[java-shib-attribute] branch main updated: OSJ-384 - HTTP client changes to allow for preemptive basic auth

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-shib-attribute.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-attribute.git;a=commit;h=03fa3bbbb63019ad52b7130d551cbb04fabd0054

The following commit(s) were added to refs/heads/main by this push:
     new 03fa3bbbb OSJ-384 - HTTP client changes to allow for preemptive basic auth
03fa3bbbb is described below

commit 03fa3bbbb63019ad52b7130d551cbb04fabd0054
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jul 24 11:28:22 2023 -0400

    OSJ-384 - HTTP client changes to allow for preemptive basic auth
    
    https://shibboleth.atlassian.net/browse/OSJ-384
    
    Apply change to HTTP data connector.
---
 .../resolver/dc/http/impl/AbstractHTTPSearchBuilder.java          | 5 ++---
 .../attribute/resolver/dc/http/impl/HTTPDataConnectorTest.java    | 8 ++++++++
 shib-attribute-resolver-impl/src/test/resources/logback-test.xml  | 2 ++
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/shib-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/http/impl/AbstractHTTPSearchBuilder.java b/shib-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/http/impl/AbstractHTTPSearchBuilder.java
index 7dbc4a42f..dc7a5f073 100644
--- a/shib-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/http/impl/AbstractHTTPSearchBuilder.java
+++ b/shib-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/http/impl/AbstractHTTPSearchBuilder.java
@@ -163,9 +163,8 @@ public abstract class AbstractHTTPSearchBuilder extends AbstractInitializableCom
                     @Nullable final HttpClientSecurityParameters securityParameters,
                     @Nonnull final HTTPResponseMappingStrategy mappingStrategy) throws IOException {
                 
-                final HttpClientContext clientContext = HttpClientContext.create();
-                assert clientContext != null;
-                HttpClientSecuritySupport.marshalSecurityParameters(clientContext, securityParameters, true);
+                final HttpClientContext clientContext =
+                        HttpClientSecuritySupport.buildHttpClientContext(securityParameters);
                 HttpClientSecuritySupport.addDefaultTLSTrustEngineCriteria(clientContext, request);
                 final Map<String,IdPAttribute> results = client.execute(request, clientContext, mappingStrategy);
                 final String scheme = request.getScheme();
diff --git a/shib-attribute-resolver-impl/src/test/java/net/shibboleth/idp/attribute/resolver/dc/http/impl/HTTPDataConnectorTest.java b/shib-attribute-resolver-impl/src/test/java/net/shibboleth/idp/attribute/resolver/dc/http/impl/HTTPDataConnectorTest.java
index 732dcea5e..f057a1606 100644
--- a/shib-attribute-resolver-impl/src/test/java/net/shibboleth/idp/attribute/resolver/dc/http/impl/HTTPDataConnectorTest.java
+++ b/shib-attribute-resolver-impl/src/test/java/net/shibboleth/idp/attribute/resolver/dc/http/impl/HTTPDataConnectorTest.java
@@ -31,7 +31,9 @@ import java.util.Set;
 import javax.annotation.Nonnull;
 import javax.script.ScriptException;
 
+import org.apache.hc.client5.http.auth.UsernamePasswordCredentials;
 import org.apache.hc.client5.http.socket.LayeredConnectionSocketFactory;
+import org.apache.hc.core5.http.HttpHost;
 import org.apache.hc.core5.http.HttpStatus;
 import org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver;
 import org.opensaml.security.credential.impl.StaticCredentialResolver;
@@ -94,6 +96,12 @@ public class HTTPDataConnectorTest {
     @Test public void test() throws ComponentInitializationException, ResolutionException, ScriptException, IOException {
         final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
         params.setTLSProtocols(CollectionSupport.singleton("TLSv1"));
+        
+        // TODO: this will get the header included but isn't actually being tested/enforced atm.
+        params.setPreemptiveBasicAuthMap(
+                CollectionSupport.singletonMap(new HttpHost("http", "git.shibboleth.net", 80),
+                        new UsernamePasswordCredentials("jdoe", "foo".toCharArray())));
+        
         connector.setHttpClientSecurityParameters(params);
         
         final TemplatedURLBuilder builder = new TemplatedURLBuilder();
diff --git a/shib-attribute-resolver-impl/src/test/resources/logback-test.xml b/shib-attribute-resolver-impl/src/test/resources/logback-test.xml
index 40fe97b33..b36b5fe54 100644
--- a/shib-attribute-resolver-impl/src/test/resources/logback-test.xml
+++ b/shib-attribute-resolver-impl/src/test/resources/logback-test.xml
@@ -4,6 +4,8 @@
     <logger name="net.shibboleth.idp.attribute" level="DEBUG"/>
 
     <logger name="net.shibboleth.idp.saml" level="DEBUG"/>
+    
+    <logger name="org.apache.hc" level="WARN"/>
 
     <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
         <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.