Package net.shibboleth.idp.authn.impl

Class ValidateUserAgentAddress

  • All Implemented Interfaces:
    net.shibboleth.idp.authn.principal.PrincipalSupportingComponent, net.shibboleth.utilities.java.support.component.Component, net.shibboleth.utilities.java.support.component.DestructableComponent, net.shibboleth.utilities.java.support.component.InitializableComponent, org.opensaml.profile.action.ProfileAction, Aware, MessageSource, MessageSourceAware, Action
    public class ValidateUserAgentAddress
extends net.shibboleth.idp.authn.AbstractValidationAction
    An action that ensures that a user-agent address found within a UserAgentContext is within a given range and generates an AuthenticationResult.
    Event:
    EventIds.PROCEED_EVENT_ID, AuthnEventIds.NO_CREDENTIALS, AuthnEventIds.INVALID_CREDENTIALS
    Precondition:
    ProfileRequestContext.getSubcontext(AuthenticationContext.class, false).getAttemptedFlow() != null
    Postcondition:
    If AuthenticationContext.getSubcontext(UserAgentContext.class, false) != null, and the content of getAddress() satisfies a configured address range, an AuthenticationResult is saved to the AuthenticationContext.

    • Field Summary

      Fields 
      Modifier and Type Field Description
      private static String DEFAULT_METRIC_NAME
      Default prefix for metrics.
      private org.slf4j.Logger log
      Class logger.
      private Map<String,​Collection<net.shibboleth.utilities.java.support.net.IPRange>> mappings
      Map of IP ranges to principal names.
      private String principalName
      The principal name established by the action, if any.
      private net.shibboleth.idp.authn.context.UserAgentContext uaContext
      User Agent context containing address to evaluate.

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      protected void doExecute​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      protected boolean doPreExecute​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
      private boolean isAuthenticated​(InetAddress address, Collection<net.shibboleth.utilities.java.support.net.IPRange> ranges)
      Checks whether the given IP address meets a set of IP range requirements.
      protected Subject populateSubject​(Subject subject)
      void setMappings​(Map<String,​Collection<net.shibboleth.utilities.java.support.net.IPRange>> newMappings)
      Set the IP range(s) to authenticate as particular principals.

      • Methods inherited from class net.shibboleth.idp.authn.AbstractValidationAction

        addDefaultPrincipals, buildAuthenticationResult, getClassifiedErrors, getMetricName, getRequesterLookupStrategy, getResponderLookupStrategy, getResultCachingPredicate, getSubject, getSupportedPrincipals, handleError, handleError, handleWarning, recordFailure, recordSuccess, setAddDefaultPrincipals, setClassifiedMessages, setMetricName, setRequesterLookupStrategy, setResponderLookupStrategy, setResultCachingPredicate, setSupportedPrincipals

      • Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

        doExecute, doPreExecute, setAuthenticationContextLookupStrategy

      • Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

        doExecute, execute, getMessage, getMessage, getMessage, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

      • Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

        getActivationCondition, setActivationCondition

      • Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

        doPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletResponse, getLogPrefix, setHttpServletRequest, setHttpServletResponse

      • Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

        destroy, doDestroy, doInitialize, initialize, isDestroyed, isInitialized

      • Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

        initialize, isInitialized

    • Field Detail

      • DEFAULT_METRIC_NAME

        @Nonnull
@NotEmpty
private static final String DEFAULT_METRIC_NAME
        Default prefix for metrics.
        See Also:
        Constant Field Values

      • log

        @Nonnull
private final org.slf4j.Logger log
        Class logger.

      • mappings

        @Nonnull
@NonnullElements
private Map<String,​Collection<net.shibboleth.utilities.java.support.net.IPRange>> mappings
        Map of IP ranges to principal names.

      • uaContext

        @Nullable
private net.shibboleth.idp.authn.context.UserAgentContext uaContext
        User Agent context containing address to evaluate.

      • principalName

        @Nullable
private String principalName
        The principal name established by the action, if any.

    • Constructor Detail

      • ValidateUserAgentAddress

        public ValidateUserAgentAddress()
        Constructor.

    • Method Detail

      • setMappings

        public void setMappings​(@Nonnull @NonnullElements
                        Map<String,​Collection<net.shibboleth.utilities.java.support.net.IPRange>> newMappings)
        Set the IP range(s) to authenticate as particular principals.
        Parameters:
        newMappings - the IP range(s) to authenticate as particular principals

      • doPreExecute

        protected boolean doPreExecute​(@Nonnull
                               org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                               @Nonnull
                               net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Overrides:
        doPreExecute in class net.shibboleth.idp.authn.AbstractValidationAction

      • doExecute

        protected void doExecute​(@Nonnull
                         org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                         @Nonnull
                         net.shibboleth.idp.authn.context.AuthenticationContext authenticationContext)
        Overrides:
        doExecute in class net.shibboleth.idp.authn.AbstractAuthenticationAction

      • isAuthenticated

        private boolean isAuthenticated​(@Nonnull
                                InetAddress address,
                                @Nonnull @NonnullElements
                                Collection<net.shibboleth.utilities.java.support.net.IPRange> ranges)
        Checks whether the given IP address meets a set of IP range requirements.
        Parameters:
        address - the IP address to check
        ranges - the ranges to check
        Returns:
        true if the given IP address meets this stage's IP range requirements, false otherwise

      • populateSubject

        @Nonnull
protected Subject populateSubject​(@Nonnull
                                  Subject subject)
        Specified by:
        populateSubject in class net.shibboleth.idp.authn.AbstractValidationAction