Class ValidateSAMLAuthentication
- java.lang.Object
-
- net.shibboleth.utilities.java.support.component.AbstractInitializableComponent
-
- org.opensaml.profile.action.AbstractProfileAction
-
- org.opensaml.profile.action.AbstractConditionalProfileAction
-
- net.shibboleth.idp.profile.AbstractProfileAction
-
- net.shibboleth.idp.authn.AbstractAuthenticationAction
-
- net.shibboleth.idp.authn.AbstractValidationAction
-
- net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication
-
- All Implemented Interfaces:
PrincipalSupportingComponent,Component,DestructableComponent,InitializableComponent,ProfileAction,Aware,MessageSource,MessageSourceAware,Action
public class ValidateSAMLAuthentication extends AbstractValidationAction
An action that produces anAuthenticationResultbased on an inbound SAML 2.0 SSO response.A
SAMLAuthnContextis used as the basis of the result and the lack of a context is a signal to record a failure. Actual validation is all upstream of this action, but the use of the ValidationAction subclass is a convenience for auditing and handling the result.- Event:
EventIds.PROCEED_EVENT_ID,EventIds.INVALID_PROFILE_CTX,IdPEventIds.INVALID_RELYING_PARTY_CTX,IdPEventIds.INVALID_PROFILE_CONFIG- Precondition:
ProfileRequestContext.getSubcontext(AuthenticationContext.class).getAttemptedFlow() != null
- Postcondition:
- If AuthenticationContext.getSubcontext(SAMLAuthnContext.class) != null, then
an
AuthenticationResultis saved to theAuthenticationContext.
-
-
Field Summary
Fields Modifier and Type Field Description private AttributeContextattributeContextContext for externally supplied inbound attributes.private Function<ProfileRequestContext,Collection<IdPAttribute>>attributeExtractionStrategyPluggable strategy function for generalized extraction of data.private ReloadableService<AttributeFilter>attributeFilterServiceService used to get the engine used to filter attributes.private Function<AuthnContext,Collection<Principal>>authnContextTranslatorIncoming context translation function.private Function<ProfileRequestContext,Collection<Principal>>authnContextTranslatorExIncoming context extended translation function.private static StringDEFAULT_METRIC_NAMEDefault prefix for metrics.private org.slf4j.LoggerlogClass logger.private StringloggedAttributeIdAn IdPAttribute ID to log as a "name" in place of the NameID for "info" purposes.private MetadataResolvermetadataResolverOptional supplemental metadata source for filtering.private BrowserSSOProfileConfigurationprofileConfigurationStore off profile config.private Function<ProfileRequestContext,RelyingPartyContext>relyingPartyContextLookupStrategyStrategy used to look up aRelyingPartyContextfor configuration options.private SAMLAuthnContextsamlAuthnContextContext containing the result to validate.private ReloadableService<AttributeTranscoderRegistry>transcoderRegistryTranscoder registry service object.
-
Constructor Summary
Constructors Constructor Description ValidateSAMLAuthentication()Constructor.
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description private ProxyAuthenticationPrincipalbuildProxyPrincipal(AuthnContext authnContext)Construct a populatedProxyAuthenticationPrincipalbased on the inbound assertion.private voiddecodeAttribute(AttributeTranscoderRegistry registry, ProfileRequestContext profileRequestContext, Attribute input, Multimap<String,IdPAttribute> results)Access the registry of transcoding rules to decode the inputAttribute.protected voiddoExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)protected booleandoPreExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)private voidfilterAttributes(ProfileRequestContext profileRequestContext)Check for inbound attributes and apply filtering.protected voidlogSuccess()Log a successful authentication based on a designated attribute ID or the NameID value.private voidpopulateFilterContext(ProfileRequestContext profileRequestContext, AttributeFilterContext filterContext)Fill in the filter context data.protected SubjectpopulateSubject(Subject subject)private voidprocessAttributes(ProfileRequestContext profileRequestContext)Process the inbound SAML Attributes.voidsetAttributeExtractionStrategy(Function<ProfileRequestContext,Collection<IdPAttribute>> strategy)Sets the strategy function to invoke for generalized extraction of data intoIdPAttributeobjects for inclusion in theAuthenticationResult.voidsetAttributeFilter(ReloadableService<AttributeFilter> filterService)Sets the filter service to use for inbound attributes.voidsetLoggedAttributeId(String id)An attribute ID to pull a "name" from for logging purposes.voidsetMetadataResolver(MetadataResolver resolver)Set a metadata source to use during filtering.voidsetRelyingPartyContextLookupStrategy(Function<ProfileRequestContext,RelyingPartyContext> strategy)Set the strategy used to return theRelyingPartyContextfor configuration options.voidsetTranscoderRegistry(ReloadableService<AttributeTranscoderRegistry> registry)Sets the registry of transcoding rules to apply to encode attributes.-
Methods inherited from class net.shibboleth.idp.authn.AbstractValidationAction
addDefaultPrincipals, buildAuthenticationResult, getClassifiedErrors, getCleanupHook, getMetricName, getRequesterLookupStrategy, getResponderLookupStrategy, getResultCachingPredicate, getSubject, getSupportedPrincipals, handleError, handleError, handleWarning, recordFailure, recordFailure, recordSuccess, recordSuccess, setAddDefaultPrincipals, setClassifiedMessages, setCleanupHook, setMetricName, setRequesterLookupStrategy, setResponderLookupStrategy, setResultCachingPredicate, setSupportedPrincipals
-
Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction
doExecute, doPreExecute, setAuthenticationContextLookupStrategy
-
Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction
doExecute, execute, getMessage, getMessage, getMessage, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy
-
Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction
getActivationCondition, setActivationCondition
-
Methods inherited from class org.opensaml.profile.action.AbstractProfileAction
doPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletResponse, getLogPrefix, setHttpServletRequest, setHttpServletResponse
-
Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent
destroy, doDestroy, doInitialize, initialize, isDestroyed, isInitialized
-
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
-
Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent
initialize, isInitialized
-
-
-
-
Field Detail
-
DEFAULT_METRIC_NAME
@Nonnull @NotEmpty private static final String DEFAULT_METRIC_NAME
Default prefix for metrics.- See Also:
- Constant Field Values
-
log
@Nonnull private final org.slf4j.Logger log
Class logger.
-
transcoderRegistry
@Nullable private ReloadableService<AttributeTranscoderRegistry> transcoderRegistry
Transcoder registry service object.
-
attributeFilterService
@Nullable private ReloadableService<AttributeFilter> attributeFilterService
Service used to get the engine used to filter attributes.
-
metadataResolver
@Nullable private MetadataResolver metadataResolver
Optional supplemental metadata source for filtering.
-
relyingPartyContextLookupStrategy
@Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy
Strategy used to look up aRelyingPartyContextfor configuration options.
-
attributeExtractionStrategy
@Nullable private Function<ProfileRequestContext,Collection<IdPAttribute>> attributeExtractionStrategy
Pluggable strategy function for generalized extraction of data.
-
loggedAttributeId
@Nullable @NotEmpty private String loggedAttributeId
An IdPAttribute ID to log as a "name" in place of the NameID for "info" purposes.
-
samlAuthnContext
@Nullable private SAMLAuthnContext samlAuthnContext
Context containing the result to validate.
-
profileConfiguration
@Nullable private BrowserSSOProfileConfiguration profileConfiguration
Store off profile config.
-
authnContextTranslator
@Nullable private Function<AuthnContext,Collection<Principal>> authnContextTranslator
Incoming context translation function.
-
authnContextTranslatorEx
@Nullable private Function<ProfileRequestContext,Collection<Principal>> authnContextTranslatorEx
Incoming context extended translation function.
-
attributeContext
@Nullable private AttributeContext attributeContext
Context for externally supplied inbound attributes.
-
-
Method Detail
-
setTranscoderRegistry
public void setTranscoderRegistry(@Nullable ReloadableService<AttributeTranscoderRegistry> registry)Sets the registry of transcoding rules to apply to encode attributes.- Parameters:
registry- registry service interface
-
setAttributeFilter
public void setAttributeFilter(@Nullable ReloadableService<AttributeFilter> filterService)Sets the filter service to use for inbound attributes.- Parameters:
filterService- optional filter service for inbound attributes
-
setMetadataResolver
public void setMetadataResolver(@Nullable MetadataResolver resolver)Set a metadata source to use during filtering.- Parameters:
resolver- metadata resolver
-
setRelyingPartyContextLookupStrategy
public void setRelyingPartyContextLookupStrategy(@Nonnull Function<ProfileRequestContext,RelyingPartyContext> strategy)Set the strategy used to return theRelyingPartyContextfor configuration options.- Parameters:
strategy- lookup strategy
-
setAttributeExtractionStrategy
public void setAttributeExtractionStrategy(@Nullable Function<ProfileRequestContext,Collection<IdPAttribute>> strategy)Sets the strategy function to invoke for generalized extraction of data intoIdPAttributeobjects for inclusion in theAuthenticationResult.- Parameters:
strategy- extraction strategy
-
setLoggedAttributeId
public void setLoggedAttributeId(@Nullable @NotEmpty String id)
An attribute ID to pull a "name" from for logging purposes.- Parameters:
id- attribute ID- Since:
- 4.2.0
-
doPreExecute
protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull AuthenticationContext authenticationContext)- Overrides:
doPreExecutein classAbstractValidationAction
-
doExecute
protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull AuthenticationContext authenticationContext)- Overrides:
doExecutein classAbstractAuthenticationAction
-
logSuccess
protected void logSuccess()
Log a successful authentication based on a designated attribute ID or the NameID value.
-
populateSubject
@Nonnull protected Subject populateSubject(@Nonnull Subject subject)
- Specified by:
populateSubjectin classAbstractValidationAction
-
buildProxyPrincipal
@Nonnull private ProxyAuthenticationPrincipal buildProxyPrincipal(@Nonnull AuthnContext authnContext)
Construct a populatedProxyAuthenticationPrincipalbased on the inbound assertion.- Parameters:
authnContext- the SAMLAuthnContextissued by the proxied IdP- Returns:
- a constructed
ProxyAuthenticationPrincipalto include in theSubject
-
processAttributes
private void processAttributes(@Nonnull ProfileRequestContext profileRequestContext)Process the inbound SAML Attributes.- Parameters:
profileRequestContext- current profile request context
-
decodeAttribute
private void decodeAttribute(@Nonnull AttributeTranscoderRegistry registry, @Nonnull ProfileRequestContext profileRequestContext, @Nonnull Attribute input, @Nonnull @NonnullElements @Live Multimap<String,IdPAttribute> results) throws AttributeDecodingExceptionAccess the registry of transcoding rules to decode the inputAttribute.- Parameters:
registry- registry of transcoding rulesprofileRequestContext- current profile request contextinput- input objectresults- collection to add results to- Throws:
AttributeDecodingException- if an error occurs or no results were obtained
-
filterAttributes
private void filterAttributes(@Nonnull ProfileRequestContext profileRequestContext)Check for inbound attributes and apply filtering.- Parameters:
profileRequestContext- current profile request context
-
populateFilterContext
private void populateFilterContext(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull AttributeFilterContext filterContext)Fill in the filter context data.- Parameters:
profileRequestContext- current profile request contextfilterContext- context to populate
-
-