[java-plugin-shibd] branch main updated: Migrate SAML SP code into separate plugin project.
Scott Cantor
cantor.2 at osu.edu
Tue Aug 20 13:23:05 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=f0b702df8108e55f6e773618c9114e35768a706c
The following commit(s) were added to refs/heads/main by this push:
new f0b702d Migrate SAML SP code into separate plugin project.
f0b702d is described below
commit f0b702df8108e55f6e773618c9114e35768a706c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Aug 20 09:23:02 2024 -0400
Migrate SAML SP code into separate plugin project.
---
pom.xml | 2 -
sp-bom/pom.xml | 10 -
sp-conf-impl/pom.xml | 32 --
.../idp/flows/sp/initiator/saml2/saml2-beans.xml | 185 -------
.../idp/flows/sp/initiator/saml2/saml2-flow.xml | 39 --
.../net/shibboleth/idp/module/conf/sp/agents.xml | 22 +-
.../net/shibboleth/sp/conf/agents-system.xml | 10 +-
.../shibboleth/sp/conf/relying-party-system.xml | 302 +----------
.../sp/flows/AbstractBaseSPFlowTest.java | 40 ++
.../shibboleth/sp/flows/AbstractSPFlowTest.java | 7 +-
.../sp/flows/ParseRequestMapFlowTest.java | 2 +-
.../java/net/shibboleth/sp/flows/PingFlowTest.java | 2 +-
.../net/shibboleth/sp/flows/SealerFlowTest.java | 2 +-
.../sp/flows/SessionInitiatorFlowTest.java | 2 +-
.../net/shibboleth/sp/flows/StorageFlowTest.java | 2 +-
...SPEnvironmentApplicationContextInitializer.java | 2 -
.../flows/saml2/SAML2SessionInitiatorFlowTest.java | 419 ---------------
.../shibboleth/sp/flows/saml2/package-info.java | 18 -
.../net/shibboleth/idp/module/conf/sp/agents.xml | 37 +-
.../idp/module/conf/sp/metadata-providers.xml | 108 ----
.../shibboleth/idp/module/conf/sp/test-agents.xml | 58 ---
.../resources/net/shibboleth/sp/test-beans.xml | 27 -
sp-saml-api/.checkstyle | 10 -
sp-saml-api/.gitignore | 2 -
sp-saml-api/pom.xml | 51 --
.../saml2/profile/SAML2InitiatorConstants.java | 30 --
.../config/BrowserSSOProfileConfiguration.java | 67 ---
.../profile/config/ECPProfileConfiguration.java | 21 -
.../profile/config/SAML2ProfileConfiguration.java | 35 --
.../config/SingleLogoutProfileConfiguration.java | 37 --
.../sp/saml/saml2/profile/config/package-info.java | 18 -
.../sp/saml/saml2/profile/package-info.java | 18 -
sp-saml-impl/.checkstyle | 10 -
sp-saml-impl/.gitignore | 2 -
sp-saml-impl/pom.xml | 79 ---
...tSAML2ArtifactConsumerProfileConfiguration.java | 101 ----
...SAML2AssertionConsumerProfileConfiguration.java | 158 ------
.../impl/AbstractSAML2ProfileConfiguration.java | 218 --------
.../impl/BrowserSSOProfileConfiguration.java | 415 ---------------
.../config/impl/ECPProfileConfiguration.java | 26 -
.../impl/SingleLogoutProfileConfiguration.java | 194 -------
.../saml2/profile/config/impl/package-info.java | 18 -
.../saml/saml2/profile/impl/AddAuthnRequest.java | 569 ---------------------
.../sp/saml/saml2/profile/impl/package-info.java | 18 -
.../AbstractSAML2ProfileConfigurationTest.java | 58 ---
.../impl/BrowserSSOProfileConfigurationTest.java | 177 -------
.../impl/SingleLogoutProfileConfigurationTest.java | 65 ---
47 files changed, 79 insertions(+), 3646 deletions(-)
diff --git a/pom.xml b/pom.xml
index 9f6464e..8d427c1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -39,8 +39,6 @@
<modules>
<module>sp-bom</module>
<module>sp-conf-impl</module>
- <module>sp-saml-api</module>
- <module>sp-saml-impl</module>
<module>sp-server-api</module>
<module>sp-server-impl</module>
<module>sp-session-api</module>
diff --git a/sp-bom/pom.xml b/sp-bom/pom.xml
index 153b841..24dd72e 100644
--- a/sp-bom/pom.xml
+++ b/sp-bom/pom.xml
@@ -17,11 +17,6 @@
<dependencyManagement>
<dependencies>
- <dependency>
- <groupId>${project.groupId}</groupId>
- <artifactId>sp-saml-api</artifactId>
- <version>${project.version}</version>
- </dependency>
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>sp-server-api</artifactId>
@@ -33,11 +28,6 @@
<version>${project.version}</version>
</dependency>
- <dependency>
- <groupId>${project.groupId}</groupId>
- <artifactId>sp-saml-impl</artifactId>
- <version>${project.version}</version>
- </dependency>
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>sp-server-impl</artifactId>
diff --git a/sp-conf-impl/pom.xml b/sp-conf-impl/pom.xml
index 9cc03db..e1a23e3 100644
--- a/sp-conf-impl/pom.xml
+++ b/sp-conf-impl/pom.xml
@@ -32,18 +32,6 @@
<version>${project.version}</version>
<scope>runtime</scope>
</dependency>
- <dependency>
- <groupId>${project.groupId}</groupId>
- <artifactId>sp-saml-api</artifactId>
- <version>${project.version}</version>
- <scope>runtime</scope>
- </dependency>
- <dependency>
- <groupId>${project.groupId}</groupId>
- <artifactId>sp-saml-impl</artifactId>
- <version>${project.version}</version>
- <scope>runtime</scope>
- </dependency>
<!-- For plugin/module classes. -->
<dependency>
@@ -63,22 +51,12 @@
<artifactId>shib-profile-impl</artifactId>
<scope>provided</scope>
</dependency>
- <dependency>
- <groupId>${shib-profile.groupId}</groupId>
- <artifactId>shib-saml-profile-api</artifactId>
- <scope>provided</scope>
- </dependency>
<dependency>
<groupId>${shib-attribute.groupId}</groupId>
<artifactId>shib-attribute-impl</artifactId>
<scope>provided</scope>
</dependency>
- <dependency>
- <groupId>${shib-attribute.groupId}</groupId>
- <artifactId>shib-saml-attribute-impl</artifactId>
- <scope>provided</scope>
- </dependency>
<dependency>
<groupId>${shib-attribute.groupId}</groupId>
<artifactId>shib-attribute-filter-spring</artifactId>
@@ -100,16 +78,6 @@
<artifactId>opensaml-core-impl</artifactId>
<scope>provided</scope>
</dependency>
- <dependency>
- <groupId>${opensaml.groupId}</groupId>
- <artifactId>opensaml-saml-api</artifactId>
- <scope>provided</scope>
- </dependency>
- <dependency>
- <groupId>${opensaml.groupId}</groupId>
- <artifactId>opensaml-saml-impl</artifactId>
- <scope>provided</scope>
- </dependency>
<dependency>
<groupId>${opensaml.groupId}</groupId>
<artifactId>opensaml-storage-impl</artifactId>
diff --git a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml
deleted file mode 100644
index 2caa461..0000000
--- a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml
+++ /dev/null
@@ -1,185 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans" xmlns:c="http://www.springframework.org/schema/c"
- xmlns:context="http://www.springframework.org/schema/context" xmlns:p="http://www.springframework.org/schema/p"
- xmlns:util="http://www.springframework.org/schema/util" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
- default-init-method="initialize" default-destroy-method="destroy">
-
- <bean id="ValidateSessionInitiatorRequest"
- class="net.shibboleth.sp.profile.impl.ValidateSessionInitiatorRequest" scope="prototype" />
-
- <bean id="PrepareInboundMessageContext"
- class="net.shibboleth.idp.saml.session.impl.PrepareInboundMessageContext" scope="prototype"
- p:relyingPartyLookupStrategy-ref="shibboleth.RelyingPartyIdLookup.Simple" />
-
- <bean id="WebFlowMessageHandlerAdaptor" abstract="true"
- class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND" />
-
- <bean id="SAMLProtocolAndRole" parent="WebFlowMessageHandlerAdaptor">
- <constructor-arg name="messageHandler">
- <bean class="org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler" scope="prototype"
- p:protocol-ref="shibboleth.MetadataLookup.Protocol"
- p:role-ref="shibboleth.MetadataLookup.Role" />
- </constructor-arg>
- </bean>
-
- <util:constant id="shibboleth.MetadataLookup.Protocol"
- static-field="org.opensaml.saml.common.xml.SAMLConstants.SAML20P_NS" />
-
- <util:constant id="shibboleth.MetadataLookup.Role"
- static-field="org.opensaml.saml.saml2.metadata.IDPSSODescriptor.DEFAULT_ELEMENT_NAME" />
-
- <bean id="SAMLMetadataLookup" parent="WebFlowMessageHandlerAdaptor">
- <constructor-arg name="messageHandler">
- <bean class="org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler" scope="prototype">
- <property name="roleDescriptorResolverLookupStrategy">
- <bean class="net.shibboleth.sp.profile.context.navigate.messaging.ApplicationMetadataResolverLookupFunction" />
- </property>
- </bean>
- </constructor-arg>
- </bean>
-
- <bean id="InitializeRelyingPartyContextFromSAMLPeer"
- class="net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer" scope="prototype" />
-
- <bean id="SelectRelyingPartyConfiguration"
- class="net.shibboleth.sp.profile.impl.SelectRelyingPartyConfiguration" scope="prototype" />
-
- <bean id="SelectProfileConfiguration"
- class="net.shibboleth.idp.profile.impl.SelectProfileConfiguration" scope="prototype"
- p:profileId="#{T(net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration).PROFILE_ID}" />
-
- <bean id="AppAwareIssuerLookupFunction" class="net.shibboleth.sp.profile.context.navigate.IssuerLookupFunction" />
-
- <bean id="InitializeOutboundMessageContext"
- class="net.shibboleth.idp.saml.profile.impl.InitializeOutboundMessageContext" scope="prototype"
- p:selfIdentityLookupStrategy-ref="AppAwareIssuerLookupFunction" />
-
- <bean id="InitializeMessageChannelSecurityContext"
- class="org.opensaml.profile.action.impl.StaticMessageChannelSecurity" scope="prototype"
- p:confidentialityActive="false"
- p:integrityActive="false" />
-
- <util:constant id="shibboleth.EndpointType"
- static-field="org.opensaml.saml.saml2.metadata.SingleSignOnService.DEFAULT_ELEMENT_NAME" />
-
- <util:list id="OutgoingSAML2SPRequestBindings">
- <ref bean="shibboleth.Binding.SAML2Redirect" />
- <ref bean="shibboleth.Binding.SAML2POST" />
- <ref bean="shibboleth.Binding.SAML2POSTSimpleSign" />
- </util:list>
-
- <bean id="OutgoingSAML2SPRequestBindingsStrategy" parent="shibboleth.Functions.Constant"
- c:_0-ref="OutgoingSAML2SPRequestBindings" />
-
- <bean id="PopulateBindingAndEndpointContexts"
- class="net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts" scope="prototype"
- p:endpointResolver-ref="shibboleth.EndpointResolver"
- p:endpointType-ref="shibboleth.EndpointType"
- p:bindingDescriptorsLookupStrategy-ref="OutgoingSAML2SPRequestBindingsStrategy"
- p:artifactImpliesSecureChannel="%{sp.artifact.secureChannel:true}" />
-
- <bean id="PopulateRequestSignatureSigningParameters"
- class="org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters" scope="prototype"
- p:configurationLookupStrategy-ref="shibboleth.SignatureSigningConfigurationLookup"
- p:signatureSigningParametersResolver-ref="shibboleth.SignatureSigningParametersResolver"
- p:noResultIsError="false">
- <property name="activationCondition">
- <bean class="net.shibboleth.saml.profile.config.logic.SignRequestsPredicate"
- p:honorMetadata="%{sp.saml.honorWantAuthnRequestsSigned:true}" />
- </property>
- </bean>
-
- <bean id="PopulateEncryptionParameters"
- class="net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters" scope="prototype"
- p:configurationLookupStrategy-ref="shibboleth.EncryptionConfigurationLookup"
- p:encryptionParametersResolver-ref="shibboleth.EncryptionParametersResolver"
- p:protocol-ref="shibboleth.MetadataLookup.Protocol"
- p:role-ref="shibboleth.MetadataLookup.Role" />
-
- <bean id="AddAuthnRequest"
- class="net.shibboleth.sp.saml.saml2.profile.impl.AddAuthnRequest" scope="prototype"
- p:overwriteExisting="true"
- p:issuerLookupStrategy-ref="AppAwareIssuerLookupFunction"
- p:nameIDLookupStrategy="#{getObject('%{sp.authn.SAML.NameIDLookupStrategy:}'.trim())}">
- <property name="identifierGeneratorLookupStrategy">
- <bean class="net.shibboleth.profile.config.navigate.IdentifierGenerationStrategyLookupFunction"
- p:defaultIdentifierGenerationStrategy-ref="shibboleth.DefaultIdentifierGenerationStrategy" />
- </property>
- </bean>
-
- <!-- Default formats not to encrypt. -->
- <util:set id="DefaultPlaintextNameIDFormats">
- <util:constant static-field="org.opensaml.saml.saml2.core.NameIDType.ENTITY" />
- </util:set>
-
- <bean id="EncryptNameIDs"
- class="org.opensaml.saml.saml2.profile.impl.EncryptNameIDs" scope="prototype"
- p:excludedFormats="#{getObject('shibboleth.PlaintextNameIDFormats') ?: getObject('DefaultPlaintextNameIDFormats')}"
- p:recipientLookupStrategy-ref="shibboleth.RelyingPartyIdLookup.Simple">
- <property name="encryptionContextLookupStrategy">
- <bean parent="shibboleth.Functions.Compose"
- c:g-ref="shibboleth.ChildLookup.EncryptionParameters"
- c:f-ref="shibboleth.ChildLookup.RelyingParty" />
- </property>
- </bean>
-
- <bean id="HandleOutboundMessage" parent="WebFlowMessageHandlerAdaptor"
- c:messageHandler-ref="PreEncodeMessageHandler"
- c:executionDirection="OUTBOUND">
- <property name="errorEvent">
- <util:constant static-field="org.opensaml.profile.action.EventIds.MESSAGE_PROC_ERROR" />
- </property>
- </bean>
-
- <bean id="PreEncodeMessageHandler"
- class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain" scope="prototype">
- <property name="handlers">
- <list>
- <bean class="org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler" scope="prototype"/>
- <bean class="org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler" scope="prototype"/>
- <bean class="org.opensaml.messaging.handler.impl.FunctionMessageHandler" scope="prototype"
- p:function="#{getObject('%{sp.SAML.outboundMessageHandlerFunction:}'.trim())}" />
- <bean class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler" scope="prototype">
- <property name="activationCondition">
- <bean parent="shibboleth.Conditions.NOT">
- <constructor-arg>
- <bean class="org.opensaml.saml.common.messaging.logic.SignatureCapableBindingPredicate" />
- </constructor-arg>
- </bean>
- </property>
- </bean>
- </list>
- </property>
- </bean>
-
- <bean id="messageEncoderFactory" class="net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory" />
-
- <bean id="EncodeMessage" class="net.shibboleth.sp.profile.impl.EncodeMessage" scope="prototype"
- p:createOutputObjects="true"
- p:messageEncoderFactory-ref="messageEncoderFactory" />
-
- <!-- Override IdP's encoders to supply the DDF-backed servlet supplier. -->
-
- <bean id="shibboleth.Encoders.SAML2RedirectEncoder"
- class="org.opensaml.saml.saml2.binding.encoding.impl.HTTPRedirectDeflateEncoder" scope="prototype" init-method=""
- p:httpServletResponseSupplier-ref="shibboleth.RemotedHttpServletResponseSupplier" />
-
- <bean id="shibboleth.Encoders.SAML2PostEncoder"
- class="org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder" scope="prototype" init-method=""
- p:httpServletResponseSupplier-ref="shibboleth.RemotedHttpServletResponseSupplier"
- p:velocityEngine-ref="shibboleth.VelocityEngine"
- p:cSPDigester="#{%{sp.encoders.cspEnabled:true} ? getObject('shibboleth.CSPDigester') : null}"
- p:cSPNonceGenerator="#{%{sp.encoders.cspEnabled:true} ? getObject('shibboleth.CSPNonce') : null}" />
-
- <bean id="shibboleth.Encoders.SAML2PostSimpleSignEncoder"
- class="org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostSimpleSignEncoder" scope="prototype" init-method=""
- p:httpServletResponseSupplier-ref="shibboleth.RemotedHttpServletResponseSupplier"
- p:velocityEngine-ref="shibboleth.VelocityEngine"
- p:cSPDigester="#{%{sp.encoders.cspEnabled:true} ? getObject('shibboleth.CSPDigester') : null}"
- p:cSPNonceGenerator="#{%{sp.encoders.cspEnabled:true} ? getObject('shibboleth.CSPNonce') : null}" />
-
-</beans>
diff --git a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-flow.xml b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-flow.xml
deleted file mode 100644
index 9a413e9..0000000
--- a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-flow.xml
+++ /dev/null
@@ -1,39 +0,0 @@
-<flow xmlns="http://www.springframework.org/schema/webflow"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
- parent="sp/initiator">
-
- <action-state id="SAML2SessionInitiator">
- <evaluate expression="ValidateSessionInitiatorRequest" />
- <evaluate expression="PrepareInboundMessageContext" />
- <evaluate expression="SAMLProtocolAndRole" />
- <evaluate expression="SAMLMetadataLookup" />
-
- <evaluate expression="InitializeRelyingPartyContextFromSAMLPeer" />
- <evaluate expression="SelectRelyingPartyConfiguration" />
- <evaluate expression="SelectProfileConfiguration" />
-
- <evaluate expression="InitializeOutboundMessageContext" />
- <evaluate expression="InitializeMessageChannelSecurityContext" />
- <!-- TODO: RelayState handling so it's populated on the inbound side... -->
- <evaluate expression="PopulateBindingAndEndpointContexts" />
-
- <evaluate expression="PopulateRequestSignatureSigningParameters" />
- <evaluate expression="PopulateEncryptionParameters" />
-
- <evaluate expression="AddAuthnRequest" />
- <evaluate expression="EncryptNameIDs" />
-
- <evaluate expression="HandleOutboundMessage" />
- <evaluate expression="EncodeMessage" />
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="proceed" />
- <!-- Remap any other events into a fall-through to the next flow. -->
- <transition to="ReselectFlow" />
- </action-state>
-
- <!-- The file really exists in this directory, but it's referenced from extending flow-directories -->
- <bean-import resource="classpath:/META-INF/net/shibboleth/idp/flows/sp/initiator/saml2/saml2-beans.xml" />
-
-</flow>
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
index f194ecc..d9af034 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
@@ -53,7 +53,7 @@
<bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">
<property name="profileConfigurations">
<list>
- <!-- <ref bean="SAML2.SSO" /> -->
+ <!-- Your profiles here. -->
</list>
</property>
</bean>
@@ -68,31 +68,15 @@
<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
<property name="profileConfigurations">
<list>
- <ref bean="SAML2.SSO" />
- <ref bean="SAML2.ECP" />
- <ref bean="SAML2.Logout" />
+ <!-- Your profiles here. -->
</list>
</property>
- </bean>
+ </bean>
<!-- Container for any overrides you want to add. -->
<util:list id="shibboleth.RelyingPartyOverrides">
- <!--
- Override example that identifies a single IdP by name and configures it
- for SAML 2 SSO with a different security configuration.
- -->
- <!--
- <bean id="CustomKey" parent="RelyingPartyByName" c:relyingPartyIds="https://idp.example.org">
- <property name="profileConfigurations">
- <list>
- <bean parent="SAML2.SSO" p:securityConfiguration-ref="custom.SecurityConfig" />
- </list>
- </property>
- </bean>
- -->
-
</util:list>
</beans>
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
index f5ec11f..8932392 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
@@ -34,11 +34,19 @@
p:defaultConfiguration-ref="shibboleth.DefaultRelyingParty"
p:relyingPartyConfigurations-ref="shibboleth.RelyingPartyOverrides"
p:metricName="net.shibboleth.sp.relyingparty.configurations"
- p:sessionInitiators-ref="shibboleth.SessionInitiators" />
+ p:sessionInitiators-ref="shibboleth.SessionInitiators"
+ p:stateTokenManager="#{getObject('%{sp.stateToken.Manager:shibboleth.StorageStateTokenManager}'.trim())}" />
<bean id="shibboleth.SessionInitiators" parent="shibboleth.CommaDelimStringArray"
c:_0="%{sp.application.sessionInitiators:saml2}" />
+ <bean id="shibboleth.StorageStateTokenManager" class="net.shibboleth.sp.impl.StorageServiceStateTokenManager" lazy-init="true"
+ p:storageService="#{getObject('%{sp.stateToken.StorageService:shibboleth.StorageService}'.trim())}" />
+
+ <bean id="shibboleth.CookieStateTokenManager" class="net.shibboleth.sp.impl.CookieStateTokenManager" lazy-init="true"
+ p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier"
+ p:httpServletResponseSupplier-ref="shibboleth.RemotedHttpServletResponseSupplier" />
+
<!-- Wildcard import hook for plugins. -->
<import resource="classpath*:/META-INF/net/shibboleth/sp/service/application/postconfig.xml" />
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml
index 37dca5b..b8ad717 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml
@@ -14,6 +14,8 @@
<context:annotation-config/>
+ <bean id="shibboleth.DefaultSecurityConfiguration" class="org.opensaml.security.config.BasicSecurityConfiguration" />
+
<!-- Parent bean for generic RelyingParty overrides that establishes defaults. -->
<bean id="RelyingParty" abstract="true" class="net.shibboleth.profile.relyingparty.BasicRelyingPartyConfiguration"
p:detailedErrorsPredicate="%{sp.errors.detailed:false}"
@@ -47,304 +49,4 @@
<bean id="TagCandidate" abstract="true"
class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate" />
- <!-- Import parent beans for metadata-driven configuration approach. -->
-<!-- <import resource="relying-party-mddriven.xml" /> -->
-
- <!--
- Default Profile Configurations, also usable as parent beans in overrides.
-
- Each profile shows up twice, once as a basic bean and again as a child bean that adds
- a suite of metadata-driven lookup strategies pre-injected.
- -->
-
- <bean id="SAML2.SSO" lazy-init="true"
- class="net.shibboleth.sp.saml.saml2.profile.config.impl.BrowserSSOProfileConfiguration"
- p:encryptionOptionalPredicate="%{sp.encryption.optional:false}" />
-
- <util:constant id="SAML2.SSO.FEATURE_AUTHNCONTEXT"
- static-field="net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration.FEATURE_AUTHNCONTEXT"/>
-
- <util:constant id="SAML2.SSO.FEATURE_SCOPING"
- static-field="net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration.FEATURE_SCOPING"/>
-
- <util:constant id="SAML2.SSO.FEATURE_NAMEIDFORMAT"
- static-field="net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration.FEATURE_NAMEIDFORMAT"/>
-
- <util:constant id="SAML2.SSO.FEATURE_SPNAMEQUALIFIER"
- static-field="net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration.FEATURE_SPNAMEQUALIFIER"/>
-
- <util:constant id="SAML2.SSO.FEATURE_FORCEAUTHN"
- static-field="net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration.FEATURE_FORCEAUTHN"/>
-
- <bean id="SAML2.ECP" lazy-init="true"
- class="net.shibboleth.sp.saml.saml2.profile.config.impl.ECPProfileConfiguration"
- p:encryptionOptionalPredicate="%{sp.encryption.optional:false}" />
-
- <bean id="SAML2.Logout" lazy-init="true"
- class="net.shibboleth.sp.saml.saml2.profile.config.impl.SingleLogoutProfileConfiguration"
- p:encryptionOptionalPredicate="%{sp.encryption.optional:false}"
- p:asynchronous="%{sp.logout.asynchronous:true}" />
-
- <!--
- Security Configuration Defaults
-
- These settings establish the default security configurations for signatures and encryption
- and loads the default credentials used.
- -->
-
- <bean id="shibboleth.DefaultSecurityConfiguration" class="org.opensaml.xmlsec.config.BasicXMLSecurityConfiguration">
- <property name="signatureSigningConfiguration">
- <ref bean="#{'%{sp.signing.config:shibboleth.SigningConfiguration.SHA256}'.trim()}" />
- </property>
-
- <property name="signatureValidationConfiguration">
- <bean parent="shibboleth.BasicSignatureValidationConfiguration"
- p:signatureTrustEngine-ref="#{'%{sp.trust.signatures:shibboleth.ChainingSignatureTrustEngine}'.trim()}" />
- </property>
-
- <property name="clientTLSValidationConfiguration">
- <bean parent="shibboleth.BasicClientTLSValidationConfiguration"
- p:x509TrustEngine-ref="#{'%{sp.trust.certificates:shibboleth.ChainingX509TrustEngine}'.trim()}" />
- </property>
-
- <property name="httpClientSecurityConfiguration">
- <bean parent="shibboleth.BasicHttpClientSecurityConfiguration"
- p:clientTLSCredential="#{getObject('shibboleth.DefaultClientTLSCredential')}"
- p:TLSTrustEngine-ref="#{'%{sp.trust.httpClient.tls:shibboleth.ChainingX509TrustEngine}'.trim()}" />
- </property>
-
- <property name="encryptionConfiguration">
- <ref bean="#{'%{sp.encryption.config:shibboleth.EncryptionConfiguration.CBC}'.trim()}" />
- </property>
-
- <property name="decryptionConfiguration">
- <bean parent="shibboleth.BasicDecryptionConfiguration"
- p:KEKKeyInfoCredentialResolver-ref="defaultKeyEncryptionCredentialResolver"
- p:encryptedKeyResolver-ref="defaultEncryptedKeyResolver" />
- </property>
- </bean>
-
- <!-- KeyInfoGeneration machinery. Former gets injected into the signing and encryption configs. -->
- <bean id="NamedKeyInfoGeneratorManager"
- class="org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager"
- p:useDefaultManager="true" />
- <bean id="DefaultKeyInfoGeneratorManager"
- factory-bean="NamedKeyInfoGeneratorManager"
- factory-method="getDefaultManager" />
-
- <!-- These install two default generator managers, for Credential and X509Credential. -->
- <bean class="org.springframework.beans.factory.config.MethodInvokingBean"
- p:targetObject-ref="DefaultKeyInfoGeneratorManager"
- p:targetMethod="registerFactory">
- <property name="arguments">
- <list>
- <ref bean="%{sp.security.basicKeyInfoFactory:shibboleth.BasicKeyInfoGeneratorFactory}" />
- </list>
- </property>
- </bean>
- <bean class="org.springframework.beans.factory.config.MethodInvokingBean"
- p:targetObject-ref="DefaultKeyInfoGeneratorManager"
- p:targetMethod="registerFactory">
- <property name="arguments">
- <list>
- <ref bean="%{sp.security.x509KeyInfoFactory:shibboleth.X509KeyInfoGeneratorFactory}" />
- </list>
- </property>
- </bean>
-
- <!-- The default generators, overrideable by inheriting from them and then setting the two properties. -->
- <bean id="shibboleth.BasicKeyInfoGeneratorFactory" class="org.opensaml.xmlsec.keyinfo.impl.BasicKeyInfoGeneratorFactory"
- p:emitPublicKeyValue="true"
- p:emitKeyNames="true" />
- <bean id="shibboleth.X509KeyInfoGeneratorFactory" class="org.opensaml.xmlsec.keyinfo.impl.X509KeyInfoGeneratorFactory"
- p:emitEntityCertificate="true" />
-
- <!-- Convenience beans for directly injecting SHA-256 or SHA-1 usage. -->
-
- <bean id="shibboleth.SecurityConfiguration.SHA256" parent="shibboleth.DefaultSecurityConfiguration" lazy-init="true"
- p:signatureSigningConfiguration-ref="shibboleth.SigningConfiguration.SHA256" />
-
- <bean id="shibboleth.SecurityConfiguration.SHA1" parent="shibboleth.DefaultSecurityConfiguration" lazy-init="true"
- p:signatureSigningConfiguration-ref="shibboleth.SigningConfiguration.SHA1" />
-
- <!-- Actual signing configurations for SHA-256 and SHA-1. -->
-
- <bean id="shibboleth.SigningConfiguration.SHA256" parent="shibboleth.BasicSignatureSigningConfiguration"
- p:signingCredentials-ref="shibboleth.DefaultSigningCredential"
- p:keyInfoGeneratorManager-ref="NamedKeyInfoGeneratorManager">
- <property name="signatureAlgorithms">
- <list>
- <util:constant
- static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256" />
- <util:constant
- static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA256" />
- </list>
- </property>
- <property name="signatureReferenceDigestMethods">
- <list>
- <util:constant
- static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_DIGEST_SHA256" />
- </list>
- </property>
- </bean>
-
- <bean id="shibboleth.SigningConfiguration.SHA1" parent="shibboleth.BasicSignatureSigningConfiguration"
- p:signingCredentials-ref="shibboleth.DefaultSigningCredential"
- p:keyInfoGeneratorManager-ref="NamedKeyInfoGeneratorManager">
- <property name="signatureAlgorithms">
- <list>
- <util:constant
- static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1" />
- <util:constant
- static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA1" />
- </list>
- </property>
- <property name="signatureReferenceDigestMethods">
- <list>
- <util:constant
- static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_DIGEST_SHA1" />
- </list>
- </property>
- </bean>
-
- <!-- Convenience beans for directly injecting AES-CBC or AES-GCM usage. -->
-
- <bean id="shibboleth.SecurityConfiguration.CBC" parent="shibboleth.DefaultSecurityConfiguration" lazy-init="true"
- p:encryptionConfiguration-ref="shibboleth.EncryptionConfiguration.CBC" />
-
- <bean id="shibboleth.SecurityConfiguration.GCM" parent="shibboleth.DefaultSecurityConfiguration" lazy-init="true"
- p:encryptionConfiguration-ref="shibboleth.EncryptionConfiguration.GCM" />
-
- <!-- Actual encryption configurations for AES-CBC and AES-GCM. -->
-
- <bean id="shibboleth.EncryptionConfiguration.CBC" parent="shibboleth.BasicEncryptionConfiguration"
- p:keyTransportKeyInfoGeneratorManager-ref="NamedKeyInfoGeneratorManager">
- <property name="dataEncryptionAlgorithms">
- <list>
- <util:constant
- static-field="org.opensaml.xmlsec.encryption.support.EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128" />
- </list>
- </property>
- <property name="keyTransportEncryptionAlgorithms">
- <list>
- <util:constant
- static-field="org.opensaml.xmlsec.encryption.support.EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP" />
- </list>
- </property>
- </bean>
-
- <bean id="shibboleth.EncryptionConfiguration.GCM" parent="shibboleth.BasicEncryptionConfiguration"
- p:keyTransportKeyInfoGeneratorManager-ref="NamedKeyInfoGeneratorManager">
- <property name="dataEncryptionAlgorithms">
- <list>
- <util:constant
- static-field="org.opensaml.xmlsec.encryption.support.EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM" />
- </list>
- </property>
- <property name="keyTransportEncryptionAlgorithms">
- <list>
- <util:constant
- static-field="org.opensaml.xmlsec.encryption.support.EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP" />
- </list>
- </property>
- </bean>
-
- <!-- Beans related to configuration of key agreement, mostly to provide abstract parent beans for impl classes -->
-
- <bean id="shibboleth.KeyAgreement.Configuration" abstract="true"
- class="org.opensaml.saml.security.SAMLMetadataKeyAgreementEncryptionConfiguration" />
-
- <bean id="shibboleth.KeyAgreement.ConcatKDF" abstract="true" class="org.opensaml.xmlsec.derivation.impl.ConcatKDF" />
-
- <bean id="shibboleth.KeyAgreement.PBKDF2" abstract="true" class="org.opensaml.xmlsec.derivation.impl.PBKDF2" />
-
- <bean id="shibboleth.KeyAgreement.DigestMethod" abstract="true" class="org.opensaml.xmlsec.agreement.impl.DigestMethod" />
-
- <bean id="shibboleth.KeyAgreement.KANonce" abstract="true" class="org.opensaml.xmlsec.agreement.impl.KANonce" />
-
- <bean id="shibboleth.MetadataPKIXValidationInformationResolver"
- class="net.shibboleth.idp.saml.security.impl.MetadataPKIXValidationInformationResolver"
- c:resolver-ref="shibboleth.RoleDescriptorResolver" />
-
- <!-- Trust Engine options for message signature evaluation. -->
-
- <bean id="shibboleth.ExplicitKeySignatureTrustEngine"
- class="org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine"
- c:resolver-ref="shibboleth.MetadataCredentialResolver"
- c:keyInfoResolver-ref="shibboleth.KeyInfoCredentialResolver" />
-
- <bean id="shibboleth.PKIXSignatureTrustEngine"
- class="org.opensaml.xmlsec.signature.support.impl.PKIXSignatureTrustEngine"
- c:resolver-ref="shibboleth.MetadataPKIXValidationInformationResolver"
- c:keyInfoResolver-ref="shibboleth.KeyInfoCredentialResolver" />
-
- <bean id="shibboleth.ChainingSignatureTrustEngine"
- class="org.opensaml.xmlsec.signature.support.impl.ChainingSignatureTrustEngine">
- <constructor-arg>
- <list>
- <ref bean="shibboleth.ExplicitKeySignatureTrustEngine" />
- <ref bean="shibboleth.PKIXSignatureTrustEngine" />
- </list>
- </constructor-arg>
- </bean>
-
- <!-- Trust Engine options for X.509 certificate evaluation (e.g., TLS). -->
-
- <bean id="shibboleth.ExplicitKeyX509TrustEngine"
- class="org.opensaml.security.trust.impl.ExplicitKeyTrustEngine"
- c:resolver-ref="shibboleth.MetadataCredentialResolver" />
- <!-- Backward compatibility, remove in 5.0. -->
- <alias name="shibboleth.ExplicitKeyX509TrustEngine" alias="shibboleth.ExplicitX509TrustEngine" />
-
- <bean id="shibboleth.PKIXX509TrustEngine"
- class="org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine"
- c:resolver-ref="shibboleth.MetadataPKIXValidationInformationResolver" />
-
- <bean id="shibboleth.ChainingX509TrustEngine" class="org.opensaml.security.trust.impl.ChainingTrustEngine">
- <constructor-arg>
- <list>
- <ref bean="shibboleth.ExplicitKeyX509TrustEngine" />
- <ref bean="shibboleth.PKIXX509TrustEngine" />
- </list>
- </constructor-arg>
- </bean>
-
- <!-- Defines decryption keys, along with support for optimizing lookup based on KeyInfo hints. -->
- <bean id="defaultKeyEncryptionCredentialResolver" class="org.opensaml.xmlsec.keyinfo.impl.ChainingKeyInfoCredentialResolver">
- <constructor-arg>
- <list>
- <bean class="org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver">
- <constructor-arg name="localCredentialResolver">
- <bean class="org.opensaml.xmlsec.keyinfo.impl.CollectionKeyInfoCredentialResolver"
- c:credentials-ref="shibboleth.DefaultEncryptionCredentials" />
- </constructor-arg>
- <constructor-arg name="keyInfoProviders">
- <list>
- <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider" />
- <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.DSAKeyValueProvider" />
- <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.ECKeyValueProvider" />
- <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.DEREncodedKeyValueProvider" />
- <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider" />
- <bean class="org.opensaml.xmlsec.keyinfo.impl.provider.AgreementMethodKeyInfoProvider" />
- </list>
- </constructor-arg>
- </bean>
- <bean class="org.opensaml.xmlsec.keyinfo.impl.StaticKeyInfoCredentialResolver"
- c:credentials-ref="shibboleth.DefaultEncryptionCredentials" />
- </list>
- </constructor-arg>
- </bean>
-
- <!-- Defines how the system locates EncryptedKey elements sent in messages containing encrypted objects. -->
- <bean id="defaultEncryptedKeyResolver" class="org.opensaml.xmlsec.encryption.support.ChainingEncryptedKeyResolver">
- <constructor-arg name="encKeyResolvers">
- <list>
- <bean class="org.opensaml.xmlsec.encryption.support.InlineEncryptedKeyResolver" />
- <bean class="org.opensaml.saml.saml2.encryption.EncryptedElementTypeEncryptedKeyResolver" />
- <bean class="org.opensaml.xmlsec.encryption.support.SimpleRetrievalMethodEncryptedKeyResolver" />
- <bean class="org.opensaml.xmlsec.encryption.support.SimpleKeyInfoReferenceEncryptedKeyResolver" />
- </list>
- </constructor-arg>
- </bean>
-
</beans>
diff --git a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/AbstractBaseSPFlowTest.java b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/AbstractBaseSPFlowTest.java
new file mode 100644
index 0000000..8187077
--- /dev/null
+++ b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/AbstractBaseSPFlowTest.java
@@ -0,0 +1,40 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.flows;
+
+import org.springframework.test.context.ContextConfiguration;
+
+/**
+ * Base class for testing SP flows within the primary plugin.
+ */
+ at ContextConfiguration(
+ locations = {
+ "classpath*:/META-INF/net.shibboleth.idp/postconfig.xml"
+ },
+ initializers = {
+ TestSPEnvironmentApplicationContextInitializer.class,
+ }
+ )
+public abstract class AbstractBaseSPFlowTest extends AbstractSPFlowTest {
+
+ protected AbstractBaseSPFlowTest(final String id) {
+ super(id);
+ }
+
+ protected AbstractBaseSPFlowTest(final String id, final String endId) {
+ super(id, endId);
+ }
+
+}
\ No newline at end of file
diff --git a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/AbstractSPFlowTest.java b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/AbstractSPFlowTest.java
index 3bd39f3..2d5ed4d 100644
--- a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/AbstractSPFlowTest.java
+++ b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/AbstractSPFlowTest.java
@@ -51,14 +51,11 @@ import net.shibboleth.sp.ddf.DDF;
import net.shibboleth.sp.profile.impl.ResolveApplication;
/**
- * Abstract unit test class for SP flows.
+ * Abstract unit test class for SP flows usable by other plugins.
*/
@ContextConfiguration(
locations = {
- "classpath*:/META-INF/net.shibboleth.idp/postconfig.xml",
- "classpath*:/net/shibboleth/sp/test-beans.xml", },
- initializers = {
- TestSPEnvironmentApplicationContextInitializer.class,
+ "classpath*:/META-INF/net.shibboleth.idp/postconfig.xml"
}
)
public abstract class AbstractSPFlowTest extends AbstractFlowTest {
diff --git a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/ParseRequestMapFlowTest.java b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/ParseRequestMapFlowTest.java
index e3e1c39..68b99ad 100644
--- a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/ParseRequestMapFlowTest.java
+++ b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/ParseRequestMapFlowTest.java
@@ -34,7 +34,7 @@ import net.shibboleth.sp.ddf.DDFSupport;
* Unit test for the SP RequestMap-parsing flow.
*/
@SuppressWarnings("javadoc")
-public class ParseRequestMapFlowTest extends AbstractSPFlowTest {
+public class ParseRequestMapFlowTest extends AbstractBaseSPFlowTest {
/** Flow ID. */
@Nonnull public static final String FLOW_ID = "sp/parse-request-map";
diff --git a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/PingFlowTest.java b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/PingFlowTest.java
index 0a5627d..2e45805 100644
--- a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/PingFlowTest.java
+++ b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/PingFlowTest.java
@@ -29,7 +29,7 @@ import net.shibboleth.sp.ddf.DDF;
/**
* Unit test for the SP ping flow and some basic agent authentication checks.
*/
-public class PingFlowTest extends AbstractSPFlowTest {
+public class PingFlowTest extends AbstractBaseSPFlowTest {
/** Flow ID. */
@Nonnull public static final String FLOW_ID = "sp/ping";
diff --git a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/SealerFlowTest.java b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/SealerFlowTest.java
index abd7078..3a51dab 100644
--- a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/SealerFlowTest.java
+++ b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/SealerFlowTest.java
@@ -36,7 +36,7 @@ import net.shibboleth.sp.profile.impl.DoSealerOperation;
/**
* Unit test for the SP sealer flow.
*/
-public class SealerFlowTest extends AbstractSPFlowTest {
+public class SealerFlowTest extends AbstractBaseSPFlowTest {
/** Flow ID. */
@Nonnull public static final String FLOW_ID = "sp/sealer";
diff --git a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/SessionInitiatorFlowTest.java b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/SessionInitiatorFlowTest.java
index 1bbf23f..98d65bb 100644
--- a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/SessionInitiatorFlowTest.java
+++ b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/SessionInitiatorFlowTest.java
@@ -29,7 +29,7 @@ import net.shibboleth.sp.profile.impl.ResolveApplication;
/**
* Unit test for the SP session-initiator flow (basics only).
*/
-public class SessionInitiatorFlowTest extends AbstractSPFlowTest {
+public class SessionInitiatorFlowTest extends AbstractBaseSPFlowTest {
/** Flow ID. */
@Nonnull public static final String FLOW_ID = "sp/session-initiator";
diff --git a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/StorageFlowTest.java b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/StorageFlowTest.java
index 24938b1..be5723d 100644
--- a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/StorageFlowTest.java
+++ b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/StorageFlowTest.java
@@ -37,7 +37,7 @@ import net.shibboleth.sp.profile.impl.DoStorageOperation;
/**
* Unit test for the SP sealer flow.
*/
-public class StorageFlowTest extends AbstractSPFlowTest {
+public class StorageFlowTest extends AbstractBaseSPFlowTest {
/** Flow ID. */
@Nonnull public static final String FLOW_ID = "sp/storage";
diff --git a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/TestSPEnvironmentApplicationContextInitializer.java b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/TestSPEnvironmentApplicationContextInitializer.java
index 51cc3cf..8a022bd 100644
--- a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/TestSPEnvironmentApplicationContextInitializer.java
+++ b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/TestSPEnvironmentApplicationContextInitializer.java
@@ -43,8 +43,6 @@ public class TestSPEnvironmentApplicationContextInitializer
final MockPropertySource mock = new MockPropertySource();
mock.setProperty("idp.home", "classpath:/net/shibboleth/idp/module");
mock.setProperty("idp.webflows", "classpath*:/flows");
- mock.setProperty("idp.service.metadata.resources", "test.sp.MetadataResolverResources");
- mock.setProperty("sp.service.agents.resources", "test.sp.AgentResolverResources");
mock.setProperty("idp.additionalProperties",
"/conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/admin/admin.properties, /conf/authn/authn.properties, /conf/c14n/subject-c14n.properties, /credentials/secrets.properties, /conf/sp/sp.properties");
applicationContext.getEnvironment().getPropertySources().addFirst(mock);
diff --git a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/saml2/SAML2SessionInitiatorFlowTest.java b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/saml2/SAML2SessionInitiatorFlowTest.java
deleted file mode 100644
index 91a1383..0000000
--- a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/saml2/SAML2SessionInitiatorFlowTest.java
+++ /dev/null
@@ -1,419 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.flows.saml2;
-
-import java.io.IOException;
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.decoder.MessageDecodingException;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.SAMLObject;
-import org.opensaml.saml.saml2.core.AuthnContext;
-import org.opensaml.saml.saml2.core.AuthnContextClassRef;
-import org.opensaml.saml.saml2.core.AuthnContextComparisonTypeEnumeration;
-import org.opensaml.saml.saml2.core.AuthnRequest;
-import org.opensaml.saml.saml2.core.NameIDPolicy;
-import org.opensaml.saml.saml2.core.NameIDType;
-import org.opensaml.saml.saml2.core.RequestedAuthnContext;
-import org.opensaml.saml.saml2.metadata.NameIDFormat;
-import org.springframework.webflow.executor.FlowExecutionResult;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.sp.context.AgentRequestContext;
-import net.shibboleth.sp.ddf.DDF;
-import net.shibboleth.sp.flows.AbstractSPFlowTest;
-import net.shibboleth.sp.profile.InitiatorConstants;
-
-/**
- * Unit test for the SP session-initiator flow.
- */
-public class SAML2SessionInitiatorFlowTest extends AbstractSPFlowTest {
-
- /** Flow ID. */
- @Nonnull public static final String FLOW_ID = "sp/session-initiator";
-
- /** Flow ID. */
- @Nonnull public static final String RESPONSE_URL = "https://sp.example.org/Shibboleth.sso/SAML2/POST";
-
- protected SAML2SessionInitiatorFlowTest() {
- super(FLOW_ID);
- }
-
- /**
- * Test flow with unverified (no metadata) IdP specified.
- *
- * @throws IOException
- */
- @Test
- public void testUnverified() throws IOException {
- setDefaultAuth();
-
- final DDF input = new DDF(null).structure();
- input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- setApplicationRequest("no-metadata", input);
-
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertFlowExecutionResult(result, FLOW_ID);
- assertFlowExecutionOutcome(result.getOutcome());
- assertOutputMessageEvent(result, AuthnEventIds.NO_POTENTIAL_FLOW);
- }
-
- /**
- * Test flow with profile disallowed.
- *
- * @throws IOException
- */
- @Test
- public void testProfileDisabled() throws IOException {
- setDefaultAuth();
-
- final DDF input = new DDF(null).structure();
- input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- setApplicationRequest("no-profile", input);
-
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertFlowExecutionResult(result, FLOW_ID);
- assertFlowExecutionOutcome(result.getOutcome());
- assertOutputMessageEvent(result, AuthnEventIds.NO_POTENTIAL_FLOW);
- }
-
- /**
- * Test flow with no valid endpoint
- *
- * @throws IOException
- */
- @Test
- public void testNoEndpoint() throws IOException {
- setDefaultAuth();
-
- final DDF input = new DDF(null).structure();
- input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- setApplicationRequest("no-endpoint", input);
-
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertFlowExecutionResult(result, FLOW_ID);
- assertFlowExecutionOutcome(result.getOutcome());
- assertOutputMessageEvent(result, AuthnEventIds.NO_POTENTIAL_FLOW);
- }
-
- /**
- * Test flow without proper input.
- *
- * @throws IOException
- */
- @Test
- public void testNoResponseURL() throws IOException {
- setDefaultAuth();
-
- setApplicationRequest(APPLICATION_ID, null);
-
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertFlowExecutionResult(result, FLOW_ID);
- assertFlowExecutionOutcome(result.getOutcome());
- assertOutputMessageEvent(result, AuthnEventIds.NO_POTENTIAL_FLOW);
- }
-
- /**
- * Test simple success case.
- *
- * @throws IOException
- * @throws MessageDecodingException
- */
- @Test
- public void testSimple() throws IOException, MessageDecodingException {
- setDefaultAuth();
-
- final DDF input = new DDF(null).structure();
- input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- setApplicationRequest(APPLICATION_ID, input);
-
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertFlowExecutionResult(result, FLOW_ID);
- assertFlowExecutionOutcome(result.getOutcome());
-
- assertOutputMessageEvent(result, null);
- final AuthnRequest req = validateOutputMessage(result, null);
- Assert.assertNull(req.getSubject());
- Assert.assertNull(req.getRequestedAuthnContext());
- Assert.assertNull(req.getScoping());
- assertFalse(req.isForceAuthn());
- assertFalse(req.isPassive());
- }
-
- /**
- * Test success supplying ForceAuthn from agent.
- *
- * @throws IOException
- * @throws MessageDecodingException
- */
- @Test
- public void testForceAuthnFromAgent() throws IOException, MessageDecodingException {
- setDefaultAuth();
-
- final DDF input = new DDF(null).structure();
- input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- input.addmember(AuthnRequest.FORCE_AUTHN_ATTRIB_NAME).integer(1);
- setApplicationRequest(APPLICATION_ID, input);
-
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertFlowExecutionResult(result, FLOW_ID);
- assertFlowExecutionOutcome(result.getOutcome());
-
- assertOutputMessageEvent(result, null);
- final AuthnRequest req = validateOutputMessage(result, null);
- Assert.assertNull(req.getSubject());
- Assert.assertNull(req.getRequestedAuthnContext());
- Assert.assertNull(req.getScoping());
- assertTrue(req.isForceAuthn());
- assertFalse(req.isPassive());
- }
-
- /**
- * Test failure supplying ForceAuthn from agent.
- *
- * @throws IOException
- * @throws MessageDecodingException
- */
- @Test
- public void testForceAuthnDisallowed() throws IOException, MessageDecodingException {
- setDefaultAuth();
-
- final DDF input = new DDF(null).structure();
- input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- input.addmember(AuthnRequest.FORCE_AUTHN_ATTRIB_NAME).integer(1);
- setApplicationRequest("feature-blocking", input);
-
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertFlowExecutionResult(result, FLOW_ID);
- assertFlowExecutionOutcome(result.getOutcome());
-
- assertOutputMessageEvent(result, null);
- final AuthnRequest req = validateOutputMessage(result, null);
- Assert.assertNull(req.getSubject());
- Assert.assertNull(req.getRequestedAuthnContext());
- Assert.assertNull(req.getScoping());
- assertFalse(req.isForceAuthn());
- assertFalse(req.isPassive());
- }
-
- /**
- * Test success supplying IsPassive from agent.
- *
- * @throws IOException
- * @throws MessageDecodingException
- */
- @Test
- public void testIsPassiveFromAgent() throws IOException, MessageDecodingException {
- setDefaultAuth();
-
- final DDF input = new DDF(null).structure();
- input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- input.addmember(AuthnRequest.IS_PASSIVE_ATTRIB_NAME).integer(1);
- setApplicationRequest(APPLICATION_ID, input);
-
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertFlowExecutionResult(result, FLOW_ID);
- assertFlowExecutionOutcome(result.getOutcome());
-
- assertOutputMessageEvent(result, null);
- final AuthnRequest req = validateOutputMessage(result, null);
- Assert.assertNull(req.getSubject());
- Assert.assertNull(req.getRequestedAuthnContext());
- Assert.assertNull(req.getScoping());
- assertFalse(req.isForceAuthn());
- assertTrue(req.isPassive());
- }
-
- /**
- * Test success supplying NameIDPolicy format from agent.
- *
- * @throws IOException
- * @throws MessageDecodingException
- */
- @Test
- public void testNameIDPolicyFromAgent() throws IOException, MessageDecodingException {
- setDefaultAuth();
-
- final DDF input = new DDF(null).structure();
- input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- input.addmember(NameIDFormat.DEFAULT_ELEMENT_LOCAL_NAME).string(NameIDType.EMAIL);
- setApplicationRequest(APPLICATION_ID, input);
-
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertFlowExecutionResult(result, FLOW_ID);
- assertFlowExecutionOutcome(result.getOutcome());
-
- assertOutputMessageEvent(result, null);
- final AuthnRequest req = validateOutputMessage(result, NameIDType.EMAIL);
- Assert.assertNull(req.getSubject());
- Assert.assertNull(req.getRequestedAuthnContext());
- Assert.assertNull(req.getScoping());
- assertFalse(req.isForceAuthn());
- assertFalse(req.isPassive());
- }
-
- /**
- * Test failure supplying NameIDPolicy format from agent.
- *
- * @throws IOException
- * @throws MessageDecodingException
- */
- @Test
- public void testNameIDPolicyDisallowed() throws IOException, MessageDecodingException {
- setDefaultAuth();
-
- final DDF input = new DDF(null).structure();
- input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- input.addmember(NameIDFormat.DEFAULT_ELEMENT_LOCAL_NAME).string(NameIDType.EMAIL);
- setApplicationRequest("feature-blocking", input);
-
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertFlowExecutionResult(result, FLOW_ID);
- assertFlowExecutionOutcome(result.getOutcome());
-
- assertOutputMessageEvent(result, null);
- final AuthnRequest req = validateOutputMessage(result, null);
- Assert.assertNull(req.getSubject());
- Assert.assertNull(req.getRequestedAuthnContext());
- Assert.assertNull(req.getScoping());
- assertFalse(req.isForceAuthn());
- assertFalse(req.isPassive());
- }
-
- /**
- * Test success supplying RequestedAuthnContext from agent.
- *
- * @throws IOException
- * @throws MessageDecodingException
- */
- @Test
- public void testAuthnContextFromAgent() throws IOException, MessageDecodingException {
- setDefaultAuth();
-
- final DDF input = new DDF(null).structure();
- input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- final DDF aclist = input.addmember(AuthnContextClassRef.DEFAULT_ELEMENT_LOCAL_NAME).list();
- aclist.add(new DDF(null).string(AuthnContext.X509_AUTHN_CTX));
- aclist.add(new DDF(null).string(AuthnContext.TIME_SYNC_TOKEN_AUTHN_CTX));
- input.addmember("AuthnContextComparison").string(AuthnContextComparisonTypeEnumeration.MINIMUM.toString());
- setApplicationRequest(APPLICATION_ID, input);
-
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertFlowExecutionResult(result, FLOW_ID);
- assertFlowExecutionOutcome(result.getOutcome());
-
- assertOutputMessageEvent(result, null);
- final AuthnRequest req = validateOutputMessage(result, null);
- Assert.assertNull(req.getSubject());
- Assert.assertNull(req.getScoping());
- assertFalse(req.isForceAuthn());
- assertFalse(req.isPassive());
-
- final RequestedAuthnContext rac = req.getRequestedAuthnContext();
- assert rac != null;
- Assert.assertEquals(rac.getComparison(), AuthnContextComparisonTypeEnumeration.MINIMUM);
- Assert.assertEquals(rac.getAuthnContextClassRefs().size(), 2);
- Assert.assertEquals(rac.getAuthnContextClassRefs().get(0).getURI(), AuthnContext.X509_AUTHN_CTX);
- Assert.assertEquals(rac.getAuthnContextClassRefs().get(1).getURI(), AuthnContext.TIME_SYNC_TOKEN_AUTHN_CTX);
- }
-
- /**
- * Test success supplying RequestedAuthnContext from agent.
- *
- * @throws IOException
- * @throws MessageDecodingException
- */
- @Test
- public void testAuthnContextDisallowed() throws IOException, MessageDecodingException {
- setDefaultAuth();
-
- final DDF input = new DDF(null).structure();
- input.addmember(InitiatorConstants.RESPONSE_URL).string(RESPONSE_URL);
- final DDF aclist = input.addmember(AuthnContextClassRef.DEFAULT_ELEMENT_LOCAL_NAME).list();
- aclist.add(new DDF(null).string(AuthnContext.X509_AUTHN_CTX));
- aclist.add(new DDF(null).string(AuthnContext.TIME_SYNC_TOKEN_AUTHN_CTX));
- setApplicationRequest("feature-blocking", input);
-
- final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertFlowExecutionResult(result, FLOW_ID);
- assertFlowExecutionOutcome(result.getOutcome());
-
- assertOutputMessageEvent(result, null);
- final AuthnRequest req = validateOutputMessage(result, null);
- Assert.assertNull(req.getSubject());
- Assert.assertNull(req.getRequestedAuthnContext());
- Assert.assertNull(req.getScoping());
- assertFalse(req.isForceAuthn());
- assertFalse(req.isPassive());
- }
-
- /**
- * Decode an encoded response and run sanity checks against it.
- *
- * @param result flow execution result
- * @param format NameID format to check for in policy element
- *
- * @return the request object
- *
- * @throws MessageDecodingException
- */
- @Nonnull private AuthnRequest validateOutputMessage(@Nonnull final FlowExecutionResult result, @Nullable final String format)
- throws MessageDecodingException {
- final ProfileRequestContext prc = retrieveProfileRequestContext(result);
- assert prc != null;
- final AgentRequestContext arc = prc.ensureSubcontext(AgentRequestContext.class);
- final DDF output = arc.getOutput();
-
- assert output != null;
- Assert.assertTrue(output.isstruct());
- final DDF http = output.getmember("http");
- Assert.assertTrue(http.isstruct());
-
- final AuthnRequest authnRequest;
- final String redirect = http.getmember("redirect").string();
- if (redirect != null) {
- final SAMLObject saml = decodeRedirect(redirect);
- assert saml instanceof AuthnRequest;
- authnRequest = (AuthnRequest) saml;
- Assert.assertTrue(redirect.startsWith(authnRequest.getDestination()));
- } else {
- final byte[] body = http.getmember("response.data").unsafe_string();
- Assert.assertNotNull(body);
- // Not trivial to consider parsing the form, so just bypass that step.
- final Object saml = prc.ensureOutboundMessageContext().ensureMessage();
- assert saml instanceof AuthnRequest;
- authnRequest = (AuthnRequest) saml;
- }
-
- assert authnRequest != null;
- Assert.assertNotNull(authnRequest.getID());
- Assert.assertTrue(Instant.now().isAfter(authnRequest.getIssueInstant()));
-
- Assert.assertEquals(authnRequest.getAssertionConsumerServiceURL(), RESPONSE_URL);
-
- final NameIDPolicy pol = authnRequest.getNameIDPolicy();
- assert pol != null;
- assertTrue(pol.getAllowCreate());
- Assert.assertEquals(pol.getFormat(), format);
-
- return authnRequest;
- }
-
-}
\ No newline at end of file
diff --git a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/saml2/package-info.java b/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/saml2/package-info.java
deleted file mode 100644
index dcd7e59..0000000
--- a/sp-conf-impl/src/test/java/net/shibboleth/sp/flows/saml2/package-info.java
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Unit tests for SAML 2 flows.
- */
-package net.shibboleth.sp.flows.saml2;
\ No newline at end of file
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml b/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
similarity index 81%
copy from sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
copy to sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
index f194ecc..e914f23 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
+++ b/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
@@ -21,6 +21,21 @@
<!-- ============ Agents and their Applications ============ -->
+ <bean id="testsp.example.org" parent="shibboleth.Agent" p:sharedSecrets="foo">
+ <property name="applications">
+ <set>
+ <bean p:id="default" parent="shibboleth.Application"
+ p:issuer="https://testsp.example.org"
+ p:authenticatingAuthority="https://idp.example.org" />
+
+ <bean p:id="no-initiators" parent="shibboleth.Application"
+ p:issuer="https://testsp.example.org"
+ p:authenticatingAuthority="https://idp.example.org"
+ p:sessionInitiators="#{{}}" />
+ </set>
+ </property>
+ </bean>
+
<bean id="sp.example.org" parent="shibboleth.Agent">
<property name="applications">
<set>
@@ -53,7 +68,7 @@
<bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">
<property name="profileConfigurations">
<list>
- <!-- <ref bean="SAML2.SSO" /> -->
+ <!-- Your profiles here. -->
</list>
</property>
</bean>
@@ -68,31 +83,15 @@
<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
<property name="profileConfigurations">
<list>
- <ref bean="SAML2.SSO" />
- <ref bean="SAML2.ECP" />
- <ref bean="SAML2.Logout" />
+ <!-- Your profiles here. -->
</list>
</property>
- </bean>
+ </bean>
<!-- Container for any overrides you want to add. -->
<util:list id="shibboleth.RelyingPartyOverrides">
- <!--
- Override example that identifies a single IdP by name and configures it
- for SAML 2 SSO with a different security configuration.
- -->
- <!--
- <bean id="CustomKey" parent="RelyingPartyByName" c:relyingPartyIds="https://idp.example.org">
- <property name="profileConfigurations">
- <list>
- <bean parent="SAML2.SSO" p:securityConfiguration-ref="custom.SecurityConfig" />
- </list>
- </property>
- </bean>
- -->
-
</util:list>
</beans>
diff --git a/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/metadata-providers.xml b/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/metadata-providers.xml
deleted file mode 100644
index ba3bf0f..0000000
--- a/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/metadata-providers.xml
+++ /dev/null
@@ -1,108 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<MetadataProvider id="ShibbolethMetadata" xsi:type="ChainingMetadataProvider"
- xmlns="urn:mace:shibboleth:2.0:metadata"
- xmlns:security="urn:mace:shibboleth:2.0:security"
- xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
- xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
- xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
- xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
- xmlns:ds11="http://www.w3.org/2009/xmldsig11#"
- xmlns:enc="http://www.w3.org/2001/04/xmlenc#"
- xmlns:enc11="http://www.w3.org/2009/xmlenc11#"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
- urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd
- urn:oasis:names:tc:SAML:2.0:assertion http://docs.oasis-open.org/security/saml/v2.0/saml-schema-assertion-2.0.xsd
- urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd
- urn:oasis:names:tc:SAML:metadata:algsupport http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-metadata-algsupport-v1.0.xsd
- http://www.w3.org/2000/09/xmldsig# http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd
- http://www.w3.org/2009/xmldsig11# http://www.w3.org/TR/2013/REC-xmldsig-core1-20130411/xmldsig11-schema.xsd
- http://www.w3.org/2001/04/xmlenc# http://www.w3.org/TR/xmlenc-core/xenc-schema.xsd
- http://www.w3.org/2009/xmlenc11# http://www.w3.org/TR/2013/REC-xmlenc-core1-20130411/xenc-schema-11.xsd">
-
- <!-- ========================================== -->
- <!-- Metadata Configuration -->
- <!-- ========================================== -->
-
- <!-- Example metadata provider. -->
-
- <MetadataProvider id="InlineExample" xsi:type="InlineMetadataProvider" indexesRef="testbed.MetadataIndexes">
- <md:EntitiesDescriptor Name="tests">
- <md:EntityDescriptor entityID="https://idp.example.org">
- <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
- <md:KeyDescriptor>
- <ds:KeyInfo>
- <ds:X509Data>
- <ds:X509Certificate>
-MIIDtTCCAp2gAwIBAgIJAPmsD+VGldyPMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
-BAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX
-aWRnaXRzIFB0eSBMdGQwHhcNMTQwNDExMTMzOTE4WhcNMjQwNDA4MTMzOTE4WjBF
-MQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50
-ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAxg0TyQAP/tIvOH89EtaXuRRn8SYzTj7W1TbNY4VvBmobjkRmSkki4hH9
-x4sQpi635wn6WtXTN/FNNmkTK3N/LspmBWxfZS+n+cc7I82E5yvCAPX67QsZgqgg
-lp2W5dvK/FsMMCS6X6SVqzBLMP88NenXKxY+HMxMs0sT0UKYh1cAEqadrHRBO65a
-DBcm5a0sBVYt9K6pgaOHrp/zSIbhnR5tFFLjBbtFktDpHL3AdGBH3OYidNGKBO3t
-J3Ms7LeKXsM0+0Y4P+9fHZINL2X3E2N6GVnKs5PZTg9sP0FtIpAbYm/+zCx7Yj1E
-T/Er8mDd6tNVGSQsn9s5xUBwGqn14wIDAQABo4GnMIGkMB0GA1UdDgQWBBSiQhSu
-p9BYjD2ZuMkEiQK7w/Zq0TB1BgNVHSMEbjBsgBSiQhSup9BYjD2ZuMkEiQK7w/Zq
-0aFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNV
-BAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAPmsD+VGldyPMAwGA1UdEwQF
-MAMBAf8wDQYJKoZIhvcNAQELBQADggEBAHZmIo9GBTSsD5DJfKkCVUvBafwR089H
-BkgVPOuVuEe803BRlKd4BVIsuxAUAy3oqdJYqf9ptPEx8Ef+ALbcDhRbWINhMgO7
-0/S4x3pS9gOn7/Y9yZplOe4Jd2q3R8QBef+hKLcD/Uv0Sqy2nilM8BnMga5tqsL+
-8oFt0blzXtQ2vcOVyNyG326uZBZv2Cf6FXFsYQX1L/tLeTBJegefgGkg2dqCTKIU
-1Qy/Kd2P3/S01kQxjDeG7UfXc9qtelJ68kvzK2d3WOJ2qmsdMxjMNfTItP7FO54M
-i8V7gp9HK+EimdSbgu7xktKlrqA2Rsn+dBoPSgOUs/LOGtCS9/biF0w=
- </ds:X509Certificate>
- </ds:X509Data>
- </ds:KeyInfo>
- </md:KeyDescriptor>
- <md:SingleSignOnService
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
- Location="https://idp.example.org/idp/profile/SAML2/Redirect/SSO" />
- <md:SingleSignOnService
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
- Location="https://idp.example.org/idp/profile/SAML2/POST/SSO" />
- </md:IDPSSODescriptor>
- </md:EntityDescriptor>
-
- <md:EntityDescriptor entityID="https://noendpoint.example.org">
- <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
- <md:KeyDescriptor>
- <ds:KeyInfo>
- <ds:X509Data>
- <ds:X509Certificate>
-MIIDtTCCAp2gAwIBAgIJAPmsD+VGldyPMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
-BAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX
-aWRnaXRzIFB0eSBMdGQwHhcNMTQwNDExMTMzOTE4WhcNMjQwNDA4MTMzOTE4WjBF
-MQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50
-ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAxg0TyQAP/tIvOH89EtaXuRRn8SYzTj7W1TbNY4VvBmobjkRmSkki4hH9
-x4sQpi635wn6WtXTN/FNNmkTK3N/LspmBWxfZS+n+cc7I82E5yvCAPX67QsZgqgg
-lp2W5dvK/FsMMCS6X6SVqzBLMP88NenXKxY+HMxMs0sT0UKYh1cAEqadrHRBO65a
-DBcm5a0sBVYt9K6pgaOHrp/zSIbhnR5tFFLjBbtFktDpHL3AdGBH3OYidNGKBO3t
-J3Ms7LeKXsM0+0Y4P+9fHZINL2X3E2N6GVnKs5PZTg9sP0FtIpAbYm/+zCx7Yj1E
-T/Er8mDd6tNVGSQsn9s5xUBwGqn14wIDAQABo4GnMIGkMB0GA1UdDgQWBBSiQhSu
-p9BYjD2ZuMkEiQK7w/Zq0TB1BgNVHSMEbjBsgBSiQhSup9BYjD2ZuMkEiQK7w/Zq
-0aFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNV
-BAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAPmsD+VGldyPMAwGA1UdEwQF
-MAMBAf8wDQYJKoZIhvcNAQELBQADggEBAHZmIo9GBTSsD5DJfKkCVUvBafwR089H
-BkgVPOuVuEe803BRlKd4BVIsuxAUAy3oqdJYqf9ptPEx8Ef+ALbcDhRbWINhMgO7
-0/S4x3pS9gOn7/Y9yZplOe4Jd2q3R8QBef+hKLcD/Uv0Sqy2nilM8BnMga5tqsL+
-8oFt0blzXtQ2vcOVyNyG326uZBZv2Cf6FXFsYQX1L/tLeTBJegefgGkg2dqCTKIU
-1Qy/Kd2P3/S01kQxjDeG7UfXc9qtelJ68kvzK2d3WOJ2qmsdMxjMNfTItP7FO54M
-i8V7gp9HK+EimdSbgu7xktKlrqA2Rsn+dBoPSgOUs/LOGtCS9/biF0w=
- </ds:X509Certificate>
- </ds:X509Data>
- </ds:KeyInfo>
- </md:KeyDescriptor>
- <md:SingleSignOnService
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
- Location="https://idp.example.org/idp/profile/SAML2/Artifact/SSO" />
- </md:IDPSSODescriptor>
- </md:EntityDescriptor>
- </md:EntitiesDescriptor>
- </MetadataProvider>
-
-</MetadataProvider>
diff --git a/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/test-agents.xml b/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/test-agents.xml
deleted file mode 100644
index e9e80df..0000000
--- a/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/test-agents.xml
+++ /dev/null
@@ -1,58 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <bean id="testsp.example.org" parent="shibboleth.Agent" p:sharedSecrets="foo">
- <property name="applications">
- <set>
- <bean p:id="default" parent="shibboleth.Application"
- p:issuer="https://testsp.example.org"
- p:authenticatingAuthority="https://idp.example.org" />
-
- <bean p:id="feature-blocking" parent="shibboleth.Application"
- p:issuer="https://testsp.example.org"
- p:authenticatingAuthority="https://idp.example.org"
- p:defaultConfiguration-ref="featureBlockingDefaultRelyingParty" />
-
- <bean p:id="no-metadata" parent="shibboleth.Application"
- p:issuer="https://testsp.example.org"
- p:authenticatingAuthority="https://unknown.example.org" />
-
- <bean p:id="no-profile" parent="shibboleth.Application"
- p:issuer="https://testsp.example.org"
- p:authenticatingAuthority="https://idp.example.org"
- p:defaultConfiguration-ref="shibboleth.UnverifiedRelyingParty" />
-
- <bean p:id="no-endpoint" parent="shibboleth.Application"
- p:issuer="https://testsp.example.org"
- p:authenticatingAuthority="https://noendpoint.example.org" />
-
- <bean p:id="no-initiators" parent="shibboleth.Application"
- p:issuer="https://testsp.example.org"
- p:authenticatingAuthority="https://idp.example.org"
- p:sessionInitiators="#{{}}" />
- </set>
- </property>
- </bean>
-
- <bean id="featureBlockingDefaultRelyingParty" parent="RelyingParty">
- <property name="profileConfigurations">
- <list>
- <bean parent="SAML2.SSO" p:disallowedFeatures="0x1F" />
- <ref bean="SAML2.ECP" />
- <ref bean="SAML2.Logout" />
- </list>
- </property>
- </bean>
-
-</beans>
diff --git a/sp-conf-impl/src/test/resources/net/shibboleth/sp/test-beans.xml b/sp-conf-impl/src/test/resources/net/shibboleth/sp/test-beans.xml
deleted file mode 100644
index 4f388d6..0000000
--- a/sp-conf-impl/src/test/resources/net/shibboleth/sp/test-beans.xml
+++ /dev/null
@@ -1,27 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:jdbc="http://www.springframework.org/schema/jdbc"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/jdbc http://www.springframework.org/schema/jdbc/spring-jdbc.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
-
- <util:list id="test.sp.AgentResolverResources">
- <value>%{idp.home}/conf/sp/agents.xml</value>
- <value>%{idp.home}/conf/sp/test-agents.xml</value>
- </util:list>
-
- <util:list id="test.sp.MetadataResolverResources">
- <value>%{idp.home}/conf/sp/metadata-providers.xml</value>
- </util:list>
-
-</beans>
diff --git a/sp-saml-api/.checkstyle b/sp-saml-api/.checkstyle
deleted file mode 100644
index 1feabed..0000000
--- a/sp-saml-api/.checkstyle
+++ /dev/null
@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-
-<fileset-config file-format-version="1.2.0" simple-config="true" sync-formatter="false">
- <local-check-config name="Shibboleth Checkstyle" location="/java-plugin-shibd/resources/checkstyle/checkstyle.xml" type="project" description="">
- <additional-data name="protect-config-file" value="false"/>
- </local-check-config>
- <fileset name="all" enabled="true" check-config-name="Shibboleth Checkstyle" local="true">
- <file-match-pattern match-pattern="." include-pattern="true"/>
- </fileset>
-</fileset-config>
diff --git a/sp-saml-api/.gitignore b/sp-saml-api/.gitignore
deleted file mode 100644
index 1df25bf..0000000
--- a/sp-saml-api/.gitignore
+++ /dev/null
@@ -1,2 +0,0 @@
-/test-output
-/target
diff --git a/sp-saml-api/pom.xml b/sp-saml-api/pom.xml
deleted file mode 100644
index d19df34..0000000
--- a/sp-saml-api/pom.xml
+++ /dev/null
@@ -1,51 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!-- See LICENSE.txt file in the root directory of this repository for the copyright/license information. -->
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
- <modelVersion>4.0.0</modelVersion>
- <parent>
- <groupId>net.shibboleth.sp</groupId>
- <artifactId>sp-parent</artifactId>
- <version>0.0.1-SNAPSHOT</version>
- </parent>
-
- <artifactId>sp-saml-api</artifactId>
- <description>SP SAML API.</description>
- <name>Shibboleth SP :: Processing Hub :: SAML API</name>
- <packaging>jar</packaging>
-
- <properties>
- <checkstyle.configLocation>${project.basedir}/../resources/checkstyle/checkstyle.xml</checkstyle.configLocation>
- <automatic.module.name>net.shibboleth.sp.saml</automatic.module.name>
- </properties>
-
- <dependencies>
- <!-- Compile dependencies -->
- <dependency>
- <groupId>${project.groupId}</groupId>
- <artifactId>sp-server-api</artifactId>
- <version>${project.version}</version>
- <scope>compile</scope>
- </dependency>
-
- <!-- Provided dependencies -->
- <dependency>
- <groupId>${shib-profile.groupId}</groupId>
- <artifactId>shib-saml-profile-api</artifactId>
- <scope>provided</scope>
- </dependency>
- <dependency>
- <groupId>${shib-attribute.groupId}</groupId>
- <artifactId>shib-attribute-api</artifactId>
- <scope>provided</scope>
- </dependency>
- <dependency>
- <groupId>${shib-metadata.groupId}</groupId>
- <artifactId>shib-metadata-api</artifactId>
- <scope>provided</scope>
- </dependency>
-
- <!-- Test Dependencies -->
- </dependencies>
-
-</project>
diff --git a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/SAML2InitiatorConstants.java b/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/SAML2InitiatorConstants.java
deleted file mode 100644
index 7e74962..0000000
--- a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/SAML2InitiatorConstants.java
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.saml.saml2.profile;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-
-/**
- * Constants for session initiator operations.
- */
-public final class SAML2InitiatorConstants {
-
- /** Private constructor. */
- private SAML2InitiatorConstants() {
-
- }
-}
\ No newline at end of file
diff --git a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
deleted file mode 100644
index 391a354..0000000
--- a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.saml.saml2.profile.config;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.saml.profile.config.SAMLArtifactConsumerProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.xml.SAMLConstants;
-import org.opensaml.saml.saml2.core.AuthnContextClassRef;
-import org.opensaml.saml.saml2.core.AuthnRequest;
-
-/** Configuration support for SP SAML 2.0 Browser SSO. */
-public interface BrowserSSOProfileConfiguration extends SAMLArtifactConsumerProfileConfiguration,
- net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration {
-
- /**
- * Get the {@link AuthnContextClassRef} values to include in SAML request.
- *
- * @param profileRequestContext current profile request context
- *
- * @return list of class references
- */
- @Nonnull @NonnullElements @NotLive @Unmodifiable List<String> getAuthnContextClassRefs(
- @Nullable final ProfileRequestContext profileRequestContext);
-
- /**
- * Get the name identifier format to require via the SAML request.
- *
- * @param profileRequestContext current profile request context
- *
- * @return required format
- */
- @Nullable String getNameIDFormat(@Nullable final ProfileRequestContext profileRequestContext);
-
-
- /**
- * Get the SAML binding to insert into an {@link AuthnRequest} to control the response binding.
- *
- * <p>Defaults tp {@link SAMLConstants#SAML2_POST_BINDING_URI}.</p>
- *
- * @param profileRequestContext current profile request context
- *
- * @return response binding
- */
- @Nullable String getResponseBinding(@Nullable final ProfileRequestContext profileRequestContext);
-
-}
\ No newline at end of file
diff --git a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/ECPProfileConfiguration.java b/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/ECPProfileConfiguration.java
deleted file mode 100644
index 6b921b0..0000000
--- a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/ECPProfileConfiguration.java
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.saml.saml2.profile.config;
-
-/** Configuration support for SP SAML 2.0 ECP. */
-public interface ECPProfileConfiguration
- extends BrowserSSOProfileConfiguration, net.shibboleth.saml.saml2.profile.config.ECPProfileConfiguration {
-
-}
\ No newline at end of file
diff --git a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/SAML2ProfileConfiguration.java b/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
deleted file mode 100644
index 55f3f52..0000000
--- a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/SAML2ProfileConfiguration.java
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.saml.saml2.profile.config;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-
-/** Common interface for SAML 2.0 SP profile configurations. */
-public interface SAML2ProfileConfiguration extends net.shibboleth.saml.saml2.profile.config.SAML2ProfileConfiguration {
-
- /**
- * Get the entityID assigned to this system.
- *
- * @param profileRequestContext current profile request context
- *
- * @return our own entityID
- */
- @Nullable @NotEmpty String getEntityID(@Nullable final ProfileRequestContext profileRequestContext);
-
-}
\ No newline at end of file
diff --git a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/SingleLogoutProfileConfiguration.java b/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/SingleLogoutProfileConfiguration.java
deleted file mode 100644
index 4a1d087..0000000
--- a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/SingleLogoutProfileConfiguration.java
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.saml.saml2.profile.config;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.ext.saml2aslo.Asynchronous;
-
-/** Configuration support for SP SAML 2.0 Single Logout. */
-public interface SingleLogoutProfileConfiguration
- extends net.shibboleth.saml.saml2.profile.config.SingleLogoutProfileConfiguration {
-
- /**
- * Get whether to include the {@link Asynchronous} extension in requests.
- *
- * <p>Defaults to true.</p>
- *
- * @param profileRequestContext current profile request context
- *
- * @return true iff the extension should be included in requests
- */
- boolean isAsynchronous(@Nullable final ProfileRequestContext profileRequestContext);
-
-}
\ No newline at end of file
diff --git a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/package-info.java b/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/package-info.java
deleted file mode 100644
index e97e075..0000000
--- a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/package-info.java
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Configuration of SAML support in SP.
- */
-package net.shibboleth.sp.saml.saml2.profile.config;
\ No newline at end of file
diff --git a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/package-info.java b/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/package-info.java
deleted file mode 100644
index c5fff8b..0000000
--- a/sp-saml-api/src/main/java/net/shibboleth/sp/saml/saml2/profile/package-info.java
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * API classes for SAML 2.0 profiles.
- */
-package net.shibboleth.sp.saml.saml2.profile;
\ No newline at end of file
diff --git a/sp-saml-impl/.checkstyle b/sp-saml-impl/.checkstyle
deleted file mode 100644
index 1feabed..0000000
--- a/sp-saml-impl/.checkstyle
+++ /dev/null
@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-
-<fileset-config file-format-version="1.2.0" simple-config="true" sync-formatter="false">
- <local-check-config name="Shibboleth Checkstyle" location="/java-plugin-shibd/resources/checkstyle/checkstyle.xml" type="project" description="">
- <additional-data name="protect-config-file" value="false"/>
- </local-check-config>
- <fileset name="all" enabled="true" check-config-name="Shibboleth Checkstyle" local="true">
- <file-match-pattern match-pattern="." include-pattern="true"/>
- </fileset>
-</fileset-config>
diff --git a/sp-saml-impl/.gitignore b/sp-saml-impl/.gitignore
deleted file mode 100644
index 1df25bf..0000000
--- a/sp-saml-impl/.gitignore
+++ /dev/null
@@ -1,2 +0,0 @@
-/test-output
-/target
diff --git a/sp-saml-impl/pom.xml b/sp-saml-impl/pom.xml
deleted file mode 100644
index 83b5a12..0000000
--- a/sp-saml-impl/pom.xml
+++ /dev/null
@@ -1,79 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!-- See LICENSE.txt file in the root directory of this repository for the copyright/license information. -->
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
- <modelVersion>4.0.0</modelVersion>
- <parent>
- <groupId>net.shibboleth.sp</groupId>
- <artifactId>sp-parent</artifactId>
- <version>0.0.1-SNAPSHOT</version>
- </parent>
-
- <artifactId>sp-saml-impl</artifactId>
- <description>SP SAML Implememntation.</description>
- <name>Shibboleth SP :: Processing Hub :: SAML Implementation</name>
- <packaging>jar</packaging>
-
- <properties>
- <checkstyle.configLocation>${project.basedir}/../resources/checkstyle/checkstyle.xml</checkstyle.configLocation>
- <automatic.module.name>net.shibboleth.sp.saml.impl</automatic.module.name>
- </properties>
-
- <dependencies>
- <!-- Compile dependencies -->
- <dependency>
- <groupId>${project.groupId}</groupId>
- <artifactId>sp-saml-api</artifactId>
- <version>${project.version}</version>
- </dependency>
-
- <!-- Provided dependencies -->
- <dependency>
- <groupId>${idp.groupId}</groupId>
- <artifactId>idp-profile-api</artifactId>
- <scope>provided</scope>
- </dependency>
-
- <dependency>
- <groupId>${shib-profile.groupId}</groupId>
- <artifactId>shib-profile-api</artifactId>
- <scope>provided</scope>
- </dependency>
- <dependency>
- <groupId>${shib-profile.groupId}</groupId>
- <artifactId>shib-saml-profile-api</artifactId>
- <scope>provided</scope>
- </dependency>
-
- <dependency>
- <groupId>${shib-attribute.groupId}</groupId>
- <artifactId>shib-attribute-api</artifactId>
- <scope>provided</scope>
- </dependency>
- <dependency>
- <groupId>${shib-metadata.groupId}</groupId>
- <artifactId>shib-metadata-api</artifactId>
- <scope>provided</scope>
- </dependency>
-
- <dependency>
- <groupId>${opensaml.groupId}</groupId>
- <artifactId>opensaml-saml-api</artifactId>
- <scope>provided</scope>
- </dependency>
-
- <dependency>
- <groupId>jakarta.servlet</groupId>
- <artifactId>jakarta.servlet-api</artifactId>
- <scope>provided</scope>
- </dependency>
-
- <!-- Test Dependencies -->
- <dependency>
- <groupId>${idp.groupId}</groupId>
- <artifactId>idp-testing</artifactId>
- <scope>test</scope>
- </dependency>
- </dependencies>
-
-</project>
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/AbstractSAML2ArtifactConsumerProfileConfiguration.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/AbstractSAML2ArtifactConsumerProfileConfiguration.java
deleted file mode 100644
index 8693b36..0000000
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/AbstractSAML2ArtifactConsumerProfileConfiguration.java
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.saml.saml2.profile.config.impl;
-
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate;
-
-import net.shibboleth.saml.profile.config.SAMLArtifactConsumerProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.PredicateSupport;
-
-/**
- * Configuration support for artifact-consuming profiles.
- */
-public abstract class AbstractSAML2ArtifactConsumerProfileConfiguration extends AbstractSAML2ProfileConfiguration
- implements SAMLArtifactConsumerProfileConfiguration {
-
- /** Predicate used to determine if artifact resolution requests should be signed. */
- @Nonnull private Predicate<MessageContext> signArtifactRequestsPredicate;
-
- /** Predicate used to determine if artifact resolution requests should use client TLS. */
- @Nonnull private Predicate<MessageContext> clientTLSArtifactRequestsPredicate;
-
- /**
- * Constructor.
- *
- * @param profileId unique ID for this profile
- */
- protected AbstractSAML2ArtifactConsumerProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- signArtifactRequestsPredicate = new NoIntegrityMessageChannelPredicate();
- clientTLSArtifactRequestsPredicate = new NoIntegrityMessageChannelPredicate().negate();
- }
-
- /** {@inheritDoc} */
- public boolean isSignArtifactRequests(@Nullable final MessageContext messageContext) {
- return signArtifactRequestsPredicate.test(messageContext);
- }
-
- /**
- * Set whether artifact resolution requests should be signed.
- *
- * @param flag flag to set
- */
- public void setSignArtifactRequests(final boolean flag) {
- signArtifactRequestsPredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set the predicate used to determine if artifact resolution requests should be signed.
- *
- * @param predicate the predicate
- */
- public void setSignArtifactRequestsPredicate(@Nonnull final Predicate<MessageContext> predicate) {
- signArtifactRequestsPredicate = Constraint.isNotNull(predicate,
- "Predicate used to determine artifact request signing may not be null");
- }
-
- /** {@inheritDoc} */
- public boolean isClientTLSArtifactRequests(@Nullable final MessageContext messageContext) {
- return clientTLSArtifactRequestsPredicate.test(messageContext);
- }
-
- /**
- * Set whether artifact resolution requests should use client TLS.
- *
- * @param flag flag to set
- */
- public void setClientTLSArtifactRequests(final boolean flag) {
- clientTLSArtifactRequestsPredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set the predicate used to determine if artifact resolution requests should use client TLS.
- *
- * @param predicate the predicate
- */
- public void setClientTLSArtifactRequestsPredicate(@Nonnull final Predicate<MessageContext> predicate) {
- clientTLSArtifactRequestsPredicate = Constraint.isNotNull(predicate,
- "Predicate used to determine artifact client TLS use may not be null");
- }
-
-}
\ No newline at end of file
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/AbstractSAML2AssertionConsumerProfileConfiguration.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/AbstractSAML2AssertionConsumerProfileConfiguration.java
deleted file mode 100644
index 343a5af..0000000
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/AbstractSAML2AssertionConsumerProfileConfiguration.java
+++ /dev/null
@@ -1,158 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.saml.saml2.profile.config.impl;
-
-import java.time.Duration;
-import java.util.Collection;
-import java.util.Set;
-import java.util.function.Function;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.saml.profile.config.SAMLAssertionConsumingProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonNegative;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.logic.PredicateSupport;
-import net.shibboleth.shared.primitive.StringSupport;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-/** Base class for SAML profile configurations. */
-public abstract class AbstractSAML2AssertionConsumerProfileConfiguration
- extends AbstractSAML2ArtifactConsumerProfileConfiguration
- implements SAMLAssertionConsumingProfileConfiguration {
-
- /** Whether to require signed assertions. */
- @Nonnull private Predicate<ProfileRequestContext> requireSignedAssertionsPredicate;
-
- /** Lookup function to supply assertionLifetime property. */
- @Nonnull private Function<ProfileRequestContext,Duration> assertionLifetimeLookupStrategy;
-
- /** Lookup function to supply additionalAudiences property. */
- @Nonnull private Function<ProfileRequestContext,Set<String>> assertionAudiencesLookupStrategy;
-
- /**
- * Constructor.
- *
- * @param profileId ID of the communication profile
- */
- public AbstractSAML2AssertionConsumerProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
-
- requireSignedAssertionsPredicate = PredicateSupport.alwaysFalse();
- assertionLifetimeLookupStrategy = FunctionSupport.constant(null);
- assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
- }
-
- /** {@inheritDoc} */
- public boolean isRequireSignedAssertions(@Nullable final ProfileRequestContext profileRequestContext) {
- return requireSignedAssertionsPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether to require signed assertions.
- *
- * @param flag flag to set
- */
- public void setRequireSignedAssertions(final boolean flag) {
- requireSignedAssertionsPredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set condition to determine whether to require signed assertions.
- *
- * @param condition condition to set
- */
- public void setRequireSignedAssertionsPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- requireSignedAssertionsPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nullable @NonNegative public Duration getAssertionLifetime(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration lifetime = assertionLifetimeLookupStrategy.apply(profileRequestContext);
- if (lifetime != null) {
- Constraint.isFalse(lifetime.isNegative(), "Assertion lifetime must be non-negative");
- }
- return lifetime;
- }
-
- /**
- * Set the maximum lifetime of an assertion.
- *
- * @param lifetime lifetime of an assertion
- */
- public void setAssertionLifetime(@Nullable @NonNegative final Duration lifetime) {
- if (lifetime != null) {
- Constraint.isFalse(lifetime.isNegative(), "Assertion lifetime must be non-negative");
- }
-
- assertionLifetimeLookupStrategy = FunctionSupport.constant(lifetime);
- }
-
- /**
- * Set a lookup strategy for the maximum lifetime of an assertion.
- *
- * @param strategy lookup strategy
- */
- public void setAssertionLifetimeLookupStrategy(@Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- assertionLifetimeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive public Set<String> getAssertionAudiences(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final Set<String> audiences = assertionAudiencesLookupStrategy.apply(profileRequestContext);
- if (audiences != null) {
- return CollectionSupport.copyToSet(audiences);
- }
- return CollectionSupport.emptySet();
- }
-
- /**
- * Set the set of audiences, in addition to our entityID, to validate the assertion against.
- *
- * @param audiences the additional audiences
- */
- public void setAssertionAudiences(@Nullable @NonnullElements final Collection<String> audiences) {
-
- if (audiences == null || audiences.isEmpty()) {
- assertionAudiencesLookupStrategy = FunctionSupport.constant(null);
- } else {
- assertionAudiencesLookupStrategy = FunctionSupport.constant(
- CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(audiences)));
- }
- }
-
- /**
- * Set a lookup strategy for the set of audiences, in addition to our entityID, to validate the assertion against.
- *
- * @param strategy lookup strategy
- *
- * @since 4.0.0
- */
- public void setAssertionAudiencesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Set<String>> strategy) {
- assertionAudiencesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
-}
\ No newline at end of file
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/AbstractSAML2ProfileConfiguration.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/AbstractSAML2ProfileConfiguration.java
deleted file mode 100644
index caa8026..0000000
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/AbstractSAML2ProfileConfiguration.java
+++ /dev/null
@@ -1,218 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.saml.saml2.profile.config.impl;
-
-import java.util.function.Function;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.profile.config.AbstractConditionalProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.logic.PredicateSupport;
-import net.shibboleth.sp.saml.saml2.profile.config.SAML2ProfileConfiguration;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.context.ProfileRequestContext;
-
-/** Base class for SAML profile configurations. */
-public abstract class AbstractSAML2ProfileConfiguration extends AbstractConditionalProfileConfiguration implements
- SAML2ProfileConfiguration {
-
- /** Function used to obtain our entityID. */
- @Nonnull private Function<ProfileRequestContext,String> entityIDLookupStrategy;
-
- /** Predicate used to determine if the generated request should be signed. Default returns false. */
- @Nonnull private Predicate<ProfileRequestContext> signRequestsPredicate;
-
- /** Predicate used to determine if the generated response should be signed. Default returns false. */
- @Nonnull private Predicate<ProfileRequestContext> signResponsesPredicate;
-
- /** Whether encryption is optional in the face of no key, etc. */
- @Nonnull private Predicate<ProfileRequestContext> encryptionOptionalPredicate;
-
- /** Predicate used to determine if name identifiers should be encrypted. */
- @Nonnull private Predicate<ProfileRequestContext> encryptNameIDsPredicate;
-
- /** Lookup function to supply a message handler function. */
- @Nonnull private Function<MessageContext,Function<MessageContext,Exception>> messageHandlerLookupStrategy;
-
-
- /**
- * Constructor.
- *
- * @param profileId ID of the communication profile
- */
- public AbstractSAML2ProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
-
- entityIDLookupStrategy = FunctionSupport.constant(null);
- signRequestsPredicate = PredicateSupport.alwaysFalse();
- signResponsesPredicate = PredicateSupport.alwaysFalse();
- encryptionOptionalPredicate = PredicateSupport.alwaysFalse();
- encryptNameIDsPredicate = PredicateSupport.alwaysFalse();
-
- messageHandlerLookupStrategy = FunctionSupport.constant(null);
- }
-
- /** {@inheritDoc} */
- public boolean isIgnoreRequestSignatures(@Nullable ProfileRequestContext profileRequestContext) {
- throw new UnsupportedOperationException("ignoreRequestSignatures is unsupported");
- }
-
- /** {@inheritDoc} */
- @Nullable @NotEmpty public String getEntityID(@Nullable final ProfileRequestContext profileRequestContext) {
- return entityIDLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the entityID of this system.
- *
- * @param id entityID
- */
- public void setEntityID(@Nullable @NotEmpty final String id) {
- entityIDLookupStrategy = FunctionSupport.constant(id);
- }
-
- /**
- * Set the lookup strategy for the entityID of this system
- *
- * @param strategy lookup strategy
- */
- public void setEntityIDLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- entityIDLookupStrategy = Constraint.isNotNull(strategy, "EntityID lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- public boolean isSignRequests(@Nullable final ProfileRequestContext profileRequestContext) {
- return signRequestsPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether generated requests should be signed.
- *
- * @param flag flag to set
- */
- public void setSignRequests(final boolean flag) {
- signRequestsPredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set the predicate used to determine if generated requests should be signed.
- *
- * @param predicate predicate used to determine if generated requests should be signed
- */
- public void setSignRequestsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
- signRequestsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
- }
-
- /** {@inheritDoc} */
- public boolean isSignResponses(@Nullable final ProfileRequestContext profileRequestContext) {
- return signResponsesPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether generated responses should be signed.
- *
- * @param flag flag to set
- */
- public void setSignResponses(final boolean flag) {
- signResponsesPredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set the predicate used to determine if generated responses should be signed.
- *
- * @param predicate predicate used to determine if generated responses should be signed
- */
- public void setSignResponsesPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
- signResponsesPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
- }
-
- /** {@inheritDoc} */
- public boolean isEncryptionOptional(@Nullable final ProfileRequestContext profileRequestContext) {
- return encryptionOptionalPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether encryption is optional in the face of a missing key, etc.
- *
- * @param flag flag to set
- */
- public void setEncryptionOptional(final boolean flag) {
- encryptionOptionalPredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set a condition to determine whether encryption is optional in the face of a missing key, etc.
- *
- * @param condition condition to set
- */
- public void setEncryptionOptionalPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- encryptionOptionalPredicate = Constraint.isNotNull(condition, "Encryption optional predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- public boolean isEncryptNameIDs(@Nullable final ProfileRequestContext profileRequestContext) {
- return encryptNameIDsPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether name identifiers should be encrypted.
- *
- * @param flag flag to set
- */
- public void setEncryptNameIDs(final boolean flag) {
- encryptNameIDsPredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set the predicate used to determine if name identifiers should be encrypted.
- *
- * @param predicate predicate used to determine if name identifiers should be encrypted
- */
- public void setEncryptNameIDsPredicate(@Nonnull final Predicate<ProfileRequestContext> predicate) {
- encryptNameIDsPredicate = Constraint.isNotNull(predicate, "Condition cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nullable
- public Function<MessageContext,Exception> getMessageHandler(@Nullable final MessageContext messageContext) {
- return messageHandlerLookupStrategy.apply(messageContext);
- }
-
- /**
- * Set a message handler for a SAML message produced or consumed by this profile.
- *
- * @param handler message handler
- */
- public void setMessageHandler(@Nullable final Function<MessageContext,Exception> handler) {
- messageHandlerLookupStrategy = FunctionSupport.constant(handler);
- }
-
- /**
- * Set a lookup strategy for a message handler for a SAML message produced or consumed by this profile.
- *
- * @param strategy lookup strategy
- */
- public void setMessageHandlerLookupStrategy(
- @Nonnull final Function<MessageContext,Function<MessageContext,Exception>> strategy) {
- messageHandlerLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
-}
\ No newline at end of file
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
deleted file mode 100644
index 31fed31..0000000
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
+++ /dev/null
@@ -1,415 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.saml.saml2.profile.config.impl;
-
-import java.time.Duration;
-import java.util.Collection;
-import java.util.List;
-import java.util.function.Function;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.saml.profile.config.SAMLArtifactConsumerProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonNegative;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.logic.PredicateSupport;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.xml.SAMLConstants;
-import org.opensaml.saml.saml2.core.AuthnContextClassRef;
-import org.opensaml.saml.saml2.core.AuthnContextComparisonTypeEnumeration;
-import org.opensaml.saml.saml2.core.AuthnRequest;
-import org.opensaml.saml.saml2.core.SubjectLocality;
-import org.opensaml.saml.saml2.metadata.RequestedAttribute;
-
-/** Configuration support for SP SAML 2.0 Browser SSO. */
-public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionConsumerProfileConfiguration
- implements SAMLArtifactConsumerProfileConfiguration, net.shibboleth.sp.saml.saml2.profile.config.BrowserSSOProfileConfiguration {
-
- /** Whether to mandate forced authentication for the request. */
- @Nonnull private Predicate<ProfileRequestContext> forceAuthnPredicate;
-
- /** Whether to compare client and assertion addresses on inbound SSO. */
- @Nonnull private Predicate<ProfileRequestContext> checkAddressPredicate;
-
- /** Lookup function to supply maximum time since inbound AuthnInstant. */
- @Nonnull private Function<ProfileRequestContext,Duration> maximumTimeSinceAuthnLookupStrategy;
-
- /** Lookup function to supply ProxyCount. */
- @Nonnull private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy;
-
- /** Lookup function for requested AC operator. */
- @Nonnull private Function<ProfileRequestContext,String> authnContextComparisonLookupStrategy;
-
- /** Lookup function to supply default authentication methods. */
- @Nonnull private Function<ProfileRequestContext,Collection<String>> authnContextClassRefLookupStrategy;
-
- /** Lookup function to supply NameID format. */
- @Nonnull private Function<ProfileRequestContext,String> nameIDFormatLookupStrategy;
-
- /** Lookup function to supply SPNameQualifier. */
- @Nonnull private Function<ProfileRequestContext,String> nameQualifierLookupStrategy;
-
- /** Lookup function to supply AttributeConsumingServiceIndex. */
- @Nonnull private Function<ProfileRequestContext,Integer> attributeIndexLookupStrategy;
-
- /** Lookup function to supply RequestedAttributes. */
- @Nonnull private Function<ProfileRequestContext,Collection<RequestedAttribute>> requestedAttributesLookupStrategy;
-
- /** Lookup function for response binding. */
- @Nonnull private Function<ProfileRequestContext,String> responseBindingLookupStrategy;
-
- /** Constructor. */
- public BrowserSSOProfileConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Constructor.
- *
- * @param profileId unique ID for this profile
- */
- protected BrowserSSOProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- setEncryptNameIDs(true);
- forceAuthnPredicate = PredicateSupport.alwaysFalse();
- checkAddressPredicate = PredicateSupport.alwaysTrue();
- maximumTimeSinceAuthnLookupStrategy = FunctionSupport.constant(null);
- proxyCountLookupStrategy = FunctionSupport.constant(null);
- authnContextComparisonLookupStrategy = FunctionSupport.constant(null);
- authnContextClassRefLookupStrategy = FunctionSupport.constant(null);
- nameIDFormatLookupStrategy = FunctionSupport.constant(null);
- nameQualifierLookupStrategy = FunctionSupport.constant(null);
- attributeIndexLookupStrategy = FunctionSupport.constant(null);
- requestedAttributesLookupStrategy = FunctionSupport.constant(null);
- responseBindingLookupStrategy = FunctionSupport.constant(SAMLConstants.SAML2_POST_BINDING_URI);
- }
-
- /** {@inheritDoc} */
- public boolean isForceAuthn(@Nullable final ProfileRequestContext profileRequestContext) {
- return forceAuthnPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether a fresh user presence proof should be required for this request.
- *
- * @param flag flag to set
- */
- public void setForceAuthn(final boolean flag) {
- forceAuthnPredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set a condition to determine whether a fresh user presence proof should be required for this request.
- *
- * @param condition condition to set
- */
- public void setForceAuthnPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- forceAuthnPredicate = Constraint.isNotNull(condition, "Forced authentication predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- public boolean isCheckAddress(@Nullable final ProfileRequestContext profileRequestContext) {
- return checkAddressPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether the client's address must match the address in an inbound {@link SubjectLocality}
- * element during inbound SSO.
- *
- * @param flag flag to set
- */
- public void setCheckAddress(final boolean flag) {
- checkAddressPredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set a condition to determine whether the client's address must match the address in an inbound
- * {@link SubjectLocality} element during inbound SSO.
- *
- * @param condition condition to set
- */
- public void setCheckAddressPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- checkAddressPredicate = Constraint.isNotNull(condition, "Address checking predicate cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nullable public Duration getMaximumTimeSinceAuthn(@Nullable final ProfileRequestContext profileRequestContext) {
- final Duration amount = maximumTimeSinceAuthnLookupStrategy.apply(profileRequestContext);
- Constraint.isFalse(amount != null && amount.isNegative(),
- "Maximum time since authentication must be greater than or equal to 0");
- return amount;
- }
-
- /**
- * Set the maximum amount of time allowed to have elapsed since an incoming AuthnInstant.
- *
- * <p>A null or 0 is interpreted as an unlimited amount.</p>
- *
- * @param amount max time to allow
- */
- public void setMaximumTimeSinceAuthn(@Nullable final Duration amount) {
- Constraint.isFalse(amount != null && amount.isNegative(),
- "Maximum time since authentication must be greater than or equal to 0");
-
- maximumTimeSinceAuthnLookupStrategy = FunctionSupport.constant(amount);
- }
-
- /**
- * Set a lookup strategy for the maximum amount of time allowed to have elapsed since an incoming AuthnInstant.
- *
- * @param strategy lookup strategy
- */
- public void setMaximumTimeSinceAuthnLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Duration> strategy) {
- maximumTimeSinceAuthnLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @NonNegative @Nullable public Integer getProxyCount(@Nullable final ProfileRequestContext profileRequestContext) {
- final Integer count = proxyCountLookupStrategy.apply(profileRequestContext);
- if (count != null) {
- Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
- }
- return count;
- }
-
- /**
- * Set the maximum number of times an assertion may be proxied to signal in the SAML request.
- *
- * @param count maximum number of times an assertion may be proxied
- */
- public void setProxyCount(@Nullable @NonNegative final Integer count) {
- if (count != null) {
- Constraint.isGreaterThanOrEqual(0, count, "Proxy count must be greater than or equal to 0");
- }
- proxyCountLookupStrategy = FunctionSupport.constant(count);
- }
-
- /**
- * Set a lookup strategy for the maximum number of times an assertion may be proxied to signal
- * in the SAML request.
- *
- * @param strategy lookup strategy
- */
- public void setProxyCountLookupStrategy(@Nonnull final Function<ProfileRequestContext,Integer> strategy) {
- proxyCountLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nullable public AuthnContextComparisonTypeEnumeration getAuthnContextComparison(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- final String comparison = authnContextComparisonLookupStrategy.apply(profileRequestContext);
- if (comparison != null) {
- return AuthnContextComparisonTypeEnumeration.valueOf(comparison.toUpperCase());
- }
-
- return null;
- }
-
- /**
- * Set the comparison operator to use when issuing SAML requests containing requested context classes.
- *
- * @param comparison comparison value or null
- *
- * @since 4.0.0
- */
- public void setAuthnContextComparison(@Nullable final AuthnContextComparisonTypeEnumeration comparison) {
- authnContextComparisonLookupStrategy =
- FunctionSupport.constant(comparison != null ? comparison.toString() : null);
- }
-
- /**
- * Set a lookup strategy for the comparison operator to use when issuing SAML requests containing
- * requested context classes.
- *
- * @param strategy lookup strategy
- */
- public void setAuthnContextComparisonLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,String> strategy) {
- authnContextComparisonLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getAuthnContextClassRefs(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Collection<String> refs = authnContextClassRefLookupStrategy.apply(profileRequestContext);
- if (refs != null) {
- return CollectionSupport.copyToList(refs);
- }
- return CollectionSupport.emptyList();
- }
-
- /**
- * Set the {@link AuthnContextClassRef} values to include in SAML request.
- *
- * @param contexts default authentication context class references to use
- */
- public void setAuthnContextClassRefs(@Nullable @NonnullElements final Collection<String> contexts) {
- if (contexts != null) {
- authnContextClassRefLookupStrategy = FunctionSupport.constant(CollectionSupport.copyToList(contexts));
- } else {
- authnContextClassRefLookupStrategy = FunctionSupport.constant(null);
- }
- }
-
- /**
- * Set a lookup strategy for the {@link AuthnContextClassRef} values to include in SAML request.
- *
- * @param strategy lookup strategy
- */
- public void setAuthnContextClassRefsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
- authnContextClassRefLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nullable public String getNameIDFormat(@Nullable final ProfileRequestContext profileRequestContext) {
- return nameIDFormatLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the name identifier format to require via the SAML request.
- *
- * @param format required format
- */
- public void setNameIDFormat(@Nullable final String format) {
- nameIDFormatLookupStrategy = FunctionSupport.constant(format);
- }
-
- /**
- * Set a lookup strategy for the name identifier format to require via the SAML request.
- *
- * @param strategy lookup strategy
- */
- public void setNameIDFormatLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,String> strategy) {
- nameIDFormatLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nullable public String getSPNameQualifier(@Nullable final ProfileRequestContext profileRequestContext) {
- return nameQualifierLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the SPNameQualifier to include in the SAML request.
- *
- * @param qualifier requested SPNameQualifier
- */
- public void setSPNameQualifier(@Nullable final String qualifier) {
- nameQualifierLookupStrategy = FunctionSupport.constant(qualifier);
- }
-
- /**
- * Set a lookup strategy for the SPNameQualifier to include in the SAML request.
- *
- * @param strategy lookup strategy
- */
- public void setSPNameQualifierLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,String> strategy) {
- nameQualifierLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nullable public Integer getAttributeIndex(@Nullable final ProfileRequestContext profileRequestContext) {
- return attributeIndexLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the AttributeConsumingServiceIndex to include in the SAML request.
- *
- * @param index the AttributeConsumingServiceIndex
- */
- public void setAttributeIndex(@Nullable final Integer index) {
- attributeIndexLookupStrategy = FunctionSupport.constant(index);
- }
-
- /**
- * Set a lookup strategy for the AttributeConsumingServiceIndex to include in the SAML request.
- *
- * @param strategy lookup strategy
- */
- public void setAttributeIndexLookupStrategy(@Nonnull final Function<ProfileRequestContext,Integer> strategy) {
- attributeIndexLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<RequestedAttribute> getRequestedAttributes(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Collection<RequestedAttribute> attrs = requestedAttributesLookupStrategy.apply(profileRequestContext);
- if (attrs != null) {
- return CollectionSupport.copyToList(attrs);
- } else {
- return CollectionSupport.emptyList();
- }
- }
-
- /**
- * Set the list of {@link RequestedAttribute} objects to include in the SAML request (via extension).
- *
- * @param attrs requested attributes
- */
- public void setRequestedAttributes(@Nullable @NonnullElements final Collection<RequestedAttribute> attrs) {
- requestedAttributesLookupStrategy = FunctionSupport.constant(attrs);
- }
-
- /**
- * Set a lookup strategy for the list of {@link RequestedAttribute} objects to include in the SAML request
- * (via extension).
- *
- * @param strategy lookup strategy
- */
- public void setRequestedAttributesLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Collection<RequestedAttribute>> strategy) {
- requestedAttributesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nullable public String getResponseBinding(@Nullable ProfileRequestContext profileRequestContext) {
- return responseBindingLookupStrategy.apply(profileRequestContext);
- }
-
- /**
- * Set the response binding to place into the {@link AuthnRequest}.
- *
- * <p>Defaults tp {@link SAMLConstants#SAML2_POST_BINDING_URI}.</p>
- *
- * @param binding response binding
- */
- public void setResponseBinding(@Nullable final String binding) {
- responseBindingLookupStrategy = FunctionSupport.constant(binding);
- }
-
- /**
- * Set a lookup strategy for
- *
- * @param strategy
- */
- public void setResponseBindingLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- responseBindingLookupStrategy =
- Constraint.isNotNull(strategy, "Response binding lookup strategy cannot be null");
- }
-
-}
\ No newline at end of file
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/ECPProfileConfiguration.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/ECPProfileConfiguration.java
deleted file mode 100644
index c9f3022..0000000
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/ECPProfileConfiguration.java
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.saml.saml2.profile.config.impl;
-
-/** Configuration support for SP SAML 2.0 ECP. */
-public class ECPProfileConfiguration extends BrowserSSOProfileConfiguration
- implements net.shibboleth.sp.saml.saml2.profile.config.ECPProfileConfiguration {
-
- /** Constructor. */
- public ECPProfileConfiguration() {
- super(net.shibboleth.saml.saml2.profile.config.ECPProfileConfiguration.PROFILE_ID);
- }
-
-}
\ No newline at end of file
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/SingleLogoutProfileConfiguration.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/SingleLogoutProfileConfiguration.java
deleted file mode 100644
index 4df4d22..0000000
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/SingleLogoutProfileConfiguration.java
+++ /dev/null
@@ -1,194 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.saml.saml2.profile.config.impl;
-
-import java.util.Collection;
-import java.util.List;
-import java.util.function.Function;
-import java.util.function.Predicate;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.logic.NoConfidentialityMessageChannelPredicate;
-import org.opensaml.profile.logic.NoIntegrityMessageChannelPredicate;
-import org.opensaml.saml.ext.saml2aslo.Asynchronous;
-import org.opensaml.saml.saml2.core.NameID;
-import org.opensaml.saml.saml2.core.NameIDType;
-
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.logic.PredicateSupport;
-import net.shibboleth.shared.primitive.StringSupport;
-
-/** Configuration support for SP SAML 2.0 Single Logout. */
-public class SingleLogoutProfileConfiguration extends AbstractSAML2ArtifactConsumerProfileConfiguration
- implements net.shibboleth.sp.saml.saml2.profile.config.SingleLogoutProfileConfiguration {
-
- /** Predicate used to determine if SOAP-based requests should be signed. */
- @Nonnull private Predicate<MessageContext> signSOAPRequestsPredicate;
-
- /** Predicate used to determine if SOAP-based requests should use client TLS. */
- @Nonnull private Predicate<MessageContext> clientTLSSOAPRequestsPredicate;
-
- /** Predicate used to determine whether requests should carry the {@link Asynchronous} extension. */
- @Nonnull private Predicate<ProfileRequestContext> asynchronousPredicate;
-
- /** Lookup function to supply qualifiedNameIDFormats property. */
- @Nonnull private Function<ProfileRequestContext,Collection<String>> qualifiedNameIDFormatsLookupStrategy;
-
- /** Constructor. */
- public SingleLogoutProfileConfiguration() {
- this(PROFILE_ID);
- }
-
- /**
- * Constructor.
- *
- * @param profileId unique ID for this profile
- */
- protected SingleLogoutProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
- super(profileId);
- setSignRequestsPredicate(new NoIntegrityMessageChannelPredicate());
- setSignResponsesPredicate(new NoIntegrityMessageChannelPredicate());
- setEncryptNameIDsPredicate(new NoConfidentialityMessageChannelPredicate());
-
- signSOAPRequestsPredicate = new org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate();
- clientTLSSOAPRequestsPredicate = new org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate().negate();
-
- asynchronousPredicate = PredicateSupport.alwaysTrue();
-
- qualifiedNameIDFormatsLookupStrategy = FunctionSupport.constant(null);
- }
-
- /** {@inheritDoc} */
- public boolean isSignSOAPRequests(@Nullable final MessageContext messageContext) {
- return signSOAPRequestsPredicate.test(messageContext);
- }
-
- /**
- * Set whether SOAP-based requests should be signed.
- *
- * @param flag flag to set
- */
- public void setSignSOAPRequests(final boolean flag) {
- signSOAPRequestsPredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set the predicate used to determine if SOAP-based requests should be signed.
- *
- * @param predicate the predicate
- */
- public void setSignSOAPRequestsPredicate(@Nonnull final Predicate<MessageContext> predicate) {
- signSOAPRequestsPredicate = Constraint.isNotNull(predicate,
- "Predicate used to determine SOAP-based signing cannot be null");
- }
-
- /** {@inheritDoc} */
- public boolean isClientTLSSOAPRequests(@Nullable final MessageContext messageContext) {
- return clientTLSSOAPRequestsPredicate.test(messageContext);
- }
-
- /**
- * Set whether SOAP-based requests should use client TLS.
- *
- * @param flag flag to set
- */
- public void setClientTLSSOAPRequests(final boolean flag) {
- clientTLSSOAPRequestsPredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set the predicate used to determine if SOAP-based requests should use client TLS.
- *
- * @param predicate the predicate
- */
- public void setClientTLSSOAPRequestsPredicate(@Nonnull final Predicate<MessageContext> predicate) {
- clientTLSSOAPRequestsPredicate = Constraint.isNotNull(predicate,
- "Predicate used to determine SOAP-based client TLS use cannot be null");
- }
-
- /** {@inheritDoc} */
- public boolean isAsynchronous(@Nullable final ProfileRequestContext profileRequestContext) {
- return asynchronousPredicate.test(profileRequestContext);
- }
-
- /**
- * Set whether to include the {@link Asynchronous} extension in requests.
- *
- * @param flag flag to set
- */
- public void setAsynchronous(final boolean flag) {
- asynchronousPredicate = PredicateSupport.constant(flag);
- }
-
- /**
- * Set a condition to determine whether to include the {@link Asynchronous} extension in requests.
- *
- * @param condition condition set set
- */
- public void setAsynchronousPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
- asynchronousPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nonnull @NonnullElements @NotLive public Collection<String> getQualifiedNameIDFormats(
- @Nullable final ProfileRequestContext profileRequestContext) {
- final Collection<String> formats = qualifiedNameIDFormatsLookupStrategy.apply(profileRequestContext);
- if (formats != null) {
- return CollectionSupport.copyToList(formats);
- }
- return CollectionSupport.emptyList();
- }
-
- /**
- * Set a collection of {@link NameID} Format values for which the use of the NameQualifier and
- * SPNameQualifier attributes is defined to allow default/implicit values derived from the
- * asserting and relying parties.
- *
- * <p>In the core standard, only the {@link NameIDType#PERSISTENT} and {@link NameIDType#TRANSIENT}
- * Formats are defined in this manner. This setting identifies <strong>additional</strong> Formats
- * that should be handled in this way.</p>
- *
- * @param formats additional Formats for which defaulting of qualifiers is permissable
- */
- public void setQualifiedNameIDFormats(@Nullable @NonnullElements final Collection<String> formats) {
- if (formats == null || formats.isEmpty()) {
- qualifiedNameIDFormatsLookupStrategy = FunctionSupport.constant(null);
- } else {
- qualifiedNameIDFormatsLookupStrategy =
- FunctionSupport.constant(List.copyOf(StringSupport.normalizeStringCollection(formats)));
- }
- }
-
- /**
- * Set a lookup strategy for the Format values for which the use of the NameQualifier and SPNameQualifier
- * attributes is defined to allow default/implicit values derived from the asserting and relying parties.
- *
- * @param strategy lookup strategy
- */
- public void setQualifiedNameIDFormatsLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
- qualifiedNameIDFormatsLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
- }
-
-}
\ No newline at end of file
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/package-info.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/package-info.java
deleted file mode 100644
index 5b08f92..0000000
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/package-info.java
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * SAML 2.0 profile configuration classes.
- */
-package net.shibboleth.sp.saml.saml2.profile.config.impl;
\ No newline at end of file
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/AddAuthnRequest.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/AddAuthnRequest.java
deleted file mode 100644
index ef5ad74..0000000
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/AddAuthnRequest.java
+++ /dev/null
@@ -1,569 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.saml.saml2.profile.impl;
-
-import java.time.Instant;
-import java.util.Collection;
-import java.util.List;
-import java.util.function.Function;
-import java.util.stream.Collectors;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.profile.IdPEventIds;
-import net.shibboleth.profile.config.navigate.IdentifierGenerationStrategyLookupFunction;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.collection.CollectionSupport;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.security.IdentifierGenerationStrategy;
-import net.shibboleth.sp.ddf.DDF;
-import net.shibboleth.sp.profile.AbstractApplicationAction;
-import net.shibboleth.sp.profile.InitiatorConstants;
-import net.shibboleth.sp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
-
-import org.opensaml.core.xml.XMLObjectBuilderFactory;
-import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
-import org.opensaml.core.xml.io.MarshallingException;
-import org.opensaml.core.xml.io.UnmarshallingException;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.SAMLObjectBuilder;
-import org.opensaml.saml.common.SAMLVersion;
-import org.opensaml.saml.ext.reqattr.RequestedAttributes;
-import org.opensaml.saml.saml2.core.AuthnContextClassRef;
-import org.opensaml.saml.saml2.core.AuthnContextComparisonTypeEnumeration;
-import org.opensaml.saml.saml2.core.AuthnRequest;
-import org.opensaml.saml.saml2.core.Extensions;
-import org.opensaml.saml.saml2.core.IDPEntry;
-import org.opensaml.saml.saml2.core.IDPList;
-import org.opensaml.saml.saml2.core.Issuer;
-import org.opensaml.saml.saml2.core.NameID;
-import org.opensaml.saml.saml2.core.NameIDPolicy;
-import org.opensaml.saml.saml2.core.RequestedAuthnContext;
-import org.opensaml.saml.saml2.core.Scoping;
-import org.opensaml.saml.saml2.core.Subject;
-import org.opensaml.saml.saml2.metadata.NameIDFormat;
-import org.opensaml.saml.saml2.metadata.RequestedAttribute;
-import org.slf4j.Logger;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Action that creates an {@link AuthnRequest} and sets it as the message returned by
- * {@link ProfileRequestContext#getOutboundMessageContext()}.
- *
- * <p>If an issuer value is returned via a lookup strategy, then it's set as the Issuer of the message.</p>
- *
- * <p>Various other values are derived from the active configuration such as {@link RequestedAuthnContext},
- * {@link NameIDPolicy}, and {@link Scoping}. This process is much more complex than the IdP, as it requires
- * marrying together inputs from the agent against the profile configuration, including enforcing limits
- * on what the agent can override/supply.</p>
- *
- * @event {@link EventIds#PROCEED_EVENT_ID}
- * @event {@link EventIds#INVALID_MESSAGE}
- * @event {@link EventIds#INVALID_MSG_CTX}
- * @event {@link EventIds#INVALID_PROFILE_CTX}
- * @event {@link IdPEventIds#INVALID_PROFILE_CONFIG}
- *
- * @post ProfileRequestContext.getOutboundMessageContext().getMessage() != null
- */
-public class AddAuthnRequest extends AbstractApplicationAction {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(AddAuthnRequest.class);
-
- /** Overwrite an existing message? */
- private boolean overwriteExisting;
-
- /** Controls whether to include {@link Scoping} element. */
- private boolean includeScoping;
-
- /** Strategy used to locate {@link RelyingPartyContext} if required. */
- @Nullable private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
-
- /** Strategy used to locate the {@link IdentifierGenerationStrategy} to use. */
- @Nonnull private Function<ProfileRequestContext,IdentifierGenerationStrategy> idGeneratorLookupStrategy;
-
- /** Strategy used to obtain the request issuer value. */
- @Nullable private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /** Optional strategy to populate request with a {@link NameID}. */
- @Nullable private Function<ProfileRequestContext,NameID> nameIDLookupStrategy;
-
- /** The generator to use. */
- @NonnullBeforeExec private IdentifierGenerationStrategy idGenerator;
-
- /** Applicable profile configuration. */
- @NonnullBeforeExec private BrowserSSOProfileConfiguration profileConfiguration;
-
- /** Input message from agent. */
- @NonnullBeforeExec private DDF input;
-
- /** EntityID to populate into Issuer element. */
- @Nullable private String issuerId;
-
- /** Constructor. */
- public AddAuthnRequest() {
- // Default strategy is a 16-byte secure random source.
- idGeneratorLookupStrategy = new IdentifierGenerationStrategyLookupFunction();
-
- relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
- }
-
- /**
- * Set whether to overwrite an existing message.
- *
- * @param flag flag to set
- */
- public void setOverwriteExisting(final boolean flag) {
- checkSetterPreconditions();
- overwriteExisting = flag;
- }
-
- /**
- * Set whether to include {@link Scoping} in request carrying a known entityID
- * in an {@link IDPList}.
- *
- * <p>Defaults to false.</p>
- *
- * @param flag flag to set
- */
- public void setIncludeScoping(final boolean flag) {
- checkSetterPreconditions();
- includeScoping = true;
- }
-
- /**
- * Set lookup strategy to locate {@link RelyingPartyContext}, only relevant when
- * also including {@link Scoping} element.
- *
- * @param strategy lookup strategy
- */
- public void setRelyingPartyContextLookupStrategy(
- @Nullable final Function<ProfileRequestContext,RelyingPartyContext> strategy) {
- checkSetterPreconditions();
- relyingPartyContextLookupStrategy = strategy;
- }
-
- /**
- * Set the strategy used to locate the {@link IdentifierGenerationStrategy} to use.
- *
- * @param strategy lookup strategy
- */
- public void setIdentifierGeneratorLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,IdentifierGenerationStrategy> strategy) {
- checkSetterPreconditions();
- idGeneratorLookupStrategy =
- Constraint.isNotNull(strategy, "IdentifierGenerationStrategy lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to locate the issuer value to use.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nullable final Function<ProfileRequestContext,String> strategy) {
- checkSetterPreconditions();
- issuerLookupStrategy = strategy;
- }
-
- /**
- * Set optional strategy to derive a {@link NameID} to populate into the {@link AuthnRequest}'s
- * {@link Subject} element.
- *
- * @param strategy lookup strategy
- */
- public void setNameIDLookupStrategy(@Nullable final Function<ProfileRequestContext,NameID> strategy) {
- checkSetterPreconditions();
- nameIDLookupStrategy = strategy;
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- input = ensureAgentRequestContext().getInput();
- if (input == null) {
- log.error("{} No input message", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
- return false;
- }
-
- final RelyingPartyContext rpCtx = profileRequestContext.getSubcontext(RelyingPartyContext.class);
- if (rpCtx != null && rpCtx.getProfileConfig() instanceof BrowserSSOProfileConfiguration sso) {
- profileConfiguration = sso;
- }
- if (profileConfiguration == null) {
- log.error("{} BrowserSSOProfileConfiguration not found", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_PROFILE_CONFIG);
- return false;
- }
-
- final MessageContext outboundMessageCtx = profileRequestContext.getOutboundMessageContext();
- if (outboundMessageCtx == null) {
- log.debug("{} No outbound message context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- } else if (!overwriteExisting && outboundMessageCtx.getMessage() != null) {
- log.debug("{} Outbound message context already contains a message", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
-
- idGenerator = idGeneratorLookupStrategy.apply(profileRequestContext);
- if (idGenerator == null) {
- log.debug("{} No identifier generation strategy", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- if (issuerLookupStrategy != null) {
- issuerId = issuerLookupStrategy.apply(profileRequestContext);
- }
-
- outboundMessageCtx.setMessage(null);
-
- return true;
- }
-
-// Checkstyle: MethodLength OFF
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- final XMLObjectBuilderFactory bf = XMLObjectProviderRegistrySupport.getBuilderFactory();
- final SAMLObjectBuilder<AuthnRequest> requestBuilder =
- (SAMLObjectBuilder<AuthnRequest>) bf.<AuthnRequest>ensureBuilder(
- AuthnRequest.DEFAULT_ELEMENT_NAME);
- final SAMLObjectBuilder<NameIDPolicy> nipBuilder =
- (SAMLObjectBuilder<NameIDPolicy>) bf.<NameIDPolicy>ensureBuilder(
- NameIDPolicy.DEFAULT_ELEMENT_NAME);
-
- final AuthnRequest object = requestBuilder.buildObject();
- object.setID(idGenerator.generateIdentifier());
- object.setIssueInstant(Instant.now());
- object.setVersion(SAMLVersion.VERSION_20);
-
- // Response URL always comes from agent.
- object.setAssertionConsumerServiceURL(input.getmember(InitiatorConstants.RESPONSE_URL).string());
- // Protocol binding always comes from config, may be null.
- object.setProtocolBinding(profileConfiguration.getResponseBinding(profileRequestContext));
-
- if (issuerId != null) {
- log.debug("{} Setting Issuer to {}", getLogPrefix(), issuerId);
- final SAMLObjectBuilder<Issuer> issuerBuilder =
- (SAMLObjectBuilder<Issuer>) bf.<Issuer>ensureBuilder(Issuer.DEFAULT_ELEMENT_NAME);
- final Issuer issuer = issuerBuilder.buildObject();
- issuer.setValue(issuerId);
- object.setIssuer(issuer);
- } else {
- log.debug("{} No issuer value available, leaving Issuer unset", getLogPrefix());
- }
-
- Integer index = input.getmember(AuthnRequest.ATTRIBUTE_CONSUMING_SERVICE_INDEX_ATTRIB_NAME).integer();
- if (index == null) {
- index = profileConfiguration.getAttributeIndex(profileRequestContext);
- }
- if (index != null) {
- log.debug("{} Setting AttributeConsumingServiceIndex to '{}'", getLogPrefix(), index);
- object.setAttributeConsumingServiceIndex(index);
- }
-
- setForceAuthn(profileRequestContext, object);
-
- final Integer passive = input.getmember(AuthnRequest.IS_PASSIVE_ATTRIB_NAME).integer();
- if (passive != null && passive == 1) {
- log.debug("{} Setting IsPassive", getLogPrefix());
- object.setIsPassive(true);
- }
-
- object.setNameIDPolicy(buildNameIDPolicy(profileRequestContext, nipBuilder));
- object.setRequestedAuthnContext(buildRequestedAuthnContext(profileRequestContext));
- object.setSubject(buildSubject(profileRequestContext));
- object.setExtensions(buildExtensions(profileRequestContext));
-
- if (includeScoping) {
- object.setScoping(buildScoping(profileRequestContext));
- }
-
- profileRequestContext.ensureOutboundMessageContext().setMessage(object);
-
- log.info("{} Generated AuthnRequest with ID {} from {}", getLogPrefix(), object.getID(), issuerId);
- }
-
- /**
- * Set ForceAuthn appropriately.
- *
- * @param profileRequestContext profile request context
- * @param authnRequest request object
- */
- private void setForceAuthn(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final AuthnRequest authnRequest) {
-
- final Integer forceAuthn = input.getmember(AuthnRequest.FORCE_AUTHN_ATTRIB_NAME).integer();
- if (forceAuthn != null) {
- if (profileConfiguration.isFeatureDisallowed(profileRequestContext,
- BrowserSSOProfileConfiguration.FEATURE_FORCEAUTHN)) {
- log.warn("{} Agent disallowed from overriding ForceAuthn", getLogPrefix());
- } else if (forceAuthn == 1) {
- log.debug("{} Setting ForceAuthn", getLogPrefix());
- authnRequest.setForceAuthn(true);
- return;
- }
- }
-
- if (profileConfiguration.isForceAuthn(profileRequestContext)) {
- log.debug("{} Setting ForceAuthn", getLogPrefix());
- authnRequest.setForceAuthn(true);
- }
- }
-
- /**
- * Build {@link NameIDPolicy} object for request.
- *
- * @param profileRequestContext profile request context
- * @param builder object builder
- *
- * @return policy object
- */
- @Nonnull NameIDPolicy buildNameIDPolicy(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final SAMLObjectBuilder<NameIDPolicy> builder) {
-
- final NameIDPolicy nip = builder.buildObject();
- nip.setAllowCreate(true);
-
- String format = input.getmember(NameIDFormat.DEFAULT_ELEMENT_LOCAL_NAME).string();
- if (format != null && profileConfiguration.isFeatureDisallowed(profileRequestContext,
- BrowserSSOProfileConfiguration.FEATURE_NAMEIDFORMAT)) {
- log.warn("{} Agent disallowed from overriding NameIDPolicy Format", getLogPrefix());
- format = null;
- }
-
- if (format == null) {
- format = profileConfiguration.getNameIDFormat(profileRequestContext);
- }
-
- if (format != null) {
- log.debug("{} Setting NameIDPolicy Format to '{}'", getLogPrefix(), format);
- nip.setFormat(format);
- }
-
- String qualifier = input.getmember(NameIDPolicy.SP_NAME_QUALIFIER_ATTRIB_NAME).string();
- if (qualifier != null) {
- if (profileConfiguration.isFeatureDisallowed(profileRequestContext,
- BrowserSSOProfileConfiguration.FEATURE_SPNAMEQUALIFIER)) {
- log.warn("{} Agent disallowed from overriding NameIDPolicy SPNameQualifier", getLogPrefix());
- }
- qualifier = null;
- }
-
- if (qualifier == null) {
- qualifier = profileConfiguration.getSPNameQualifier(profileRequestContext);
- }
-
- if (qualifier != null) {
- log.debug("{} Setting NameIDPolicy SPNameQualifier to '{}'", getLogPrefix(), qualifier);
- nip.setSPNameQualifier(qualifier);
- }
-
- return nip;
- }
-
- /**
- * Build a {@link RequestedAuthnContext} if warranted.
- *
- * @param profileRequestContext current profile request context
- *
- * @return the object to include in the request, or null
- */
- @Nullable private RequestedAuthnContext buildRequestedAuthnContext(
- @Nullable final ProfileRequestContext profileRequestContext) {
-
- List<String> classrefs = input.getmember(AuthnContextClassRef.DEFAULT_ELEMENT_LOCAL_NAME).asList()
- .stream()
- .map(DDF::string)
- .collect(CollectionSupport.nonnullCollector(Collectors.toUnmodifiableList())).get();
- if (!classrefs.isEmpty() && profileConfiguration.isFeatureDisallowed(profileRequestContext,
- BrowserSSOProfileConfiguration.FEATURE_AUTHNCONTEXT)) {
- log.warn("{} Agent disallowed from overriding RequestedAuthnContext", getLogPrefix());
- classrefs = CollectionSupport.emptyList();
- }
-
- if (classrefs.isEmpty()) {
- profileConfiguration.getAuthnContextClassRefs(profileRequestContext);
- }
-
- if (classrefs.isEmpty()) {
- return null;
- }
-
- log.debug("{} Setting requested AuthnContextClassRef(s) {}", getLogPrefix(), classrefs);
-
- final XMLObjectBuilderFactory bf = XMLObjectProviderRegistrySupport.getBuilderFactory();
-
- final SAMLObjectBuilder<RequestedAuthnContext> builder =
- (SAMLObjectBuilder<RequestedAuthnContext>) bf.<RequestedAuthnContext>ensureBuilder(
- RequestedAuthnContext.DEFAULT_ELEMENT_NAME);
-
- final SAMLObjectBuilder<AuthnContextClassRef> acBuilder =
- (SAMLObjectBuilder<AuthnContextClassRef>) bf.<AuthnContextClassRef>ensureBuilder(
- AuthnContextClassRef.DEFAULT_ELEMENT_NAME);
-
- final RequestedAuthnContext rac = builder.buildObject();
-
- classrefs.forEach(ref -> {
- final AuthnContextClassRef obj = acBuilder.buildObject();
- obj.setURI(ref);
- rac.getAuthnContextClassRefs().add(obj);
- });
-
- String opstring = input.getmember("AuthnContextComparison").string();
- if (opstring != null && profileConfiguration.isFeatureDisallowed(profileRequestContext,
- BrowserSSOProfileConfiguration.FEATURE_AUTHNCONTEXT)) {
- log.warn("{} Agent disallowed from overriding RequestedAuthnContext operator", getLogPrefix());
- opstring = null;
- }
-
- final AuthnContextComparisonTypeEnumeration operator;
- if (opstring != null) {
- try {
- operator = AuthnContextComparisonTypeEnumeration.valueOf(opstring.toUpperCase());
- } catch (final IllegalArgumentException e) {
- log.warn("{} Error translating RequestedAuthnContext operator string", getLogPrefix(), e);
- return null;
- }
- } else {
- operator = profileConfiguration.getAuthnContextComparison(profileRequestContext);
- }
- if (operator != null) {
- log.debug("{} Setting RequestedAuthnContext operator to {}", getLogPrefix(), operator);
- rac.setComparison(operator);
- }
-
- return rac;
- }
-// Checkstyle: MethodLength ON
-
- /**
- * Build a {@link Subject} element if necessary.
- *
- * @param profileRequestContext profile request context
- *
- * @return the {@link Subject} element to include
- */
- @Nullable private Subject buildSubject(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- final NameID nameID = nameIDLookupStrategy != null
- ? nameIDLookupStrategy.apply(profileRequestContext) : null;
- if (nameID == null) {
- return null;
- }
-
- final XMLObjectBuilderFactory bf = XMLObjectProviderRegistrySupport.getBuilderFactory();
- final SAMLObjectBuilder<Subject> subjectBuilder =
- (SAMLObjectBuilder<Subject>) bf.<Subject>ensureBuilder(Subject.DEFAULT_ELEMENT_NAME);
-
- final Subject subject = subjectBuilder.buildObject();
- subject.setNameID(nameID);
-
- log.debug("{} Populating request with NameID '{}' and Format '{}'", getLogPrefix(),
- nameID.getValue(), nameID.getFormat());
-
- return subject;
- }
-
- /**
- * Build a {@link Scoping} element, decrementing the proxy count if set.
- *
- * @param profileRequestContext current profile request context
- *
- * @return populated {@link Scoping}
- */
- @Nullable private Scoping buildScoping(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- final RelyingPartyContext rpContext = relyingPartyContextLookupStrategy != null ?
- relyingPartyContextLookupStrategy.apply(profileRequestContext) : null;
- final String entityID = rpContext != null ? rpContext.getRelyingPartyId() : null;
- if (entityID == null) {
- return null;
- }
-
- final XMLObjectBuilderFactory bf = XMLObjectProviderRegistrySupport.getBuilderFactory();
-
- final SAMLObjectBuilder<Scoping> scopingBuilder =
- (SAMLObjectBuilder<Scoping>) bf.<Scoping>ensureBuilder(Scoping.DEFAULT_ELEMENT_NAME);
- final SAMLObjectBuilder<IDPList> idpListBuilder =
- (SAMLObjectBuilder<IDPList>) bf.<IDPList>ensureBuilder(IDPList.DEFAULT_ELEMENT_NAME);
- final SAMLObjectBuilder<IDPEntry> idpBuilder =
- (SAMLObjectBuilder<IDPEntry>) bf.<IDPEntry>ensureBuilder(IDPEntry.DEFAULT_ELEMENT_NAME);
-
- final IDPEntry entry = idpBuilder.buildObject();
- entry.setProviderID(entityID);
-
- final IDPList idps = idpListBuilder.buildObject();
- idps.getIDPEntrys().add(entry);
-
- final Scoping scoping = scopingBuilder.buildObject();
- scoping.setIDPList(idps);
-
- return scoping;
- }
-
- /**
- * Build {@link RequestedAttributes} extension if required.
- *
- * @param profileRequestContext current profile request context
- *
- * @return extension or null
- */
- @Nullable private Extensions buildExtensions(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- assert profileConfiguration!=null;
- final Collection<RequestedAttribute> attrs = profileConfiguration.getRequestedAttributes(profileRequestContext);
- if (!attrs.isEmpty()) {
- final XMLObjectBuilderFactory bf = XMLObjectProviderRegistrySupport.getBuilderFactory();
- final SAMLObjectBuilder<Extensions> extBuilder =
- (SAMLObjectBuilder<Extensions>) bf.<Extensions>ensureBuilder(
- Extensions.DEFAULT_ELEMENT_NAME);
- final SAMLObjectBuilder<RequestedAttributes> reqExtBuilder =
- (SAMLObjectBuilder<RequestedAttributes>) bf.<RequestedAttributes>ensureBuilder(
- RequestedAttributes.DEFAULT_ELEMENT_NAME);
- final RequestedAttributes reqExt = reqExtBuilder.buildObject();
- attrs.forEach(attr -> {
- try {
- assert attr != null;
- reqExt.getRequestedAttributes().add(XMLObjectSupport.cloneXMLObject(attr));
- } catch (final MarshallingException|UnmarshallingException e) {
- log.error("{} Error cloning RequestedAttribute from profile configuration", getLogPrefix(), e);
- }
- });
- final Extensions ext = extBuilder.buildObject();
- ext.getUnknownXMLObjects().add(reqExt);
- return ext;
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/package-info.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/package-info.java
deleted file mode 100644
index f8d7d8e..0000000
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/impl/package-info.java
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Profile actions and classes for SAML 2.0 profile flows.
- */
-package net.shibboleth.sp.saml.saml2.profile.impl;
\ No newline at end of file
diff --git a/sp-saml-impl/src/test/java/net/shibboleth/sp/saml/saml2/profile/config/impl/AbstractSAML2ProfileConfigurationTest.java b/sp-saml-impl/src/test/java/net/shibboleth/sp/saml/saml2/profile/config/impl/AbstractSAML2ProfileConfigurationTest.java
deleted file mode 100644
index 8cc1b1b..0000000
--- a/sp-saml-impl/src/test/java/net/shibboleth/sp/saml/saml2/profile/config/impl/AbstractSAML2ProfileConfigurationTest.java
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.saml.saml2.profile.config.impl;
-
-import net.shibboleth.shared.logic.PredicateSupport;
-
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/** Unit test for {@link AbstractSAML2ProfileConfiguration}. */
- at SuppressWarnings("javadoc")
-public class AbstractSAML2ProfileConfigurationTest {
-
- @Test
- public void testEncryptionOptional(){
- final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
- Assert.assertFalse(config.isEncryptionOptional(null));
-
- config.setEncryptionOptional(true);
- Assert.assertTrue(config.isEncryptionOptional(null));
- }
-
- @Test
- public void testIndirectEncryptionOptional(){
- final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
-
- config.setEncryptionOptionalPredicate(PredicateSupport.alwaysTrue());
- Assert.assertTrue(config.isEncryptionOptional(null));
- }
-
- @Test public void testEncryptNameIDsPredicate() {
- final MockSAML2ProfileConfiguration config = new MockSAML2ProfileConfiguration();
-
- config.setEncryptNameIDs(true);
- Assert.assertTrue(config.isEncryptNameIDs(null));
- }
-
- /** Mock class for testing {@link AbstractSAML2ProfileConfiguration}. */
- private static class MockSAML2ProfileConfiguration extends AbstractSAML2ProfileConfiguration {
-
- /** Constructor. */
- public MockSAML2ProfileConfiguration() {
- super("mock");
- }
- }
-}
\ No newline at end of file
diff --git a/sp-saml-impl/src/test/java/net/shibboleth/sp/saml/saml2/profile/config/impl/BrowserSSOProfileConfigurationTest.java b/sp-saml-impl/src/test/java/net/shibboleth/sp/saml/saml2/profile/config/impl/BrowserSSOProfileConfigurationTest.java
deleted file mode 100644
index da854c3..0000000
--- a/sp-saml-impl/src/test/java/net/shibboleth/sp/saml/saml2/profile/config/impl/BrowserSSOProfileConfigurationTest.java
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.saml.saml2.profile.config.impl;
-
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.logic.FunctionSupport;
-
-import java.time.Duration;
-import java.util.Arrays;
-import java.util.HashSet;
-import java.util.Set;
-
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-
-/** Unit test for {@link BrowserSSOProfileConfiguration}. */
- at SuppressWarnings("javadoc")
-public class BrowserSSOProfileConfigurationTest {
-
- @Test
- public void testProfileId() {
- final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
- Assert.assertEquals(config.getId(), BrowserSSOProfileConfiguration.PROFILE_ID);
- }
-
- @Test public void testAssertionLifetime() {
- final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
- Assert.assertNull(config.getAssertionLifetime(null));
-
- config.setAssertionLifetime(Duration.ofMillis(100));
- Assert.assertEquals(config.getAssertionLifetime(null), Duration.ofMillis(100));
-
- try {
- config.setAssertionLifetime(Duration.ofMillis(-100));
- Assert.fail();
- } catch (ConstraintViolationException e) {
- // expected this
- }
- }
-
- @Test public void testIndirectAssertionLifetime() {
- final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
-
- config.setAssertionLifetimeLookupStrategy(FunctionSupport.constant(Duration.ofMillis(500)));
- Assert.assertEquals(config.getAssertionLifetime(null), Duration.ofMillis(500));
- }
-
- @Test public void testAssertionAudiences() {
- final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
- Assert.assertNotNull(config.getAssertionAudiences(null));
- Assert.assertTrue(config.getAssertionAudiences(null).isEmpty());
-
- config.setAssertionAudiences(Arrays.asList("", null, " foo"));
-
- final Set<String> audiences = config.getAssertionAudiences(null);
- Assert.assertNotNull(audiences);
- Assert.assertEquals(audiences.size(), 1);
- Assert.assertTrue(audiences.contains("foo"));
-
- try {
- audiences.add("bar");
- Assert.fail();
- } catch (UnsupportedOperationException e) {
- // expected this
- }
-
- config.setAssertionAudiences(null);
- Assert.assertNotNull(config.getAssertionAudiences(null));
- Assert.assertTrue(config.getAssertionAudiences(null).isEmpty());
- }
-
- @Test public void testIndirectAssertionAudiences() {
-final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
- final Set<String> audiences = new HashSet<>();
- audiences.add("foo");
- audiences.add("bar");
- config.setAssertionAudiencesLookupStrategy(FunctionSupport.constant(audiences));
- Assert.assertEquals(config.getAssertionAudiences(null), audiences);
- }
-
- @Test
- public void testNameIDFormat() {
- final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
- Assert.assertNull(config.getNameIDFormat(null));
-
- config.setNameIDFormat("foo");
- Assert.assertEquals(config.getNameIDFormat(null), "foo");
- }
-
- @Test
- public void testIndirectNameIDFormat() {
- final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
-
- config.setNameIDFormatLookupStrategy(FunctionSupport.constant("foo"));
- Assert.assertEquals(config.getNameIDFormat(null), "foo");
- }
-
- @Test
- public void testSPNameQualifier() {
- final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
- Assert.assertNull(config.getSPNameQualifier(null));
-
- config.setSPNameQualifier("foo");
- Assert.assertEquals(config.getSPNameQualifier(null), "foo");
- }
-
- @Test
- public void testIndirectSPNameQualifier() {
- final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
-
- config.setSPNameQualifierLookupStrategy(FunctionSupport.constant("foo"));
- Assert.assertEquals(config.getSPNameQualifier(null), "foo");
- }
-
- @Test
- public void testAttributeIndex() {
- final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
- Assert.assertNull(config.getAttributeIndex(null));
-
- config.setAttributeIndex(10);
- Assert.assertEquals(config.getAttributeIndex(null), 10);
- }
-
- @Test
- public void testIndirectAttributeIndex() {
- final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
-
- config.setAttributeIndexLookupStrategy(FunctionSupport.constant(10));
- Assert.assertEquals(config.getAttributeIndex(null), 10);
- }
-
- @Test
- public void testSignArtifactRequests() {
- final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
-
- config.setSignArtifactRequests(true);
- Assert.assertTrue(config.isSignArtifactRequests(null));
- }
-
- @Test
- public void testClientTLSArtifactRequests() {
- final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
-
- config.setClientTLSArtifactRequests(true);
- Assert.assertTrue(config.isClientTLSArtifactRequests(null));
- }
-
-
- @Test public void testProxyCount() {
- final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
- Assert.assertNull(config.getProxyCount(null));
-
- config.setProxyCount(1);
- Assert.assertEquals(config.getProxyCount(null), Integer.valueOf(1));
- }
-
- @Test public void testIndirectProxyCount() {
- final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
-
- config.setProxyCountLookupStrategy(FunctionSupport.constant(1));
- Assert.assertEquals(config.getProxyCount(null), Integer.valueOf(1));
- }
-
-}
\ No newline at end of file
diff --git a/sp-saml-impl/src/test/java/net/shibboleth/sp/saml/saml2/profile/config/impl/SingleLogoutProfileConfigurationTest.java b/sp-saml-impl/src/test/java/net/shibboleth/sp/saml/saml2/profile/config/impl/SingleLogoutProfileConfigurationTest.java
deleted file mode 100644
index a9d84b6..0000000
--- a/sp-saml-impl/src/test/java/net/shibboleth/sp/saml/saml2/profile/config/impl/SingleLogoutProfileConfigurationTest.java
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.saml.saml2.profile.config.impl;
-
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-import net.shibboleth.shared.logic.PredicateSupport;
-
-/** Unit test for {@link SingleLogoutProfileConfiguration}. */
- at SuppressWarnings("javadoc")
-public class SingleLogoutProfileConfigurationTest {
-
- @Test
- public void testProfileId() {
- final SingleLogoutProfileConfiguration config = new SingleLogoutProfileConfiguration();
- Assert.assertEquals(config.getId(), SingleLogoutProfileConfiguration.PROFILE_ID);
- }
-
- @Test
- public void testSignArtifactRequests() {
- final SingleLogoutProfileConfiguration config = new SingleLogoutProfileConfiguration();
-
- config.setSignArtifactRequests(true);
- Assert.assertTrue(config.isSignArtifactRequests(null));
- }
-
- @Test
- public void testClientTLSArtifactRequests() {
- final SingleLogoutProfileConfiguration config = new SingleLogoutProfileConfiguration();
-
- config.setClientTLSArtifactRequests(true);
- Assert.assertTrue(config.isClientTLSArtifactRequests(null));
- }
-
- @Test
- public void testAsynchronous() {
- final SingleLogoutProfileConfiguration config = new SingleLogoutProfileConfiguration();
- Assert.assertTrue(config.isAsynchronous(null));
-
- config.setAsynchronous(false);
- Assert.assertFalse(config.isAsynchronous(null));
- }
-
- @Test
- public void testIndirectAsynchronous() {
- final SingleLogoutProfileConfiguration config = new SingleLogoutProfileConfiguration();
-
- config.setAsynchronousPredicate(PredicateSupport.alwaysFalse());
- Assert.assertFalse(config.isAsynchronous(null));
- }
-
-}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list