Fwd: [java-identity-provider COMMIT] /trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/logic/EntitiesDesc...

[Brent Putman]

I saw this go by, and also the AttributeRequesterInEntityGroupPolicyRule...

Didn't we want in v3 to avoid using explicit references to
EntitiesDescriptors as a concept?  And in terms of implementation, use
the new object metadata EntitiesDescriptorGroupName, rather than coding
to looking at EntitiesDescriptors? 

For the impl, we'd need to declare the NodeProcessingMetadataFilter,
with the desired MetadataNodeProcessors, e.g.
EntitiesDescriptorNameProcessor.  (We need to do that anyway for the
KeyAuthorityNodeProcessor, otherwise the legacy PKIX trust engine stuff
won't work.   Unless we make that support optional, commented out, etc.)

Walking the tree for the EntitiesDescriptors as below does currently
work, because the metadata resolvers don't currently destroy or mutate
the tree structure.  But with our new EntityDescriptor-centric focus,
that's not guaranteed to always be the case - unless we decide that
preserving it is a requirement, but that would be moving in the opposite
direction from what I thought we wanted.





-------- Original Message --------
Subject: 	[java-identity-provider COMMIT]
/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/logic/EntitiesDesc...

Date: 	Thu, 29 May 2014 22:53:53 -0000
From: 	noreply at shibboleth.net
Reply-To: 	noreply at shibboleth.net
To: 	commits at shibboleth.net



Author: scantor
Date: Thu May 29 18:53:52 2014
New Revision: 6000

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6000&view=rev
Log:
Predicate for EntitiesDescriptor membership.

Modified:
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/logic/EntitiesDescriptorPredicate.java

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/logic/EntitiesDescriptorPredicate.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/logic/EntitiesDescriptorPredicate.java?rev=6000&r1=5999&r2=6000&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/logic/EntitiesDescriptorPredicate.java (original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/logic/EntitiesDescriptorPredicate.java Thu May 29 18:53:52 2014
@@ -20,12 +20,22 @@
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
+import org.opensaml.core.xml.XMLObject;
+import org.opensaml.messaging.context.BaseContext;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
 import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
+import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
+import org.opensaml.saml.saml2.metadata.EntitiesDescriptor;
 
+import com.google.common.base.Function;
+import com.google.common.base.Functions;
 import com.google.common.base.Predicate;
 
 /**
@@ -33,7 +43,10 @@
  * {@link EntitiesDescriptor} groups. 
  */
 public class EntitiesDescriptorPredicate implements Predicate<ProfileRequestContext> {
-
+    
+    /** Strategy function to lookup SAMLMetadataContext. */
+    @Nonnull private Function<ProfileRequestContext,SAMLMetadataContext> metadataContextLookupStrategy;
+    
     /** Group to match. */
     @Nonnull @NotEmpty private final String groupName;
     
@@ -44,12 +57,60 @@
      */
     public EntitiesDescriptorPredicate(@Nonnull @NotEmpty final String name) {
         groupName = Constraint.isNotNull(StringSupport.trimOrNull(name), "Group name cannot be null or empty");
+        
+        // Default is PRC -> RPC -> SAML Peer -> Metadata
+        metadataContextLookupStrategy = Functions.compose(
+                Functions.compose(new ChildContextLookup<>(SAMLMetadataContext.class), new SAMLPeerEntityLookup()),
+                new ChildContextLookup<ProfileRequestContext,RelyingPartyContext>(RelyingPartyContext.class));
+    }
+    
+    /**
+     * Set the lookup strategy to use to locate the {@link SAMLMetadataContext}.
+     * 
+     * @param strategy lookup function to use
+     */
+    public synchronized void setMetadataContextLookupStrategy(
+            @Nonnull final Function<ProfileRequestContext,SAMLMetadataContext> strategy) {
+
+        metadataContextLookupStrategy =
+                Constraint.isNotNull(strategy, "SAMLMetadataContext lookup strategy cannot be null");
     }
 
     /** {@inheritDoc} */
-    @Override public boolean apply(@Nullable ProfileRequestContext arg0) {
-        // TODO
+    @Override
+    public boolean apply(@Nullable final ProfileRequestContext input) {
+        final SAMLMetadataContext metadataCtx = metadataContextLookupStrategy.apply(input);
+        if (metadataCtx != null && metadataCtx.getEntityDescriptor() != null) {
+            XMLObject group = metadataCtx.getEntityDescriptor().getParent();
+            while (group != null && group instanceof EntitiesDescriptor) {
+                if (((EntitiesDescriptor) group).getName() != null
+                        && groupName.equals(((EntitiesDescriptor) group).getName())) {
+                    return true;
+                }
+                group = group.getParent();
+            }
+        }
+        
         return false;
+    }
+    
+    /** A function to access a SAMLPeerEntityContext underlying a RelyingPartyContext. */
+    private class SAMLPeerEntityLookup implements ContextDataLookupFunction<RelyingPartyContext,SAMLPeerEntityContext> {
+
+        /** {@inheritDoc} */
+        @Override
+        @Nullable public SAMLPeerEntityContext apply(@Nullable final RelyingPartyContext input) {
+            
+            if (input != null) {
+                final BaseContext peer = input.getRelyingPartyIdContextTree();
+                if (peer != null && peer instanceof SAMLPeerEntityContext) {
+                    return (SAMLPeerEntityContext) peer;
+                }
+            }
+            
+            return null;
+        }

[... 5 lines stripped ...]



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140530/7db07a17/attachment-0001.html