[java-identity-provider] branch main updated: JSATTR-6: SAML AttributeQuery DataConnector

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=59c5f2a9ce4546becd403fa59943d241551f3bbe

The following commit(s) were added to refs/heads/main by this push:
     new 59c5f2a9c JSATTR-6: SAML AttributeQuery DataConnector
59c5f2a9c is described below

commit 59c5f2a9ce4546becd403fa59943d241551f3bbe
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu May 29 18:16:37 2025 -0400

    JSATTR-6: SAML AttributeQuery DataConnector
    
    Add support for SOAP signing and client TLS predicates on
    AttributeQueryProfileConfiguration
---
 .../impl/AttributeQueryProfileConfiguration.java   | 69 ++++++++++++++++++++++
 1 file changed, 69 insertions(+)

diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AttributeQueryProfileConfiguration.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AttributeQueryProfileConfiguration.java
index bec9880b4..ab9687ccf 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AttributeQueryProfileConfiguration.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AttributeQueryProfileConfiguration.java
@@ -20,6 +20,7 @@ import java.util.function.Predicate;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.profile.logic.NoConfidentialityMessageChannelPredicate;
 import org.opensaml.profile.logic.NoIntegrityMessageChannelPredicate;
@@ -42,6 +43,12 @@ public class AttributeQueryProfileConfiguration extends AbstractSAML2AssertionPr
     /** Lookup strategy for attribute recipient group ID. */
     @Nonnull private Function<ProfileRequestContext,String> attributeRecipientGroupIDLookupStrategy;
     
+    /** Predicate used to determine if SOAP-based requests should be signed. */
+    @Nonnull private Predicate<MessageContext> signSOAPRequestsPredicate;
+    
+    /** Predicate used to determine if SOAP-based requests should use client TLS. */
+    @Nonnull private Predicate<MessageContext> clientTLSSOAPRequestsPredicate;
+    
     /** Constructor. */
     public AttributeQueryProfileConfiguration() {
         this(PROFILE_ID);
@@ -58,6 +65,12 @@ public class AttributeQueryProfileConfiguration extends AbstractSAML2AssertionPr
         setEncryptAssertionsPredicate(new NoConfidentialityMessageChannelPredicate());
         randomizeFriendlyNamePredicate = PredicateSupport.alwaysFalse();
         attributeRecipientGroupIDLookupStrategy = FunctionSupport.constant(null);
+        
+        signSOAPRequestsPredicate = new org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate();
+        final Predicate<MessageContext> cltsrp =
+                new org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate().negate();
+        assert cltsrp!=null;
+        clientTLSSOAPRequestsPredicate = cltsrp;
     }
 
     /** {@inheritDoc} */
@@ -122,5 +135,61 @@ public class AttributeQueryProfileConfiguration extends AbstractSAML2AssertionPr
         attributeRecipientGroupIDLookupStrategy =
                 Constraint.isNotNull(strategy, "Group ID lookup strategy cannot be null");
     }
+    
+    /** {@inheritDoc} */
+    public boolean isSignSOAPRequests(@Nullable final MessageContext messageContext) {
+        return signSOAPRequestsPredicate.test(messageContext);
+    }
+
+    /**
+     * Set whether SOAP-based requests should be signed.
+     * 
+     * @param flag flag to set
+     * 
+     * @since 5.2.0
+     */
+    public void setSignSOAPRequests(final boolean flag) {
+        signSOAPRequestsPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+    }
+    
+    /**
+     * Set the predicate used to determine if SOAP-based requests should be signed.
+     * 
+     * @param predicate the predicate
+     * 
+     * @since 5.2.0
+     */
+    public void setSignSOAPRequestsPredicate(@Nonnull final Predicate<MessageContext> predicate) {
+        signSOAPRequestsPredicate = Constraint.isNotNull(predicate, 
+                "Predicate used to determine SOAP-based signing cannot be null");
+    }
+
+    /** {@inheritDoc} */
+    public boolean isClientTLSSOAPRequests(@Nullable final MessageContext messageContext) {
+        return clientTLSSOAPRequestsPredicate.test(messageContext);
+    }
+    
+    /**
+     * Set whether SOAP-based requests should use client TLS.
+     * 
+     * @param flag flag to set
+     * 
+     * @since 5.2.0
+     */
+    public void setClientTLSSOAPRequests(final boolean flag) {
+        clientTLSSOAPRequestsPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+    }
+    
+    /**
+     * Set the predicate used to determine if SOAP-based requests should use client TLS.
+     * 
+     * @param predicate the predicate
+     * 
+     * @since 5.2.0
+     */
+    public void setClientTLSSOAPRequestsPredicate(@Nonnull final Predicate<MessageContext> predicate) {
+        clientTLSSOAPRequestsPredicate = Constraint.isNotNull(predicate, 
+                "Predicate used to determine SOAP-based client TLS use cannot be null");
+    }
 
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.