diff --git a/backend/src/main/groovy/edu/internet2/tier/shibboleth/admin/ui/service/JPAMetadataResolverServiceImpl.groovy b/backend/src/main/groovy/edu/internet2/tier/shibboleth/admin/ui/service/JPAMetadataResolverServiceImpl.groovy index 4b41a9e29..be89653f4 100644 --- a/backend/src/main/groovy/edu/internet2/tier/shibboleth/admin/ui/service/JPAMetadataResolverServiceImpl.groovy +++ b/backend/src/main/groovy/edu/internet2/tier/shibboleth/admin/ui/service/JPAMetadataResolverServiceImpl.groovy @@ -77,7 +77,7 @@ class JPAMetadataResolverServiceImpl implements MetadataResolverService { List metadataFilters = new ArrayList<>() // set up namespace protection - if (shibUIConfiguration.protectedAttributeNamespaces && shibUIConfiguration.protectedAttributeNamespaces.size() > 0) { + if (shibUIConfiguration.protectedAttributeNamespaces && shibUIConfiguration.protectedAttributeNamespaces.size() > 0 && targetMetadataResolver && jpaMetadataResolver.type in ['FileBackedHttpMetadataResolver', 'DynamicHttpMetadataResolver']) { def target = new org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter() target.attributeFilter = new ScriptedPredicate(new EvaluableScript(protectedNamespaceScript())) metadataFilters.add(target) @@ -192,17 +192,17 @@ class JPAMetadataResolverServiceImpl implements MetadataResolverService { constructXmlNodeForResolver(mr, delegate) { //TODO: enhance def didNamespaceProtectionFilter = !(shibUIConfiguration.protectedAttributeNamespaces && shibUIConfiguration.protectedAttributeNamespaces.size() > 0) - mr.metadataFilters.each { edu.internet2.tier.shibboleth.admin.ui.domain.filters.MetadataFilter filter -> - if (filter instanceof EntityAttributesFilter && !didNamespaceProtectionFilter) { + def doNamespaceProtectionFilter = { def filter -> + if (mr.type in ['FileBackedMetadataResolver', 'DynamicHttpMetadataResolver'] && (filter == null || filter instanceof EntityAttributesFilter) && !didNamespaceProtectionFilter) { constructXmlNodeForEntityAttributeNamespaceProtection(delegate) didNamespaceProtectionFilter = true } - constructXmlNodeForFilter(filter, delegate) } - if (!didNamespaceProtectionFilter) { - constructXmlNodeForEntityAttributeNamespaceProtection(delegate) - didNamespaceProtectionFilter = true + mr.metadataFilters.each { edu.internet2.tier.shibboleth.admin.ui.domain.filters.MetadataFilter filter -> + doNamespaceProtectionFilter() + constructXmlNodeForFilter(filter, delegate) } + doNamespaceProtectionFilter() } } } diff --git a/backend/src/test/groovy/edu/internet2/tier/shibboleth/admin/ui/service/JPAMetadataResolverServiceImplTests.groovy b/backend/src/test/groovy/edu/internet2/tier/shibboleth/admin/ui/service/JPAMetadataResolverServiceImplTests.groovy index cbeac0960..b46888e14 100644 --- a/backend/src/test/groovy/edu/internet2/tier/shibboleth/admin/ui/service/JPAMetadataResolverServiceImplTests.groovy +++ b/backend/src/test/groovy/edu/internet2/tier/shibboleth/admin/ui/service/JPAMetadataResolverServiceImplTests.groovy @@ -11,6 +11,7 @@ import edu.internet2.tier.shibboleth.admin.ui.domain.filters.EntityAttributesFil import edu.internet2.tier.shibboleth.admin.ui.domain.filters.RequiredValidUntilFilter import edu.internet2.tier.shibboleth.admin.ui.domain.resolvers.ClasspathMetadataResource import edu.internet2.tier.shibboleth.admin.ui.domain.resolvers.DynamicHttpMetadataResolver +import edu.internet2.tier.shibboleth.admin.ui.domain.resolvers.LocalDynamicMetadataResolver import edu.internet2.tier.shibboleth.admin.ui.domain.resolvers.MetadataQueryProtocolScheme import edu.internet2.tier.shibboleth.admin.ui.domain.resolvers.RegexScheme import edu.internet2.tier.shibboleth.admin.ui.domain.resolvers.SvnMetadataResource @@ -395,6 +396,23 @@ class JPAMetadataResolverServiceImplTests extends Specification { ['http://shibboleth.net/ns/profiles', 'http://scaldingspoon.com/iam'] | '/conf/984-2.xml' } + @DirtiesContext(methodMode = DirtiesContext.MethodMode.AFTER_METHOD) + def 'test namespace protection in nonURL resolver'() { + setup: + shibUIConfiguration.protectedAttributeNamespaces = ['http://shibboleth.net/ns/profiles'] + def resolver = new LocalDynamicMetadataResolver().with { + it.xmlId = 'LocalDynamic' + it.sourceDirectory = '/tmp' + it + } + + when: + metadataResolverRepository.save(resolver) + + then: + generatedXmlIsTheSameAsExpectedXml('/conf/1059.xml', metadataResolverService.generateConfiguration()) + } + @Ignore('there is a bug in org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter.applyFilter') def 'test namespace protection internal filtering'() { setup: diff --git a/backend/src/test/resources/conf/1059.xml b/backend/src/test/resources/conf/1059.xml new file mode 100644 index 000000000..7610893be --- /dev/null +++ b/backend/src/test/resources/conf/1059.xml @@ -0,0 +1,17 @@ + + + + + + \ No newline at end of file