Package net.shibboleth.idp.authn.impl

Class ValidateExternalAuthentication

  • All Implemented Interfaces:
    net.shibboleth.idp.authn.principal.PrincipalSupportingComponent, net.shibboleth.utilities.java.support.component.Component, net.shibboleth.utilities.java.support.component.DestructableComponent, net.shibboleth.utilities.java.support.component.InitializableComponent, org.opensaml.profile.action.ProfileAction, Aware, MessageSource, MessageSourceAware, Action
    public class ValidateExternalAuthentication
extends net.shibboleth.idp.authn.AbstractValidationAction
    An action that checks for an ExternalAuthenticationContext and directly produces an AuthenticationResult or records error state based on the contents.
    Event:
    EventIds.PROCEED_EVENT_ID, AuthnEventIds.INVALID_AUTHN_CTX, AuthnEventIds.AUTHN_EXCEPTION, AuthnEventIds.NO_CREDENTIALS
    Precondition:
    ProfileRequestContext.getSubcontext(AuthenticationContext.class).getAttemptedFlow() != null
    Postcondition:
    If AuthenticationContext.getSubcontext(ExternalAuthenticationContext.class) != null, then an AuthenticationResult is saved to the AuthenticationContext on a successful login. On a failed login, the AbstractValidationAction.handleError(ProfileRequestContext, AuthenticationContext, Exception, String) method is called.

    • Field Summary

      Fields 
      Modifier and Type Field Description
      private net.shibboleth.idp.attribute.context.AttributeContext attributeContext
      Context for externally supplied inbound attributes.
      private net.shibboleth.utilities.java.support.service.ReloadableService<net.shibboleth.idp.attribute.filter.AttributeFilter> attributeFilterService
      Service used to get the engine used to filter attributes.
      private static String DEFAULT_METRIC_NAME
      Default prefix for metrics.
      private net.shibboleth.idp.authn.context.ExternalAuthenticationContext extContext
      Context containing the result to validate.
      private org.slf4j.Logger log
      Class logger.
      private Pattern matchExpression
      A regular expression to apply for acceptance testing.
      private org.opensaml.saml.metadata.resolver.MetadataResolver metadataResolver
      Optional supplemental metadata source for filtering.

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      private boolean checkUsername​(Subject subject)
      Validate the username if necessary.
      protected void doExecute​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      protected boolean doPreExecute​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      private void filterAttributes()
      Check for inbound attributes and apply filtering.
      private void populateFilterContext​(net.shibboleth.idp.attribute.filter.context.AttributeFilterContext filterContext)
      Fill in the filter context data.
      protected Subject populateSubject​(Subject subject)
      void setMatchExpression​(Pattern expression)
      Set a matching expression to apply for username acceptance.
      void setMetadataResolver​(org.opensaml.saml.metadata.resolver.MetadataResolver resolver)
      Set a metadata source to use during filtering.

      • Methods inherited from class net.shibboleth.idp.authn.AbstractValidationAction

        addDefaultPrincipals, buildAuthenticationResult, getClassifiedErrors, getMetricName, getRequesterLookupStrategy, getResponderLookupStrategy, getResultCachingPredicate, getSubject, getSupportedPrincipals, handleError, handleError, handleWarning, recordFailure, recordSuccess, setAddDefaultPrincipals, setClassifiedMessages, setMetricName, setRequesterLookupStrategy, setResponderLookupStrategy, setResultCachingPredicate, setSupportedPrincipals

      • Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

        doExecute, doPreExecute, setAuthenticationContextLookupStrategy

      • Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

        doExecute, execute, getMessage, getMessage, getMessage, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

      • Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

        getActivationCondition, setActivationCondition

      • Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

        doPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletResponse, getLogPrefix, setHttpServletRequest, setHttpServletResponse

      • Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

        destroy, doDestroy, doInitialize, initialize, isDestroyed, isInitialized

      • Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

        initialize, isInitialized

    • Field Detail

      • DEFAULT_METRIC_NAME

        @Nonnull
@NotEmpty
private static final String DEFAULT_METRIC_NAME
        Default prefix for metrics.
        See Also:
        Constant Field Values

      • log

        @Nonnull
private final org.slf4j.Logger log
        Class logger.

      • attributeFilterService

        @Nullable
private net.shibboleth.utilities.java.support.service.ReloadableService<net.shibboleth.idp.attribute.filter.AttributeFilter> attributeFilterService
        Service used to get the engine used to filter attributes.

      • metadataResolver

        @Nullable
private org.opensaml.saml.metadata.resolver.MetadataResolver metadataResolver
        Optional supplemental metadata source for filtering.

      • matchExpression

        @Nullable
private Pattern matchExpression
        A regular expression to apply for acceptance testing.

      • extContext

        @Nullable
private net.shibboleth.idp.authn.context.ExternalAuthenticationContext extContext
        Context containing the result to validate.

      • attributeContext

        @Nullable
private net.shibboleth.idp.attribute.context.AttributeContext attributeContext
        Context for externally supplied inbound attributes.

    • Constructor Detail

      • ValidateExternalAuthentication

        public ValidateExternalAuthentication()
        Constructor.

      • ValidateExternalAuthentication

        public ValidateExternalAuthentication​(@Nullable
                                      net.shibboleth.utilities.java.support.service.ReloadableService<net.shibboleth.idp.attribute.filter.AttributeFilter> filterService)
        Constructor.
        Parameters:
        filterService - optional filter service for inbound attributes
        Since:
        4.0.0

    • Method Detail

      • setMatchExpression

        public void setMatchExpression​(@Nullable
                               Pattern expression)
        Set a matching expression to apply for username acceptance.
        Parameters:
        expression - a matching expression

      • setMetadataResolver

        public void setMetadataResolver​(@Nullable
                                org.opensaml.saml.metadata.resolver.MetadataResolver resolver)
        Set a metadata source to use during filtering.
        Parameters:
        resolver - metadata resolver
        Since:
        4.0.0

      • doPreExecute

        protected boolean doPreExecute​(@Nonnull
                               org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                               @Nonnull
                               net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Overrides:
        doPreExecute in class net.shibboleth.idp.authn.AbstractValidationAction

      • doExecute

        protected void doExecute​(@Nonnull
                         org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                         @Nonnull
                         net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Overrides:
        doExecute in class net.shibboleth.idp.authn.AbstractAuthenticationAction

      • populateSubject

        @Nonnull
protected Subject populateSubject​(@Nonnull
                                  Subject subject)
        Specified by:
        populateSubject in class net.shibboleth.idp.authn.AbstractValidationAction

      • checkUsername

        private boolean checkUsername​(@Nonnull
                              Subject subject)
        Validate the username if necessary.
        Parameters:
        subject - subject containing a UsernamePrincipal to check
        Returns:
        true iff the username is acceptable

      • filterAttributes

        private void filterAttributes()
        Check for inbound attributes and apply filtering.

      • populateFilterContext

        private void populateFilterContext​(@Nonnull
                                   net.shibboleth.idp.attribute.filter.context.AttributeFilterContext filterContext)
        Fill in the filter context data.

        This is a very minimally populated context with nothing much set except possibly issuer, based on the AuthenticationAuthorities data.

        Parameters:
        filterContext - context to populate