[java-shib-profile] branch main updated: JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
Scott Cantor
cantor.2 at osu.edu
Mon Feb 20 17:31:56 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-shib-profile.
View the commit online:
http://git.shibboleth.net/view/?p=java-shib-profile.git;a=commit;h=e1ba3aa7e803748605928d5a0d625e28397bcdb1
The following commit(s) were added to refs/heads/main by this push:
new e1ba3aa JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
e1ba3aa is described below
commit e1ba3aa7e803748605928d5a0d625e28397bcdb1
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Feb 20 12:31:49 2023 -0500
JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
https://shibboleth.atlassian.net/browse/JSPROF-1
Add additonal profile interfaces and refactor relationships.
Fix some signing predicates.
---
...SAMLAssertionConsumingProfileConfiguration.java | 67 ++++++++++++++++++
...SAMLAssertionProducingProfileConfiguration.java | 80 ++++++++++++++++++++++
.../logic/NotBeforeProfileConfigPredicate.java | 52 ++++++++++++++
...Predicate.java => SignAssertionsPredicate.java} | 54 +++++++--------
.../config/logic/SignRequestsPredicate.java | 30 +++++---
.../navigate/AssertionAudiencesLookupFunction.java | 52 ++++++++++++++
.../navigate/AssertionLifetimeLookupFunction.java | 52 ++++++++++++++
.../AudienceRestrictionsLookupFunction.java | 75 ++++++++++++++++++++
.../config/navigate/package-info.java} | 17 ++---
.../ArtifactResolutionProfileConfiguration.java | 21 ++++--
.../config/AttributeQueryProfileConfiguration.java | 14 ++--
.../config/BrowserSSOProfileConfiguration.java} | 9 +--
.../profile/config/package-info.java} | 17 ++---
.../ArtifactResolutionProfileConfiguration.java | 32 ++++++++-
.../config/AttributeQueryProfileConfiguration.java | 9 ++-
.../config/BrowserSSOProfileConfiguration.java | 12 +++-
...AML2AssertionProducingProfileConfiguration.java | 14 ++--
17 files changed, 520 insertions(+), 87 deletions(-)
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/SAMLAssertionConsumingProfileConfiguration.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/SAMLAssertionConsumingProfileConfiguration.java
new file mode 100644
index 0000000..321e4c3
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/SAMLAssertionConsumingProfileConfiguration.java
@@ -0,0 +1,67 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.profile.config;
+
+import java.time.Duration;
+import java.util.Set;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.saml.saml2.profile.config.SAML2ProfileConfiguration;
+import net.shibboleth.shared.annotation.constraint.NonNegative;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+
+/**
+ * Interface for configuration of SAML profiles that consume assertions.
+ */
+public interface SAMLAssertionConsumingProfileConfiguration extends SAML2ProfileConfiguration {
+
+ /**
+ * Get the predicate used to determine if assertions must be signed.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return predicate used to determine if assertions must be signed
+ */
+ boolean isRequireSignedAssertions(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the maximum lifetime of the assertions.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return maximum lifetime of the assertions
+ */
+ @Nullable @NonNegative Duration getAssertionLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get set of audiences to include when validating assertion, in addition to our own entityID.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return additional audiences
+ */
+ @Nonnull @NonnullElements @NotLive @Unmodifiable
+ Set<String> getAssertionAudiences( @Nullable final ProfileRequestContext profileRequestContext);
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/SAMLAssertionProducingProfileConfiguration.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/SAMLAssertionProducingProfileConfiguration.java
new file mode 100644
index 0000000..c2d8d86
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/SAMLAssertionProducingProfileConfiguration.java
@@ -0,0 +1,80 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.profile.config;
+
+import java.time.Duration;
+import java.util.Set;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.shared.annotation.constraint.NonNegative;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+
+/**
+ * Interface for SAML profiles that produce assertions.
+ */
+public interface SAMLAssertionProducingProfileConfiguration extends SAMLProfileConfiguration {
+
+ /** Default assertion lifetime. */
+ @Nonnull public static final Duration DEFAULT_ASSERTION_LIFETIME = Duration.ofMinutes(5);
+
+ /**
+ * Get whether generated assertions should be signed.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether generated assertions should be signed
+ */
+ boolean isSignAssertions(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get whether to include a NotBefore attribute in the Conditions of generated assertions.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether to include a NotBefore attribute in the Conditions of generated assertions
+ */
+ boolean isIncludeConditionsNotBefore(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Get the lifetime of generated assertions.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return lifetime of generated assertions
+ */
+ @NonNegative @Nonnull Duration getAssertionLifetime(@Nullable final ProfileRequestContext profileRequestContext);
+
+
+ /**
+ * Get an unmodifiable set of audiences, in addition to the relying party(ies) to which the IdP is issuing the
+ * assertion, with which an assertion may be shared.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return additional audiences to which an assertion may be shared
+ */
+ @Nonnull @NonnullElements @NotLive @Unmodifiable
+ Set<String> getAssertionAudiences(@Nullable final ProfileRequestContext profileRequestContext);
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/NotBeforeProfileConfigPredicate.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/NotBeforeProfileConfigPredicate.java
new file mode 100644
index 0000000..577d7cb
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/NotBeforeProfileConfigPredicate.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * A predicate that returns
+ * {@link SAMLAssertionProducingProfileConfiguration#isIncludeConditionsNotBefore(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If unable to locate a specific setting, the predicate is true.</p>
+ */
+public class NotBeforeProfileConfigPredicate extends AbstractRelyingPartyPredicate {
+
+ /** {@inheritDoc} */
+ public boolean test(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContext(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof SAMLAssertionProducingProfileConfiguration downcast) {
+ return downcast.isIncludeConditionsNotBefore(input);
+ }
+ }
+
+ return true;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/SignRequestsPredicate.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/SignAssertionsPredicate.java
similarity index 69%
copy from shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/SignRequestsPredicate.java
copy to shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/SignAssertionsPredicate.java
index 0b09855..fa1c653 100644
--- a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/SignRequestsPredicate.java
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/SignAssertionsPredicate.java
@@ -22,55 +22,49 @@ import java.util.function.Function;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
+import org.opensaml.saml.saml2.metadata.RoleDescriptor;
+import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
+
import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration;
import net.shibboleth.saml.profile.context.navigate.SAMLMetadataContextLookupFunction;
-import net.shibboleth.saml.profile.config.SAMLProfileConfiguration;
import net.shibboleth.shared.logic.Constraint;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
-import org.opensaml.saml.saml2.metadata.IDPSSODescriptor;
-import org.opensaml.saml.saml2.metadata.RoleDescriptor;
-
/**
- * A predicate implementation that forwards to
- * {@link SAMLProfileConfiguration#isSignRequests(ProfileRequestContext)}
- * or follows {@link IDPSSODescriptor#getWantAuthnRequestsSigned()} if so configured.
+ * A predicate implementation that forwards to profile configuration lookup
+ * or follows {@link SPSSODescriptor#getWantAssertionsSigned()} if so configured.
*/
-public class SignRequestsPredicate extends AbstractRelyingPartyPredicate {
-
- /** Whether to override the result based on the WantAuthnRequestsSigned flag in SAML metadata. */
+public class SignAssertionsPredicate extends AbstractRelyingPartyPredicate {
+
+ /** Whether to override the result based on the WantAssertionsSigned flag in SAML metadata. */
private boolean honorMetadata;
/** Lookup strategy for {@link SAMLMetadataContext}. */
private Function<ProfileRequestContext,SAMLMetadataContext> metadataContextLookupStrategy;
/** Constructor. */
- public SignRequestsPredicate() {
+ public SignAssertionsPredicate() {
+ honorMetadata = true;
metadataContextLookupStrategy = new SAMLMetadataContextLookupFunction();
}
/**
- * Set whether to override the result based on the WantAuthnRequestsSigned flag in SAML metadata.
- *
- * <p>Defaults to false.</p>
+ * Set whether to override the result based on the WantAssertionsSigned flag in SAML metadata.
*
* @param flag flag to set
- *
- * @since 4.0.0
*/
public void setHonorMetadata(final boolean flag) {
honorMetadata = flag;
}
-
+
/**
* Set lookup strategy for {@link SAMLMetadataContext}.
*
* @param strategy lookup strategy
- *
- * @since 4.0.0
*/
public void setMetadataContextLookupStrategy(
@Nonnull final Function<ProfileRequestContext,SAMLMetadataContext> strategy) {
@@ -80,13 +74,13 @@ public class SignRequestsPredicate extends AbstractRelyingPartyPredicate {
/** {@inheritDoc} */
public boolean test(@Nullable final ProfileRequestContext input) {
-
+
if (honorMetadata) {
final SAMLMetadataContext metadataCtx = metadataContextLookupStrategy.apply(input);
if (metadataCtx != null) {
final RoleDescriptor role = metadataCtx.getRoleDescriptor();
- if (role instanceof IDPSSODescriptor) {
- final Boolean flag = ((IDPSSODescriptor) role).getWantAuthnRequestsSigned();
+ if (role instanceof SPSSODescriptor) {
+ final Boolean flag = ((SPSSODescriptor) role).getWantAssertionsSigned();
if (flag != null && flag.booleanValue()) {
return true;
}
@@ -97,11 +91,17 @@ public class SignRequestsPredicate extends AbstractRelyingPartyPredicate {
final RelyingPartyContext rpc = getRelyingPartyContext(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof SAMLProfileConfiguration) {
- return ((SAMLProfileConfiguration) pc).isSignRequests(input);
+ if (pc instanceof SAMLAssertionProducingProfileConfiguration downcast) {
+ return downcast.isSignAssertions(input);
+ } else if (pc instanceof
+ net.shibboleth.saml.saml2.profile.config.ArtifactResolutionProfileConfiguration downcast) {
+ return downcast.isSignAssertions(input);
+ } else if (pc instanceof
+ net.shibboleth.saml.saml1.profile.config.ArtifactResolutionProfileConfiguration downcast) {
+ return downcast.isSignAssertions(input);
}
}
-
+
return false;
}
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/SignRequestsPredicate.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/SignRequestsPredicate.java
index 0b09855..53bc2cf 100644
--- a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/SignRequestsPredicate.java
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/logic/SignRequestsPredicate.java
@@ -26,6 +26,7 @@ import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
import net.shibboleth.saml.profile.context.navigate.SAMLMetadataContextLookupFunction;
+import net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
import net.shibboleth.saml.profile.config.SAMLProfileConfiguration;
import net.shibboleth.shared.logic.Constraint;
@@ -79,9 +80,26 @@ public class SignRequestsPredicate extends AbstractRelyingPartyPredicate {
}
/** {@inheritDoc} */
+// Checkstyle: CyclomaticComplexity OFF
public boolean test(@Nullable final ProfileRequestContext input) {
- if (honorMetadata) {
+ boolean sso = false;
+
+ final RelyingPartyContext rpc = getRelyingPartyContext(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc instanceof SAMLProfileConfiguration) {
+ if (((SAMLProfileConfiguration) pc).isSignRequests(input)) {
+ return true;
+ }
+
+ if (pc instanceof BrowserSSOProfileConfiguration) {
+ sso = true;
+ }
+ }
+ }
+
+ if (honorMetadata && sso) {
final SAMLMetadataContext metadataCtx = metadataContextLookupStrategy.apply(input);
if (metadataCtx != null) {
final RoleDescriptor role = metadataCtx.getRoleDescriptor();
@@ -94,15 +112,7 @@ public class SignRequestsPredicate extends AbstractRelyingPartyPredicate {
}
}
- final RelyingPartyContext rpc = getRelyingPartyContext(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof SAMLProfileConfiguration) {
- return ((SAMLProfileConfiguration) pc).isSignRequests(input);
- }
- }
-
return false;
}
-
+// Checkstyle: CyclomaticComplexity ON
}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/navigate/AssertionAudiencesLookupFunction.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/navigate/AssertionAudiencesLookupFunction.java
new file mode 100644
index 0000000..f4181ea
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/navigate/AssertionAudiencesLookupFunction.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.profile.config.navigate;
+
+import java.util.Set;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration;
+
+/**
+ * A function that returns
+ * {@link SAMLAssertionProducingProfileConfiguration#getAssertionAudiences(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class AssertionAudiencesLookupFunction extends AbstractRelyingPartyLookupFunction<Set<String>> {
+
+ /** {@inheritDoc} */
+ @Nullable public Set<String> apply(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ if (rpc.getProfileConfig() instanceof SAMLAssertionProducingProfileConfiguration downcast) {
+ return downcast.getAssertionAudiences(input);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/navigate/AssertionLifetimeLookupFunction.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/navigate/AssertionLifetimeLookupFunction.java
new file mode 100644
index 0000000..e687e7f
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/navigate/AssertionLifetimeLookupFunction.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.profile.config.navigate;
+
+import java.time.Duration;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * A function that returns
+ * {@link SAMLAssertionProducingProfileConfiguration#getAssertionLifetime(ProfileRequestContext)}
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, a null value is returned.</p>
+ */
+public class AssertionLifetimeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
+
+ /** {@inheritDoc} */
+ @Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ if (rpc.getProfileConfig() instanceof SAMLAssertionProducingProfileConfiguration downcast) {
+ return downcast.getAssertionLifetime(input);
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/navigate/AudienceRestrictionsLookupFunction.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/navigate/AudienceRestrictionsLookupFunction.java
new file mode 100644
index 0000000..8db15b6
--- /dev/null
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/navigate/AudienceRestrictionsLookupFunction.java
@@ -0,0 +1,75 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.saml.profile.config.navigate;
+
+import java.util.Collection;
+import java.util.Set;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
+import net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import com.google.common.collect.ImmutableCollection.Builder;
+import com.google.common.collect.ImmutableList;
+
+/**
+ * A function that returns the effective audience restrictions to include in assertions,
+ * based on combining a relying party's entityID with the result of
+ * {@link SAMLAssertionProducingProfileConfiguration#getAssertionAudiences(ProfileRequestContext)},
+ * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
+ * by default a child of the {@link ProfileRequestContext}.
+ *
+ * <p>If a specific setting is unavailable, no values are returned.</p>
+ */
+public class AudienceRestrictionsLookupFunction extends AbstractRelyingPartyLookupFunction<Collection<String>> {
+
+ /** {@inheritDoc} */
+ @Nullable @NonnullElements @NotLive @Unmodifiable public Collection<String> apply(
+ @Nullable final ProfileRequestContext input) {
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final String id = rpc.getRelyingPartyId();
+ if (rpc.getProfileConfig() instanceof SAMLAssertionProducingProfileConfiguration downcast) {
+ final Set<String> additional = downcast.getAssertionAudiences(input);
+ if (!additional.isEmpty()) {
+ final Builder<String> builder = ImmutableList.builder();
+ if (id != null) {
+ builder.add(rpc.getRelyingPartyId());
+ }
+ builder.addAll(additional);
+ return builder.build();
+ }
+ }
+
+ if (id != null) {
+ return CollectionSupport.singletonList(id);
+ }
+ }
+
+ return CollectionSupport.emptyList();
+ }
+
+}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/navigate/package-info.java
similarity index 62%
copy from shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
copy to shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/navigate/package-info.java
index a4a0b9a..5ac0471 100644
--- a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/profile/config/navigate/package-info.java
@@ -15,16 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.saml.saml2.profile.config;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-
-/** Configuration support for SAML 2.0 artifact resolution profile. */
-public interface ArtifactResolutionProfileConfiguration extends SAML2AssertionProducingProfileConfiguration {
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/query/artifact";
-
-}
\ No newline at end of file
+/**
+ * Functions to navigate into SAML profile configuration.
+ */
+package net.shibboleth.saml.profile.config.navigate;
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml1/profile/config/ArtifactResolutionProfileConfiguration.java
similarity index 62%
copy from shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
copy to shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml1/profile/config/ArtifactResolutionProfileConfiguration.java
index a4a0b9a..ad2dfb4 100644
--- a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml1/profile/config/ArtifactResolutionProfileConfiguration.java
@@ -15,16 +15,29 @@
* limitations under the License.
*/
-package net.shibboleth.saml.saml2.profile.config;
+package net.shibboleth.saml.saml1.profile.config;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.saml.profile.config.SAMLProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
-/** Configuration support for SAML 2.0 artifact resolution profile. */
-public interface ArtifactResolutionProfileConfiguration extends SAML2AssertionProducingProfileConfiguration {
+/** Configuration support for SAML 1.x artifact resolution profile. */
+public interface ArtifactResolutionProfileConfiguration extends SAMLProfileConfiguration {
/** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/query/artifact";
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml1/query/artifact";
+
+ /**
+ * Get whether enclosed assertions should be signed.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether enclosed assertions should be signed
+ */
+ boolean isSignAssertions(@Nullable final ProfileRequestContext profileRequestContext);
}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml1/profile/config/AttributeQueryProfileConfiguration.java
similarity index 73%
copy from shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java
copy to shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml1/profile/config/AttributeQueryProfileConfiguration.java
index ee2ee68..07638c7 100644
--- a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml1/profile/config/AttributeQueryProfileConfiguration.java
@@ -15,17 +15,23 @@
* limitations under the License.
*/
-package net.shibboleth.saml.saml2.profile.config;
+package net.shibboleth.saml.saml1.profile.config;
import javax.annotation.Nonnull;
+import net.shibboleth.saml.profile.config.SAMLProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
-/** Configuration support for SAML 2.0 attribute query profile. */
-public interface AttributeQueryProfileConfiguration extends SAML2AssertionProducingProfileConfiguration {
+/**
+ * Configuration support for SAML 1.x attribute query profile.
+ *
+ * <p>Note that this interface extends neither the assertion producing nor consuming
+ * interfaces, as this is specific to IdP and SP behavior.</p>
+ */
+public interface AttributeQueryProfileConfiguration extends SAMLProfileConfiguration {
/** ID for this profile configuration. */
@Nonnull @NotEmpty
- public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/query/attribute";
+ public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml1/query/attribute";
}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml1/profile/config/BrowserSSOProfileConfiguration.java
similarity index 77%
copy from shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
copy to shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml1/profile/config/BrowserSSOProfileConfiguration.java
index a4a0b9a..850a818 100644
--- a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml1/profile/config/BrowserSSOProfileConfiguration.java
@@ -15,16 +15,17 @@
* limitations under the License.
*/
-package net.shibboleth.saml.saml2.profile.config;
+package net.shibboleth.saml.saml1.profile.config;
import javax.annotation.Nonnull;
+import net.shibboleth.saml.profile.config.SAMLProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
-/** Configuration support for SAML 2.0 artifact resolution profile. */
-public interface ArtifactResolutionProfileConfiguration extends SAML2AssertionProducingProfileConfiguration {
+/** Configuration for SAML 1.x Browser SSO profile. */
+public interface BrowserSSOProfileConfiguration extends SAMLProfileConfiguration {
/** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/query/artifact";
+ @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml1/sso/browser";
}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml1/profile/config/package-info.java
similarity index 62%
copy from shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
copy to shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml1/profile/config/package-info.java
index a4a0b9a..bcbd43f 100644
--- a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml1/profile/config/package-info.java
@@ -15,16 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.saml.saml2.profile.config;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-
-/** Configuration support for SAML 2.0 artifact resolution profile. */
-public interface ArtifactResolutionProfileConfiguration extends SAML2AssertionProducingProfileConfiguration {
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/query/artifact";
-
-}
\ No newline at end of file
+/**
+ * SAML 1.x profile configuration classes.
+ */
+package net.shibboleth.saml.saml1.profile.config;
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
index a4a0b9a..a726d5e 100644
--- a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
@@ -18,13 +18,43 @@
package net.shibboleth.saml.saml2.profile.config;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
/** Configuration support for SAML 2.0 artifact resolution profile. */
-public interface ArtifactResolutionProfileConfiguration extends SAML2AssertionProducingProfileConfiguration {
+public interface ArtifactResolutionProfileConfiguration extends SAML2ProfileConfiguration {
/** ID for this profile configuration. */
@Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/query/artifact";
+ /**
+ * Gets whether enclosed assertions should be signed.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether enclosed assertions should be signed
+ */
+ boolean isSignAssertions(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Gets whether enclosed assertions should be encrypted.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether enclosed assertions should be encrypted
+ */
+ boolean isEncryptAssertions(@Nullable final ProfileRequestContext profileRequestContext);
+
+ /**
+ * Gets whether enclosed attributes should be encrypted.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return whether enclosed attributes should be encrypted
+ */
+ boolean isEncryptAttributes(@Nullable final ProfileRequestContext profileRequestContext);
+
}
\ No newline at end of file
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java
index ee2ee68..eac242f 100644
--- a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java
@@ -21,8 +21,13 @@ import javax.annotation.Nonnull;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
-/** Configuration support for SAML 2.0 attribute query profile. */
-public interface AttributeQueryProfileConfiguration extends SAML2AssertionProducingProfileConfiguration {
+/**
+ * Configuration support for SAML 2.0 attribute query profile.
+ *
+ * <p>Note that this interface extends neither the assertion producing nor consuming
+ * interfaces, as this is specific to IdP and SP behavior.</p>
+ */
+public interface AttributeQueryProfileConfiguration extends SAML2ProfileConfiguration {
/** ID for this profile configuration. */
@Nonnull @NotEmpty
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index e86de00..a9727ed 100644
--- a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -24,6 +24,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.saml.profile.config.SAMLArtifactConsumerProfileConfiguration;
+import net.shibboleth.saml.profile.config.SAMLAssertionConsumingProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NonNegative;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
@@ -35,9 +36,14 @@ import org.opensaml.saml.saml2.core.AuthnContextComparisonTypeEnumeration;
import org.opensaml.saml.saml2.core.SubjectLocality;
import org.opensaml.saml.saml2.metadata.RequestedAttribute;
-/** Configuration for SAML 2.0 Browser SSO. */
+/**
+ * Configuration for SAML 2.0 Browser SSO profile.
+ *
+ * <p>Note that this interface extends {@link SAMLAssertionConsumingProfileConfiguration} due to both
+ * IdP and SP functionality including that step, but not the "producing" interface, as that is IdP-only.</p>
+ */
public interface BrowserSSOProfileConfiguration extends SAMLArtifactConsumerProfileConfiguration,
- SAML2ProfileConfiguration {
+ SAML2ProfileConfiguration, SAMLAssertionConsumingProfileConfiguration {
/** ID for this profile configuration. */
@Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/sso/browser";
@@ -117,7 +123,7 @@ public interface BrowserSSOProfileConfiguration extends SAMLArtifactConsumerProf
*
* @return requested SPNameQualifier
*/
- @Nullable String getNameQualifier(@Nullable final ProfileRequestContext profileRequestContext);
+ @Nullable String getSPNameQualifier(@Nullable final ProfileRequestContext profileRequestContext);
/**
* Get the AttributeConsumingServiceIndex to include in the SAML request.
diff --git a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/SAML2AssertionProducingProfileConfiguration.java b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/SAML2AssertionProducingProfileConfiguration.java
index 3c66a42..16e9185 100644
--- a/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/SAML2AssertionProducingProfileConfiguration.java
+++ b/shib-saml-profile-api/src/main/java/net/shibboleth/saml/saml2/profile/config/SAML2AssertionProducingProfileConfiguration.java
@@ -21,27 +21,29 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration;
+
/**
* Interface for SAML 2.0 profiles that produce assertions.
*/
-public interface SAML2AssertionProducingProfileConfiguration extends SAML2ProfileConfiguration {
+public interface SAML2AssertionProducingProfileConfiguration extends SAML2ProfileConfiguration,
+ SAMLAssertionProducingProfileConfiguration {
/**
- * Gets the predicate used to determine if assertions should be encrypted.
+ * Gets whether assertions should be encrypted.
*
* @param profileRequestContext current profile request context
*
- * @return predicate used to determine if assertions should be encrypted
+ * @return whether assertions should be encrypted
*/
boolean isEncryptAssertions(@Nullable final ProfileRequestContext profileRequestContext);
/**
- * Gets the predicate used to determine if attributes should be encrypted.
+ * Gets whether attributes should be encrypted.
*
* @param profileRequestContext current profile request context
*
- * @return predicate used to determine if attributes should be encrypted
+ * @return whether attributes should be encrypted
*/
boolean isEncryptAttributes(@Nullable final ProfileRequestContext profileRequestContext);
-
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list