net.shibboleth.idp.saml.session.impl

Class SAML2SPSessionCreationStrategy

java.lang.Object

net.shibboleth.idp.saml.session.impl.SAML2SPSessionCreationStrategy

All Implemented Interfaces:

Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.idp.session.SPSession>

public class SAML2SPSessionCreationStrategy
extends Object
implements Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.idp.session.SPSession>

A function to create a SAML2SPSession based on profile execution state.

This strategy is a default approach that uses a RelyingPartyContext via lookup strategy to obtain a requester value, used as the SPSession's relying party ID. The authentication flow ID comes from the AuthenticationResult in the AuthenticationContext. The session has a creation time based on the time of execution, and the expiration is based on a configurable lifetime, bounded by the per-SP lifetime setting for the profile.

The SAML 2 specific data is extracted from the first assertion containing an authn statement found in a Response message located via a lookup strategy, by default the outbound message context. Failure to locate any of this data will cause a null return value.

Field Summary

Fields

Modifier and Type	Field and Description
private org.slf4j.Logger	log Class logger.
private Function<org.opensaml.profile.context.ProfileRequestContext,RelyingPartyContext>	relyingPartyContextLookupStrategy RelyingPartyContext lookup strategy.
private Function<org.opensaml.profile.context.ProfileRequestContext,org.opensaml.saml.saml2.core.Response>	responseLookupStrategy Response lookup strategy.
private long	sessionLifetime Lifetime of sessions to create.

Constructor Summary

Constructors

Constructor and Description
SAML2SPSessionCreationStrategy(long lifetime) Constructor.

Method Summary

Methods

Modifier and Type	Method and Description
net.shibboleth.idp.session.SPSession	apply(org.opensaml.profile.context.ProfileRequestContext input)
private Pair<org.opensaml.saml.saml2.core.Assertion,org.opensaml.saml.saml2.core.AuthnStatement>	getAssertionAndStatement(org.opensaml.profile.context.ProfileRequestContext profileRequestContext) Locate the first assertion and authentication statement, such that the assertion subject contains a name identifier and the statement contains a session index.
void	setRelyingPartyContextLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,RelyingPartyContext> strategy) Set the strategy used to locate the RelyingPartyContext to operate on.
void	setResponseLookupStrategy(Function<org.opensaml.profile.context.ProfileRequestContext,org.opensaml.saml.saml2.core.Response> strategy) Set the strategy used to locate the Response to operate on.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface com.google.common.base.Function

equals

Field Detail

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

sessionLifetime

@Positive
@Duration
private final long sessionLifetime

Lifetime of sessions to create.

relyingPartyContextLookupStrategy

@Nonnull
private Function<org.opensaml.profile.context.ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy

RelyingPartyContext lookup strategy.

responseLookupStrategy

@Nonnull
private Function<org.opensaml.profile.context.ProfileRequestContext,org.opensaml.saml.saml2.core.Response> responseLookupStrategy

Response lookup strategy.

Constructor Detail

SAML2SPSessionCreationStrategy

public SAML2SPSessionCreationStrategy(@Positive@Duration
                              long lifetime)

Constructor.

Parameters:

lifetime - lifetime in milliseconds, determines upper bound for expiration of SAML2SPSession to be created

Method Detail

setRelyingPartyContextLookupStrategy

public void setRelyingPartyContextLookupStrategy(@Nonnull
                                        Function<org.opensaml.profile.context.ProfileRequestContext,RelyingPartyContext> strategy)

Set the strategy used to locate the RelyingPartyContext to operate on.

Parameters:

strategy - lookup strategy

setResponseLookupStrategy

public void setResponseLookupStrategy(@Nonnull
                             Function<org.opensaml.profile.context.ProfileRequestContext,org.opensaml.saml.saml2.core.Response> strategy)

Set the strategy used to locate the Response to operate on.

Parameters:

strategy - strategy used to locate the Response to operate on

apply

@Nullable
public net.shibboleth.idp.session.SPSession apply(@Nullable
                                                  org.opensaml.profile.context.ProfileRequestContext input)

Specified by:

apply in interface Function<org.opensaml.profile.context.ProfileRequestContext,net.shibboleth.idp.session.SPSession>

getAssertionAndStatement

@Nullable
private Pair<org.opensaml.saml.saml2.core.Assertion,org.opensaml.saml.saml2.core.AuthnStatement> getAssertionAndStatement(@Nonnull
                                                                                                                         org.opensaml.profile.context.ProfileRequestContext profileRequestContext)

Locate the first assertion and authentication statement, such that the assertion subject contains a name identifier and the statement contains a session index.

Parameters:

profileRequestContext - current profile request context

Returns:

the suitable objects, or null