[java-plugin-shibd] branch main updated: Continue work on master session initiator flow and supporting changes.
Scott Cantor
cantor.2 at osu.edu
Tue Jul 9 14:57:37 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=6bf637b36c0e92cb491f66a056cb908053c4e8ae
The following commit(s) were added to refs/heads/main by this push:
new 6bf637b Continue work on master session initiator flow and supporting changes.
6bf637b is described below
commit 6bf637b36c0e92cb491f66a056cb908053c4e8ae
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jul 9 10:57:33 2024 -0400
Continue work on master session initiator flow and supporting changes.
---
.../idp/flows/sp/application/application-beans.xml | 8 ++
.../session-initiator/session-initiator-beans.xml | 3 +
.../session-initiator/session-initiator-flow.xml | 1 +
.../net/shibboleth/idp/module/conf/sp/agents.xml | 4 +-
.../shibboleth/idp/module/conf/sp/test-agents.xml | 4 +-
.../main/java/net/shibboleth/sp/Application.java | 10 ++
.../net/shibboleth/sp/impl/BasicApplication.java | 36 +++++++
.../impl/InitializeRelyingPartyContext.java | 116 +++++++++++++++++++++
.../sp/profile/impl/ResolveApplication.java | 1 +
.../sp/profile/impl/BaseAgplicationActionTest.java | 42 ++++++++
.../impl/InitializeRelyingPartyContextTest.java | 101 ++++++++++++++++++
11 files changed, 324 insertions(+), 2 deletions(-)
diff --git a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/application/application-beans.xml b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/application/application-beans.xml
index d201acc..e51c356 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/application/application-beans.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/application/application-beans.xml
@@ -9,4 +9,12 @@
<bean id="ResolveApplication" class="net.shibboleth.sp.profile.impl.ResolveApplication" scope="prototype" />
+ <!-- Used by most child flows to get at tunneled/wrapped servlet interfaces. -->
+
+ <bean id="shibboleth.RemotedHttpServletRequestSupplier"
+ class="net.shibboleth.sp.messaging.impl.RemotedHttpServletRequestSupplier" scope="prototype" />
+
+ <bean id="shibboleth.RemotedHttpServletResponseSupplier"
+ class="net.shibboleth.sp.messaging.impl.RemotedHttpServletResponseSupplier" scope="prototype" />
+
</beans>
diff --git a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/session-initiator/session-initiator-beans.xml b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/session-initiator/session-initiator-beans.xml
index 5a13abe..3611a02 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/session-initiator/session-initiator-beans.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/session-initiator/session-initiator-beans.xml
@@ -10,4 +10,7 @@
<bean id="shibboleth.sp.profileId" class="java.lang.String" c:_0="http://shibboleth.net/ns/profiles/sp/session-initiator" />
<bean id="shibboleth.sp.loggingId" class="java.lang.String" c:_0="%{idp.service.logging.sp:SPAgent}" />
+ <bean id="InitializeRelyingPartyContext"
+ class="net.shibboleth.sp.profile.impl.InitializeRelyingPartyContext" scope="prototype" />
+
</beans>
diff --git a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/session-initiator/session-initiator-flow.xml b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/session-initiator/session-initiator-flow.xml
index de61b5a..9b21c44 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/session-initiator/session-initiator-flow.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/session-initiator/session-initiator-flow.xml
@@ -16,6 +16,7 @@
<on-entry>
<evaluate expression="opensamlProfileRequestContext.ensureSubcontext(T(net.shibboleth.sp.context.AgentRequestContext)).getApplication().getSessionInitiators(opensamlProfileRequestContext).iterator()" result="flowScope.SessionInitiatorIterator" />
</on-entry>
+ <evaluate expression="InitializeRelyingPartyContext" />
<evaluate expression="'proceed'" />
<!-- Branch to child flow for actual work. -->
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
index cdf25ef..e04cfc9 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
@@ -24,7 +24,9 @@
<bean id="sp.example.org" parent="shibboleth.Agent">
<property name="applications">
<set>
- <bean p:id="default" parent="shibboleth.Application" p:issuer="https://sp.example.org"/>
+ <bean p:id="default" parent="shibboleth.Application"
+ p:issuer="https://sp.example.org"
+ p:authenticatingAuthority="https://idp.example.org" />
</set>
</property>
</bean>
diff --git a/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/test-agents.xml b/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/test-agents.xml
index aa95a7a..f556b2a 100644
--- a/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/test-agents.xml
+++ b/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/test-agents.xml
@@ -16,10 +16,12 @@
<property name="applications">
<set>
<bean p:id="default" parent="shibboleth.Application"
- p:issuer="https://testsp.example.org"/>
+ p:issuer="https://testsp.example.org"
+ p:authenticatingAuthority="https://idp.example.org" />
<bean p:id="no-initiators" parent="shibboleth.Application"
p:issuer="https://testsp.example.org"
+ p:authenticatingAuthority="https://idp.example.org"
p:sessionInitiators="#{{}}" />
</set>
</property>
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/Application.java b/sp-server-api/src/main/java/net/shibboleth/sp/Application.java
index e694c8c..c646207 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/Application.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/Application.java
@@ -60,6 +60,16 @@ public interface Application extends RelyingPartyConfigurationResolver {
*/
@Nullable @NotEmpty String getIssuer(@Nonnull final ProfileRequestContext profileRequestContext);
+ /**
+ * Gets the identifier of the authenticating authority (IdP, OP, etc.) to use for this application
+ * if not overridden.
+ *
+ * @param profileRequestContext current profile request context
+ *
+ * @return authenticating authority
+ */
+ @Nullable @NotEmpty String getAuthenticatingAuthority(@Nonnull final ProfileRequestContext profileRequestContext);
+
/**
* Get an ordered list of session initiator flows to attempt for this application.
*
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java
index c7bbac0..e1df613 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java
@@ -52,6 +52,9 @@ public class BasicApplication extends DefaultRelyingPartyConfigurationResolver i
/** Lookup strategy for issuer. */
@Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
+ /** Lookup strategy for authenticating authority. */
+ @Nonnull private Function<ProfileRequestContext,String> authenticatingAuthorityLookupStrategy;
+
/** Session initiator list lookup strategy. */
@Nonnull private Function<ProfileRequestContext,List<String>> sessionInitiatorLookupStrategy;
@@ -70,6 +73,7 @@ public class BasicApplication extends DefaultRelyingPartyConfigurationResolver i
/** Constructor. */
public BasicApplication() {
issuerLookupStrategy = FunctionSupport.constant(null);
+ authenticatingAuthorityLookupStrategy = FunctionSupport.constant(null);
sessionInitiatorLookupStrategy = FunctionSupport.constant(CollectionSupport.emptyList());
}
@@ -130,6 +134,38 @@ public class BasicApplication extends DefaultRelyingPartyConfigurationResolver i
issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
+ @Nullable @NotEmpty public String getAuthenticatingAuthority(@Nonnull ProfileRequestContext profileRequestContext) {
+ return authenticatingAuthorityLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Sets the identifier of the authenticating authority (IdP, OP, etc.) to use for this application
+ * if not overridden.
+ *
+ * @param authority authority name
+ */
+ public void setAuthenticatingAuthority(@Nullable @NotEmpty final String authority) {
+ checkSetterPreconditions();
+
+ final String trimmed = Constraint.isNotNull(authority, "Authority name cannot be null or empty");
+ authenticatingAuthorityLookupStrategy = FunctionSupport.constant(trimmed);
+ }
+
+ /**
+ * Sets the lookup strategy for the identifier of the authenticating authority (IdP, OP, etc.) to use
+ * for this application if not overridden.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setAuthenticatingAuthorityLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,String> strategy) {
+ checkSetterPreconditions();
+
+ authenticatingAuthorityLookupStrategy =
+ Constraint.isNotNull(strategy, "Authority lookup strategy cannot be null");
+ }
+
/** {@inheritDoc} */
@Nonnull public List<String> getSessionInitiators(@Nullable final ProfileRequestContext profileRequestContext) {
final List<String> ret = sessionInitiatorLookupStrategy.apply(profileRequestContext);
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/InitializeRelyingPartyContext.java b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/InitializeRelyingPartyContext.java
new file mode 100644
index 0000000..53dcab1
--- /dev/null
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/InitializeRelyingPartyContext.java
@@ -0,0 +1,116 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.profile.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.action.EventIds;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.sp.Application;
+import net.shibboleth.sp.ddf.DDF;
+import net.shibboleth.sp.profile.AbstractApplicationAction;
+import net.shibboleth.sp.profile.InitiatorConstants;
+import net.shibboleth.idp.profile.IdPEventIds;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.logic.Constraint;
+
+/**
+ * Action that creates a {@link RelyingPartyContext} based on the identity of the eventual authenticating
+ * authority (the IdP/OP/etc.).
+ *
+ * <p>The authority ID is potentially supplied by the agent in the request, or may be defaulted
+ * based on the {@link Application}.</p>
+ *
+ * <p>In rare cases (mainly SAML ECP), it is not strictly required that the ID be known in advance.</p>
+ *
+ * @event {@link EventIds#PROCEED_EVENT_ID}
+ * @event {@link EventIds#INVALID_PROFILE_CTX}
+ * @event {@link IdPEventIds#INVALID_RELYING_PARTY_CTX}
+ */
+public class InitializeRelyingPartyContext extends AbstractApplicationAction {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(InitializeRelyingPartyContext.class);
+
+ /** Creation strategy for {@link RelyingPartyContext}. */
+ @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextCreationStrategy;
+
+ /** The relying party name to base the inbound context on. */
+ @Nullable private String relyingPartyId;
+
+ /** Constructor. */
+ public InitializeRelyingPartyContext() {
+ relyingPartyContextCreationStrategy = new ChildContextLookup<>(RelyingPartyContext.class, true);
+ }
+
+ /**
+ * Set an optional lookup strategy to identify the relying party name, as a substitute for the session/logout
+ * assumptions made by the action otherwise.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setRelyingPartyContextCreationStrategy(
+ @Nonnull final Function<ProfileRequestContext,RelyingPartyContext> strategy) {
+ checkSetterPreconditions();
+
+ relyingPartyContextCreationStrategy =
+ Constraint.isNotNull(strategy, "RelyingPartyContext creation strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+ if (!super.doPreExecute(profileRequestContext)) {
+ return false;
+ }
+
+ final DDF input = ensureAgentRequestContext().getInput();
+ relyingPartyId = input != null ? input.getmember(InitiatorConstants.AUTHORITY).string() : null;
+ if (relyingPartyId == null) {
+ log.debug("{} Request did not specify authority to use, falling back to Application default",
+ getLogPrefix());
+ relyingPartyId = ensureApplication().getAuthenticatingAuthority(profileRequestContext);
+ }
+
+ if (relyingPartyId == null) {
+ log.debug("{} No authority identified", getLogPrefix());
+ }
+
+ return true;
+ }
+
+ /** {@inheritDoc} */
+ @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+
+ final RelyingPartyContext rpContext = relyingPartyContextCreationStrategy.apply(profileRequestContext);
+ if (rpContext == null) {
+ ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
+ log.error("{} Unable to create dRelyingPartyContext", getLogPrefix());
+ return;
+ }
+
+ rpContext.setRelyingPartyId(relyingPartyId);
+ log.debug("{} Initialized RelyingPartyContext for {}", getLogPrefix(), relyingPartyId);
+ }
+
+}
\ No newline at end of file
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ResolveApplication.java b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ResolveApplication.java
index 858fb28..db1e4ca 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ResolveApplication.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/profile/impl/ResolveApplication.java
@@ -26,6 +26,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.sp.Agent;
import net.shibboleth.sp.Application;
import net.shibboleth.sp.ddf.DDF;
+import net.shibboleth.sp.profile.AbstractAgentAction;
/**
* An action that maps a message request from an agent to the corresponding {@link Application}
diff --git a/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/BaseAgplicationActionTest.java b/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/BaseAgplicationActionTest.java
new file mode 100644
index 0000000..3c0e860
--- /dev/null
+++ b/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/BaseAgplicationActionTest.java
@@ -0,0 +1,42 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.profile.impl;
+
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.sp.impl.BasicApplication;
+
+/**
+ * Base class for unit tests that rely on set up of an agent request with an application.
+ */
+public abstract class BaseAgplicationActionTest extends BaseAgentRequestTest {
+
+ protected BasicApplication application;
+
+ /**
+ * Call from the before-method set up hook.
+ *
+ * @throws ComponentInitializationException
+ */
+ public void beforeMethod() throws ComponentInitializationException {
+ super.beforeMethod();
+
+ application = new BasicApplication();
+ application.setId("test");
+ //application.initialize();
+
+ arc.setApplication(application);
+ }
+
+}
\ No newline at end of file
diff --git a/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/InitializeRelyingPartyContextTest.java b/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/InitializeRelyingPartyContextTest.java
new file mode 100644
index 0000000..214fdef
--- /dev/null
+++ b/sp-server-impl/src/test/java/net/shibboleth/sp/profile/impl/InitializeRelyingPartyContextTest.java
@@ -0,0 +1,101 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.profile.impl;
+
+import javax.annotation.Nonnull;
+
+import org.springframework.webflow.execution.Event;
+import org.testng.Assert;
+import org.testng.annotations.AfterMethod;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.profile.testing.ActionTestingSupport;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.sp.ddf.DDF;
+import net.shibboleth.sp.profile.InitiatorConstants;
+
+/**
+ * Unit test for {@link InitializeRelyingPartyContext} action.
+ */
+ at SuppressWarnings("javadoc")
+public class InitializeRelyingPartyContextTest extends BaseAgplicationActionTest {
+
+ /** Test value. */
+ @Nonnull @NotEmpty private final static String TEST_VALUE = "https://idp.example.org";
+
+ private InitializeRelyingPartyContext action;
+
+ /**
+ * Set up test.
+ *
+ * @throws ComponentInitializationException
+ */
+ @BeforeMethod
+ public void setUp() throws ComponentInitializationException {
+ super.beforeMethod();
+
+ action = new InitializeRelyingPartyContext();
+ action.initialize();
+ }
+
+ /**
+ * Tear down test.
+ */
+ @AfterMethod
+ public void tearDown() {
+ action.destroy();
+ }
+
+ @Test
+ public void testNoAuthority() {
+ final Event event = action.execute(src);
+ ActionTestingSupport.assertProceedEvent(event);
+
+ final RelyingPartyContext rpc = prc.getSubcontext(RelyingPartyContext.class);
+ assert rpc != null;
+ Assert.assertNull(rpc.getRelyingPartyId());
+ }
+
+ @Test
+ public void testFallbackAuthority() {
+ application.setAuthenticatingAuthority(TEST_VALUE);
+
+ final Event event = action.execute(src);
+ ActionTestingSupport.assertProceedEvent(event);
+
+ final RelyingPartyContext rpc = prc.getSubcontext(RelyingPartyContext.class);
+ assert rpc != null;
+ Assert.assertEquals(rpc.getRelyingPartyId(), TEST_VALUE);
+ }
+
+ @Test
+ public void testInputAuthority() {
+ application.setAuthenticatingAuthority(TEST_VALUE);
+ final DDF input = new DDF(null).structure();
+ input.addmember(InitiatorConstants.AUTHORITY).string(TEST_VALUE + "/shibboleth");
+ arc.setInput(input);
+
+ final Event event = action.execute(src);
+ ActionTestingSupport.assertProceedEvent(event);
+
+ final RelyingPartyContext rpc = prc.getSubcontext(RelyingPartyContext.class);
+ assert rpc != null;
+ Assert.assertEquals(rpc.getRelyingPartyId(), TEST_VALUE + "/shibboleth");
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list