[java-shib-profile] branch main updated: Move default SecurityConfiguration to RelyingPartyConfiguration.
Scott Cantor
cantor.2 at osu.edu
Thu Mar 16 18:41:56 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-shib-profile.
View the commit online:
http://git.shibboleth.net/view/?p=java-shib-profile.git;a=commit;h=c36c9e0994433fa6164b2971293ec1bc81f43cc8
The following commit(s) were added to refs/heads/main by this push:
new c36c9e0 Move default SecurityConfiguration to RelyingPartyConfiguration.
c36c9e0 is described below
commit c36c9e0994433fa6164b2971293ec1bc81f43cc8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Mar 16 14:41:53 2023 -0400
Move default SecurityConfiguration to RelyingPartyConfiguration.
---
...DefaultSecurityConfigurationLookupFunction.java | 53 +++++++---------------
...ntTLSValidationConfigurationLookupFunction.java | 9 ++--
.../DecryptionConfigurationLookupFunction.java | 7 +--
.../EncryptionConfigurationLookupFunction.java | 7 +--
...IdentifierGenerationStrategyLookupFunction.java | 23 ++++------
...ignatureSigningConfigurationLookupFunction.java | 7 +--
...atureValidationConfigurationLookupFunction.java | 7 +--
...DefaultSecurityConfigurationLookupFunction.java | 50 ++++++--------------
...pClientSecurityConfigurationLookupFunction.java | 14 ++----
...ignatureSigningConfigurationLookupFunction.java | 16 ++-----
...atureValidationConfigurationLookupFunction.java | 14 ++----
.../BasicRelyingPartyConfiguration.java | 34 ++++++++++++++
.../relyingparty/RelyingPartyConfiguration.java | 16 ++++++-
.../RelyingPartyConfigurationResolver.java | 13 ------
.../DefaultRelyingPartyConfigurationResolver.java | 21 ---------
15 files changed, 113 insertions(+), 178 deletions(-)
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/AbstractDefaultSecurityConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/AbstractDefaultSecurityConfigurationLookupFunction.java
index 50131f2..5b9fe47 100644
--- a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/AbstractDefaultSecurityConfigurationLookupFunction.java
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/AbstractDefaultSecurityConfigurationLookupFunction.java
@@ -17,57 +17,38 @@
package net.shibboleth.profile.config.navigate;
-import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.security.config.SecurityConfiguration;
-import org.slf4j.Logger;
import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.profile.relyingparty.RelyingPartyConfigurationResolver;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.service.ReloadableService;
-import net.shibboleth.shared.service.ServiceException;
-import net.shibboleth.shared.service.ServiceableComponent;
+import net.shibboleth.profile.relyingparty.RelyingPartyConfiguration;
/**
* Base class for lookup functions that require access to the default security configuration
- * for a profile via the {@link RelyingPartyConfigurationResolver} interface.
+ * for a profile via the {@link RelyingPartyConfiguration} interface.
*
* @param <T> function return type
*/
-public abstract class AbstractDefaultSecurityConfigurationLookupFunction<T>
+public abstract class AbstractDefaultSecurityConfigurationLookupFunction<T>
extends AbstractRelyingPartyLookupFunction<T> {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(AbstractDefaultSecurityConfigurationLookupFunction.class);
-
- /** A resolver for default security configurations. */
- @Nullable private ReloadableService<RelyingPartyConfigurationResolver> rpResolver;
-
+
/**
- * Set the resolver for default security configurations.
+ * Return the default {@link SecurityConfiguration} for the {@link RelyingPartyConfiguration}.
+ *
+ * @param relyingPartyConfiguration active relying party configuration, if any
+ * @param profileRequestContext current profile request context
*
- * @param resolver the resolver to use
+ * @return the default security configuration
*/
- public void setRelyingPartyConfigurationResolver(
- @Nullable final ReloadableService<RelyingPartyConfigurationResolver> resolver) {
- rpResolver = resolver;
- }
-
@Nullable protected SecurityConfiguration getDefaultSecurityConfiguration(
- @Nonnull @NotEmpty final String profileId) {
-
- if (rpResolver != null) {
- try (final ServiceableComponent<RelyingPartyConfigurationResolver> component =
- rpResolver.getServiceableComponent()) {
- return component.getComponent().getDefaultSecurityConfiguration(profileId);
- } catch (final ServiceException e) {
- log.error("RelyingPartyConfigurationResolver was invalid", e.getMessage());
- }
- }
-
- return null;
+ @Nullable final RelyingPartyConfiguration relyingPartyConfiguration,
+ @Nullable final ProfileRequestContext profileRequestContext) {
+
+ return relyingPartyConfiguration != null ?
+ relyingPartyConfiguration.getSecurityConfiguration(profileRequestContext) :
+ null;
}
+
}
\ No newline at end of file
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/ClientTLSValidationConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/ClientTLSValidationConfigurationLookupFunction.java
index d5bce7c..2673f0c 100644
--- a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/ClientTLSValidationConfigurationLookupFunction.java
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/ClientTLSValidationConfigurationLookupFunction.java
@@ -52,16 +52,13 @@ public class ClientTLSValidationConfigurationLookupFunction
configs.add(sc.getClientTLSValidationConfiguration());
}
}
- }
-
- // Check for a per-profile default (relying party independent) config.
- if (input != null) {
- final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(input.getProfileId());
+
+ final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(rpc.getConfiguration(), input);
if (defaultConfig != null && defaultConfig.getClientTLSValidationConfiguration() != null) {
configs.add(defaultConfig.getClientTLSValidationConfiguration());
}
}
-
+
configs.add(ConfigurationService.get(ClientTLSValidationConfiguration.class));
return configs;
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/DecryptionConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/DecryptionConfigurationLookupFunction.java
index 79144d7..7b34b19 100644
--- a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/DecryptionConfigurationLookupFunction.java
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/DecryptionConfigurationLookupFunction.java
@@ -53,11 +53,8 @@ public class DecryptionConfigurationLookupFunction
configs.add(xsc.getDecryptionConfiguration());
}
}
- }
-
- // Check for a per-profile default (relying party independent) config.
- if (input != null) {
- final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(input.getProfileId());
+
+ final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(rpc.getConfiguration(), input);
if (defaultConfig instanceof XMLSecurityConfiguration xsc && xsc.getDecryptionConfiguration() != null) {
configs.add(xsc.getDecryptionConfiguration());
}
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/EncryptionConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/EncryptionConfigurationLookupFunction.java
index 4d1c6a4..bb11527 100644
--- a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/EncryptionConfigurationLookupFunction.java
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/EncryptionConfigurationLookupFunction.java
@@ -53,11 +53,8 @@ public class EncryptionConfigurationLookupFunction
configs.add(xsc.getEncryptionConfiguration());
}
}
- }
-
- // Check for a per-profile default (relying party independent) config.
- if (input != null) {
- final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(input.getProfileId());
+
+ final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(rpc.getConfiguration(), input);
if (defaultConfig instanceof XMLSecurityConfiguration xsc && xsc.getEncryptionConfiguration() != null) {
configs.add(xsc.getEncryptionConfiguration());
}
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/IdentifierGenerationStrategyLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/IdentifierGenerationStrategyLookupFunction.java
index 4fbf090..a2d3e14 100644
--- a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/IdentifierGenerationStrategyLookupFunction.java
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/IdentifierGenerationStrategyLookupFunction.java
@@ -48,24 +48,19 @@ public class IdentifierGenerationStrategyLookupFunction
}
/** {@inheritDoc} */
- @Override
@Nullable public IdentifierGenerationStrategy apply(@Nullable final ProfileRequestContext input) {
- if (input != null) {
- final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
- if (rpc != null) {
- final ProfileConfiguration pc = rpc.getProfileConfig();
- if (pc != null) {
- final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
- if (sc != null) {
- return sc.getIdGenerator();
- }
+
+ final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
+ if (rpc != null) {
+ final ProfileConfiguration pc = rpc.getProfileConfig();
+ if (pc != null) {
+ final SecurityConfiguration sc = pc.getSecurityConfiguration(input);
+ if (sc != null) {
+ return sc.getIdGenerator();
}
}
- }
- // Check for a per-profile default (relying party independent) config.
- if (input != null) {
- final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(input.getProfileId());
+ final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(rpc.getConfiguration(), input);
if (defaultConfig != null && defaultConfig.getIdGenerator() != null) {
return defaultConfig.getIdGenerator();
}
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/SignatureSigningConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/SignatureSigningConfigurationLookupFunction.java
index a1991b4..818968c 100644
--- a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/SignatureSigningConfigurationLookupFunction.java
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/SignatureSigningConfigurationLookupFunction.java
@@ -53,11 +53,8 @@ public class SignatureSigningConfigurationLookupFunction
configs.add(xsc.getSignatureSigningConfiguration());
}
}
- }
-
- // Check for a per-profile default (relying party independent) config.
- if (input != null) {
- final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(input.getProfileId());
+
+ final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(rpc.getConfiguration(), input);
if (defaultConfig instanceof XMLSecurityConfiguration xsc &&
xsc.getSignatureSigningConfiguration() != null) {
configs.add(xsc.getSignatureSigningConfiguration());
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/SignatureValidationConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/SignatureValidationConfigurationLookupFunction.java
index afd42b3..e577112 100644
--- a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/SignatureValidationConfigurationLookupFunction.java
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/SignatureValidationConfigurationLookupFunction.java
@@ -53,11 +53,8 @@ public class SignatureValidationConfigurationLookupFunction
configs.add(xsc.getSignatureValidationConfiguration());
}
}
- }
-
- // Check for a per-profile default (relying party independent) config.
- if (input != null) {
- final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(input.getProfileId());
+
+ final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(rpc.getConfiguration(), input);
if (defaultConfig instanceof XMLSecurityConfiguration xsc &&
xsc.getSignatureValidationConfiguration() != null) {
configs.add(xsc.getSignatureValidationConfiguration());
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/AbstractDefaultSecurityConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/AbstractDefaultSecurityConfigurationLookupFunction.java
index f343036..6d4825f 100644
--- a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/AbstractDefaultSecurityConfigurationLookupFunction.java
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/AbstractDefaultSecurityConfigurationLookupFunction.java
@@ -17,57 +17,37 @@
package net.shibboleth.profile.config.navigate.messaging;
-import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.opensaml.messaging.context.MessageContext;
import org.opensaml.security.config.SecurityConfiguration;
-import org.slf4j.Logger;
import net.shibboleth.profile.context.navigate.messaging.AbstractRelyingPartyLookupFunction;
-import net.shibboleth.profile.relyingparty.RelyingPartyConfigurationResolver;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import net.shibboleth.shared.service.ReloadableService;
-import net.shibboleth.shared.service.ServiceException;
-import net.shibboleth.shared.service.ServiceableComponent;
+import net.shibboleth.profile.relyingparty.RelyingPartyConfiguration;
/**
* Base class for lookup functions that require access to the default security configuration
- * for a profile via the {@link RelyingPartyConfigurationResolver} interface.
+ * for a profile via the {@link RelyingPartyConfiguration} interface.
*
* @param <T> function return type
*/
public abstract class AbstractDefaultSecurityConfigurationLookupFunction<T>
extends AbstractRelyingPartyLookupFunction<T> {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(AbstractDefaultSecurityConfigurationLookupFunction.class);
-
- /** A resolver for default security configurations. */
- @Nullable private ReloadableService<RelyingPartyConfigurationResolver> rpResolver;
-
+
/**
- * Set the resolver for default security configurations.
+ * Return the default {@link SecurityConfiguration} for the {@link RelyingPartyConfiguration}.
+ *
+ * @param relyingPartyConfiguration active relying party configuration, if any
+ * @param messageContext current message context
*
- * @param resolver the resolver to use
+ * @return the default security configuration
*/
- public void setRelyingPartyConfigurationResolver(
- @Nullable final ReloadableService<RelyingPartyConfigurationResolver> resolver) {
- rpResolver = resolver;
- }
-
@Nullable protected SecurityConfiguration getDefaultSecurityConfiguration(
- @Nonnull @NotEmpty final String profileId) {
-
- if (rpResolver != null) {
- try (final ServiceableComponent<RelyingPartyConfigurationResolver> component =
- rpResolver.getServiceableComponent()) {
- return component.getComponent().getDefaultSecurityConfiguration(profileId);
- } catch (final ServiceException e) {
- log.error("RelyingPartyConfigurationResolver was invalid", e.getMessage());
- }
- }
-
- return null;
+ @Nullable final RelyingPartyConfiguration relyingPartyConfiguration,
+ @Nullable final MessageContext messageContext) {
+
+ return relyingPartyConfiguration != null ?
+ relyingPartyConfiguration.getSecurityConfiguration(getProfileRequestContext(messageContext)) : null;
}
+
}
\ No newline at end of file
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/HttpClientSecurityConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/HttpClientSecurityConfigurationLookupFunction.java
index 07efd2c..efa4082 100644
--- a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/HttpClientSecurityConfigurationLookupFunction.java
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/HttpClientSecurityConfigurationLookupFunction.java
@@ -53,16 +53,10 @@ public class HttpClientSecurityConfigurationLookupFunction
configs.add(sc.getHttpClientSecurityConfiguration());
}
}
-
- // Check for a per-profile default (relying party independent) config.
- if (pc != null) {
- final String id = pc.getId();
- if (id != null) {
- final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(id);
- if (defaultConfig != null && defaultConfig.getHttpClientSecurityConfiguration() != null) {
- configs.add(defaultConfig.getHttpClientSecurityConfiguration());
- }
- }
+
+ final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(rpc.getConfiguration(), input);
+ if (defaultConfig != null && defaultConfig.getHttpClientSecurityConfiguration() != null) {
+ configs.add(defaultConfig.getHttpClientSecurityConfiguration());
}
}
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/SignatureSigningConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/SignatureSigningConfigurationLookupFunction.java
index 7e68ff8..85387b0 100644
--- a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/SignatureSigningConfigurationLookupFunction.java
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/SignatureSigningConfigurationLookupFunction.java
@@ -54,17 +54,11 @@ public class SignatureSigningConfigurationLookupFunction
configs.add(xsc.getSignatureSigningConfiguration());
}
}
-
- // Check for a per-profile default (relying party independent) config.
- if (pc != null) {
- final String id = pc.getId();
- if (id != null) {
- final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(id);
- if (defaultConfig instanceof XMLSecurityConfiguration xsc &&
- xsc.getSignatureSigningConfiguration() != null) {
- configs.add(xsc.getSignatureSigningConfiguration());
- }
- }
+
+ final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(rpc.getConfiguration(), input);
+ if (defaultConfig instanceof XMLSecurityConfiguration xsc &&
+ xsc.getSignatureSigningConfiguration() != null) {
+ configs.add(xsc.getSignatureSigningConfiguration());
}
}
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/SignatureValidationConfigurationLookupFunction.java b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/SignatureValidationConfigurationLookupFunction.java
index 2daa939..0a317b0 100644
--- a/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/SignatureValidationConfigurationLookupFunction.java
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/config/navigate/messaging/SignatureValidationConfigurationLookupFunction.java
@@ -55,16 +55,10 @@ public class SignatureValidationConfigurationLookupFunction
}
}
- // Check for a per-profile default (relying party independent) config.
- if (pc != null) {
- final String id = pc.getId();
- if (id != null) {
- final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(id);
- if (defaultConfig instanceof XMLSecurityConfiguration xsc &&
- xsc.getSignatureValidationConfiguration() != null) {
- configs.add(xsc.getSignatureValidationConfiguration());
- }
- }
+ final SecurityConfiguration defaultConfig = getDefaultSecurityConfiguration(rpc.getConfiguration(), input);
+ if (defaultConfig instanceof XMLSecurityConfiguration xsc &&
+ xsc.getSignatureValidationConfiguration() != null) {
+ configs.add(xsc.getSignatureValidationConfiguration());
}
}
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/relyingparty/BasicRelyingPartyConfiguration.java b/shib-profile-api/src/main/java/net/shibboleth/profile/relyingparty/BasicRelyingPartyConfiguration.java
index 4b5802f..d433f2c 100644
--- a/shib-profile-api/src/main/java/net/shibboleth/profile/relyingparty/BasicRelyingPartyConfiguration.java
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/relyingparty/BasicRelyingPartyConfiguration.java
@@ -28,6 +28,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.security.config.SecurityConfiguration;
import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
@@ -60,6 +61,9 @@ public class BasicRelyingPartyConfiguration extends AbstractIdentifiableInitiali
/** Controls whether detailed information about errors should be exposed. */
@Nonnull private Predicate<ProfileRequestContext> detailedErrorsPredicate;
+ /** Lookup function to supply securityConfiguration property. */
+ @Nonnull private Function<ProfileRequestContext,SecurityConfiguration> securityConfigurationLookupStrategy;
+
/** Lookup function to supply <code>profileConfigurations</code> property. */
@Nonnull
private Function<ProfileRequestContext,Map<String,ProfileConfiguration>> profileConfigurationsLookupStrategy;
@@ -72,6 +76,7 @@ public class BasicRelyingPartyConfiguration extends AbstractIdentifiableInitiali
activationCondition = PredicateSupport.alwaysTrue();
issuerLookupStrategy = FunctionSupport.constant(null);
detailedErrorsPredicate = PredicateSupport.alwaysFalse();
+ securityConfigurationLookupStrategy = FunctionSupport.constant(null);
profileConfigurationsLookupStrategy = FunctionSupport.constant(null);
}
@@ -149,6 +154,35 @@ public class BasicRelyingPartyConfiguration extends AbstractIdentifiableInitiali
detailedErrorsPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
}
+ /** {@inheritDoc} */
+ @Nullable public SecurityConfiguration getSecurityConfiguration(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ return securityConfigurationLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Sets the security configuration for this profile.
+ *
+ * @param configuration security configuration for this profile
+ *
+ * @since 5.0.0
+ */
+ public void setSecurityConfiguration(@Nullable final SecurityConfiguration configuration) {
+ securityConfigurationLookupStrategy = FunctionSupport.constant(configuration);
+ }
+
+ /**
+ * Set a lookup strategy for the security configuration.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 5.0.0
+ */
+ public void setSecurityConfigurationLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,SecurityConfiguration> strategy) {
+ securityConfigurationLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
/** {@inheritDoc} */
@Nonnull @NonnullElements @Unmodifiable @NotLive public Map<String,ProfileConfiguration> getProfileConfigurations(
@Nullable final ProfileRequestContext profileRequestContext) {
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/relyingparty/RelyingPartyConfiguration.java b/shib-profile-api/src/main/java/net/shibboleth/profile/relyingparty/RelyingPartyConfiguration.java
index 6fd7347..3f4d061 100644
--- a/shib-profile-api/src/main/java/net/shibboleth/profile/relyingparty/RelyingPartyConfiguration.java
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/relyingparty/RelyingPartyConfiguration.java
@@ -24,6 +24,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.security.config.SecurityConfiguration;
import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
@@ -75,7 +76,19 @@ public interface RelyingPartyConfiguration extends InitializableComponent, Ident
* @return true iff it is acceptable to expose detailed error information
*/
boolean isDetailedErrors(@Nullable final ProfileRequestContext profileRequestContext);
-
+
+ /**
+ * Get the default {@link SecurityConfiguration} to use.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return default security configuration
+ *
+ * @since 5.0.0
+ */
+ @Nullable SecurityConfiguration getSecurityConfiguration(
+ @Nullable final ProfileRequestContext profileRequestContext);
+
/**
* Get the unmodifiable set of profile configurations for this relying party.
*
@@ -86,7 +99,6 @@ public interface RelyingPartyConfiguration extends InitializableComponent, Ident
@Nonnull @NonnullElements @Unmodifiable @NotLive Map<String,ProfileConfiguration> getProfileConfigurations(
@Nullable final ProfileRequestContext profileRequestContext);
-
/**
* Get the profile configuration, for the relying party, for the given profile. This is a convenience method and is
* equivalent to calling {@link Map#get(Object)} on the return of
diff --git a/shib-profile-api/src/main/java/net/shibboleth/profile/relyingparty/RelyingPartyConfigurationResolver.java b/shib-profile-api/src/main/java/net/shibboleth/profile/relyingparty/RelyingPartyConfigurationResolver.java
index 9b9d255..f2dfedc 100644
--- a/shib-profile-api/src/main/java/net/shibboleth/profile/relyingparty/RelyingPartyConfigurationResolver.java
+++ b/shib-profile-api/src/main/java/net/shibboleth/profile/relyingparty/RelyingPartyConfigurationResolver.java
@@ -20,15 +20,11 @@ package net.shibboleth.profile.relyingparty;
import java.util.Collection;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.profile.criterion.ProfileRequestContextCriterion;
-import org.opensaml.security.config.SecurityConfiguration;
import org.opensaml.security.credential.Credential;
-import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
import net.shibboleth.shared.component.IdentifiedComponent;
@@ -48,15 +44,6 @@ import net.shibboleth.shared.resolver.Resolver;
*/
public interface RelyingPartyConfigurationResolver extends Resolver<RelyingPartyConfiguration,CriteriaSet>,
IdentifiedComponent {
-
- /**
- * Return the default security configuration for a profile.
- *
- * @param profileId the profile ID (available via {@link ProfileConfiguration#getId()}
- *
- * @return the configured default configuration
- */
- @Nullable SecurityConfiguration getDefaultSecurityConfiguration(@Nonnull @NotEmpty final String profileId);
/**
* Directly expose any configured signing credentials.
diff --git a/shib-profile-impl/src/main/java/net/shibboleth/profile/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java b/shib-profile-impl/src/main/java/net/shibboleth/profile/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java
index 3c538e7..f1aecb6 100644
--- a/shib-profile-impl/src/main/java/net/shibboleth/profile/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java
+++ b/shib-profile-impl/src/main/java/net/shibboleth/profile/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java
@@ -34,7 +34,6 @@ import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
import org.opensaml.saml.criterion.RoleDescriptorCriterion;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
import org.opensaml.saml.saml2.metadata.RoleDescriptor;
-import org.opensaml.security.config.SecurityConfiguration;
import org.opensaml.security.credential.Credential;
import org.slf4j.Logger;
import org.springframework.beans.factory.annotation.Autowired;
@@ -45,7 +44,6 @@ import net.shibboleth.profile.relyingparty.RelyingPartyConfiguration;
import net.shibboleth.profile.relyingparty.RelyingPartyConfigurationResolver;
import net.shibboleth.profile.relyingparty.VerifiedProfileCriterion;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
import net.shibboleth.shared.collection.CollectionSupport;
@@ -90,9 +88,6 @@ public class DefaultRelyingPartyConfigurationResolver extends AbstractIdentifiab
/** Unverified relying party configuration, used if the request is unverified. */
@Nullable private RelyingPartyConfiguration unverifiedConfiguration;
- /** A global default security configuration. */
- @Nullable private SecurityConfiguration defaultSecurityConfiguration;
-
/** The global list of all configured signing credentials. */
@Nonnull private List<Credential> signingCredentials;
@@ -152,17 +147,6 @@ public class DefaultRelyingPartyConfigurationResolver extends AbstractIdentifiab
defaultRelyingPartyConfiguration = configuration;
}
- /**
- * Set the global default {@link SecurityConfiguration}.
- *
- * @param config global default
- */
- public void setDefaultSecurityConfiguration(@Nullable final SecurityConfiguration config) {
- checkSetterPreconditions();
-
- defaultSecurityConfiguration = config;
- }
-
/**
* Get the {@link RelyingPartyConfiguration} to use if the configuration is found to be "unverified"
* (via use of {@link VerifiedProfileCriterion}).
@@ -292,11 +276,6 @@ public class DefaultRelyingPartyConfigurationResolver extends AbstractIdentifiab
return null;
}
- /** {@inheritDoc} */
- @Nullable public SecurityConfiguration getDefaultSecurityConfiguration(@Nonnull @NotEmpty final String profileId) {
- return defaultSecurityConfiguration;
- }
-
/** {@inheritDoc} */
@Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<Credential> getSigningCredentials() {
return signingCredentials;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list