net.shibboleth.idp.session.impl

Class DetectIdentitySwitch

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction<InboundMessageType,OutboundMessageType>

org.opensaml.profile.action.AbstractConditionalProfileAction<InboundMessageType,OutboundMessageType>

net.shibboleth.idp.profile.AbstractProfileAction<InboundMessageType,OutboundMessageType>

net.shibboleth.idp.authn.AbstractAuthenticationAction

net.shibboleth.idp.session.impl.DetectIdentitySwitch

All Implemented Interfaces:

net.shibboleth.utilities.java.support.component.Component, net.shibboleth.utilities.java.support.component.DestructableComponent, net.shibboleth.utilities.java.support.component.InitializableComponent, org.opensaml.profile.action.ProfileAction, Aware, MessageSource, MessageSourceAware, org.springframework.webflow.execution.Action

public class DetectIdentitySwitch
extends AbstractAuthenticationAction

An authentication action that checks for a mismatch between an existing session's identity and the result of a newly canonicalized subject (from a SubjectCanonicalizationContext).

On a mismatch it destroys a pre-existing session and clears AuthenticationContext and SessionContext state such that no trace of its impact on the contexts remains, and signals the event.

An error interacting with the session layer will result in an EventIds.IO_ERROR event.

Event:

EventIds.PROCEED_EVENT_ID, EventIds.INVALID_PROFILE_CTX, EventIds.IO_ERROR, AuthnEventIds.IDENTITY_SWITCH

Postcondition:

If an identity switch is detected, SessionContext.getIdPSession() == null && AuthenticationContext.getActiveResults().isEmpty()

Field Summary

Fields

Modifier and Type	Field and Description
private com.google.common.base.Function<org.opensaml.profile.context.ProfileRequestContext,SubjectCanonicalizationContext>	c14nContextLookupStrategy Lookup function for SubjectCanonicalizationContext.
private Logger	log Class logger.
private String	newPrincipalName A newly established principal name to check.
private com.google.common.base.Function<org.opensaml.profile.context.ProfileRequestContext,SessionContext>	sessionContextLookupStrategy Lookup function for SessionContext.
private SessionContext	sessionCtx SessionContext to operate on.
private SessionManager	sessionManager SessionManager.

Constructor Summary

Constructors

Constructor and Description
DetectIdentitySwitch() Constructor.

Method Summary

Modifier and Type	Method and Description
protected void	doExecute(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
protected void	doInitialize()
protected boolean	doPreExecute(org.opensaml.profile.context.ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)
void	setSessionContextLookupStrategy(com.google.common.base.Function<org.opensaml.profile.context.ProfileRequestContext,SessionContext> strategy) Set the lookup strategy for the SessionContext to access.
void	setSessionManager(SessionManager manager) Set the SessionManager to use.
void	setSubjectCanonicalizationContextLookupStrategy(com.google.common.base.Function<org.opensaml.profile.context.ProfileRequestContext,SubjectCanonicalizationContext> strategy) Set the lookup strategy for the SubjectCanonicalizationContext to access.

Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

doExecute, doPreExecute, setLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getMessage, getMessage, getMessage, getProfileContextLookupStrategy, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletResponse, getLogPrefix, setHttpServletRequest, setHttpServletResponse

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

initialize, isInitialized

Field Detail

log

@Nonnull
private final Logger log

Class logger.

sessionManager

@NonnullAfterInit
private SessionManager sessionManager

SessionManager.

sessionContextLookupStrategy

@Nonnull
private com.google.common.base.Function<org.opensaml.profile.context.ProfileRequestContext,SessionContext> sessionContextLookupStrategy

Lookup function for SessionContext.

c14nContextLookupStrategy

@Nonnull
private com.google.common.base.Function<org.opensaml.profile.context.ProfileRequestContext,SubjectCanonicalizationContext> c14nContextLookupStrategy

Lookup function for SubjectCanonicalizationContext.

sessionCtx

@Nullable
private SessionContext sessionCtx

SessionContext to operate on.

newPrincipalName

@Nullable
private String newPrincipalName

A newly established principal name to check.

Constructor Detail

DetectIdentitySwitch

public DetectIdentitySwitch()

Constructor.

Method Detail

setSessionManager

public void setSessionManager(@Nonnull
                              SessionManager manager)

Set the SessionManager to use.

Parameters:

manager - session manager to use

setSessionContextLookupStrategy

public void setSessionContextLookupStrategy(@Nonnull
                                            com.google.common.base.Function<org.opensaml.profile.context.ProfileRequestContext,SessionContext> strategy)

Set the lookup strategy for the SessionContext to access.

Parameters:

strategy - lookup strategy

setSubjectCanonicalizationContextLookupStrategy

public void setSubjectCanonicalizationContextLookupStrategy(@Nonnull
                                                            com.google.common.base.Function<org.opensaml.profile.context.ProfileRequestContext,SubjectCanonicalizationContext> strategy)

Set the lookup strategy for the SubjectCanonicalizationContext to access.

Parameters:

strategy - lookup strategy

doInitialize

protected void doInitialize()
                     throws net.shibboleth.utilities.java.support.component.ComponentInitializationException

Overrides:

doInitialize in class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

Throws:

net.shibboleth.utilities.java.support.component.ComponentInitializationException

doPreExecute

protected boolean doPreExecute(@Nonnull
                               org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                               @Nonnull
                               AuthenticationContext authenticationContext)

Overrides:

doPreExecute in class AbstractAuthenticationAction

doExecute

protected void doExecute(@Nonnull
                         org.opensaml.profile.context.ProfileRequestContext profileRequestContext,
                         @Nonnull
                         AuthenticationContext authenticationContext)

Overrides:

doExecute in class AbstractAuthenticationAction