[java-plugin-shibd] branch main updated: JSHIBD-8 - Add authorization layer for limiting use of vhosts by agent

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd/commit/94fefcf536a683922d91e095ef3b6c1e13ecc1cd

The following commit(s) were added to refs/heads/main by this push:
     new 94fefcf  JSHIBD-8 - Add authorization layer for limiting use of vhosts by agent
94fefcf is described below

commit 94fefcf536a683922d91e095ef3b6c1e13ecc1cd
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Wed Oct 7 12:49:16 2026 -0400

    JSHIBD-8 - Add authorization layer for limiting use of vhosts by agent
    
    https://shibboleth.atlassian.net/browse/JSHIBD-8
---
 .../META-INF/net.shibboleth.idp/postconfig.xml     |  4 +++
 .../profile/BasicTokenConsumerFlowDescriptor.java  | 30 ++++++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index 18d188d..b3a218f 100644
--- a/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/sp-conf-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -103,6 +103,10 @@
         class="net.shibboleth.sp.profile.impl.LogoutConsumerFlowDescriptorManager"
         p:components="#{getObject('shibboleth.sp.AvailableLogoutConsumerFlows')}" />
 
+    <bean id="shibboleth.sp.TokenConsumerFlowDescriptor"
+        class="net.shibboleth.sp.profile.BasicTokenConsumerFlowDescriptor" abstract="true"
+        p:policyCondition-ref="#{'%{sp.policy.tokenConsumerPolicyCondition:shibboleth.Conditions.TRUE}'.trim()}" />
+
     <!-- Flow Descriptor for built-in discovery flow. -->
     
     <bean id="shibboleth.sp.DiscoveryParameterCondition"
diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/profile/BasicTokenConsumerFlowDescriptor.java b/sp-server-api/src/main/java/net/shibboleth/sp/profile/BasicTokenConsumerFlowDescriptor.java
index f858c14..bc48d65 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/profile/BasicTokenConsumerFlowDescriptor.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/profile/BasicTokenConsumerFlowDescriptor.java
@@ -23,6 +23,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
 import com.google.common.base.MoreObjects;
 
 import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
+import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.logic.PredicateSupport;
 
@@ -34,10 +35,14 @@ public class BasicTokenConsumerFlowDescriptor extends AbstractIdentifiableInitia
     
     /** Whether this flow supports a particular request. */
     @Nonnull private Predicate<ProfileRequestContext> activationCondition;
+
+    /** A second condition combined into the installed activation condition. */
+    @Nonnull private Predicate<ProfileRequestContext> policyCondition;
     
     /** Constructor. */
     public BasicTokenConsumerFlowDescriptor() {
         activationCondition = PredicateSupport.alwaysFalse();
+        policyCondition = PredicateSupport.alwaysTrue();
     }
 
     /** {@inheritDoc} */
@@ -55,7 +60,32 @@ public class BasicTokenConsumerFlowDescriptor extends AbstractIdentifiableInitia
     public void setActivationCondition(@Nonnull final Predicate<ProfileRequestContext> condition) {
         activationCondition = Constraint.isNotNull(condition, "Activation condition cannot be null");
     }
+
+    /**
+     * Set policy condition to determine whether to run this flow.
+     * 
+     * <p>This is a separately defined activation condition that simplifies the installation of
+     * a condition that operates independently of the specifics of the flow but focuses on the
+     * ability to regulate the content of the message being processed by a particular Agent, such
+     * as limitaing the URL(s) an Agent is "allowed" to process requests for.</p>
+     * 
+     * <p>Defaults to true/off and is ignored.</p>
+     * 
+     * @param condition condition to use
+     */
+    public void setPolicyCondition(@Nonnull final Predicate<ProfileRequestContext> condition) {
+        policyCondition = Constraint.isNotNull(condition, "Policy condition cannot be null");
+    }
     
+    /** {@inheritDoc} */
+    @Override
+    protected void doInitialize() throws ComponentInitializationException {
+        super.doInitialize();
+        
+        // Reset the final condition to combine the two conditions.
+        activationCondition = PredicateSupport.and(activationCondition, policyCondition);
+    }
+
     /** {@inheritDoc} */
     @Override public int hashCode() {
         return ensureId().hashCode();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.