[java-plugin-shibd-saml] branch main updated: JSHIBDSAML-10 - Add AttributeQuery profile bean(s) for DataConnector
Codeberg
noreply at shibboleth.net
Tue Oct 20 16:10:37 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-plugin-shibd-saml.
View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-saml/commit/376e999fb8b9f2ba411718a439e04bcf42b2face
The following commit(s) were added to refs/heads/main by this push:
new 376e999 JSHIBDSAML-10 - Add AttributeQuery profile bean(s) for DataConnector
376e999 is described below
commit 376e999fb8b9f2ba411718a439e04bcf42b2face
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Tue Oct 20 12:10:17 2026 -0400
JSHIBDSAML-10 - Add AttributeQuery profile bean(s) for DataConnector
https://shibboleth.atlassian.net/browse/JSHIBDSAML-10
SP-specific profile class added for necessary interface.
---
.../net/shibboleth/sp/service/agent/postconfig.xml | 6 +
.../impl/AttributeQueryProfileConfiguration.java | 208 +++++++++++++++++++++
2 files changed, 214 insertions(+)
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
index 3b6fa25..1da5107 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
@@ -33,6 +33,7 @@
<ref bean="SAML2.SSO" />
<ref bean="SAML2.ECP" />
<ref bean="SAML2.Logout" />
+ <ref bean="SAML2.AttributeQuery" />
</list>
</property>
<property name="metadataDrivenDefaultProfileConfigurations">
@@ -86,6 +87,11 @@
p:encryptionOptionalPredicate="%{sp.saml.encryption.optional:true}"
p:asynchronousPredicate="%{sp.saml.logout.asynchronous:true}" />
+ <bean id="SAML2.AttributeQuery" lazy-init="true"
+ class="net.shibboleth.sp.saml.saml2.profile.config.impl.AttributeQueryProfileConfiguration"
+ p:securityConfiguration-ref="%{sp.saml.security.config:shibboleth.sp.DefaultXMLSecurityConfiguration}" />
+
+
<!--
Security Configuration Defaults
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/AttributeQueryProfileConfiguration.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/AttributeQueryProfileConfiguration.java
new file mode 100644
index 0000000..0dba792
--- /dev/null
+++ b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/AttributeQueryProfileConfiguration.java
@@ -0,0 +1,208 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.sp.saml.saml2.profile.config.impl;
+
+import java.util.Collection;
+import java.util.function.Function;
+import java.util.function.Predicate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate;
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.idp.attribute.IdPAttribute;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.logic.PredicateSupport;
+import net.shibboleth.shared.primitive.StringSupport;
+
+/** Configuration support for IdP SAML 2.0 attribute query profile. */
+public class AttributeQueryProfileConfiguration extends AbstractSAML2ProfileConfiguration
+ implements net.shibboleth.saml.saml2.profile.config.AttributeQueryProfileConfiguration {
+
+ /** Name of profile counter. */
+ @Nonnull @NotEmpty public static final String PROFILE_COUNTER = "net.shibboleth.idp.profiles.sam2.query.attribute";
+
+ /** Lookup strategy for requested IdP attribute names to pass into resolver. */
+ @Nonnull private Function<ProfileRequestContext,Collection<String>> requestedIdPAttributeNamesLookupStrategy;
+
+ /** Lookup strategy for attribute recipient group ID. */
+ @Nonnull private Function<ProfileRequestContext,String> attributeRecipientGroupIDLookupStrategy;
+
+ /** Predicate used to determine if SOAP-based requests should be signed. */
+ @Nonnull private Predicate<MessageContext> signSOAPRequestsPredicate;
+
+ /** Predicate used to determine if SOAP-based requests should use client TLS. */
+ @Nonnull private Predicate<MessageContext> clientTLSSOAPRequestsPredicate;
+
+ /** Constructor. */
+ public AttributeQueryProfileConfiguration() {
+ this(PROFILE_ID);
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param profileId unique ID for this profile
+ */
+ protected AttributeQueryProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
+ super(profileId);
+
+ requestedIdPAttributeNamesLookupStrategy = FunctionSupport.constant(null);
+ attributeRecipientGroupIDLookupStrategy = FunctionSupport.constant(null);
+
+ signSOAPRequestsPredicate = new NoIntegrityMessageChannelPredicate();
+ final Predicate<MessageContext> cltsrp = new NoIntegrityMessageChannelPredicate().negate();
+ assert cltsrp!=null;
+ clientTLSSOAPRequestsPredicate = cltsrp;
+ }
+
+ /** {@inheritDoc} */
+ public boolean isResolveAttributes(@Nullable final ProfileRequestContext profileRequestContext) {
+ return true;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull @Unmodifiable @NotLive public Collection<String> getRequestedIdPAttributeNames(
+ @Nullable final ProfileRequestContext profileRequestContext) {
+ final Collection<String> names = requestedIdPAttributeNamesLookupStrategy.apply(profileRequestContext);
+ if (names != null) {
+ return CollectionSupport.copyToSet(names);
+ }
+ return CollectionSupport.emptySet();
+ }
+
+ /**
+ * Set {@link IdPAttribute} names to resolve (if resolving attributes).
+ *
+ * @param names {@link IdPAttribute} names to resolve
+ *
+ * @since 5.2.0
+ */
+ public void setRequestedIdPAttributeNames(@Nullable final Collection<String> names) {
+ if (names == null || names.isEmpty()) {
+ requestedIdPAttributeNamesLookupStrategy = FunctionSupport.constant(null);
+ } else {
+ requestedIdPAttributeNamesLookupStrategy = FunctionSupport.constant(
+ CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(names)));
+ }
+ }
+
+ /**
+ * Lookup strategy for {@link IdPAttribute} names to resolve (if resolving attributes).
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 5.2.0
+ */
+ public void setRequestedIdPAttributeNamesLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,Collection<String>> strategy) {
+ requestedIdPAttributeNamesLookupStrategy =
+ Constraint.isNotNull(strategy, "Requested IdPAttribute names lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Nullable public String getAttributeRecipientGroupID(@Nullable final ProfileRequestContext profileRequestContext) {
+ return attributeRecipientGroupIDLookupStrategy.apply(profileRequestContext);
+ }
+
+ /**
+ * Set the group of services for which attributes are being resolved.
+ *
+ * @param groupID group identifier
+ *
+ * @since 5.2.0
+ */
+ public void setAttributeRecipientGroupID(@Nullable final String groupID) {
+ attributeRecipientGroupIDLookupStrategy = FunctionSupport.constant(groupID);
+ }
+
+ /**
+ * Set the lookup strategy for the group of services for which attributes are being resolved.
+ *
+ * @param strategy lookup strategy
+ *
+ * @since 5.2.0
+ */
+ public void setAttributeRecipientGroupIDLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,String> strategy) {
+ attributeRecipientGroupIDLookupStrategy =
+ Constraint.isNotNull(strategy, "Group ID lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ public boolean isSignSOAPRequests(@Nullable final MessageContext messageContext) {
+ return signSOAPRequestsPredicate.test(messageContext);
+ }
+
+ /**
+ * Set whether SOAP-based requests should be signed.
+ *
+ * @param flag flag to set
+ *
+ * @since 5.2.0
+ */
+ public void setSignSOAPRequests(final boolean flag) {
+ signSOAPRequestsPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
+
+ /**
+ * Set the predicate used to determine if SOAP-based requests should be signed.
+ *
+ * @param predicate the predicate
+ *
+ * @since 5.2.0
+ */
+ public void setSignSOAPRequestsPredicate(@Nonnull final Predicate<MessageContext> predicate) {
+ signSOAPRequestsPredicate = Constraint.isNotNull(predicate,
+ "Predicate used to determine SOAP-based signing cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ public boolean isClientTLSSOAPRequests(@Nullable final MessageContext messageContext) {
+ return clientTLSSOAPRequestsPredicate.test(messageContext);
+ }
+
+ /**
+ * Set whether SOAP-based requests should use client TLS.
+ *
+ * @param flag flag to set
+ *
+ * @since 5.2.0
+ */
+ public void setClientTLSSOAPRequests(final boolean flag) {
+ clientTLSSOAPRequestsPredicate = flag ? PredicateSupport.alwaysTrue() : PredicateSupport.alwaysFalse();
+ }
+
+ /**
+ * Set the predicate used to determine if SOAP-based requests should use client TLS.
+ *
+ * @param predicate the predicate
+ *
+ * @since 5.2.0
+ */
+ public void setClientTLSSOAPRequestsPredicate(@Nonnull final Predicate<MessageContext> predicate) {
+ clientTLSSOAPRequestsPredicate = Constraint.isNotNull(predicate,
+ "Predicate used to determine SOAP-based client TLS use cannot be null");
+ }
+
+}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list