From 0f31a4f404f1e7919f6510ea5ba92a2c6151573d Mon Sep 17 00:00:00 2001 From: Dmitriy Kopylenko Date: Mon, 9 Dec 2019 14:40:45 -0500 Subject: [PATCH] WIP --- .../AbstractAttributeExtensibleXMLObject.java | 6 +- .../admin/ui/domain/RequestInitiator.java | 4 +- .../ui/hibernate/QNameTypeContributor.java | 15 ++ .../admin/ui/hibernate/QNameUserType.java | 150 ++++++++++++++++++ .../org.hibernate.boot.model.TypeContributor | 1 + testbed/mariadb/conf/application.yml | 138 ++++++++++++++++ testbed/mariadb/conf/keystore.p12 | Bin 0 -> 2591 bytes testbed/mariadb/conf/users.csv | 2 + testbed/mariadb/docker-compose.yml | 41 +++++ 9 files changed, 350 insertions(+), 7 deletions(-) create mode 100644 backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/hibernate/QNameTypeContributor.java create mode 100644 backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/hibernate/QNameUserType.java create mode 100644 backend/src/main/resources/META-INF/services/org.hibernate.boot.model.TypeContributor create mode 100644 testbed/mariadb/conf/application.yml create mode 100644 testbed/mariadb/conf/keystore.p12 create mode 100644 testbed/mariadb/conf/users.csv create mode 100644 testbed/mariadb/docker-compose.yml diff --git a/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/domain/AbstractAttributeExtensibleXMLObject.java b/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/domain/AbstractAttributeExtensibleXMLObject.java index 60aef53e8..1d35bfc49 100644 --- a/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/domain/AbstractAttributeExtensibleXMLObject.java +++ b/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/domain/AbstractAttributeExtensibleXMLObject.java @@ -1,6 +1,7 @@ package edu.internet2.tier.shibboleth.admin.ui.domain; import lombok.EqualsAndHashCode; +import org.hibernate.annotations.Type; import org.hibernate.envers.Audited; import org.hibernate.envers.NotAudited; import org.opensaml.core.xml.AttributeExtensibleXMLObject; @@ -34,10 +35,7 @@ public AttributeMap getUnknownAttributes() { return this.unknownAttributes; } - //@ElementCollection - //@MapKeyColumn(length = 1000) - //@NotAudited - @Transient + @ElementCollection private Map storageAttributeMap = new HashMap<>(); @PrePersist diff --git a/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/domain/RequestInitiator.java b/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/domain/RequestInitiator.java index 96e08ca11..4405d2797 100644 --- a/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/domain/RequestInitiator.java +++ b/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/domain/RequestInitiator.java @@ -53,9 +53,7 @@ public void setResponseLocation(String location) { this.responseLocation = location; } - //@ElementCollection - //@MapKeyColumn(length = 1000) - @Transient + @ElementCollection private Map storageAttributeMap = new HashMap<>(); @Transient diff --git a/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/hibernate/QNameTypeContributor.java b/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/hibernate/QNameTypeContributor.java new file mode 100644 index 000000000..0cca1f713 --- /dev/null +++ b/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/hibernate/QNameTypeContributor.java @@ -0,0 +1,15 @@ +package edu.internet2.tier.shibboleth.admin.ui.hibernate; + +import org.hibernate.boot.model.TypeContributions; +import org.hibernate.boot.model.TypeContributor; +import org.hibernate.service.ServiceRegistry; + +import javax.xml.namespace.QName; + +public class QNameTypeContributor implements TypeContributor { + + @Override + public void contribute(TypeContributions typeContributions, ServiceRegistry serviceRegistry) { + typeContributions.contributeType(new QNameUserType(), "qname", QName.class.getName()); + } +} diff --git a/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/hibernate/QNameUserType.java b/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/hibernate/QNameUserType.java new file mode 100644 index 000000000..5c14dd1dd --- /dev/null +++ b/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/hibernate/QNameUserType.java @@ -0,0 +1,150 @@ +package edu.internet2.tier.shibboleth.admin.ui.hibernate; + +import org.hibernate.HibernateException; +import org.hibernate.engine.spi.SharedSessionContractImplementor; +import org.hibernate.usertype.UserType; + +import javax.xml.namespace.QName; +import java.io.Serializable; +import java.sql.PreparedStatement; +import java.sql.ResultSet; +import java.sql.SQLException; +import java.sql.Types; + +public class QNameUserType implements UserType { + + private static final int[] SQL_TYPES = new int[] { Types.VARCHAR }; + + /* + * (non-Javadoc) + * + * @see org.hibernate.usertype.UserType#assemble(java.io.Serializable, java.lang.Object) + */ + public Object assemble(Serializable cached, Object owner) throws HibernateException { + return cached; + } + + /* + * (non-Javadoc) + * + * @see org.hibernate.usertype.UserType#deepCopy(java.lang.Object) + */ + public Object deepCopy(Object value) throws HibernateException { + return value; + } + + /* + * (non-Javadoc) + * + * @see org.hibernate.usertype.UserType#disassemble(java.lang.Object) + */ + public Serializable disassemble(Object value) throws HibernateException { + return (Serializable) value; + } + + /** Compares the int values of the enumerates */ + public boolean equals(Object x, Object y) throws HibernateException { + // todo: check compare on null values + if (x == null && y == null) { + return true; + } + + if (x == null || y == null) { + return false; + } + + if (x.getClass() != y.getClass()) { + return false; + } + + final QName q1 = (QName) x; + final QName q2 = (QName) y; + + return q1.toString().compareTo(q2.toString()) == 0; + } + + /* + * (non-Javadoc) + * + * @see org.hibernate.usertype.UserType#hashCode(java.lang.Object) + */ + public int hashCode(Object x) throws HibernateException { + return x.toString().hashCode(); + } + + /** Not mutable */ + public boolean isMutable() { + return false; + } + + /* + * (non-Javadoc) + * + * @see org.hibernate.usertype.UserType#nullSafeGet(java.sql.ResultSet, java.lang.String[], + * java.lang.Object) + */ + public Object nullSafeGet(ResultSet rs, String[] names, SharedSessionContractImplementor sessionContractImplementor, Object owner) throws HibernateException, SQLException { + final String str = rs.getString(names[0]); + if (rs.wasNull()) { + return null; + } + return convertFromString(str); + } + + /* + * (non-Javadoc) + * + * @see org.hibernate.usertype.UserType#nullSafeSet(java.sql.PreparedStatement, + * java.lang.Object, int) + */ + public void nullSafeSet(PreparedStatement st, Object value, int index, SharedSessionContractImplementor sessionContractImplementor) throws HibernateException, SQLException { + if (value == null) { + st.setNull(index, Types.VARCHAR); + } else { + st.setString(index, convertToString((QName) value)); + } + } + + /* + * (non-Javadoc) + * + * @see org.hibernate.usertype.UserType#replace(java.lang.Object, java.lang.Object, + * java.lang.Object) + */ + public Object replace(Object original, Object target, Object owner) throws HibernateException { + return original; + } + + /** Returns the parameterizezd enumType */ + public Class returnedClass() { + return QName.class; + } + + /** An enum is stored in one varchar */ + public int[] sqlTypes() { + return SQL_TYPES; + } + + protected String convertToString(QName qName) { + return "{" + qName.getNamespaceURI() + "}" + qName.getPrefix() + ":" + qName.getLocalPart(); + } + + protected QName convertFromString(String str) { + if (str.indexOf("{") == -1) { + throw new HibernateException("String " + str + " can not be converted to a QName, missing starting {"); + } + final int endIndexNS = str.indexOf("}"); + if (endIndexNS == -1) { + throw new HibernateException("String " + str + + " can not be converted to a QName, missing end ns delimiter } "); + } + final int prefixIndex = str.indexOf(":", endIndexNS); + if (prefixIndex == -1) { + throw new HibernateException("String " + str + " can not be converted to a QName, missing prefix delimiter :"); + } + final String ns = str.substring(1, endIndexNS); + final String prefix = str.substring(endIndexNS + 1, prefixIndex); + final String localPart = str.substring(prefixIndex + 1); + return new QName(ns, localPart, prefix); + } +} diff --git a/backend/src/main/resources/META-INF/services/org.hibernate.boot.model.TypeContributor b/backend/src/main/resources/META-INF/services/org.hibernate.boot.model.TypeContributor new file mode 100644 index 000000000..5f1ae5827 --- /dev/null +++ b/backend/src/main/resources/META-INF/services/org.hibernate.boot.model.TypeContributor @@ -0,0 +1 @@ +edu.internet2.tier.shibboleth.admin.ui.hibernate.QNameTypeContributor diff --git a/testbed/mariadb/conf/application.yml b/testbed/mariadb/conf/application.yml new file mode 100644 index 000000000..68018a4b9 --- /dev/null +++ b/testbed/mariadb/conf/application.yml @@ -0,0 +1,138 @@ +spring: + profiles: + include: + datasource: + platform: mysql + driver-class-name: org.mariadb.jdbc.Driver + url: jdbc:mariadb://db:3306/shibui + username: shibui + password: shibui + jpa: + properties: + hibernate: + dialect: org.hibernate.dialect.MariaDBDialect +server: + port: 8443 + ssl: + key-store: "/conf/keystore.p12" + key-store-password: "changeit" + keyStoreType: "PKCS12" + keyAlias: "tomcat" +shibui: + user-bootstrap-resource: file:/conf/users.csv + roles: ROLE_ADMIN,ROLE_NONE,ROLE_USER,ROLE_PONY +custom: + attributes: + # Default attributes + - name: eduPersonPrincipalName + displayName: label.attribute-eduPersonPrincipalName + - name: uid + displayName: label.attribute-uid + - name: mail + displayName: label.attribute-mail + - name: surname + displayName: label.attribute-surname + - name: givenName + displayName: label.attribute-givenName + - name: eduPersonAffiliation + displayName: label.attribute-eduPersonAffiliation + - name: eduPersonScopedAffiliation + displayName: label.attribute-eduPersonScopedAffiliation + - name: eduPersonPrimaryAffiliation + displayName: label.attribute-eduPersonPrimaryAffiliation + - name: eduPersonEntitlement + displayName: label.attribute-eduPersonEntitlement + - name: eduPersonAssurance + displayName: label.attribute-eduPersonAssurance + - name: eduPersonUniqueId + displayName: label.attribute-eduPersonUniqueId + - name: employeeNumber + displayName: label.attribute-employeeNumber + # Custom attributes + overrides: + # Default overrides + - name: signAssertion + displayName: label.sign-the-assertion + displayType: boolean + defaultValue: false + helpText: tooltip.sign-assertion + attributeName: http://shibboleth.net/ns/profiles/saml2/sso/browser/signAssertions + attributeFriendlyName: signAssertions + - name: dontSignResponse + displayName: label.dont-sign-the-response + displayType: boolean + defaultValue: false + helpText: tooltip.dont-sign-response + attributeName: http://shibboleth.net/ns/profiles/saml2/sso/browser/signResponses + attributeFriendlyName: signResponses + - name: turnOffEncryption + displayName: label.turn-off-encryption-of-response + displayType: boolean + defaultValue: false + helpText: tooltip.turn-off-encryption + attributeName: http://shibboleth.net/ns/profiles/encryptAssertions + attributeFriendlyName: encryptAssertions + - name: useSha + displayName: label.use-sha1-signing-algorithm + displayType: boolean + defaultValue: false + helpText: tooltip.usa-sha-algorithm + persistType: string + persistValue: shibboleth.SecurityConfiguration.SHA1 + attributeName: http://shibboleth.net/ns/profiles/securityConfiguration + attributeFriendlyName: securityConfiguration + - name: ignoreAuthenticationMethod + displayName: label.ignore-any-sp-requested-authentication-method + displayType: boolean + defaultValue: false + helpText: tooltip.ignore-auth-method + persistType: string + persistValue: 0x1 + attributeName: http://shibboleth.net/ns/profiles/disallowedFeatures + attributeFriendlyName: disallowedFeatures + - name: omitNotBefore + displayName: label.omit-not-before-condition + displayType: boolean + defaultValue: false + helpText: tooltip.omit-not-before-condition + attributeName: http://shibboleth.net/ns/profiles/includeConditionsNotBefore + attributeFriendlyName: includeConditionsNotBefore + - name: responderId + displayName: label.responder-id + displayType: string + defaultValue: null + helpText: tooltip.responder-id + attributeName: http://shibboleth.net/ns/profiles/responderId + attributeFriendlyName: responderId + - name: nameIdFormats + displayName: label.nameid-format-to-send + displayType: set + helpText: tooltip.nameid-format + defaultValues: + - urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified + - urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress + - urn:oasis:names:tc:SAML:2.0:nameid-format:persistent + - urn:oasis:names:tc:SAML:2.0:nameid-format:transient + attributeName: http://shibboleth.net/ns/profiles/nameIDFormatPrecedence + attributeFriendlyName: nameIDFormatPrecedence + - name: authenticationMethods + displayName: label.authentication-methods-to-use + displayType: set + helpText: tooltip.authentication-methods-to-use + defaultValues: + - https://refeds.org/profile/mfa + - urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken + - urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport + attributeName: http://shibboleth.net/ns/profiles/defaultAuthenticationMethods + attributeFriendlyName: defaultAuthenticationMethods + - name: forceAuthn + displayName: label.force-authn + displayType: boolean + defaultValue: false + helpText: tooltip.force-authn + attributeName: http://shibboleth.net/ns/profiles/forceAuthn + attributeFriendlyName: forceAuthn +logging: + level: + org.pac4j: "TRACE" + org.opensaml: "INFO" diff --git a/testbed/mariadb/conf/keystore.p12 b/testbed/mariadb/conf/keystore.p12 new file mode 100644 index 0000000000000000000000000000000000000000..57f9c162a6953c21e77cf24451d52a9d3fa5cd54 GIT binary patch literal 2591 zcmY+EXEYlM8^+#;9KJd*1inb3Z)iIp_EPKhMV>97D|oBqN7osHVVFVlnzLKj_FP$qF%41Q3R* z^9r}YF%+)Wm1*z9WVf@%JDMN3TvEX07$;TX^lxG0$V|M==T7l`GEyXPdw zXm@Syfq*ghPdN9rC^82iIiSk~gaP$MoHrr;heS_|UuGmN=cS{B0tJIUb0I?8*yTo7 z<;eF;9*tyN_u(*2@@PrdCWF2Dy0D}1o_X_!#ZZ`{?D%G$xW!6I082tT@kNaVWLI$y zQ?{iJZ+N@ftfv2ER`h<1Ps33b3x`zD#Xa^Yls;WQ*yFh6Z4hzUNZY5VhP!2ryOY5V zKGpR+arsS!Krgf}A<6#C2})#Ie`zQ4&PMp_lE|YAC+E}i=UDu!=&HTo~B0gi(9cejrUwu@8hK)P4Ppc|?PGVI38Hao~@kTe57RrfAV`uiHpU&|;rw>h&9Ew=! zLMynJ&c~u{@IoN*@p6@(O;6g*)m@_r4f!y92e%+LL89f0jf2D#yd<5tn%y@)<=-63 z6_0Wk384``Yo}vPAw_V9)L#x);zJ`87Rrq4-DfRRQ`^s@Lrj#H(Pe=Mp7Po8fC#js zcSJ_PtVsY!pJk}CFP;k7O zc_`Dqty6pqp_B4@A5ys8D~azqv>9f*uX6D_`SXt6#4yP$g|~+Vfroy_?Yb-~gYqI0 z5mLA&`cD56Gh6EF>7>Bz6Bov(Oh|U|)q=+_KUMmMQaoWc_bHRFt>yS2`2PdR_MWAzBqHlq;FHp;4?3i-pX#W148gm~V-UUZ|n*JjzAkUSFq zttV7Z>+Y5zw~xD0q0bHr6tPBYk<@ZRYqSC5C5LJiSzj9x*Jfz5<(#IULa0K099m|`{ksz@rub0J!&%HoKuFUrr zWXg;<+Bqmkm+RPThvHeaFl2lIUw}{=`hIFH2F^riQ@cgPRe##VOlhq{C!$y zVj2oh;|;i+c{#2fJ1b-;B#$QNMnLR@eci$$qQ-ms7bc++#f`<^nCMftG;_6g7RkDG zS)Avgii(ZQLOp!MllH-jXVki-(HWhVnKy&7Tl@B)y!#8xCT>ULqi)rNN;h#Q7CxqR zte=q-)bmc(SCU!-g{|J;c?pUaD+SJP9LH%`RA><;$y;@hzcxf~7(I>Z(q(f{zf_Xe zf^+??N-7p<2rn(b58wsx0N4W_0sP?n|Aeg4EFh+Pt{#q1X?a;iWkm%Ac?CFJ`bwTg zf0ro1S3Xt0Ldrlgz}1rZCn5WnVZr|~tkqHEp57>;w2?YVbCA+_xIaH;_`imYz>t%= zKLnhg96NO9Of%ipR@Ct?o8CRsk7X;lAXwe>=H7+*|55nmS)}2Ts|&f1Nl>z1 zPp%bXaadZ_SSnSH-ijLuA8bkgxt3k0e=KaXxvasg01EAO&U?ELSmNRS@Vih`O`n~! zm(iL%2^WSEvkM+EsF_lT1D_e@M-l3VUhD?z3@NL5yD$To`Q|y$2lZz@8Gr zH4a-TtEoQ|2cur+F-BXgKL4tkHyAja?^>!LPV8%yz$IX7t45YvZQo#J^&uiR-_S?` zVVZok0mHxl`d(kE5k+c?f|#$W$oE!N?wV_-Lx@?LcLHxvUivKu_Ty)u3Fn#qSoD1Z z)q5K^gp<}bKZ1pR>6t{YF4aubO9b>EsG|8Ic|MxD@?c@p>&n6>r)Kdcl7DnwQx*!? zqN|mP_On)F72tRv9Ka}`BR`D!)Z6uX6A@!OR6q&@dJtSP&2tHt*YNx*)eyv6=1@=1 z0Ny4nsx!gKdBZ)?43Q@1JQD0EntJm%-;=l00}SIaB7KE>E%tK`$J1|Vk{ZzCy#=0( zrOIhoXp~QXrmT;gp5{^Jz8Ls+TQIjTzYevT&yv94>ouv1?~>VU#n%gf$6Xt~E(ERD zK;m4byGfL*a9YtUngDy?_Brb@jq?t0C5>?`p)fW$*MQBkF|Ww#RnhSC@RkIWjKknZ zBLec1=wR==k~K5LiB(-Ox;}hz-_=vlV^IAz9_d%ru;Fawb=wBT7=0Z)%sJL=ETE z1K}_i-IeO_F;spY)>~=*tiy^f*X(CwGuxLIb|s@IL$=*RKp0_k{sq}UzfGV^$P=R# z0ouf)?@zmvOBRng}=n%+lMZ$8fk6z%zIgz@9-Z^#c&dEhz zjy_f~4KC~7h);(y-@3i8#%7D{ip3I?%)J>p*up#)iL;26E8bS&fw=+*E z&@<&p2yJD