forked from opensearch-project/security
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Integrates OpenSAML 4.3 with SAML authenticator (opensearch-project#3651
) In order to exclude `permission org.opensearch.secure_sm.ThreadPermission "modifyArbitraryThread";` we must use the dedicated `cleaners` thread factory in `OpenSearch`. Since `OpenSAML` packages are sealed it it impossible to replace `CleanerSupport` class with our own solution. Instead we have to change configuration of how such objects should be parsed. There are only 2 classes in the library which use `CleanerSupport`: - `X509CertificateImpl` - `X509CRLImpl` This fix uses the same solution as in `OpenSAML` and replaces `CleanerSupport` with our custom implementation `CleanerFactory`. Signed-off-by: Andrey Pleskach <[email protected]>
- Loading branch information
1 parent
f6f561e
commit 44a03c5
Showing
9 changed files
with
386 additions
and
38 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
42 changes: 42 additions & 0 deletions
42
src/main/java/org/opensearch/security/opensaml/integration/CleanerFactory.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| /* | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * The OpenSearch Contributors require contributions made to | ||
| * this file be licensed under the Apache-2.0 license or a | ||
| * compatible open source license. | ||
| * | ||
| * Modifications Copyright OpenSearch Contributors. See | ||
| * GitHub history for details. | ||
| */ | ||
|
|
||
| package org.opensearch.security.opensaml.integration; | ||
|
|
||
| import org.opensearch.common.util.concurrent.OpenSearchExecutors; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| import java.lang.ref.Cleaner; | ||
| import java.util.concurrent.ThreadFactory; | ||
|
|
||
| /** | ||
| * The class was adapted from {@link net.shibboleth.utilities.java.support.primitive.CleanerSupport}. | ||
| * The main reason is that it is only one way to set Cleaner.create() | ||
| * together with cleaners daemon thread factory which is required for OpenSearch | ||
| */ | ||
| public class CleanerFactory { | ||
|
|
||
| private static final Logger LOG = LoggerFactory.getLogger(CleanerFactory.class); | ||
|
|
||
| private static final ThreadFactory cleanersThreadFactory = OpenSearchExecutors.daemonThreadFactory("cleaners"); | ||
|
|
||
| /** Constructor. */ | ||
| private CleanerFactory() {} | ||
|
|
||
| public static Cleaner create(final Class<?> requester) { | ||
| // Current approach here is to create a new Cleaner on each call. A given class requester/owner | ||
| // is assumed to call only once and store in static storage. | ||
| LOG.debug("Creating new java.lang.ref.Cleaner instance requested by class: {}", requester.getName()); | ||
| return Cleaner.create(cleanersThreadFactory); | ||
| } | ||
|
|
||
| } |
23 changes: 23 additions & 0 deletions
23
src/main/java/org/opensearch/security/opensaml/integration/SecurityX509CRLBuilder.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| /* | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * The OpenSearch Contributors require contributions made to | ||
| * this file be licensed under the Apache-2.0 license or a | ||
| * compatible open source license. | ||
| * | ||
| * Modifications Copyright OpenSearch Contributors. See | ||
| * GitHub history for details. | ||
| */ | ||
|
|
||
| package org.opensearch.security.opensaml.integration; | ||
|
|
||
| import org.opensaml.xmlsec.signature.X509CRL; | ||
| import org.opensaml.xmlsec.signature.impl.X509CRLBuilder; | ||
|
|
||
| public class SecurityX509CRLBuilder extends X509CRLBuilder { | ||
|
|
||
| public X509CRL buildObject(final String namespaceURI, final String localName, final String namespacePrefix) { | ||
| return new SecurityX509CRLImpl(namespaceURI, localName, namespacePrefix); | ||
| } | ||
|
|
||
| } |
86 changes: 86 additions & 0 deletions
86
src/main/java/org/opensearch/security/opensaml/integration/SecurityX509CRLImpl.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| /* | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * The OpenSearch Contributors require contributions made to | ||
| * this file be licensed under the Apache-2.0 license or a | ||
| * compatible open source license. | ||
| * | ||
| * Modifications Copyright OpenSearch Contributors. See | ||
| * GitHub history for details. | ||
| */ | ||
|
|
||
| package org.opensearch.security.opensaml.integration; | ||
|
|
||
| import net.shibboleth.utilities.java.support.collection.IndexingObjectStore; | ||
| import org.opensaml.core.xml.AbstractXMLObject; | ||
| import org.opensaml.core.xml.XMLObject; | ||
| import org.opensaml.xmlsec.signature.X509CRL; | ||
|
|
||
| import javax.annotation.Nonnull; | ||
| import java.lang.ref.Cleaner; | ||
| import java.util.Collections; | ||
| import java.util.List; | ||
| import java.util.Objects; | ||
|
|
||
| /** | ||
| * The class was adapted from {@link org.opensaml.xmlsec.signature.impl.X509CRLImpl}. | ||
| * The main reason is that it is only one way to set up {@link CleanerFactory} | ||
| * together with cleaners daemon thread factory which is required for OpenSearch | ||
| */ | ||
| public class SecurityX509CRLImpl extends AbstractXMLObject implements X509CRL { | ||
|
|
||
| private static final IndexingObjectStore<String> B64_CRL_STORE = new IndexingObjectStore<>(); | ||
|
|
||
| private static final Cleaner CLEANER = CleanerFactory.create(SecurityX509CRLImpl.class); | ||
|
|
||
| private Cleaner.Cleanable cleanable; | ||
|
|
||
| private String b64CRLIndex; | ||
|
|
||
| protected SecurityX509CRLImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) { | ||
| super(namespaceURI, elementLocalName, namespacePrefix); | ||
| } | ||
|
|
||
| public String getValue() { | ||
| return B64_CRL_STORE.get(b64CRLIndex); | ||
| } | ||
|
|
||
| public void setValue(final String newValue) { | ||
| // Dump our cached DOM if the new value really is new | ||
| final String currentCRL = B64_CRL_STORE.get(b64CRLIndex); | ||
| final String newCRL = prepareForAssignment(currentCRL, newValue); | ||
|
|
||
| // This is a new value, remove the old one, add the new one | ||
| if (!Objects.equals(currentCRL, newCRL)) { | ||
| if (cleanable != null) { | ||
| cleanable.clean(); | ||
| cleanable = null; | ||
| } | ||
| b64CRLIndex = B64_CRL_STORE.put(newCRL); | ||
| if (b64CRLIndex != null) { | ||
| cleanable = CLEANER.register(this, new SecurityX509CRLImpl.CleanerState(b64CRLIndex)); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public List<XMLObject> getOrderedChildren() { | ||
| return Collections.emptyList(); | ||
| } | ||
|
|
||
| static class CleanerState implements Runnable { | ||
|
|
||
| /** The index to remove from the store. */ | ||
| private String index; | ||
|
|
||
| public CleanerState(@Nonnull final String idx) { | ||
| index = idx; | ||
| } | ||
|
|
||
| /** {@inheritDoc} */ | ||
| public void run() { | ||
| SecurityX509CRLImpl.B64_CRL_STORE.remove(index); | ||
| } | ||
|
|
||
| } | ||
| } |
24 changes: 24 additions & 0 deletions
24
...ain/java/org/opensearch/security/opensaml/integration/SecurityX509CertificateBuilder.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| /* | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * The OpenSearch Contributors require contributions made to | ||
| * this file be licensed under the Apache-2.0 license or a | ||
| * compatible open source license. | ||
| * | ||
| * Modifications Copyright OpenSearch Contributors. See | ||
| * GitHub history for details. | ||
| */ | ||
|
|
||
| package org.opensearch.security.opensaml.integration; | ||
|
|
||
| import org.opensaml.xmlsec.signature.X509Certificate; | ||
| import org.opensaml.xmlsec.signature.impl.X509CertificateBuilder; | ||
|
|
||
| public class SecurityX509CertificateBuilder extends X509CertificateBuilder { | ||
|
|
||
| @Override | ||
| public X509Certificate buildObject(final String namespaceURI, final String localName, final String namespacePrefix) { | ||
| return new SecurityX509CertificateImpl(namespaceURI, localName, namespacePrefix); | ||
| } | ||
|
|
||
| } |
Oops, something went wrong.