getPrincipals() typing

[Cantor, Scott]

On 8/31/16, 6:16 PM, "dev on behalf of Klingenstein, Nate" <dev-bounces at shibboleth.net on behalf of nklingenstein at calstate.edu> wrote:

> I'm still trying to understand how Webflow and Java Principals/Subjects work

The Java security model has been around a really long time, and we just re-used it. I'm sure there are probably books around on it. It's not terrible complex, a Subject is just a collection of Principals and then two generic Object collections, the public and private "credentials", which is where things like passwords or certificates can get stored.

A Principal is anything that represents the identity of the subject or the subject's privileges. Beyond that it's literally anything. All of the semantics are entirely up to the types of objects you put in the collections.

That's it.

There are few standard Principal types of any significance, so we just created a handful to carry what the IdP generally cares about, usernames, SAML authentication types, and simple objects that can identify what kinds of authentication have been performed.

I don't know what else you're after. The APIs are not ours, they're part of Java and should be documented reasonably well.


> I would rather not hardcode principal types into this.

You can't do anything with Java Security without knowing the types you care about. There are no semantics at the level of Principal or Subject.

> I get null if I don't specify a principal type.
> result.getSubject().getPrincipals().iterator().next().getName();

I don't think that's possible unless we have a Principal class that's returning null there, and I'm not sure we do. That doesn't mean that's a sensible thing to do; that expression is meaningless since it doesn't refer to a specific type of Principal. You could get literally anything back there, and you can't mean to do that unless you're just logging it or something.

-- Scott