Skip to content

Commit

Permalink
SHIBUI-2268
Browse files Browse the repository at this point in the history
Adding remaining needed pieces for Algorithm filter
  • Loading branch information
chasegawa committed Aug 8, 2022
1 parent 50bd2c7 commit ccc61ff
Show file tree
Hide file tree
Showing 8 changed files with 164 additions and 12 deletions.
2 changes: 1 addition & 1 deletion backend/build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -332,7 +332,7 @@ task generateSources {
}
}

new XmlSlurper().parse(file('src/main/resources/jpa-saml2-metadata-ds-config.xml')).with { builders ->
new XmlSlurper().parse(file('src/main/resources/jpa-signature-config.xml')).with { builders ->
builders.ObjectProviders.ObjectProvider.BuilderClass.each {
processLine(it['@className'].toString(), 'src/main/templates/SignatureBuilderTemplate.java')
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@ import edu.internet2.tier.shibboleth.admin.ui.domain.filters.NameIdFormatFilter
import edu.internet2.tier.shibboleth.admin.ui.domain.filters.RequiredValidUntilFilter
import edu.internet2.tier.shibboleth.admin.ui.domain.filters.SignatureValidationFilter
import edu.internet2.tier.shibboleth.admin.ui.domain.filters.algorithm.AlgorithmFilter
import edu.internet2.tier.shibboleth.admin.ui.domain.filters.algorithm.ConditionRef
import edu.internet2.tier.shibboleth.admin.ui.domain.filters.algorithm.ConditionScript
import edu.internet2.tier.shibboleth.admin.ui.domain.filters.algorithm.Entity
import edu.internet2.tier.shibboleth.admin.ui.domain.filters.opensaml.OpenSamlNameIdFormatFilter
import edu.internet2.tier.shibboleth.admin.ui.domain.resolvers.DynamicHttpMetadataResolver
Expand Down Expand Up @@ -111,6 +113,15 @@ class JPAMetadataResolverServiceImpl implements MetadataResolverService {
{
if (xmlObject instanceof Entity) {
Entity(xmlObject.getValue())
} else if (xmlObject instanceof ConditionRef) {
ConditionRef(xmlObject.getValue())
} else if (xmlObject instanceof ConditionScript) {
ConditionScript() {
Script() {
def script = xmlObject.getValue()
mkp.yieldUnescaped("\n<![CDATA[\n${script}\n]]>\n")
}
}
} else {
mkp.yieldUnescaped(openSamlObjects.marshalToXmlString(xmlObject, false))
}
Expand All @@ -133,10 +144,8 @@ class JPAMetadataResolverServiceImpl implements MetadataResolverService {
Entity(it)
}
break
case EntityAttributesFilterTarget
.EntityAttributesFilterTargetType.CONDITION_SCRIPT:
case EntityAttributesFilterTarget
.EntityAttributesFilterTargetType.REGEX:
case EntityAttributesFilterTarget.EntityAttributesFilterTargetType.CONDITION_SCRIPT:
case EntityAttributesFilterTarget.EntityAttributesFilterTargetType.REGEX:
ConditionScript() {
Script() {
def script
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
package edu.internet2.tier.shibboleth.admin.ui.domain.filters.algorithm;

import edu.internet2.tier.shibboleth.admin.ui.domain.AbstractXMLObject;
import lombok.EqualsAndHashCode;
import lombok.Getter;
import lombok.Setter;
import lombok.ToString;
import org.hibernate.envers.Audited;

import javax.annotation.Nullable;

@javax.persistence.Entity
@Audited
@Getter
@Setter
@ToString
@EqualsAndHashCode(callSuper = true)
/**
* The textual content (the value/uri) is the Bean ID of type Predicate<EntityDescriptor>
*/
public class ConditionRef extends AbstractXMLObject implements org.opensaml.core.xml.schema.XSString {
private String uri;

public ConditionRef() {
setElementLocalName("ConditionRef");
}

@Nullable
@Override
public String getValue() {
return this.uri;
}

@Override
public void setValue(@Nullable String newValue) {
this.uri = newValue;
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
package edu.internet2.tier.shibboleth.admin.ui.domain.filters.algorithm;

import edu.internet2.tier.shibboleth.admin.ui.domain.AbstractXMLObject;
import lombok.EqualsAndHashCode;
import lombok.Getter;
import lombok.Setter;
import lombok.ToString;
import org.hibernate.envers.Audited;

import javax.annotation.Nullable;

@javax.persistence.Entity
@Audited
@Getter
@Setter
@ToString
@EqualsAndHashCode(callSuper = true)
/**
* The textual content is the JS script (the export of the XML will wrap it appropriately)
*/
public class ConditionScript extends AbstractXMLObject implements org.opensaml.core.xml.schema.XSString {
private String uri;

public ConditionScript() {
setElementLocalName("ConditionScript");
}

@Nullable
@Override
public String getValue() {
return this.uri;
}

@Override
public void setValue(@Nullable String newValue) {
this.uri = newValue;
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@
@Setter
@ToString
@EqualsAndHashCode(callSuper = true)
/**
* The textual content (value/uri) is an entityID.
*/
public class Entity extends AbstractXMLObject implements org.opensaml.core.xml.schema.XSString {
private String uri;

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,16 +8,15 @@ public class JPAXMLObjectProviderInitializer extends AbstractXMLObjectProviderIn
protected String[] getConfigResources() {
return new String[]{
"/jpa-default-config.xml",
"/jpa-saml2-metadata-config.xml",
"/jpa-saml2-metadata-attr-config.xml",
"/encryption-config.xml",
"/jpa-saml2-assertion-config.xml",
"/jpa-schema-config.xml",
"/jpa-saml2-metadata-ui-config.xml",
"/jpa-signature-config.xml",
"/jpa-saml2-metadata-algorithm-config.xml",
"/jpa-saml2-metadata-ds-config.xml",
"/encryption-config.xml",
"/jpa-saml2-metadata-attr-config.xml",
"/jpa-saml2-metadata-config.xml",
"/jpa-saml2-metadata-reqinit-config.xml",
"/jpa-saml2-metadata-ui-config.xml",
"/jpa-schema-config.xml",
"/jpa-signature-config.xml",
"/saml2-protocol-config.xml",
"/modified-saml2-assertion-config.xml"
};
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@ import edu.internet2.tier.shibboleth.admin.ui.domain.filters.EntityAttributesFil
import edu.internet2.tier.shibboleth.admin.ui.domain.filters.EntityAttributesFilterTarget
import edu.internet2.tier.shibboleth.admin.ui.domain.filters.MetadataFilter
import edu.internet2.tier.shibboleth.admin.ui.domain.filters.RequiredValidUntilFilter
import edu.internet2.tier.shibboleth.admin.ui.domain.filters.algorithm.ConditionRef
import edu.internet2.tier.shibboleth.admin.ui.domain.filters.algorithm.ConditionScript
import edu.internet2.tier.shibboleth.admin.ui.domain.filters.algorithm.Entity
import edu.internet2.tier.shibboleth.admin.ui.domain.filters.algorithm.MGF
import edu.internet2.tier.shibboleth.admin.ui.domain.filters.algorithm.PRF
Expand Down Expand Up @@ -217,6 +219,40 @@ class JPAMetadataResolverServiceImplTests extends AbstractBaseDataJpaTest {
generatedXmlIsTheSameAsExpectedXml('/conf/2268-simple.xml', domBuilder.parseText(writer.toString()))
}

def 'test generating AlgorithmFilter shibui-2268 actual'() {
given:
def filter = TestObjectGenerator.algorithmFilter()
EncryptionMethod encryptionMethod = new EncryptionMethod()
encryptionMethod.setElementLocalName(EncryptionMethod.DEFAULT_ELEMENT_LOCAL_NAME)
encryptionMethod.setNamespacePrefix(SAMLConstants.SAML20MD_PREFIX)
encryptionMethod.setNamespaceURI(SAMLConstants.SAML20MD_NS)
encryptionMethod.setSchemaLocation(SAMLConstants.SAML20MD_SCHEMA_LOCATION)
encryptionMethod.setAlgorithm("http://www.w3.org/2001/04/xmlenc#aes128-cbc")
filter.addUnknownXMLObject(encryptionMethod)

Entity entity = new Entity()
entity.setValue("https://broken.example.org/sp")
filter.addUnknownXMLObject(entity)

ConditionRef cr = new ConditionRef()
cr.setValue("shibboleth.Conditions.TRUE")
filter.addUnknownXMLObject(cr)

ConditionScript cs = new ConditionScript()
cs.setValue("\"use strict\";\nfalse;")
filter.addUnknownXMLObject(cs)

when:
genXmlSnippet(markupBuilder) { JPAMetadataResolverServiceImpl.cast(metadataResolverService).constructXmlNodeForFilter(filter, it) }

then:
generatedXmlIsTheSameAsExpectedXml('/conf/2268-actual.xml', domBuilder.parseText(writer.toString()))
}

/**
* This test was written before we simplified the concept of what we'd allow the users to build in the UI. Because the test was
* already done and working, it was left here for completeness.
*/
def 'test generating complex AlgorithmFilter xml snippet'() {
given:
def filter = TestObjectGenerator.algorithmFilter()
Expand Down
29 changes: 29 additions & 0 deletions backend/src/test/resources/conf/2268-actual.xml
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<MetadataProvider id="ShibbolethMetadata"
xmlns="urn:mace:shibboleth:2.0:metadata"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd urn:mace:shibboleth:2.0:resource http://shibboleth.net/schema/idp/shibboleth-resource.xsd urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd urn:oasis:names:tc:SAML:2.0:assertion http://docs.oasis-open.org/security/saml/v2.0/saml-schema-assertion-2.0.xsd"
xsi:type="ChainingMetadataProvider">
<MetadataFilter xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:security="urn:mace:shibboleth:2.0:security"
xmlns:xenc11="http://www.w3.org/2009/xmlenc11#"
xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd urn:oasis:names:tc:SAML:2.0:assertion http://docs.oasis-open.org/security/saml/v2.0/saml-schema-assertion-2.0.xsd urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd urn:oasis:names:tc:SAML:metadata:algsupport https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-metadata-algsupport-v1.0.xsd http://www.w3.org/2000/09/xmldsig# https://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd http://www.w3.org/2009/xmlenc11# https://www.w3.org/TR/xmlenc-core1/xenc-schema-11.xsd"
xsi:type="Algorithm">

<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
<Entity>https://broken.example.org/sp</Entity>
<ConditionRef>shibboleth.Conditions.TRUE</ConditionRef>
<ConditionScript>
<Script>
<![CDATA[
"use strict";
false;
]]>
</Script>
</ConditionScript>

</MetadataFilter>
</MetadataProvider>

0 comments on commit ccc61ff

Please sign in to comment.