Format Java files with google-java-format 1.6 According to google java style guides wildcard imports are not used:[1]. [1] https://google.github.io/styleguide/javaguide.html#s3.3.1-wildcard-imports Change-Id: I6fec9f95a4c1cd502a72596c8ac79ecc77ee79dd
diff --git a/src/main/java/com/thesamet/gerrit/plugins/saml/AuthenticatedUser.java b/src/main/java/com/thesamet/gerrit/plugins/saml/AuthenticatedUser.java index 5836585..85792eb 100644 --- a/src/main/java/com/thesamet/gerrit/plugins/saml/AuthenticatedUser.java +++ b/src/main/java/com/thesamet/gerrit/plugins/saml/AuthenticatedUser.java
@@ -15,41 +15,49 @@ package com.thesamet.gerrit.plugins.saml; public class AuthenticatedUser implements java.io.Serializable { - private String username; - private String displayName; - private String email; - private String externalId; + private String username; + private String displayName; + private String email; + private String externalId; - public AuthenticatedUser(String username, String displayName, String email, String externalId) { - this.username = username; - this.displayName = displayName; - this.email = email; - this.externalId = externalId; - } + public AuthenticatedUser(String username, String displayName, String email, String externalId) { + this.username = username; + this.displayName = displayName; + this.email = email; + this.externalId = externalId; + } - public String getUsername() { - return username; - } + public String getUsername() { + return username; + } - public String getDisplayName() { - return displayName; - } + public String getDisplayName() { + return displayName; + } - public String getEmail() { - return email; - } + public String getEmail() { + return email; + } - public String getExternalId() { - return externalId; - } + public String getExternalId() { + return externalId; + } - @Override - public String toString() { - return "AuthenticatedUser{" + - "username='" + username + '\'' + - ", displayName='" + displayName + '\'' + - ", email='" + email + '\'' + - ", externalId='" + externalId + '\'' + - '}'; - } + @Override + public String toString() { + return "AuthenticatedUser{" + + "username='" + + username + + '\'' + + ", displayName='" + + displayName + + '\'' + + ", email='" + + email + + '\'' + + ", externalId='" + + externalId + + '\'' + + '}'; + } }
diff --git a/src/main/java/com/thesamet/gerrit/plugins/saml/SamlConfig.java b/src/main/java/com/thesamet/gerrit/plugins/saml/SamlConfig.java index ed0e05a..8b64ebd 100644 --- a/src/main/java/com/thesamet/gerrit/plugins/saml/SamlConfig.java +++ b/src/main/java/com/thesamet/gerrit/plugins/saml/SamlConfig.java
@@ -17,12 +17,9 @@ import com.google.gerrit.server.config.GerritServerConfig; import com.google.inject.Inject; import com.google.inject.Singleton; - import org.eclipse.jgit.lib.Config; -/** - * SAML 2.0 related settings from {@code gerrit.config}. - */ +/** SAML 2.0 related settings from {@code gerrit.config}. */ @Singleton public class SamlConfig { @@ -42,11 +39,9 @@ keystorePath = getString(cfg, "keystorePath"); privateKeyPassword = getString(cfg, "privateKeyPassword"); keystorePassword = getString(cfg, "keystorePassword"); - displayNameAttr = - getGetStringWithDefault(cfg, "displayNameAttr", "DisplayName"); + displayNameAttr = getGetStringWithDefault(cfg, "displayNameAttr", "DisplayName"); userNameAttr = getGetStringWithDefault(cfg, "userNameAttr", "UserName"); - emailAddressAttr = - getGetStringWithDefault(cfg, "emailAddressAttr", "EmailAddress"); + emailAddressAttr = getGetStringWithDefault(cfg, "emailAddressAttr", "EmailAddress"); maxAuthLifetimeAttr = cfg.getInt("saml", "maxAuthLifetime", maxAuthLifetimeDefault); } @@ -86,8 +81,7 @@ return cfg.getString("saml", null, name); } - private static String getGetStringWithDefault(Config cfg, String name, - String defaultValue) { + private static String getGetStringWithDefault(Config cfg, String name, String defaultValue) { String result = getString(cfg, name); if (result != null) { return result;
diff --git a/src/main/java/com/thesamet/gerrit/plugins/saml/SamlWebFilter.java b/src/main/java/com/thesamet/gerrit/plugins/saml/SamlWebFilter.java index 2888581..66313d2 100644 --- a/src/main/java/com/thesamet/gerrit/plugins/saml/SamlWebFilter.java +++ b/src/main/java/com/thesamet/gerrit/plugins/saml/SamlWebFilter.java
@@ -20,6 +20,21 @@ import com.google.gerrit.server.config.GerritServerConfig; import com.google.inject.Inject; import com.google.inject.Singleton; +import java.io.IOException; +import java.util.Enumeration; +import java.util.HashSet; +import java.util.List; +import javax.annotation.Nonnull; +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.FilterConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletRequestWrapper; +import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.HttpSession; import org.eclipse.jgit.lib.Config; import org.pac4j.core.context.J2EContext; import org.pac4j.core.exception.HttpAction; @@ -31,269 +46,257 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; -import javax.annotation.Nonnull; -import javax.servlet.*; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletRequestWrapper; -import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; -import java.io.IOException; -import java.util.Enumeration; -import java.util.HashSet; -import java.util.List; - @Singleton class SamlWebFilter implements Filter { - static final String GERRIT_LOGOUT = "/logout"; - static final String GERRIT_LOGIN = "/login"; - static final String SAML_POSTBACK = "/plugins/gerrit-saml-plugin/saml"; + static final String GERRIT_LOGOUT = "/logout"; + static final String GERRIT_LOGIN = "/login"; + static final String SAML_POSTBACK = "/plugins/gerrit-saml-plugin/saml"; - private static final String SESSION_ATTR_USER = "Gerrit-Saml-User"; + private static final String SESSION_ATTR_USER = "Gerrit-Saml-User"; - static final Logger log = LoggerFactory.getLogger(SamlWebFilter.class); - private final SAML2Client saml2Client; - private final SamlConfig samlConfig; - private final String httpUserNameHeader; - private final String httpDisplaynameHeader; - private final String httpEmailHeader; - private final String httpExternalIdHeader; - private final HashSet<String> authHeaders; + static final Logger log = LoggerFactory.getLogger(SamlWebFilter.class); + private final SAML2Client saml2Client; + private final SamlConfig samlConfig; + private final String httpUserNameHeader; + private final String httpDisplaynameHeader; + private final String httpEmailHeader; + private final String httpExternalIdHeader; + private final HashSet<String> authHeaders; - private String getHeaderFromConfig(Config gerritConfig, String name) { - String s = gerritConfig.getString("auth", null, name); - return s == null ? "" : s.toUpperCase(); + private String getHeaderFromConfig(Config gerritConfig, String name) { + String s = gerritConfig.getString("auth", null, name); + return s == null ? "" : s.toUpperCase(); + } + + @Inject + SamlWebFilter(@GerritServerConfig Config gerritConfig, SamlConfig samlConfig) { + this.samlConfig = samlConfig; + log.debug("Max Authentication Lifetime: " + samlConfig.getMaxAuthLifetimeAttr()); + SAML2ClientConfiguration samlClientConfig = + new SAML2ClientConfiguration( + samlConfig.getKeystorePath(), samlConfig.getKeystorePassword(), + samlConfig.getPrivateKeyPassword(), samlConfig.getMetadataPath()); + samlClientConfig.setMaximumAuthenticationLifetime(samlConfig.getMaxAuthLifetimeAttr()); + saml2Client = new SAML2Client(samlClientConfig); + String callbackUrl = + gerritConfig.getString("gerrit", null, "canonicalWebUrl") + + "plugins/gerrit-saml-plugin/saml"; + httpUserNameHeader = getHeaderFromConfig(gerritConfig, "httpHeader"); + httpDisplaynameHeader = getHeaderFromConfig(gerritConfig, "httpDisplaynameHeader"); + httpEmailHeader = getHeaderFromConfig(gerritConfig, "httpEmailHeader"); + httpExternalIdHeader = getHeaderFromConfig(gerritConfig, "httpExternalIdHeader"); + authHeaders = + Sets.newHashSet( + httpUserNameHeader, httpDisplaynameHeader, httpEmailHeader, httpExternalIdHeader); + if (authHeaders.contains("") || authHeaders.contains(null)) { + throw new RuntimeException("All authentication headers must be set."); + } + if (authHeaders.size() != 4) { + throw new RuntimeException( + "Unique values for httpUserNameHeader, " + + "httpDisplaynameHeader, httpEmailHeader and httpExternalIdHeader " + + "are required."); } - @Inject - SamlWebFilter(@GerritServerConfig Config gerritConfig, SamlConfig samlConfig) { - this.samlConfig = samlConfig; - log.debug("Max Authentication Lifetime: " + samlConfig.getMaxAuthLifetimeAttr()); - SAML2ClientConfiguration samlClientConfig = new SAML2ClientConfiguration( - samlConfig.getKeystorePath(), samlConfig.getKeystorePassword(), - samlConfig.getPrivateKeyPassword(), samlConfig.getMetadataPath()); - samlClientConfig.setMaximumAuthenticationLifetime(samlConfig.getMaxAuthLifetimeAttr()); - saml2Client = - new SAML2Client(samlClientConfig); - String callbackUrl = gerritConfig.getString("gerrit", null, "canonicalWebUrl") + "plugins/gerrit-saml-plugin/saml"; - httpUserNameHeader = getHeaderFromConfig(gerritConfig, "httpHeader"); - httpDisplaynameHeader = getHeaderFromConfig(gerritConfig, "httpDisplaynameHeader"); - httpEmailHeader = getHeaderFromConfig(gerritConfig, "httpEmailHeader"); - httpExternalIdHeader = getHeaderFromConfig(gerritConfig, "httpExternalIdHeader"); - authHeaders = Sets.newHashSet( - httpUserNameHeader, - httpDisplaynameHeader, - httpEmailHeader, - httpExternalIdHeader); - if (authHeaders.contains("") || authHeaders.contains(null)) { - throw new RuntimeException("All authentication headers must be set."); + saml2Client.setCallbackUrl(callbackUrl); + } + + @Override + public void init(FilterConfig filterConfig) throws ServletException {} + + @Override + public void destroy() {} + + private AuthenticatedUser userFromRequest(HttpServletRequest request) { + HttpSession s = request.getSession(); + AuthenticatedUser user = (AuthenticatedUser) s.getAttribute(SESSION_ATTR_USER); + if (user == null || user.getUsername() == null) return null; + else return user; + } + + private void signin(J2EContext context) throws HttpAction, IOException { + SAML2Credentials credentials = saml2Client.getCredentials(context); + SAML2Profile user = saml2Client.getUserProfile(credentials, context); + if (user != null) { + log.debug( + "Received SAML callback for userId={} with attributes: {}", + getUserName(user), + user.getAttributes()); + HttpSession s = context.getRequest().getSession(); + s.setAttribute( + SESSION_ATTR_USER, + new AuthenticatedUser( + getUserName(user), + getDisplayName(user), + getEmailAddress(user), + "saml/" + user.getId())); + + String redirectUri = context.getRequest().getParameter("RelayState"); + if (null == redirectUri || redirectUri.isEmpty()) { + redirectUri = "/"; + } + context.getResponse().sendRedirect(context.getRequest().getContextPath() + redirectUri); + } + } + + @Override + public void doFilter(ServletRequest incomingRequest, ServletResponse response, FilterChain chain) + throws IOException, ServletException { + /* The first thing we do is to wrap the request in an anonymous request, so in case + a malicious user is trying to set the headers manually, they'll be discarded. + */ + HttpServletRequest httpRequest = new AnonymousHttpRequest((HttpServletRequest) incomingRequest); + HttpServletResponse httpResponse = (HttpServletResponse) response; + AuthenticatedUser user = userFromRequest(httpRequest); + + try { + if (isSamlPostback(httpRequest)) { + J2EContext context = new J2EContext(httpRequest, httpResponse); + signin(context); + } else if (isGerritLogin(httpRequest)) { + if (user == null) { + J2EContext context = new J2EContext(httpRequest, httpResponse); + redirectToIdentityProvider(context); + } else { + HttpServletRequest req = new AuthenticatedHttpRequest(httpRequest, user); + chain.doFilter(req, response); } - if (authHeaders.size() != 4) { - throw new RuntimeException("Unique values for httpUserNameHeader, " + - "httpDisplaynameHeader, httpEmailHeader and httpExternalIdHeader " + - "are required."); - } - - saml2Client.setCallbackUrl(callbackUrl); + } else if (isGerritLogout(httpRequest)) { + httpRequest.getSession().removeAttribute(SESSION_ATTR_USER); + chain.doFilter(httpRequest, httpResponse); + } else { + chain.doFilter(httpRequest, httpResponse); + } + } catch (final HttpAction requiresHttpAction) { + throw new TechnicalException("Unexpected HTTP action", requiresHttpAction); } + } - @Override - public void init(FilterConfig filterConfig) throws ServletException { - } - - @Override - public void destroy() { - } - - private AuthenticatedUser userFromRequest(HttpServletRequest request) { - HttpSession s = request.getSession(); - AuthenticatedUser user = (AuthenticatedUser) s.getAttribute(SESSION_ATTR_USER); - if (user == null || user.getUsername() == null) - return null; - else return user; - } - - private void signin(J2EContext context) throws HttpAction, IOException { - SAML2Credentials credentials = saml2Client.getCredentials(context); - SAML2Profile user = saml2Client.getUserProfile(credentials, context); - if (user != null) { - log.debug("Received SAML callback for userId={} with attributes: {}", - getUserName(user), user.getAttributes()); - HttpSession s = context.getRequest().getSession(); - s.setAttribute(SESSION_ATTR_USER, new AuthenticatedUser( - getUserName(user), - getDisplayName(user), - getEmailAddress(user), - "saml/" + user.getId())); - - String redirectUri = context.getRequest().getParameter("RelayState"); - if (null == redirectUri || redirectUri.isEmpty()) { - redirectUri = "/"; - } - context.getResponse().sendRedirect(context.getRequest().getContextPath() + redirectUri); - } - } - - @Override - public void doFilter(ServletRequest incomingRequest, ServletResponse response, - FilterChain chain) throws IOException, ServletException { - /* The first thing we do is to wrap the request in an anonymous request, so in case - a malicious user is trying to set the headers manually, they'll be discarded. - */ - HttpServletRequest httpRequest = new AnonymousHttpRequest( - (HttpServletRequest) incomingRequest); - HttpServletResponse httpResponse = (HttpServletResponse) response; - AuthenticatedUser user = userFromRequest(httpRequest); - - try { - if (isSamlPostback(httpRequest)) { - J2EContext context = new J2EContext(httpRequest, httpResponse); - signin(context); - } else if (isGerritLogin(httpRequest)) { - if (user == null) { - J2EContext context = new J2EContext(httpRequest, httpResponse); - redirectToIdentityProvider(context); - } else { - HttpServletRequest req = new AuthenticatedHttpRequest(httpRequest, user); - chain.doFilter(req, response); - } - } else if (isGerritLogout(httpRequest)) { - httpRequest.getSession().removeAttribute(SESSION_ATTR_USER); - chain.doFilter(httpRequest, httpResponse); - } else { - chain.doFilter(httpRequest, httpResponse); - } - } catch (final HttpAction requiresHttpAction) { - throw new TechnicalException("Unexpected HTTP action", requiresHttpAction); - } - } - - private void redirectToIdentityProvider(J2EContext context) - throws HttpAction { - String redirectUri = Url.decode(context + private void redirectToIdentityProvider(J2EContext context) throws HttpAction { + String redirectUri = + Url.decode( + context .getRequest() .getRequestURI() - .substring( - context.getRequest().getContextPath().length())); - context.setSessionAttribute(SAML2Client.SAML_RELAY_STATE_ATTRIBUTE, redirectUri); - log.debug("Setting redirectUri: {}", redirectUri); - saml2Client.redirect(context); + .substring(context.getRequest().getContextPath().length())); + context.setSessionAttribute(SAML2Client.SAML_RELAY_STATE_ATTRIBUTE, redirectUri); + log.debug("Setting redirectUri: {}", redirectUri); + saml2Client.redirect(context); + } + + private static boolean isGerritLogin(HttpServletRequest request) { + return request.getRequestURI().indexOf(GERRIT_LOGIN) >= 0; + } + + private static boolean isGerritLogout(HttpServletRequest request) { + return request.getRequestURI().indexOf(GERRIT_LOGOUT) >= 0; + } + + private static boolean isSamlPostback(HttpServletRequest request) { + return "POST".equals(request.getMethod()) + && request.getRequestURI().indexOf(SAML_POSTBACK) >= 0; + } + + private String getAttribute(SAML2Profile user, String attrName) { + List<?> names = (List<?>) user.getAttribute(attrName); + if (names != null && !names.isEmpty()) { + return (String) names.get(0); + } + return null; + } + + private String getAttributeOrElseId(SAML2Profile user, String attrName) { + String value = getAttribute(user, attrName); + if (value != null) { + return value; + } + return user.getId(); + } + + private String getDisplayName(SAML2Profile user) { + return getAttributeOrElseId(user, samlConfig.getDisplayNameAttr()); + } + + private String getEmailAddress(SAML2Profile user) { + String emailAddress = getAttribute(user, samlConfig.getEmailAddressAttr()); + if (emailAddress != null) { + return emailAddress; + } + String nameId = user.getId(); + if (!nameId.contains("@")) { + log.debug( + "Email address attribute not found, NameId {} does not look like an email.", nameId); + return null; + } + return emailAddress; + } + + private String getUserName(SAML2Profile user) { + return getAttributeOrElseId(user, samlConfig.getUserNameAttr()); + } + + private class AuthenticatedHttpRequest extends HttpServletRequestWrapper { + private AuthenticatedUser user; + + public AuthenticatedHttpRequest(HttpServletRequest request, @Nonnull AuthenticatedUser user) { + super(request); + this.user = user; } - private static boolean isGerritLogin(HttpServletRequest request) { - return request.getRequestURI().indexOf(GERRIT_LOGIN) >= 0; + @Override + public Enumeration<String> getHeaderNames() { + final Enumeration<String> wrappedHeaderNames = super.getHeaderNames(); + HashSet<String> headerNames = new HashSet<>(authHeaders); + while (wrappedHeaderNames.hasMoreElements()) { + headerNames.add(wrappedHeaderNames.nextElement()); + } + return Iterators.asEnumeration(headerNames.iterator()); } - private static boolean isGerritLogout(HttpServletRequest request) { - return request.getRequestURI().indexOf(GERRIT_LOGOUT) >= 0; + @Override + public String getHeader(String name) { + String nameUpperCase = name.toUpperCase(); + if (httpUserNameHeader.equals(nameUpperCase)) { + return user.getUsername(); + } else if (httpDisplaynameHeader.equals(nameUpperCase)) { + return user.getDisplayName(); + } else if (httpEmailHeader.equals(nameUpperCase)) { + return user.getEmail(); + } else if (httpExternalIdHeader.equals(nameUpperCase)) { + return user.getExternalId(); + } else { + return super.getHeader(name); + } + } + } + + private class AnonymousHttpRequest extends HttpServletRequestWrapper { + public AnonymousHttpRequest(HttpServletRequest request) { + super(request); } - private static boolean isSamlPostback(HttpServletRequest request) { - return "POST".equals(request.getMethod()) - && request.getRequestURI().indexOf(SAML_POSTBACK) >= 0; - } + @Override + public Enumeration<String> getHeaderNames() { + final Enumeration<String> wrappedHeaderNames = super.getHeaderNames(); - private String getAttribute(SAML2Profile user, String attrName) { - List<?> names = (List<?>) user.getAttribute(attrName); - if (names != null && !names.isEmpty()) { - return (String) names.get(0); + HashSet<String> headerNames = new HashSet<>(); + while (wrappedHeaderNames.hasMoreElements()) { + String header = wrappedHeaderNames.nextElement(); + if (!authHeaders.contains(header.toUpperCase())) { + headerNames.add(wrappedHeaderNames.nextElement()); } + } + return Iterators.asEnumeration(headerNames.iterator()); + } + + @Override + public String getHeader(String name) { + String nameUpperCase = name.toUpperCase(); + if (authHeaders.contains(nameUpperCase)) { return null; + } else { + return super.getHeader(name); + } } - - private String getAttributeOrElseId(SAML2Profile user, String attrName) { - String value = getAttribute(user, attrName); - if (value != null) { - return value; - } - return user.getId(); - } - - private String getDisplayName(SAML2Profile user) { - return getAttributeOrElseId(user, samlConfig.getDisplayNameAttr()); - } - - private String getEmailAddress(SAML2Profile user) { - String emailAddress = getAttribute(user, samlConfig.getEmailAddressAttr()); - if (emailAddress != null) { - return emailAddress; - } - String nameId = user.getId(); - if (!nameId.contains("@")) { - log.debug( - "Email address attribute not found, NameId {} does not look like an email.", - nameId); - return null; - } - return emailAddress; - } - - private String getUserName(SAML2Profile user) { - return getAttributeOrElseId(user, samlConfig.getUserNameAttr()); - } - - private class AuthenticatedHttpRequest extends HttpServletRequestWrapper { - private AuthenticatedUser user; - - public AuthenticatedHttpRequest(HttpServletRequest request, - @Nonnull AuthenticatedUser user) { - super(request); - this.user = user; - } - - @Override - public Enumeration<String> getHeaderNames() { - final Enumeration<String> wrappedHeaderNames = super.getHeaderNames(); - HashSet<String> headerNames = new HashSet<>(authHeaders); - while (wrappedHeaderNames.hasMoreElements()) { - headerNames.add(wrappedHeaderNames.nextElement()); - } - return Iterators.asEnumeration(headerNames.iterator()); - } - - @Override - public String getHeader(String name) { - String nameUpperCase = name.toUpperCase(); - if (httpUserNameHeader.equals(nameUpperCase)) { - return user.getUsername(); - } else if (httpDisplaynameHeader.equals(nameUpperCase)) { - return user.getDisplayName(); - } else if (httpEmailHeader.equals(nameUpperCase)) { - return user.getEmail(); - } else if (httpExternalIdHeader.equals(nameUpperCase)) { - return user.getExternalId(); - } else { - return super.getHeader(name); - } - } - } - - private class AnonymousHttpRequest extends HttpServletRequestWrapper { - public AnonymousHttpRequest(HttpServletRequest request) { - super(request); - } - - @Override - public Enumeration<String> getHeaderNames() { - final Enumeration<String> wrappedHeaderNames = super.getHeaderNames(); - - HashSet<String> headerNames = new HashSet<>(); - while (wrappedHeaderNames.hasMoreElements()) { - String header = wrappedHeaderNames.nextElement(); - if (!authHeaders.contains(header.toUpperCase())) { - headerNames.add(wrappedHeaderNames.nextElement()); - } - } - return Iterators.asEnumeration(headerNames.iterator()); - } - - @Override - public String getHeader(String name) { - String nameUpperCase = name.toUpperCase(); - if (authHeaders.contains(nameUpperCase)) { - return null; - } else { - return super.getHeader(name); - } - } - } + } }