From 3fc853cc1e861f455888a92ff0c9995270d2ba2c Mon Sep 17 00:00:00 2001 From: root Date: Mon, 25 Jul 2011 20:14:02 +0200 Subject: imported 1.1.2 --- .../middleware/shibboleth/wayf/plugins/Plugin.html | 320 +++--- .../shibboleth/wayf/plugins/PluginContext.html | 64 +- .../wayf/plugins/PluginMetadataParameter.html | 62 +- .../wayf/plugins/WayfRequestHandled.html | 36 +- .../shibboleth/wayf/plugins/package-frame.html | 4 +- .../shibboleth/wayf/plugins/package-summary.html | 6 +- .../wayf/plugins/provider/BindingFilter.html | 354 +++---- .../wayf/plugins/provider/ListFilter.html | 374 +++---- .../wayf/plugins/provider/SamlCookiePlugin.html | 1090 ++++++++++---------- .../wayf/plugins/provider/package-frame.html | 4 +- .../wayf/plugins/provider/package-summary.html | 6 +- 11 files changed, 1165 insertions(+), 1155 deletions(-) (limited to 'doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins') diff --git a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/Plugin.html b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/Plugin.html index 0c6391a..390d7b9 100644 --- a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/Plugin.html +++ b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/Plugin.html @@ -1,172 +1,172 @@ - + Plugin xref
View Javadoc
 
-1   /**
-2    * Copyright [2006] [University Corporation for Advanced Internet Development, Inc.]
-3    *
-4    * Licensed under the Apache License, Version 2.0 (the "License");
-5    * you may not use this file except in compliance with the License.
-6    * You may obtain a copy of the License at
-7    *
-8    * http://www.apache.org/licenses/LICENSE-2.0
-9    *
-10   * Unless required by applicable law or agreed to in writing, software
-11   * distributed under the License is distributed on an "AS IS" BASIS,
-12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-13   * See the License for the specific language governing permissions and
-14   * limitations under the License.
-15   */
-16  package edu.internet2.middleware.shibboleth.wayf.plugins;
-17  
-18  import java.util.Collection;
-19  import java.util.List;
-20  import java.util.Map;
-21  
-22  import javax.servlet.http.HttpServletRequest;
-23  import javax.servlet.http.HttpServletResponse;
-24  
-25  import org.opensaml.saml2.metadata.provider.MetadataProvider;
-26  
-27  import edu.internet2.middleware.shibboleth.wayf.IdPSite;
-28  
-29  /**
-30   * 
-31   * The Plugin interface is used to affect the 'hints' that the WAYF offers to the users.  
-32   * <p>
-33   * The WAYF can register any number of plugins.  Each plugin is called when the metadata is loaded or realoaded
-34   * (so it can do any indexing) and at the three entry points into the WAYF - Lookup (main entry), Search and Select.
-35   * Plugins are called in the order in which they are declared to the WAYF. 
-36   * <p>
-37   * Each plugin is called once when the user has made a selection.
-38   * <p>
-39   * For Search and Lookup, each plugin is called multiple times, once for each metadata provider which has 
-40   * been declared to this particular WAYF instance.  The plugin can return a context which is handed to subsequent calls.
-41   * <p>
-42   * The idea is that each plugin can affect the displayed lists of IdPs.  As a reminder the WAYF displays two lists of 
-43   * IdPs - the complete list, displayed either as a single list or a list of lists, and the hint list (which was
-44   * previously only populated from the _saml_idp cookie.  In the search case the WAYF displays a third list of
-45   * the search hits. 
-46   * <p>
-47   * When the plugin in called it is given the current set of potential IdPs as a Map from EntityID to {@link IdPSite}
-48   * and lists representing the current hint list and search results.  A Plugin can remove an entry from 
-49   * the map or the lists.  Additionally it can insert an IdPSite found in the Map into the hint or search lists.
-50   * Thus the plugin can restrict the number of sites that the WAYF instance displays in the 'complete list' and
-51   * can add or remove IdPs from the hint list.
-52   * <p>
-53   * At any stage the plugin can take control of the current request and redirect or forward it.  It signals that
-54   * it has done this to the WAYF by means of an exception.
-55   * <p> 
-56   *  The _saml_idp cookie handling code is written as a WAYF plugin.  Other plugins have been written to allow IdPs
-57   *  to be presented as hints based on the client's IP address or to redirect back to the SP once the choice of
-58   *  IdP has been made.
-59   *  <p>
-60   *  Object implementing this interface are created during WAYF discovery service initialization.  There are 
-61   *  expected to implement a constructor which takes a {@link org.w3c.dom.Element} as the only parameter and they are 
-62   *  created via this constructor, with the parameter being the appropriate section of the WAYF configuration file 
-63   *  
-64   * @version Discussion
-65   *
-66   */
-67  public interface Plugin {
-68  
-69          /**
-70           *  Whenever the WAYF discoveres that the metadata is stale, it reloads it and calls each plugin at this method.
-71           * 
-72           * @param metadata - where to get the data from.
-73           * @return the value which will be provided as input to subsequent calls to {@link #lookup Lookup} and 
-74           * {@link #search Search}
-75           */
-76          PluginMetadataParameter refreshMetadata(MetadataProvider metadata);
-77          
-78          /**
-79           * The WAYF calls each plugin at this entry point when it is first contacted.  
-80           * 
-81           * @param req - Describes the current request.  A Plugin might use it to find any appropriate cookies 
-82           * @param res - Describes the current response.  A Plugin might use it to redirect a the request. 
-83           * @param parameter Describes the metadata.
-84           * @param context Any processing context returned from a previous call.
-85           * @param validIdps The list of IdPs which is currently views as possibly matches for the pattern. 
-86           *                  The Key is the EntityId for the IdP and the value the object which describes 
-87           *                  the Idp 
-88           * @param idpList The set of Idps which are currently considered as potential hints.    
-89           * @return a context to hand to subsequent calls
-90           * @throws WayfRequestHandled if the plugin has handled the request (for instance it has
-91           * issues a redirect)
-92           *
-93           * Each plugin is called multiple times,
-94           * once for each metadata provider which is registered (Depending on the precise configuration of the WAYF
-95           * metadata providers whose metadata does not include the target may be dropped).  Initially the plugin is
-96           * called with a context parameter of <code>null</code>.  In subsequent calls, the value returned from
-97           * the previous call is passed in as the context parameter. 
-98           * 
-99           * The plugin may remove IdPSite objects from the validIdps list.
-100          * 
-101          * The plugin may add or remove them to the idpList.  IdPSite Objects which are to be added to the idpList 
-102          * should be looked up by EntityIdName in validIdps by EntityId.  Hence any metadata processing shoudl 
-103          * store the entityID. 
-104          * 
-105          */
-106         PluginContext lookup(HttpServletRequest req, 
-107                                                  HttpServletResponse res, 
-108                                                  PluginMetadataParameter parameter, 
-109                                                  Map<String, IdPSite> validIdps, 
-110                                                  PluginContext context, 
-111                                                  List<IdPSite> idpList) throws WayfRequestHandled;
-112 
-113         /**
-114          * This method is called when the user specified a search operation.  The processing is similar to 
-115          * that described for {@link #lookup lookup}.
-116          * Two additional paramaters are provided, the search parameter which was provided, and the current 
-117          * proposed list of candidate IdPs.  The plugin is at liberty to alter both the list of hints and the 
-118          * list of valid IdPs. 
-119          * 
-120          * @param req Describes the current request.  The Plugin could use it to find any appropriate cookies 
-121          * @param res Describes the result - this is needed if (for instance) a plung needs to change cookie values
-122          * @param parameter Describes the metadata
-123          * @param pattern The Search pattern provided
-124          * @param validIdps The list of IdPs which is currently views as possibly matches for the pattern.  
-125          *                  The Key is the Idp Name an the value the idp
-126          * @param context Any processing context returned from a previous call.
-127          * @param searchResult the resukt of any search
-128          * @param idpList The set of Idps which are currently considered as potential hints.  Each Idp is associated
-129          * with a numeric weight, where the lower the number is the more likely the IdP is to be a candidate.  
-130          * As descibed above the WAYF uses this to provide hint list to the GUI (or even to dispatch 
-131          * immediately to the IdP).  
-132          * @return a context to hand to subsequent calls
-133          * @throws WayfRequestHandled if the plugin has handled the request (for instance it has
-134          * issues a redirect)
-135          */
-136         PluginContext search(HttpServletRequest req, 
-137                                         HttpServletResponse res, 
-138                                         PluginMetadataParameter parameter, 
-139                                         String pattern, 
-140                                         Map<String, IdPSite> validIdps, 
-141                                         PluginContext context, 
-142                                         Collection<IdPSite> searchResult,
-143                                         List<IdPSite> idpList) throws WayfRequestHandled;
-144         
-145         /**
-146          * This method is called, for every plugin, after a user has selected an IdP.  The plugin is expected 
-147          * to use it to update any in memory state (via the {@link PluginMetadataParameter} parameter or permananent 
-148          * state (for instance by writing back a cookie.
-149          * @param req Describes the current request. 
-150          * @param res Describes the current response
-151          * @param parameter  Describes the metadata
-152          * @throws WayfRequestHandled if the plugin has handled the request (for instance it has
-153          * issues a redirect)
-154          */
-155         void selected(HttpServletRequest req, 
-156                       HttpServletResponse res, 
-157                       PluginMetadataParameter parameter, 
-158                       String idP) throws WayfRequestHandled;
-159 }
+1   /**
+2    * Copyright [2006] [University Corporation for Advanced Internet Development, Inc.]
+3    *
+4    * Licensed under the Apache License, Version 2.0 (the "License");
+5    * you may not use this file except in compliance with the License.
+6    * You may obtain a copy of the License at
+7    *
+8    * http://www.apache.org/licenses/LICENSE-2.0
+9    *
+10   * Unless required by applicable law or agreed to in writing, software
+11   * distributed under the License is distributed on an "AS IS" BASIS,
+12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+13   * See the License for the specific language governing permissions and
+14   * limitations under the License.
+15   */
+16  package edu.internet2.middleware.shibboleth.wayf.plugins;
+17  
+18  import java.util.Collection;
+19  import java.util.List;
+20  import java.util.Map;
+21  
+22  import javax.servlet.http.HttpServletRequest;
+23  import javax.servlet.http.HttpServletResponse;
+24  
+25  import org.opensaml.saml2.metadata.provider.MetadataProvider;
+26  
+27  import edu.internet2.middleware.shibboleth.wayf.IdPSite;
+28  
+29  /**
+30   * 
+31   * The Plugin interface is used to affect the 'hints' that the WAYF offers to the users.  
+32   * <p>
+33   * The WAYF can register any number of plugins.  Each plugin is called when the metadata is loaded or realoaded
+34   * (so it can do any indexing) and at the three entry points into the WAYF - Lookup (main entry), Search and Select.
+35   * Plugins are called in the order in which they are declared to the WAYF. 
+36   * <p>
+37   * Each plugin is called once when the user has made a selection.
+38   * <p>
+39   * For Search and Lookup, each plugin is called multiple times, once for each metadata provider which has 
+40   * been declared to this particular WAYF instance.  The plugin can return a context which is handed to subsequent calls.
+41   * <p>
+42   * The idea is that each plugin can affect the displayed lists of IdPs.  As a reminder the WAYF displays two lists of 
+43   * IdPs - the complete list, displayed either as a single list or a list of lists, and the hint list (which was
+44   * previously only populated from the _saml_idp cookie.  In the search case the WAYF displays a third list of
+45   * the search hits. 
+46   * <p>
+47   * When the plugin in called it is given the current set of potential IdPs as a Map from EntityID to {@link IdPSite}
+48   * and lists representing the current hint list and search results.  A Plugin can remove an entry from 
+49   * the map or the lists.  Additionally it can insert an IdPSite found in the Map into the hint or search lists.
+50   * Thus the plugin can restrict the number of sites that the WAYF instance displays in the 'complete list' and
+51   * can add or remove IdPs from the hint list.
+52   * <p>
+53   * At any stage the plugin can take control of the current request and redirect or forward it.  It signals that
+54   * it has done this to the WAYF by means of an exception.
+55   * <p> 
+56   *  The _saml_idp cookie handling code is written as a WAYF plugin.  Other plugins have been written to allow IdPs
+57   *  to be presented as hints based on the client's IP address or to redirect back to the SP once the choice of
+58   *  IdP has been made.
+59   *  <p>
+60   *  Object implementing this interface are created during WAYF discovery service initialization.  There are 
+61   *  expected to implement a constructor which takes a {@link org.w3c.dom.Element} as the only parameter and they are 
+62   *  created via this constructor, with the parameter being the appropriate section of the WAYF configuration file 
+63   *  
+64   * @version Discussion
+65   *
+66   */
+67  public interface Plugin {
+68  
+69          /**
+70           *  Whenever the WAYF discoveres that the metadata is stale, it reloads it and calls each plugin at this method.
+71           * 
+72           * @param metadata - where to get the data from.
+73           * @return the value which will be provided as input to subsequent calls to {@link #lookup Lookup} and 
+74           * {@link #search Search}
+75           */
+76          PluginMetadataParameter refreshMetadata(MetadataProvider metadata);
+77          
+78          /**
+79           * The WAYF calls each plugin at this entry point when it is first contacted.  
+80           * 
+81           * @param req - Describes the current request.  A Plugin might use it to find any appropriate cookies 
+82           * @param res - Describes the current response.  A Plugin might use it to redirect a the request. 
+83           * @param parameter Describes the metadata.
+84           * @param context Any processing context returned from a previous call.
+85           * @param validIdps The list of IdPs which is currently views as possibly matches for the pattern. 
+86           *                  The Key is the EntityId for the IdP and the value the object which describes 
+87           *                  the Idp 
+88           * @param idpList The set of Idps which are currently considered as potential hints.    
+89           * @return a context to hand to subsequent calls
+90           * @throws WayfRequestHandled if the plugin has handled the request (for instance it has
+91           * issues a redirect)
+92           *
+93           * Each plugin is called multiple times,
+94           * once for each metadata provider which is registered (Depending on the precise configuration of the WAYF
+95           * metadata providers whose metadata does not include the target may be dropped).  Initially the plugin is
+96           * called with a context parameter of <code>null</code>.  In subsequent calls, the value returned from
+97           * the previous call is passed in as the context parameter. 
+98           * 
+99           * The plugin may remove IdPSite objects from the validIdps list.
+100          * 
+101          * The plugin may add or remove them to the idpList.  IdPSite Objects which are to be added to the idpList 
+102          * should be looked up by EntityIdName in validIdps by EntityId.  Hence any metadata processing shoudl 
+103          * store the entityID. 
+104          * 
+105          */
+106         PluginContext lookup(HttpServletRequest req, 
+107                                                  HttpServletResponse res, 
+108                                                  PluginMetadataParameter parameter, 
+109                                                  Map<String, IdPSite> validIdps, 
+110                                                  PluginContext context, 
+111                                                  List<IdPSite> idpList) throws WayfRequestHandled;
+112 
+113         /**
+114          * This method is called when the user specified a search operation.  The processing is similar to 
+115          * that described for {@link #lookup lookup}.
+116          * Two additional paramaters are provided, the search parameter which was provided, and the current 
+117          * proposed list of candidate IdPs.  The plugin is at liberty to alter both the list of hints and the 
+118          * list of valid IdPs. 
+119          * 
+120          * @param req Describes the current request.  The Plugin could use it to find any appropriate cookies 
+121          * @param res Describes the result - this is needed if (for instance) a plung needs to change cookie values
+122          * @param parameter Describes the metadata
+123          * @param pattern The Search pattern provided
+124          * @param validIdps The list of IdPs which is currently views as possibly matches for the pattern.  
+125          *                  The Key is the Idp Name an the value the idp
+126          * @param context Any processing context returned from a previous call.
+127          * @param searchResult the resukt of any search
+128          * @param idpList The set of Idps which are currently considered as potential hints.  Each Idp is associated
+129          * with a numeric weight, where the lower the number is the more likely the IdP is to be a candidate.  
+130          * As descibed above the WAYF uses this to provide hint list to the GUI (or even to dispatch 
+131          * immediately to the IdP).  
+132          * @return a context to hand to subsequent calls
+133          * @throws WayfRequestHandled if the plugin has handled the request (for instance it has
+134          * issues a redirect)
+135          */
+136         PluginContext search(HttpServletRequest req, 
+137                                         HttpServletResponse res, 
+138                                         PluginMetadataParameter parameter, 
+139                                         String pattern, 
+140                                         Map<String, IdPSite> validIdps, 
+141                                         PluginContext context, 
+142                                         Collection<IdPSite> searchResult,
+143                                         List<IdPSite> idpList) throws WayfRequestHandled;
+144         
+145         /**
+146          * This method is called, for every plugin, after a user has selected an IdP.  The plugin is expected 
+147          * to use it to update any in memory state (via the {@link PluginMetadataParameter} parameter or permananent 
+148          * state (for instance by writing back a cookie.
+149          * @param req Describes the current request. 
+150          * @param res Describes the current response
+151          * @param parameter  Describes the metadata
+152          * @throws WayfRequestHandled if the plugin has handled the request (for instance it has
+153          * issues a redirect)
+154          */
+155         void selected(HttpServletRequest req, 
+156                       HttpServletResponse res, 
+157                       PluginMetadataParameter parameter, 
+158                       String idP) throws WayfRequestHandled;
+159 }
 

diff --git a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/PluginContext.html b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/PluginContext.html index 23967b7..b2f158e 100644 --- a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/PluginContext.html +++ b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/PluginContext.html @@ -1,44 +1,44 @@ - + PluginContext xref
View Javadoc
 
-1   /**
-2    * Copyright [2006] [University Corporation for Advanced Internet Development, Inc.]
-3    *
-4    * Licensed under the Apache License, Version 2.0 (the "License");
-5    * you may not use this file except in compliance with the License.
-6    * You may obtain a copy of the License at
-7    *
-8    * http://www.apache.org/licenses/LICENSE-2.0
-9    *
-10   * Unless required by applicable law or agreed to in writing, software
-11   * distributed under the License is distributed on an "AS IS" BASIS,
-12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-13   * See the License for the specific language governing permissions and
-14   * limitations under the License.
-15   */
-16  
-17  package edu.internet2.middleware.shibboleth.wayf.plugins;
-18  
-19  /**
-20   * This is a marker interface.
-21   * <p>
-22   * Objects which implement PluginContext are passed between sucessive calls to a plugins implementations of
-23   * {@link Plugin#lookup lookup} and {@link Plugin#search search} as the plugin 
-24   * is called for each {@link org.opensaml.saml2.metadata.provider.MetadataProvider}.
-25   * <p>
-26   * @author Rod Widdowson
-27   * @version Discussion
-28   */
-29  public interface PluginContext {
-30  
-31  }
+1   /**
+2    * Copyright [2006] [University Corporation for Advanced Internet Development, Inc.]
+3    *
+4    * Licensed under the Apache License, Version 2.0 (the "License");
+5    * you may not use this file except in compliance with the License.
+6    * You may obtain a copy of the License at
+7    *
+8    * http://www.apache.org/licenses/LICENSE-2.0
+9    *
+10   * Unless required by applicable law or agreed to in writing, software
+11   * distributed under the License is distributed on an "AS IS" BASIS,
+12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+13   * See the License for the specific language governing permissions and
+14   * limitations under the License.
+15   */
+16  
+17  package edu.internet2.middleware.shibboleth.wayf.plugins;
+18  
+19  /**
+20   * This is a marker interface.
+21   * <p>
+22   * Objects which implement PluginContext are passed between sucessive calls to a plugins implementations of
+23   * {@link Plugin#lookup lookup} and {@link Plugin#search search} as the plugin 
+24   * is called for each {@link org.opensaml.saml2.metadata.provider.MetadataProvider}.
+25   * <p>
+26   * @author Rod Widdowson
+27   * @version Discussion
+28   */
+29  public interface PluginContext {
+30  
+31  }
 

diff --git a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/PluginMetadataParameter.html b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/PluginMetadataParameter.html index e07d9e0..b5d416e 100644 --- a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/PluginMetadataParameter.html +++ b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/PluginMetadataParameter.html @@ -1,43 +1,43 @@ - + PluginMetadataParameter xref
View Javadoc
 
-1   /**
-2    * Copyright [2006] [University Corporation for Advanced Internet Development, Inc.]
-3    *
-4    * Licensed under the Apache License, Version 2.0 (the "License");
-5    * you may not use this file except in compliance with the License.
-6    * You may obtain a copy of the License at
-7    *
-8    * http://www.apache.org/licenses/LICENSE-2.0
-9    *
-10   * Unless required by applicable law or agreed to in writing, software
-11   * distributed under the License is distributed on an "AS IS" BASIS,
-12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-13   * See the License for the specific language governing permissions and
-14   * limitations under the License.
-15   */
-16  package edu.internet2.middleware.shibboleth.wayf.plugins;
-17  
-18  
-19  /**
-20   * The PluginParameter is a marker interface which a WAYF {@link Plugin} can use to associate extra information 
-21   * with the metadata.  Each plugin returns a PluginParameter from {@link Plugin#refreshMetadata RefreshMetadata}
-22   * and this is in turn presented back to then Plugin when it is called  during WAYF processing. 
-23   * <p>
-24   * @author Rod Widdowson
-25   * @version Discussion
-26   *
-27   */
-28  public interface PluginMetadataParameter {
-29  
-30  }
+1   /**
+2    * Copyright [2006] [University Corporation for Advanced Internet Development, Inc.]
+3    *
+4    * Licensed under the Apache License, Version 2.0 (the "License");
+5    * you may not use this file except in compliance with the License.
+6    * You may obtain a copy of the License at
+7    *
+8    * http://www.apache.org/licenses/LICENSE-2.0
+9    *
+10   * Unless required by applicable law or agreed to in writing, software
+11   * distributed under the License is distributed on an "AS IS" BASIS,
+12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+13   * See the License for the specific language governing permissions and
+14   * limitations under the License.
+15   */
+16  package edu.internet2.middleware.shibboleth.wayf.plugins;
+17  
+18  
+19  /**
+20   * The PluginParameter is a marker interface which a WAYF {@link Plugin} can use to associate extra information 
+21   * with the metadata.  Each plugin returns a PluginParameter from {@link Plugin#refreshMetadata RefreshMetadata}
+22   * and this is in turn presented back to then Plugin when it is called  during WAYF processing. 
+23   * <p>
+24   * @author Rod Widdowson
+25   * @version Discussion
+26   *
+27   */
+28  public interface PluginMetadataParameter {
+29  
+30  }
 

diff --git a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/WayfRequestHandled.html b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/WayfRequestHandled.html index bb9d473..8facffe 100644 --- a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/WayfRequestHandled.html +++ b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/WayfRequestHandled.html @@ -1,30 +1,30 @@ - + WayfRequestHandled xref
View Javadoc
 
-1   package edu.internet2.middleware.shibboleth.wayf.plugins;
-2   
-3   /**
-4    * 
-5    * This Exception can be signalled by a plugin to indicate to the WAYF that it has handled the 
-6    * request and all processing should stop.
-7    * 
-8    * @author Rod Widdowson
-9    */
-10  public class WayfRequestHandled extends Exception {
-11  
-12     /**
-13      * Required Serialization constant.
-14      */
-15      private static final long serialVersionUID = 3022489208153734092L;
-16  
-17  }
+1   package edu.internet2.middleware.shibboleth.wayf.plugins;
+2   
+3   /**
+4    * 
+5    * This Exception can be signalled by a plugin to indicate to the WAYF that it has handled the 
+6    * request and all processing should stop.
+7    * 
+8    * @author Rod Widdowson
+9    */
+10  public class WayfRequestHandled extends Exception {
+11  
+12     /**
+13      * Required Serialization constant.
+14      */
+15      private static final long serialVersionUID = 3022489208153734092L;
+16  
+17  }
 

diff --git a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/package-frame.html b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/package-frame.html index f1f59a9..e12c25c 100644 --- a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/package-frame.html +++ b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/package-frame.html @@ -2,8 +2,8 @@ - - Shibboleth Discovery Service 1.1.1 Reference Package edu.internet2.middleware.shibboleth.wayf.plugins + + Shibboleth Discovery Service 1.1.2 Reference Package edu.internet2.middleware.shibboleth.wayf.plugins diff --git a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/package-summary.html b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/package-summary.html index 09d4e41..7f243ac 100644 --- a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/package-summary.html +++ b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/package-summary.html @@ -2,8 +2,8 @@ - - Shibboleth Discovery Service 1.1.1 Reference Package edu.internet2.middleware.shibboleth.wayf.plugins + + Shibboleth Discovery Service 1.1.2 Reference Package edu.internet2.middleware.shibboleth.wayf.plugins @@ -77,6 +77,6 @@
- Copyright © 2006-2009 Internet2. All Rights Reserved. + Copyright © 2006-2010 Internet2. All Rights Reserved. \ No newline at end of file diff --git a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/BindingFilter.html b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/BindingFilter.html index 8b1fa09..c99499a 100644 --- a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/BindingFilter.html +++ b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/BindingFilter.html @@ -1,187 +1,191 @@ - + BindingFilter xref
View Javadoc
 
-1   /*
-2    * Copyright 2008 University Corporation for Advanced Internet Development, Inc.
-3    *
-4    * Licensed under the Apache License, Version 2.0 (the "License");
-5    * you may not use this file except in compliance with the License.
-6    * You may obtain a copy of the License at
-7    *
-8    * http://www.apache.org/licenses/LICENSE-2.0
-9    *
-10   * Unless required by applicable law or agreed to in writing, software
-11   * distributed under the License is distributed on an "AS IS" BASIS,
-12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-13   * See the License for the specific language governing permissions and
-14   * limitations under the License.
-15   */
-16  
-17  package edu.internet2.middleware.shibboleth.wayf.plugins.provider;
-18  
-19  import java.util.Iterator;
-20  import java.util.List;
-21  
-22  import org.opensaml.saml2.common.Extensions;
-23  import org.opensaml.saml2.metadata.EntitiesDescriptor;
-24  import org.opensaml.saml2.metadata.EntityDescriptor;
-25  import org.opensaml.saml2.metadata.RoleDescriptor;
-26  import org.opensaml.saml2.metadata.SPSSODescriptor;
-27  import org.opensaml.saml2.metadata.provider.FilterException;
-28  import org.opensaml.saml2.metadata.provider.MetadataFilter;
-29  import org.opensaml.samlext.idpdisco.DiscoveryResponse;
-30  import org.opensaml.xml.XMLObject;
-31  import org.slf4j.Logger;
-32  import org.slf4j.LoggerFactory;
-33  
-34  /**
-35   * See SDSJ-48.  If we get a DS endpoint then we need to check that the binding is provided
-36   * and that it is correct.
-37   * 
-38   * @author Rod Widdowson
-39   *
-40   */
-41  public class BindingFilter implements MetadataFilter {
-42  
-43      /**
-44       * Log for the warning. 
-45       */
-46      private static final Logger LOG = LoggerFactory.getLogger(BindingFilter.class.getName());
-47      
-48      /**
-49       * Set if we just want to warn on failure.
-50       */
-51      private final boolean warnOnFailure;
-52      
-53      /**
-54       * Only the protected constructor should be visible.
-55       */
-56      private BindingFilter() {
-57          this.warnOnFailure = false;
-58      }
-59      
-60      /**
-61       * Initialize the filter.
-62       * @param warn do we warn or do we fail if we see badness?
-63       */
-64      public BindingFilter(boolean warn) {
-65          this.warnOnFailure = warn;
-66      }
-67      
-68      /**
-69       * Apply the filter.
-70       * @see org.opensaml.saml2.metadata.provider.MetadataFilter#doFilter(org.opensaml.xml.XMLObject)
-71       * @param metadata what to filter.
-72       * @throws FilterException if it sees any missed or bad bindings.
-73       */
-74      public void doFilter(XMLObject metadata) throws FilterException {
-75  
-76          if (metadata instanceof EntitiesDescriptor) {
-77              
-78              checkEntities((EntitiesDescriptor) metadata);
-79              
-80          } else if (metadata instanceof EntityDescriptor) {
-81              EntityDescriptor entity = (EntityDescriptor) metadata;
-82              
-83              if (!checkEntity(entity)) {
-84                  if (warnOnFailure) {
-85                      LOG.warn("Badly formatted binding for " + entity.getEntityID());
-86                  } else {
-87                      LOG.error("Badly formatted binding for top level entity " + entity.getEntityID());
-88                  }
-89              }
-90          }
-91      }
-92  
-93      /**
-94       * If the entity has an SP characteristic, and it has a DS endpoint
-95       * then check its binding.
-96       * 
-97       * @param entity what to check.
-98       * @return true if all is OK.
-99       */
-100     private static boolean checkEntity(EntityDescriptor entity) {
-101         List<RoleDescriptor> roles = entity.getRoleDescriptors();
-102         
-103         for (RoleDescriptor role:roles) {
-104             
-105             //
-106             // Check every role
-107             //
-108             if (role instanceof SPSSODescriptor) {
-109                 
-110                 //
-111                 // Grab hold of all the extensions for SPSSO descriptors
-112                 //
-113                 
-114                 Extensions exts = role.getExtensions();
-115                 if (exts != null) {
-116                     //
-117                     // We have some children check them form <DiscoveryResponse>
-118                     //
-119                     List<XMLObject> children = exts.getOrderedChildren();
-120                     
-121                     for (XMLObject obj : children) {
-122                         if (obj instanceof DiscoveryResponse) {
-123                             //
-124                             // And check or the binding
-125                             //
-126                             DiscoveryResponse ds = (DiscoveryResponse) obj;
-127                             String binding = ds.getBinding(); 
-128 
-129                             if (!DiscoveryResponse.IDP_DISCO_NS.equals(binding)) {
-130                                 return false;
-131                             }
-132                         }
-133                     }
-134                 }
-135             }
-136         }
-137         return true;
-138     }
-139     
-140     /**
-141      * Check an EntitiesDescriptor call checkentities for the Entities and ourselves
-142      *  recursively for the EntitesDescriptors.
-143      *  
-144      * @param entities what to check.
-145      */
-146     private void checkEntities(EntitiesDescriptor entities) {
-147         List<EntitiesDescriptor> childEntities = entities.getEntitiesDescriptors();
-148         List<EntityDescriptor> children = entities.getEntityDescriptors();
-149         
-150         if (children != null) {
-151             Iterator<EntityDescriptor> itr;
-152             EntityDescriptor entity;
-153             itr = children.iterator();
-154             
-155             while (itr.hasNext()) {
-156                 entity = itr.next();
-157                 if (!checkEntity(entity)) { 
-158                     if (warnOnFailure) {
-159                         LOG.warn("Badly formatted binding for " + entity.getEntityID());
-160                     } else {
-161                         LOG.error("Badly formatted binding for " + entity.getEntityID() + ". Entity has been removed");
-162                         itr.remove();
-163                     }
-164                 }
-165             }
-166         }
-167         
-168         if (childEntities != null) {
-169             for (EntitiesDescriptor descriptor : childEntities) {
-170                 checkEntities(descriptor);
-171             }
-172         }
-173     }
-174 }
+1   /*
+2    * Copyright 2008 University Corporation for Advanced Internet Development, Inc.
+3    *
+4    * Licensed under the Apache License, Version 2.0 (the "License");
+5    * you may not use this file except in compliance with the License.
+6    * You may obtain a copy of the License at
+7    *
+8    * http://www.apache.org/licenses/LICENSE-2.0
+9    *
+10   * Unless required by applicable law or agreed to in writing, software
+11   * distributed under the License is distributed on an "AS IS" BASIS,
+12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+13   * See the License for the specific language governing permissions and
+14   * limitations under the License.
+15   */
+16  
+17  package edu.internet2.middleware.shibboleth.wayf.plugins.provider;
+18  
+19  import java.util.Collection;
+20  import java.util.HashSet;
+21  import java.util.Iterator;
+22  import java.util.List;
+23  
+24  import org.opensaml.saml2.common.Extensions;
+25  import org.opensaml.saml2.metadata.EntitiesDescriptor;
+26  import org.opensaml.saml2.metadata.EntityDescriptor;
+27  import org.opensaml.saml2.metadata.RoleDescriptor;
+28  import org.opensaml.saml2.metadata.SPSSODescriptor;
+29  import org.opensaml.saml2.metadata.provider.FilterException;
+30  import org.opensaml.saml2.metadata.provider.MetadataFilter;
+31  import org.opensaml.samlext.idpdisco.DiscoveryResponse;
+32  import org.opensaml.xml.XMLObject;
+33  import org.slf4j.Logger;
+34  import org.slf4j.LoggerFactory;
+35  
+36  /**
+37   * See SDSJ-48.  If we get a DS endpoint then we need to check that the binding is provided
+38   * and that it is correct.
+39   * 
+40   * @author Rod Widdowson
+41   *
+42   */
+43  public class BindingFilter implements MetadataFilter {
+44  
+45      /**
+46       * Log for the warning. 
+47       */
+48      private static final Logger LOG = LoggerFactory.getLogger(BindingFilter.class.getName());
+49      
+50      /**
+51       * Set if we just want to warn on failure.
+52       */
+53      private final boolean warnOnFailure;
+54      
+55      /**
+56       * Only the protected constructor should be visible.
+57       */
+58      private BindingFilter() {
+59          this.warnOnFailure = false;
+60      }
+61      
+62      /**
+63       * Initialize the filter.
+64       * @param warn do we warn or do we fail if we see badness?
+65       */
+66      public BindingFilter(boolean warn) {
+67          this.warnOnFailure = warn;
+68      }
+69      
+70      /**
+71       * Apply the filter.
+72       * @see org.opensaml.saml2.metadata.provider.MetadataFilter#doFilter(org.opensaml.xml.XMLObject)
+73       * @param metadata what to filter.
+74       * @throws org.opensaml.saml2.metadata.provider.FilterException if it sees any missed or bad bindings.
+75       */
+76      public void doFilter(XMLObject metadata) throws FilterException {
+77  
+78          if (metadata instanceof EntitiesDescriptor) {
+79              
+80              checkEntities((EntitiesDescriptor) metadata);
+81              
+82          } else if (metadata instanceof EntityDescriptor) {
+83              EntityDescriptor entity = (EntityDescriptor) metadata;
+84              
+85              if (!checkEntity(entity)) {
+86                  if (warnOnFailure) {
+87                      LOG.warn("Badly formatted binding for " + entity.getEntityID());
+88                  } else {
+89                      LOG.error("Badly formatted binding for top level entity " + entity.getEntityID());
+90                  }
+91              }
+92          }
+93      }
+94  
+95      /**
+96       * If the entity has an SP characteristic, and it has a DS endpoint
+97       * then check its binding.
+98       * 
+99       * @param entity what to check.
+100      * @return true if all is OK.
+101      */
+102     private static boolean checkEntity(EntityDescriptor entity) {
+103         List<RoleDescriptor> roles = entity.getRoleDescriptors();
+104         
+105         for (RoleDescriptor role:roles) {
+106             
+107             //
+108             // Check every role
+109             //
+110             if (role instanceof SPSSODescriptor) {
+111                 
+112                 //
+113                 // Grab hold of all the extensions for SPSSO descriptors
+114                 //
+115                 
+116                 Extensions exts = role.getExtensions();
+117                 if (exts != null) {
+118                     //
+119                     // We have some children check them form <DiscoveryResponse>
+120                     //
+121                     List<XMLObject> children = exts.getOrderedChildren();
+122                     
+123                     for (XMLObject obj : children) {
+124                         if (obj instanceof DiscoveryResponse) {
+125                             //
+126                             // And check or the binding
+127                             //
+128                             DiscoveryResponse ds = (DiscoveryResponse) obj;
+129                             String binding = ds.getBinding(); 
+130 
+131                             if (!DiscoveryResponse.IDP_DISCO_NS.equals(binding)) {
+132                                 return false;
+133                             }
+134                         }
+135                     }
+136                 }
+137             }
+138         }
+139         return true;
+140     }
+141     
+142     /**
+143      * Check an EntitiesDescriptor call checkentities for the Entities and ourselves
+144      *  recursively for the EntitesDescriptors.
+145      *  
+146      * @param entities what to check.
+147      */
+148     private void checkEntities(EntitiesDescriptor entities) {
+149         List<EntitiesDescriptor> childEntities = entities.getEntitiesDescriptors();
+150         List<EntityDescriptor> children = entities.getEntityDescriptors();
+151         Collection<EntityDescriptor> excludes = new HashSet<EntityDescriptor>();
+152         
+153         if (children != null) {
+154             Iterator<EntityDescriptor> itr;
+155             EntityDescriptor entity;
+156             itr = children.iterator();
+157             
+158             while (itr.hasNext()) {
+159                 entity = itr.next();
+160                 if (!checkEntity(entity)) { 
+161                     if (warnOnFailure) {
+162                         LOG.warn("Badly formatted binding for " + entity.getEntityID());
+163                     } else {
+164                         LOG.error("Badly formatted binding for " + entity.getEntityID() + ". Entity has been removed");
+165                         excludes.add(entity);
+166                     }
+167                 }
+168             }
+169             children.removeAll(excludes);
+170         }
+171         
+172         if (childEntities != null) {
+173             for (EntitiesDescriptor descriptor : childEntities) {
+174                 checkEntities(descriptor);
+175             }
+176         }
+177     }
+178 }
 

diff --git a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/ListFilter.html b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/ListFilter.html index d0b7acc..ad96e7d 100644 --- a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/ListFilter.html +++ b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/ListFilter.html @@ -1,196 +1,202 @@ - + ListFilter xref
View Javadoc
 
-1   /*
-2    * Copyright 2008 University Corporation for Advanced Internet Development, Inc.
-3    *
-4    * Licensed under the Apache License, Version 2.0 (the "License");
-5    * you may not use this file except in compliance with the License.
-6    * You may obtain a copy of the License at
-7    *
-8    * http://www.apache.org/licenses/LICENSE-2.0
-9    *
-10   * Unless required by applicable law or agreed to in writing, software
-11   * distributed under the License is distributed on an "AS IS" BASIS,
-12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-13   * See the License for the specific language governing permissions and
-14   * limitations under the License.
-15   */
-16  
-17  package edu.internet2.middleware.shibboleth.wayf.plugins.provider;
-18  
-19  import java.util.HashSet;
-20  import java.util.Iterator;
-21  import java.util.List;
-22  import java.util.Set;
-23  
-24  import org.opensaml.saml2.metadata.EntitiesDescriptor;
-25  import org.opensaml.saml2.metadata.EntityDescriptor;
-26  import org.opensaml.saml2.metadata.provider.FilterException;
-27  import org.opensaml.saml2.metadata.provider.MetadataFilter;
-28  import org.opensaml.xml.XMLObject;
-29  import org.slf4j.Logger;
-30  import org.slf4j.LoggerFactory;
-31  import org.w3c.dom.Element;
-32  import org.w3c.dom.NodeList;
-33  
-34  import edu.internet2.middleware.shibboleth.wayf.XMLConstants;
-35  
-36  /**
-37   * See SDSJ-57.  Explicit 
-38   * 
-39   * @author Rod Widdowson
-40   *
-41   */
-42  public class ListFilter implements MetadataFilter {
-43  
-44      /**
-45       * Log for any messages.
-46       */
-47      private static final Logger LOG = LoggerFactory.getLogger(ListFilter.class.getName());
-48      
-49      /**
-50       * Set if this is a blacklist.
-51       */
-52      private boolean excludeEntries;
-53      
-54      /**
-55       * The list of entities.
-56       */
-57      private final Set<String> filterEntities;
-58      
-59      /**
-60       * The name of the filter (needed for debug).
-61       */
-62      private final String filterName;
-63      
-64      /**
-65       * Only the protected constructor should be visible.
-66       */
-67      private ListFilter() {
-68          this.excludeEntries = false;
-69          this.filterEntities = new HashSet<String>(0);
-70          this.filterName = "anonymous";
-71      }
-72      
-73      /**
-74       * Initialize the filter.
-75       * @param config the configuration
-76       *
-77       * The configuration looks liken this
-78       * <code> <Filter identifier="WhiteList" 
-79       *                type ="edu.internet2.middleware.shibboleth.wayf.plugins.provider.ListFilter"
-80       *                excludeEntries = "true" >
-81       *        <EntityId>foo</EntityId>
-82       *        [...]
-83       *        </Filter>
-84       *  </code>
-85       */
-86      public ListFilter(Element config) {
-87          String excludeEntriesValue;
-88          this.filterEntities = new HashSet<String>(10);
-89          this.filterName = config.getAttribute("identifier");
-90          excludeEntriesValue = config.getAttribute("excludeEntries");
-91          
-92          if (null == excludeEntriesValue || 0 == excludeEntriesValue.length()) {
-93              this.excludeEntries = true;
-94          } else {
-95              this.excludeEntries = Boolean.getBoolean(excludeEntriesValue);
-96          }
-97          
-98          NodeList itemElements = config.getElementsByTagNameNS(XMLConstants.CONFIG_NS, "EntityId");
-99          
-100         if (excludeEntries) {
-101             LOG.debug("Populating blacklist " + filterName);
-102         } else {
-103             LOG.debug("Populating whitelist " + filterName);
-104         }  
-105         
-106         for (int i = 0; i < itemElements.getLength(); i++) {
-107             Element element = (Element) itemElements.item(i);
-108             String entityId = element.getTextContent();
-109             
-110             LOG.debug("\t" + entityId);
-111             this.filterEntities.add(entityId);
-112         }
-113     }
-114     
-115     /**
-116      * Apply the filter.
-117      * @see org.opensaml.saml2.metadata.provider.MetadataFilter#doFilter(org.opensaml.xml.XMLObject)
-118      * @param metadata what to filter.
-119      * @throws FilterException if it sees any missed or bad bindings.
-120      */
-121     public void doFilter(XMLObject metadata) throws FilterException {
-122 
-123         if (metadata instanceof EntitiesDescriptor) { 
-124             filterEntities((EntitiesDescriptor)metadata);
-125         } else if (metadata instanceof EntityDescriptor) {
-126             EntityDescriptor entity = (EntityDescriptor) metadata;
-127             String entityName = entity.getEntityID();
-128             
-129             if (excludeEntries) {
-130                 if (filterEntities.contains(entityName)) {
-131                     LOG.error("Metadata provider contains a single <EntityDescriptor> (" + entityName + 
-132                               ") which is in exclude list");
-133                 }
-134             } else if (!filterEntities.contains(entity.getEntityID())) {
-135                 LOG.error("Metadata provider contains a single <EntityDescriptor>  (" + entityName + 
-136                           ") which is not on include list");
-137             }
-138         }
-139     }
-140 
-141     /**
-142      * Filter an EntitiesDescriptor .  We do this explictly for the Entities and call ourselves
-143      *  recursively for the EntitesDescriptors.
-144      *  
-145      * @param entities what to check.
-146      */
-147     private void filterEntities(EntitiesDescriptor entities) {
-148         String entitiesName = entities.getName();
-149         List<EntitiesDescriptor> childEntities = entities.getEntitiesDescriptors();
-150         List<EntityDescriptor> children = entities.getEntityDescriptors();
-151         
-152         //
-153         // Go through and apply the filter
-154         //
-155 
-156         if (children != null) {
-157             Iterator<EntityDescriptor> itr;
-158             EntityDescriptor entity;
-159             itr = children.iterator();
-160             
-161             while (itr.hasNext()) {
-162                 entity = itr.next();
-163                 String entityName = entity.getEntityID();
-164                 if (excludeEntries) {
-165 
-166                     if (filterEntities.contains(entityName)) {
-167                         LOG.debug("Filter " + filterName + ": Removing blacklisted "  + entityName + " from " + entitiesName);
-168                         itr.remove();
-169                     }
-170                 } else if (!filterEntities.contains(entityName)) {
-171                     LOG.debug("Filter " + filterName + ": Removing non-whitelisted "  + entityName + " from " + entitiesName);
-172                     itr.remove();
-173                 }
-174             } 
-175         }
-176         
-177         if (childEntities != null) {
-178             for (EntitiesDescriptor descriptor : childEntities) {
-179                 filterEntities(descriptor);
-180             }
-181         }
-182     }
-183 }
+1   /*
+2    * Copyright 2008 University Corporation for Advanced Internet Development, Inc.
+3    *
+4    * Licensed under the Apache License, Version 2.0 (the "License");
+5    * you may not use this file except in compliance with the License.
+6    * You may obtain a copy of the License at
+7    *
+8    * http://www.apache.org/licenses/LICENSE-2.0
+9    *
+10   * Unless required by applicable law or agreed to in writing, software
+11   * distributed under the License is distributed on an "AS IS" BASIS,
+12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+13   * See the License for the specific language governing permissions and
+14   * limitations under the License.
+15   */
+16  
+17  package edu.internet2.middleware.shibboleth.wayf.plugins.provider;
+18  
+19  import java.util.Collection;
+20  import java.util.HashSet;
+21  import java.util.Iterator;
+22  import java.util.List;
+23  import java.util.Set;
+24  
+25  import org.opensaml.saml2.metadata.EntitiesDescriptor;
+26  import org.opensaml.saml2.metadata.EntityDescriptor;
+27  import org.opensaml.saml2.metadata.provider.FilterException;
+28  import org.opensaml.saml2.metadata.provider.MetadataFilter;
+29  import org.opensaml.xml.XMLObject;
+30  import org.slf4j.Logger;
+31  import org.slf4j.LoggerFactory;
+32  import org.w3c.dom.Element;
+33  import org.w3c.dom.NodeList;
+34  
+35  import edu.internet2.middleware.shibboleth.wayf.XMLConstants;
+36  
+37  /**
+38   * See SDSJ-57.  Explicit 
+39   * 
+40   * @author Rod Widdowson
+41   *
+42   */
+43  public class ListFilter implements MetadataFilter {
+44  
+45      /**
+46       * Log for any messages.
+47       */
+48      private static final Logger LOG = LoggerFactory.getLogger(ListFilter.class.getName());
+49      
+50      /**
+51       * Set if this is a blacklist.
+52       */
+53      private boolean excludeEntries;
+54      
+55      /**
+56       * The list of entities.
+57       */
+58      private final Set<String> filterEntities;
+59      
+60      /**
+61       * The name of the filter (needed for debug).
+62       */
+63      private final String filterName;
+64      
+65      /**
+66       * Only the protected constructor should be visible.
+67       */
+68      private ListFilter() {
+69          this.excludeEntries = false;
+70          this.filterEntities = new HashSet<String>(0);
+71          this.filterName = "anonymous";
+72      }
+73      
+74      /**
+75       * Initialize the filter.
+76       * @param config the configuration
+77       *
+78       * The configuration looks liken this
+79       * <code> <Filter identifier="WhiteList" 
+80       *                type ="edu.internet2.middleware.shibboleth.wayf.plugins.provider.ListFilter"
+81       *                excludeEntries = "true" >
+82       *        <EntityId>foo</EntityId>
+83       *        [...]
+84       *        </Filter>
+85       *  </code>
+86       */
+87      public ListFilter(Element config) {
+88          String excludeEntriesValue;
+89          this.filterEntities = new HashSet<String>(10);
+90          this.filterName = config.getAttribute("identifier");
+91          excludeEntriesValue = config.getAttribute("excludeEntries");
+92          
+93          if (null == excludeEntriesValue || 0 == excludeEntriesValue.length()) {
+94              this.excludeEntries = true;
+95          } else {
+96              this.excludeEntries = Boolean.parseBoolean(excludeEntriesValue);
+97          }
+98          
+99          NodeList itemElements = config.getElementsByTagNameNS(XMLConstants.CONFIG_NS, "EntityId");
+100         
+101         if (excludeEntries) {
+102             LOG.debug("Populating blacklist " + filterName);
+103         } else {
+104             LOG.debug("Populating whitelist " + filterName);
+105         }  
+106         
+107         for (int i = 0; i < itemElements.getLength(); i++) {
+108             Element element = (Element) itemElements.item(i);
+109             String entityId = element.getTextContent();
+110             
+111             LOG.debug("\t" + entityId);
+112             this.filterEntities.add(entityId);
+113         }
+114     }
+115     
+116     /**
+117      * Apply the filter.
+118      * @see org.opensaml.saml2.metadata.provider.MetadataFilter#doFilter(org.opensaml.xml.XMLObject)
+119      * @param metadata what to filter.
+120      * @throws FilterException if it sees any missed or bad bindings.
+121      */
+122     public void doFilter(XMLObject metadata) throws FilterException {
+123 
+124         if (metadata instanceof EntitiesDescriptor) { 
+125             filterEntities((EntitiesDescriptor)metadata);
+126         } else if (metadata instanceof EntityDescriptor) {
+127             EntityDescriptor entity = (EntityDescriptor) metadata;
+128             String entityName = entity.getEntityID();
+129             
+130             if (excludeEntries) {
+131                 if (filterEntities.contains(entityName)) {
+132                     LOG.error("Metadata provider contains a single <EntityDescriptor> (" + entityName + 
+133                               ") which is in exclude list");
+134                 }
+135             } else if (!filterEntities.contains(entity.getEntityID())) {
+136                 LOG.error("Metadata provider contains a single <EntityDescriptor>  (" + entityName + 
+137                           ") which is not on include list");
+138             }
+139         }
+140     }
+141 
+142     /**
+143      * Filter an EntitiesDescriptor .  We do this explictly for the Entities and call ourselves
+144      *  recursively for the EntitesDescriptors.
+145      *  
+146      * @param entities what to check.
+147      */
+148     private void filterEntities(EntitiesDescriptor entities) {
+149         String entitiesName = entities.getName();
+150         List<EntitiesDescriptor> childEntities = entities.getEntitiesDescriptors();
+151         List<EntityDescriptor> children = entities.getEntityDescriptors();
+152         Collection<EntityDescriptor> excludes = new HashSet<EntityDescriptor>();
+153         
+154         //
+155         // Go through and apply the filter
+156         //
+157 
+158         if (children != null) {
+159             Iterator<EntityDescriptor> itr;
+160             EntityDescriptor entity;
+161             itr = children.iterator();
+162             
+163             while (itr.hasNext()) {
+164                 entity = itr.next();
+165                 String entityName = entity.getEntityID();
+166                 if (excludeEntries) {
+167 
+168                     if (filterEntities.contains(entityName)) {
+169                         LOG.debug("Filter " + filterName + ": Removing blacklisted "  
+170                                 + entityName + " from " + entitiesName);
+171                         excludes.add(entity);
+172                     }
+173                 } else if (!filterEntities.contains(entityName)) {
+174                     LOG.debug("Filter " + filterName + ": Removing non-whitelisted "  
+175                             + entityName + " from " + entitiesName);
+176 
+177                     excludes.add(entity);
+178                 }
+179             } 
+180             children.removeAll(excludes);
+181         }
+182         
+183         if (childEntities != null) {
+184             for (EntitiesDescriptor descriptor : childEntities) {
+185                 filterEntities(descriptor);
+186             }
+187         }
+188     }
+189 }
 

diff --git a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/SamlCookiePlugin.html b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/SamlCookiePlugin.html index 9e6528e..239909e 100644 --- a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/SamlCookiePlugin.html +++ b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/SamlCookiePlugin.html @@ -1,557 +1,557 @@ - + SamlCookiePlugin xref
View Javadoc
 
-1   package edu.internet2.middleware.shibboleth.wayf.plugins.provider;
-2   
-3   import java.io.UnsupportedEncodingException;
-4   import java.net.URLDecoder;
-5   import java.net.URLEncoder;
-6   import java.util.ArrayList;
-7   import java.util.Collection;
-8   import java.util.Iterator;
-9   import java.util.List;
-10  import java.util.Map;
-11  
-12  import javax.servlet.http.Cookie;
-13  import javax.servlet.http.HttpServletRequest;
-14  import javax.servlet.http.HttpServletResponse;
-15  
-16  import org.apache.log4j.Logger;
-17  import org.opensaml.saml2.metadata.provider.MetadataProvider;
-18  import org.opensaml.xml.util.Base64;
-19  import org.w3c.dom.Element;
-20  
-21  import edu.internet2.middleware.shibboleth.wayf.DiscoveryServiceHandler;
-22  import edu.internet2.middleware.shibboleth.wayf.IdPSite;
-23  import edu.internet2.middleware.shibboleth.wayf.WayfException;
-24  import edu.internet2.middleware.shibboleth.wayf.plugins.Plugin;
-25  import edu.internet2.middleware.shibboleth.wayf.plugins.PluginContext;
-26  import edu.internet2.middleware.shibboleth.wayf.plugins.PluginMetadataParameter;
-27  import edu.internet2.middleware.shibboleth.wayf.plugins.WayfRequestHandled;
-28  
-29  /**
-30   * This is a test implementation of the saml cookie lookup stuff to 
-31   * see whether it fits the plugin architecture.
-32   * 
-33   * @author Rod Widdowson
-34   *
-35   */
-36  public class SamlCookiePlugin implements Plugin {
-37          
-38      /**
-39       * The parameter which controls the cache.
-40       */
-41      private static final String PARAMETER_NAME = "cache";
-42  
-43      /**
-44       * Parameter to say make it last a long time.
-45       */
-46      private static final String PARAMETER_PERM = "perm";
-47  
-48      /**
-49       * Parameter to say just keep this as long as the brower is open.
-50       */
-51      private static final String PARAMETER_SESSION = "session";
-52      
-53      /**
-54       * Handle for logging. 
-55       */
-56      private static Logger log = Logger.getLogger(SamlCookiePlugin.class.getName());
-57  
-58      /**
-59       * As specified in the SAML2 profiles specification.
-60       */
-61      private static final String COOKIE_NAME = "_saml_idp";
-62  
-63      /**
-64       * By default we keep the cookie around for a week.
-65       */
-66      private static final int DEFAULT_CACHE_EXPIRATION = 6048000;
-67      
-68      /**
-69       * Do we always go where the cookie tells us, or do we just provide the cookie as a hint.
-70       */
-71      private boolean alwaysFollow;
-72  
-73      /**
-74       * Is our job to clean up the cookie. 
-75       */
-76      private boolean deleteCookie;
-77      
-78      /**
-79       * Lipservice towards having a common domain cookie. 
-80       */
-81      private String cacheDomain; 
-82      
-83      /**
-84       * How long the cookie our will be active? 
-85       */
-86      private int cacheExpiration;
-87      
-88      /**
-89       * This constructor is called during wayf initialization with it's
-90       * own little bit of XML config.
-91       * 
-92       * @param element - further information to be gleaned from the DOM.
-93       */
-94      public SamlCookiePlugin(Element element) {
-95          /*
-96           * <Plugin idenfifier="WayfCookiePlugin" 
-97           *         type="edu.internet2.middleware.shibboleth.wayf.plugins.provider.SamlCookiePlugin"
-98           *         alwaysFollow = "FALSE"
-99           *         deleteCookie = "FALSE"
-100          *         cacheExpiration = "number" 
-101          *         cacheDomain = "string"/> 
-102          */
-103         log.info("New plugin");
-104         String s;
-105 
-106         s = element.getAttribute("alwaysFollow");
-107         if (s != null && !s.equals("") ) {
-108             alwaysFollow = Boolean.valueOf(s).booleanValue();
-109         } else {
-110             alwaysFollow = true;
-111         }
-112             
-113         s = element.getAttribute("deleteCookie");
-114         if (s != null && !s.equals("")) {
-115             deleteCookie = Boolean.valueOf(s).booleanValue();
-116         } else {
-117             deleteCookie = false;
-118         }
-119             
-120         s = element.getAttribute("cacheDomain");
-121         if ((s != null) && !s.equals("")) {
-122             cacheDomain = s;
-123         } else {
-124             cacheDomain = "";
-125         }
-126         
-127         s  = element.getAttribute("cacheExpiration");
-128         if ((s != null) && !s.equals("")) {
-129             
-130             try {
-131 
-132                 cacheExpiration = Integer.parseInt(s);
-133             } catch (NumberFormatException ex) {
-134                     
-135                 log.error("Invalid CacheExpiration value - " + s);
-136                 cacheExpiration = DEFAULT_CACHE_EXPIRATION;                       
-137             }
-138         } else {
-139             cacheExpiration = DEFAULT_CACHE_EXPIRATION;
-140         }
-141     }
-142     
-143     /**
-144      * Create a plugin with the hard-wired default settings.
-145      */
-146     private SamlCookiePlugin() {
-147         alwaysFollow = false;
-148         deleteCookie = false;
-149         cacheExpiration = DEFAULT_CACHE_EXPIRATION;
-150     }
-151 
-152     /**
-153      * This is the 'hook' in the lookup part of Discovery Service processing. 
-154      * 
-155      * @param req - Describes the current request.  Used to find any appropriate cookies 
-156      * @param res - Describes the current response.  Used to redirect the request. 
-157      * @param parameter - Describes the metadata.
-158      * @param context - Any processing context returned from a previous call. We set this on first call and
-159      *                  use non null to indicate that we don't go there again.
-160      * @param validIdps The list of IdPs which is currently views as possibly matches for the pattern. 
-161      *                  The Key is the EntityId for the IdP and the value the object which describes 
-162      *                  the Idp 
-163      * @param idpList The set of Idps which are currently considered as potential hints.    
-164      * @return a context to hand to subsequent calls
-165      * @throws WayfRequestHandled if the plugin has handled the request.
-166      * issues a redirect)
-167      * 
-168      * @see edu.internet2.middleware.shibboleth.wayf.plugins.Plugin#lookup
-169      */
-170     public PluginContext lookup(HttpServletRequest req,
-171                                 HttpServletResponse res,  
-172                                 PluginMetadataParameter parameter, 
-173                                 Map<String, IdPSite> validIdps,
-174                                 PluginContext context,
-175                                 List <IdPSite> idpList) throws WayfRequestHandled {
-176             
-177         if (context != null) {
-178             //
-179             // We only need to be called once
-180             //
-181             return context;
-182         }
-183             
-184         if (deleteCookie) {
-185             deleteCookie(req, res);
-186             //
-187             // Only need to be called once - so set up a parameter
-188             //
-189             return new Context() ;
-190         } 
-191         List <String> idps = getIdPCookie(req, res, cacheDomain).getIdPList();
-192             
-193         for (String idpName : idps) {
-194             IdPSite idp = validIdps.get(idpName);
-195             if (idp != null) {
-196                 if (alwaysFollow) {
-197                     try {
-198                         DiscoveryServiceHandler.forwardRequest(req, res, idp);
-199                     } catch (WayfException e) {
-200                         // Do nothing we are going to throw anyway
-201                         ;
-202                     }
-203                     throw new WayfRequestHandled();
-204                 }
-205                 //
-206                 // This IDP is ok 
-207                 //
-208                 idpList.add(idp);
-209             }
-210         } 
-211             
-212         return null;
-213     }
-214 
-215     /**
-216      * Plugin point which is called when the data is refreshed.
-217      * @param metadata - where to get the data from.
-218      * @return the value which will be provided as input to subsequent calls
-219      * @see edu.internet2.middleware.shibboleth.wayf.plugins.Plugin#refreshMetadata
-220      */
-221     public PluginMetadataParameter refreshMetadata(MetadataProvider metadata) {
-222         //
-223         // We don't care about metadata - we are given all that we need
-224         //
-225         return null;
-226     }
-227 
-228     /**
-229      * Plgin point for searching.
-230      * 
-231      * @throws WayfRequestHandled 
-232      * @param req Describes the current request. 
-233      * @param res Describes the current response.
-234      * @param parameter Describes the metadata.
-235      * @param pattern What we are searchign for. 
-236      * @param validIdps The list of IdPs which is currently views as possibly matches for the pattern. 
-237      *                  The Key is the EntityId for the IdP and the value the object which describes 
-238      *                  the Idp 
-239      * @param context Any processing context returned from a previous call. We set this on first call and
-240      *                use non null to indicate that we don't go there again.
-241      * @param searchResult What the search yielded. 
-242      * @param idpList The set of Idps which are currently considered as potential hints.    
-243      * @return a context to hand to subsequent calls.
-244      * @see edu.internet2.middleware.shibboleth.wayf.plugins.Plugin#search
-245      * @throws WayfRequestHandled if the plugin has handled the request.
-246      * 
-247      */
-248     public PluginContext search(HttpServletRequest req,
-249                                 HttpServletResponse res, 
-250                                 PluginMetadataParameter parameter, 
-251                                 String pattern,
-252                                 Map<String, IdPSite> validIdps,
-253                                 PluginContext context,
-254                                 Collection<IdPSite> searchResult,
-255                                 List<IdPSite> idpList) throws WayfRequestHandled {
-256         //
-257         // Don't distinguish between lookup and search
-258         //
-259         return lookup(req, res, parameter, validIdps, context, idpList);
-260     }
-261 
-262     /**
-263      * Plugin point for selection.
-264      * 
-265      * @see edu.internet2.middleware.shibboleth.wayf.plugins.Plugin#selected(javax.servlet.http.HttpServletRequest.
-266      *  javax.servlet.http.HttpServletResponse, 
-267      *  edu.internet2.middleware.shibboleth.wayf.plugins.PluginMetadataParameter, 
-268      *  java.lang.String)
-269      * @param req Describes the current request. 
-270      * @param res Describes the current response.
-271      * @param parameter Describes the metadata.
-272      * @param idP Describes the idp.
-273      * 
-274      */
-275     public void selected(HttpServletRequest req, HttpServletResponse res,
-276                          PluginMetadataParameter parameter, String idP) {
-277             
-278         SamlIdPCookie cookie = getIdPCookie(req, res, cacheDomain);
-279         String param = req.getParameter(PARAMETER_NAME);
-280         
-281         if (null == param || param.equals("")) {
-282             return;
-283         } else if (param.equalsIgnoreCase(PARAMETER_SESSION)) {
-284             cookie.addIdPName(idP, -1);
-285         } else if (param.equalsIgnoreCase(PARAMETER_PERM)) {
-286             cookie.addIdPName(idP, cacheExpiration);
-287         }
-288     }
-289     
-290     //
-291     // Private classes for internal use
-292     //
-293     
-294     /**
-295      * This is just a marker tag.
-296      */
-297     private static class Context implements PluginContext {}
-298     
-299     /** 
-300      * Class to abstract away the saml cookie for us.
-301      */
-302     public final class SamlIdPCookie  {
-303 
-304             
-305         /**
-306          * The associated request.
-307          */
-308         private final HttpServletRequest req;
-309         /**
-310          * The associated response.
-311          */
-312         private final HttpServletResponse res;
-313         /**
-314          * The associated domain.
-315          */
-316         private final String domain;
-317         /**
-318          * The IdPs.
-319          */
-320         private final List <String> idPList = new ArrayList<String>();
-321             
-322         /**
-323          * Constructs a <code>SamlIdPCookie</code> from the provided string (which is the raw data. 
-324          * 
-325          * @param codedData
-326          *            the information read from the cookie
-327          * @param request Describes the current request. 
-328          * @param response Describes the current response.
-329          * @param domainName - if non null the domain for any *created* cookie.
-330          */
-331         private SamlIdPCookie(String codedData, 
-332                               HttpServletRequest request, 
-333                               HttpServletResponse response, 
-334                               String domainName) {
-335                     
-336             this.req = request;
-337             this.res = response;
-338             this.domain = domainName;
-339                     
-340             int start;
-341             int end;
-342                     
-343             if (codedData == null || codedData.equals(""))  {
-344                 log.info("Empty cookie");
-345                 return;
-346             }
-347             //
-348             // An earlier version saved the cookie without URL encoding it, hence there may be 
-349             // spaces which in turn means we may be quoted.  Strip any quotes.
-350             //
-351             if (codedData.charAt(0) == '"' && codedData.charAt(codedData.length()-1) == '"') {
-352                 codedData = codedData.substring(1,codedData.length()-1);
-353             }
-354                     
-355             try {
-356                 codedData = URLDecoder.decode(codedData, "UTF-8");
-357             } catch (UnsupportedEncodingException e) {
-358                 log.error("could not decode cookie");
-359                 return;
-360             }
-361                     
-362             start = 0;
-363             end = codedData.indexOf(' ', start);
-364             while (end > 0) {
-365                 String value = codedData.substring(start, end);
-366                 start = end + 1;
-367                 end = codedData.indexOf(' ', start);
-368                 if (!value.equals("")) {
-369                     idPList.add(new String(Base64.decode(value)));
-370                 }
-371             }
-372             if (start < codedData.length()) {
-373                 String value = codedData.substring(start);
-374                 if (!value.equals("")) {
-375                     idPList.add(new String(Base64.decode(value)));
-376                 }
-377             }
-378         }
-379         /**
-380          * Create a SamlCookie with no data inside.
-381          * @param domainName - if non null, the domain of the new cookie 
-382          * @param request Describes the current request. 
-383          * @param response Describes the current response.
-384          *
-385          */
-386         private SamlIdPCookie(HttpServletRequest request, HttpServletResponse response, String domainName) {
-387             this.req = request;
-388             this.res = response;
-389             this.domain = domainName;
-390         }
-391 
-392         /**
-393          * Add the specified Shibboleth IdP Name to the cookie list or move to 
-394          * the front and then write it back.
-395          * 
-396          * We always add to the front (and remove from wherever it was)
-397          * 
-398          * @param idPName    - The name to be added
-399          * @param expiration - The expiration of the cookie or zero if it is to be unchanged
-400          */
-401         private void addIdPName(String idPName, int expiration) {
-402 
-403             idPList.remove(idPName);
-404             idPList.add(0, idPName);
-405 
-406             writeCookie(expiration);
-407         }
-408             
-409         /**
-410          * Delete the <b>entire<\b> cookie contents
-411          */
-412 
-413 
-414         /**
-415          * Remove origin from the cachedata and write it back.
-416          * 
-417          * @param origin what to remove.
-418          * @param expiration How long it will live.
-419          */
-420             
-421         public void deleteIdPName(String origin, int expiration) {
-422             idPList.remove(origin);
-423             writeCookie(expiration);
-424         }
-425 
-426         /**
-427          * Write back the cookie.
-428          * 
-429          * @param expiration How long it will live
-430          */
-431         private void writeCookie(int expiration) {
-432             Cookie cookie = getCookie(req);
-433                     
-434             if (idPList.size() == 0) {
-435                 //
-436                 // Nothing to write, so delete the cookie
-437                 //
-438                 cookie.setPath("/");
-439                 cookie.setMaxAge(0);
-440                 res.addCookie(cookie);
-441                 return;
-442             }
-443 
-444             //
-445             // Otherwise encode up the cookie
-446             //
-447             StringBuffer buffer = new StringBuffer();
-448             Iterator <String> it = idPList.iterator();
-449                     
-450             while (it.hasNext()) {
-451                 String next = it.next();
-452                 String what = new String(Base64.encodeBytes(next.getBytes()));
-453                 buffer.append(what).append(' ');
-454             }
-455                     
-456             String value;
-457             try {
-458                 value = URLEncoder.encode(buffer.toString(), "UTF-8");
-459             } catch (UnsupportedEncodingException e) {
-460                 log.error("Could not encode cookie");
-461                 return;
-462             }
-463                     
-464             if (cookie == null) { 
-465                 cookie = new Cookie(COOKIE_NAME, value);
-466             } else {
-467                 cookie.setValue(value);
-468             }
-469             cookie.setComment("Used to cache selection of a user's Shibboleth IdP");
-470             cookie.setPath("/");
-471 
-472 
-473             cookie.setMaxAge(expiration);
-474                     
-475             if (domain != null && domain != "") {
-476                 cookie.setDomain(domain);
-477             }
-478             res.addCookie(cookie);
-479             
-480         }
-481     
-482         /**
-483          * Return the list of Idps for this cookie.
-484          * @return The list.
-485          */
-486         public List <String> getIdPList() {
-487             return idPList;
-488         }
-489     }
-490 
-491     /**
-492      * Extract the cookie from a request.
-493      * @param req the request.
-494      * @return the cookie.
-495      */
-496     private static Cookie getCookie(HttpServletRequest req) {
-497             
-498         Cookie[] cookies = req.getCookies();
-499         if (cookies != null) {
-500             for (int i = 0; i < cookies.length; i++) {
-501                 if (cookies[i].getName().equals(COOKIE_NAME)) { 
-502                     return cookies[i];
-503                 }
-504             }
-505         }
-506         return null;
-507     }
-508 
-509     /**
-510      * Delete the cookie from the response.
-511      * @param req The request.
-512      * @param res The response.
-513      */
-514     private static void deleteCookie(HttpServletRequest req, HttpServletResponse res) {
-515         Cookie cookie = getCookie(req);
-516             
-517         if (cookie == null) { 
-518             return; 
-519         }
-520             
-521         cookie.setPath("/");
-522         cookie.setMaxAge(0);
-523         res.addCookie(cookie);
-524     }
-525     /**
-526      * Load up the cookie and convert it into a SamlIdPCookie.  If there is no
-527      * underlying cookie return a null one.
-528      * @param req The request.
-529      * @param res The response.
-530      * @param domain - if this is set then any <b>created</b> cookies are set to this domain
-531      * @return the new object. 
-532      */
-533     
-534     private SamlIdPCookie getIdPCookie(HttpServletRequest req, HttpServletResponse res, String domain) {
-535         Cookie cookie = getCookie(req);
-536             
-537         if (cookie == null) {
-538             return new SamlIdPCookie(req, res, domain);
-539         } else {
-540             return new SamlIdPCookie(cookie.getValue(), req, res, domain);
-541         }
-542     }
-543 }
-544 
+1   package edu.internet2.middleware.shibboleth.wayf.plugins.provider;
+2   
+3   import java.io.UnsupportedEncodingException;
+4   import java.net.URLDecoder;
+5   import java.net.URLEncoder;
+6   import java.util.ArrayList;
+7   import java.util.Collection;
+8   import java.util.Iterator;
+9   import java.util.List;
+10  import java.util.Map;
+11  
+12  import javax.servlet.http.Cookie;
+13  import javax.servlet.http.HttpServletRequest;
+14  import javax.servlet.http.HttpServletResponse;
+15  
+16  import org.apache.log4j.Logger;
+17  import org.opensaml.saml2.metadata.provider.MetadataProvider;
+18  import org.opensaml.xml.util.Base64;
+19  import org.w3c.dom.Element;
+20  
+21  import edu.internet2.middleware.shibboleth.wayf.DiscoveryServiceHandler;
+22  import edu.internet2.middleware.shibboleth.wayf.IdPSite;
+23  import edu.internet2.middleware.shibboleth.wayf.WayfException;
+24  import edu.internet2.middleware.shibboleth.wayf.plugins.Plugin;
+25  import edu.internet2.middleware.shibboleth.wayf.plugins.PluginContext;
+26  import edu.internet2.middleware.shibboleth.wayf.plugins.PluginMetadataParameter;
+27  import edu.internet2.middleware.shibboleth.wayf.plugins.WayfRequestHandled;
+28  
+29  /**
+30   * This is a test implementation of the saml cookie lookup stuff to 
+31   * see whether it fits the plugin architecture.
+32   * 
+33   * @author Rod Widdowson
+34   *
+35   */
+36  public class SamlCookiePlugin implements Plugin {
+37          
+38      /**
+39       * The parameter which controls the cache.
+40       */
+41      private static final String PARAMETER_NAME = "cache";
+42  
+43      /**
+44       * Parameter to say make it last a long time.
+45       */
+46      private static final String PARAMETER_PERM = "perm";
+47  
+48      /**
+49       * Parameter to say just keep this as long as the brower is open.
+50       */
+51      private static final String PARAMETER_SESSION = "session";
+52      
+53      /**
+54       * Handle for logging. 
+55       */
+56      private static Logger log = Logger.getLogger(SamlCookiePlugin.class.getName());
+57  
+58      /**
+59       * As specified in the SAML2 profiles specification.
+60       */
+61      private static final String COOKIE_NAME = "_saml_idp";
+62  
+63      /**
+64       * By default we keep the cookie around for a week.
+65       */
+66      private static final int DEFAULT_CACHE_EXPIRATION = 6048000;
+67      
+68      /**
+69       * Do we always go where the cookie tells us, or do we just provide the cookie as a hint.
+70       */
+71      private boolean alwaysFollow;
+72  
+73      /**
+74       * Is our job to clean up the cookie. 
+75       */
+76      private boolean deleteCookie;
+77      
+78      /**
+79       * Lipservice towards having a common domain cookie. 
+80       */
+81      private String cacheDomain; 
+82      
+83      /**
+84       * How long the cookie our will be active? 
+85       */
+86      private int cacheExpiration;
+87      
+88      /**
+89       * This constructor is called during wayf initialization with it's
+90       * own little bit of XML config.
+91       * 
+92       * @param element - further information to be gleaned from the DOM.
+93       */
+94      public SamlCookiePlugin(Element element) {
+95          /*
+96           * <Plugin idenfifier="WayfCookiePlugin" 
+97           *         type="edu.internet2.middleware.shibboleth.wayf.plugins.provider.SamlCookiePlugin"
+98           *         alwaysFollow = "FALSE"
+99           *         deleteCookie = "FALSE"
+100          *         cacheExpiration = "number" 
+101          *         cacheDomain = "string"/> 
+102          */
+103         log.info("New plugin");
+104         String s;
+105 
+106         s = element.getAttribute("alwaysFollow");
+107         if (s != null && !s.equals("") ) {
+108             alwaysFollow = Boolean.valueOf(s).booleanValue();
+109         } else {
+110             alwaysFollow = true;
+111         }
+112             
+113         s = element.getAttribute("deleteCookie");
+114         if (s != null && !s.equals("")) {
+115             deleteCookie = Boolean.valueOf(s).booleanValue();
+116         } else {
+117             deleteCookie = false;
+118         }
+119             
+120         s = element.getAttribute("cacheDomain");
+121         if ((s != null) && !s.equals("")) {
+122             cacheDomain = s;
+123         } else {
+124             cacheDomain = "";
+125         }
+126         
+127         s  = element.getAttribute("cacheExpiration");
+128         if ((s != null) && !s.equals("")) {
+129             
+130             try {
+131 
+132                 cacheExpiration = Integer.parseInt(s);
+133             } catch (NumberFormatException ex) {
+134                     
+135                 log.error("Invalid CacheExpiration value - " + s);
+136                 cacheExpiration = DEFAULT_CACHE_EXPIRATION;                       
+137             }
+138         } else {
+139             cacheExpiration = DEFAULT_CACHE_EXPIRATION;
+140         }
+141     }
+142     
+143     /**
+144      * Create a plugin with the hard-wired default settings.
+145      */
+146     private SamlCookiePlugin() {
+147         alwaysFollow = false;
+148         deleteCookie = false;
+149         cacheExpiration = DEFAULT_CACHE_EXPIRATION;
+150     }
+151 
+152     /**
+153      * This is the 'hook' in the lookup part of Discovery Service processing. 
+154      * 
+155      * @param req - Describes the current request.  Used to find any appropriate cookies 
+156      * @param res - Describes the current response.  Used to redirect the request. 
+157      * @param parameter - Describes the metadata.
+158      * @param context - Any processing context returned from a previous call. We set this on first call and
+159      *                  use non null to indicate that we don't go there again.
+160      * @param validIdps The list of IdPs which is currently views as possibly matches for the pattern. 
+161      *                  The Key is the EntityId for the IdP and the value the object which describes 
+162      *                  the Idp 
+163      * @param idpList The set of Idps which are currently considered as potential hints.    
+164      * @return a context to hand to subsequent calls
+165      * @throws WayfRequestHandled if the plugin has handled the request.
+166      * issues a redirect)
+167      * 
+168      * @see edu.internet2.middleware.shibboleth.wayf.plugins.Plugin#lookup
+169      */
+170     public PluginContext lookup(HttpServletRequest req,
+171                                 HttpServletResponse res,  
+172                                 PluginMetadataParameter parameter, 
+173                                 Map<String, IdPSite> validIdps,
+174                                 PluginContext context,
+175                                 List <IdPSite> idpList) throws WayfRequestHandled {
+176             
+177         if (context != null) {
+178             //
+179             // We only need to be called once
+180             //
+181             return context;
+182         }
+183             
+184         if (deleteCookie) {
+185             deleteCookie(req, res);
+186             //
+187             // Only need to be called once - so set up a parameter
+188             //
+189             return new Context() ;
+190         } 
+191         List <String> idps = getIdPCookie(req, res, cacheDomain).getIdPList();
+192             
+193         for (String idpName : idps) {
+194             IdPSite idp = validIdps.get(idpName);
+195             if (idp != null) {
+196                 if (alwaysFollow) {
+197                     try {
+198                         DiscoveryServiceHandler.forwardRequest(req, res, idp);
+199                     } catch (WayfException e) {
+200                         // Do nothing we are going to throw anyway
+201                         ;
+202                     }
+203                     throw new WayfRequestHandled();
+204                 }
+205                 //
+206                 // This IDP is ok 
+207                 //
+208                 idpList.add(idp);
+209             }
+210         } 
+211             
+212         return null;
+213     }
+214 
+215     /**
+216      * Plugin point which is called when the data is refreshed.
+217      * @param metadata - where to get the data from.
+218      * @return the value which will be provided as input to subsequent calls
+219      * @see edu.internet2.middleware.shibboleth.wayf.plugins.Plugin#refreshMetadata
+220      */
+221     public PluginMetadataParameter refreshMetadata(MetadataProvider metadata) {
+222         //
+223         // We don't care about metadata - we are given all that we need
+224         //
+225         return null;
+226     }
+227 
+228     /**
+229      * Plgin point for searching.
+230      * 
+231      * @throws WayfRequestHandled 
+232      * @param req Describes the current request. 
+233      * @param res Describes the current response.
+234      * @param parameter Describes the metadata.
+235      * @param pattern What we are searchign for. 
+236      * @param validIdps The list of IdPs which is currently views as possibly matches for the pattern. 
+237      *                  The Key is the EntityId for the IdP and the value the object which describes 
+238      *                  the Idp 
+239      * @param context Any processing context returned from a previous call. We set this on first call and
+240      *                use non null to indicate that we don't go there again.
+241      * @param searchResult What the search yielded. 
+242      * @param idpList The set of Idps which are currently considered as potential hints.    
+243      * @return a context to hand to subsequent calls.
+244      * @see edu.internet2.middleware.shibboleth.wayf.plugins.Plugin#search
+245      * @throws WayfRequestHandled if the plugin has handled the request.
+246      * 
+247      */
+248     public PluginContext search(HttpServletRequest req,
+249                                 HttpServletResponse res, 
+250                                 PluginMetadataParameter parameter, 
+251                                 String pattern,
+252                                 Map<String, IdPSite> validIdps,
+253                                 PluginContext context,
+254                                 Collection<IdPSite> searchResult,
+255                                 List<IdPSite> idpList) throws WayfRequestHandled {
+256         //
+257         // Don't distinguish between lookup and search
+258         //
+259         return lookup(req, res, parameter, validIdps, context, idpList);
+260     }
+261 
+262     /**
+263      * Plugin point for selection.
+264      * 
+265      * @see edu.internet2.middleware.shibboleth.wayf.plugins.Plugin#selected(javax.servlet.http.HttpServletRequest.
+266      *  javax.servlet.http.HttpServletResponse, 
+267      *  edu.internet2.middleware.shibboleth.wayf.plugins.PluginMetadataParameter, 
+268      *  java.lang.String)
+269      * @param req Describes the current request. 
+270      * @param res Describes the current response.
+271      * @param parameter Describes the metadata.
+272      * @param idP Describes the idp.
+273      * 
+274      */
+275     public void selected(HttpServletRequest req, HttpServletResponse res,
+276                          PluginMetadataParameter parameter, String idP) {
+277             
+278         SamlIdPCookie cookie = getIdPCookie(req, res, cacheDomain);
+279         String param = req.getParameter(PARAMETER_NAME);
+280         
+281         if (null == param || param.equals("")) {
+282             return;
+283         } else if (param.equalsIgnoreCase(PARAMETER_SESSION)) {
+284             cookie.addIdPName(idP, -1);
+285         } else if (param.equalsIgnoreCase(PARAMETER_PERM)) {
+286             cookie.addIdPName(idP, cacheExpiration);
+287         }
+288     }
+289     
+290     //
+291     // Private classes for internal use
+292     //
+293     
+294     /**
+295      * This is just a marker tag.
+296      */
+297     private static class Context implements PluginContext {}
+298     
+299     /** 
+300      * Class to abstract away the saml cookie for us.
+301      */
+302     public final class SamlIdPCookie  {
+303 
+304             
+305         /**
+306          * The associated request.
+307          */
+308         private final HttpServletRequest req;
+309         /**
+310          * The associated response.
+311          */
+312         private final HttpServletResponse res;
+313         /**
+314          * The associated domain.
+315          */
+316         private final String domain;
+317         /**
+318          * The IdPs.
+319          */
+320         private final List <String> idPList = new ArrayList<String>();
+321             
+322         /**
+323          * Constructs a <code>SamlIdPCookie</code> from the provided string (which is the raw data. 
+324          * 
+325          * @param codedData
+326          *            the information read from the cookie
+327          * @param request Describes the current request. 
+328          * @param response Describes the current response.
+329          * @param domainName - if non null the domain for any *created* cookie.
+330          */
+331         private SamlIdPCookie(String codedData, 
+332                               HttpServletRequest request, 
+333                               HttpServletResponse response, 
+334                               String domainName) {
+335                     
+336             this.req = request;
+337             this.res = response;
+338             this.domain = domainName;
+339                     
+340             int start;
+341             int end;
+342                     
+343             if (codedData == null || codedData.equals(""))  {
+344                 log.info("Empty cookie");
+345                 return;
+346             }
+347             //
+348             // An earlier version saved the cookie without URL encoding it, hence there may be 
+349             // spaces which in turn means we may be quoted.  Strip any quotes.
+350             //
+351             if (codedData.charAt(0) == '"' && codedData.charAt(codedData.length()-1) == '"') {
+352                 codedData = codedData.substring(1,codedData.length()-1);
+353             }
+354                     
+355             try {
+356                 codedData = URLDecoder.decode(codedData, "UTF-8");
+357             } catch (UnsupportedEncodingException e) {
+358                 log.error("could not decode cookie");
+359                 return;
+360             }
+361                     
+362             start = 0;
+363             end = codedData.indexOf(' ', start);
+364             while (end > 0) {
+365                 String value = codedData.substring(start, end);
+366                 start = end + 1;
+367                 end = codedData.indexOf(' ', start);
+368                 if (!value.equals("")) {
+369                     idPList.add(new String(Base64.decode(value)));
+370                 }
+371             }
+372             if (start < codedData.length()) {
+373                 String value = codedData.substring(start);
+374                 if (!value.equals("")) {
+375                     idPList.add(new String(Base64.decode(value)));
+376                 }
+377             }
+378         }
+379         /**
+380          * Create a SamlCookie with no data inside.
+381          * @param domainName - if non null, the domain of the new cookie 
+382          * @param request Describes the current request. 
+383          * @param response Describes the current response.
+384          *
+385          */
+386         private SamlIdPCookie(HttpServletRequest request, HttpServletResponse response, String domainName) {
+387             this.req = request;
+388             this.res = response;
+389             this.domain = domainName;
+390         }
+391 
+392         /**
+393          * Add the specified Shibboleth IdP Name to the cookie list or move to 
+394          * the front and then write it back.
+395          * 
+396          * We always add to the front (and remove from wherever it was)
+397          * 
+398          * @param idPName    - The name to be added
+399          * @param expiration - The expiration of the cookie or zero if it is to be unchanged
+400          */
+401         private void addIdPName(String idPName, int expiration) {
+402 
+403             idPList.remove(idPName);
+404             idPList.add(0, idPName);
+405 
+406             writeCookie(expiration);
+407         }
+408             
+409         /**
+410          * Delete the <b>entire<\b> cookie contents
+411          */
+412 
+413 
+414         /**
+415          * Remove origin from the cachedata and write it back.
+416          * 
+417          * @param origin what to remove.
+418          * @param expiration How long it will live.
+419          */
+420             
+421         public void deleteIdPName(String origin, int expiration) {
+422             idPList.remove(origin);
+423             writeCookie(expiration);
+424         }
+425 
+426         /**
+427          * Write back the cookie.
+428          * 
+429          * @param expiration How long it will live
+430          */
+431         private void writeCookie(int expiration) {
+432             Cookie cookie = getCookie(req);
+433                     
+434             if (idPList.size() == 0) {
+435                 //
+436                 // Nothing to write, so delete the cookie
+437                 //
+438                 cookie.setPath("/");
+439                 cookie.setMaxAge(0);
+440                 res.addCookie(cookie);
+441                 return;
+442             }
+443 
+444             //
+445             // Otherwise encode up the cookie
+446             //
+447             StringBuffer buffer = new StringBuffer();
+448             Iterator <String> it = idPList.iterator();
+449                     
+450             while (it.hasNext()) {
+451                 String next = it.next();
+452                 String what = new String(Base64.encodeBytes(next.getBytes()));
+453                 buffer.append(what).append(' ');
+454             }
+455                     
+456             String value;
+457             try {
+458                 value = URLEncoder.encode(buffer.toString(), "UTF-8");
+459             } catch (UnsupportedEncodingException e) {
+460                 log.error("Could not encode cookie");
+461                 return;
+462             }
+463                     
+464             if (cookie == null) { 
+465                 cookie = new Cookie(COOKIE_NAME, value);
+466             } else {
+467                 cookie.setValue(value);
+468             }
+469             cookie.setComment("Used to cache selection of a user's Shibboleth IdP");
+470             cookie.setPath("/");
+471 
+472 
+473             cookie.setMaxAge(expiration);
+474                     
+475             if (domain != null && domain != "") {
+476                 cookie.setDomain(domain);
+477             }
+478             res.addCookie(cookie);
+479             
+480         }
+481     
+482         /**
+483          * Return the list of Idps for this cookie.
+484          * @return The list.
+485          */
+486         public List <String> getIdPList() {
+487             return idPList;
+488         }
+489     }
+490 
+491     /**
+492      * Extract the cookie from a request.
+493      * @param req the request.
+494      * @return the cookie.
+495      */
+496     private static Cookie getCookie(HttpServletRequest req) {
+497             
+498         Cookie[] cookies = req.getCookies();
+499         if (cookies != null) {
+500             for (int i = 0; i < cookies.length; i++) {
+501                 if (cookies[i].getName().equals(COOKIE_NAME)) { 
+502                     return cookies[i];
+503                 }
+504             }
+505         }
+506         return null;
+507     }
+508 
+509     /**
+510      * Delete the cookie from the response.
+511      * @param req The request.
+512      * @param res The response.
+513      */
+514     private static void deleteCookie(HttpServletRequest req, HttpServletResponse res) {
+515         Cookie cookie = getCookie(req);
+516             
+517         if (cookie == null) { 
+518             return; 
+519         }
+520             
+521         cookie.setPath("/");
+522         cookie.setMaxAge(0);
+523         res.addCookie(cookie);
+524     }
+525     /**
+526      * Load up the cookie and convert it into a SamlIdPCookie.  If there is no
+527      * underlying cookie return a null one.
+528      * @param req The request.
+529      * @param res The response.
+530      * @param domain - if this is set then any <b>created</b> cookies are set to this domain
+531      * @return the new object. 
+532      */
+533     
+534     private SamlIdPCookie getIdPCookie(HttpServletRequest req, HttpServletResponse res, String domain) {
+535         Cookie cookie = getCookie(req);
+536             
+537         if (cookie == null) {
+538             return new SamlIdPCookie(req, res, domain);
+539         } else {
+540             return new SamlIdPCookie(cookie.getValue(), req, res, domain);
+541         }
+542     }
+543 }
+544 
 

diff --git a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/package-frame.html b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/package-frame.html index b7af423..e4a3b0a 100644 --- a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/package-frame.html +++ b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/package-frame.html @@ -2,8 +2,8 @@ - - Shibboleth Discovery Service 1.1.1 Reference Package edu.internet2.middleware.shibboleth.wayf.plugins.provider + + Shibboleth Discovery Service 1.1.2 Reference Package edu.internet2.middleware.shibboleth.wayf.plugins.provider diff --git a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/package-summary.html b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/package-summary.html index 206dc1d..26b5292 100644 --- a/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/package-summary.html +++ b/doc/src-xref/edu/internet2/middleware/shibboleth/wayf/plugins/provider/package-summary.html @@ -2,8 +2,8 @@ - - Shibboleth Discovery Service 1.1.1 Reference Package edu.internet2.middleware.shibboleth.wayf.plugins.provider + + Shibboleth Discovery Service 1.1.2 Reference Package edu.internet2.middleware.shibboleth.wayf.plugins.provider @@ -82,6 +82,6 @@
- Copyright © 2006-2009 Internet2. All Rights Reserved. + Copyright © 2006-2010 Internet2. All Rights Reserved. \ No newline at end of file -- cgit v1.1