Package net.shibboleth.idp.session.impl

Class DetectIdentitySwitch

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.authn.AbstractAuthenticationAction

net.shibboleth.idp.session.impl.DetectIdentitySwitch

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class DetectIdentitySwitch
extends AbstractAuthenticationAction

An authentication action that checks for a mismatch between an existing session's identity and the result of a newly canonicalized subject (from a SubjectCanonicalizationContext).

On a mismatch it destroys a pre-existing session and clears AuthenticationContext and SessionContext state such that no trace of its impact on the contexts remains, and signals the event.

An error interacting with the session layer will result in an EventIds.IO_ERROR event.

Event:

EventIds.PROCEED_EVENT_ID, EventIds.INVALID_PROFILE_CTX, EventIds.IO_ERROR, AuthnEventIds.IDENTITY_SWITCH

Postcondition:

If an identity switch is detected, SessionContext.getIdPSession() == null && AuthenticationContext.getActiveResults().isEmpty()

Field Summary

Fields

Modifier and Type	Field	Description
private Function<ProfileRequestContext,SubjectCanonicalizationContext>	c14nContextLookupStrategy	Lookup function for SubjectCanonicalizationContext.
private final org.slf4j.Logger	log	Class logger.
private String	newPrincipalName	A newly established principal name to check.
private Function<ProfileRequestContext,SessionContext>	sessionContextLookupStrategy	Lookup function for SessionContext.
private SessionContext	sessionCtx	SessionContext to operate on.
private SessionManager	sessionManager	SessionManager.

Constructor Summary

Constructors

Constructor	Description
DetectIdentitySwitch()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)	Performs this authentication action.
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)	Performs this authentication action's pre-execute step.
void	setSessionContextLookupStrategy(Function<ProfileRequestContext,SessionContext> strategy)	Set the lookup strategy for the SessionContext to access.
void	setSessionManager(SessionManager manager)	Set the SessionManager to use.
void	setSubjectCanonicalizationContextLookupStrategy(Function<ProfileRequestContext,SubjectCanonicalizationContext> strategy)	Set the lookup strategy for the SubjectCanonicalizationContext to access.

Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

doExecute, doPreExecute, setAuthenticationContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getMessage, getMessage, getMessage, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, execute, getHttpServletRequest, getHttpServletResponse, getLogPrefix, setHttpServletRequest, setHttpServletResponse

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

sessionManager

@NonnullAfterInit
private SessionManager sessionManager

SessionManager.

sessionContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,SessionContext> sessionContextLookupStrategy

Lookup function for SessionContext.

c14nContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,SubjectCanonicalizationContext> c14nContextLookupStrategy

Lookup function for SubjectCanonicalizationContext.

sessionCtx

@Nullable
private SessionContext sessionCtx

SessionContext to operate on.

newPrincipalName

@Nullable
private String newPrincipalName

A newly established principal name to check.

Constructor Details

DetectIdentitySwitch

public DetectIdentitySwitch()

Constructor.

Method Details

setSessionManager

public void setSessionManager(@Nonnull
 SessionManager manager)

Set the SessionManager to use.

Parameters:

manager - session manager to use

setSessionContextLookupStrategy

public void setSessionContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,SessionContext> strategy)

Set the lookup strategy for the SessionContext to access.

Parameters:

strategy - lookup strategy

setSubjectCanonicalizationContextLookupStrategy

public void setSubjectCanonicalizationContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,SubjectCanonicalizationContext> strategy)

Set the lookup strategy for the SubjectCanonicalizationContext to access.

Parameters:

strategy - lookup strategy

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Performs this authentication action's pre-execute step. Default implementation just returns true.

Overrides:

doPreExecute in class AbstractAuthenticationAction

Parameters:

profileRequestContext - the current IdP profile request context

authenticationContext - the current authentication context

Returns:

true iff execution should continue

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Performs this authentication action. Default implementation throws an exception.

Overrides:

doExecute in class AbstractAuthenticationAction

Parameters:

profileRequestContext - the current IdP profile request context

authenticationContext - the current authentication context