@Prototype public class PopulateDelegationContext extends AbstractProfileAction
Assertion token
is active, and populates a DelegationContext appropriately.
The output of 3 different evaluations is combined to produce the final result:
DelegationRequest. Delegation may be requested via:
Audience in the AudienceRestriction condition
of the inbound AuthnRequest.RequestedAttribute with name LibertyConstants.SERVICE_TYPE_SSOS in
the relying party's metadata via AttributeConsumingService.
BrowserSSOProfileConfiguration.isAllowingDelegation()
or the predicate BrowserSSOProfileConfiguration.getAllowDelegation().
Credential instances are resolved for the relying party from
its resolved metadata RoleDescriptor.
If 1) delegation is allowed, 2) subject confirmation credentials were resolved, and 3) request status was either
DelegationRequest.REQUESTED_OPTIONAL or DelegationRequest.REQUESTED_REQUIRED,
a DelegationContext is populated indicating issuance of delegated token to be active, and containing the
resolved subject confirmation credentials.
If request status was DelegationRequest.REQUESTED_REQUIRED but delegation was not allowed and/or no
subject confirmation credentials could be resolved, a fatal event is produced.
Otherwise, issuance of a delegated token is not active and so no DelegationContext is populated.
EventIds.INVALID_MSG_CTX, EventIds.INVALID_PROFILE_CTX, EventIds.MESSAGE_PROC_ERROR, EventIds.INVALID_SEC_CFG| Modifier and Type | Field and Description |
|---|---|
private org.opensaml.saml.saml2.metadata.AttributeConsumingService |
attributeConsumingService
The AttributeConsumingService for the SAML peer entity.
|
private List<org.opensaml.security.credential.Credential> |
confirmationCredentials
The subject confirmation credentials.
|
private org.opensaml.security.credential.CredentialResolver |
credentialResolver
The credential resolver used to resolve HoK Credentials for the peer.
|
private DelegationRequest |
defaultDelegationRequested
Default delegation request value.
|
private boolean |
delegationAllowed
Whether delegation is allowed for the current relying party.
|
private Function<org.opensaml.profile.context.ProfileRequestContext,DelegationContext> |
delegationContextLookupStrategy
Strategy used to lookup the {@link DelegationContext.
|
private DelegationRequest |
delegationRequested
The delegation requested state for the current request.
|
private org.slf4j.Logger |
log
Class logger.
|
private RelyingPartyContext |
relyingPartyContext
The current RelyingPartyContext.
|
private Function<org.opensaml.profile.context.ProfileRequestContext,RelyingPartyContext> |
relyingPartyContextLookupStrategy
Strategy used to lookup the RelyingPartyContext.
|
private String |
relyingPartyId
The entityID of the SAML relying party.
|
private String |
responderId
The entityID of the local responder entity.
|
private org.opensaml.saml.saml2.metadata.RoleDescriptor |
roleDescriptor
The RoleDescriptor for the SAML peer entity.
|
private Function<org.opensaml.profile.context.ProfileRequestContext,org.opensaml.saml.common.messaging.context.SAMLMetadataContext> |
samlMetadataContextLookupStrategy
Strategy used to lookup the SAMLMetadataContext.
|
| Constructor and Description |
|---|
PopulateDelegationContext()
Constructor.
|
| Modifier and Type | Method and Description |
|---|---|
private void |
createAndPopulateDelegationContext(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
Create and populate the
DelegationContext using the available information. |
protected void |
doExecute(org.opensaml.profile.context.ProfileRequestContext profileRequestContext) |
protected void |
doInitialize() |
protected boolean |
doPreExecute(org.opensaml.profile.context.ProfileRequestContext profileRequestContext) |
protected boolean |
doPreExecuteInbound(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
Pre-execute actions on the inbound message.
|
protected boolean |
doPreExecuteMetadata(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
Pre-execute actions on the relying party metadata.
|
protected boolean |
doPreExecuteRelyingParty(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
Pre-execute actions on the relying party context info.
|
DelegationRequest |
getDefaultDelegationRequested()
Get the effective default value for whether request processing should proceed
with issuance of a delegation token.
|
private DelegationRequest |
getDelegationRequested(org.opensaml.profile.context.ProfileRequestContext requestContext)
Check whether issuance of a delegated token has been requested.
|
private DelegationRequest |
getDelegationRequestedByMetadata(org.opensaml.profile.context.ProfileRequestContext requestContext)
Determine whether a delegation token was requested via the SP's SPSSODescriptor AttributeConsumingService.
|
private boolean |
isDelegationRequestedByAudience(org.opensaml.profile.context.ProfileRequestContext requestContext)
Determine whether a delegation token was requested via the inbound AuthnRequest's
Conditions' AudienceRestriction.
|
private List<org.opensaml.security.credential.Credential> |
resolveConfirmationCredentials(org.opensaml.profile.context.ProfileRequestContext requestContext)
Resolve the subject confirmation credentials.
|
void |
setCredentialResolver(org.opensaml.security.credential.CredentialResolver resolver)
Set the
CredentialResolver instance to use to resolve HoK Credential. |
void |
setDefaultDelegationRequested(DelegationRequest delegationRequest)
Set the effective default value for whether request processing should proceed
with issuance of a delegation token.
|
void |
setDelegationContextLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,DelegationContext> strategy)
Set the strategy used to locate the current
DelegationContext. |
void |
setRelyingPartyContextLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,RelyingPartyContext> strategy)
Set the strategy used to locate the current
RelyingPartyContext. |
void |
setSAMLMetadataContextLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,org.opensaml.saml.common.messaging.context.SAMLMetadataContext> strategy)
Set the strategy used to locate the current
SAMLMetadataContext. |
doExecute, execute, getMessage, getMessage, getMessage, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategygetActivationCondition, setActivationConditiondoPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletResponse, getLogPrefix, setHttpServletRequest, setHttpServletResponsedestroy, doDestroy, initialize, isDestroyed, isInitializedclone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, waitinitialize, isInitializedprivate final org.slf4j.Logger log
@Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy
@Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,org.opensaml.saml.common.messaging.context.SAMLMetadataContext> samlMetadataContextLookupStrategy
@Nonnull private Function<org.opensaml.profile.context.ProfileRequestContext,DelegationContext> delegationContextLookupStrategy
private DelegationRequest defaultDelegationRequested
@Nonnull private org.opensaml.security.credential.CredentialResolver credentialResolver
private DelegationRequest delegationRequested
private RelyingPartyContext relyingPartyContext
private boolean delegationAllowed
private String responderId
private String relyingPartyId
private org.opensaml.saml.saml2.metadata.RoleDescriptor roleDescriptor
private org.opensaml.saml.saml2.metadata.AttributeConsumingService attributeConsumingService
private List<org.opensaml.security.credential.Credential> confirmationCredentials
public void setRelyingPartyContextLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,RelyingPartyContext> strategy)
RelyingPartyContext.strategy - strategy used to locate the current RelyingPartyContextpublic void setSAMLMetadataContextLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,org.opensaml.saml.common.messaging.context.SAMLMetadataContext> strategy)
SAMLMetadataContext.strategy - strategy used to locate the current SAMLMetadataContextpublic void setDelegationContextLookupStrategy(@Nonnull Function<org.opensaml.profile.context.ProfileRequestContext,DelegationContext> strategy)
DelegationContext.strategy - strategy used to locate the current DelegationContextpublic void setCredentialResolver(@Nonnull org.opensaml.security.credential.CredentialResolver resolver)
CredentialResolver instance to use to resolve HoK Credential.
Typically this should be a metadata-based resolver which accepts input as the
peer's RoleDescriptor.
resolver - the resolver instance to use@Nonnull public DelegationRequest getDefaultDelegationRequested()
public void setDefaultDelegationRequested(@Nonnull DelegationRequest delegationRequest)
delegationRequest - the default delegation requested valueprotected void doInitialize()
throws ComponentInitializationException
doInitialize in class AbstractInitializableComponentComponentInitializationExceptionprotected boolean doPreExecute(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
doPreExecute in class org.opensaml.profile.action.AbstractConditionalProfileActionprotected boolean doPreExecuteInbound(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
profileRequestContext - the current profile request contextdoExecute(ProfileRequestContext) should proceedprotected boolean doPreExecuteRelyingParty(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
profileRequestContext - the current profile request contextdoExecute(ProfileRequestContext) should proceedprotected boolean doPreExecuteMetadata(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
profileRequestContext - the current profile request contextdoExecute(ProfileRequestContext) should proceed, false otherwiseprotected void doExecute(@Nonnull org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
doExecute in class org.opensaml.profile.action.AbstractProfileActionprivate void createAndPopulateDelegationContext(org.opensaml.profile.context.ProfileRequestContext profileRequestContext)
DelegationContext using the available information.profileRequestContext - the current request contextprivate List<org.opensaml.security.credential.Credential> resolveConfirmationCredentials(@Nonnull org.opensaml.profile.context.ProfileRequestContext requestContext)
requestContext - the current request contextprivate DelegationRequest getDelegationRequested(@Nonnull org.opensaml.profile.context.ProfileRequestContext requestContext)
requestContext - the current request context@Nonnull private DelegationRequest getDelegationRequestedByMetadata(@Nonnull org.opensaml.profile.context.ProfileRequestContext requestContext)
requestContext - the current request contextprivate boolean isDelegationRequestedByAudience(@Nonnull org.opensaml.profile.context.ProfileRequestContext requestContext)
requestContext - the current request contextCopyright © 1999–2017 Shibboleth Consortium. All rights reserved.