[java-identity-provider] 16/28: IDP-2222 - Hook for username manipulation in extraction actions
Scott Cantor
cantor.2 at osu.edu
Wed Jan 31 14:52:02 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch dev/thymeleaf
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=05509b925f3353f3d81ceadc158d84ccb296fc20
commit 05509b925f3353f3d81ceadc158d84ccb296fc20
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jan 8 13:46:46 2024 -0500
IDP-2222 - Hook for username manipulation in extraction actions
https://shibboleth.atlassian.net/browse/IDP-2222
Not wiring up for now.
---
.../idp/authn/AbstractExtractionAction.java | 52 +++++++++++++++++++---
.../idp/authn/impl/ExtractRemoteUser.java | 6 +--
.../idp/authn/impl/ExtractUserAgentAddress.java | 2 +-
.../idp/authn/impl/ExtractUserAgentIdentifier.java | 3 +-
.../impl/ExtractUsernamePasswordFromBasicAuth.java | 3 +-
.../ExtractUsernamePasswordFromFormRequest.java | 2 +-
.../idp/authn/impl/PrePopulateUsername.java | 8 ++--
7 files changed, 60 insertions(+), 16 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractExtractionAction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractExtractionAction.java
index d734a1881..3b6598733 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractExtractionAction.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractExtractionAction.java
@@ -17,12 +17,14 @@ package net.shibboleth.idp.authn;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
+import java.util.function.BiFunction;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
@@ -55,6 +57,9 @@ public abstract class AbstractExtractionAction extends AbstractAuthenticationAct
/** Trim prior to transforms? */
private boolean trim;
+ /** Generic hook for remapping username. */
+ @Nullable private BiFunction<ProfileRequestContext,String,String> usernameRemappingStrategy;
+
/** Constructor. */
public AbstractExtractionAction() {
transforms = CollectionSupport.emptyList();
@@ -114,16 +119,52 @@ public abstract class AbstractExtractionAction extends AbstractAuthenticationAct
}
/**
- * Apply any configured regular expression replacements to an input value and return the result.
+ * Sets a general hook for remapping username.
+ *
+ * @param strategy username remapping strategy
+ *
+ * @since 5.1.0
+ */
+ public void setUsernameRemappingStrategy(@Nullable final BiFunction<ProfileRequestContext,String,String> strategy) {
+ checkSetterPreconditions();
+
+ usernameRemappingStrategy = strategy;
+ }
+
+ /**
+ * Apply any configured rules, regular expression replacements, or remapping strategy
+ * to an input value and return the result.
*
* @param input the input string
*
- * @return the result of applying the expressions
+ * @return the result of applying the rules
+ *
+ * @deprecated
*/
+ @Deprecated(since="5.1.0", forRemoval=true)
@Nullable @NotEmpty protected String applyTransforms(@Nullable final String input) {
+ // No deprecation warning due to legacy plugins unable to convert their calls.
+ return applyTransforms(null, input);
+ }
+
+// Checkstyle: CyclomaticComplexity OFF
+ /**
+ * Apply any configured rules, regular expression replacements, or remapping strategy
+ * to an input value and return the result.
+ *
+ * @param profileRequestContext profile request context
+ * @param input the input string
+ *
+ * @return the result of applying the rules
+ *
+ * @since 5.1.0
+ */
+ @Nullable @NotEmpty protected String applyTransforms(@Nullable final ProfileRequestContext profileRequestContext,
+ @Nullable final String input) {
if (input == null) {
- return null;
+ return usernameRemappingStrategy != null ?
+ usernameRemappingStrategy.apply(profileRequestContext, input) : null;
}
String s = input;
@@ -142,7 +183,7 @@ public abstract class AbstractExtractionAction extends AbstractAuthenticationAct
}
if (transforms.isEmpty()) {
- return s;
+ return usernameRemappingStrategy != null ? usernameRemappingStrategy.apply(profileRequestContext, s) : s;
}
for (final Pair<Pattern,String> p : transforms) {
@@ -156,7 +197,8 @@ public abstract class AbstractExtractionAction extends AbstractAuthenticationAct
}
}
- return s;
+ return usernameRemappingStrategy != null ? usernameRemappingStrategy.apply(profileRequestContext, s) : s;
}
+// Checkstyle: CyclomaticComplexity ON
}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractRemoteUser.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractRemoteUser.java
index 7d96ac509..534a4853b 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractRemoteUser.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractRemoteUser.java
@@ -125,7 +125,7 @@ public class ExtractRemoteUser extends AbstractExtractionAction {
if (username != null && !username.isEmpty()) {
log.debug("{} User identity extracted from REMOTE_USER: {}", getLogPrefix(), username);
authenticationContext.ensureSubcontext(UsernameContext.class).setUsername(
- applyTransforms(username));
+ applyTransforms(profileRequestContext, username));
return;
}
}
@@ -135,7 +135,7 @@ public class ExtractRemoteUser extends AbstractExtractionAction {
if (attr != null && !attr.toString().isEmpty()) {
log.debug("{} User identity extracted from attribute {}: {}", getLogPrefix(), s, attr);
authenticationContext.ensureSubcontext(UsernameContext.class).setUsername(
- applyTransforms(attr.toString()));
+ applyTransforms(profileRequestContext, attr.toString()));
return;
}
}
@@ -145,7 +145,7 @@ public class ExtractRemoteUser extends AbstractExtractionAction {
if (username != null && !username.isEmpty()) {
log.debug("{} User identity extracted from header {}: {}", getLogPrefix(), s, username);
authenticationContext.ensureSubcontext(UsernameContext.class).setUsername(
- applyTransforms(username));
+ applyTransforms(profileRequestContext, username));
return;
}
}
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentAddress.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentAddress.java
index 3dc2f56a6..424ac3c75 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentAddress.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentAddress.java
@@ -59,7 +59,7 @@ public class ExtractUserAgentAddress extends AbstractExtractionAction {
return;
}
- final String addressString = applyTransforms(HttpServletSupport.getRemoteAddr(request));
+ final String addressString = applyTransforms(profileRequestContext, HttpServletSupport.getRemoteAddr(request));
if (addressString == null || !InetAddresses.isInetAddress(addressString)) {
log.debug("{} User agent's address, {}, is not a valid IP address", getLogPrefix(), addressString);
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentIdentifier.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentIdentifier.java
index 8493efb74..e56464dd2 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentIdentifier.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUserAgentIdentifier.java
@@ -64,7 +64,8 @@ public class ExtractUserAgentIdentifier extends AbstractExtractionAction {
return;
}
- authenticationContext.ensureSubcontext(UserAgentContext.class).setIdentifier(applyTransforms(agent));
+ authenticationContext.ensureSubcontext(UserAgentContext.class).setIdentifier(
+ applyTransforms(profileRequestContext, agent));
}
}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromBasicAuth.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromBasicAuth.java
index df2b9b913..3c74fed79 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromBasicAuth.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromBasicAuth.java
@@ -86,7 +86,8 @@ public class ExtractUsernamePasswordFromBasicAuth extends AbstractExtractionActi
return;
}
- upCtx.setUsername(applyTransforms(decodedCredentials.getFirst())).setPassword(decodedCredentials.getSecond());
+ upCtx.setUsername(applyTransforms(profileRequestContext, decodedCredentials.getFirst()))
+ .setPassword(decodedCredentials.getSecond());
}
// CheckStyle: ReturnCount ON
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromFormRequest.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromFormRequest.java
index ff64d1f04..5a3bc7470 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromFormRequest.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromFormRequest.java
@@ -119,7 +119,7 @@ public class ExtractUsernamePasswordFromFormRequest extends AbstractExtractionAc
return;
}
- upCtx.setUsername(applyTransforms(username));
+ upCtx.setUsername(applyTransforms(profileRequestContext, username));
final String password = request.getParameter(passwordFieldName);
if (password == null || password.isEmpty()) {
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PrePopulateUsername.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PrePopulateUsername.java
index 40b181a45..eb88d118f 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PrePopulateUsername.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PrePopulateUsername.java
@@ -184,7 +184,7 @@ public class PrePopulateUsername extends AbstractExtractionAction {
usernameContext.setUsername(null);
usernameContext.setPassword(null);
- String username = getUsernameFromForm(authenticationContext);
+ String username = getUsernameFromForm(profileRequestContext);
if (username != null && !username.isEmpty()) {
log.debug("{} Populating username '{}' from form submission into UsernamePasswordContext",
getLogPrefix(), username);
@@ -212,15 +212,15 @@ public class PrePopulateUsername extends AbstractExtractionAction {
*
* <p>Also processes do-not-cache instruction.</p>
*
- * @param authenticationContext authentication context
+ * @param profileRequestContext profile request context
*
* @return submitted username, after applying any configured transforms
*/
- @Nullable private String getUsernameFromForm(@Nonnull final AuthenticationContext authenticationContext) {
+ @Nullable private String getUsernameFromForm(@Nonnull final ProfileRequestContext profileRequestContext) {
final HttpServletRequest request = getHttpServletRequest();
if (request != null) {
- return applyTransforms(request.getParameter(usernameFieldName));
+ return applyTransforms(profileRequestContext, request.getParameter(usernameFieldName));
}
return null;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list