Package net.shibboleth.idp.authn.impl

Class ValidateCredentials

  • All Implemented Interfaces:
    net.shibboleth.idp.authn.CredentialValidator.ErrorHandler, net.shibboleth.idp.authn.CredentialValidator.WarningHandler, net.shibboleth.idp.authn.principal.PrincipalSupportingComponent, net.shibboleth.utilities.java.support.component.Component, net.shibboleth.utilities.java.support.component.DestructableComponent, net.shibboleth.utilities.java.support.component.InitializableComponent, org.opensaml.profile.action.ProfileAction, Aware, MessageSource, MessageSourceAware, Action
    public class ValidateCredentials
extends net.shibboleth.idp.authn.AbstractValidationAction
implements net.shibboleth.idp.authn.CredentialValidator.WarningHandler, net.shibboleth.idp.authn.CredentialValidator.ErrorHandler
    An action that processes a list of CredentialValidator objects to produce an AuthenticationResult.
    Since:
    4.0.0
    Event:
    EventIds.PROCEED_EVENT_ID, others on error
    Precondition:
    ProfileRequestContext.getSubcontext(AuthenticationContext.class).getAttemptedFlow() != null

    • Field Summary

      Fields 
      Modifier and Type Field Description
      private List<net.shibboleth.idp.authn.CredentialValidator> credentialValidators
      Ordered list of validators.
      private net.shibboleth.idp.authn.CredentialValidator currentValidator
      Currently executing validator.
      private static String DEFAULT_METRIC_NAME
      Default prefix for metrics.
      private boolean errorSignaled
      Tracks whether an error event was signaled.
      private net.shibboleth.idp.authn.AccountLockoutManager lockoutManager
      Optional lockout management interface.
      private org.slf4j.Logger log
      Class logger.
      private boolean requireAll
      Whether all validators must succeed.
      private Collection<Subject> results
      Results from successful validators.
      private boolean warningSignaled
      Tracks whether a warning event was signaled.

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      protected void doExecute​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      protected boolean doPreExecute​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      String getMetricName()
      void handleError​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext, Exception e, String eventId)
      void handleError​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext, String message, String eventId)
      void handleWarning​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext, String message, String eventId)
      protected Subject populateSubject​(Subject subject)
      protected void recordSuccess​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
      Record a successful authentication attempt against the configured counter, optionally clearing account lockout state.
      void setLockoutManager​(net.shibboleth.idp.authn.AccountLockoutManager manager)
      Set an account lockout management component.
      void setRequireAll​(boolean flag)
      Set whether to execute and require success from all configured validators, or stop at the first successful result.
      void setValidators​(List<net.shibboleth.idp.authn.CredentialValidator> validators)
      Set the list of validators to use.

      • Methods inherited from class net.shibboleth.idp.authn.AbstractValidationAction

        addDefaultPrincipals, buildAuthenticationResult, getClassifiedErrors, getRequesterLookupStrategy, getResponderLookupStrategy, getResultCachingPredicate, getSubject, getSupportedPrincipals, recordFailure, recordSuccess, setAddDefaultPrincipals, setClassifiedMessages, setMetricName, setRequesterLookupStrategy, setResponderLookupStrategy, setResultCachingPredicate, setSupportedPrincipals

      • Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

        doExecute, doPreExecute, setAuthenticationContextLookupStrategy

      • Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

        doExecute, execute, getMessage, getMessage, getMessage, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

      • Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

        getActivationCondition, setActivationCondition

      • Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

        doPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletResponse, getLogPrefix, setHttpServletRequest, setHttpServletResponse

      • Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

        destroy, doDestroy, doInitialize, initialize, isDestroyed, isInitialized

      • Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

        initialize, isInitialized

    • Field Detail

      • DEFAULT_METRIC_NAME

        @Nonnull
@NotEmpty
private static final String DEFAULT_METRIC_NAME
        Default prefix for metrics.
        See Also:
        Constant Field Values

      • log

        @Nonnull
private final org.slf4j.Logger log
        Class logger.

      • credentialValidators

        @Nonnull
@NonnullElements
private List<net.shibboleth.idp.authn.CredentialValidator> credentialValidators
        Ordered list of validators.

      • requireAll

        private boolean requireAll
        Whether all validators must succeed.

      • lockoutManager

        @Nullable
private net.shibboleth.idp.authn.AccountLockoutManager lockoutManager
        Optional lockout management interface.

      • results

        @Nonnull
@NonnullElements
private Collection<Subject> results
        Results from successful validators.

      • currentValidator

        @Nullable
private net.shibboleth.idp.authn.CredentialValidator currentValidator
        Currently executing validator.

      • warningSignaled

        private boolean warningSignaled
        Tracks whether a warning event was signaled.

      • errorSignaled

        private boolean errorSignaled
        Tracks whether an error event was signaled.

    • Constructor Detail

      • ValidateCredentials

        public ValidateCredentials()
        Constructor.

    • Method Detail

      • setLockoutManager

        public void setLockoutManager​(@Nullable
                              net.shibboleth.idp.authn.AccountLockoutManager manager)
        Set an account lockout management component.
        Parameters:
        manager - lockout manager

      • setValidators

        public void setValidators​(@Nonnull @NonnullElements
                          List<net.shibboleth.idp.authn.CredentialValidator> validators)
        Set the list of validators to use.
        Parameters:
        validators - validators to use

      • setRequireAll

        public void setRequireAll​(boolean flag)
        Set whether to execute and require success from all configured validators, or stop at the first successful result.
        Parameters:
        flag - flag to set

      • getMetricName

        @Nonnull
@NotEmpty
public String getMetricName()
        Overrides:
        getMetricName in class net.shibboleth.idp.authn.AbstractValidationAction

      • handleWarning

        public void handleWarning​(@Nonnull
                          org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                          @Nonnull
                          net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext,
                          @Nullable
                          String message,
                          @Nonnull @NotEmpty
                          String eventId)
        Specified by:
        handleWarning in interface net.shibboleth.idp.authn.CredentialValidator.WarningHandler
        Overrides:
        handleWarning in class net.shibboleth.idp.authn.AbstractValidationAction

      • handleError

        public void handleError​(@Nonnull
                        org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                        @Nonnull
                        net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext,
                        @Nullable
                        String message,
                        @Nonnull @NotEmpty
                        String eventId)
        Specified by:
        handleError in interface net.shibboleth.idp.authn.CredentialValidator.ErrorHandler
        Overrides:
        handleError in class net.shibboleth.idp.authn.AbstractValidationAction

      • handleError

        public void handleError​(@Nonnull
                        org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                        @Nonnull
                        net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext,
                        @Nonnull
                        Exception e,
                        @Nonnull @NotEmpty
                        String eventId)
        Specified by:
        handleError in interface net.shibboleth.idp.authn.CredentialValidator.ErrorHandler
        Overrides:
        handleError in class net.shibboleth.idp.authn.AbstractValidationAction

      • doPreExecute

        protected boolean doPreExecute​(@Nonnull
                               org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                               @Nonnull
                               net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Overrides:
        doPreExecute in class net.shibboleth.idp.authn.AbstractValidationAction

      • doExecute

        protected void doExecute​(@Nonnull
                         org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                         @Nonnull
                         net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Overrides:
        doExecute in class net.shibboleth.idp.authn.AbstractAuthenticationAction

      • populateSubject

        @Nonnull
protected Subject populateSubject​(@Nonnull
                                  Subject subject)
        Specified by:
        populateSubject in class net.shibboleth.idp.authn.AbstractValidationAction

      • recordSuccess

        protected void recordSuccess​(@Nonnull
                             org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
        Record a successful authentication attempt against the configured counter, optionally clearing account lockout state.
        Parameters:
        profileRequestContext - current profile request context