[java-identity-provider] branch main updated: JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
Scott Cantor
cantor.2 at osu.edu
Mon Feb 20 17:40:40 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=73e82b5c45eb40861c6dcb31030e0af9ec909d94
The following commit(s) were added to refs/heads/main by this push:
new 73e82b5c4 JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
73e82b5c4 is described below
commit 73e82b5c45eb40861c6dcb31030e0af9ec909d94
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Feb 20 12:40:37 2023 -0500
JSPROF-1 - Move RelyingParty "layer" into java-shib-profile
https://shibboleth.atlassian.net/browse/JSPROF-1
Migrate more functions out and rebase profile configs on interfaces.
---
.../shibboleth/idp/conf/relying-party-mddriven.xml | 91 +++++++++--
.../idp/flows/authn/saml-authn-beans.xml | 2 +-
.../idp/flows/saml/saml-abstract-beans.xml | 8 +-
.../config/AbstractSAMLProfileConfiguration.java | 150 -----------------
.../profile/config/SAMLProfileConfiguration.java | 49 ------
.../logic/NotBeforeProfileConfigPredicate.java | 51 ------
.../config/logic/SignAssertionsPredicate.java | 101 ------------
...itionalAudiencesForAssertionLookupFunction.java | 53 ------
.../navigate/AssertionLifetimeLookupFunction.java | 53 ------
.../AudienceRestrictionsLookupFunction.java | 79 ---------
...ML1AssertionProducingProfileConfiguration.java} | 171 ++++++++------------
.../ArtifactResolutionProfileConfiguration.java | 39 ++++-
.../config/AttributeQueryProfileConfiguration.java | 9 +-
.../config/BrowserSSOProfileConfiguration.java | 10 +-
...AML2AssertionProducingProfileConfiguration.java | 179 ++++++++++++++++++++-
.../ArtifactResolutionProfileConfiguration.java | 32 +++-
.../config/BrowserSSOProfileConfiguration.java | 136 ++++++++++++++--
...DefaultAuthenticationMethodsLookupFunction.java | 3 +-
.../navigate/ProxyRestrictionLookupFunction.java | 2 +-
.../AbstractSAMLProfileConfigurationTest.java | 100 ------------
...ArtifactResolutionProfileConfigurationTest.java | 10 +-
.../AttributeQueryProfileConfigurationTest.java | 9 +-
.../config/BrowserSSOProfileConfigurationTest.java | 95 ++++++++++-
...ArtifactResolutionProfileConfigurationTest.java | 10 +-
.../AttributeQueryProfileConfigurationTest.java | 10 +-
.../config/BrowserSSOProfileConfigurationTest.java | 96 ++++++++++-
.../profile/impl/PopulateEncryptionParameters.java | 4 +
27 files changed, 746 insertions(+), 806 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
index 6eeb9a874..4597e0a8b 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
@@ -149,6 +149,9 @@
<constructor-arg value="false" />
</bean>
</property>
+ </bean>
+
+ <bean id="AbstractMDDrivenSAML1AssertionProducingProfile" parent="AbstractMDDrivenSAMLProfile" abstract="true">
<property name="signAssertionsPredicate">
<bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
@@ -169,11 +172,11 @@
<bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="assertionLifetime">
<property name="defaultValue">
<util:constant
- static-field="net.shibboleth.idp.saml.profile.config.AbstractSAMLProfileConfiguration.DEFAULT_ASSERTION_LIFETIME" />
+ static-field="net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration.DEFAULT_ASSERTION_LIFETIME" />
</property>
</bean>
</property>
- <property name="additionalAudiencesForAssertionLookupStrategy">
+ <property name="assertionAudiencesLookupStrategy">
<bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="assertionAudiences" />
</property>
</bean>
@@ -205,6 +208,44 @@
</property>
</bean>
+ <bean id="AbstractMDDrivenSAML2AssertionProducingProfile" parent="AbstractMDDrivenSAML2Profile" abstract="true">
+ <property name="signAssertionsPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signAssertions" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
+ <property name="includeConditionsNotBeforePredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="includeConditionsNotBefore" />
+ </constructor-arg>
+ <constructor-arg value="true" />
+ </bean>
+ </property>
+ <property name="assertionLifetimeLookupStrategy">
+ <bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="assertionLifetime">
+ <property name="defaultValue">
+ <util:constant
+ static-field="net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration.DEFAULT_ASSERTION_LIFETIME" />
+ </property>
+ </bean>
+ </property>
+ <property name="assertionAudiencesLookupStrategy">
+ <bean parent="shibboleth.MDDrivenSetProperty" p:propertyName="assertionAudiences" />
+ </property>
+ <property name="encryptAttributesPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptAttributes" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
+ </bean>
+
<bean id="AbstractMDDrivenCASProfile" parent="AbstractMDDrivenProfile" abstract="true">
<property name="resolveAttributesPredicate">
<bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
@@ -226,7 +267,7 @@
<!-- Concrete profile beans. -->
- <bean id="Shibboleth.SSO.MDDriven" parent="AbstractMDDrivenSAMLProfile" lazy-init="true"
+ <bean id="Shibboleth.SSO.MDDriven" parent="AbstractMDDrivenSAML1AssertionProducingProfile" lazy-init="true"
class="net.shibboleth.idp.saml.saml1.profile.config.BrowserSSOProfileConfiguration"
p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration">
<property name="artifactConfigurationLookupStrategy">
@@ -280,7 +321,7 @@
</property>
</bean>
- <bean id="SAML1.AttributeQuery.MDDriven" parent="AbstractMDDrivenSAMLProfile" lazy-init="true"
+ <bean id="SAML1.AttributeQuery.MDDriven" parent="AbstractMDDrivenSAML1AssertionProducingProfile" lazy-init="true"
class="net.shibboleth.idp.saml.saml1.profile.config.AttributeQueryProfileConfiguration">
<property name="signResponsesPredicate">
<bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
@@ -306,9 +347,17 @@
</constructor-arg>
</bean>
</property>
+ <property name="signAssertionsPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signAssertions" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
</bean>
- <bean id="SAML2.SSO.MDDriven" parent="AbstractMDDrivenSAML2Profile" lazy-init="true"
+ <bean id="SAML2.SSO.MDDriven" parent="AbstractMDDrivenSAML2AssertionProducingProfile" lazy-init="true"
class="net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration"
p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration">
<property name="artifactConfigurationLookupStrategy">
@@ -435,6 +484,14 @@
<constructor-arg value="false" />
</bean>
</property>
+ <property name="requireSignedAssertionsPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="requireSignedAssertions" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
<property name="authnContextTranslationStrategyLookupStrategy">
<bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="authnContextTranslationStrategy"
p:propertyType="#{T(java.util.function.Function)}">
@@ -477,6 +534,12 @@
<property name="maximumTimeSinceAuthnLookupStrategy">
<bean parent="shibboleth.MDDrivenDurationProperty" p:propertyName="maximumTimeSinceAuthn" />
</property>
+ <property name="sPNameQualifierLookupStrategy">
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="spNameQualifier" />
+ </property>
+ <property name="attributeIndexLookupStrategy">
+ <bean parent="shibboleth.MDDrivenStringProperty" p:propertyName="attributeIndex" />
+ </property>
</bean>
<bean id="SAML2.ECP.MDDriven" parent="SAML2.SSO.MDDriven" lazy-init="true"
@@ -576,7 +639,7 @@
</property>
</bean>
- <bean id="SAML2.AttributeQuery.MDDriven" parent="AbstractMDDrivenSAML2Profile" lazy-init="true"
+ <bean id="SAML2.AttributeQuery.MDDriven" parent="AbstractMDDrivenSAML2AssertionProducingProfile" lazy-init="true"
class="net.shibboleth.idp.saml.saml2.profile.config.AttributeQueryProfileConfiguration">
<property name="signResponsesPredicate">
<bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
@@ -598,14 +661,6 @@
</constructor-arg>
</bean>
</property>
- <property name="encryptAttributesPredicate">
- <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
- <constructor-arg>
- <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="encryptAttributes" />
- </constructor-arg>
- <constructor-arg value="false" />
- </bean>
- </property>
</bean>
<bean id="SAML2.ArtifactResolution.MDDriven" parent="AbstractMDDrivenSAML2Profile" lazy-init="true"
@@ -620,6 +675,14 @@
</constructor-arg>
</bean>
</property>
+ <property name="signAssertionsPredicate">
+ <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="signAssertions" />
+ </constructor-arg>
+ <constructor-arg value="false" />
+ </bean>
+ </property>
<property name="encryptAssertionsPredicate">
<bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
index 4ba564d83..043a5f4a0 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
@@ -392,7 +392,7 @@
<bean class="net.shibboleth.saml.saml2.profile.config.navigate.MaximumTimeSinceAuthnLookupFunction" />
</property>
<property name="additionalAudiences">
- <bean class="net.shibboleth.idp.saml.profile.config.navigate.AdditionalAudiencesForAssertionLookupFunction" />
+ <bean class="net.shibboleth.saml.profile.config.navigate.AssertionAudiencesLookupFunction" />
</property>
<property name="signatureRequired">
<bean parent="shibboleth.Conditions.NOT">
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml
index 3d5b0b575..2ed83ea79 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml
@@ -144,7 +144,7 @@
p:signatureSigningParametersResolver-ref="shibboleth.SignatureSigningParametersResolver"
p:noResultIsError="true">
<property name="activationCondition">
- <bean class="net.shibboleth.idp.saml.profile.config.logic.SignAssertionsPredicate"
+ <bean class="net.shibboleth.saml.profile.config.logic.SignAssertionsPredicate"
p:honorMetadata="%{idp.saml.honorWantAssertionsSigned:true}" />
</property>
<property name="securityParametersContextLookupStrategy">
@@ -240,7 +240,7 @@
<bean id="AddNotBeforeConditionToAssertions"
class="org.opensaml.saml.common.profile.impl.AddNotBeforeConditionToAssertions" scope="prototype">
<property name="activationCondition">
- <bean class="net.shibboleth.idp.saml.profile.config.logic.NotBeforeProfileConfigPredicate" />
+ <bean class="net.shibboleth.saml.profile.config.logic.NotBeforeProfileConfigPredicate" />
</property>
</bean>
@@ -248,14 +248,14 @@
class="org.opensaml.saml.common.profile.impl.AddNotOnOrAfterConditionToAssertions" scope="prototype"
p:defaultAssertionLifetime="PT5M">
<property name="assertionLifetimeStrategy">
- <bean class="net.shibboleth.idp.saml.profile.config.navigate.AssertionLifetimeLookupFunction" />
+ <bean class="net.shibboleth.saml.profile.config.navigate.AssertionLifetimeLookupFunction" />
</property>
</bean>
<bean id="AddAudienceRestrictionToAssertions"
class="org.opensaml.saml.common.profile.impl.AddAudienceRestrictionToAssertions" scope="prototype">
<property name="audienceRestrictionsLookupStrategy">
- <bean class="net.shibboleth.idp.saml.profile.config.navigate.AudienceRestrictionsLookupFunction" />
+ <bean class="net.shibboleth.saml.profile.config.navigate.AudienceRestrictionsLookupFunction" />
</property>
</bean>
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java
index 7bde0fdde..b58eb0a60 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java
@@ -17,24 +17,15 @@
package net.shibboleth.idp.saml.profile.config;
-import java.time.Duration;
-import java.util.Collection;
-import java.util.Set;
-import java.util.function.Function;
import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.logic.PredicateSupport;
-import net.shibboleth.shared.primitive.StringSupport;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -42,27 +33,12 @@ import org.opensaml.profile.context.ProfileRequestContext;
public abstract class AbstractSAMLProfileConfiguration extends AbstractInterceptorAwareProfileConfiguration implements
SAMLProfileConfiguration {
- /** Default assertion lifetime. */
- @Nonnull public static final Duration DEFAULT_ASSERTION_LIFETIME = Duration.ofMinutes(5);
-
/** Predicate used to determine if the generated request should be signed. Default returns false. */
@Nonnull private Predicate<ProfileRequestContext> signRequestsPredicate;
/** Predicate used to determine if the generated response should be signed. Default returns false. */
@Nonnull private Predicate<ProfileRequestContext> signResponsesPredicate;
- /** Predicate used to determine if the generated assertion should be signed. Default returns false. */
- @Nonnull private Predicate<ProfileRequestContext> signAssertionsPredicate;
-
- /** Controls whether to include a NotBefore attribute in the Conditions of generated assertions. */
- @Nonnull private Predicate<ProfileRequestContext> includeNotBeforePredicate;
-
- /** Lookup function to supply assertionLifetime property. */
- @Nonnull private Function<ProfileRequestContext,Duration> assertionLifetimeLookupStrategy;
-
- /** Lookup function to supply assertionAudiences property. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> assertionAudiencesLookupStrategy;
-
/**
* Constructor.
*
@@ -73,35 +49,6 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractIntercept
signRequestsPredicate = PredicateSupport.alwaysFalse();
signResponsesPredicate = PredicateSupport.alwaysFalse();
- signAssertionsPredicate = PredicateSupport.alwaysFalse();
- includeNotBeforePredicate = PredicateSupport.alwaysTrue();
- assertionLifetimeLookupStrategy = FunctionSupport.constant(DEFAULT_ASSERTION_LIFETIME);
- assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
- }
-
- /** {@inheritDoc} */
- public boolean isSignAssertions(@Nullable final ProfileRequestContext profileRequestContext) {
- return signAssertionsPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether generated assertions should be signed.
- *
- * @param flag flag to set
- */
- public void setSignAssertions(final boolean flag) {
- signAssertionsPredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set the predicate used to determine if generated assertions should be signed.
- *
- * @param predicate predicate used to determine if generated assertions should be signed
- *
- * @since 4.0.0
- */
- public void setSignAssertionsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
- signAssertionsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
}
/** {@inheritDoc} */
@@ -154,101 +101,4 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractIntercept
signResponsesPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
}
- /** {@inheritDoc} */
- @Nonnull public Duration getAssertionLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = assertionLifetimeLookupStrategy.apply(profileRequestContext);
- Constraint.isNotNull(lifetime, "Assertion lifetime cannot be null");
- Constraint.isFalse(lifetime.isNegative() || lifetime.isZero(), "Assertion lifetime must be greater than 0");
- return lifetime;
- }
-
- /**
- * Set the lifetime of an assertion.
- *
- * @param lifetime lifetime of an assertion
- */
- public void setAssertionLifetime(@Nonnull final Duration lifetime) {
- Constraint.isNotNull(lifetime, "Assertion lifetime cannot be null");
- Constraint.isFalse(lifetime.isNegative() || lifetime.isZero(), "Assertion lifetime must be greater than 0");
-
- assertionLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
- }
-
- /**
- * Set a lookup strategy for the lifetime of an assertion.
- *
- * @param strategy lookup strategy
- *
- * @since 3.3.0
- */
- public void setAssertionLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- assertionLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /**{@inheritDoc} */
- public boolean isIncludeConditionsNotBefore(@Nullable final ProfileRequestContext profileRequestContext) {
- return includeNotBeforePredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether to include a NotBefore attribute in the Conditions of generated assertions.
- *
- * @param flag flag to set
- */
- public void setIncludeConditionsNotBefore(final boolean flag) {
- includeNotBeforePredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set a condition to determine whether to include a NotBefore attribute in the Conditions of
- * generated assertions.
- *
- * @param condition lookup strategy
- *
- * @since 3.3.0
- */
- public void setIncludeConditionsNotBeforePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- includeNotBeforePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive public Set<String> getAdditionalAudiencesForAssertion(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> audiences = assertionAudiencesLookupStrategy.apply(profileRequestContext);
- if (audiences != null) {
- return CollectionSupport.copyToSet(audiences);
- }
- return CollectionSupport.emptySet();
- }
-
- /**
- * Set the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the assertion, with
- * which an assertion may be shared.
- *
- * @param audiences the additional audiences
- */
- public void setAdditionalAudiencesForAssertion(@Nullable @NonnullElements final Collection<String> audiences) {
-
- if (audiences == null || audiences.isEmpty()) {
- assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
- } else {
- assertionAudiencesLookupStrategy = FunctionSupport.constant(
- Set.copyOf(StringSupport.normalizeStringCollection(audiences)));
- }
- }
-
- /**
- * Set a lookup strategy for the set of audiences, in addition to the relying party(ies) to which the IdP
- * is issuing the assertion, with which an assertion may be shared.
- *
- * @param strategy lookup strategy
- *
- * @since 4.0.0
- */
- public void setAdditionalAudiencesForAssertionLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- assertionAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/SAMLProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/SAMLProfileConfiguration.java
index 08069a6cf..ab0ac80bb 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/SAMLProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/SAMLProfileConfiguration.java
@@ -17,59 +17,10 @@
package net.shibboleth.idp.saml.profile.config;
-import java.time.Duration;
-import java.util.Set;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
import net.shibboleth.idp.profile.config.InterceptorAwareProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
/** Common interface for IdP SAML profile configurations. */
public interface SAMLProfileConfiguration extends net.shibboleth.saml.profile.config.SAMLProfileConfiguration,
InterceptorAwareProfileConfiguration {
-
- /**
- * Get the predicate used to determine if generated assertions should be signed.
- *
- * @param profileRequestContext current profile request context
- *
- * @return predicate used to determine if generated assertions should be signed
- */
- boolean isSignAssertions(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get the lifetime of generated assertions.
- *
- * @param profileRequestContext current profile request context
- *
- * @return lifetime of generated assertions
- */
- @Nonnull Duration getAssertionLifetime(@Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get an unmodifiable set of audiences, in addition to the relying party(ies) to which the IdP is issuing the
- * assertion, with which an assertion may be shared.
- *
- * @param profileRequestContext current profile request context
- *
- * @return additional audiences to which an assertion may be shared
- */
- @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getAdditionalAudiencesForAssertion(
- @Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get whether to include a NotBefore attribute in the Conditions of generated assertions.
- *
- * @param profileRequestContext current profile request context
- *
- * @return whether to include a NotBefore attribute in the Conditions of generated assertions
- */
- boolean isIncludeConditionsNotBefore(@Nullable final ProfileRequestContext profileRequestContext);
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/NotBeforeProfileConfigPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/NotBeforeProfileConfigPredicate.java
deleted file mode 100644
index d17fa79dc..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/NotBeforeProfileConfigPredicate.java
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.profile.config.logic;
-
-import javax.annotation.Nullable;
-
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.idp.saml.profile.config.SAMLProfileConfiguration;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-/**
- * A predicate that returns {@link SAMLProfileConfiguration#isIncludeConditionsNotBefore(ProfileRequestContext)}
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
- * by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If unable to locate a specific setting, the predicate is true.</p>
- */
-public class NotBeforeProfileConfigPredicate extends AbstractRelyingPartyPredicate {
-
- /** {@inheritDoc} */
- public boolean test(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContext(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof SAMLProfileConfiguration) {
- return ((SAMLProfileConfiguration) pc).isIncludeConditionsNotBefore(input);
- }
- }
-
- return true;
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignAssertionsPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignAssertionsPredicate.java
deleted file mode 100644
index 5c9216790..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/SignAssertionsPredicate.java
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.profile.config.logic;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
-import org.opensaml.saml.saml2.metadata.RoleDescriptor;
-import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
-
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
-import net.shibboleth.saml.profile.context.navigate.SAMLMetadataContextLookupFunction;
-import net.shibboleth.idp.saml.profile.config.SAMLProfileConfiguration;
-import net.shibboleth.shared.logic.Constraint;
-
-/** A predicate implementation that forwards to
- * {@link SAMLProfileConfiguration#isSignAssertions(ProfileRequestContext)}.
- * or follows {@link SPSSODescriptor#getWantAssertionsSigned()} if so configured.*/
-public class SignAssertionsPredicate extends AbstractRelyingPartyPredicate {
-
- /** Whether to override the result based on the WantAssertionsSigned flag in SAML metadata. */
- private boolean honorMetadata;
-
- /** Lookup strategy for {@link SAMLMetadataContext}. */
- private Function<ProfileRequestContext,SAMLMetadataContext> metadataContextLookupStrategy;
-
- /** Constructor. */
- public SignAssertionsPredicate() {
- honorMetadata = true;
- metadataContextLookupStrategy = new SAMLMetadataContextLookupFunction();
- }
-
- /**
- * Set whether to override the result based on the WantAssertionsSigned flag in SAML metadata.
- *
- * @param flag flag to set
- */
- public void setHonorMetadata(final boolean flag) {
- honorMetadata = flag;
- }
-
- /**
- * Set lookup strategy for {@link SAMLMetadataContext}.
- *
- * @param strategy lookup strategy
- */
- public void setMetadataContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,SAMLMetadataContext> strategy) {
- metadataContextLookupStrategy = Constraint.isNotNull(strategy,
- "SAMLMetadataContext lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- public boolean test(@Nullable final ProfileRequestContext input) {
-
- if (honorMetadata) {
- final SAMLMetadataContext metadataCtx = metadataContextLookupStrategy.apply(input);
- if (metadataCtx != null) {
- final RoleDescriptor role = metadataCtx.getRoleDescriptor();
- if (role instanceof SPSSODescriptor) {
- final Boolean flag = ((SPSSODescriptor) role).getWantAssertionsSigned();
- if (flag != null && flag.booleanValue()) {
- return true;
- }
- }
- }
- }
-
- final RelyingPartyContext rpc = getRelyingPartyContext(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc instanceof SAMLProfileConfiguration) {
- return ((SAMLProfileConfiguration) pc).isSignAssertions(input);
- }
- }
-
- return false;
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AdditionalAudiencesForAssertionLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AdditionalAudiencesForAssertionLookupFunction.java
deleted file mode 100644
index 6e0e9eff9..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AdditionalAudiencesForAssertionLookupFunction.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.profile.config.navigate;
-
-import java.util.Set;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.idp.saml.profile.config.SAMLProfileConfiguration;
-
-/**
- * A function that returns {@link SAMLProfileConfiguration#getAdditionalAudiencesForAssertion(ProfileRequestContext)}
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
- * by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class AdditionalAudiencesForAssertionLookupFunction extends AbstractRelyingPartyLookupFunction<Set<String>> {
-
- /** {@inheritDoc} */
- @Nullable public Set<String> apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof SAMLProfileConfiguration) {
- return ((SAMLProfileConfiguration) pc).getAdditionalAudiencesForAssertion(input);
- }
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AssertionLifetimeLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AssertionLifetimeLookupFunction.java
deleted file mode 100644
index d29fd4b86..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AssertionLifetimeLookupFunction.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.profile.config.navigate;
-
-import java.time.Duration;
-
-import javax.annotation.Nullable;
-
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.idp.saml.profile.config.SAMLProfileConfiguration;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-/**
- * A function that returns {@link SAMLProfileConfiguration#getAssertionLifetime(ProfileRequestContext)}
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
- * by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, a null value is returned.</p>
- */
-public class AssertionLifetimeLookupFunction extends AbstractRelyingPartyLookupFunction<Duration> {
-
- /** {@inheritDoc} */
- @Nullable public Duration apply(@Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof SAMLProfileConfiguration) {
- return ((SAMLProfileConfiguration) pc).getAssertionLifetime(input);
- }
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AudienceRestrictionsLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AudienceRestrictionsLookupFunction.java
deleted file mode 100644
index 9f9b95bb6..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/AudienceRestrictionsLookupFunction.java
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.profile.config.navigate;
-
-import java.util.Collection;
-import java.util.Collections;
-import java.util.Set;
-
-import javax.annotation.Nullable;
-
-import net.shibboleth.profile.config.ProfileConfiguration;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.idp.saml.profile.config.SAMLProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-import net.shibboleth.shared.collection.CollectionSupport;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import com.google.common.collect.ImmutableCollection.Builder;
-import com.google.common.collect.ImmutableList;
-
-/**
- * A function that returns the effective audience restrictions to include in assertions,
- * based on combining a relying party's entityID with the result of
- * {@link SAMLProfileConfiguration#getAdditionalAudiencesForAssertion(ProfileRequestContext)},
- * if such a profile is available from a {@link RelyingPartyContext} obtained via a lookup function,
- * by default a child of the {@link ProfileRequestContext}.
- *
- * <p>If a specific setting is unavailable, no values are returned.</p>
- */
-public class AudienceRestrictionsLookupFunction extends AbstractRelyingPartyLookupFunction<Collection<String>> {
-
- /** {@inheritDoc} */
- @Nullable @NonnullElements @NotLive @Unmodifiable public Collection<String> apply(
- @Nullable final ProfileRequestContext input) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final String id = rpc.getRelyingPartyId();
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof SAMLProfileConfiguration) {
- final Set<String> additional =
- ((SAMLProfileConfiguration) pc).getAdditionalAudiencesForAssertion(input);
- if (!additional.isEmpty()) {
- final Builder<String> builder = ImmutableList.builder();
- if (id != null) {
- builder.add(rpc.getRelyingPartyId());
- }
- builder.addAll(additional);
- return builder.build();
- }
- }
-
- if (id != null) {
- return CollectionSupport.singletonList(id);
- }
- }
-
- return Collections.emptyList();
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/AbstractSAML1AssertionProducingProfileConfiguration.java
similarity index 63%
copy from idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java
copy to idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/AbstractSAML1AssertionProducingProfileConfiguration.java
index 7bde0fdde..aaa31f779 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/AbstractSAML1AssertionProducingProfileConfiguration.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package net.shibboleth.idp.saml.profile.config;
+package net.shibboleth.idp.saml.saml1.profile.config;
import java.time.Duration;
import java.util.Collection;
@@ -26,7 +26,7 @@ import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration;
+import net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
@@ -34,49 +34,45 @@ import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.logic.PredicateSupport;
+import net.shibboleth.shared.primitive.DeprecationSupport;
+import net.shibboleth.shared.primitive.DeprecationSupport.ObjectType;
import net.shibboleth.shared.primitive.StringSupport;
import org.opensaml.profile.context.ProfileRequestContext;
-/** Base class for SAML profile configurations. */
-public abstract class AbstractSAMLProfileConfiguration extends AbstractInterceptorAwareProfileConfiguration implements
- SAMLProfileConfiguration {
-
- /** Default assertion lifetime. */
- @Nonnull public static final Duration DEFAULT_ASSERTION_LIFETIME = Duration.ofMinutes(5);
-
- /** Predicate used to determine if the generated request should be signed. Default returns false. */
- @Nonnull private Predicate<ProfileRequestContext> signRequestsPredicate;
-
- /** Predicate used to determine if the generated response should be signed. Default returns false. */
- @Nonnull private Predicate<ProfileRequestContext> signResponsesPredicate;
+/** Base class for IdP SAML 1.x profile configurations that produce assertions. */
+public abstract class AbstractSAML1AssertionProducingProfileConfiguration
+ extends AbstractSAML1ArtifactAwareProfileConfiguration
+ implements SAMLAssertionProducingProfileConfiguration {
- /** Predicate used to determine if the generated assertion should be signed. Default returns false. */
+ /** Predicate used to determine whether to sign assertions. */
@Nonnull private Predicate<ProfileRequestContext> signAssertionsPredicate;
- /** Controls whether to include a NotBefore attribute in the Conditions of generated assertions. */
+ /**
+ * Predicate used to determine whether to include a NotBefore attribute in the
+ * Conditions of generated assertions.
+ */
@Nonnull private Predicate<ProfileRequestContext> includeNotBeforePredicate;
-
+
/** Lookup function to supply assertionLifetime property. */
@Nonnull private Function<ProfileRequestContext,Duration> assertionLifetimeLookupStrategy;
/** Lookup function to supply assertionAudiences property. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> assertionAudiencesLookupStrategy;
+ @Nonnull private Function<ProfileRequestContext,Set<String>> additionalAudiencesLookupStrategy;
/**
* Constructor.
*
- * @param profileId ID of the communication profile
+ * @param profileId ID of the communication profile, never null or empty
*/
- public AbstractSAMLProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
+ public AbstractSAML1AssertionProducingProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
- signRequestsPredicate = PredicateSupport.alwaysFalse();
- signResponsesPredicate = PredicateSupport.alwaysFalse();
signAssertionsPredicate = PredicateSupport.alwaysFalse();
includeNotBeforePredicate = PredicateSupport.alwaysTrue();
- assertionLifetimeLookupStrategy = FunctionSupport.constant(DEFAULT_ASSERTION_LIFETIME);
- assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
+ assertionLifetimeLookupStrategy =
+ FunctionSupport.constant(SAMLAssertionProducingProfileConfiguration.DEFAULT_ASSERTION_LIFETIME);
+ additionalAudiencesLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
@@ -97,61 +93,33 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractIntercept
* Set the predicate used to determine if generated assertions should be signed.
*
* @param predicate predicate used to determine if generated assertions should be signed
- *
- * @since 4.0.0
*/
public void setSignAssertionsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
signAssertionsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
}
-
- /** {@inheritDoc} */
- public boolean isSignRequests(@Nullable final ProfileRequestContext profileRequestContext) {
- return signRequestsPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether generated requests should be signed.
- *
- * @param flag flag to set
- */
- public void setSignRequests(final boolean flag) {
- signRequestsPredicate = PredicateSupport.constant(flag);
- }
- /**
- * Set the predicate used to determine if generated requests should be signed.
- *
- * @param predicate predicate used to determine if generated requests should be signed
- *
- * @since 4.0.0
- */
- public void setSignRequestsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
- signRequestsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
- }
-
- /** {@inheritDoc} */
- public boolean isSignResponses(@Nullable final ProfileRequestContext profileRequestContext) {
- return signResponsesPredicate.test(profileRequestContext);
+ /**{@inheritDoc} */
+ public boolean isIncludeConditionsNotBefore(@Nullable final ProfileRequestContext profileRequestContext) {
+ return includeNotBeforePredicate.test(profileRequestContext);
}
/**
- * Set whether generated responses should be signed.
+ * Set whether to include a NotBefore attribute in the Conditions of generated assertions.
*
* @param flag flag to set
*/
- public void setSignResponses(final boolean flag) {
- signResponsesPredicate = PredicateSupport.constant(flag);
+ public void setIncludeConditionsNotBefore(final boolean flag) {
+ includeNotBeforePredicate = PredicateSupport.constant(flag);
}
-
+
/**
- * Set the predicate used to determine if generated responses should be signed.
- *
- * @param predicate predicate used to determine if generated responses should be signed
- *
- * @since 4.0.0
+ * Set a condition to determine whether to include a NotBefore attribute in the Conditions of
+ * generated assertions.
+ *
+ * @param condition lookup strategy
*/
- public void setSignResponsesPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
- signResponsesPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
+ public void setIncludeConditionsNotBeforePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ includeNotBeforePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
/** {@inheritDoc} */
@@ -178,62 +146,63 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractIntercept
* Set a lookup strategy for the lifetime of an assertion.
*
* @param strategy lookup strategy
- *
- * @since 3.3.0
*/
public void setAssertionLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext,Duration> strategy) {
assertionLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
-
- /**{@inheritDoc} */
- public boolean isIncludeConditionsNotBefore(@Nullable final ProfileRequestContext profileRequestContext) {
- return includeNotBeforePredicate.test(profileRequestContext);
+
+ /** {@inheritDoc} */
+ @Nonnull @NonnullElements @NotLive public Set<String> getAssertionAudiences(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+
+ final Set<String> audiences = additionalAudiencesLookupStrategy.apply(profileRequestContext);
+ if (audiences != null) {
+ return CollectionSupport.copyToSet(audiences);
+ }
+ return CollectionSupport.emptySet();
}
/**
- * Set whether to include a NotBefore attribute in the Conditions of generated assertions.
+ * Deprecated, replacement is {@link #setAssertionAudiences(Collection)}.
*
- * @param flag flag to set
+ * @param audiences the additional audiences
+ *
+ * @deprecated
*/
- public void setIncludeConditionsNotBefore(final boolean flag) {
- includeNotBeforePredicate = PredicateSupport.constant(flag);
+ @Deprecated(since="5.0.0", forRemoval=true)
+ public void setAdditionalAudiencesForAssertion(@Nullable @NonnullElements final Collection<String> audiences) {
+ DeprecationSupport.warn(ObjectType.METHOD, "setAdditionalAudiencesForAssertion", "relying-party.xml",
+ "setAdditionalAudiences");
+ setAssertionAudiences(audiences);
}
/**
- * Set a condition to determine whether to include a NotBefore attribute in the Conditions of
- * generated assertions.
- *
- * @param condition lookup strategy
+ * Deprecated, replacement is {@link #setAssertionAudiencesLookupStrategy(Function)}.
*
- * @since 3.3.0
+ * @param strategy lookup strategy
+ *
+ * @deprecated
*/
- public void setIncludeConditionsNotBeforePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- includeNotBeforePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive public Set<String> getAdditionalAudiencesForAssertion(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> audiences = assertionAudiencesLookupStrategy.apply(profileRequestContext);
- if (audiences != null) {
- return CollectionSupport.copyToSet(audiences);
- }
- return CollectionSupport.emptySet();
+ @Deprecated(since="5.0.0", forRemoval=true)
+ public void setAdditionalAudiencesForAssertionLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
+ DeprecationSupport.warn(ObjectType.METHOD, "setAdditionalAudiencesForAssertionLookupStrategy",
+ "relying-party.xml", "setAdditionalAudiences");
+ setAssertionAudiencesLookupStrategy(strategy);
}
-
+
/**
* Set the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the assertion, with
* which an assertion may be shared.
*
* @param audiences the additional audiences
*/
- public void setAdditionalAudiencesForAssertion(@Nullable @NonnullElements final Collection<String> audiences) {
+ public void setAssertionAudiences(@Nullable @NonnullElements final Collection<String> audiences) {
if (audiences == null || audiences.isEmpty()) {
- assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
+ additionalAudiencesLookupStrategy = FunctionSupport.constant(null);
} else {
- assertionAudiencesLookupStrategy = FunctionSupport.constant(
+ additionalAudiencesLookupStrategy = FunctionSupport.constant(
Set.copyOf(StringSupport.normalizeStringCollection(audiences)));
}
}
@@ -243,12 +212,10 @@ public abstract class AbstractSAMLProfileConfiguration extends AbstractIntercept
* is issuing the assertion, with which an assertion may be shared.
*
* @param strategy lookup strategy
- *
- * @since 4.0.0
*/
- public void setAdditionalAudiencesForAssertionLookupStrategy(
+ public void setAssertionAudiencesLookupStrategy(
@Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- assertionAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ additionalAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
-
+
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/ArtifactResolutionProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/ArtifactResolutionProfileConfiguration.java
index 8e3a2e370..d363e9d55 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/ArtifactResolutionProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/ArtifactResolutionProfileConfiguration.java
@@ -17,20 +17,25 @@
package net.shibboleth.idp.saml.saml1.profile.config;
+import java.util.function.Predicate;
+
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.logic.NoIntegrityMessageChannelPredicate;
import net.shibboleth.idp.saml.profile.config.AbstractSAMLProfileConfiguration;
-import net.shibboleth.idp.saml.profile.config.SAMLProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
-/** Configuration support for SAML 1 artifact resolution requests. */
+/** Configuration support for SAML 1.x artifact resolution requests. */
public class ArtifactResolutionProfileConfiguration extends AbstractSAMLProfileConfiguration
- implements SAMLProfileConfiguration {
+ implements net.shibboleth.saml.saml1.profile.config.ArtifactResolutionProfileConfiguration {
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml1/query/artifact";
+ /** Predicate used to determine whether to sign assertions. */
+ @Nonnull private Predicate<ProfileRequestContext> signAssertionsPredicate;
/** Constructor. */
public ArtifactResolutionProfileConfiguration() {
@@ -45,6 +50,30 @@ public class ArtifactResolutionProfileConfiguration extends AbstractSAMLProfileC
protected ArtifactResolutionProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
setSignResponsesPredicate(new NoIntegrityMessageChannelPredicate());
+ signAssertionsPredicate = PredicateSupport.alwaysFalse();
+ }
+
+ /** {@inheritDoc} */
+ public boolean isSignAssertions(@Nullable final ProfileRequestContext profileRequestContext) {
+ return signAssertionsPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether generated assertions should be signed.
+ *
+ * @param flag flag to set
+ */
+ public void setSignAssertions(final boolean flag) {
+ signAssertionsPredicate = PredicateSupport.constant(flag);
}
+ /**
+ * Set the predicate used to determine if generated assertions should be signed.
+ *
+ * @param predicate predicate used to determine if generated assertions should be signed
+ */
+ public void setSignAssertionsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+ signAssertionsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
+ }
+
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfiguration.java
index ce206a990..4d47d7134 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfiguration.java
@@ -21,14 +21,13 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.logic.NoIntegrityMessageChannelPredicate;
+import net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
/** Configuration support for SAML 1 attribute query requests. */
-public class AttributeQueryProfileConfiguration extends AbstractSAML1ArtifactAwareProfileConfiguration {
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID =
- "http://shibboleth.net/ns/profiles/saml1/query/attribute";
+public class AttributeQueryProfileConfiguration extends AbstractSAML1AssertionProducingProfileConfiguration
+ implements net.shibboleth.saml.saml1.profile.config.AttributeQueryProfileConfiguration,
+ SAMLAssertionProducingProfileConfiguration {
/** Constructor. */
public AttributeQueryProfileConfiguration() {
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfiguration.java
index 84261ac82..3d94bf0b8 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfiguration.java
@@ -32,6 +32,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
import net.shibboleth.idp.saml.authn.principal.AuthenticationMethodPrincipal;
import net.shibboleth.profile.config.AttributeResolvingProfileConfiguration;
+import net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NonNegative;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
@@ -44,11 +45,10 @@ import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.primitive.StringSupport;
/** Configuration for SAML 1 Browser SSO profile requests. */
-public class BrowserSSOProfileConfiguration extends AbstractSAML1ArtifactAwareProfileConfiguration
- implements AuthenticationProfileConfiguration, AttributeResolvingProfileConfiguration {
-
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml1/sso/browser";
+public class BrowserSSOProfileConfiguration extends AbstractSAML1AssertionProducingProfileConfiguration
+ implements net.shibboleth.saml.saml1.profile.config.BrowserSSOProfileConfiguration,
+ AuthenticationProfileConfiguration, AttributeResolvingProfileConfiguration,
+ SAMLAssertionProducingProfileConfiguration {
/** Whether attributes should be resolved in the course of the profile. */
@Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate;
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2AssertionProducingProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2AssertionProducingProfileConfiguration.java
index 85fddb1fe..a79ac47f6 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2AssertionProducingProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AbstractSAML2AssertionProducingProfileConfiguration.java
@@ -17,28 +17,56 @@
package net.shibboleth.idp.saml.saml2.profile.config;
+import java.time.Duration;
+import java.util.Collection;
+import java.util.Set;
+import java.util.function.Function;
import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration;
import net.shibboleth.saml.saml2.profile.config.SAML2AssertionProducingProfileConfiguration;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.logic.PredicateSupport;
+import net.shibboleth.shared.primitive.DeprecationSupport;
+import net.shibboleth.shared.primitive.DeprecationSupport.ObjectType;
+import net.shibboleth.shared.primitive.StringSupport;
import org.opensaml.profile.context.ProfileRequestContext;
-/** Base class for SAML 2 profile configurations. */
+/** Base class for IdP SAML 2.0 profile configurations that produce assertions. */
public abstract class AbstractSAML2AssertionProducingProfileConfiguration
extends AbstractSAML2ArtifactAwareProfileConfiguration
implements SAML2AssertionProducingProfileConfiguration {
+ /** Predicate used to determine whether to sign assertions. */
+ @Nonnull private Predicate<ProfileRequestContext> signAssertionsPredicate;
+
+ /**
+ * Predicate used to determine whether to include a NotBefore attribute in the
+ * Conditions of generated assertions.
+ */
+ @Nonnull private Predicate<ProfileRequestContext> includeNotBeforePredicate;
+
+ /** Lookup function to supply assertionLifetime property. */
+ @Nonnull private Function<ProfileRequestContext,Duration> assertionLifetimeLookupStrategy;
+
+ /** Lookup function to supply assertionAudiences property. */
+ @Nonnull private Function<ProfileRequestContext,Set<String>> additionalAudiencesLookupStrategy;
+
/** Predicate used to determine if assertions should be encrypted. */
@Nonnull private Predicate<ProfileRequestContext> encryptAssertionsPredicate;
/** Predicate used to determine if attributes should be encrypted. */
@Nonnull private Predicate<ProfileRequestContext> encryptAttributesPredicate;
+
/**
* Constructor.
@@ -48,10 +76,159 @@ public abstract class AbstractSAML2AssertionProducingProfileConfiguration
public AbstractSAML2AssertionProducingProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
+ signAssertionsPredicate = PredicateSupport.alwaysFalse();
+ includeNotBeforePredicate = PredicateSupport.alwaysTrue();
+ assertionLifetimeLookupStrategy =
+ FunctionSupport.constant(SAMLAssertionProducingProfileConfiguration.DEFAULT_ASSERTION_LIFETIME);
+ additionalAudiencesLookupStrategy = FunctionSupport.constant(null);
+
encryptAssertionsPredicate = PredicateSupport.alwaysFalse();
encryptAttributesPredicate = PredicateSupport.alwaysFalse();
}
+ /** {@inheritDoc} */
+ public boolean isSignAssertions(@Nullable final ProfileRequestContext profileRequestContext) {
+ return signAssertionsPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether generated assertions should be signed.
+ *
+ * @param flag flag to set
+ */
+ public void setSignAssertions(final boolean flag) {
+ signAssertionsPredicate = PredicateSupport.constant(flag);
+ }
+
+ /**
+ * Set the predicate used to determine if generated assertions should be signed.
+ *
+ * @param predicate predicate used to determine if generated assertions should be signed
+ */
+ public void setSignAssertionsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+ signAssertionsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
+ }
+
+ /**{@inheritDoc} */
+ public boolean isIncludeConditionsNotBefore(@Nullable final ProfileRequestContext profileRequestContext) {
+ return includeNotBeforePredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to include a NotBefore attribute in the Conditions of generated assertions.
+ *
+ * @param flag flag to set
+ */
+ public void setIncludeConditionsNotBefore(final boolean flag) {
+ includeNotBeforePredicate = PredicateSupport.constant(flag);
+ }
+
+ /**
+ * Set a condition to determine whether to include a NotBefore attribute in the Conditions of
+ * generated assertions.
+ *
+ * @param condition lookup strategy
+ */
+ public void setIncludeConditionsNotBeforePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ includeNotBeforePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public Duration getAssertionLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
+ final Duration lifetime = assertionLifetimeLookupStrategy.apply(profileRequestContext);
+ Constraint.isNotNull(lifetime, "Assertion lifetime cannot be null");
+ Constraint.isFalse(lifetime.isNegative() || lifetime.isZero(), "Assertion lifetime must be greater than 0");
+ return lifetime;
+ }
+
+ /**
+ * Set the lifetime of an assertion.
+ *
+ * @param lifetime lifetime of an assertion
+ */
+ public void setAssertionLifetime(@Nonnull final Duration lifetime) {
+ Constraint.isNotNull(lifetime, "Assertion lifetime cannot be null");
+ Constraint.isFalse(lifetime.isNegative() || lifetime.isZero(), "Assertion lifetime must be greater than 0");
+
+ assertionLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
+ }
+
+ /**
+ * Set a lookup strategy for the lifetime of an assertion.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setAssertionLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext,Duration> strategy) {
+ assertionLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull @NonnullElements @NotLive public Set<String> getAssertionAudiences(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+
+ final Set<String> audiences = additionalAudiencesLookupStrategy.apply(profileRequestContext);
+ if (audiences != null) {
+ return CollectionSupport.copyToSet(audiences);
+ }
+ return CollectionSupport.emptySet();
+ }
+
+ /**
+ * Deprecated, replacement is {@link #setAssertionAudiences(Collection)}.
+ *
+ * @param audiences the additional audiences
+ *
+ * @deprecated
+ */
+ @Deprecated(since="5.0.0", forRemoval=true)
+ public void setAdditionalAudiencesForAssertion(@Nullable @NonnullElements final Collection<String> audiences) {
+ DeprecationSupport.warn(ObjectType.METHOD, "setAdditionalAudiencesForAssertion", "relying-party.xml",
+ "setAdditionalAudiences");
+ setAssertionAudiences(audiences);
+ }
+
+ /**
+ * Deprecated, replacement is {@link #setAssertionAudiencesLookupStrategy(Function)}.
+ *
+ * @param strategy lookup strategy
+ *
+ * @deprecated
+ */
+ @Deprecated(since="5.0.0", forRemoval=true)
+ public void setAdditionalAudiencesForAssertionLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
+ DeprecationSupport.warn(ObjectType.METHOD, "setAdditionalAudiencesForAssertionLookupStrategy",
+ "relying-party.xml", "setAdditionalAudiences");
+ setAssertionAudiencesLookupStrategy(strategy);
+ }
+
+ /**
+ * Set the set of audiences, in addition to the relying party(ies) to which the IdP is issuing the assertion, with
+ * which an assertion may be shared.
+ *
+ * @param audiences the additional audiences
+ */
+ public void setAssertionAudiences(@Nullable @NonnullElements final Collection<String> audiences) {
+
+ if (audiences == null || audiences.isEmpty()) {
+ additionalAudiencesLookupStrategy = FunctionSupport.constant(null);
+ } else {
+ additionalAudiencesLookupStrategy = FunctionSupport.constant(
+ Set.copyOf(StringSupport.normalizeStringCollection(audiences)));
+ }
+ }
+
+ /**
+ * Set a lookup strategy for the set of audiences, in addition to the relying party(ies) to which the IdP
+ * is issuing the assertion, with which an assertion may be shared.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setAssertionAudiencesLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
+ additionalAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
/** {@inheritDoc} */
public boolean isEncryptAssertions(@Nullable final ProfileRequestContext profileRequestContext) {
return encryptAssertionsPredicate.test(profileRequestContext);
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
index 8b6f3f3cd..ea8589c5b 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfiguration.java
@@ -34,15 +34,15 @@ import net.shibboleth.shared.logic.PredicateSupport;
public class ArtifactResolutionProfileConfiguration extends AbstractSAML2ProfileConfiguration
implements net.shibboleth.saml.saml2.profile.config.ArtifactResolutionProfileConfiguration {
- /** ID for this profile configuration. */
- @Nonnull @NotEmpty public static final String PROFILE_ID = "http://shibboleth.net/ns/profiles/saml2/query/artifact";
+ /** Predicate used to determine whether to sign assertions. */
+ @Nonnull private Predicate<ProfileRequestContext> signAssertionsPredicate;
/** Predicate used to determine if assertions should be encrypted. */
@Nonnull private Predicate<ProfileRequestContext> encryptAssertionsPredicate;
/** Predicate used to determine if attributes should be encrypted. */
@Nonnull private Predicate<ProfileRequestContext> encryptAttributesPredicate;
-
+
/** Constructor. */
public ArtifactResolutionProfileConfiguration() {
this(PROFILE_ID);
@@ -56,10 +56,36 @@ public class ArtifactResolutionProfileConfiguration extends AbstractSAML2Profile
protected ArtifactResolutionProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
super(profileId);
setSignResponsesPredicate(new NoIntegrityMessageChannelPredicate());
+
+ signAssertionsPredicate = PredicateSupport.alwaysFalse();
+
encryptAssertionsPredicate = new NoConfidentialityMessageChannelPredicate();
encryptAttributesPredicate = PredicateSupport.alwaysFalse();
}
+
+ /** {@inheritDoc} */
+ public boolean isSignAssertions(@Nullable final ProfileRequestContext profileRequestContext) {
+ return signAssertionsPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether generated assertions should be signed.
+ *
+ * @param flag flag to set
+ */
+ public void setSignAssertions(final boolean flag) {
+ signAssertionsPredicate = PredicateSupport.constant(flag);
+ }
+ /**
+ * Set the predicate used to determine if generated assertions should be signed.
+ *
+ * @param predicate predicate used to determine if generated assertions should be signed
+ */
+ public void setSignAssertionsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
+ signAssertionsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
+ }
+
/** {@inheritDoc} */
public boolean isEncryptAssertions(@Nullable final ProfileRequestContext profileRequestContext) {
return encryptAssertionsPredicate.test(profileRequestContext);
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index 26612053a..94c532a11 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -96,7 +96,10 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
/** Whether to require requests be signed. */
@Nonnull private Predicate<ProfileRequestContext> requireSignedRequestsPredicate;
-
+
+ /** Whether to require assertions be signed. */
+ @Nonnull private Predicate<ProfileRequestContext> requireSignedAssertionsPredicate;
+
/** Lookup function to supply maximum session lifetime. */
@Nonnull private Function<ProfileRequestContext,Duration> maximumSPSessionLifetimeLookupStrategy;
@@ -134,7 +137,16 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
/** Lookup function to supply NameID formats. */
@Nonnull private Function<ProfileRequestContext,Collection<String>> nameIDFormatPrecedenceLookupStrategy;
+
+ /** Lookup function to supply SPNameQualifier in request. */
+ @Nonnull private Function<ProfileRequestContext,String> spNameQualifierLookupStrategy;
+
+ /** Lookup function to supply AttributeConsumingServiceIndex in request. */
+ @Nonnull private Function<ProfileRequestContext,String> attributeIndexLookupStrategy;
+ /** Lookup function to supply RequestedAttributes in request. */
+ @Nonnull private Function<ProfileRequestContext,Collection<RequestedAttribute>> requestedAttributesLookupStrategy;
+
/** Constructor. */
public BrowserSSOProfileConfiguration() {
this(PROFILE_ID);
@@ -160,6 +172,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
proxiedAuthnInstantPredicate = PredicateSupport.alwaysTrue();
suppressAuthenticatingAuthorityPredicate = PredicateSupport.alwaysFalse();
requireSignedRequestsPredicate = PredicateSupport.alwaysFalse();
+ requireSignedAssertionsPredicate = PredicateSupport.alwaysFalse();
maximumSPSessionLifetimeLookupStrategy = FunctionSupport.constant(null);
maximumTimeSinceAuthnLookupStrategy = FunctionSupport.constant(null);
maximumTokenDelegationChainLengthLookupStrategy = FunctionSupport.constant(DEFAULT_DELEGATION_CHAIN_LENGTH);
@@ -171,6 +184,9 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
authnContextComparisonLookupStrategy = new ProxyAwareAuthnContextComparisonLookupFunction();
defaultAuthenticationContextsLookupStrategy = new ProxyAwareDefaultAuthenticationMethodsLookupFunction();
nameIDFormatPrecedenceLookupStrategy = FunctionSupport.constant(null);
+ spNameQualifierLookupStrategy = FunctionSupport.constant(null);
+ attributeIndexLookupStrategy = FunctionSupport.constant(null);
+ requestedAttributesLookupStrategy = FunctionSupport.constant(null);
}
/** {@inheritDoc} */
@@ -552,6 +568,34 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
public void setRequireSignedRequestsPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
requireSignedRequestsPredicate = Constraint.isNotNull(condition, "Signed requests predicate cannot be null");
}
+
+ /** {@inheritDoc} */
+ public boolean isRequireSignedAssertions(@Nullable final ProfileRequestContext profileRequestContext) {
+ return requireSignedAssertionsPredicate.test(profileRequestContext);
+ }
+
+ /**
+ * Set whether to require signed assertions.
+ *
+ * @param flag flag to set
+ *
+ * @since 5.0.0
+ */
+ public void setRequireSignedAssertions(final boolean flag) {
+ requireSignedAssertionsPredicate = PredicateSupport.constant(flag);
+ }
+
+ /**
+ * Set a condition to determine whether to require signed assertions.
+ *
+ * @param condition condition to set
+ *
+ * @since 5.0.0
+ */
+ public void setRequireSignedAssertionsPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ requireSignedAssertionsPredicate = Constraint.isNotNull(condition,
+ "Signed assertions predicate cannot be null");
+ }
/**
* Get the maximum amount of time the service provider should maintain a session for the user
@@ -1030,24 +1074,94 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
}
/** {@inheritDoc} */
- @Nullable
- public String getNameQualifier(@Nullable final ProfileRequestContext profileRequestContext) {
- // TODO Auto-generated method stub
- return null;
+ @Nullable public String getSPNameQualifier(@Nullable final ProfileRequestContext profileRequestContext) {
+ return spNameQualifierLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Sets the SPNameQualifier to include in requests.
+ *
+ * @param qualifier the SPNameQualifier to include
+ *
+ * @since 5.0.0
+ */
+ public void setSPNameQualifier(@Nullable final String qualifier) {
+ spNameQualifierLookupStrategy = FunctionSupport.constant(qualifier);
+ }
+
+ /**
+ * Sets a lookup strategy for the SPNameQualifier to include in requests.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 5.0.0
+ */
+ public void setSPNameQualifierLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ spNameQualifierLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
/** {@inheritDoc} */
- @Nullable
- public String getAttributeIndex(@Nullable final ProfileRequestContext profileRequestContext) {
- // TODO Auto-generated method stub
- return null;
+ @Nullable public String getAttributeIndex(@Nullable final ProfileRequestContext profileRequestContext) {
+ return attributeIndexLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Sets the AttributeConsumingServiceIndex to include in requests.
+ *
+ * @param index the index to include
+ *
+ * @since 5.0.0
+ */
+ public void setAttributeIndex(@Nullable final String index) {
+ attributeIndexLookupStrategy = FunctionSupport.constant(index);
+ }
+
+ /**
+ * Sets a lookup strategy for the AttributeConsumingServiceIndex to include in requests.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 5.0.0
+ */
+ public void setAttributeIndexLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
+ attributeIndexLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
}
/** {@inheritDoc} */
- @Nonnull public Collection<RequestedAttribute> getRequestedAttributes(
+ @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<RequestedAttribute> getRequestedAttributes(
@Nullable final ProfileRequestContext profileRequestContext) {
- // TODO Auto-generated method stub
+ final Collection<RequestedAttribute> attrs = requestedAttributesLookupStrategy.apply(profileRequestContext);
+ if (attrs != null) {
+ return CollectionSupport.copyToList(attrs);
+ }
return CollectionSupport.emptyList();
}
+ /**
+ * Set the {@link RequestedAttribute} objects to include in request.
+ *
+ * @param attrs requested attributes to include
+ *
+ * @since 5.0.0
+ */
+ public void setRequestedAttributes(@Nullable @NonnullElements final Collection<RequestedAttribute> attrs) {
+ if (attrs != null) {
+ requestedAttributesLookupStrategy = FunctionSupport.constant(CollectionSupport.copyToList(attrs));
+ } else {
+ requestedAttributesLookupStrategy = FunctionSupport.constant(null);
+ }
+ }
+
+ /**
+ * Set a lookup strategy for the name identifier formats to use.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 5.0.0
+ */
+ public void setRequestedAttributesLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Collection<RequestedAttribute>> strategy) {
+ requestedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyAwareDefaultAuthenticationMethodsLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyAwareDefaultAuthenticationMethodsLookupFunction.java
index 25f97d0b5..1916109f8 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyAwareDefaultAuthenticationMethodsLookupFunction.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyAwareDefaultAuthenticationMethodsLookupFunction.java
@@ -19,7 +19,6 @@ package net.shibboleth.idp.saml.saml2.profile.config.navigate;
import java.security.Principal;
import java.util.Collection;
-import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
@@ -95,7 +94,7 @@ public class ProxyAwareDefaultAuthenticationMethodsLookupFunction
if (principalMappings.containsKey(p)) {
return principalMappings.get(p);
}
- return Collections.singletonList(p);
+ return CollectionSupport.singletonList(p);
})
.flatMap(Collection::stream)
.filter(AuthnContextClassRefPrincipal.class::isInstance)
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyRestrictionLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyRestrictionLookupFunction.java
index 927f6c9d4..09af402b2 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyRestrictionLookupFunction.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyRestrictionLookupFunction.java
@@ -77,7 +77,7 @@ public class ProxyRestrictionLookupFunction extends AbstractRelyingPartyLookupFu
final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
if (rpc != null) {
final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null && pc instanceof BrowserSSOProfileConfiguration) {
+ if (pc instanceof BrowserSSOProfileConfiguration) {
proxyCount = ((BrowserSSOProfileConfiguration) pc).getProxyCount(input);
final Set<String> configAudiences = ((BrowserSSOProfileConfiguration) pc).getProxyAudiences(input);
if (configAudiences != null && !configAudiences.isEmpty()) {
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfigurationTest.java
index 16458513d..4fddfabe3 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/profile/config/AbstractSAMLProfileConfigurationTest.java
@@ -17,15 +17,6 @@
package net.shibboleth.idp.saml.profile.config;
-import java.time.Duration;
-import java.util.Arrays;
-import java.util.HashSet;
-import java.util.Set;
-
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.logic.PredicateSupport;
-
import org.testng.Assert;
import org.testng.annotations.Test;
@@ -33,13 +24,6 @@ import org.testng.annotations.Test;
@SuppressWarnings("javadoc")
public class AbstractSAMLProfileConfigurationTest {
- @Test public void testSignAssertionsCriteria() {
- final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
-
- config.setSignAssertions(false);
- Assert.assertFalse(config.isSignAssertions(null));
- }
-
@Test public void testSignResponsesCriteria() {
final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
@@ -54,90 +38,6 @@ public class AbstractSAMLProfileConfigurationTest {
Assert.assertFalse(config.isSignRequests(null));
}
- @Test public void testAssertionLifetime() {
- final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
- Assert.assertTrue(config.getAssertionLifetime(null).toMillis() > 0);
-
- config.setAssertionLifetime(Duration.ofMillis(100));
- Assert.assertEquals(config.getAssertionLifetime(null), Duration.ofMillis(100));
-
- try {
- config.setAssertionLifetime(Duration.ZERO);
- Assert.fail();
- } catch (ConstraintViolationException e) {
- // expected this
- }
-
- try {
- config.setAssertionLifetime(Duration.ofMillis(-100));
- Assert.fail();
- } catch (ConstraintViolationException e) {
- // expected this
- }
- }
-
- @Test public void testIndirectAssertionLifetime() {
- final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
- config.setAssertionLifetimeLookupStrategy(FunctionSupport.constant(Duration.ofMillis(500)));
- Assert.assertEquals(config.getAssertionLifetime(null), Duration.ofMillis(500));
-
- config.setAssertionLifetimeLookupStrategy(FunctionSupport.constant(null));
- try {
- config.getAssertionLifetime(null);
- Assert.fail();
- } catch (ConstraintViolationException e) {
- // expected this
- }
- }
-
- @Test public void testIncludeNotBefore() {
- final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
- Assert.assertTrue(config.isIncludeConditionsNotBefore(null));
-
- config.setIncludeConditionsNotBefore(false);
- Assert.assertFalse(config.isIncludeConditionsNotBefore(null));
- }
-
- @Test public void testIndirectIncludeNotBefore() {
- final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
-
- config.setIncludeConditionsNotBeforePredicate(PredicateSupport.alwaysFalse());
- Assert.assertFalse(config.isIncludeConditionsNotBefore(null));
- }
-
- @Test public void testAdditionalAudiencesForAssertion() {
- final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
- Assert.assertNotNull(config.getAdditionalAudiencesForAssertion(null));
- Assert.assertTrue(config.getAdditionalAudiencesForAssertion(null).isEmpty());
-
- config.setAdditionalAudiencesForAssertion(Arrays.asList("", null, " foo"));
-
- final Set<String> audiences = config.getAdditionalAudiencesForAssertion(null);
- Assert.assertNotNull(audiences);
- Assert.assertEquals(audiences.size(), 1);
- Assert.assertTrue(audiences.contains("foo"));
-
- try {
- audiences.add("bar");
- Assert.fail();
- } catch (UnsupportedOperationException e) {
- // expected this
- }
-
- config.setAdditionalAudiencesForAssertion(null);
- Assert.assertNotNull(config.getAdditionalAudiencesForAssertion(null));
- Assert.assertTrue(config.getAdditionalAudiencesForAssertion(null).isEmpty());
- }
-
- @Test public void testIndirectAudiencesForAssertion() {
- final MockSAMLProfileConfiguration config = new MockSAMLProfileConfiguration();
- final Set<String> audiences = new HashSet<>();
- audiences.add("foo");
- audiences.add("bar");
- config.setAdditionalAudiencesForAssertionLookupStrategy(FunctionSupport.constant(audiences));
- Assert.assertEquals(config.getAdditionalAudiencesForAssertion(null), audiences);
- }
-
/** Mock class for test {@link AbstractSAMLProfileConfiguration}. */
private static class MockSAMLProfileConfiguration extends AbstractSAMLProfileConfiguration {
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/ArtifactResolutionProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/ArtifactResolutionProfileConfigurationTest.java
index c720e1aa0..c40cef173 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/ArtifactResolutionProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/ArtifactResolutionProfileConfigurationTest.java
@@ -27,10 +27,14 @@ public class ArtifactResolutionProfileConfigurationTest {
@Test
public void testProfileId() {
- Assert.assertEquals(ArtifactResolutionProfileConfiguration.PROFILE_ID,
- "http://shibboleth.net/ns/profiles/saml1/query/artifact");
-
ArtifactResolutionProfileConfiguration config = new ArtifactResolutionProfileConfiguration();
Assert.assertEquals(config.getId(), ArtifactResolutionProfileConfiguration.PROFILE_ID);
}
+
+ @Test public void testSignAssertionsCriteria() {
+ final ArtifactResolutionProfileConfiguration config = new ArtifactResolutionProfileConfiguration();
+
+ config.setSignAssertions(false);
+ Assert.assertFalse(config.isSignAssertions(null));
+ }
}
\ No newline at end of file
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfigurationTest.java
index 57c1980d3..88e27e714 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/AttributeQueryProfileConfigurationTest.java
@@ -31,9 +31,6 @@ public class AttributeQueryProfileConfigurationTest {
@Test
public void testProfileId() {
- Assert.assertEquals(AttributeQueryProfileConfiguration.PROFILE_ID,
- "http://shibboleth.net/ns/profiles/saml1/query/attribute");
-
final AttributeQueryProfileConfiguration config = new AttributeQueryProfileConfiguration();
Assert.assertEquals(config.getId(), AttributeQueryProfileConfiguration.PROFILE_ID);
}
@@ -60,4 +57,10 @@ public class AttributeQueryProfileConfigurationTest {
Assert.assertSame(config.getArtifactConfiguration(null), artifactConfiguration);
}
+ @Test public void testSignAssertionsCriteria() {
+ final AttributeQueryProfileConfiguration config = new AttributeQueryProfileConfiguration();
+
+ config.setSignAssertions(false);
+ Assert.assertFalse(config.isSignAssertions(null));
+ }
}
\ No newline at end of file
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfigurationTest.java
index fbbec670d..17d72485e 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/BrowserSSOProfileConfigurationTest.java
@@ -20,6 +20,7 @@ package net.shibboleth.idp.saml.saml1.profile.config;
import net.shibboleth.idp.saml.authn.principal.AuthenticationMethodPrincipal;
import net.shibboleth.idp.saml.profile.config.BasicSAMLArtifactConfiguration;
import net.shibboleth.idp.saml.profile.config.SAMLArtifactConfiguration;
+import net.shibboleth.shared.logic.ConstraintViolationException;
import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.logic.PredicateSupport;
@@ -27,6 +28,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.testng.Assert;
import org.testng.annotations.Test;
+import java.time.Duration;
import java.util.*;
/** Unit test for {@link BrowserSSOProfileConfiguration}. */
@@ -35,11 +37,100 @@ public class BrowserSSOProfileConfigurationTest {
@Test
public void testProfileId() {
- Assert.assertEquals(BrowserSSOProfileConfiguration.PROFILE_ID, "http://shibboleth.net/ns/profiles/saml1/sso/browser");
-
final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
Assert.assertEquals(config.getId(), BrowserSSOProfileConfiguration.PROFILE_ID);
}
+
+ @Test public void testSignAssertions() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+
+ config.setSignAssertions(false);
+ Assert.assertFalse(config.isSignAssertions(null));
+ }
+
+ @Test public void testAssertionLifetime() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+ Assert.assertTrue(config.getAssertionLifetime(null).toMillis() > 0);
+
+ config.setAssertionLifetime(Duration.ofMillis(100));
+ Assert.assertEquals(config.getAssertionLifetime(null), Duration.ofMillis(100));
+
+ try {
+ config.setAssertionLifetime(Duration.ZERO);
+ Assert.fail();
+ } catch (ConstraintViolationException e) {
+ // expected this
+ }
+
+ try {
+ config.setAssertionLifetime(Duration.ofMillis(-100));
+ Assert.fail();
+ } catch (ConstraintViolationException e) {
+ // expected this
+ }
+ }
+
+ @Test public void testIndirectAssertionLifetime() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+ config.setAssertionLifetimeLookupStrategy(FunctionSupport.constant(Duration.ofMillis(500)));
+ Assert.assertEquals(config.getAssertionLifetime(null), Duration.ofMillis(500));
+
+ config.setAssertionLifetimeLookupStrategy(FunctionSupport.constant(null));
+ try {
+ config.getAssertionLifetime(null);
+ Assert.fail();
+ } catch (ConstraintViolationException e) {
+ // expected this
+ }
+ }
+
+ @Test public void testIncludeNotBefore() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+ Assert.assertTrue(config.isIncludeConditionsNotBefore(null));
+
+ config.setIncludeConditionsNotBefore(false);
+ Assert.assertFalse(config.isIncludeConditionsNotBefore(null));
+ }
+
+ @Test public void testIndirectIncludeNotBefore() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+
+ config.setIncludeConditionsNotBeforePredicate(PredicateSupport.alwaysFalse());
+ Assert.assertFalse(config.isIncludeConditionsNotBefore(null));
+ }
+
+ @Test public void testAdditionalAudiencesForAssertion() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+ Assert.assertNotNull(config.getAssertionAudiences(null));
+ Assert.assertTrue(config.getAssertionAudiences(null).isEmpty());
+
+ config.setAssertionAudiences(Arrays.asList("", null, " foo"));
+
+ final Set<String> audiences = config.getAssertionAudiences(null);
+ Assert.assertNotNull(audiences);
+ Assert.assertEquals(audiences.size(), 1);
+ Assert.assertTrue(audiences.contains("foo"));
+
+ try {
+ audiences.add("bar");
+ Assert.fail();
+ } catch (UnsupportedOperationException e) {
+ // expected this
+ }
+
+ config.setAssertionAudiences(null);
+ Assert.assertNotNull(config.getAssertionAudiences(null));
+ Assert.assertTrue(config.getAssertionAudiences(null).isEmpty());
+ }
+
+ @Test public void testIndirectAudiencesForAssertion() {
+final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+ final Set<String> audiences = new HashSet<>();
+ audiences.add("foo");
+ audiences.add("bar");
+ config.setAssertionAudiencesLookupStrategy(FunctionSupport.constant(audiences));
+ Assert.assertEquals(config.getAssertionAudiences(null), audiences);
+ }
@Test
public void testResolveAttributes(){
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfigurationTest.java
index 25b9a0d96..cfc093f00 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/ArtifactResolutionProfileConfigurationTest.java
@@ -26,13 +26,17 @@ public class ArtifactResolutionProfileConfigurationTest {
@Test
public void testProfileId() {
- Assert.assertEquals(ArtifactResolutionProfileConfiguration.PROFILE_ID,
- "http://shibboleth.net/ns/profiles/saml2/query/artifact");
-
final ArtifactResolutionProfileConfiguration config = new ArtifactResolutionProfileConfiguration();
Assert.assertEquals(config.getId(), ArtifactResolutionProfileConfiguration.PROFILE_ID);
}
+ @Test public void testSignAssertionsCriteria() {
+ final ArtifactResolutionProfileConfiguration config = new ArtifactResolutionProfileConfiguration();
+
+ config.setSignAssertions(false);
+ Assert.assertFalse(config.isSignAssertions(null));
+ }
+
@Test public void testEncryptAssertionsPredicate() {
final ArtifactResolutionProfileConfiguration config = new ArtifactResolutionProfileConfiguration();
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java
index 5c50a457d..7ad59124b 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfigurationTest.java
@@ -30,9 +30,6 @@ public class AttributeQueryProfileConfigurationTest {
@Test
public void testProfileId() {
- Assert.assertEquals(AttributeQueryProfileConfiguration.PROFILE_ID,
- "http://shibboleth.net/ns/profiles/saml2/query/attribute");
-
final AttributeQueryProfileConfiguration config = new AttributeQueryProfileConfiguration();
Assert.assertEquals(config.getId(), AttributeQueryProfileConfiguration.PROFILE_ID);
}
@@ -74,6 +71,13 @@ public class AttributeQueryProfileConfigurationTest {
Assert.assertTrue(config.isClientTLSArtifactRequests(null));
}
+ @Test public void testSignAssertionsCriteria() {
+ final AttributeQueryProfileConfiguration config = new AttributeQueryProfileConfiguration();
+
+ config.setSignAssertions(false);
+ Assert.assertFalse(config.isSignAssertions(null));
+ }
+
@Test public void testEncryptAssertionsPredicate() {
final AttributeQueryProfileConfiguration config = new AttributeQueryProfileConfiguration();
diff --git a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java
index 1e35898d3..2170ffb27 100644
--- a/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java
+++ b/idp-saml-api/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfigurationTest.java
@@ -20,11 +20,13 @@ package net.shibboleth.idp.saml.saml2.profile.config;
import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
import net.shibboleth.idp.saml.profile.config.BasicSAMLArtifactConfiguration;
import net.shibboleth.idp.saml.profile.config.SAMLArtifactConfiguration;
+import net.shibboleth.shared.logic.ConstraintViolationException;
import net.shibboleth.shared.logic.FunctionSupport;
import net.shibboleth.shared.logic.PredicateSupport;
import java.time.Duration;
import java.util.ArrayList;
+import java.util.Arrays;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
@@ -39,12 +41,102 @@ public class BrowserSSOProfileConfigurationTest {
@Test
public void testProfileId() {
- Assert.assertEquals(BrowserSSOProfileConfiguration.PROFILE_ID, "http://shibboleth.net/ns/profiles/saml2/sso/browser");
-
final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
Assert.assertEquals(config.getId(), BrowserSSOProfileConfiguration.PROFILE_ID);
}
+ @Test public void testSignAssertions() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+
+ config.setSignAssertions(false);
+ Assert.assertFalse(config.isSignAssertions(null));
+ }
+
+ @Test public void testAssertionLifetime() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+ Assert.assertTrue(config.getAssertionLifetime(null).toMillis() > 0);
+
+ config.setAssertionLifetime(Duration.ofMillis(100));
+ Assert.assertEquals(config.getAssertionLifetime(null), Duration.ofMillis(100));
+
+ try {
+ config.setAssertionLifetime(Duration.ZERO);
+ Assert.fail();
+ } catch (ConstraintViolationException e) {
+ // expected this
+ }
+
+ try {
+ config.setAssertionLifetime(Duration.ofMillis(-100));
+ Assert.fail();
+ } catch (ConstraintViolationException e) {
+ // expected this
+ }
+ }
+
+ @Test public void testIndirectAssertionLifetime() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+ config.setAssertionLifetimeLookupStrategy(FunctionSupport.constant(Duration.ofMillis(500)));
+ Assert.assertEquals(config.getAssertionLifetime(null), Duration.ofMillis(500));
+
+ config.setAssertionLifetimeLookupStrategy(FunctionSupport.constant(null));
+ try {
+ config.getAssertionLifetime(null);
+ Assert.fail();
+ } catch (ConstraintViolationException e) {
+ // expected this
+ }
+ }
+
+ @Test public void testIncludeNotBefore() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+ Assert.assertTrue(config.isIncludeConditionsNotBefore(null));
+
+ config.setIncludeConditionsNotBefore(false);
+ Assert.assertFalse(config.isIncludeConditionsNotBefore(null));
+ }
+
+ @Test public void testIndirectIncludeNotBefore() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+
+ config.setIncludeConditionsNotBeforePredicate(PredicateSupport.alwaysFalse());
+ Assert.assertFalse(config.isIncludeConditionsNotBefore(null));
+ }
+
+ @Test public void testAdditionalAudiencesForAssertion() {
+ final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+ Assert.assertNotNull(config.getAssertionAudiences(null));
+ Assert.assertTrue(config.getAssertionAudiences(null).isEmpty());
+
+ config.setAssertionAudiences(Arrays.asList("", null, " foo"));
+
+ final Set<String> audiences = config.getAssertionAudiences(null);
+ Assert.assertNotNull(audiences);
+ Assert.assertEquals(audiences.size(), 1);
+ Assert.assertTrue(audiences.contains("foo"));
+
+ try {
+ audiences.add("bar");
+ Assert.fail();
+ } catch (UnsupportedOperationException e) {
+ // expected this
+ }
+
+ config.setAssertionAudiences(null);
+ Assert.assertNotNull(config.getAssertionAudiences(null));
+ Assert.assertTrue(config.getAssertionAudiences(null).isEmpty());
+ }
+
+ @Test public void testIndirectAudiencesForAssertion() {
+final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
+ final Set<String> audiences = new HashSet<>();
+ audiences.add("foo");
+ audiences.add("bar");
+ config.setAssertionAudiencesLookupStrategy(FunctionSupport.constant(audiences));
+ Assert.assertEquals(config.getAssertionAudiences(null), audiences);
+ }
+
+
@Test
public void testResolveAttributes(){
final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
index 41ba14611..8a220f974 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
@@ -52,6 +52,7 @@ import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.idp.profile.IdPEventIds;
import net.shibboleth.idp.saml.saml2.profile.config.SingleLogoutProfileConfiguration;
import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.saml.saml2.profile.config.ArtifactResolutionProfileConfiguration;
import net.shibboleth.saml.saml2.profile.config.SAML2AssertionProducingProfileConfiguration;
import net.shibboleth.saml.saml2.profile.config.SAML2ProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
@@ -276,6 +277,9 @@ public class PopulateEncryptionParameters extends AbstractProfileAction {
if (profileConfiguration instanceof SAML2AssertionProducingProfileConfiguration appc) {
encryptAssertions = appc.isEncryptAssertions(profileRequestContext);
encryptAttributes = appc.isEncryptAttributes(profileRequestContext);
+ } else if (profileConfiguration instanceof ArtifactResolutionProfileConfiguration arpc) {
+ encryptAssertions = arpc.isEncryptAssertions(profileRequestContext);
+ encryptAttributes = arpc.isEncryptAttributes(profileRequestContext);
}
if (!encryptAssertions && !encryptIdentifiers && !encryptAttributes) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list