Package net.shibboleth.idp.authn.impl

Class SelectAuthenticationFlow

  • All Implemented Interfaces:
    net.shibboleth.utilities.java.support.component.Component, net.shibboleth.utilities.java.support.component.DestructableComponent, net.shibboleth.utilities.java.support.component.InitializableComponent, org.opensaml.profile.action.ProfileAction, Aware, MessageSource, MessageSourceAware, Action
    public class SelectAuthenticationFlow
extends net.shibboleth.idp.authn.AbstractAuthenticationAction
    An authentication action that selects an authentication flow to invoke, or re-uses an existing result for SSO.

    This is the heart of the authentication processing sequence, and runs after the AuthenticationContext has been fully populated. It uses the potential flows, the RequestedPrincipalContext (if any), and the active results, to decide how to proceed.

    Normal processing behavior can be circumvented if AuthenticationContext.getSignaledFlowId() is set, which causes an active result from that flow to be reused, or that flow to be invoked, if at all possible, subject to the usual predicates and requested principal constraints noted below.

    Otherwise, if there is no RequestedPrincipalContext, then an active result will be reused, unless the request requires forced authentication. If not possible, then a potential flow will be selected and its ID returned as the result of the action.

    If there are requested principals, then the results or flows chosen must "match" the request information according to the PrincipalEvalPredicateFactoryRegistry attached to the context. The "favorSSO" option determines whether to select a flow specifically in the order specified by the RequestedPrincipalContext, or to favor an active but matching result over a new flow. Forced authentication trumps the use of any active result.

    Event:
    EventIds.PROCEED_EVENT_ID (reuse of a result, i.e., SSO), AuthnEventIds.NO_PASSIVE, AuthnEventIds.NO_POTENTIAL_FLOW, AuthnEventIds.REQUEST_UNSUPPORTED, Selected flow ID to execute
    Precondition:
    ProfileRequestContext.getSubcontext(AuthenticationContext.class) != null
    , The content of AuthenticationContext.getPotentialFlows() are assumed to be acceptable with respect to passive and forced authentication requirements, etc.
    Postcondition:
    If a result is reused, AuthenticationContext.getAuthenticationResult() will return that result. Otherwise, AuthenticationContext.getAttemptedFlow() will return the flow selected for execution and returned as an event.

    • Field Summary

      Fields 
      Modifier and Type Field Description
      private boolean favorSSO
      Whether SSO trumps explicit relying party flow preference.
      private org.slf4j.Logger log
      Class logger.
      private boolean noProxying
      Tracks a proxy count of zero for the request.
      private net.shibboleth.idp.authn.context.PreferredPrincipalContext preferredPrincipalCtx
      A subordinate PreferredPrincipalContext, if any.
      private net.shibboleth.idp.authn.context.RequestedPrincipalContext requestedPrincipalCtx
      A subordinate RequestedPrincipalContext, if any.

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      protected void doExecute​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      protected boolean doPreExecute​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      private void doSelectNoRequestedPrincipals​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      Executes the selection process in the absence of specific requested principals.
      private void doSelectRequestedPrincipals​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      Executes the selection process in the presence of specific requested Principals, requiring evaluation of potential flows and results for Principal-compatibility with request.
      private void doSelectSignaledFlow​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      Executes the selection process in the presence of an explicit flow signal.
      boolean getFavorSSO()
      Get whether SSO should trump explicit relying party requirements preference.
      private net.shibboleth.idp.authn.AuthenticationFlowDescriptor getUnattemptedInactiveFlow​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      Return the first inactive potential flow not found in the intermediate flows collection that applies to the request.
      private void selectActiveResult​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext, net.shibboleth.idp.authn.AuthenticationResult result)
      Selects an active result and completes processing.
      private void selectInactiveFlow​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext, net.shibboleth.idp.authn.AuthenticationFlowDescriptor descriptor)
      Selects an inactive flow and completes processing.
      private void selectRequestedFlow​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext, Map<String,​net.shibboleth.idp.authn.AuthenticationResult> activeResults)
      Selects a flow or an active result in the presence of specific requested Principals and completes processing.
      private void selectRequestedInactiveFlow​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      Selects an inactive flow in the presence of specific requested Principals, and completes processing.
      void setFavorSSO​(boolean flag)
      Set whether SSO should trump explicit relying party requirements preference.

      • Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

        doExecute, doPreExecute, setAuthenticationContextLookupStrategy

      • Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

        doExecute, execute, getMessage, getMessage, getMessage, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

      • Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

        getActivationCondition, setActivationCondition

      • Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

        doPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletResponse, getLogPrefix, setHttpServletRequest, setHttpServletResponse

      • Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

        destroy, doDestroy, doInitialize, initialize, isDestroyed, isInitialized

      • Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

        initialize, isInitialized

    • Field Detail

      • log

        @Nonnull
private final org.slf4j.Logger log
        Class logger.

      • favorSSO

        private boolean favorSSO
        Whether SSO trumps explicit relying party flow preference.

      • requestedPrincipalCtx

        @Nullable
private net.shibboleth.idp.authn.context.RequestedPrincipalContext requestedPrincipalCtx
        A subordinate RequestedPrincipalContext, if any.

      • preferredPrincipalCtx

        @Nullable
private net.shibboleth.idp.authn.context.PreferredPrincipalContext preferredPrincipalCtx
        A subordinate PreferredPrincipalContext, if any.

      • noProxying

        private boolean noProxying
        Tracks a proxy count of zero for the request.

    • Constructor Detail

      • SelectAuthenticationFlow

        public SelectAuthenticationFlow()

    • Method Detail

      • getFavorSSO

        public boolean getFavorSSO()
        Get whether SSO should trump explicit relying party requirements preference.
        Returns:
        whether SSO should trump explicit relying party requirements preference

      • setFavorSSO

        public void setFavorSSO​(boolean flag)
        Set whether SSO should trump explicit relying party requirements preference.
        Parameters:
        flag - whether SSO should trump explicit relying party requirements preference

      • doPreExecute

        protected boolean doPreExecute​(@Nonnull
                               org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                               @Nonnull
                               net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Overrides:
        doPreExecute in class net.shibboleth.idp.authn.AbstractAuthenticationAction

      • doExecute

        protected void doExecute​(@Nonnull
                         org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                         @Nonnull
                         net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Overrides:
        doExecute in class net.shibboleth.idp.authn.AbstractAuthenticationAction

      • doSelectSignaledFlow

        private void doSelectSignaledFlow​(@Nonnull
                                  org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                                  @Nonnull
                                  net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Executes the selection process in the presence of an explicit flow signal.
        Parameters:
        profileRequestContext - the current IdP profile request context
        authenticationContext - the current authentication context

      • doSelectNoRequestedPrincipals

        private void doSelectNoRequestedPrincipals​(@Nonnull
                                           org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                                           @Nonnull
                                           net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Executes the selection process in the absence of specific requested principals.
        Parameters:
        profileRequestContext - the current IdP profile request context
        authenticationContext - the current authentication context

      • getUnattemptedInactiveFlow

        @Nullable
private net.shibboleth.idp.authn.AuthenticationFlowDescriptor getUnattemptedInactiveFlow​(@Nonnull
                                                                                         org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                                                                                         @Nonnull
                                                                                         net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Return the first inactive potential flow not found in the intermediate flows collection that applies to the request.
        Parameters:
        profileRequestContext - the current profile request context
        authenticationContext - the current authentication context
        Returns:
        an eligible flow, or null

      • selectInactiveFlow

        private void selectInactiveFlow​(@Nonnull
                                org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                                @Nonnull
                                net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext,
                                @Nonnull
                                net.shibboleth.idp.authn.AuthenticationFlowDescriptor descriptor)
        Selects an inactive flow and completes processing.
        Parameters:
        profileRequestContext - the current IdP profile request context
        authenticationContext - the current authentication context
        descriptor - the flow to select

      • selectActiveResult

        private void selectActiveResult​(@Nonnull
                                org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                                @Nonnull
                                net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext,
                                @Nonnull
                                net.shibboleth.idp.authn.AuthenticationResult result)
        Selects an active result and completes processing.
        Parameters:
        profileRequestContext - the current IdP profile request context
        authenticationContext - the current authentication context
        result - the result to reuse

      • doSelectRequestedPrincipals

        private void doSelectRequestedPrincipals​(@Nonnull
                                         org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                                         @Nonnull
                                         net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Executes the selection process in the presence of specific requested Principals, requiring evaluation of potential flows and results for Principal-compatibility with request.
        Parameters:
        profileRequestContext - the current IdP profile request context
        authenticationContext - the current authentication context

      • selectRequestedInactiveFlow

        private void selectRequestedInactiveFlow​(@Nonnull
                                         org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                                         @Nonnull
                                         net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Selects an inactive flow in the presence of specific requested Principals, and completes processing.
        Parameters:
        profileRequestContext - the current IdP profile request context
        authenticationContext - the current authentication context

      • selectRequestedFlow

        private void selectRequestedFlow​(@Nonnull
                                 org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                                 @Nonnull
                                 net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext,
                                 @Nonnull @NonnullElements
                                 Map<String,​net.shibboleth.idp.authn.AuthenticationResult> activeResults)
        Selects a flow or an active result in the presence of specific requested Principals and completes processing.
        Parameters:
        profileRequestContext - the current IdP profile request context
        authenticationContext - the current authentication context
        activeResults - active results that may be reused