Package net.shibboleth.idp.authn.impl

Class X500SubjectCanonicalization

  • All Implemented Interfaces:
    net.shibboleth.utilities.java.support.component.Component, net.shibboleth.utilities.java.support.component.DestructableComponent, net.shibboleth.utilities.java.support.component.InitializableComponent, org.opensaml.profile.action.ProfileAction, Aware, MessageSource, MessageSourceAware, Action
    public class X500SubjectCanonicalization
extends net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction
    An action that operates on a SubjectCanonicalizationContext child of the current ProfileRequestContext, and transforms the input Subject into a principal name by searching for one and only one X509Certificate public credential, or in its absence one and only one X500Principal.

    A list of OIDs is used to locate an RDN to extract from the Subject DN and use as the principal name after applying the transforms from the base class.

    Alternatively, a list of subjectAltName extension types may be specified, which takes precedence over the subject, if a match is found.

    Event:
    EventIds.PROCEED_EVENT_ID, AuthnEventIds.INVALID_SUBJECT
    Precondition:
    ProfileRequestContext.getSubcontext(SubjectCanonicalizationContext.class) != null
    Postcondition:
    SubjectCanonicalizationContext.getPrincipalName() != null
  || SubjectCanonicalizationContext.getException() != null

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      protected void doExecute​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.SubjectCanonicalizationContext c14nContext)
      protected boolean doPreExecute​(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, net.shibboleth.idp.authn.context.SubjectCanonicalizationContext c14nContext)
      protected String findRDN​(org.cryptacular.x509.dn.RDNSequence sequence, String oid)
      Find an RDN with the specified OID.
      void setObjectIds​(List<String> ids)
      Set the OIDs to search for, in order of preference.
      void setSubjectAltNameTypes​(List<Integer> types)
      Set the subjectAltName types to search for, in order of preference.

      • Methods inherited from class net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction

        applyTransforms, doExecute, doPreExecute, setLookupStrategy, setLowercase, setTransforms, setTrim, setUppercase

      • Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

        doExecute, execute, getMessage, getMessage, getMessage, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

      • Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

        getActivationCondition, setActivationCondition

      • Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

        doPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletResponse, getLogPrefix, setHttpServletRequest, setHttpServletResponse

      • Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

        destroy, doDestroy, doInitialize, initialize, isDestroyed, isInitialized

      • Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

        initialize, isInitialized

    • Field Detail

      • log

        @Nonnull
private final org.slf4j.Logger log
        Class logger.

      • subjectAltNameTypes

        @Nonnull
@NonnullElements
private List<Integer> subjectAltNameTypes
        subjectAltName types to search for.

      • objectIds

        @Nonnull
@NonnullElements
private List<String> objectIds
        OIDs to search for.

      • certificate

        @Nullable
private X509Certificate certificate
        The certificate to operate on.

      • x500Principal

        @Nullable
private X500Principal x500Principal
        The subject DN to operate on.

    • Constructor Detail

      • X500SubjectCanonicalization

        public X500SubjectCanonicalization()
        Constructor.

    • Method Detail

      • setSubjectAltNameTypes

        public void setSubjectAltNameTypes​(@Nonnull @NonnullElements
                                   List<Integer> types)
        Set the subjectAltName types to search for, in order of preference.
        Parameters:
        types - types to search for

      • setObjectIds

        public void setObjectIds​(@Nonnull @NonnullElements
                         List<String> ids)
        Set the OIDs to search for, in order of preference.
        Parameters:
        ids - RDN OIDs to search for

      • doPreExecute

        protected boolean doPreExecute​(@Nonnull
                               org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                               @Nonnull
                               net.shibboleth.idp.authn.context.SubjectCanonicalizationContext c14nContext)
        Overrides:
        doPreExecute in class net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction

      • doExecute

        protected void doExecute​(@Nonnull
                         org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                         @Nonnull
                         net.shibboleth.idp.authn.context.SubjectCanonicalizationContext c14nContext)
        Overrides:
        doExecute in class net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction

      • findRDN

        @Nullable
protected String findRDN​(@Nonnull
                         org.cryptacular.x509.dn.RDNSequence sequence,
                         @Nonnull @NotEmpty
                         String oid)
        Find an RDN with the specified OID.
        Parameters:
        sequence - the DN components
        oid - the OID to look for
        Returns:
        the first matching RDN value, or null