[java-oidfed-common] branch main updated: Improve metadata policy merging and enforcement
Codeberg
noreply at shibboleth.net
Fri Oct 30 08:02:23 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-oidfed-common.
View the commit online:
https://codeberg.org/Shibboleth/java-oidfed-common/commit/30915fdc7e57457f717a480edfe8563bd39e7ec4
The following commit(s) were added to refs/heads/main by this push:
new 30915fd Improve metadata policy merging and enforcement
30915fd is described below
commit 30915fdc7e57457f717a480edfe8563bd39e7ec4
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Oct 30 10:01:52 2026 +0200
Improve metadata policy merging and enforcement
- Verify that the wired list of metadata policy operators is not empty
- Solely put non-null values in the merged result
- Perform one_of check also when one side of the merge is null/empty
- Fix Javadoc
---
.../DefaultFederationMetadataPolicyEnforcer.java | 9 ++---
...ultFederationMetadataPolicyMergingStrategy.java | 38 +++++++++++++---------
2 files changed, 27 insertions(+), 20 deletions(-)
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyEnforcer.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyEnforcer.java
index 82fd9d0..11602d8 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyEnforcer.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyEnforcer.java
@@ -36,9 +36,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
/**
* <p>A function that applies the given {@link MetadataPolicy} to the given object. The input is given as a {@link
* Pair} of the object and the policy. The policy is applied to the incoming object as specified in the OpenID
- * Federation specification 1.0 (draft 42 / April 2025)</p>
- *
- * <p>In addition to the standard operators, we also support regular expression validation.</p>
+ * Federation specification 1.0.</p>
*
* <p>The function returns a {@link Pair} of the object for which the value modifiers of the metadata policy have
* been applied to, and a flag indicating if the object was compatible with the value checks of the metadata policy.
@@ -60,7 +58,9 @@ public class DefaultFederationMetadataPolicyEnforcer extends AbstractIdentifiabl
*/
public void setMetadataPolicyOperators(@Nonnull final List<FederationMetadataPolicyOperator> policyOperators) {
checkSetterPreconditions();
- operators = Constraint.isNotNull(policyOperators, "List of metadata policy operators cannot be null");
+ Constraint.isNotEmpty(policyOperators, "List of metadata policy operators cannot be empty");
+ assert policyOperators != null;
+ operators = policyOperators;
}
/** {@inheritDoc} */
@@ -75,6 +75,7 @@ public class DefaultFederationMetadataPolicyEnforcer extends AbstractIdentifiabl
/** {@inheritDoc} */
@Override @Nullable public Pair<Object, Boolean> apply(@Nullable final Object candidate,
@Nullable final MetadataPolicy policy) {
+ checkComponentActive();
if (policy == null) {
return new Pair<>(candidate, Boolean.TRUE);
}
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyMergingStrategy.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyMergingStrategy.java
index 670fbc0..6257899 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyMergingStrategy.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/policy/impl/DefaultFederationMetadataPolicyMergingStrategy.java
@@ -14,7 +14,6 @@
package net.shibboleth.oidfed.metadata.policy.impl;
-import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
@@ -32,6 +31,7 @@ import net.shibboleth.oidc.metadata.policy.MetadataPolicy;
import net.shibboleth.oidc.metadata.policy.impl.MetadataPolicyHelper;
import net.shibboleth.oidfed.metadata.policy.FederationMetadataPolicyOperator;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.collection.Pair;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
@@ -41,8 +41,8 @@ import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A function that merges two maps of metadata policies according to the rules specified in the OID federation spec
- * (draft 42), section 6.1. The function returns a pair of map of merged metadata policies and a boolean indicating if
- * the merging operators in the policies were compliant.
+ * section 6.1. The function returns a pair of map of merged metadata policies and a boolean indicating if the merging
+ * operators in the policies were compliant.
*/
public class DefaultFederationMetadataPolicyMergingStrategy extends AbstractIdentifiableInitializableComponent
implements BiFunction<Map<String, MetadataPolicy>, Map<String, MetadataPolicy>,
@@ -61,7 +61,9 @@ public class DefaultFederationMetadataPolicyMergingStrategy extends AbstractIden
*/
public void setMetadataPolicyOperators(@Nonnull final List<FederationMetadataPolicyOperator> policyOperators) {
checkSetterPreconditions();
- operators = Constraint.isNotNull(policyOperators, "List of metadata policy operators cannot be null");
+ Constraint.isNotEmpty(policyOperators, "List of metadata policy operators cannot be empty");
+ assert policyOperators != null;
+ operators = policyOperators;
}
/** {@inheritDoc} */
@@ -75,13 +77,14 @@ public class DefaultFederationMetadataPolicyMergingStrategy extends AbstractIden
/** {@inheritDoc} */
@Nonnull
- public Pair<Map<String, MetadataPolicy>, Boolean> apply(@Nullable final Map<String,MetadataPolicy> first,
- @Nullable final Map<String,MetadataPolicy> second) {
- if (first == null || first.isEmpty()) {
- return new Pair<>(second == null ? (first == null ? null : Collections.emptyMap()) : second , Boolean.TRUE);
- } else if (second == null || second.isEmpty()) {
- return new Pair<>(first, Boolean.TRUE);
+ public Pair<Map<String, MetadataPolicy>, Boolean> apply(@Nullable final Map<String,MetadataPolicy> firstMap,
+ @Nullable final Map<String,MetadataPolicy> secondMap) {
+ checkComponentActive();
+ if (firstMap == null && secondMap == null) {
+ return new Pair<>(null, Boolean.TRUE);
}
+ final Map<String,MetadataPolicy> first = firstMap != null ? firstMap : CollectionSupport.emptyMap();
+ final Map<String,MetadataPolicy> second = secondMap != null ? secondMap : CollectionSupport.emptyMap();
final Set<String> combinedKeys = Stream.concat(first.keySet().stream(),
second.keySet().stream()).collect(Collectors.toSet());
final Map<String, MetadataPolicy> result = new HashMap<>();
@@ -91,22 +94,25 @@ public class DefaultFederationMetadataPolicyMergingStrategy extends AbstractIden
final MetadataPolicy merged =
MetadataPolicyHelper.mergeMetadataPolicies(first.get(key), second.get(key));
log.debug("Merging result of {} with {}: {}", first.get(key), second.get(key), merged);
- if (merged != null && merged.getOneOfValues() != null && merged.getOneOfValues().isEmpty()) {
- log.warn("Value of 'one_of' operator is empty after merging");
- valid = false;
+ if (merged != null) {
+ if (merged.getOneOfValues() != null && merged.getOneOfValues().isEmpty()) {
+ log.warn("Value of 'one_of' operator is empty after merging");
+ valid = false;
+ }
+ result.put(key, merged);
}
- result.put(key, merged);
for (final FederationMetadataPolicyOperator operator : operators) {
if (merged != null && !operator.validate(merged)) {
valid = false;
}
}
} catch (final ConstraintViolationException e) {
- log.warn("Incompatible metadata policies for claim '{}' that cannot be merged.", key);
+ log.warn("Incompatible metadata policies for claim '{}' that cannot be merged: {}", key,
+ e.getMessage());
valid = false;
}
}
- return new Pair<>(result, Boolean.valueOf(valid));
+ return new Pair<>(CollectionSupport.copyToMap(result), Boolean.valueOf(valid));
}
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list