[java-shib-metadata] branch main updated: JSMD-14 - Filter to add/remove Scope extension
Codeberg
noreply at shibboleth.net
Wed Jan 21 13:56:32 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-shib-metadata.
View the commit online:
https://codeberg.org/Shibboleth/java-shib-metadata/commit/67c62e2287a54fbf684fcb50ca485ea3f7e35ddd
The following commit(s) were added to refs/heads/main by this push:
new 67c62e22 JSMD-14 - Filter to add/remove Scope extension
67c62e22 is described below
commit 67c62e2287a54fbf684fcb50ca485ea3f7e35ddd
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jan 21 08:56:19 2026 -0500
JSMD-14 - Filter to add/remove Scope extension
https://shibboleth.atlassian.net/browse/JSMD-14
Adjust docs, add more parser tests.
---
.../idp/saml/metadata/impl/ScopeFilter.java | 9 ++-
.../spring/metadata/filter/ScopeFilterParser.java | 4 +-
.../metadata/filter/ScopeFilterParserTest.java | 60 +++++++---------
.../spring/metadata/filter/scopeRemoveOnly.xml | 82 ++++++++++++++++++++++
4 files changed, 116 insertions(+), 39 deletions(-)
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ScopeFilter.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ScopeFilter.java
index f46f6d63..14317469 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ScopeFilter.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ScopeFilter.java
@@ -46,14 +46,17 @@ import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
/**
- * A filter that adds the {@link Scope} extension to entities in order to drive software
+ * A filter that adds the {@link Scope} extension to roles in order to drive software
* behavior based on them.
*
* <p>The entities to annotate are identified with a {@link Predicate}, and multiple scopes can be
* associated with each, with and without the regexp flag.</p>
*
- * <p>Note that this filter only operates on extensions defined at the {@link EntityDescriptor} level
- * and not on individual roles. Role-specific scopes are discouraged in general.</p>
+ * <p>Note that this filter only operates on extensions defined at the {@link RoleDescriptor} level.
+ * When removing existing extensions, it will strip any found at both the top level and on each role.
+ * All roles are modified, regardless of type, though this is not always sensible.</p>
+ *
+ * @since 5.2.0
*/
public class ScopeFilter extends AbstractMetadataFilter {
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/ScopeFilterParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/ScopeFilterParser.java
index f1a67e06..7d6ec901 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/ScopeFilterParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/ScopeFilterParser.java
@@ -46,9 +46,9 @@ import net.shibboleth.spring.ScriptTypeBeanParser;
import net.shibboleth.spring.metadata.AbstractMetadataProviderParser;
/**
- * Parser for Algorithm filter.
+ * Parser for Scope filter.
*
- * @since 4.0.0
+ * @since 5.2.0
*/
public class ScopeFilterParser extends AbstractMetadataFilterParser {
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/ScopeFilterParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/ScopeFilterParserTest.java
index a066c5ff..09150598 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/ScopeFilterParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/ScopeFilterParserTest.java
@@ -36,30 +36,18 @@ import org.testng.annotations.Test;
@SuppressWarnings("javadoc")
public class ScopeFilterParserTest extends AbstractMetadataParserTest {
-
- @Test
- public void test() throws ResolverException, IOException {
- doTest("filter/scope.xml");
- }
-
- /*
- @Test
- public void testRegex() throws ResolverException, IOException {
- doTest("filter/algorithmRegex.xml");
- }
@Test
- public void testFilterScript() throws ResolverException, IOException {
- doTest("filter/algorithmWithScript.xml");
+ public void testRemoveOnly() throws ResolverException, IOException {
+ doTest(true, "filter/scopeRemoveOnly.xml");
}
-
+
@Test
- public void testFilterScriptResource() throws ResolverException, IOException {
- doTest("filter/algorithmWithScriptResource.xml");
+ public void test() throws ResolverException, IOException {
+ doTest(false, "filter/scope.xml");
}
- */
- private void doTest(final String... files) throws ResolverException, IOException {
+ private void doTest(boolean removed, final String... files) throws ResolverException, IOException {
final MetadataResolver resolver = getBean(MetadataResolver.class, files);
@@ -68,12 +56,12 @@ public class ScopeFilterParserTest extends AbstractMetadataParserTest {
EntityIdCriterion crit = new EntityIdCriterion("https://sp.example.org/sp/shibboleth");
EntityDescriptor entity = resolver.resolveSingle(new CriteriaSet(crit));
- validate(entity);
+ validate(entity, removed);
crit = new EntityIdCriterion("https://sp4.example.org/sp/shibboleth");
entity = resolver.resolveSingle(new CriteriaSet(crit));
if (entity != null) {
- validate(entity);
+ validate(entity, removed);
}
crit = new EntityIdCriterion("https://sp2.example.org/sp/shibboleth");
@@ -86,22 +74,26 @@ public class ScopeFilterParserTest extends AbstractMetadataParserTest {
}
}
- private void validate(final EntityDescriptor entity) {
+ private void validate(final EntityDescriptor entity, boolean removed) {
for (final RoleDescriptor role : entity.getRoleDescriptors()) {
final Extensions exts = role.getExtensions();
- assert exts != null;
-
- final List<XMLObject> scopes = exts.getUnknownXMLObjects(Scope.DEFAULT_ELEMENT_NAME);
-
- assertEquals(scopes.size(), 2);
-
- final Scope scope1 = (Scope) scopes.get(0);
- Assert.assertEquals(scope1.getValue(), "example.org");
- Assert.assertEquals(scope1.getRegexp(), false);
-
- final Scope scope2 = (Scope) scopes.get(1);
- Assert.assertEquals(scope2.getValue(), "sub.example.org");
- Assert.assertEquals(scope2.getRegexp(), true);
+ if (removed) {
+ Assert.assertTrue(exts == null || exts.getUnknownXMLObjects(Scope.DEFAULT_ELEMENT_NAME).isEmpty());
+ } else {
+ assert exts != null;
+
+ final List<XMLObject> scopes = exts.getUnknownXMLObjects(Scope.DEFAULT_ELEMENT_NAME);
+
+ assertEquals(scopes.size(), 2);
+
+ final Scope scope1 = (Scope) scopes.get(0);
+ Assert.assertEquals(scope1.getValue(), "example.org");
+ Assert.assertEquals(scope1.getRegexp(), false);
+
+ final Scope scope2 = (Scope) scopes.get(1);
+ Assert.assertEquals(scope2.getValue(), "sub.example.org");
+ Assert.assertEquals(scope2.getRegexp(), true);
+ }
}
}
diff --git a/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/filter/scopeRemoveOnly.xml b/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/filter/scopeRemoveOnly.xml
new file mode 100644
index 00000000..f7109e80
--- /dev/null
+++ b/shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/filter/scopeRemoveOnly.xml
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata:MetadataProvider xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:metadata="urn:mace:shibboleth:2.0:metadata"
+ xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+ xmlns:shibmdext="urn:mace:shibboleth:metadata:1.0"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
+ urn:oasis:names:tc:SAML:2.0:assertion http://docs.oasis-open.org/security/saml/v2.0/saml-schema-assertion-2.0.xsd
+ urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd
+ urn:mace:shibboleth:metadata:1.0 http://shibboleth.net/schema/idp/shibboleth-metadata-1.0.xsd
+ http://www.w3.org/2009/xmlenc11# http://www.w3.org/TR/2013/REC-xmlenc-core1-20130411/xenc-schema-11.xsd"
+
+ failFastInitialization="false" requireValidMetadata="false"
+
+ id="scopes" xsi:type="metadata:InlineMetadataProvider">
+
+ <metadata:MetadataFilter xsi:type="metadata:Scope" removeExistingScopes="true">
+ <metadata:Entity>https://sp.example.org/sp/shibboleth</metadata:Entity>
+ <metadata:Entity>https://sp3.example.org/sp/shibboleth</metadata:Entity>
+ <metadata:Entity>https://sp4.example.org/sp/shibboleth</metadata:Entity>
+ <metadata:ConditionScript language="javascript">
+ <metadata:Script>input.getEntityID().equals("https://sp3.example.org/sp/shibboleth");</metadata:Script>
+ </metadata:ConditionScript>
+ </metadata:MetadataFilter>
+
+ <EntitiesDescriptor Name="ukgroup">
+ <EntityDescriptor
+ entityID="https://sp.example.org/sp/shibboleth">
+ <Extensions>
+ <shibmdext:Scope regexp="false">example.org</shibmdext:Scope>
+ <shibmdext:Scope regexp="true">sub.example.org</shibmdext:Scope>
+ </Extensions>
+ <SPSSODescriptor
+ protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
+
+ <Extensions>
+ <shibmdext:Scope regexp="false">example.org</shibmdext:Scope>
+ <shibmdext:Scope regexp="true">sub.example.org</shibmdext:Scope>
+ </Extensions>
+
+ <AssertionConsumerService
+ Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
+ Location="https://sp.example.org/Shibboleth.sso/SAML2/POST-SimpleSign"
+ index="5" />
+ </SPSSODescriptor>
+ </EntityDescriptor>
+
+ <EntityDescriptor
+ entityID="https://sp2.example.org/sp/shibboleth">
+ <SPSSODescriptor
+ protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
+
+ <Extensions>
+ <shibmdext:Scope regexp="false">example.org</shibmdext:Scope>
+ <shibmdext:Scope regexp="true">sub.example.org</shibmdext:Scope>
+ </Extensions>
+
+ <AssertionConsumerService
+ Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
+ Location="https://sp2.example.org/Shibboleth.sso/SAML2/POST-SimpleSign"
+ index="5" />
+ </SPSSODescriptor>
+ </EntityDescriptor>
+
+ <EntityDescriptor
+ entityID="https://sp4.example.org/sp/shibboleth">
+ <SPSSODescriptor
+ protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
+
+ <Extensions>
+ <shibmdext:Scope regexp="false">example.org</shibmdext:Scope>
+ <shibmdext:Scope regexp="true">sub.example.org</shibmdext:Scope>
+ </Extensions>
+
+ <AssertionConsumerService
+ Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
+ Location="https://sp4.example.org/Shibboleth.sso/SAML2/POST-SimpleSign"
+ index="5" />
+ </SPSSODescriptor>
+ </EntityDescriptor>
+ </EntitiesDescriptor>
+</metadata:MetadataProvider>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list