[java-identity-provider] branch main updated: IDP-2076 - Implement new SAML profile settings
Scott Cantor
cantor.2 at osu.edu
Mon Feb 27 16:42:17 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=5f463fb61f398848bfcfcf32c568bf104ebd9130
The following commit(s) were added to refs/heads/main by this push:
new 5f463fb61 IDP-2076 - Implement new SAML profile settings
5f463fb61 is described below
commit 5f463fb61f398848bfcfcf32c568bf104ebd9130
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Feb 27 11:41:47 2023 -0500
IDP-2076 - Implement new SAML profile settings
https://shibboleth.atlassian.net/browse/IDP-2076
Add RequestedAttribute support via profile config.
---
.../shibboleth/idp/conf/relying-party-mddriven.xml | 4 +
.../idp/flows/admin/resolvertest-beans.xml | 2 +-
.../idp/flows/saml/saml-abstract-beans.xml | 24 ++---
.../idp/flows/saml/saml-abstract-flow.xml | 5 +-
.../idp/flows/resolveAndFilter/beans.xml | 2 +-
.../impl/AddAttributeConsumingServiceHandler.java | 103 +++++++++++++++++++++
6 files changed, 124 insertions(+), 16 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
index c82330f65..1bc575c17 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
@@ -544,6 +544,10 @@
<property name="attributeIndexLookupStrategy">
<bean parent="shibboleth.MDDrivenIntProperty" p:propertyName="attributeIndex" />
</property>
+ <property name="requestedAttributesLookupStrategy">
+ <bean parent="shibboleth.MDDrivenListProperty" p:propertyName="requestedAttributes"
+ p:propertyType="#{T(org.opensaml.saml.saml2.metadata.RequestedAttribute)}" />
+ </property>
</bean>
<bean id="SAML2.ECP.MDDriven" parent="SAML2.SSO.MDDriven" lazy-init="true"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/resolvertest-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/resolvertest-beans.xml
index ec439d153..41b73a599 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/resolvertest-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/admin/resolvertest-beans.xml
@@ -80,7 +80,7 @@
class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
c:executionDirection="INBOUND">
<constructor-arg name="messageHandler">
- <bean class="org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler" scope="prototype" />
+ <bean class="net.shibboleth.idp.saml.messaging.impl.AddAttributeConsumingServiceHandler" scope="prototype" />
</constructor-arg>
</bean>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml
index 2ed83ea79..06a559c1f 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml
@@ -74,18 +74,6 @@
</constructor-arg>
</bean>
- <bean id="SAMLPopulateAttributeConsumingService"
- class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler" scope="prototype" />
- </constructor-arg>
- </bean>
-
- <bean id="MapRequestedAttributesInAttributeConsumingService" scope="prototype"
- class="net.shibboleth.idp.saml.saml2.profile.impl.MapRequestedAttributesInAttributeConsumingService"
- p:transcoderRegistry-ref="shibboleth.AttributeRegistryService" />
-
<bean id="InitializeRelyingPartyContextFromSAMLPeer"
class="net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer" scope="prototype" />
@@ -98,6 +86,18 @@
<bean id="SelectProfileConfiguration"
class="net.shibboleth.idp.profile.impl.SelectProfileConfiguration" scope="prototype" />
+
+ <bean id="SAMLPopulateAttributeConsumingService"
+ class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
+ c:executionDirection="INBOUND">
+ <constructor-arg name="messageHandler">
+ <bean class="net.shibboleth.idp.saml.messaging.impl.AddAttributeConsumingServiceHandler" scope="prototype" />
+ </constructor-arg>
+ </bean>
+
+ <bean id="MapRequestedAttributesInAttributeConsumingService" scope="prototype"
+ class="net.shibboleth.idp.saml.saml2.profile.impl.MapRequestedAttributesInAttributeConsumingService"
+ p:transcoderRegistry-ref="shibboleth.AttributeRegistryService" />
<bean id="PopulateSignatureValidationParameters"
class="org.opensaml.profile.action.impl.PopulateSignatureValidationParameters" scope="prototype"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml
index 953d6f3a0..e7c33b785 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml
@@ -17,8 +17,6 @@
<evaluate expression="SAML1ArtifactRequestIssuer" />
<evaluate expression="SAMLProtocolAndRole" />
<evaluate expression="SAMLMetadataLookup" />
- <evaluate expression="SAMLPopulateAttributeConsumingService" />
- <evaluate expression="MapRequestedAttributesInAttributeConsumingService" />
<evaluate expression="InitializeRelyingPartyContextFromSAMLPeer" />
<evaluate expression="SelectRelyingPartyConfiguration" />
@@ -27,6 +25,9 @@
<evaluate expression="SelectProfileConfiguration" />
+ <evaluate expression="SAMLPopulateAttributeConsumingService" />
+ <evaluate expression="MapRequestedAttributesInAttributeConsumingService" />
+
<evaluate expression="PopulateSignatureValidationParameters" />
<evaluate expression="PopulateClientTLSValidationParameters" />
diff --git a/idp-conf/src/test/resources/META-INF/net/shibboleth/idp/flows/resolveAndFilter/beans.xml b/idp-conf/src/test/resources/META-INF/net/shibboleth/idp/flows/resolveAndFilter/beans.xml
index 0246efc42..342be2931 100644
--- a/idp-conf/src/test/resources/META-INF/net/shibboleth/idp/flows/resolveAndFilter/beans.xml
+++ b/idp-conf/src/test/resources/META-INF/net/shibboleth/idp/flows/resolveAndFilter/beans.xml
@@ -43,7 +43,7 @@
scope="prototype" c:executionDirection="INBOUND">
<constructor-arg name="messageHandler">
<bean
- class="org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler"
+ class="net.shibboleth.idp.saml.messaging.impl.AddAttributeConsumingServiceHandler"
scope="prototype" />
</constructor-arg>
</bean>
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/AddAttributeConsumingServiceHandler.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/AddAttributeConsumingServiceHandler.java
new file mode 100644
index 000000000..d19bd406a
--- /dev/null
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/AddAttributeConsumingServiceHandler.java
@@ -0,0 +1,103 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.messaging.impl;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.messaging.context.navigate.ParentContextLookup;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler;
+import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.metadata.RequestedAttribute;
+
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.logic.Constraint;
+
+/**
+ * Extension of OpenSAML handler that incorporates
+ * {@link BrowserSSOProfileConfiguration#getRequestedAttributes(org.opensaml.profile.context.ProfileRequestContext)}.
+ *
+ * @since 5.0.0
+ */
+public class AddAttributeConsumingServiceHandler extends SAMLAddAttributeConsumingServiceHandler {
+
+ /** Lookup strategy for {@link ProfileRequestContext}. */
+ @Nonnull private Function<MessageContext,ProfileRequestContext> profileRequestContextLookupStrategy;
+
+ /** Lookup strategy for {@link RelyingPartyContext}. */
+ @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
+
+ /** Constructor. */
+ public AddAttributeConsumingServiceHandler() {
+ profileRequestContextLookupStrategy = new ParentContextLookup<>(ProfileRequestContext.class);
+ relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
+ }
+
+ /**
+ * Set the lookup strategy for the {@link ProfileRequestContext}.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setProfileRequestContextLookupStrategy(
+ @Nonnull final Function<MessageContext,ProfileRequestContext> strategy) {
+ profileRequestContextLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
+ * Set the lookup strategy for the {@link RelyingPartyContext}.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setRelyingPartyContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,RelyingPartyContext> strategy) {
+ relyingPartyContextLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable @NonnullElements protected Collection<RequestedAttribute> getRequestedAttributes(
+ @Nonnull final MessageContext messageContext, @Nonnull final AuthnRequest authn) {
+
+ final ProfileRequestContext prc = profileRequestContextLookupStrategy.apply(messageContext);
+ final RelyingPartyContext rpContext = relyingPartyContextLookupStrategy.apply(prc);
+ if (rpContext != null && rpContext.getProfileConfig() instanceof BrowserSSOProfileConfiguration sso) {
+ Collection<RequestedAttribute> attrs = sso.getRequestedAttributes(prc);
+ if (!attrs.isEmpty()) {
+ final ArrayList<RequestedAttribute> copy = new ArrayList<>();
+ copy.addAll(attrs);
+ attrs = super.getRequestedAttributes(messageContext, authn);
+ if (attrs != null) {
+ copy.addAll(attrs);
+ }
+ return copy;
+ }
+ }
+
+ return super.getRequestedAttributes(messageContext, authn);
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list