[java-plugin-shibd] branch main updated: Rework relationship between Application and default RP settings.
Scott Cantor
cantor.2 at osu.edu
Thu Sep 12 18:53:01 UTC 2024
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-plugin-shibd.
View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=e473e60bf90f4d99ab1490d054cb7ad31e939e70
The following commit(s) were added to refs/heads/main by this push:
new e473e60 Rework relationship between Application and default RP settings.
e473e60 is described below
commit e473e60bf90f4d99ab1490d054cb7ad31e939e70
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Sep 12 14:52:58 2024 -0400
Rework relationship between Application and default RP settings.
---
.../net/shibboleth/idp/module/conf/sp/agents.xml | 30 +++---
.../net/shibboleth/sp/conf/agents-system.xml | 4 +-
.../shibboleth/sp/conf/relying-party-system.xml | 3 +-
.../net/shibboleth/idp/module/conf/sp/agents.xml | 25 ++---
.../main/java/net/shibboleth/sp/Application.java | 13 ---
.../context/navigate/IssuerLookupFunction.java | 55 -----------
.../net/shibboleth/sp/impl/BasicApplication.java | 106 ++++++++++++++++++---
7 files changed, 122 insertions(+), 114 deletions(-)
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
index 435193b..1364e85 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/agents.xml
@@ -33,6 +33,16 @@
</property>
</bean>
+
+ <!-- ============ Profile defaults ============ -->
+
+ <!-- Used for all applications by default to provide a baseline for profile settings. -->
+
+ <util:list id="shibboleth.DefaultProfileConfigurations">
+ <!-- Your profiles here. -->
+ </util:list>
+
+
<!-- ============ RelyingParty defaults ============ -->
<!--
@@ -42,8 +52,7 @@
-->
<!--
- Unverified RP configuration, defaults to no support for any profiles. Add <ref> elements to the list
- to enable specific default profile settings (as below), or create new beans inline to override defaults.
+ Unverified RP configuration, defaults to no support for any profiles.
"Unverified" typically means the SP has no metadata, or equivalent way of assuring the identity and
legitimacy of an IdP system. To run an "open" SP, you can enable profiles here.
@@ -56,22 +65,7 @@
</property>
</bean>
- <!--
- Default configuration, with default settings applied for all profiles.
-
- Take care with any defaults you apply at this level because you will have to create
- overrides or apply metadata tags for every single SP that requires a different setting.
- Changed defaults should be things you really do want to apply to nearly every SP.
- -->
- <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
- <property name="profileConfigurations">
- <list>
- <!-- Your profiles here. -->
- </list>
- </property>
- </bean>
-
- <!-- Container for any overrides you want to add. -->
+ <!-- Container for any overrides you want to add, again used for all applications by default. -->
<util:list id="shibboleth.RelyingPartyOverrides">
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
index d6d746b..6a9fad1 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/agents-system.xml
@@ -30,8 +30,10 @@
p:attributeTranscoderRegistry-ref="shibboleth.AttributeRegistryService"
p:attributeResolver-ref="shibboleth.AttributeResolverService"
p:attributeFilter-ref="shibboleth.AttributeFilterService"
+ p:detailedErrorsPredicate="%{sp.errors.detailed:false}"
+ p:securityConfiguration-ref="#{'%{sp.security.config:shibboleth.DefaultSecurityConfiguration}'.trim()}"
+ p:profileConfigurations-ref="shibboleth.DefaultProfileConfigurations"
p:unverifiedConfiguration-ref="shibboleth.UnverifiedRelyingParty"
- p:defaultConfiguration-ref="shibboleth.DefaultRelyingParty"
p:relyingPartyConfigurations-ref="shibboleth.RelyingPartyOverrides"
p:metricName="net.shibboleth.sp.relyingparty.configurations"
p:sessionInitiators-ref="shibboleth.SessionInitiators"
diff --git a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml
index dbd9ef7..640e017 100644
--- a/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml
+++ b/sp-conf-impl/src/main/resources/net/shibboleth/sp/conf/relying-party-system.xml
@@ -19,7 +19,8 @@
<!-- Parent bean for generic RelyingParty overrides that establishes defaults. -->
<bean id="RelyingParty" abstract="true" class="net.shibboleth.profile.relyingparty.BasicRelyingPartyConfiguration"
p:detailedErrorsPredicate="%{sp.errors.detailed:false}"
- p:securityConfiguration-ref="#{'%{sp.security.config:shibboleth.DefaultSecurityConfiguration}'.trim()}" />
+ p:securityConfiguration-ref="#{'%{sp.security.config:shibboleth.DefaultSecurityConfiguration}'.trim()}"
+ p:profileConfigurations-ref="shibboleth.DefaultProfileConfigurations" />
<!-- Parent bean for RelyingParty overrides based on activation by name(s). -->
<bean id="RelyingPartyByName" abstract="true" parent="RelyingParty"
diff --git a/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml b/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
index 28167fe..6a68252 100644
--- a/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
+++ b/sp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/sp/agents.xml
@@ -32,6 +32,16 @@
</set>
</property>
</bean>
+
+
+ <!-- ============ Profile defaults ============ -->
+
+ <!-- Used for all applications by default to provide a baseline for profile settings. -->
+
+ <util:list id="shibboleth.DefaultProfileConfigurations">
+ <!-- Your profiles here. -->
+ </util:list>
+
<!-- ============ RelyingParty defaults ============ -->
@@ -56,21 +66,6 @@
</property>
</bean>
- <!--
- Default configuration, with default settings applied for all profiles.
-
- Take care with any defaults you apply at this level because you will have to create
- overrides or apply metadata tags for every single SP that requires a different setting.
- Changed defaults should be things you really do want to apply to nearly every SP.
- -->
- <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
- <property name="profileConfigurations">
- <list>
- <!-- Your profiles here. -->
- </list>
- </property>
- </bean>
-
<!-- Container for any overrides you want to add. -->
<util:list id="shibboleth.RelyingPartyOverrides">
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/Application.java b/sp-server-api/src/main/java/net/shibboleth/sp/Application.java
index f0d22a4..53b1ce4 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/Application.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/Application.java
@@ -28,7 +28,6 @@ import org.opensaml.saml.metadata.resolver.MetadataResolver;
import net.shibboleth.idp.attribute.filter.AttributeFilter;
import net.shibboleth.idp.attribute.resolver.AttributeResolver;
import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
-import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.relyingparty.RelyingPartyConfigurationResolver;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.service.ReloadableService;
@@ -47,18 +46,6 @@ import net.shibboleth.shared.service.ReloadableService;
@ThreadSafe
public interface Application extends RelyingPartyConfigurationResolver {
- /**
- * Get the issuer value to use in various identity protocols when identifying this application.
- *
- * <p>Note that this value may be overridden via a relevant {@link ProfileConfiguration} obtained via
- * the implemented {@link RelyingPartyConfigurationResolver}.</p>
- *
- * @param profileRequestContext profile request context
- *
- * @return default issue value to use
- */
- @Nullable @NotEmpty String getIssuer(@Nullable final ProfileRequestContext profileRequestContext);
-
/**
* Gets the identifier of the authenticating authority (IdP, OP, etc.) to use for this application
* if not overridden.
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/profile/context/navigate/IssuerLookupFunction.java b/sp-server-api/src/main/java/net/shibboleth/sp/profile/context/navigate/IssuerLookupFunction.java
deleted file mode 100644
index d7b899e..0000000
--- a/sp-server-api/src/main/java/net/shibboleth/sp/profile/context/navigate/IssuerLookupFunction.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.sp.profile.context.navigate;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-import net.shibboleth.sp.Application;
-
-/**
- * Extension of standard lookup function for deriving a message issuer value that
- * adds SP awareness of the requesting {@link Application}.
- */
-public class IssuerLookupFunction extends AbstractAgentRequestLookupFunction<String> {
-
- /** Called before applying logic within this class. */
- @Nonnull private final Function<ProfileRequestContext,String> primarySource;
-
- /** Constructor. */
- public IssuerLookupFunction() {
- primarySource = new net.shibboleth.profile.context.navigate.IssuerLookupFunction();
- }
-
- /** {@inheritDoc} */
- @Nullable public String apply(@Nullable final ProfileRequestContext profileRequestContext) {
- final String issuer = primarySource.apply(profileRequestContext);
- if (issuer != null) {
- return issuer;
- }
-
- final Application app = ensureAgentRequestContext(profileRequestContext).getApplication();
- if (app != null) {
- return app.getIssuer(profileRequestContext);
- }
-
- return null;
- }
-
-}
\ No newline at end of file
diff --git a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java
index e42dcde..1f1ea2c 100644
--- a/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java
+++ b/sp-server-impl/src/main/java/net/shibboleth/sp/impl/BasicApplication.java
@@ -17,14 +17,17 @@ package net.shibboleth.sp.impl;
import java.util.Collection;
import java.util.List;
+import java.util.Map;
import java.util.Objects;
import java.util.function.Function;
+import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.metadata.resolver.MetadataResolver;
+import org.opensaml.security.config.SecurityConfiguration;
import com.codahale.metrics.MetricRegistry;
import com.google.common.base.MoreObjects;
@@ -32,6 +35,8 @@ import com.google.common.base.MoreObjects;
import net.shibboleth.idp.attribute.filter.AttributeFilter;
import net.shibboleth.idp.attribute.resolver.AttributeResolver;
import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.relyingparty.BasicRelyingPartyConfiguration;
import net.shibboleth.profile.relyingparty.impl.DefaultRelyingPartyConfigurationResolver;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
@@ -48,8 +53,7 @@ import net.shibboleth.sp.StateTokenManager;
*/
public class BasicApplication extends DefaultRelyingPartyConfigurationResolver implements Application {
- /** Lookup strategy for issuer. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
+ @Nonnull private BasicRelyingPartyConfiguration defaultRelyingPartyConfiguration;
/** Lookup strategy for authenticating authority. */
@Nonnull private Function<ProfileRequestContext,String> authenticatingAuthorityLookupStrategy;
@@ -77,7 +81,8 @@ public class BasicApplication extends DefaultRelyingPartyConfigurationResolver i
/** Constructor. */
public BasicApplication() {
- issuerLookupStrategy = FunctionSupport.constant(null);
+ defaultRelyingPartyConfiguration = new BasicRelyingPartyConfiguration();
+
authenticatingAuthorityLookupStrategy = FunctionSupport.constant(null);
sessionInitiatorLookupStrategy = FunctionSupport.constant(CollectionSupport.emptyList());
tokenConsumerLookupStrategy = FunctionSupport.constant(CollectionSupport.emptyList());
@@ -86,6 +91,12 @@ public class BasicApplication extends DefaultRelyingPartyConfigurationResolver i
/** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
+
+ // Init our default config and inject into parent class.
+ defaultRelyingPartyConfiguration.setId(getId());
+ defaultRelyingPartyConfiguration.initialize();
+ setDefaultConfiguration(defaultRelyingPartyConfiguration);
+
super.doInitialize();
if (stateTokenManager == null) {
@@ -114,11 +125,6 @@ public class BasicApplication extends DefaultRelyingPartyConfigurationResolver i
return null;
}
- /** {@inheritDoc} */
- @Nullable @NotEmpty public String getIssuer(@Nullable final ProfileRequestContext profileRequestContext) {
- return issuerLookupStrategy.apply(profileRequestContext);
- }
-
/**
* Set default issuer value to use for this application.
*
@@ -127,8 +133,7 @@ public class BasicApplication extends DefaultRelyingPartyConfigurationResolver i
public void setIssuer(@Nullable @NotEmpty final String issuer) {
checkSetterPreconditions();
- final String trimmed = Constraint.isNotNull(issuer, "Issuer cannot be null or empty");
- issuerLookupStrategy = FunctionSupport.constant(trimmed);
+ defaultRelyingPartyConfiguration.setIssuer(issuer);
}
/**
@@ -139,7 +144,86 @@ public class BasicApplication extends DefaultRelyingPartyConfigurationResolver i
public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
checkSetterPreconditions();
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
+ defaultRelyingPartyConfiguration.setIssuerLookupStrategy(strategy);
+ }
+
+ /**
+ * Set whether detailed information about errors should be exposed.
+ *
+ * @param flag flag to set
+ */
+ public void setDetailedErrors(final boolean flag) {
+ checkSetterPreconditions();
+
+ defaultRelyingPartyConfiguration.setDetailedErrors(flag);
+ }
+
+ /**
+ * Set a condition to determine whether detailed information about errors should be exposed.
+ *
+ * @param condition condition to set
+ */
+ public void setDetailedErrorsPredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ checkSetterPreconditions();
+
+ defaultRelyingPartyConfiguration.setDetailedErrorsPredicate(condition);
+ }
+
+ /**
+ * Sets the security configuration for this profile.
+ *
+ * @param configuration security configuration for this profile
+ */
+ public void setSecurityConfiguration(@Nullable final SecurityConfiguration configuration) {
+ checkSetterPreconditions();
+
+ defaultRelyingPartyConfiguration.setSecurityConfiguration(configuration);
+ }
+
+ /**
+ * Set a lookup strategy for the security configuration.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setSecurityConfigurationLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,SecurityConfiguration> strategy) {
+ checkSetterPreconditions();
+
+ defaultRelyingPartyConfiguration.setSecurityConfigurationLookupStrategy(strategy);
+ }
+
+ /**
+ * Set the profile configurations for this relying party.
+ *
+ * @param configs the configurations to set
+ */
+ public void setProfileConfigurations(@Nullable final Collection<ProfileConfiguration> configs) {
+ checkSetterPreconditions();
+
+ defaultRelyingPartyConfiguration.setProfileConfigurations(configs);
+ }
+
+ /**
+ * Set a lookup strategy for the <code>profileConfigurations</code> property.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setProfileConfigurationsLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Map<String,ProfileConfiguration>> strategy) {
+ checkSetterPreconditions();
+
+ defaultRelyingPartyConfiguration.setProfileConfigurationsLookupStrategy(strategy);
+ }
+
+ /**
+ * Set the condition under which the relying party configuration should be active.
+ *
+ * @param condition the activation condition
+ */
+ public void setActivationCondition(@Nonnull final Predicate<ProfileRequestContext> condition) {
+ checkSetterPreconditions();
+
+ defaultRelyingPartyConfiguration.setActivationCondition(condition);
}
/** {@inheritDoc} */
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list