[java-idp-plugin-webauthn] branch main updated: Minor view and property improvements
Phil Smart
philip.smart at jisc.ac.uk
Tue Apr 30 13:46:58 UTC 2024
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=14047d80ddb3741155c5ef733f0e1da1875d1f43
The following commit(s) were added to refs/heads/main by this push:
new 14047d8 Minor view and property improvements
14047d8 is described below
commit 14047d80ddb3741155c5ef733f0e1da1875d1f43
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Apr 30 14:46:55 2024 +0100
Minor view and property improvements
---
...stractAttributeContextUserIdentityStrategy.java | 51 ++++++++++++++++++----
.../META-INF/net.shibboleth.idp/postconfig.xml | 8 ++--
.../authn/webauthn/conf/authn/webauthn.properties | 16 ++++---
.../webauthn/views/webauthn-management-search.vm | 2 +-
4 files changed, 56 insertions(+), 21 deletions(-)
diff --git a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/AbstractAttributeContextUserIdentityStrategy.java b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/AbstractAttributeContextUserIdentityStrategy.java
index 545752a..e433137 100644
--- a/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/AbstractAttributeContextUserIdentityStrategy.java
+++ b/webauthn-api/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/context/navigate/AbstractAttributeContextUserIdentityStrategy.java
@@ -14,6 +14,7 @@
package net.shibboleth.idp.plugin.authn.webauthn.context.navigate;
+import java.util.Map;
import java.util.function.Function;
import javax.annotation.Nonnull;
@@ -51,6 +52,9 @@ public abstract class AbstractAttributeContextUserIdentityStrategy<T> extends Ab
/** The attribute Id to extract the value from.*/
@Nullable @NotEmpty private String attributeId;
+ /** Whether to look at filtered or unfiltered attributes. */
+ private boolean useUnfilteredAttributes;
+
/** Constructor.*/
protected AbstractAttributeContextUserIdentityStrategy() {
final Function<ProfileRequestContext,AttributeContext> acls =
@@ -58,9 +62,30 @@ public abstract class AbstractAttributeContextUserIdentityStrategy<T> extends Ab
new ChildContextLookup<>(RelyingPartyContext.class));
assert acls !=null;
attributeContextLookupStrategy = acls;
+ useUnfilteredAttributes = true;
}
+ /**
+ * Get whether to source the input attributes from the unfiltered set.
+ *
+ * @return whether to source the input attributes from the unfiltered set
+ */
+ public boolean isUseUnfilteredAttributes() {
+ return useUnfilteredAttributes;
+ }
+
+ /**
+ * Set whether to source the input attributes from the unfiltered set.
+ *
+ * <p>Defaults to true.</p>
+ *
+ * @param flag flag to set
+ */
+ public void setUseUnfilteredAttributes(final boolean flag) {
+ useUnfilteredAttributes = flag;
+ }
+
/**
* Set the attribute Id to extract the value from.
*
@@ -95,7 +120,8 @@ public abstract class AbstractAttributeContextUserIdentityStrategy<T> extends Ab
}
/**
- * Get the attribute with the given attribute Id from the AttributeContext (if it exists).
+ * Get the attribute from the filtered set of attributes with the given attribute Id from the AttributeContext
+ * (if it exists).
*
* @param profileRequestContext the profile request context to locate the attribute context and the attribute from
*
@@ -106,22 +132,29 @@ public abstract class AbstractAttributeContextUserIdentityStrategy<T> extends Ab
checkComponentActive();
final AttributeContext attrContext = attributeContextLookupStrategy.apply(profileRequestContext);
+
+ if (attrContext == null) {
+ log.trace("{}: Attribute '{}' could not be found, no attribute context", getId(), attributeId);
+ return null;
+ }
+
+ final Map<String,IdPAttribute> attributes = useUnfilteredAttributes
+ ? attrContext.getUnfilteredIdPAttributes()
+ : attrContext.getIdPAttributes();
- if (attrContext != null && attributeId != null) {
- for (final IdPAttribute attribute : attrContext.getIdPAttributes().values()) {
+ if (attributeId != null) {
+ for (final IdPAttribute attribute : attributes.values()) {
if (attribute != null && !attribute.getValues().isEmpty() &&
attribute.getId().equals(attributeId)) {
return attribute;
}
}
+ log.trace("{}: Attribute '{}' could not be found", getId(), attributeId);
+ return null;
}
- log.trace("{}: Attribute '{}' could not be found", getId(), attributeId);
+ log.trace("{}: Attribute to find has not been set", getId());
return null;
- }
-
-
-
-
+ }
}
diff --git a/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 307a389..5537a70 100644
--- a/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/webauthn-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -47,10 +47,10 @@
<bean parent="shibboleth.AdminFlow"
c:id="http://shibboleth.net/ns/profiles/admin/webauthn/register-credential"
p:loggingId="%{idp.authn.webauthn.admin.registration.logging:WebAuthnCredentialRegistration}"
- p:policyName="%{idp.authn.webauthn.admin.registration.accessPolicy:AccessByIPAddress}"
+ p:policyName="%{idp.authn.webauthn.admin.registration.accessPolicy:AccessByAnyone}"
p:nonBrowserSupported="false"
- p:authenticated="true"
- p:resolveAttributes="%{idp.authn.webauthn.admin.registration.resolveIdentityAttributes:true}">
+ p:authenticated="%{idp.authn.webauthn.admin.registration.authenticated:true}"
+ p:resolveAttributes="%{idp.authn.webauthn.admin.registration.resolveAttributes:false}">
<property name="authenticationFlows">
<bean parent="shibboleth.CommaDelimStringArray"
c:_0="#{'%{idp.authn.webauthn.admin.registration.authenticationFlows:}'.trim()}" />
@@ -71,7 +71,7 @@
p:loggingId="%{idp.authn.webauthn.admin.management.logging:WebAuthnCredentialManagement}"
p:policyName="%{idp.authn.webauthn.admin.management.accessPolicy:AccessByAdminUser}"
p:nonBrowserSupported="false"
- p:authenticated="true"
+ p:authenticated="%{idp.authn.webauthn.admin.management.authenticated:true}"
p:resolveAttributes="%{idp.authn.webauthn.admin.management.resolveIdentityAttributes:true}">
<property name="authenticationFlows">
<bean parent="shibboleth.CommaDelimStringArray"
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
index 74e05f9..9e2511f 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/conf/authn/webauthn.properties
@@ -36,11 +36,12 @@ idp.authn.webauthn.supportedPrincipals = \
#### Registration properties.
+# Does the registration page require authentication. Should always be true.
+#idp.authn.webauthn.admin.registration.authenticate = true
# Access policy for the registration flow
-#idp.authn.webauthn.admin.registration.accessPolicy =
+#idp.authn.webauthn.admin.registration.accessPolicy = AccessByAnyone
# Restrict the usable authentication flows
-#idp.authn.webauthn.admin.registration.authenticationFlows =
-
+#idp.authn.webauthn.admin.registration.authenticationFlows =
# Should user.id and display name be resolve from the attribute resolver? else the user.id will be generated by the plugin
#idp.authn.webauthn.admin.registration.resolveIdentityAttributes = true;
@@ -92,10 +93,11 @@ idp.authn.webauthn.supportedPrincipals = \
#idp.authn.webauthn.admin.management.logging = WebAuthnCredentialManagement
#idp.authn.webauthn.admin.management.accessPolicy = AccessByAdmin
-#idp.authn.webauthn.admin.management.resolveIdentityAttributes = true
-#idp.authn.webauthn.admin.management.authenticationFlows
-#idp.authn.webauthn.admin.management.postAuthenticationFlows
-#idp.authn.webauthn.admin.management.defaultAuthenticationMethod
+#idp.authn.webauthn.admin.management.resolveAttributes = false
+#idp.authn.webauthn.admin.management.authenticationFlows =
+#idp.authn.webauthn.admin.management.postAuthenticationFlows =
+#idp.authn.webauthn.admin.management.defaultAuthenticationMethod =
+#idp.authn.webauthn.admin.management.authenticated = true
#### Authentication properties
diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management-search.vm b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management-search.vm
index 900bcfd..c6cf1b6 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management-search.vm
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management-search.vm
@@ -37,7 +37,7 @@
</header>
<section>
- <div class="centre">
+ <div>
<div class="hidden output-message output--error" id="error_div">
<p id="error_message"></p>
</div>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list