[java-shib-attribute] branch main updated: JSATTR-31 Add protocolSupportEnumeration-based filter policy
Rod Widdowson
rdw at steadingsoftware.com
Wed Apr 9 13:58:37 UTC 2025
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch main
in repository java-shib-attribute.
View the commit online:
http://git.shibboleth.net/view/?p=java-shib-attribute.git;a=commit;h=02f51915955fbe07cc44cd49786cabc679f95253
The following commit(s) were added to refs/heads/main by this push:
new 02f519159 JSATTR-31 Add protocolSupportEnumeration-based filter policy
02f519159 is described below
commit 02f51915955fbe07cc44cd49786cabc679f95253
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Wed Apr 9 14:57:42 2025 +0100
JSATTR-31 Add protocolSupportEnumeration-based filter policy
https://shibboleth.atlassian.net/browse/JSATTR-31
Spring integration
* Schema
* Parsers
* Tests
---
.../impl/AttributeFilterNamespaceHandler.java | 14 ++++++-
.../impl/AbstractProtocolSupportParser.java | 44 ++++++++++++++++++++
.../impl/IssuerProtocolSupportParser.java | 22 ++++++++++
.../ProxiedRequesterProtocolSupportParser.java | 22 ++++++++++
.../impl/RequesterProtocolSupportParser.java | 22 ++++++++++
.../src/main/resources/schema/shibboleth-afp.xsd | 48 ++++++++++++++++++++++
.../filter/spring/saml/ProtocolSupportTest.java | 42 +++++++++++++++++++
.../filter/policyrule/issuerProtocolSupport.xml | 4 ++
.../policyrule/proxiedRequesterProtocolSupport.xml | 4 ++
.../filter/policyrule/requesterProtocolSupport.xml | 4 ++
10 files changed, 225 insertions(+), 1 deletion(-)
diff --git a/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java b/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
index 23e5277f0..2d2a3ef0a 100644
--- a/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
+++ b/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/impl/AttributeFilterNamespaceHandler.java
@@ -31,14 +31,17 @@ import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.AttributeIssue
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.AttributeRequesterRegexRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.AttributeRequesterRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.InboundRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.IssuerProtocolSupportParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.NumOfAttributeValuesRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.OutboundRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.PredicateRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.PrincipalNameRegexRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.PrincipalNameRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.ProfileRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.ProxiedRequesterProtocolSupportParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.ProxiedRequesterRegexRuleParser;
import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.ProxiedRequesterRuleParser;
+import net.shibboleth.idp.attribute.filter.spring.policyrule.impl.RequesterProtocolSupportParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.AttributeInMetadataRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.IssuerEntityAttributeExactRuleParser;
import net.shibboleth.idp.attribute.filter.spring.saml.impl.IssuerEntityAttributeRegexRuleParser;
@@ -181,6 +184,15 @@ public class AttributeFilterNamespaceHandler extends BaseSpringNamespaceHandler
registerBeanDefinitionParser(ValueMatchesShibMDScopeParser.SCHEMA_TYPE, new ValueMatchesShibMDScopeParser());
registerBeanDefinitionParser(ScopeMatchesShibMDScopeParser.SCHEMA_TYPE, new ScopeMatchesShibMDScopeParser());
+
+ registerBeanDefinitionParser(IssuerProtocolSupportParser.SCHEMA_TYPE,
+ new IssuerProtocolSupportParser());
+
+ registerBeanDefinitionParser(RequesterProtocolSupportParser.SCHEMA_TYPE,
+ new RequesterProtocolSupportParser());
+
+ registerBeanDefinitionParser(ProxiedRequesterProtocolSupportParser.SCHEMA_TYPE,
+ new ProxiedRequesterProtocolSupportParser());
}
// Checkstyle: MethodLength ON
-}
\ No newline at end of file
+}
diff --git a/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/AbstractProtocolSupportParser.java b/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/AbstractProtocolSupportParser.java
new file mode 100644
index 000000000..7cfd53762
--- /dev/null
+++ b/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/AbstractProtocolSupportParser.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.filter.spring.policyrule.impl;
+
+import javax.annotation.Nonnull;
+
+import org.springframework.beans.factory.support.BeanDefinitionBuilder;
+import org.springframework.beans.factory.xml.ParserContext;
+import org.w3c.dom.Element;
+
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AbstractProtocolSupportPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.policyrule.BasePolicyRuleParser;
+import net.shibboleth.shared.primitive.StringSupport;
+
+/**
+ * Base class all the Protocol Support Policy Rules.
+ * Corresponds to {@link AbstractProtocolSupportPolicyRule} and the abstract
+ * xsd type ProtocolSupportType.
+ */
+public abstract class AbstractProtocolSupportParser extends BasePolicyRuleParser {
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+ @Nonnull final BeanDefinitionBuilder builder) {
+ super.doParse(element, builder);
+
+ builder.addPropertyValue("protocol", StringSupport.trimOrNull(element.getAttributeNS(null, "protocol")));
+
+ }
+
+}
\ No newline at end of file
diff --git a/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/IssuerProtocolSupportParser.java b/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/IssuerProtocolSupportParser.java
new file mode 100644
index 000000000..d95951a5c
--- /dev/null
+++ b/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/IssuerProtocolSupportParser.java
@@ -0,0 +1,22 @@
+package net.shibboleth.idp.attribute.filter.spring.policyrule.impl;
+
+import javax.annotation.Nonnull;
+import javax.xml.namespace.QName;
+
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.IssuerProtocolSupportPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
+
+/**
+ * Parser for the IssuerProtocolSupport policy rule.
+ */
+public class IssuerProtocolSupportParser extends AbstractProtocolSupportParser {
+
+ /** Schema type. */
+ @Nonnull public static final QName SCHEMA_TYPE =
+ new QName(BaseFilterParser.NAMESPACE, "IssuerProtocolSupport");
+
+ @Override
+ protected Class<?> getNativeBeanClass() {
+ return IssuerProtocolSupportPolicyRule.class;
+ }
+}
diff --git a/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/ProxiedRequesterProtocolSupportParser.java b/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/ProxiedRequesterProtocolSupportParser.java
new file mode 100644
index 000000000..472ecc95c
--- /dev/null
+++ b/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/ProxiedRequesterProtocolSupportParser.java
@@ -0,0 +1,22 @@
+package net.shibboleth.idp.attribute.filter.spring.policyrule.impl;
+
+import javax.annotation.Nonnull;
+import javax.xml.namespace.QName;
+
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.ProxiedRequesterProtocolSupportPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
+
+/**
+ * Parser for the ProxiedRequesterProtocolSupport policy rule.
+ */
+public class ProxiedRequesterProtocolSupportParser extends AbstractProtocolSupportParser {
+
+ /** Schema type. */
+ @Nonnull public static final QName SCHEMA_TYPE =
+ new QName(BaseFilterParser.NAMESPACE, "ProxiedRequesterProtocolSupport");
+
+ @Override
+ protected Class<?> getNativeBeanClass() {
+ return ProxiedRequesterProtocolSupportPolicyRule.class;
+ }
+}
diff --git a/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/RequesterProtocolSupportParser.java b/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/RequesterProtocolSupportParser.java
new file mode 100644
index 000000000..4f5624969
--- /dev/null
+++ b/shib-attribute-filter-spring/src/main/java/net/shibboleth/idp/attribute/filter/spring/policyrule/impl/RequesterProtocolSupportParser.java
@@ -0,0 +1,22 @@
+package net.shibboleth.idp.attribute.filter.spring.policyrule.impl;
+
+import javax.annotation.Nonnull;
+import javax.xml.namespace.QName;
+
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.RequesterProtocolSupportPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.BaseFilterParser;
+
+/**
+ * Parser for the ProtocolSupport policy rule.
+ */
+public class RequesterProtocolSupportParser extends AbstractProtocolSupportParser {
+
+ /** Schema type. */
+ @Nonnull public static final QName SCHEMA_TYPE =
+ new QName(BaseFilterParser.NAMESPACE, "ProtocolSupport");
+
+ @Override
+ protected Class<?> getNativeBeanClass() {
+ return RequesterProtocolSupportPolicyRule.class;
+ }
+}
diff --git a/shib-attribute-filter-spring/src/main/resources/schema/shibboleth-afp.xsd b/shib-attribute-filter-spring/src/main/resources/schema/shibboleth-afp.xsd
index 9af7009d6..8c512d337 100644
--- a/shib-attribute-filter-spring/src/main/resources/schema/shibboleth-afp.xsd
+++ b/shib-attribute-filter-spring/src/main/resources/schema/shibboleth-afp.xsd
@@ -719,6 +719,54 @@
</complexContent>
</complexType>
+ <complexType name="ProtocolSupport">
+ <annotation>
+ <documentation>
+ A Policy Rule that matches the supplied protocol against the
+ protocols supported by the Requester
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:ProtocolSupportType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="IssuerProtocolSupport">
+ <annotation>
+ <documentation>
+ A Policy Rule that matches the supplied protocol against the
+ protocols supported by the Issuer
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:ProtocolSupportType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="ProxiedRequesterProtocolSupport">
+ <annotation>
+ <documentation>
+ A Policy Rule that matches the supplied protocol against the
+ protocols supported by the Proxied Requester
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:ProtocolSupportType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="ProtocolSupportType" abstract="true">
+ <complexContent>
+ <extension base="afp:MatchFunctorType">
+ <attribute name="protocol" type="afp:string" use="required">
+ <annotation>
+ <documentation>The protocol to match.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
<complexType name="NameIDFormatExactMatch">
<annotation>
<documentation>
diff --git a/shib-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/ProtocolSupportTest.java b/shib-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/ProtocolSupportTest.java
new file mode 100644
index 000000000..4b9c8fbdd
--- /dev/null
+++ b/shib-attribute-filter-spring/src/test/java/net/shibboleth/idp/attribute/filter/spring/saml/ProtocolSupportTest.java
@@ -0,0 +1,42 @@
+package net.shibboleth.idp.attribute.filter.spring.saml;
+
+import static org.testng.Assert.assertEquals;
+
+import javax.annotation.Nonnull;
+
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AbstractProtocolSupportPolicyRule;
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.IssuerProtocolSupportPolicyRule;
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.ProxiedRequesterProtocolSupportPolicyRule;
+import net.shibboleth.idp.attribute.filter.policyrule.saml.impl.RequesterProtocolSupportPolicyRule;
+import net.shibboleth.idp.attribute.filter.spring.testing.BaseAttributeFilterParserTest;
+import net.shibboleth.shared.component.ComponentInitializationException;
+
+public class ProtocolSupportTest extends BaseAttributeFilterParserTest {
+
+ private AbstractProtocolSupportPolicyRule getAndTest(@Nonnull final String name) throws ComponentInitializationException {
+ final AbstractProtocolSupportPolicyRule result = (AbstractProtocolSupportPolicyRule)
+ getPolicyRule(name);
+ assertEquals(result.getProtocol(), "urn:example:protocol:support");
+ return result;
+ }
+
+ @Test
+ public void issuer() throws ComponentInitializationException {
+ final AbstractProtocolSupportPolicyRule rule = getAndTest("issuerProtocolSupport.xml");
+ assertEquals(rule.getClass(), IssuerProtocolSupportPolicyRule.class);
+ }
+
+ @Test
+ public void requester() throws ComponentInitializationException {
+ final AbstractProtocolSupportPolicyRule rule = getAndTest("requesterProtocolSupport.xml");
+ assertEquals(rule.getClass(), RequesterProtocolSupportPolicyRule.class);
+ }
+
+ @Test
+ public void proxiedRequester() throws ComponentInitializationException {
+ final AbstractProtocolSupportPolicyRule rule = getAndTest("proxiedRequesterProtocolSupport.xml");
+ assertEquals(rule.getClass(), ProxiedRequesterProtocolSupportPolicyRule.class);
+ }
+}
diff --git a/shib-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/issuerProtocolSupport.xml b/shib-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/issuerProtocolSupport.xml
new file mode 100644
index 000000000..3b275f92b
--- /dev/null
+++ b/shib-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/issuerProtocolSupport.xml
@@ -0,0 +1,4 @@
+<AttributeFilterPolicy id="MostBasicExample" xmlns="urn:mace:shibboleth:2.0:afp" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
+ <PolicyRequirementRule xsi:type="IssuerProtocolSupport" protocol="urn:example:protocol:support" />
+</AttributeFilterPolicy>
diff --git a/shib-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/proxiedRequesterProtocolSupport.xml b/shib-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/proxiedRequesterProtocolSupport.xml
new file mode 100644
index 000000000..285272738
--- /dev/null
+++ b/shib-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/proxiedRequesterProtocolSupport.xml
@@ -0,0 +1,4 @@
+<AttributeFilterPolicy id="MostBasicExample" xmlns="urn:mace:shibboleth:2.0:afp" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
+ <PolicyRequirementRule xsi:type="ProxiedRequesterProtocolSupport" protocol="urn:example:protocol:support" />
+</AttributeFilterPolicy>
diff --git a/shib-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/requesterProtocolSupport.xml b/shib-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/requesterProtocolSupport.xml
new file mode 100644
index 000000000..1584f5049
--- /dev/null
+++ b/shib-attribute-filter-spring/src/test/resources/net/shibboleth/idp/attribute/filter/policyrule/requesterProtocolSupport.xml
@@ -0,0 +1,4 @@
+<AttributeFilterPolicy id="MostBasicExample" xmlns="urn:mace:shibboleth:2.0:afp" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
+ <PolicyRequirementRule xsi:type="ProtocolSupport" protocol="urn:example:protocol:support" />
+</AttributeFilterPolicy>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list