All Classes and Interfaces
Class
Description
Base class for attribute definition resolver plugins.
Abstract Function which returns
Locale-aware information about an attribute.Abstract base class for predicates operating on an
AttributeContext.Base class for attribute release consent actions.
Base class for a function that takes a
ProfileRequestContext and requires access to an
AttributeResolutionContext.Base class for transcoders.
Base class for validation actions that includes new audit logging support.
A base class for authentication related actions.
A factory bean to collect information to do with a
BasicCredential.Form of encoding for SecretKey info.
Specific parser for all BasicCredentials.
A factory bean to collect information to do with a
BasicPKIXValidationInformation.Base class for transcoders that support CAS attributes.
A function to produce a "canonical" name for a CAS
Attribute for transcoding rules.Base class for CAS protocol actions.
Base Parser for trust engines of type SignatureChaining and Chaining.
A strategy function that examines SAML metadata associated with a relying party and derives List<String>-valued
configuration settings based on EntityAttribute extension tags.
Base class for JCommander command line argument handling for an HTTP-based remote service call,
with an abstract method that adds to a URL based on a derived class' arguments.
Base class for
PolicyRequirementRule implementations that are compositions of other
PolicyRequirementRules.Base class for
ConditionalProfileConfiguration implementations.Base class for consent actions.
Base class for consent actions which write to a
StorageService.Base class for consent actions which interact with a
StorageService.A factory bean to accumulate the information pertaining to an
AbstractCredential.Base parser for all <Credential> elements.
An abstract
CredentialValidator that handles some common behavior.Base class for data connector resolver plugins.
Base spring bean definition parser for data connectors.
A base class for authentication actions which call a Duo AuthAPI endpont.
Parser for abstract dynamic HTTP metadata resolvers.
Parser for
AbstractDynamicMetadataResolver.Matcher that checks, via an exact match, for an entity attribute with a given value.
Parser for EntityAttributeExactPolicyRule types.
Base class for matchers that check whether a particular entity attribute is present and contains a given value.
Matcher functor that checks entity attribute values via matching against a regular expression.
Parser for EntityAttributeRegexPolicyRule types.
Base definition for all EntityAttribute Parsers.
A matcher that evaluates to true if an entity's metadata matches the provided entity group name,
or a valid metadata-sourced affiliation of entities.
Parser for entity group policy rules.
Abstract executable search filter builder for implementations that can provide a search filter.
Basis of statement builder.
A base class for authentication actions that extract usernames for subsequent use.
Basis of request builder.
An extension to
AbstractCommandLine that auto-adds our context initializer for idp.home
and property support.An extension to
AbstractCommandLineArguments
that allows idp.home override and includes HTTP client support.IdPModule base class implementing basic file management.A base class implementing
IdPPlugin that defaults common settings.Abstract base for implementations of
IdPSession, handles basic management of the
instance data without addressing persistence.Address syntaxes supported for address binding.
Base class for implementing
MappingStrategy instances that includes
support for field renaming/aliasing.This is the base of all implementations of
Matcher which do some sort of comparison.Base class for filters which rely on the issuer's <shibmd:scope> extensions.
A strategy function that examines SAML metadata associated with a relying party and derives configuration
settings based on EntityAttribute extension tags.
A child context that caches derived configuration properties.
Parser for the MetadataProviderType in the
urn:mace:shibboleth:2.0:metadata namespace.Checks if the attribute issuer supports the required NameID format.
Parser for NameIDFormat rules.
Base class for all actions that build SAML
Response messages for output.Base parser for all <ValidationInfo> types.
Basis of all implementations of
PolicyRequirementRule which do some sort of comparison.Base class for
PrincipalSerializer implementations.Base class for Spring-aware profile actions.
Base class for
ProfileConfiguration implementations.A base class for profile interceptor actions.
Base class for profile interceptor results.
Base class for CAS protocol configuration.
Abstract base class for protocol response messages.
Base class for
Function that returns content from the ProxyRestriction element.Base class for regex matching functors of natural type Matcher (mostly attribute value matchers).
Base class for regex matching functors of natural type PolicyRule.
General
Matcher for regexp comparison of strings in Attribute Filters.General
Matcher for regexp comparison of strings in Attribute
Filters.Base class for rules operating on the RPI extension in metadata.
Spring bean definition parser that creates RegistrationAuthorityPolicyRule beans.
Parser for all types which extend the <ReloadingMetadataProviderType>.
Abstract base class for a function that requires a
RelyingPartyContext
obtained via a lookup function, by default a child of the ProfileRequestContext.Abstract base class for a function that requires a
ProfileRequestContext obtained
via a lookup function, by default the parent of the specified MessageContext, and
a RelyingPartyContext obtained via a lookup function, by default a child of the
aforementioned parent.Base class for a predicate that evaluates a
ProfileRequestContext and requires access to a
RelyingPartyContext.Abstract base class for a predicate that evaluates a
MessageContext
and which requires a RelyingPartyContext obtained via a lookup function,
by default a child of the InOutOperationContext
the parent of the specified MessageContext.Base class for all
ResolverPlugins.A factory bean to collect the parameterization that goes onto a
AbstractResolverPlugin.Configuration support for artifact-aware profiles.
Base class for transcoders that operate on a SAML 1
Attribute or AttributeDesignator.A function to produce a "canonical" name for a SAML 1
AttributeDesignator for transcoding rules.Configuration support for artifact-aware profiles.
Base class for transcoders that operate on a SAML 2
Attribute or RequestedAttribute.A function to produce a "canonical" name for a SAML 2.0
Attribute for transcoding rules.Base class for SAML 2 profile configurations.
AbstractSAMLAttributeTranscoder<AttributeType extends SAMLObject,EncodedType extends IdPAttributeValue>
Base class for transcoders that support SAML attributes.
Base class for SAML profile configurations.
A
DataConnector containing functionality common to data connectors that
retrieve attribute data by searching a data source.Base class for
SPSession serializers that handles data common to all such objects.Base Parser for trust engines of type StaticPKIXKeySignature and StaticPKIXX509Credential.
FactoryBean to do a deferred decision on whether to create a
X509CredentialNameEvaluator.Base class for string matching functors of natural type Matcher (mostly attribute value matchers).
General
PolicyRequirementRule for String comparison of strings in Attribute Filters.Base class for string matching functors of natural type PolicyRule.
A base class for subject canonicalization actions.
Base class for
Template based search dn resolvers.Escapes LDAP attribute values added to the template context.
Base class for ticket serializers that use a simple field-delimited serialization strategy.
Abstract base class for ticket services that rely on
StorageService for ticket storage.Basis of all parsers for <security:TrustEngine>.
An abstract
CredentialValidator that checks for a UsernamePasswordContext and delegates
to subclasses to produce a result.A base class for authentication related actions that validate credentials and produce an
AuthenticationResult.A factory bean to collect information to do with an X509 backed
BasicX509Credential.Specific parser for all X509Credentials.
A component that manages lockout state for accounts.
Class to contain a processed form of the
AttributeConsumingService suitable for display purposes.Helper class for
Action operations.Action that builds an
AttributeStatement and adds it to an Assertion returned by a lookup
strategy, by default in the InOutOperationContext.getOutboundMessageContext().Action that builds an
AttributeStatement and adds it to an Assertion returned by a lookup
strategy, by default in the InOutOperationContext.getOutboundMessageContext().Action that builds an
AuthenticationStatement and adds it to an Assertion returned by a lookup
strategy, by default in the InOutOperationContext.getOutboundMessageContext().Action that creates an
AuthnRequest and sets it as the message returned by
InOutOperationContext.getOutboundMessageContext().Action that builds an
AuthnStatement and adds it to an Assertion returned by a lookup
strategy, by default in the InOutOperationContext.getOutboundMessageContext().Action that builds an
AuthnStatement and adds it to an Assertion returned by a lookup
strategy, by default in the InOutOperationContext.getOutboundMessageContext().Action which adds a
DelegationRestrictionType Condition to each Assertion
contained within the outbound Response.Handler implementation that adds a Liberty sbf:Framework header to the outbound SOAP envelope.
A function that returns
SAMLProfileConfiguration.getAdditionalAudiencesForAssertion(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.Action that creates a
LogoutRequest based on an SAML2SPSession in a
LogoutPropagationContext and sets it as the message returned by
InOutOperationContext.getOutboundMessageContext().Handler implementation that adds a Liberty sb:Sender header to the outbound SOAP envelope.
Function to return the SAML self entityID from the MessageContext.
A descriptor for an administrative flow.
Manager of
AdministrativeFlowDescriptor objects.Parser for Algorithm filter.
Predicate which evaluates the inbound
AbstractSAMLEntityContext.getEntityId()
against a specified collection of entityIDs.Matcher that implements the conjunction of matchers.Bean definition parser for
AndMatcher or AndPolicyRule objects.PolicyRequirementRule that implements the conjunction of Policy Rules.Bean definition parser for
PolicyRequirementRule.MATCHES_ALL objects.Configuration support for SAML 1 artifact resolution requests.
Configuration support for SAML 2 artifact resolution requests.
Function that returns the ID attribute from the assertions in a response.Function that returns the IssueInstant attribute from the assertions in a response.A function that returns
SAMLProfileConfiguration.getAssertionLifetime(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.Function that returns the latest attempted authentication flow ID.Function that returns the username in a subordinate UsernamePasswordContext or
UsernameContext, if any.Wrapper class for a CAS attribute/values construct in a validate response.
A
BaseContext that tracks a set of attributes.Indicates a problem during decoding into an attribute.
Definition of attribute definition resolver plugins.
Function which returns the locale-aware display description of an attribute, defaulting to the
attribute ID if the attribute has no display description.
Function which returns the locale-aware display name of an attribute, defaulting to the
attribute ID if the attribute has no display name.
Indicates a problem during the encoding of an attribute.
Base class for attribute related exceptions.
Interface that filters out attributes and values based upon loaded policies.
A context supplying input to the
AttributeFilter interface.Used to indicate the "direction" of filtering relative to the IdP.
Indicates that an error has occurred during an attribute filtering process.
Service that filters out attributes and values based upon loaded policies.
Namespace handler for the attribute filtering engine.
A policy describing if a set of attribute value filters is applicable.
Bean definition parser for <afp:AttributeFilterPolicyGroup>, top top level of the filter "stack".
Bean definition parser for an
AttributeFilterPolicy.Strategy for summoning up an
AttributeFilterImpl from a populated ApplicationContext.A context which carries and collects information through the attribute filtering process, and coordinates data
between the filter implementation and the various resolver MatchFunctor implementations.
Matcher that checks whether an attribute is enumerated in an SP's metadata as a required or optional attribute.
Bean definition parser for
AttributeInMetadataMatcher.A function that returns
AttributeResolutionContext.getAttributeIssuerID() if available from a
AttributeResolutionContext obtained via a lookup function defined on the base class.Predicate that evaluates a
ProfileRequestContext by looking for an attribute issuer
that matches one of a designated set or a generic predicate.Compare the attribute issuer's entity ID for this resolution with the provided name.
Compare the attribute issuer's entity ID for this resolution with the provided regexp.
Bean definition parser for
AttributeIssuerRegexpPolicyRule.Bean definition parser for
AttributeIssuerPolicyRule.An implementation of
MetadataNodeProcessor which extracts IdPRequestedAttributes from any
AttributeConsumingService we find and IdPAttributes from any EntityDescriptor that we find.Predicate to determine whether consent should be obtained for an attribute.
A function that returns
AttributeResolutionContext.getPrincipal() if available from a
AttributeResolutionContext obtained via a lookup function defined on the base class.Predicate that evaluates a
ProfileRequestContext by looking for an attribute subject
that matches one of a designated set or a generic predicate.Configuration support for SAML 1 attribute query requests.
Configuration support for SAML 2 attribute query requests.
A function that returns
AttributeResolutionContext.getAttributeRecipientID() if available from a
AttributeResolutionContext obtained via a lookup function defined on the base class.Predicate that evaluates a
ProfileRequestContext by looking for an attribute recipient
that matches one of a designated set.Strategy for summoning up an
AttributeTranscoderRegistryImpl from a populated ApplicationContext.Function that returns a map of consent objects representing consent to attribute release.
Context for attribute release consent.
Descriptor for an attribute release flow.
Compare the attribute requester's entity ID for this resolution with the provided name.
Compare the attribute requester's entity ID for this resolution with the provided regexp.
Bean definition parser for
AttributeRequesterRegexpPolicyRule.Bean definition parser for
AttributeRequesterPolicyRule.A context supplying input to the
AttributeResolver interface.A component that resolves the attributes for a particular subject.
A component that resolves the attributes for a particular subject.
Namespace handler for the attribute resolver.
Bean definition parser for an
AttributeResolver.Additional gauges for attribute resolver.
Strategy for summoning up an
AttributeResolverImpl from a populated ApplicationContext.A context which carries and collects information through the attribute resolution process, and coordinates data
between the resolver implementation and the various resolver plugin implementations.
ProfileConfiguration with optional resolution of attributes.A condition for login flows that checks for revocation against a resolved
IdPAttribute.Represents a value filtering rule for a particular attribute.
Spring bean definition parser to configure an
AttributeRule.Function that returns the attribute IDs from an AttributeContext.Bean definition parser for
AttributeScopeStringMatchers.Class to implement a filter of scopes against <shibmd:scope>.
Bean definition parser for
AttributeScopeRegexpMatchers.Test that the scope in a
ScopedStringAttributeValue is a regexp match to configured value.Test that the scope of a
ScopedStringAttributeValue is a string match to the value configured.Container for decoded attributes.
Generator for
NameIdentifier objects based on IdPAttribute data.Generator for
NameID objects based on IdPAttribute data.An action that extracts a resolved
IdPAttribute value from an AttributeContext child obtained via
lookup function (by default a child of the SubjectCanonicalizationContext), and uses it as the result
of subject canonicalization.Transcoders are objects that support both attribute encoding and decoding for bidirectional
translation between
IdPAttribute format and technology-specific formats.The transcoder registry provides access to "instructions" for converting between
the
IdPAttribute "neutral" representation within the IdP and protocol-specific
forms such as SAML Attributes or OIDC claims.Interface to a naming function that allows an object to be turned into a unique string name.
Service implementation of the
AttributeTranscoderRegistry interface.ContextDataLookupFunction to return the value of an attribute from an AttributeContext.Class to implement a filter of string values against <shibmd:scope>.
Bean definition parser for
AttributeValueRegexpMatchers.Test that an
IdPAttributeValue is a regexp match to the configured string.Function to calculate the hash of the values of an IdP attribute.
Test that an
IdPAttributeValue is a string match to the configured string.Bean definition parser for
AttributeValueStringMatchers.A function that returns the effective audience restrictions to include in assertions,
based on combining a relying party's entityID with the result of
SAMLProfileConfiguration.getAdditionalAudiencesForAssertion(ProfileRequestContext),
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.BaseContext containing information to preserve for auditing/logging.A context representing the state of an authentication attempt, this is the primary
input/output context for the action flow responsible for authentication, and
within that flow, the individual flows that carry out a specific kind of
authentication.
Function that returns any classified errors found in a subordinate AuthenticationErrorContext,
or "Success" if none.A context that holds information about authentication failures.
Function that returns the authentication flow ID used to satisfy a request.A descriptor for an authentication flow.
Manager of
AuthenticationFlowDescriptor objects.A function that returns
AuthenticationProfileConfiguration.getAuthenticationFlows(org.opensaml.profile.context.ProfileRequestContext)()
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.Principal based on a SAML 1.x AuthenticationMethod.
Configuration of profiles for authentication.
Describes an act of authentication.
Principal that wraps an
AuthenticationResult.Principal serializer for
AuthenticationResultPrincipal.A context that holds information about authentication warnings.
Constants to use for audit logging fields stored in an
AuditContext.Function that returns the first AuthenticationMethod, AuthnContextCLassRef,
or AuthnContextDeclRef from an assertions in a response.Principal based on a SAML AuthnContextClassRef.
Principal based on a SAML AuthnContextDecl.
Principal based on a SAML AuthnContextDeclRef.
Constants to use for
ProfileAction
EventContext results related to
authentication and subject c14n.Function that returns the first authentication timestamp from an assertions in a response.Base class for actions that encode an
AttributeContext into a SAML attribute statement.Base class for actions that encode authentication information into a SAML 1 or SAML 2 statement.
Base spring bean definition parser for attribute definitions.
Base class for Spring bean definition parser for attribute encoders.
Base function for all Attribute Value matchers.
Base class for all classes which bridge between
PolicyRequirementRule and Matcher (in either
direction).An abstract action which contains the logic to do crypto transient decoding matching.
A base helper class for predicates that determine if CSRF protection is required per state.
Base class for Spring bean definition parsers within the filter engine configuration.
Decodes an incoming Shibboleth Authentication Request message.
Base function for all natural policy rules.
Bean definition parser for
ResolverAttributeDefinitionDependency and
for ResolverDataConnectorDependency.Bean definition parser for a
ResolverPlugin.Base class for Spring bean definition parser for SAML 1 attribute encoders.
Base class for Spring bean definition parser for SAML 1 attribute encoders.
Regular expression, etc.
An abstract action which contains the logic to do transient decoding matching (shared between SAML2 and SAML1).
A descriptor for an administrative flow.
A wrapper class to construct logo objects for exposure by
UIInfo interface.A class which is here solely to provide compatibility for V2 scripted attribute definitions.
Wrapper for use of Duo.
Factory bean for BasicInline Credentials.
Parser for BasicInline Credentials.
Wrapper around
BasicKeystoreKeyStrategyTool.Basic implementation of a
AttributeTranscoderRegistry.NamingFunction.Spring bean factory for producing a
BasicCredential from Resources.Parser for BasicFilesystem and BasicResourceBacked Credentials.
Interface for outbound SAML artifact configuration.
Implementation support for a concrete
SPSession implementation.A function to create a
BasicSPSession based on profile execution state.A serializer for
BasicSPSession objects.Spring bean factory for producing a
BasicX509Credential from Resources.A strategy function that examines SAML metadata associated with a relying party and derives bean-based
configuration settings based on EntityAttribute extension tags.
A strategy function for establishing an appropriate
BestMatchLocationCriterion
based on the AssertionConsumerService location used to initiate a SAML2SPSession.Subclass that adds awareness of a Spring bean ID for a binding's
MessageEncoder.A strategy function that examines SAML metadata associated with a relying party and derives Boolean-valued
configuration settings based on EntityAttribute extension tags.
Configuration for SAML 1 Browser SSO profile requests.
Configuration support for SAML 2 Browser SSO.
Builds an authentication context from an incoming
ServiceTicketRequest message.Action that builds the chain of visited proxies for a successful proxy ticket validation event.
Creates the
RelyingPartyContext as a child of the ProfileRequestContext.Builds a
SAMLMetadataContext child of RelyingPartyContext to facilitate relying party selection
by group name.Creates the SAML response message for failed ticket validation at the
/samlValidate URI.Creates the SAML response message for successful ticket validation at the
/samlValidate URI.Code to build the war file during an install or on request.
A
BeanPostProcessor for MetadataResolver beans that ensures a ByReferenceMetadataFilterBridge
is attached.This is a bridge filter that uses Spring to locate extant
ByReferenceMetadataFilter
objects to run.Parser for a <ByReference> filter.
A
byte[] value for an IdPAttribute.Utility class for parsing v2 cache configuration.
Function that returns a principal name from one of two places: a
SubjectCanonicalizationContext child
of the root context or a SessionContext.IdPModule implementation.Marker interface for transcoders that support CAS attributes.
Constants to use for audit logging fields stored in an
AuditContext.Describes a CAS protocol-specific service provider session created in response to a successful ticket validation.
JSON serializer for
CASSPSession class.Context that carries a
Certificate to be validated.Function that returns the issuer of a client certificate.Function that returns the subject of a client certificate.Spring bean definition parser for {urn:mace:shibboleth:2.0:security}ValidationOptions elements which have a type
specialization of {urn:mace:shibboleth:2.0:security}CertPathValidationOptionsType.
Parser for <ChainingMetadataProvider>.
Parser for trust engines of type SignatureChaining.
Factory bean for
ChainingSignatureTrustEngine.Factory bean for
ChainingTrustEngine.A predicate that evaluates a
ProfileRequestContext and extracts the effective
setting of BrowserSSOProfileConfiguration.isCheckAddress(ProfileRequestContext).Checks the current
ServiceContext to determine whether the service/relying party is authorized to proxy.Entry point for command line attribute utility.
A predicate implementation that forwards to
SAMLArtifactConsumerProfileConfiguration.isClientTLSArtifactRequests(MessageContext).A predicate implementation that forwards to
SingleLogoutProfileConfiguration.isClientTLSSOAPRequests(MessageContext).A function that returns a
ClientTLSValidationConfiguration list by way of various lookup strategies.Principal that can be cloned without knowledge of the underlying type.
Serializes a
Collection of strings.Interface for JCommander command line argument handling for an HTTP-based remote service call.
Spring bean definition parser for configuring ComputedIdDataConnector.
A
PairwiseIdStore that generates a pairwise ID by computing the hash of
a given attribute value, the entity ID of the recipient, and a salt.Post-digest encoding types.
A
ProfileConfiguration supporting an activation condition.Lookup function for extracting CAS profile configuration from the profile request context.
Validator implementation that invokes
Connection.open() to determine if the ConnectionFactory is properly
configured.Represents consent.
IdPModule implementation.Constants to use for audit logging fields stored in an
AuditContext as a
child of an ConsentContext.Context representing the state of a consent flow.
Descriptor for a consent flow.
Context representing signals to consent flows for managing their state.
The result of a consent flow, suitable for storage.
Serializes
Consent.IdPModule implementation.An attribute definition which returns an attribute whose values are derived from the
ProfileRequestContext associated with the request via a plugged in Function.Spring Bean Definition Parser for attribute definitions derived from the Principal.
An action that checks for an
ExternalAuthenticationContext for a signaled event via the
ExternalAuthenticationContext.getAuthnError() method, and otherwise enforces the presence
of an inbound SAML Response to process.Copy the distribution to the final location.
A set of gauges for core system information.
Implementation base class for
IdPModule that lives within the core code
and whose documentation URLs will float with the IdP's own.A
Comparator used to order storage keys so that the least used and oldest storage keys are returned first.Function to order storage keys by least-used and oldest first during pruning of storage records.
Consent action to create a consent result representing global consent to be stored in a storage service.
Consent action to create a consent result representing the result of a consent flow.
A Factory bean to summon up
CredentialConfig from supplied <Credential> statements.High-level API for validating credentials and producing a Java Subject as a result.
Interface to use to report errors to the caller.
Interface to use to report warnings to the caller.
Resolves a
RelyingPartyConfiguration for a given CriteriaSet.Resolver which uses an instance of
CriteriaRelyingPartyConfigurationResolver to
resolve the self entityID.Generates transients using a
DataSealer to encrypt the result into a recoverable value,
for use with stateless clustering.Processes a transient
NameID, checks that its NameIDType.getNameQualifier() and
NameIDType.getSPNameQualifier() are correct, and decodes XSString.getValue()
via the base class (reversing the work done by
CryptoTransientIdGenerationStrategy).Processes a transient
NameIdentifier, checks that its NameIdentifier.getNameQualifier() is
correct, and decodes XSString.getValue() via the base class (reversing the work done by
CryptoTransientIdGenerationStrategy).An anti cross-site request forgery token.
A flow execution lifecycle listener that, if enabled:
Sets an anti-CSRF token into the view-scope map on rendering of a suitable view-state
Checks the CSRF token in a HTTP request matches that stored in the view-scope map when a suitable
view-state event occurs.
A thread-safe helper class for dealing with cross-site request forgery tokens.
A simple default CSRF token validation predicate.
Function that returns the current consent IDs from a ConsentContext.Function that returns whether the current consents are approved from an ConsentContext.Function that returns the current consent values from an ConsentContext.Tells the installers about the current install state.
Tells the installers about the current install state.
Base class for data connector resolver plugins.
A factory bean to collect the parameterization that goes onto a
AbstractDataConnector.Arguments for DataSealer CLI.
Operation enum.
Command line utility for
DataSealer.Validator implementation that invokes
DataSource.getConnection() to determine if the DataSource is properly
configured.Provides a date/time matching predicate that compares a date-based attribute value against
current system time with optional offset.
An
AttributeDefinition that creates an attribute whose values are the values
of all its dependencies, passed through or converted into a DateTimeAttributeValue.Bean definition parser for a
DateTimeAttributeDefinition.Base class for
IdPAttribute values that are date/time values.A profile action which decorates instances of
Assertion appropriately for use as delegation tokens.Strategy that builds the SSOS endpoint URL based on the current HTTP request
using default values for scheme, port and URI path suffix.
An
AttributeDefinition that creates an attribute whose values are the
decrypted values of its dependencies.Bean definition parser for a
DecryptedAttributeDefinition.A function that returns a
DecryptionConfiguration list by way of various lookup strategies.Handles serialization of results, delegating handling of
Principal objects to one or more
PrincipalSerializer plugins.Default
BiPredicate for determining if CSRF token validation should occur
from a compatible request context and event.Function to filter a set of candidate NameIdentifier/NameID Format values derived from an entity's SAML metadata
against configuration preferences.
Deprecated, for removal: This API element is subject to removal in a future version.
Retrieves a per-relying party configuration for a given profile request based on the request context.
Default comparator implementation for comparing CAS service URLs.
Deprecated, for removal: This API element is subject to removal in a future version.
Default
Predicate for determining if a CSRF token is required for the given
request context.Lookup function to return the valid delegated assertion token in effect for the Liberty SSOS request.
An implementation of
CriteriaRelyingPartyConfigurationResolver which delegates to an instance of
RelyingPartyConfigurationResolver.Context which holds data relevant to the issuance of a delegated
Assertion.SAMLObject for the Shibboleth DelegationPolicy extension supporting SAML delegation.
Builder of
DelegationPolicy objects.Implementation of
DelegationPolicy.Marshaller for
DelegationPolicy.Unmarshaller for
DelegationPolicy.Enum which represents the state of the relying party's indication of whether
a delegated assertion token is requested.
IdPModule implementation.Deprecated, for removal: This API element is subject to removal in a future version.
A bean that emits deprecation warnings if a configurable set of properties are set.
Profile action that destroys any
IdPSessions found in a LogoutContext.Predicate to determine whether a relying party should see detailed error information.
A predicate that evaluates
RelyingPartyConfiguration.isDetailedErrors(ProfileRequestContext)
if available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.An authentication action that checks for a mismatch between an existing session's identity and
the result of a newly canonicalized subject (from a
SubjectCanonicalizationContext).General
PolicyRequirementRule for testing the filtering direction.A
Function that produces a discovery request URL using the protocol defined in
https://wiki.oasis-open.org/security/IdpDiscoSvcProtonProfileAction that implements a JSON REST API for the
AccountLockoutManager interface.Action that implements a JSON REST API for the
RevocationCache interface.Action that implements a JSON REST API for accessing
StorageService records.A strategy function that examines SAML metadata associated with a relying party and derives Double-valued
configuration settings based on EntityAttribute extension tags.
IdPModule implementation.Constants defined in the Duo AuthAPI.
Describes the results of a Duo AuthAPI call, intended for use with a jackson
ObjectMapper.Implementation of the the Duo AuthApi /v2/auth endpoint.
Context that carries Duo factor and device or passcode to be used in validation.
Describes the results of an authentication attempt via the Duo AuthAPI, intended for use with a jackson
ObjectMapper.Represents a Duo device, intended for use with a jackson
ObjectMapper.Describes the failure of a Duo AuthAPI call.
Interface to a particular Duo integration point.
Implementation of the the Duo AuthAPI /v2/preauth endpoint.
Describes the results of an pre-authentication attempt via the Duo AuthAPI.
Principal based on a Duo authentication.
Handle a generic object returned from the response that will come from the Duo
AuthAPI.
Helpers for DuoWeb and Duo AuthAPI operations.
Extended
PairwiseIdStore interface that supports reversal, mutation, and deactivation features
requiring durable storage.A strategy function that examines SAML metadata associated with a relying party and derives Long-valued
configuration settings that are durations, based on EntityAttribute extension tags.
Predicate over an
AttributeContext that derives the value(s) to match based
on one or more supplied Functions instead of static values.Parser for concrete dynamic HTTP metadata resolvers, based on
FunctionDrivenDynamicHTTPMetadataResolver.Configuration support for SAML 2 ECP.
An
IdPAttributeValue that is empty.Types of empty values.
Ticket service that uses two different strategies for ticket persistence:
Service tickets, proxy tickets, and root proxy-granting tickets are persisted by serializing
ticket data and encrypting it into the opaque part of the ticket ID using a
DataSealer.
Chained proxy-granting tickets are persisted using a StorageService.
Function that returns the data encryption algorithm used.A function that returns a
EncryptionConfiguration list using injected lookup strategies.Credential resolver whose purpose is to resolve configured IdP encryption credentials.
Parser for a <EntitiesDescriptorName> node processor.
Parser for a <EntityAttributes> filter.
Parser for a <EntityRolet> filter.
Action which implements policy controls to decide whether an SSO request based
on a delegated
Assertion token is allowed to proceed.CAS protocol flow event identifiers.
PrincipalEvalPredicateFactory that implements exact matching of principals,
and works for any type.Should be implemented by objects used to search for attributes, that uniquely identify those search results.
Builder used to created
ExecutableSearch instances.A search filter that can be executed against an LDAP to fetch results.
A statement that can be executed against a database to fetch results.
IdPModule implementation.Constants used in XMLObject extensions.
IdPModule implementation.Public interface supporting external authentication outside the webflow engine.
A context representing the state of an externalized authentication attempt,
a case where authentication happens outside of a web flow.
Exception indicating a problem with the external authentication process.
Implementation of the
ExternalAuthentication API that handles moving information in and out
of request attributes.Public interface supporting external interceptor flows outside the webflow engine.
A context representing the state of an externalized interceptor flow.
Exception indicating a problem with the external interceptor process.
Implementation of the
ExternalInterceptor API that handles moving information in and out
of request attributes.An authentication action that populates a
AuthenticationContext with the active
AuthenticationResult objects found in a SessionContext that is a direct
child of the ProfileRequestContext.Consent action which extracts user input and updates current consent objects in the consent context accordingly.
An action that extracts a discovery service result and copies it to the
AuthenticationContext.An action that extracts the Duo factor and device or passcode from HTTP request headers into a
DuoAuthenticationContext, and attaches it to the AuthenticationContext.TODO.
An action that extracts an asserted user identity from the incoming request, creates a
UsernameContext, and attaches it to the AuthenticationContext.Action that extracts a SAML Subject from an inbound message, and prepares a
SubjectCanonicalizationContext to process it into a principal identity.Lookup function that returns the
NameIdentifier or NameID from the request in the inbound
message context.An action that extracts the user-agent's IP address from the incoming request, creates a
UserAgentContext, and attaches it to the AuthenticationContext.An action that extracts the user-agent's identifier from the incoming request, creates a
UserAgentContext, and attaches it to the AuthenticationContext./**
An action that extracts a username and password from the HTTP
HttpHeaders.AUTHORIZATION header,
creates a UsernamePasswordContext, and attaches it to the AuthenticationContext.An action that extracts a username and password from an HTTP form body or query string,
creates a
UsernamePasswordContext, and attaches it to the AuthenticationContext.An authentication stage that extracts a username/password from the WSS Username/Password attached to a SOAP message.
An action that extracts an X.509 certificate from the standard servlet request attribute,
creates a
CertificateContext, and attaches it to the AuthenticationContext.Parser for a <FileBackedHTTPMetadataProvider>.
Factory bean customization for the Shibboleth IdP.
Deprecated, for removal: This API element is subject to removal in a future version.
Parser for a <FilesystemMetadataProvider>.
Action that invokes the
AttributeFilter for the current request.Action that filters a set of attributes against the
AttributeDesignator
objects in an AttributeQuery.Action that filters a set of attributes against the
Attribute objects in
an AttributeQuery.An authentication action that filters out potential authentication flows if the request requires
forced authentication or max age behavior and the flows don't support forced authentication.
An authentication action that filters out potential authentication flows if the request requires
non-browser support and the flows require a browser.
A profile interceptor action that filters out available interceptor flows if the request requires non-browser support
and the flows require a browser.
An authentication action that runs after a completed authentication flow (or the reuse
of an active result) and transfers information from other contexts into a
SubjectContext
child of the ProfileRequestContext.An authentication action that completes MFA by producing a final
AuthenticationResult
out of whatever constituent parts and pieces exist, by means of an overridable function,
storing it in the AuthenticationContext and preparing a fresh SubjectCanonicalizationContext
to operate on.Default merging strategy to combine individual
AuthenticationResult objects into a
single result.An action that runs after a completed canonicalization of a SAML Subject and transfers
information into a
SubjectContext child of the ProfileRequestContext.Post-process the results of
Assertion token subject canonicalization.Implementation class for plugins from the project itself to centralize
update handling.
A bean factory for creating
FlowDefinitionRegistry instances, based on the programmatic
builder built into SWF.Copied from SWF, a basic registry implementation.
Derivation of SWF-supplied resource factory for flow definitions.
Marker interface for a descriptor for a webflow allowing managed injection of configuration settings.
Function that returns a profile interceptor flow descriptor from a profile request context using a lookup strategy.
ContextDataLookupFunction that returns the current flow id.This code is extended from
FlowModelFlowBuilder
in order to customize the Spring ApplicationContext used for flow configuration.This code is extended from org.springframework.webflow.engine.builder.model.FlowRelativeResourceLoader
with modifications to support proper lookup of resources via both filesystem and classpath along with
custom protocol-specific loaders.
Function that returns the ForceAuthn attribute from an AuthnRequest.A predicate that evaluates a
ProfileRequestContext and determines whether forced
authentication should be set based on the associated AuthenticationProfileConfiguration.Deprecated.
Replaced by api class.
IdPModule implementation.Looks up the value of the CAS gateway parameter from the request to the /login URI.
Principal serializer for arbitrary principal types.
PrincipalService for most principal types that just exposes the proper PrincipalSerializer.Predicate to determine whether global consent has been given by user.
Generates and stores a CAS protocol proxy ticket.
Generates and stores a CAS protocol service ticket.
Kerberos login utility for the context acceptor, encapsulates a number of special options
used to create a security context for the GSS acceptor, usually based on a keytab file.
Helper class that manages context establishment for the SPNEGO GSS-API mechanism.
IdPModule implementation.Principal based on an HOTP authentication.
A password validator that authenticates against Apache htpasswd files.
Factory bean customization for the Shibboleth IdP.
Deprecated, for removal: This API element is subject to removal in a future version.
Authenticates a CAS proxy callback endpoint using an
HttpClient instance to establish
the connection and a TrustEngine to verify the TLS certificate presented by the remote peer.A
MessageContext function that returns a HttpClientSecurityConfiguration list
by way of various lookup strategies.This class implements a
DataConnector
that obtains data from an HTTP service.Bean definition Parser for a
HTTPDataConnector.Utility class for parsing v2 schema configuration.
Parser for a FilesystemMetadataProvider.
Helper class for Spring configuration of HTTP metadata providers.
A metrics reporter that runs at scheduled times and posts a JSON feed of metrics to a designated endpoint.
Factory bean for simple use cases that auto-configure PKIX or key pinning for
an
HTTPResource.Strategy for processing an
HttpClient response into a map of
IdPAttributes.An HTTP request that returns attribute data.
Criterion representing a session bound to a servlet request,
which is implicitly the "current" request known to the resolver.A function that returns an
IdentifierGenerationStrategy by way of a RelyingPartyContext
obtained via a lookup function, by default a child of the ProfileRequestContext.Each attribute represents one piece of information about a user and has associated encoders used to turn that
information in to protocol-specific formats.
Principal that wraps an
IdPAttribute.Principal serializer for
IdPAttributePrincipal.Engine to mine values from
IdPAttributePrincipals.Interface for values of an
IdPAttribute.Constants to use for audit logging fields stored in an
AuditContext.IdP-specific constants to use for
ProfileAction
EventContexts.A set of gauges for core system information.
Object representing a Shibboleth Authentication Request message.
Decodes an incoming Shibboleth Authentication Request message.
Decodes an incoming Shibboleth Authentication Request message.
This interface is exported (via the service API) by every IdP module.
Interface to a resource managed by the module.
Resource management outcome.
This interface is exported (via the service API) by every IdP plugin.
An
ApplicationContextInitializer which appends properties to the application context's environment.IdP Representation of the SAML2 RequestedAttribute.
An identity provider session belonging to a particular subject and client device.
Class to contain a processed form of the
UIInfo suitable for display purposes.Predicate that decides whether to ignore a request signature.
A predicate that evaluates a
ProfileRequestContext and extracts the effective
setting of BrowserSSOProfileConfiguration.isIgnoreScoping(ProfileRequestContext).IdPModule implementation.A function that returns
ProfileConfiguration.getInboundInterceptorFlows(org.opensaml.profile.context.ProfileRequestContext)() if such a profile is
available from a RelyingPartyContext obtained via a lookup function, by default a child of the
ProfileRequestContext.Bean definition parser for
DirectionPolicyRule using AttributeFilterContext.Direction.INBOUND.A predicate that evaluates a SSO
ProfileRequestContext and determines whether an attribute statement
should be included in the outgoing assertion.PrincipalEvalPredicateFactory that implements inexact matching of principals,
based on an arbitrary set of "matches" configured at runtime.An action that processes settings from a supplied
AdministrativeFlowDescriptor to prepare
the profile context tree for subsequent use by an administrative profile flow.Action that creates an
AttributeReleaseContext and attaches it to the current ProfileRequestContext.An action that creates an
AuthenticationContext and attaches it to the current ProfileRequestContext.Action that creates a
ConsentContext and attaches it to the current ProfileRequestContext.Initializes the CAS protocol interaction at the
/login URI.Action that adds an outbound
MessageContext and related SAML contexts to the ProfileRequestContext
based on the identity of a relying party accessed via a lookup strategy, by default an immediate child of the profile
request context.Action that prepares an outbound
MessageContext and related SAML contexts
in the event that they are not already prepared, to allow error responses to be
generated in the case of synchronous bindings (i.e., SOAP).Action that creates a new
ProfileRequestContext and binds it to the current conversation under the
ProfileRequestContext.BINDING_KEY key, and sets the profile and logging IDs, if provided.Initializes the CAS protocol interaction at the
/proxy URI.Action that creates a new
ProfileRequestContext via a creation strategy,
and sets the profile and logging IDs, if provided.Message handler that adds a
RelyingPartyContext to the current InOutOperationContext tree
via a creation function.Action that adds a
RelyingPartyContext to the current ProfileRequestContext tree
via a creation function.An action that creates an
RequestedPrincipalContext and attaches it to the current
AuthenticationContext, if the profile request context contains a RelyingPartyContext
with an AuthenticationProfileConfiguration containing one or more default authentication
methods.Initializes the CAS protocol interaction at the
/login URI.Parser for <InlineMetadataProvider>.
Deprecated, for removal: This API element is subject to removal in a future version.
Factory bean customization for the Shibboleth IdP.
Bean definition parser for a
ResolverAttributeDefinitionDependency.Bean definition parser for a
ResolverDataConnectorDependency.Function that returns the InResponseTo attribute from a response.Shimmed logger.
Entry point to run the main classes.
Interface to describe simply parameterization and status of the installation.
Class implement
InstallerProperties with properties/UI driven values.General common names and helper functions for the Installer.
A strategy function that examines SAML metadata associated with a relying party and derives Integer-valued
configuration settings based on EntityAttribute extension tags.
Exception indicating a problem validating a CSRF token at runtime.
IdPModule implementation.A
BiPredicate that checks if a pair of addresses are either equal, or share an IPRange.Predicate that determines whether an IdP attribute is required by the requester.
Predicate that returns whether consent is required by comparing the previous and current consents from the consent
context.
Function that returns the IsPassive attribute from an AuthnRequest.Matcher that checks, via an exact match, if the attribute issuer contains an entity attribute with a given value.
Parser for
IssuerEntityAttributeExactPolicyRule.Matcher that checks, via regex, if the attribute issuer contains an entity attribute with a given value.
Parser for
IssuerEntityAttributeRegexPolicyRule.A matcher that evaluates to true if attribute issuer's metadata matches the provided entity group name,
or a valid metadata-sourced affiliation of entities.
Parser for
IssuerInEntityGroupPolicyRule.Checks if the attribute issuer supports the required NameID format.
Parser for
IssuerNameIDFormatExactPolicyRule.Rule based on RPI extension in attribute issuer's metadata.
Spring bean definition parser that creates
IssuerRegistrationAuthorityPolicyRule beans.A predicate which determines whether issuance of a delegated
SAML 2
Assertion is active.A password validator that authenticates against JAAS.
Command line arguments for
JarCheckCLI.Program to check for potential jar clashes.
JDBC-based storage management for pairwise IDs.
Function to join the result of two functions with a separator.
A password validator that authenticates against Kerberos natively, with optional service ticket verification.
Kerberos realm settings for the SPNEGO authentication flow.
Kerberos settings for the SPNEGO authentication flow.
Context that carries a
KerberosTicket to be validated.XMLObject for the Shibboleth KeyAuthority metadata extension.
Builder of
KeyAuthority objects.Implementation of
KeyAuthority.Marshaller for
KeyAuthority.An implementation of
MetadataNodeProcessor which supports processing the
Shibboleth KeyAuthority information within a metadata document.Parser for a <KeyAuthority> node processor.
Utility class for extracting
PKIXValidationInformation from a KeyAuthority.Basic implementation of
PKIXValidationInformation.Unmarshaller for
KeyAuthority.Implementation of
CredentialConfig that loads keystore and truststore data using a Resource.LDAP Authentication configuration.
Enum that defines authenticator configuration.
Enum that defines LDAP connection strategy.
Enum that defines an LDAP pool passivator.
Enum that defines LDAP trust configuration.
A password validator that authenticates against LDAP natively.
A
DataConnector that queries an LDAP in order to retrieve attribute
data.Bean definition Parser for a
LDAPDataConnector.Utility class for parsing v2 schema configuration.
Principal serializer for
LdapPrincipal.A context containing data about an LDAP authentication operation.
Deprecated.
A predicate implementation that supports the legacy V2 configuration options of
"always", "conditional", and "never" for encryption.
Internal enum for the options supported.
A predicate implementation that supports the legacy V2 configuration options of
"always", "conditional", and "never" for signing.
Internal enum for the options supported.
Liberty-related constants.
Decoder for Liberty ID-WSF 2.0 SOAP 1.1 HTTP binding carrying SAML protocol messages
used in SAML delegation.
Encoder for Liberty ID-WSF 2.0 SOAP 1.1 HTTP binding carrying SAML protocol messages
used in SAML delegation.
Context for storing information related to the Liberty SSOS profile and use of an inbound delegated
Assertion token.A strategy function that examines SAML metadata associated with a relying party and derives List<String>-valued
configuration settings based on EntityAttribute extension tags.
Parser for
LocalDynamicMetadataResolver.Function which resolves the
Locale from a ProfileRequestContext.This code is copied verbatim from org.springframework.webflow.engine.builder.model.LocalFlowBuilderContext
A builder context that delegates to a flow-local bean factory for builder services.
A context that holds information about a management operation on an
AccountLockoutManager.Simple
LoggingService that watches for logback configuration file changes
and reloads the file when a change occurs.Spring Web Flow utility action for logging on DEBUG a representation of the current
ProfileRequestContext.Deprecated, for removal: This API element is subject to removal in a future version.
A @{link
FileVisitor copies directory trees keeping a note of all copied target files.A bean that logs IdP internals when instantiated.
CAS protocol configuration that applies to the
/login URI.A
BaseContext that holds a multimap of SPSession objects.A function that returns a session from a
LogoutContext
and removes it from that context at the same time.Context holding information needed to perform logout for a single SP session.
Logout propagation result.
A descriptor for a logout propagation flow.
Manager of
LogoutPropagationFlowDescriptor objects.Selection function to retrieve the logout propagation flow descriptor that is suitable for a given
SPSession.A strategy function for determining the status of a logout based on the content of
a
LogoutContext.Dedicated bean used to log flow exceptions, to get around issues with Spring Expressions
referencing class objects under certain conditions that are so far not understood.
Spring Web Flow utility action for logging on DEBUG details about the current hierarchy of
Spring
ApplicationContext and the beans contained within each.A strategy function that examines SAML metadata associated with a relying party and derives Long-valued
configuration settings based on EntityAttribute extension tags.
A condition that relies on a
Meter to detect looping SPs.Utility class for parsing v2 managed connection configuration.
Implements a set of default logic for mapping an
AuthnContext's content into a set of
custom Principals based on a set of static mapping rules.Implementation of Mapped Attributes.
Bean definition parser for a
MappedAttributeDefinition.Bean definition parser for deprecated variant of
AttributeInMetadataMatcher.Extended version of EntityAttributes-driven predicate that uses an optimization to check
for mapped attributes in an
AttributesMapContainer structure.Strategy for mapping from an arbitrary result type to a collection of
IdPAttributes.Action that ensures that the attributes in the ACS (if any) are mapped.
Java definition of MatchFunctorType as applied to value filtering.
Bridging class to go from a
PolicyRequirementRule to a Matcher.A function that returns
BrowserSSOProfileConfiguration.getMaximumTimeSinceAuthn(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A class to merge a property file into another property file, preserving the comments.
Function that returns a consent object whose id and value are resolved from a lookup function
and
MessageSource.Interface to define Metadata Generation.
This class gathers information which it then uses to generate IdP Metadata.
The end points we understand.
Interface which describes metadata that needs to be generated.
Implementation of
MetadataGeneratorParameters.Task to generate metadata.
Namespace handler for
urn:mace:shibboleth:2.0:metadata.An implementation of
PKIXValidationInformationResolver which resolves PKIXValidationInformation based
on information stored in SAML 2 metadata.Function that returns the Metadata protocol (as defined by the bean
called shibboleth.MetadataLookup.Protocol).This class is a sortable container of
MetadataResolvers, wrapped into a serviceable component.Command line processing for MetadataQuery flow.
Object representing a query for metadata.
Decodes an incoming metadata query request.
Additional gauges for metadata resolvers.
Strategy for summoning up a
MetadataResolver from a populated ApplicationContext.CAS service registry implementation that queries SAML metadata for a CAS service given a CAS service URL using
the following strategy.
Predicate defines CAS login endpoints so that the metadata index on endpoints can be scoped to the smallest
set needed to support CAS entities in SAML metadata.
IdPModule implementation.Information required to perform some module operations.
Module exception class.
Arguments for
IdPModule management CLI.Command line for
IdPModule management.A context that holds information about the intermediate state of the multi-factor login flow.
A ruleset for managing the transition out of a step during the multi-factor authn flow.
A special ResolutionException which is thrown if multiple results were resolved
by a data connector and the deployer specified "MultipleResultsAnError".
BaseContext representing multiple relying parties involved in a request, usually a
subcontext of ProfileRequestContext.Error thrown if decoding of a SAML subject identifier fails.
Function that returns the Name Identifier from a request or response.Action to perform subject canonicalization, transforming the input
Subject
into a principal name by searching for one and only one NameIDPrincipal custom principal,
using an injected NameIDDecoder to carry out the process.A predicate that determines if this action can run or not.
A class used to describe flow descriptors for
NameIDPrincipal and
NameIdentifierPrincipal c14n.Interface for converting a
NameID back into a principal name.Action to perform subject canonicalization, transforming the input
Subject
into a principal name by searching for one and only one NameIdentifierPrincipal custom principal,
using an injected NameIdentifierDecoder to carry out the process.A predicate that determines if this action can run or not.
Interface for converting a
NameIdentifier back into a principal name.A service interface for obtaining name identifier generators.
Implementation of
NameIdentifierGenerationService.Principal based on the SAML2
NameIdentifier.Function that returns the Name Identifier Format from a SAML Subject.Parser for a <NameIDFormat> filter.
Function that returns the NameID Format from a NameIDPolicy element.Function that returns the SPNameQualifier from a NameIDPolicy element.Principal based on the SAML2
NameID.Principal serializer for
NameIDPrincipal.A
BeanPostProcessor for MetadataResolver beans that ensures a NodeProcessingMetadataFilter
containing a set of default MetadataNodeProcessor plugins is attached.Parser for a <NodeProcessing> filter.
Used to determine whether a Data Connector initialized properly and continues to be fit for use.
A special ResolutionException which is thrown if no results were resolved
by a data connector and the deployer specified "NoResultsAnError".
A predicate that returns
SAMLProfileConfiguration.isIncludeConditionsNotBefore(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.Matcher that implements the negation of a matcher.Bean definition parser for
NotMatcher or NotPolicyRule objects.PolicyRequirementRule that implements the negation of a matcher.A policy rule that checks if the given attribute has more than the minimum number of values but less than the
maximum.
Bean definition parser for
NumOfAttributeValuesPolicyRule.Descriptor for an administrative flow that tracks whether it's been run or not to
limit use.
A simple bean that may be used with Spring to initialize the OpenSAML library
with injected instances of some critical objects.
Service OrganizationDisplayName - directly from the metadata if present.
Service OrganizationName - directly from the metadata if present.
Class to contain a processed form of the
Organization suitable for display purposes.Service OrganizationURL - directly from the metadata if present.
Matcher that implements the disjunction of matchers.Bean definition parser for
OrMatcher or OrPolicyRule objects.PolicyRequirementRule that implements the disjunction of Policy Rules.A function that returns
ProfileConfiguration.getOutboundInterceptorFlows(org.opensaml.profile.context.ProfileRequestContext)() if such a profile is
available from a RelyingPartyContext obtained via a lookup function, by default a child of the
ProfileRequestContext.Bean definition parser for
DirectionPolicyRule using AttributeFilterContext.Direction.OUTBOUND.Action that outputs one or more
Metric objects.ProfileConfiguration with optional override of issuer setting.Object representing a pairwise/targeted identifier entry as a storage input/output.
A
DataConnector that generates pairwise IDs that depend on
a seed IdPAttribute.Spring bean definition parser for configuring
PairwiseIdDataConnector variants.Storage and retrieval interface for pairwise/targeted identifiers allowing for custom implementations.
Deprecated.
Replaced by api class.
An
ExecutableSearchBuilder that generates the search filter to
be executed by evaluating a parameterized filter string against the currently resolved attributes within a
AttributeResolutionContext.IdPModule implementation.Ant helper class to ask for passwords, rejecting zero length passwords and asking for confirmation.
Principal that wraps a password.
Extension of standard SWF URL handler that checks for requests in which a valid flow ID
is a prefix of the PATH_INFO value, allowing the flow to run with the rest of the path
available to it as input.
Service registry that evaluates a candidate service URL against one or more defined services, where each
definition contains a service URL regular expression pattern.
Deprecated.
Generator for "persistent" Format
NameID objects that provides a source/seed ID based on IdPAttribute
data.File system specific bean for PKIXValidationInfo.
Parser for <ValidationInfo type="PKIXInline">.
File system specific bean for PKIXValidationInfo.
Parser for <ValidationInfo type="PKIXFilesystem"> and <ValidationInfo type="PKIXResourceBacked">.
A Parser for the < ValidationOptions > within a StaticPKIXSignature.
Support class for working with dependencies both
ResolverAttributeDefinitionDependency
and ResolverDataConnectorDependency.Plugin exception class.
Implementation base class for
IdPModule that is shipped in a plugin
produced by the Shibboleth Project ourselves and for which the documentation
will be in the wiki in a fixed location.Class which encapsulates the information about a given plugin as downloaded
fro the plugin URL (or file).
The class where the heavy lifting of managing a plugin happens.
Arguments for Plugin Installer CLI.
Operation enum.
Command line for Plugin Installation.
Support for copying files during plugin manipulation.
A @{link
FileVisitor which deletes files.A @{link
FileVisitor which detects (and logs) whether a copy would overwrite.A class which will answer questions about a plugin state as of now
(by querying the information Resources for the current published state).
Encapsulation of the information about a given IdP version.
Useful methods for supporting plugins.
Value for support level pointed to by
PluginSupport.SUPPORT_LEVEL_INTERFIX.A version string (Major.minor.patch) as a handy class.
Bridging class to go from a
Matcher to a PolicyRequirementRule.Bridging class to go from a
Matcher to a PolicyRequirementRule.Java definition of PolicyRequirementRule.
Representation of the three outcomes of a PolicyRequirementRule.
Template-based pooled search dn resolver.Attribute consent action to populate the attribute consent context with the attributes for which consent should be
obtained.
Action that populates fields in an
AuditContext using injected functions.Parser for the formatting strings that exposes a final set of field labels that are
present in any of the input formatters.
An action that populates an
AuthenticationContext with the AuthenticationFlowDescriptor
objects configured into the IdP, potential flows filtered by flow IDs from a lookup function.Action that populates the outbound
SAMLBindingContext and when appropriate the
SAMLEndpointContext based on the inbound request.Consent action which populates the current consents of a consent context with the output value of a function whose
input value is a profile request context.
A profile action which determines whether issuance of a delegated
Assertion token
is active, and populates a DelegationContext appropriately.Action that resolves and populates
EncryptionParameters on an EncryptionContext
created/accessed via a lookup function, by default on a RelyingPartyContext child of the
profile request context.Action that adds a
SAMLSelfEntityContext to the inbound MessageContextLocate a pre-validated
Assertion WS-Security token,
and populate the LibertySSOSContext.Profile action that creates a
LogoutPropagationContext containing SPSession to be destroyed.An action that creates and populates a
MultiFactorAuthenticationContext with the set of
transition rules to use for coordinating activity, the executing AuthenticationFlowDescriptor
and with any active "factors" found, if an active result from the MFA flow is present in the
AuthenticationContext.Profile action that populates a
MultiRelyingPartyContext with the relying party
information from a LogoutContext, and extends each RelyingPartyContext
created with a SAMLMetadataContext based on metadata lookup.Populate the outbound message context with data that is specific to the delegation flow.
An profile interceptor action that populates a
ProfileInterceptorContext with
ProfileInterceptorFlowDescriptor objects based on flow IDs from a lookup function.Populates error information needed for protocol error messages.
A profile action that populates a
SessionContext with an active, valid
IdPSession.An action that populates a
SubjectCanonicalizationContext with the
SubjectCanonicalizationFlowDescriptor objects configured into the IdP.An action that populates a principal name obtained from a lookup function into a
SubjectContext
child of the ProfileRequestContext.An action that conditionally populates a
UserAgentContext as a child of the ProfileRequestContext.A function that returns
AuthenticationProfileConfiguration.getPostAuthenticationFlows(org.opensaml.profile.context.ProfileRequestContext)()
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.Factory bean allow property replacements of the direction going in to a
PredicateFilter.Parser for a <Predicate> filter.
Call out to an externally define predicate.
Bean definition parser for
PredicatePolicyRule.Comparator which prefers to order strings according to the order in which they appear in a list, and which falls back
to natural ordering for strings not present in the list.
A context that holds information about an authentication request's
preference for a specific custom
Principal.Action that adds an inbound
MessageContext and a SAMLPeerEntityContext to the
ProfileRequestContext based on the identity of a relying party, by default from a
SAML2SPSession found in a LogoutPropagationContext.Prepares
TicketValidationResponse for use in CAS protocol response views.Profile action that performs initial analysis of a
LogoutRequest or LogoutResponse to
dispatch it for subsequent processing.An attribute definition that creates
ScopedStringAttributeValues by taking a source attribute value splitting
it at a delimiter.Spring bean definition parser for prescoped attributes.
An action that extracts configured parameters from a servlet request and populates
AuthenticationContext.getAuthenticationStateMap() with the data.A function that returns the value of
AuthenticationResult.isPreviousResult()
or null if the input context is null or AuthenticationContext.getAuthenticationResult() is null.A
Predicate to evaluate a Principal that represents a requested form of
authentication against a set of principals supported by a PrincipalSupportingComponent.Generates a
Predicate to evaluate a PrincipalSupportingComponent
against a requested form of authentication expressed in terms of a Principal.Wraps the association of a
PrincipalEvalPredicateFactory against a particular
Principal subtype and a string operator.A registry of mappings between a custom
Principal subtype with a matching operator
and a corresponding PrincipalEvalPredicateFactory that returns predicates enforcing
a particular set of matching rules for that operator and subtype.An attribute definition which returns an attribute with a single value - the principal.
Spring Bean Definition Parser for PrincipalName attribute definitions.
Compare the principal name for this resolution with the provided string.
Compare the principal name for this resolution with the provided regexp.
Bean definition parser for
PrincipalNameRegexpPolicyRule.Bean definition parser for
PrincipalNamePolicyRule.Interface for the serialization/deserialization of principals.
Interface that provides services for a
Principal of a given type.Manages and exposes instances of the
PrincipalService interface.Interface for an authentication component that exposes custom
Principal objects.Perform processing of a SAML 2 Response's Assertions that have been validated by earlier actions
for use in finalization of SAML-based authentication by later actions.
Handler implementation that handles sbf:Framework header on the inbound SOAP envelope.
Profile action that resolves an active session from the profile request, and records it,
populating the associated
SPSession objects into a LogoutContext.Profile action that processes a
LogoutRequest by resolving matching sessions, and destroys them,
populating the associated SPSession objects (excepting the one initiating the logout) into a
LogoutContext.An authentication action that processes the
RequestedAuthnContext in a SAML 2 AuthnRequest,
and populates a RequestedPrincipalContext with the corresponding information.Processes the ticket validation request message from decoded SAML 1.1 message and request parameters.
Handler implementation that handles the sb:Sender header on the inbound SOAP envelope.
Post-processes bean configuration metadata to ensure that stateful beans are scoped properly.
Post-processes
ProfileAction beans by wrapping them in a Spring Web Flow adaptor.Represents the configuration of a particular communication profile.
A
BaseContext which holds flows that are available to be executed, the last flow attempted, and any flow
result.A descriptor for a profile interceptor flow.
Manager of
ProfileInterceptorFlowDescriptor objects.Represents the result of a profile interceptor flow intended for storage by a
StorageService.Compare the profile identifier for this resolution with the provided string.
Exposes the
ProfileRequestContext in a request attribute to make it
accessible outside the Webflow execution pipeline.Bean definition parser for
ProfilePolicyRule.A version of
BufferedOutputStream which provides some idea of progress.A package which is similar to Properties, but allows comments to be preserved.
A POJO which looks like a property.
Implementation of
IdPModule relying on Java Properties.Implementation of
IdPPlugin relying on Java Properties.Context container for CAS protocol request and response messages.
CAS protocol errors.
Protocol parameter name enumeration.
Matcher that checks, via an exact match, if the proxied requester's metadata
contains an entity attribute with a given value.
Parser for
ProxiedRequesterEntityAttributeExactPolicyRule.Matcher that checks, via regex, if the proxied attribute requester's metadata
contains an entity attribute with a given value.
Parser for
ProxiedRequesterEntityAttributeRegexPolicyRule.A matcher that evaluates to true if proxied requester's metadata matches the provided entity group name,
or a valid metadata-sourced affiliation of entities.
Parser for
ProxiedRequesterInEntityGroupPolicyRule.Compare a proxied attribute requester's entity ID for this resolution with the provided name.
Compare a proxied attribute requester's entity ID for this resolution with the provided regexp.
Bean definition parser for
ProxiedRequesterRegexpPolicyRule.Rule based on RPI extension in proxied requester's metadata.
Spring bean definition parser that creates
ProxiedRequesterRegistrationAuthorityPolicyRule beans.Bean definition parser for
ProxiedRequesterPolicyRule.Function that returns ProxyRestriction.getAudiences().A function that returns the first value stored in a
ProxyAuthenticationPrincipal
contained in a Subject.Principal that wraps a set of proxied authentication authorities and any restrictions
on subsequent re-use.
Principal serializer for
ProxyAuthenticationPrincipal.Implements a set of default logic for determining the
RequestedAuthnContext
operator to use.Implements a set of default logic for determining the custom principals to derive the
RequestedAuthnContext from.Implements a set of default logic for determining whether ForceAuthn should be applied.
CAS protocol configuration that applies to the
/proxy URI.Function that returns ProxyRestriction.getProxyCount().A function that returns the allowable proxy count based on the result of
SAML2ProfileConfiguration.getProxyCount(ProfileRequestContext),
if such a profile is available
from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.CAS proxy-granting ticket.
Looks up the PGT from a proxy ticket request.
Serializes proxy-granting tickets in simple field-delimited form.
Container for identifiers used in authenticating a proxy callback endpoint.
A function that returns the allowable proxy count and audiences to include in assertions,
based on the results of lookup functions for local configuration merged with upstream
proxy restrictions to compute a final result in accordance with the standard.
A compound implementation of the
SAML1NameIdentifierGenerator interface that wraps a sequence of
candidate generators along with a default to try if no format-specific options are available.A compound implementation of the
SAML2NameIDGenerator interface that wraps a sequence of
candidate generators along with a default to try if no format-specific options are available.CAS proxy ticket.
Container for proxy ticket request parameters provided to
/proxy URI.Container for proxy ticket response parameters returned from
/proxy URI.Proxy ticket storage serializer.
Strategy pattern component for proxy callback endpoint validation.
Action to publish the CAS protocol request or response messages, i.e.
A function that returns the
NameID Formats
whose NameQualifier attributes should allow for defaulting based on the result of
SingleLogoutProfileConfiguration.getQualifiedNameIDFormats(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.A
DataConnector that queries a relation database in order to retrieve
attribute data.Bean definition Parser for a
RDBMSDataConnector.Utility class for parsing v2 schema configuration.
Consent action which reads consent records from storage and adds the serialized consent records to the consent
context as previous consents.
Action that records the "Response Complete" status on the external context if not done so already.
Predicate that evaluates an
AttributeContext and checks
a specific attribute for value(s) that match a regular expression.An
AttributeDefinition that produces its attribute values by taking the
first group match of a regular expression evaluating against the values of this definition's dependencies.Spring Bean Definition Parser for Regexp split attribute definitions.
Attribute consent action which constrains the attributes released to those consented to.
A set of gauges for a reloadable service.
This class wraps an
AccessControlService in a
ServiceableComponent.Retrieves a per-relying party configuration for a given profile request based on the request context.
This class uses the service interface to implement
MetadataResolver.Service registry wrapper around a
ReloadableService.Action that refreshes or clears a
MetadataResolver manually.Command line processing for reload-metadata flow.
Command line processing for reload-service flow.
Action that refreshes a
ReloadableService manually.The configuration that applies to a given relying party.
Resolves a
RelyingPartyConfiguration for a given profile request context.Support functions for building
RelyingPartyConfiguration objects with SAML functionality.BaseContext containing relying party specific information, usually a
subcontext of ProfileRequestContext.A function that returns
MultiRelyingPartyContext.getCurrentRelyingPartyContext().A function that returns a
RelyingPartyContext based on ID.A function that returns a collection of
RelyingPartyContexts based on a label.A function that returns
RelyingPartyContext.getRelyingPartyId() from a
RelyingPartyContext obtained via a lookup function, by default a child of the ProfileRequestContext.Predicate that evaluates a
ProfileRequestContext by looking for a relying party ID
that matches one of a designated set, or a generic predicate.An implementation of the
loginConfigStrategy for JAASCredentialValidator
which uses a supplied map to resolve the JAAS config to use.This is a utility class used as an auto-wiring source for collections of
signing and encryption
Credential objects so that other layers of the
system can gain access to the complete set of them.The context which carries the user interface information.
IdPModule implementation.Extracts authentication information from the request and returns it via the IdP's external authentication
interface.
IdPModule implementation.Looks up the value of the CAS renew parameter from the request to the /login URI.
A context that holds information about an authentication request's
requirement for a specific custom
Principal.A function that returns
RequestedPrincipalContext.getOperator().A function that returns
RequestedPrincipalContext.getRequestedPrincipals() but
transforms the values into strings.Matcher that checks, via an exact match, if the attribute requester's metadata
contains an entity attribute with a given value.
Parser for
RequesterEntityAttributeExactPolicyRule.Matcher that checks, via regex, if the attribute requester's metadata
contains an entity attribute with a given value.
Parser for
RequesterEntityAttributeRegexPolicyRule.A matcher that evaluates to true if attribute requester's metadata matches the provided entity group name,
or a valid metadata-sourced affiliation of entities.
Parser for
RequesterInEntityGroupPolicyRule.Checks if the attribute requester supports the required NameID format.
Parser for
RequesterNameIDFormatExactPolicyRule.Rule based on RPI extension in attribute requester's metadata.
Spring bean definition parser that creates
RequesterRegistrationAuthorityPolicyRule beans.Parser for a <RequiredValidUntil> filter.
An exception indicating a problem resolving attribute data.
A function that returns
AttributeResolutionContext.getResolutionLabel() if available from a
AttributeResolutionContext obtained via a lookup function defined on the base class.Predicate that evaluates a
ProfileRequestContext by looking for an attribute resolution label
that matches one of a designated set or a generic predicate.Action that invokes the
AttributeResolver for the current request.Predicate to determine whether a profile request should resolve attributes.
Deprecated, for removal: This API element is subject to removal in a future version.
A proxy which wraps a resolved attribute definition and always returns the same attribute.
A proxy which wraps a resolved data connector and always returns the same attributes.
A Dependency that references to an Attribute Definition.
A Dependency that references to an Data Connector.
Interface defining the base work done by all plugins used within attribute resolution.
Command line processing for ResolverTest flow.
Returns the principal name from a
ResolverTestRequest message in the inbound message context.Object representing a request to run the attribute resolution and filtering components.
Decodes an incoming resolver test message.
Parser for a ResourceBackedMetadataProvider.
A function that returns
RelyingPartyConfiguration.getResponderId(org.opensaml.profile.context.ProfileRequestContext)() if
available from a RelyingPartyContext obtained via a lookup function, by default a child of the
ProfileRequestContext.Restores specific portions of the context tree used during logout processing to enable
reuse of logout propagation subflows during back channel logout.
Strategy for mapping from a
ResultSet to a collection of IdPAttributes.This handler can be attached to view or end states that are used to respond to errors,
including RuntimeExceptions, so that if they themselves raise another RuntimeException,
it won't trigger the state again, but just fail the flow.
Extension of SWF's built-in
FlowHandlerAdapter implementation that overrides its
poor assumption that a missing flow exception should result in the flow being restarted.A condition for login flows that checks for revocation against a
RevocationCache.Consent action which deletes a consent record from storage.
A class to rename the property names in a property file, preserving the comments.
An object which does installation rollback in its
AutoCloseable.close() method.Marker interface for transcoders that operate on a SAML 1
Attribute or AttributeDesignator.Spring Bean Definition Parser for
SAML1ByteAttributeTranscoder.Deprecated, for removal: This API element is subject to removal in a future version.
Spring bean definition parser for SAML 1 NameIdentifier attribute definitions.
Marker interface for SAML 1.x profile configuration interfaces, currently empty.
Spring Bean Definition Parser for
SAML1ScopedStringAttributeTranscoder.Marker subtype for a SAML 1 session, adds no actual information other than its identity as
a SAML 1 session.
A function to create a
SAML1SPSession based on profile execution state.A serializer for
SAML1SPSession objects.Spring Bean Definition Parser for
SAML1StringAttributeTranscoder.Spring Bean Definition Parser for
SAML1XMLObjectAttributeTranscoder.Marker interface for transcoders that operate on a SAML 2
Attribute or RequestedAttribute.Message handler implementation that enforces the AuthnRequestsSigned flag of
SAML 2 metadata element @{link
SPSSODescriptor and/or a local profile
configuration option.Spring Bean Definition Parser for
SAML2ByteAttributeTranscoder.Spring Bean Definition Parser for
SAML2DateTimeAttributeTranscoder.Deprecated, for removal: This API element is subject to removal in a future version.
Spring bean definition parser for SAML 2 NameID attribute definitions.
Base interface for SAML 2 profile configurations.
Spring Bean Definition Parser for
SAML2ScopedStringAttributeTranscoder.Extends a
BasicSPSession with SAML 2.0 information required for
reverse lookup in the case of a logout.A function to create a
SAML2SPSession based on profile execution state.A serializer for
SAML2SPSession objects.Spring Bean Definition Parser for
SAML2StringAttributeTranscoder.Spring Bean Definition Parser for
SAML2XMLObjectAttributeTranscoder.Common interface for SAML profile configurations involving artifact production.
Interface for outbound SAML artifact configuration.
Common interface for SAML profile configurations involving artifact consumption, for example artifact
resolution requests.
Constants to use for audit logging fields stored in an
AuditContext.Manages state during proxied SAML authentication.
MVC controller that handles outbound and inbound message I/O for
proxied SAML authentication.
XML related constants used with SAML.
Context, usually attached to
AuthenticationContext,
that carries a SAML Assertion to be validated.Support class for encoding IdP Attributes and their value.
A function to access a
SAMLMetadataContext underlying a RelyingPartyContext located via a
lookup function.A function to access a
SAMLMetadataContext underlying a RelyingPartyContext located via a
lookup function, by default a child of the profile request context.SAML 1.1 protocol params needed to support
/samlValidate endpoint.Common interface for SAML profile configurations.
A lookup strategy that returns a SAML entityID if the
RelyingPartyContext contains a reference
to a SAMLPeerEntityContext or SAMLSelfEntityContext.Body handler impl for use with SAML SOAP message decoders.
A lookup strategy that returns true iff the
RelyingPartyContext contains a reference
to a SAMLPeerEntityContext or SAMLSelfEntityContext that contains a
SAMLMetadataContext such that SAMLMetadataContext.getEntityDescriptor() is non-null.Stores the
LogoutContext in the servlet session to facilitate lookup by logout propagation flows.Saves off specific portions of the context tree in use during logout processing to enable
reuse of logout propagation subflows during back channel logout.
Parser for a <SchemaValidation> filter.
XMLObject for the Shibboleth Scope metadata extension.
Builder of
Scope objects.An attribute definition that creates
ScopedStringAttributeValues by taking a source attribute value and
applying a static scope to each.Spring Bean Definition Parser for scoped attribute definitions.
An attribute value with an associated scope.
XMLObject that represents a SAML attribute value whose value contains a scope attribute.
Builder of
ScopedValue objects.Concrete implementation of
ScopedValue.Marshaller of
ScopedValue objects.Unmarshaller for
ScopedValue objects.Implementation of
Scope.Marshaller for
Scope.Bean definition parser for
AttributeScopeMatchesShibMDScope.A container for all the
Scope elements (attached to either a
EntityDescriptor, IDPSSODescriptor or
AttributeAuthorityDescriptor).An implementation of
MetadataNodeProcessor which extracts Scopes from any
AttributeConsumingService or EntityDescriptor.Unmarshaller for
Scope.Bean definition Parser for a
ScriptedDataConnector.An action which calls out to a supplied script.
An
AttributeDefinition that executes a script in order to populate the
values of the generated attribute.Spring bean definition parser for scripted attribute configuration elements.
A
Function over a BaseContext
which calls out to a supplied script.A Data Connector which populates a series of attributes from a provided
ProfileRequestContext.This is the API which is available to ECMAScripted attributes.
An encapsulated Attribute suitable for handing to scripts.
A
Matcher that delegates to a JSR-223 script for its actual processing.Bean definition parser for
ScriptedPolicyRule or ScriptedMatcher objects.A
PolicyRequirementRule that delegates to a JSR-223 script for its actual
processing.A
Predicate which calls out to a supplied script.HTTPResponseMappingStrategy that relies on a script to map the response to the
attribute set.StorageMappingStrategy that relies on a script to map the record to the
attribute set.Parser for elements derived from ScriptType in the various namespaces.
Principal serializer that encrypts/decrypts the data when serializing.
Strategy for mapping from a
SearchResult to a collection of
IdPAttributes.Configuration for security behavior of profiles.
Namespace handler for
AbstractMetadataProviderParser.SECURITY_NAMESPACE.An authentication action that selects an authentication flow to invoke, or re-uses an
existing result for SSO.
A profile action that selects a logout propagation flow to invoke.
Action that selects the
ProfileConfiguration for the given request and sets it in the looked-up
RelyingPartyContext.Action that selects the
ProfileConfiguration for the given message context and sets it in the looked-up
RelyingPartyContext.A profile interceptor action that selects flows to invoke.
This action attempts to resolve a
RelyingPartyConfiguration and adds it to the RelyingPartyContext
that was looked up.This message handler attempts to resolve a
RelyingPartyConfiguration and adds it to the
RelyingPartyContext that was looked up.A canonicalization action that selects a canonicalization flow to invoke.
A function that returns a
EncryptionConfiguration list intended for self-encryption cases.Task to shim around
SelfSignedCertificateGenerator.Container for metadata about a CAS service (i.e.
return the contactInfo for the SP or null.
IdP context container for CAS service (i.e.
Defines a registered CAS service (i.e.
Display the description from the <mdui:UIInfo>.
Adapts CAS protocol service metadata onto SAML metadata.
Service InformationURL - directly from the metadata if present.
Logo for the SP.
Looks up the service URL from the CAS protocol request.
Display the serviceName.
Service PrivacyURL - directly from the metadata if present.
Registry for explicitly verified CAS services (relying parties).
Display the serviceName.
CAS service ticket.
Describes a request for a ticket to access a service.
CAS protocol response message for a successfully granted service ticket.
Serializes service tickets in simple field-delimited form.
Looks up the profile request context from a servlet request attribute.
A
BaseContext that holds an IdPSession.A function that returns the session ID from the session inside a
SessionContext.A function that returns the principal name from the session inside a
SessionContext.Exception indicating a problem authenticating a user.
Criterion representing a session ID.Function that returns SessionIndex values from assertions in a response or a logout request.A function that returns
BrowserSSOProfileConfiguration.getMaximumSPSessionLifetime(ProfileRequestContext)
if such a profile is available from a RelyingPartyContext obtained via a lookup function,
by default a child of the ProfileRequestContext.Component that manages sessions between the IdP and client devices.
A resolver that is capable of finding
IdPSession objects that meet certain criteria.A strategy function that examines SAML metadata associated with a relying party and derives Set<String>-valued
configuration settings based on EntityAttribute extension tags.
Action to populate the
ProfileRequestContext with a RelyingPartyUIContext.A predicate implementation that forwards to
SAMLArtifactConsumerProfileConfiguration.isSignArtifactRequests(MessageContext).A predicate implementation that forwards to
SAMLProfileConfiguration.isSignAssertions(ProfileRequestContext).Parser for trust engines of type SignatureChaining.
A
MessageContext function that returns a SignatureSigningConfiguration list
by way of various lookup strategies.A function that returns a
SignatureSigningConfiguration list by way of various lookup strategies.A
MessageContext function that returns a SignatureValidationConfiguration list
by way of various lookup strategies.A function that returns a
SignatureValidationConfiguration list by way of various lookup strategies.Factory bean impl for producing a
CriteriaSet instance specialized for signature validation use
cases, such as input to the SignatureValidationFilter.Parser for xsi:type="SignatureValidation".
Credential resolver whose purpose is to resolve configured IdP signing credentials.
A predicate implementation that forwards to
SAMLProfileConfiguration.isSignRequests(ProfileRequestContext)
or follows IDPSSODescriptor.getWantAuthnRequestsSigned() if so configured.A predicate implementation that forwards
to
SAMLProfileConfiguration.isSignResponses(ProfileRequestContext).A predicate implementation that forwards to
SingleLogoutProfileConfiguration.isSignSOAPRequests(MessageContext).An
AttributeDefinition that creates an attribute whose values are the
values of all its dependencies.Bean definition parser for a
SimpleAttributeDefinition.Predicate that evaluates an
AttributeContext and checks
for particular attribute/value pairs.A default, immutable, implementation of a
CSRFToken.Principal serializer for string-based principals that serialize to a simple JSON structure.
MappingStrategy for pulling data out of StorageRecord.An action that operates on a
SubjectCanonicalizationContext child of the current
ProfileRequestContext, and transforms the input Subject
into a principal name by searching for one and only one UsernamePrincipal custom principal.A predicate that determines if this action can run or not.
Simple CAS ticket management service that delegates storage to
StorageService.Configuration support for SAML 2 Single Logout.
Servlet filter that sets some interesting MDC attributes as the request comes in and clears the MDC as the response
is returned.
Predicate that decides whether to handle an error by returning a SOAP fault to a requester
or fail locally.
Profile action that propagates a prepared
LogoutRequest message to an SP via the SOAP
binding, encapsulating SOAP pipeline construction and execution.Represents incoming attribute values and rules used for matching them.
Bean definition parser for a
SourceValue.Function that returns the SPNameQualifier from a SAML Subject.IdPModule implementation.MVC controller for managing the SPNEGO exchanges implemented as an
ExternalAuthentication mechanism.Component managing the auto-login state via cookie.
Context, usually attached to
AuthenticationContext,
that carries configuration data and request state for SPNEGO authentication.A function that returns the correct
MessageDecoder to use based on a simple map of
strings to bean IDs.A function that returns the correct
MessageEncoder to use based on an underlying BindingDescriptor.A function that returns a view name to render based on a Spring Web Flow
Event.A
Function over a BaseContext
which calls out to a Spring Expression.Predicate whose condition is defined by an Spring EL expression.
A lookup function that fetches a SWF flow scope parameters.
A
BaseContext which holds the Spring WebFlow RequestContext in which the
overall parent context is operating.A function that returns a status message to include, if any, in a SAML response based on the current
profile request context state, using Spring's
MessageSource functionality.Describes a session with a service in turn associated with an
IdPSession.Criterion representing a service ID and an implementation-specific service session key.Deprecated, for removal: This API element is subject to removal in a future version.
A registry of mappings between a
SPSession class and a corresponding StorageSerializer
for that type.Wrapper type for auto-wiring serializers.
Configuration support for the Liberty ID-WSF SSOS profile.
An attribute definition that simply returns a static value.
A
DataConnector that just returns a static collection of
attributes.Bean definition Parser for a
StaticDataConnector.Factory bean for simple use cases involving the
ExplicitKeyTrustEngine and static credentials.Parser for trust engines of type StaticExplicitKey TrustEngine.
Parser for trust engines of type StaticExplicitKeySignature.
File system specific bean for PKIXX509CredentialTrustEngine.
Parser for trust engines of type StaticPKIXKeySignature.
Parser for trust engines of type StaticPKIXX509Credential.
Command line processing for status flow.
Function that returns the StatusCode from a response.Looks up the protocol message status code from a CAS protocol message response.
Looks up the protocol message status detail from a CAS protocol message response.
Function that returns the StatusMessage from a response.Implementation of
AccountLockoutManager interface that relies on a StorageService
to track lockout state.A function to generate a key for lockout storage.
Implementation of
IdPSession for use with StorageBackedSessionManager.A serializer for instances of
StorageBackedIdPSession designed in conjunction with the
StorageService-backed SessionManager implementation.Implementation of
SessionManager and SessionResolver interfaces that relies on a
StorageService for persistence and lifecycle management of data.Simplifies Spring wiring of a true/false condition for the consistentAddress feature.
Strategy for mapping from a
StorageRecord to a collection of IdPAttribute objects.This class implements a
DataConnector
that obtains data from a StorageService.Bean definition Parser for a
StorageServiceDataConnector.Utility class for parsing v2 schema configuration.
A search that can be executed against a
StorageService to fetch a result.Spring bean definition parser for StoredIDDataConnector.
An abstract decoder which contains the logic to decode SAML persistent IDs that are managed with a
DurablePairwiseIdStore.Generates transients using a
StorageService to manage the reverse mappings.Base class for
IdPAttribute values that are strings.Deprecated.
Replaced by api class.
A simple
SearchResultMappingStrategy that iterates over all result entries and includes all attribute values
as strings.A strategy function that examines SAML metadata associated with a relying party and derives String-valued
configuration settings based on EntityAttribute extension tags.
Deprecated.
Replaced by api class.
A simple
ResultMappingStrategy that assumes all columns in the result set should be mapped and that all
values are strings.This code is copied verbatim from org.springframework.webflow.engine.builder.model.SubflowExpression
A context that holds an input
Subject to canonicalize into a principal name, and
the collection of c14n flows to attempt.A function that returns the
Subject from a SubjectCanonicalizationContext.Exception indicating a problem translating a subject between forms.
A descriptor for a subject canonicalization flow.
A context that holds information about the subject of a request.
A function that returns the impersonating principal name from a
SubjectContext.A function that returns the principal name from a
SubjectContext.A
DataConnector that extracts all
IdPAttributePrincipal objects from the Subject objects associated
with the request.Bean definition Parser for a
SubjectDataConnector.Spring Bean Definition Parser for attribute definitions derived from the Principal.
A Function which returns
IdPAttributeValues derived from the Principals
associated with the request.Function that returns the lower-level StatusCode(s) from a response.A predicate that evaluates a
ProfileRequestContext and extracts the effective
setting of BrowserSSOProfileConfiguration.isSuppressAuthenticatingAuthority(ProfileRequestContext).An attribute definition that constructs its values based on the values of its dependencies using the Velocity
Template Language.
Spring bean definition parser for templated attribute definition elements.
An
ExecutableSearchBuilder that generates a
request by evaluating Templates against the currently resolved attributes within an
AttributeResolutionContext to produce a URL and body, via GET or POST, and a configurable
cache key.Deprecated.
Replaced by api class.
An
ExecutableSearchBuilder that generates the search filter to
be executed by evaluating a Template against the currently resolved attributes within a
AttributeResolutionContext.Escapes LDAP attribute values added to the template context.
Deprecated.
Replaced by api class.
An
ExecutableSearchBuilder that generates the SQL statement to
be executed by evaluating a Template against the currently resolved attributes within a
AttributeResolutionContext.Escapes SQL values added to the template context.
An
ExecutableSearchBuilder that generates the StorageService context and key
using Velocity templates.An
ExecutableSearchBuilder that generates the URL to
request by evaluating a Template against the currently resolved attributes within an
AttributeResolutionContext.Template-based search dn resolver.Generic CAS ticket that has a natural identifier and expiration.
IdP context that stores a granted CAS ticket.
Generates CAS protocol ticket identifiers of the form:
Strategy for ticket generation.
Looks up the service (proxy) ticket provided in a CAS protocol request or produced in a CAS protocol response.
Looks up a principal name stored in a CAS ticket:
ProfileRequestContext -> ProtocolContext -> TicketContext ->
Ticket.getTicketState() -> TicketState.getPrincipalName().CAS ticket management service.
Supplemental state data to be stored with a ticket.
Ticket validation request message.
Service ticket validation response protocol message.
A factory bean for producing instances of
LayeredConnectionSocketFactory for use in HttpClient.Principal based on a TOTP authentication.
Support functions for working with
AttributeTranscoder framework.Wrapper around a
Map representing a rule for transcoding, used to
detect and load the rules at runtime from a Spring context.A mechanism for loading a set of
TranscodingRule objects from sources such as maps
or directories of property files.Function that returns the transformed username in a subordinate UsernamePasswordContext,
if any.Transform from a
NameID.Transform from a
NameIdentifier.Generates and manages transient identifiers according to specific strategies.
The Parameters we need to store in, and get out of a transient ID, namely the attribute recipient (aka the SP) and
the principal.
Decodes
XSString.getValue() via the base class (reversing the work done by
TransientSAML2NameIDGenerator).Decodes
XSString.getValue() via the base class (reversing the work done by
TransientSAML1NameIdentifierGenerator).Generator for transient
NameIdentifier objects.Generator for transient
NameID objects.An authentication action that acts as the driver regulating execution of transitions
between MFA stages.
Code to handle (load, update, check) the trust store for an individual plugin.
An opaque handle around a
PGPSignature.An implementation of
MetadataNodeProcessor which processes any UIInfos
into an IdPUIInfo and processes any AttributeConsumingService into an
ACSUIInfo.Action that sets keystore and key passwords for one or more DataSealer KeyStrategy
objects based on query parameters.
IdPModule implementation.Action that creates private key objects and injects them into existing
MutableCredential objects.Exception thrown when a particular
IdPAttributeValue type was expected but a
different one was encountered.Consent action which maintains a storage record whose value is the current time in milliseconds.
Conditionally updates the
IdPSession with a CASSPSession to support SLO.Action that updates inbound and/or outbound instances of
SAMLSelfEntityContext
based on the identity of a relying party accessed via a lookup strategy,
by default an immediate child of the profile request context.An authentication action that establishes a record of the
AuthenticationResult
in an IdPSession for the client, either by updating an existing session or creating a new one.An action that establishes a record of an
SPSession in an existing IdPSession for the client.A context containing data about the user agent.
Context that carries a username (without a password) to be validated.
Context that carries a username/password pair to be validated.
Principal based on a username.
A
TemplatedExecutableSearchFilterBuilder which also injects an
V2SAMLProfileRequestContext into the spring context.A
TemplatedExecutableStatementBuilder which also injects an
V2SAMLProfileRequestContext into the spring context.Emulation code for Scripted Attributes.
Code to do most of the V4 Install.
A thin veneer around the V4 installer.
CAS protocol configuration.
An action that processes a list of
CredentialValidator objects to produce an AuthenticationResult.A default cleanup hook that removes the
UsernamePasswordContext from the tree.An action that checks for a
DuoAuthenticationContext and directly produces an
AuthenticationResult based on that identity by authenticating against the Duo
AuthAPI.An action that validates a DuoWeb response message and produces an
AuthenticationResult or records error state.An action that checks for an
ExternalAuthenticationContext and directly produces an
AuthenticationResult or records error state based on the
contents.A default cleanup hook that removes a
CertificateContext from the tree.An action that executes a deployer-supplied function and produces an
AuthenticationResult based on the function result.Validates the proxy callback URL provided in the service ticket validation request and creates a PGT when
the proxy callback is successfully authenticated.
An action that checks for a
UsernameContext and directly produces an
AuthenticationResult based on that identity.Ensures that a service ticket validation request that specifies renew=true matches the renew flag on the ticket
that is presented for validation.
An action that produces an
AuthenticationResult based on an inbound
SAML 2.0 SSO response.CAS protocol service ticket validation action.
An action that ensures that a user-agent address found within a
UserAgentContext
is within a given range and generates an AuthenticationResult.Exception thrown by
Validators when validation fails.Used to determine whether a Data Connector initialized properly and continues to be fit for use.
Performs many to one mapping of source values to a return value.
Bean definition parser for a
ValueMap.Bean definition parser for
AttributeValueMatchesShibMDScope.Predicate to determine whether a profile request is from a verified source.
Class for getting and printing the version of the IdP.
IdPModule implementation.A
Function that checks for cases in which the webflow's current event is not reflected by
an attached EventContext and compensates, along with returning a suitably populated context.An
AbstractProfileAction subclass that adapts an OpenSAML MessageHandler for execution
in a Spring WebFlow environment.Used to indicate the target message context for invocation of the adapted message handler.
Adaptor that wraps a
ProfileAction with a Spring Web Flow compatible action implementation
so that it can be executed as part of a flow.A
Function that extracts the ProfileRequestContext from the current Webflow conversation.Action that produces audit log entries based on an
AuditContext and one or more formatting strings.Action that produces F-TICKS log entries for successful SAML SSO responses.
A profile interceptor action that writes a
ProfileInterceptorResult to a StorageService.CAS 1.0 protocol response handler.
Principal serializer for
X500Principal.An action that operates on a
SubjectCanonicalizationContext child of the current
ProfileRequestContext, and transforms the input Subject
into a principal name by searching for one and only one X509Certificate public credential,
or in its absence one and only one X500Principal.A predicate that determines if this action can run or not.
IdPModule implementation.Servlet compatible with the
ExternalAuthentication interface that extracts and validates
an X.509 client certificate for user authentication.A credential validator that validates an X.509 certificate.
A factory bean to understand X509Inline credentials.
Parser for X509Inline credentials.
Servlet filter to translate Apache mod_ssl certificate variables into Java servlet attributes.
Implementation of
CredentialConfig that loads trust and key material using a Resource.Parser for X509Filesystem credentials.
A
XMLObjectAttributeValue value for an IdPAttribute.XMLObject provider initializer for providers from OpenLiberty used in delegation.
XMLObject provider initializer for module "saml-impl".