Package net.shibboleth.idp.authn

Class AbstractValidationAction

    • Field Detail

      • log

        @Nonnull
private final org.slf4j.Logger log
        Class logger.

      • metricName

        @Nonnull
@NotEmpty
private String metricName
        Base name of metrics.

      • addDefaultPrincipals

        private boolean addDefaultPrincipals
        Whether to inject the authentication flow's default custom principals into the subject.

      • clearErrorContext

        private boolean clearErrorContext
        Indicates whether to clear any existing AuthenticationErrorContext before execution.

      • resultCachingPredicate

        @Nullable
private Predicate<ProfileRequestContext> resultCachingPredicate
        Predicate to apply when setting AuthenticationResult cacheability.

    • Constructor Detail

      • AbstractValidationAction

        public AbstractValidationAction()
        Constructor.

    • Method Detail

      • getMetricName

        @Nonnull
@NotEmpty
public String getMetricName()
        Get the base name to use for metrics reported.
        Returns:
        root for name of metrics
        Since:
        3.3.0

      • setMetricName

        public void setMetricName​(@Nonnull @NotEmpty
                          String name)
        Set the base name to use for metrics reported.
        Parameters:
        name - root for name of metrics
        Since:
        3.3.0

      • addDefaultPrincipals

        public boolean addDefaultPrincipals()
        Get whether to inject the authentication flow's default custom principals into the subject.

        This is the default behavior, and works for static flows in which the principal set can be statically determined from the flow.

        Returns:
        whether to inject the authentication flow's default custom principals into the subject

      • setAddDefaultPrincipals

        public void setAddDefaultPrincipals​(boolean flag)
        Set whether to inject the authentication flow's default custom principals into the subject.
        Parameters:
        flag - flag to set

      • setClassifiedMessages

        public void setClassifiedMessages​(@Nullable @NonnullElements
                                  Map<String,​Collection<String>> messages)
        Set the error messages to map to specific events.

        The map keys are the events and the values are the message collections.

        Parameters:
        messages - the error message / event mappings to set

      • setResultCachingPredicate

        public void setResultCachingPredicate​(@Nullable
                                      Predicate<ProfileRequestContext> predicate)
        Set predicate to apply to determine cacheability of AuthenticationResult.
        Parameters:
        predicate - predicate to apply, or null

      • getCleanupHook

        @Nullable
public Consumer<ProfileRequestContext> getCleanupHook()
        Get the cleanup hook to execute after successful validation.
        Returns:
        cleanup hook
        Since:
        4.1.0

      • setCleanupHook

        public void setCleanupHook​(@Nullable
                           Consumer<ProfileRequestContext> hook)
        Set the cleanup hook to execute after successful validation.
        Parameters:
        hook - cleanup hook
        Since:
        4.1.0

      • getRequesterLookupStrategy

        @Nullable
public Function<ProfileRequestContext,​String> getRequesterLookupStrategy()
        Get the strategy used to locate the requester ID for canonicalization.
        Returns:
        lookup strategy
        Since:
        4.0.0

      • setRequesterLookupStrategy

        public void setRequesterLookupStrategy​(@Nullable
                                       Function<ProfileRequestContext,​String> strategy)
        Set the strategy used to locate the requester ID for canonicalization.
        Parameters:
        strategy - lookup strategy

      • getResponderLookupStrategy

        @Nullable
public Function<ProfileRequestContext,​String> getResponderLookupStrategy()
        Get the strategy used to locate the responder ID for canonicalization.
        Returns:
        lookup strategy
        Since:
        4.0.0

      • setResponderLookupStrategy

        public void setResponderLookupStrategy​(@Nullable
                                       Function<ProfileRequestContext,​String> strategy)
        Set the strategy used to locate the responder ID for canonicalization.
        Parameters:
        strategy - lookup strategy

      • setSupportedPrincipals

        public void setSupportedPrincipals​(@Nullable @NonnullElements
                                   Collection<Principal> principals)
        Set supported non-user-specific principals that the action will include in the subjects it generates, in place of any default principals from the flow.

        Setting to a null or empty collection will maintain the default behavior of relying on the flow.

        Parameters:
        principals - supported principals to include

      • getSubject

        @Nonnull
protected Subject getSubject()
        Get the subject to be produced by successful execution of this action.
        Returns:
        the subject meant as the result of this action

      • doPreExecute

        protected boolean doPreExecute​(@Nonnull
                               ProfileRequestContext profileRequestContext,
                               @Nonnull
                               AuthenticationContext authenticationContext)
        Performs this authentication action's pre-execute step. Default implementation just returns true.
        Overrides:
        doPreExecute in class AbstractAuthenticationAction
        Parameters:
        profileRequestContext - the current IdP profile request context
        authenticationContext - the current authentication context
        Returns:
        true iff execution should continue

      • populateSubject

        @Nonnull
protected abstract Subject populateSubject​(@Nonnull
                                           Subject subject)
        Subclasses must override this method to complete the population of the Subject with Principal and credential information based on the validation they perform.

        Typically this will include attaching a UsernamePrincipal, but this is not a requirement if other components are suitably overridden.

        Parameters:
        subject - subject to populate
        Returns:
        the input subject

      • recordSuccess

        @Deprecated(since="4.1.0",
            forRemoval=true)
protected void recordSuccess()
        Deprecated, for removal: This API element is subject to removal in a future version.
        Record a successful authentication attempt against the configured counter. Records nothing if the metrics registry is not installed into the runtime.
        Since:
        3.3.0

      • recordFailure

        @Deprecated(since="4.1.0",
            forRemoval=true)
protected void recordFailure()
        Deprecated, for removal: This API element is subject to removal in a future version.
        Record a failed authentication attempt against the configured counter. Records nothing if the metrics registry is not installed into the runtime.
        Since:
        3.3.0

      • recordSuccess

        protected void recordSuccess​(@Nonnull
                             ProfileRequestContext profileRequestContext)
        Record a successful authentication attempt against the configured counter. Records nothing if the metrics registry is not installed into the runtime.
        Parameters:
        profileRequestContext - profile request context
        Since:
        4.1.0

      • recordFailure

        protected void recordFailure​(@Nonnull
                             ProfileRequestContext profileRequestContext)
        Record a failed authentication attempt against the configured counter. Records nothing if the metrics registry is not installed into the runtime.
        Parameters:
        profileRequestContext - profile request context
        Since:
        4.1.0

      • handleError

        protected void handleError​(@Nonnull
                           ProfileRequestContext profileRequestContext,
                           @Nonnull
                           AuthenticationContext authenticationContext,
                           @Nonnull
                           Exception e,
                           @Nonnull @NotEmpty
                           String eventId)
        Adds an exception encountered during the action to an AuthenticationErrorContext, creating one if necessary, beneath the AuthenticationContext.

        The exception message is evaluated as a potential match as a "classified" error and if matched, the classification label is attached to the AuthenticationErrorContext and used as the resulting event for the action.

        Parameters:
        profileRequestContext - the current profile request context
        authenticationContext - the current authentication context
        e - the exception to process
        eventId - the event to "return" via an EventContext if the exception message is not classified

      • handleError

        protected void handleError​(@Nonnull
                           ProfileRequestContext profileRequestContext,
                           @Nonnull
                           AuthenticationContext authenticationContext,
                           @Nullable
                           String message,
                           @Nonnull @NotEmpty
                           String eventId)
        Evaluates a message as a potential match as a "classified" error and if matched, the classification label is attached to an AuthenticationErrorContext and used as the resulting event for the action.

        If no match, the supplied eventId is used as the result.

        If multiple matches, the first matching label is used as the result, but each match is added to the context.

        Parameters:
        profileRequestContext - the current profile request context
        authenticationContext - the current authentication context
        message - to process
        eventId - the event to "return" via an EventContext if the message is not classified

      • handleWarning

        protected void handleWarning​(@Nonnull
                             ProfileRequestContext profileRequestContext,
                             @Nonnull
                             AuthenticationContext authenticationContext,
                             @Nullable
                             String message,
                             @Nonnull @NotEmpty
                             String eventId)
        Evaluates a message as a potential match as a "classified" warning and if matched, the classification label is attached to an AuthenticationWarningContext and used as the resulting event for the action.

        If no match, the supplied eventId is used as the result.

        If multiple matches, the first matching label is used as the result, but each match is added to the context.

        Parameters:
        profileRequestContext - the current profile request context
        authenticationContext - the current authentication context
        message - to process
        eventId - the event to "return" via an EventContext if the message is not classified