Package net.shibboleth.idp.authn.impl

Class JAASCredentialValidator

  • All Implemented Interfaces:
    net.shibboleth.idp.authn.CredentialValidator, net.shibboleth.idp.authn.principal.PrincipalSupportingComponent, net.shibboleth.utilities.java.support.component.Component, net.shibboleth.utilities.java.support.component.DestructableComponent, net.shibboleth.utilities.java.support.component.IdentifiableComponent, net.shibboleth.utilities.java.support.component.IdentifiedComponent, net.shibboleth.utilities.java.support.component.InitializableComponent
    @ThreadSafe
public class JAASCredentialValidator
extends net.shibboleth.idp.authn.AbstractUsernamePasswordCredentialValidator
    A password validator that authenticates against JAAS.

    Support for complex chaining of JAAS modules remains supported but should be avoided in favor of the new support for chaining validators in most cases.

    Since:
    4.0.0

    • Nested Class Summary

      Nested Classes 
      Modifier and Type Class Description
      protected class  JAASCredentialValidator.SimpleCallbackHandler
      A callback handler that provides name and password data to a JAAS login process, along with other miscellany.

      • Nested classes/interfaces inherited from interface net.shibboleth.idp.authn.CredentialValidator

        net.shibboleth.idp.authn.CredentialValidator.ErrorHandler, net.shibboleth.idp.authn.CredentialValidator.WarningHandler

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      private Subject authenticate​(String loginConfigName, net.shibboleth.idp.authn.context.UsernamePasswordContext usernamePasswordContext)
      Create a JAAS configuration and attempt a login with it.
      protected Subject doValidate​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext, net.shibboleth.idp.authn.context.UsernamePasswordContext usernamePasswordContext, net.shibboleth.idp.authn.CredentialValidator.WarningHandler warningHandler, net.shibboleth.idp.authn.CredentialValidator.ErrorHandler errorHandler)
      Configuration.Parameters getLoginConfigParameters()
      Get the type-specific parameters of the JAAS Configuration to use.
      String getLoginConfigType()
      Get the type of JAAS Configuration to use.
      protected Subject populateSubject​(Subject subject, Subject derivedSubject, net.shibboleth.idp.authn.context.UsernamePasswordContext usernamePasswordContext)
      Finish decorating the result.
      void setLoginConfigNames​(Collection<String> names)
      Set the JAAS application name(s) to use.
      void setLoginConfigParameters​(Configuration.Parameters params)
      Set the type-specific parameters of the JAAS Configuration to use.
      void setLoginConfigStrategy​(Function<org.opensaml.profile.context.ProfileRequestContext,​Collection<net.shibboleth.utilities.java.support.collection.Pair<String,​Subject>>> strategy)
      Set the strategy function to use to obtain the JAAS application configuration(s) to use.
      void setLoginConfigType​(String type)
      Set the type of JAAS Configuration to use.
      void setLoginConfigurations​(Collection<net.shibboleth.utilities.java.support.collection.Pair<String,​Collection<Principal>>> configs)
      Set the JAAS application name(s) to use, along with an optional collection of custom principals to apply to the result.

      • Methods inherited from class net.shibboleth.idp.authn.AbstractUsernamePasswordCredentialValidator

        applyTransforms, doValidate, populateSubject, removeContextAfterValidation, savePasswordToCredentialSet, setLowercase, setMatchExpression, setRemoveContextAfterValidation, setSavePasswordToCredentialSet, setTransforms, setTrim, setUppercase, setUsernamePasswordContextLookupStrategy

      • Methods inherited from class net.shibboleth.idp.authn.AbstractCredentialValidator

        getLogPrefix, getSupportedPrincipals, isAcceptable, populateSubject, setActivationCondition, setId, setSupportedPrincipals, validate

      • Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

        doInitialize, getId

      • Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

        destroy, doDestroy, initialize, isDestroyed, isInitialized

      • Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiedComponent

        getId

    • Field Detail

      • log

        @Nonnull
private final org.slf4j.Logger log
        Class logger.

      • loginConfigType

        @Nullable
private String loginConfigType
        Type of JAAS Configuration to instantiate.

      • loginConfigParameters

        @Nullable
private Configuration.Parameters loginConfigParameters
        Type-specific configuration parameters.

      • loginConfigurations

        @Nonnull
private Collection<net.shibboleth.utilities.java.support.collection.Pair<String,​Subject>> loginConfigurations
        Application name(s) in JAAS configuration to use.

      • loginConfigStrategy

        @Nullable
private Function<org.opensaml.profile.context.ProfileRequestContext,​Collection<net.shibboleth.utilities.java.support.collection.Pair<String,​Subject>>> loginConfigStrategy
        Strategy function to dynamically derive the login config(s) to use.

    • Constructor Detail

      • JAASCredentialValidator

        public JAASCredentialValidator()
        Constructor.

    • Method Detail

      • getLoginConfigType

        @Nullable
public String getLoginConfigType()
        Get the type of JAAS Configuration to use.
        Returns:
        the type of JAAS configuration to use

      • setLoginConfigType

        public void setLoginConfigType​(@Nullable
                               String type)
        Set the type of JAAS Configuration to use.
        Parameters:
        type - the type of JAAS configuration to use

      • getLoginConfigParameters

        @Nullable
public Configuration.Parameters getLoginConfigParameters()
        Get the type-specific parameters of the JAAS Configuration to use.
        Returns:
        the JAAS configuration parameters to use

      • setLoginConfigParameters

        public void setLoginConfigParameters​(@Nullable
                                     Configuration.Parameters params)
        Set the type-specific parameters of the JAAS Configuration to use.
        Parameters:
        params - the JAAS configuration parameters to use

      • setLoginConfigurations

        public void setLoginConfigurations​(@Nullable
                                   Collection<net.shibboleth.utilities.java.support.collection.Pair<String,​Collection<Principal>>> configs)
        Set the JAAS application name(s) to use, along with an optional collection of custom principals to apply to the result.
        Parameters:
        configs - list of JAAS application names and custom principals to use

      • setLoginConfigNames

        public void setLoginConfigNames​(@Nullable @NonnullElements
                                Collection<String> names)
        Set the JAAS application name(s) to use.
        Parameters:
        names - list of JAAS application names to use

      • setLoginConfigStrategy

        public void setLoginConfigStrategy​(@Nullable
                                   Function<org.opensaml.profile.context.ProfileRequestContext,​Collection<net.shibboleth.utilities.java.support.collection.Pair<String,​Subject>>> strategy)
        Set the strategy function to use to obtain the JAAS application configuration(s) to use.
        Parameters:
        strategy - strategy function

      • doValidate

        @Nullable
protected Subject doValidate​(@Nonnull
                             org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                             @Nonnull
                             net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext,
                             @Nonnull
                             net.shibboleth.idp.authn.context.UsernamePasswordContext usernamePasswordContext,
                             @Nullable
                             net.shibboleth.idp.authn.CredentialValidator.WarningHandler warningHandler,
                             @Nullable
                             net.shibboleth.idp.authn.CredentialValidator.ErrorHandler errorHandler)
                      throws Exception
        Specified by:
        doValidate in class net.shibboleth.idp.authn.AbstractUsernamePasswordCredentialValidator
        Throws:
        Exception

      • authenticate

        @Nonnull
private Subject authenticate​(@Nonnull @NotEmpty
                             String loginConfigName,
                             @Nonnull
                             net.shibboleth.idp.authn.context.UsernamePasswordContext usernamePasswordContext)
                      throws LoginException,
                             NoSuchAlgorithmException
        Create a JAAS configuration and attempt a login with it.
        Parameters:
        loginConfigName - the application name to use
        usernamePasswordContext - input context
        Returns:
        the JAAS result
        Throws:
        LoginException - if the JAAS login process fails
        NoSuchAlgorithmException - if a JAAS configuration cannot be created

      • populateSubject

        @Nonnull
protected Subject populateSubject​(@Nonnull
                                  Subject subject,
                                  @Nullable
                                  Subject derivedSubject,
                                  @Nonnull
                                  net.shibboleth.idp.authn.context.UsernamePasswordContext usernamePasswordContext)
        Finish decorating the result.
        Parameters:
        subject - the JAAS result
        derivedSubject - container for additional principals
        usernamePasswordContext - input context
        Returns:
        final result