Package net.shibboleth.idp.authn.revocation.impl

Class AttributeRevocationCondition

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

net.shibboleth.idp.authn.revocation.impl.AttributeRevocationCondition

All Implemented Interfaces:

BiPredicate<ProfileRequestContext,AuthenticationResult>, Component, DestructableComponent, InitializableComponent

public class AttributeRevocationCondition
extends AbstractInitializableComponent
implements BiPredicate<ProfileRequestContext,AuthenticationResult>

A condition for login flows that checks for revocation against a resolved IdPAttribute.

Since:

4.3.0

Field Summary

Fields

Modifier and Type	Field	Description
private String	attributeId	Attribute ID to resolve.
private ReloadableService<AttributeResolver>	attributeResolver	Attribute Resolver service.
private Function<ProfileRequestContext,String>	issuerLookupStrategy	Strategy used to locate the identity of the issuer associated with the attribute resolution.
private final org.slf4j.Logger	log	Class logger.
private Function<ProfileRequestContext,String>	principalNameLookupStrategy	Lookup strategy for principal name.
private Function<ProfileRequestContext,String>	recipientLookupStrategy	Strategy used to locate the identity of the recipient associated with the attribute resolution.

Constructor Summary

Constructors

Constructor	Description
AttributeRevocationCondition()	Constructor.

Method Summary

Modifier and Type	Method	Description
private AttributeResolutionContext	buildResolutionContext(ProfileRequestContext profileRequestContext, String principal)	Build an AttributeResolutionContext to use.
protected void	doInitialize()
protected boolean	isRevoked(String principal, AuthenticationResult result, Collection<Instant> revocationRecords)	Check the revocation records' timestamps for applicability.
void	setAttributeId(String id)	Set the ID of an IdPAttribute to resolve to obtain revocation records for the principal.
void	setAttributeResolver(ReloadableService<AttributeResolver> service)	Set AttributeResolver to use.
void	setIssuerLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the strategy used to lookup the issuer for this attribute resolution.
void	setPrincipalNameLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set lookup strategy for principal name.
void	setRecipientLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the strategy used to lookup the recipient for this attribute resolution.
boolean	test(ProfileRequestContext input, AuthenticationResult input2)

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface java.util.function.BiPredicate

and, negate, or

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

principalNameLookupStrategy

@NonnullAfterInit
private Function<ProfileRequestContext,String> principalNameLookupStrategy

Lookup strategy for principal name.

issuerLookupStrategy

@Nullable
private Function<ProfileRequestContext,String> issuerLookupStrategy

Strategy used to locate the identity of the issuer associated with the attribute resolution.

recipientLookupStrategy

@Nullable
private Function<ProfileRequestContext,String> recipientLookupStrategy

Strategy used to locate the identity of the recipient associated with the attribute resolution.

attributeResolver

@NonnullAfterInit
private ReloadableService<AttributeResolver> attributeResolver

Attribute Resolver service.

attributeId

@NonnullAfterInit
@NotEmpty
private String attributeId

Attribute ID to resolve.

Constructor Details

AttributeRevocationCondition

public AttributeRevocationCondition()

Constructor.

Method Details

setPrincipalNameLookupStrategy

public void setPrincipalNameLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set lookup strategy for principal name.

Parameters:

strategy - lookup strategy

setIssuerLookupStrategy

public void setIssuerLookupStrategy(@Nullable
 Function<ProfileRequestContext,String> strategy)

Set the strategy used to lookup the issuer for this attribute resolution.

Parameters:

strategy - lookup strategy

setRecipientLookupStrategy

public void setRecipientLookupStrategy(@Nullable
 Function<ProfileRequestContext,String> strategy)

Set the strategy used to lookup the recipient for this attribute resolution.

Parameters:

strategy - lookup strategy

setAttributeResolver

public void setAttributeResolver(@Nonnull
 ReloadableService<AttributeResolver> service)

Set AttributeResolver to use.

Parameters:

service - attribute resolver service

setAttributeId

public void setAttributeId(@Nonnull @NotEmpty
 String id)

Set the ID of an IdPAttribute to resolve to obtain revocation records for the principal.

Parameters:

id - attribute ID to resolve

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

test

public boolean test(@Nullable
 ProfileRequestContext input,
 @Nullable
 AuthenticationResult input2)

Specified by:

test in interface BiPredicate<ProfileRequestContext,AuthenticationResult>

buildResolutionContext

@Nonnull
private AttributeResolutionContext buildResolutionContext(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull @NotEmpty
 String principal)

Build an AttributeResolutionContext to use.

Parameters:

profileRequestContext - profile request context

principal - name of principal

Returns:

the attached context

isRevoked

protected boolean isRevoked(@Nonnull @NotEmpty
 String principal,
 @Nonnull
 AuthenticationResult result,
 @Nonnull @NonnullElements
 Collection<Instant> revocationRecords)

Check the revocation records' timestamps for applicability.

Parameters:

principal - name of principal

result - active result being checked

revocationRecords - the records from the cache

Returns:

true iff the revocation applies to this result