<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
I saw this go by, and also the
AttributeRequesterInEntityGroupPolicyRule...<br>
<br>
Didn't we want in v3 to avoid using explicit references to
EntitiesDescriptors as a concept? And in terms of implementation,
use the new object metadata EntitiesDescriptorGroupName, rather than
coding to looking at EntitiesDescriptors? <br>
<br>
For the impl, we'd need to declare the NodeProcessingMetadataFilter,
with the desired MetadataNodeProcessors, e.g.
EntitiesDescriptorNameProcessor. (We need to do that anyway for the
KeyAuthorityNodeProcessor, otherwise the legacy PKIX trust engine
stuff won't work. Unless we make that support optional, commented
out, etc.)<br>
<div class="moz-forward-container"><br>
Walking the tree for the EntitiesDescriptors as below does
currently work, because the metadata resolvers don't currently
destroy or mutate the tree structure. But with our new
EntityDescriptor-centric focus, that's not guaranteed to always be
the case - unless we decide that preserving it is a requirement,
but that would be moving in the opposite direction from what I
thought we wanted.<br>
<br>
<br>
<br>
<br>
<br>
-------- Original Message --------
<table class="moz-email-headers-table" cellpadding="0"
cellspacing="0" border="0">
<tbody>
<tr>
<th nowrap="nowrap" valign="BASELINE" align="RIGHT">Subject:
</th>
<td>[java-identity-provider COMMIT]
/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/logic/EntitiesDesc...</td>
</tr>
<tr>
<th nowrap="nowrap" valign="BASELINE" align="RIGHT">Date: </th>
<td>Thu, 29 May 2014 22:53:53 -0000</td>
</tr>
<tr>
<th nowrap="nowrap" valign="BASELINE" align="RIGHT">From: </th>
<td><a class="moz-txt-link-abbreviated" href="mailto:noreply@shibboleth.net">noreply@shibboleth.net</a></td>
</tr>
<tr>
<th nowrap="nowrap" valign="BASELINE" align="RIGHT">Reply-To:
</th>
<td><a class="moz-txt-link-abbreviated" href="mailto:noreply@shibboleth.net">noreply@shibboleth.net</a></td>
</tr>
<tr>
<th nowrap="nowrap" valign="BASELINE" align="RIGHT">To: </th>
<td><a class="moz-txt-link-abbreviated" href="mailto:commits@shibboleth.net">commits@shibboleth.net</a></td>
</tr>
</tbody>
</table>
<br>
<br>
<pre>Author: scantor
Date: Thu May 29 18:53:52 2014
New Revision: 6000
URL: <a class="moz-txt-link-freetext" href="http://svn.shibboleth.net/view/java-identity-provider?rev=6000&view=rev">http://svn.shibboleth.net/view/java-identity-provider?rev=6000&view=rev</a>
Log:
Predicate for EntitiesDescriptor membership.
Modified:
trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/logic/EntitiesDescriptorPredicate.java
Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/logic/EntitiesDescriptorPredicate.java
URL: <a class="moz-txt-link-freetext" href="http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/logic/EntitiesDescriptorPredicate.java?rev=6000&r1=5999&r2=6000&view=diff">http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/logic/EntitiesDescriptorPredicate.java?rev=6000&r1=5999&r2=6000&view=diff</a>
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/logic/EntitiesDescriptorPredicate.java (original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/logic/EntitiesDescriptorPredicate.java Thu May 29 18:53:52 2014
@@ -20,12 +20,22 @@
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import net.shibboleth.idp.profile.context.RelyingPartyContext;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
+import org.opensaml.core.xml.XMLObject;
+import org.opensaml.messaging.context.BaseContext;
+import org.opensaml.messaging.context.navigate.ChildContextLookup;
+import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
+import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
+import org.opensaml.saml.saml2.metadata.EntitiesDescriptor;
+import com.google.common.base.Function;
+import com.google.common.base.Functions;
import com.google.common.base.Predicate;
/**
@@ -33,7 +43,10 @@
* {@link EntitiesDescriptor} groups.
*/
public class EntitiesDescriptorPredicate implements Predicate<ProfileRequestContext> {
-
+
+ /** Strategy function to lookup SAMLMetadataContext. */
+ @Nonnull private Function<ProfileRequestContext,SAMLMetadataContext> metadataContextLookupStrategy;
+
/** Group to match. */
@Nonnull @NotEmpty private final String groupName;
@@ -44,12 +57,60 @@
*/
public EntitiesDescriptorPredicate(@Nonnull @NotEmpty final String name) {
groupName = Constraint.isNotNull(StringSupport.trimOrNull(name), "Group name cannot be null or empty");
+
+ // Default is PRC -> RPC -> SAML Peer -> Metadata
+ metadataContextLookupStrategy = Functions.compose(
+ Functions.compose(new ChildContextLookup<>(SAMLMetadataContext.class), new SAMLPeerEntityLookup()),
+ new ChildContextLookup<ProfileRequestContext,RelyingPartyContext>(RelyingPartyContext.class));
+ }
+
+ /**
+ * Set the lookup strategy to use to locate the {@link SAMLMetadataContext}.
+ *
+ * @param strategy lookup function to use
+ */
+ public synchronized void setMetadataContextLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext,SAMLMetadataContext> strategy) {
+
+ metadataContextLookupStrategy =
+ Constraint.isNotNull(strategy, "SAMLMetadataContext lookup strategy cannot be null");
}
/** {@inheritDoc} */
- @Override public boolean apply(@Nullable ProfileRequestContext arg0) {
- // TODO
+ @Override
+ public boolean apply(@Nullable final ProfileRequestContext input) {
+ final SAMLMetadataContext metadataCtx = metadataContextLookupStrategy.apply(input);
+ if (metadataCtx != null && metadataCtx.getEntityDescriptor() != null) {
+ XMLObject group = metadataCtx.getEntityDescriptor().getParent();
+ while (group != null && group instanceof EntitiesDescriptor) {
+ if (((EntitiesDescriptor) group).getName() != null
+ && groupName.equals(((EntitiesDescriptor) group).getName())) {
+ return true;
+ }
+ group = group.getParent();
+ }
+ }
+
return false;
+ }
+
+ /** A function to access a SAMLPeerEntityContext underlying a RelyingPartyContext. */
+ private class SAMLPeerEntityLookup implements ContextDataLookupFunction<RelyingPartyContext,SAMLPeerEntityContext> {
+
+ /** {@inheritDoc} */
+ @Override
+ @Nullable public SAMLPeerEntityContext apply(@Nullable final RelyingPartyContext input) {
+
+ if (input != null) {
+ final BaseContext peer = input.getRelyingPartyIdContextTree();
+ if (peer != null && peer instanceof SAMLPeerEntityContext) {
+ return (SAMLPeerEntityContext) peer;
+ }
+ }
+
+ return null;
+ }
[... 5 lines stripped ...]
</pre>
<br>
</div>
<br>
</body>
</html>