[java-identity-provider] branch main updated: IDP-2424 - Accessing attributes via authnContextTranslationStrategyEx
Codeberg
noreply at shibboleth.net
Thu Jan 15 17:01:07 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
https://codeberg.org/Shibboleth/java-identity-provider/commit/1286a0a3be122a863254fb67a2209752e6e265e2
The following commit(s) were added to refs/heads/main by this push:
new 1286a0a3b IDP-2424 - Accessing attributes via authnContextTranslationStrategyEx
1286a0a3b is described below
commit 1286a0a3be122a863254fb67a2209752e6e265e2
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jan 15 12:00:08 2026 -0500
IDP-2424 - Accessing attributes via authnContextTranslationStrategyEx
https://shibboleth.atlassian.net/browse/IDP-2424
---
...buteSourcedAuthnContextTranslationStrategy.java | 174 +++++++++++++++++++++
1 file changed, 174 insertions(+)
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeSourcedAuthnContextTranslationStrategy.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeSourcedAuthnContextTranslationStrategy.java
new file mode 100644
index 000000000..924817e38
--- /dev/null
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeSourcedAuthnContextTranslationStrategy.java
@@ -0,0 +1,174 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.saml2.profile.config;
+
+import java.security.Principal;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+
+import net.shibboleth.idp.attribute.IdPAttribute;
+import net.shibboleth.idp.attribute.StringAttributeValue;
+import net.shibboleth.idp.attribute.context.AttributeContext;
+import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.component.AbstractInitializableComponent;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
+
+/**
+ * Implementation of the SSO authnContextTranslationStrategyEx hook that translates decoded
+ * {@link IdPAttribute} values into (optionally mapped) values in the form of {@link AuthnContextClassRefPrincipal}
+ * objects.
+ *
+ * <p>This is primarily used for proxying via SAML to non-compliant IdPs (i.e., virtually all of them) that can't
+ * be bothered to properly support the use of Authentication Context to carry what it was literally designed to
+ * carry.</p>
+ */
+public class AttributeSourcedAuthnContextTranslationStrategy extends AbstractInitializableComponent
+ implements Function<ProfileRequestContext,Collection<Principal>> {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(AttributeSourcedAuthnContextTranslationStrategy.class);
+
+ /** Lookup strategy for AttributeContext to pull from. */
+ @Nonnull private Function<ProfileRequestContext,AttributeContext> attributeContextLookupStrategy;
+
+ /** Attribute sources to pull from. */
+ @Nonnull private Set<String> attributeSourceIDs;
+
+ /** Translation map to convert values if necessary. */
+ @Nonnull private Map<String,String> valueMappings;
+
+ /** Constructor. */
+ public AttributeSourcedAuthnContextTranslationStrategy() {
+ // Nested PRC -> RPC -> AC
+ attributeContextLookupStrategy = new ChildContextLookup<>(AttributeContext.class).compose(
+ new ChildContextLookup<>(RelyingPartyContext.class));
+
+ attributeSourceIDs = CollectionSupport.emptySet();
+ valueMappings = CollectionSupport.emptyMap();
+ }
+
+ /**
+ * Sets the lookup strategy for the {@link AttributeContext} to pull from.
+ *
+ * @param strategy lookup strategy
+ */
+ public void setAttributeContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,AttributeContext> strategy) {
+ checkSetterPreconditions();
+ attributeContextLookupStrategy =
+ Constraint.isNotNull(strategy, "AttributeContext lookup strategy cannot be null");
+ }
+
+ /**
+ * Sets the names of the {@link IdPAttribute} objects to check for values to map in.
+ *
+ * @param sources {@link IdPAttribute} IDs to check for
+ */
+ public void setAttributeSourceIDs(@Nonnull final Collection<String> sources) {
+ checkSetterPreconditions();
+ attributeSourceIDs = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(sources));
+ }
+
+ /**
+ * Sets the mappings to transform {@StringAttributeValue} data into different values for use as
+ * context class references.
+ *
+ * <p>Note that null keys are ignored, but null values are allowed, which suppresses the mapping
+ * of a value caising it to be skipped. Also, keys are not trimmed, but values are, to ensure
+ * the result is a valid context class reference.</p>
+ *
+ * @param mappings the value mappings
+ */
+ public void setValueMappings(@Nullable final Map<String,String> mappings) {
+ checkSetterPreconditions();
+
+ if (mappings != null) {
+ valueMappings = new HashMap<>();
+ // Needs to allow for null values.
+ for (final Map.Entry<String,String> entry : mappings.entrySet()) {
+ if (entry.getKey() != null) {
+ valueMappings.put(entry.getKey(), StringSupport.trimOrNull(entry.getValue()));
+ }
+ }
+ } else {
+ valueMappings = CollectionSupport.emptyMap();
+ }
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public Collection<Principal> apply(@Nullable final ProfileRequestContext input) {
+ checkComponentActive();
+
+ final AttributeContext attributeCtx = attributeContextLookupStrategy.apply(input);
+ if (attributeCtx == null) {
+ log.warn("No AttributeContext found");
+ return null;
+ } else if (attributeCtx.getIdPAttributes().isEmpty()) {
+ log.warn("No filtered IdPAttributes found in AttributeContext");
+ return null;
+ }
+
+ final Set<Principal> accumulator = new HashSet<>();
+
+ attributeCtx.getIdPAttributes().values().stream()
+ .filter(a -> attributeSourceIDs.contains(a.getId()))
+ .forEach(a -> addMappedValues(accumulator, a));
+
+ return accumulator.isEmpty() ? null : accumulator;
+ }
+
+ private void addMappedValues(@Nonnull final Set<Principal> results,
+ @Nonnull final IdPAttribute source) {
+
+ source.getValues().stream()
+ .filter(StringAttributeValue.class::isInstance)
+ .map(StringAttributeValue.class::cast)
+ .map(StringAttributeValue::getValue)
+ .forEach(v -> {
+ if (valueMappings.containsKey(v)) {
+ final String mapped = valueMappings.get(v);
+ if (mapped != null) {
+ log.debug("Attrbute value for {} mapped to AuthnContextClassRef {}", source.getId(), mapped);
+ results.add(new AuthnContextClassRefPrincipal(mapped));
+ } else {
+ log.debug("Skipping suppressed attribute value for {}", source.getId());
+ }
+ } else {
+ final String trimmed = StringSupport.trimOrNull(v);
+ if (trimmed != null) {
+ log.debug("Attrbute value for {} passed through as AuthnContextClassRef {}", source.getId(),
+ trimmed);
+ results.add(new AuthnContextClassRefPrincipal(trimmed));
+ }
+ }
+ });
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list