[java-plugin-shibd-saml] branch main updated: JSHIBDSAML-5 - Audit extractors for encryption information
Codeberg
noreply at shibboleth.net
Wed Jul 1 19:13:53 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-saml/commit/8a4d03d5e2b2742f472e2df3877f09a957575316
The following commit(s) were added to refs/heads/main by this push:
new 8a4d03d JSHIBDSAML-5 - Audit extractors for encryption information
8a4d03d is described below
commit 8a4d03d5e2b2742f472e2df3877f09a957575316
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Wed Jul 1 15:13:44 2026 -0400
JSHIBDSAML-5 - Audit extractors for encryption information
https://shibboleth.atlassian.net/browse/JSHIBDSAML-5
Added more suitable functions and wired into inbound auditing.
---
.../META-INF/net.shibboleth.idp/postconfig.xml | 42 ++++++
.../impl/EncryptedAssertionAuditExtractor.java | 62 +++++++++
.../InboundEncryptionAlgorithmAuditExtractor.java | 154 +++++++++++++++++++++
.../sp/saml/saml2/audit/impl/package-info.java | 18 +++
4 files changed, 276 insertions(+)
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 19711e1..bc631b2 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -301,6 +301,18 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.ENCRYPTION_ALGORITHM"/>
+ </key>
+ <bean class="net.shibboleth.sp.saml.saml2.audit.impl.InboundEncryptionAlgorithmAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
</map>
</property>
</bean>
@@ -359,6 +371,30 @@
<constructor-arg name="f" ref="shibboleth.MessageContextLookup.Inbound"/>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.ENCRYPTION"/>
+ </key>
+ <bean class="net.shibboleth.sp.saml.saml2.audit.impl.EncryptedAssertionAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.ENCRYPTION_ALGORITHM"/>
+ </key>
+ <bean class="net.shibboleth.sp.saml.saml2.audit.impl.InboundEncryptionAlgorithmAuditExtractor">
+ <constructor-arg>
+ <bean parent="shibboleth.Functions.Compose"
+ c:g-ref="shibboleth.MessageLookup.SAMLObject"
+ c:f-ref="shibboleth.MessageContextLookup.Inbound" />
+ </constructor-arg>
+ </bean>
+ </entry>
<entry>
<key>
<util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.RESPONSE_ID"/>
@@ -645,6 +681,12 @@
</constructor-arg>
</bean>
</entry>
+ <entry>
+ <key>
+ <util:constant static-field="net.shibboleth.idp.saml.profile.SAMLAuditFields.ENCRYPTION_ALGORITHM"/>
+ </key>
+ <bean class="net.shibboleth.idp.saml.audit.impl.EncryptionAlgorithmAuditExtractor" />
+ </entry>
</map>
</property>
</bean>
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/audit/impl/EncryptedAssertionAuditExtractor.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/audit/impl/EncryptedAssertionAuditExtractor.java
new file mode 100644
index 0000000..e7e315c
--- /dev/null
+++ b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/audit/impl/EncryptedAssertionAuditExtractor.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.saml.saml2.audit.impl;
+
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.SAMLObject;
+import org.opensaml.saml.saml2.core.ArtifactResponse;
+import org.opensaml.saml.saml2.core.Response;
+
+import net.shibboleth.shared.logic.Constraint;
+
+/** {@link Function} that returns {@link Boolean#TRUE} if an encrypted assertion is present in a {@link Response}. */
+public class EncryptedAssertionAuditExtractor implements Function<ProfileRequestContext,Boolean> {
+
+ /** Lookup strategy for message to read from. */
+ @Nonnull private final Function<ProfileRequestContext,SAMLObject> messageLookupStrategy;
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for message
+ */
+ public EncryptedAssertionAuditExtractor(@Nonnull final Function<ProfileRequestContext,SAMLObject> strategy) {
+ messageLookupStrategy = Constraint.isNotNull(strategy, "Message lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public Boolean apply(@Nullable final ProfileRequestContext input) {
+ SAMLObject msg = messageLookupStrategy.apply(input);
+ if (msg != null) {
+
+ // Step down into ArtifactResponses.
+ if (msg instanceof ArtifactResponse ar) {
+ msg = ar.getMessage();
+ }
+
+ if (msg instanceof Response resp) {
+ return !resp.getEncryptedAssertions().isEmpty();
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/audit/impl/InboundEncryptionAlgorithmAuditExtractor.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/audit/impl/InboundEncryptionAlgorithmAuditExtractor.java
new file mode 100644
index 0000000..032ef26
--- /dev/null
+++ b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/audit/impl/InboundEncryptionAlgorithmAuditExtractor.java
@@ -0,0 +1,154 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.saml.saml2.audit.impl;
+
+import java.util.List;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.SAMLObject;
+import org.opensaml.saml.saml2.core.ArtifactResponse;
+import org.opensaml.saml.saml2.core.Assertion;
+import org.opensaml.saml.saml2.core.AttributeStatement;
+import org.opensaml.saml.saml2.core.EncryptedAssertion;
+import org.opensaml.saml.saml2.core.EncryptedAttribute;
+import org.opensaml.saml.saml2.core.EncryptedID;
+import org.opensaml.saml.saml2.core.LogoutRequest;
+import org.opensaml.saml.saml2.core.Response;
+import org.opensaml.saml.saml2.core.Subject;
+import org.opensaml.xmlsec.encryption.EncryptedData;
+import org.opensaml.xmlsec.encryption.EncryptionMethod;
+
+import net.shibboleth.shared.logic.Constraint;
+
+/** {@link Function} that returns the first encryption algorithm found in a SAML message. */
+public class InboundEncryptionAlgorithmAuditExtractor implements Function<ProfileRequestContext,String> {
+
+ /** Lookup strategy for message to read from. */
+ @Nonnull private final Function<ProfileRequestContext,SAMLObject> messageLookupStrategy;
+
+ /**
+ * Constructor.
+ *
+ * @param strategy lookup strategy for message
+ */
+ public InboundEncryptionAlgorithmAuditExtractor(@Nonnull final Function<ProfileRequestContext,SAMLObject> strategy) {
+ messageLookupStrategy = Constraint.isNotNull(strategy, "Message lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public String apply(@Nullable final ProfileRequestContext input) {
+ SAMLObject msg = messageLookupStrategy.apply(input);
+ if (msg != null) {
+
+ // Step down into ArtifactResponses.
+ if (msg instanceof ArtifactResponse ar) {
+ msg = ar.getMessage();
+ }
+
+ if (msg instanceof Response resp) {
+ for (final EncryptedAssertion assertion : resp.getEncryptedAssertions()) {
+ assert assertion != null;
+ final String alg = apply(assertion.getEncryptedData());
+ if (alg != null) {
+ return alg;
+ }
+ }
+
+ for (final Assertion assertion : resp.getAssertions()) {
+ assert assertion != null;
+ final String alg = apply(assertion);
+ if (alg != null) {
+ return alg;
+ }
+ }
+ } else if (msg instanceof LogoutRequest logout) {
+ final EncryptedID nameID = logout.getEncryptedID();
+ if (nameID != null) {
+ final String alg = apply(nameID.getEncryptedData());
+ if (alg != null) {
+ return alg;
+ }
+ }
+
+ } else if (msg instanceof Assertion a) {
+ final String alg = apply(a);
+ if (alg != null) {
+ return alg;
+ }
+ }
+ }
+
+ return null;
+ }
+
+ /**
+ * Apply function to an {@link Assertion} object.
+ *
+ * @param assertion assertion to interrogate
+ *
+ * @return the format, or null
+ */
+ @Nullable private String apply(@Nonnull final Assertion assertion) {
+ final Subject subject = assertion.getSubject();
+ if (subject != null) {
+ final EncryptedID nameID = subject.getEncryptedID();
+ if (nameID != null) {
+ final String alg = apply(nameID.getEncryptedData());
+ if (alg != null) {
+ return alg;
+ }
+ }
+ }
+
+ final List<AttributeStatement> statements = assertion.getAttributeStatements();
+ for (final AttributeStatement statement : statements) {
+ assert statement != null;
+ final List<EncryptedAttribute> attributes = statement.getEncryptedAttributes();
+ for (final EncryptedAttribute attr : attributes) {
+ assert attr != null;
+ final String alg = apply(attr.getEncryptedData());
+ if (alg != null) {
+ return alg;
+ }
+ }
+ }
+
+ return null;
+ }
+
+ /**
+ * Apply function to an {@link EncryptedData} object.
+ *
+ * @param encryptedData object to interrogate
+ *
+ * @return the format, or null
+ */
+ @Nullable private String apply(@Nullable final EncryptedData encryptedData) {
+
+ if (encryptedData != null) {
+ final EncryptionMethod method = encryptedData.getEncryptionMethod();
+ if (method != null) {
+ return method.getAlgorithm();
+ }
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/audit/impl/package-info.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/audit/impl/package-info.java
new file mode 100644
index 0000000..0568f09
--- /dev/null
+++ b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/audit/impl/package-info.java
@@ -0,0 +1,18 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * SP-specific audit extractors.
+ */
+package net.shibboleth.sp.saml.saml2.audit.impl;
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list