241,6 @@ public class PopulateEncryptionParameters extends AbstractProfileAction {
log.debug("{} Unable to locate RelyingPartyContext", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
return false;
- } else if (rpContext.getProfileConfig() == null) {
- log.debug("{} Unable to locate RelyingPartyContext", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
- return false;
} else if (!(rpContext.getProfileConfig() instanceof SAML2ProfileConfiguration)) {
log.debug("{} Not a SAML 2 profile configuration, nothing to do", getLogPrefix());
return false;
@@ -275,9 +272,11 @@ public class PopulateEncryptionParameters extends AbstractProfileAction {
// Encryption can only be optional if the request didn't specify it above.
encryptionOptional = profileConfiguration.isEncryptionOptional(profileRequestContext);
}
-
- encryptAssertions = profileConfiguration.isEncryptAssertions(profileRequestContext);
- encryptAttributes = profileConfiguration.isEncryptAttributes(profileRequestContext);
+
+ if (profileConfiguration instanceof SAML2AssertionProducingProfileConfiguration appc) {
+ encryptAssertions = appc.isEncryptAssertions(profileRequestContext);
+ encryptAttributes = appc.isEncryptAttributes(profileRequestContext);
+ }
if (!encryptAssertions && !encryptIdentifiers && !encryptAttributes) {
log.debug("{} No encryption requested, nothing to do", getLogPrefix());
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParametersTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParametersTest.java
index ff2403f43..85c8307ba 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParametersTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParametersTest.java
@@ -84,7 +84,7 @@ public class PopulateEncryptionParametersTest extends OpenSAMLInitBaseTestCase {
prc.getSubcontext(RelyingPartyContext.class).setProfileConfig(null);
final Event event = action.execute(rc);
- ActionTestingSupport.assertEvent(event, IdPEventIds.INVALID_PROFILE_CONFIG);
+ ActionTestingSupport.assertProceedEvent(event);
}
@Test public void testWrongConfig() throws Exception {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list