[java-identity-provider] branch main updated: Adjust pre-execute steps and enforce presence of child context.
Scott Cantor
cantor.2 at osu.edu
Mon Jan 23 16:02:36 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=094655489f4663e8a14e5330b51594f56fcbfb5b
The following commit(s) were added to refs/heads/main by this push:
new 094655489 Adjust pre-execute steps and enforce presence of child context.
094655489 is described below
commit 094655489f4663e8a14e5330b51594f56fcbfb5b
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jan 23 11:02:33 2023 -0500
Adjust pre-execute steps and enforce presence of child context.
---
.../idp/authn/AbstractAuthenticationAction.java | 12 ++++++
.../AbstractSubjectCanonicalizationAction.java | 43 +++++++++++++++-------
2 files changed, 41 insertions(+), 14 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractAuthenticationAction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractAuthenticationAction.java
index edaa1373d..7a3348af0 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractAuthenticationAction.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractAuthenticationAction.java
@@ -25,10 +25,12 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
import net.shibboleth.idp.authn.context.AuthenticationContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A base class for authentication related actions.
@@ -44,6 +46,9 @@ import net.shibboleth.shared.logic.Constraint;
public abstract class AbstractAuthenticationAction
extends AbstractProfileAction {
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractCredentialValidator.class);
+
/**
* Strategy used to extract, and create if necessary, the {@link AuthenticationContext} from the
* {@link ProfileRequestContext}.
@@ -81,6 +86,7 @@ public abstract class AbstractAuthenticationAction
return false;
}
+ assert authnContext != null;
return doPreExecute(profileRequestContext, authnContext);
}
return false;
@@ -89,6 +95,12 @@ public abstract class AbstractAuthenticationAction
/** {@inheritDoc} */
@Override
protected final void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ if (authnContext == null) {
+ log.error("{} AuthenticationContext not populated", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_AUTHN_CTX);
+ return;
+ }
+ assert authnContext != null;
doExecute(profileRequestContext, authnContext);
}
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractSubjectCanonicalizationAction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractSubjectCanonicalizationAction.java
index 5e7c3d8de..55ab2b7f8 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractSubjectCanonicalizationAction.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractSubjectCanonicalizationAction.java
@@ -19,7 +19,6 @@ package net.shibboleth.idp.authn;
import java.util.ArrayList;
import java.util.Collection;
-import java.util.Collections;
import java.util.List;
import java.util.function.Function;
import java.util.regex.Matcher;
@@ -32,14 +31,15 @@ import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.collection.Pair;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -83,7 +83,7 @@ public abstract class AbstractSubjectCanonicalizationAction
/** Constructor. */
public AbstractSubjectCanonicalizationAction() {
scCtxLookupStrategy = new ChildContextLookup<>(SubjectCanonicalizationContext.class, false);
- transforms = Collections.emptyList();
+ transforms = CollectionSupport.emptyList();
uppercase = false;
lowercase = false;
@@ -116,7 +116,7 @@ public abstract class AbstractSubjectCanonicalizationAction
StringSupport.trimOrNull(p.getSecond()), "Replacement expression cannot be null")));
}
} else {
- transforms = Collections.emptyList();
+ transforms = CollectionSupport.emptyList();
}
}
@@ -153,13 +153,19 @@ public abstract class AbstractSubjectCanonicalizationAction
/** {@inheritDoc} */
@Override
protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- scContext = scCtxLookupStrategy.apply(profileRequestContext);
- if (scContext == null) {
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_SUBJECT_C14N_CTX);
- return false;
+
+ if (super.doPreExecute(profileRequestContext)) {
+ scContext = scCtxLookupStrategy.apply(profileRequestContext);
+ if (scContext == null) {
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_SUBJECT_C14N_CTX);
+ return false;
+ }
+
+ assert scContext != null;
+ return doPreExecute(profileRequestContext, scContext);
}
- return doPreExecute(profileRequestContext, scContext) && super.doPreExecute(profileRequestContext);
+ return false;
}
/**
@@ -186,6 +192,12 @@ public abstract class AbstractSubjectCanonicalizationAction
/** {@inheritDoc} */
@Override
protected final void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ if (scContext == null) {
+ log.error("{} SubjectCanonicalizationContext not populated", getLogPrefix());
+ ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_SUBJECT_C14N_CTX);
+ return;
+ }
+ assert scContext != null;
doExecute(profileRequestContext, scContext);
}
@@ -225,11 +237,14 @@ public abstract class AbstractSubjectCanonicalizationAction
}
for (final Pair<Pattern,String> p : transforms) {
- final Matcher m = p.getFirst().matcher(s);
- log.debug("{} applying replacement expression '{}' against input '{}'", getLogPrefix(),
- p.getFirst().pattern(), s);
- s = m.replaceAll(p.getSecond());
- log.debug("{} result of replacement is '{}'", getLogPrefix(), s);
+ final Pattern pattern = p.getFirst();
+ if (pattern != null) {
+ final Matcher m = pattern.matcher(s);
+ log.debug("{} applying replacement expression '{}' against input '{}'", getLogPrefix(),
+ pattern.pattern(), s);
+ s = m.replaceAll(p.getSecond());
+ log.debug("{} result of replacement is '{}'", getLogPrefix(), s);
+ }
}
return s;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list