Class AuthenticationFlowDescriptor
- java.lang.Object
-
- net.shibboleth.utilities.java.support.component.AbstractInitializableComponent
-
- net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent
-
- net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent
-
- net.shibboleth.idp.authn.AuthenticationFlowDescriptor
-
- All Implemented Interfaces:
Predicate<ProfileRequestContext>,PrincipalSupportingComponent,FlowDescriptor,Component,DestructableComponent,IdentifiableComponent,IdentifiedComponent,InitializableComponent,StorageSerializer<AuthenticationResult>,Ordered
public class AuthenticationFlowDescriptor extends AbstractIdentifiableInitializableComponent implements FlowDescriptor, PrincipalSupportingComponent, Predicate<ProfileRequestContext>, StorageSerializer<AuthenticationResult>, Ordered
A descriptor for an authentication flow.A flow models a sequence of profile actions that performs authentication in a particular way and satisfies various constraints that may apply to an authentication request. Some of these constraints are directly exposed as properties of the flow, and others can be found by examining the list of extended
Principals that the flow exposes.
-
-
Nested Class Summary
Nested Classes Modifier and Type Class Description private classAuthenticationFlowDescriptor.ProxyCountPredicateAPredicatethat implements a cross-check between an effective proxy count of zero and whether a descriptor is honoring the limit.private classAuthenticationFlowDescriptor.WeightedComparator<T>AComparatorthat compares the mapped weights of the two operands, using a weight of zero for any unmapped values.
-
Field Summary
Fields Modifier and Type Field Description private Predicate<ProfileRequestContext>activationConditionPredicate that must be true for this flow to be usable for a given request.private booleandiscoveryRequiredWhether this flow should invoke discovery if no authenticating authority populated.static StringFLOW_ID_PREFIXPrefix convention for flow IDs.private DurationinactivityTimeoutMaximum amount of time since last usage that a flow should be considered active.private DurationlifetimeMaximum amount of time since first usage that a flow should be considered active.private intorderSpring auto-wiring order.private PrincipalServiceManagerprincipalServiceManagerAccess to principal services.private Map<Principal,Integer>principalWeightMapWeighted sort oredering of custom Principals produced by flow(s).private booleanproxyRestrictionsEnforcedWhether this flow should honor proxy restrictions toward RPs.private booleanproxyScopingEnforcedWhether this flow should honor proxy scoping restrictions toward IdPs.private StorageSerializer<AuthenticationResult>resultSerializerCustom serializer for the results generated by this flow.private Predicate<ProfileRequestContext>reuseConditionWhether this flow allows reuse of its results.private BiPredicate<ProfileRequestContext,AuthenticationResult>revocationConditionWhether a result from this flow should be considered revoked.static DurationSTORAGE_EXPIRATION_OFFSETAdditional allowance for storage of result records to avoid race conditions during use.private Set<String>stringBasedPrincipalsSupported principals provided by delimited strings, for post-initialization override viaPrincipalServiceManager.private BiConsumer<ProfileRequestContext,Subject>subjectDecoratorCustomizes subject prior to triggering subject canonicalization.private SubjectsupportedPrincipalsSupported principals, indexed by type, that the flow can produce.private booleansupportsForcedWhether this flow supports forced authentication.private booleansupportsNonBrowserWhether this flow supports non-browser clients.private booleansupportsPassiveWhether this flow supports passive authentication.-
Fields inherited from interface org.springframework.core.Ordered
HIGHEST_PRECEDENCE, LOWEST_PRECEDENCE
-
-
Constructor Summary
Constructors Constructor Description AuthenticationFlowDescriptor()Constructor.
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description AuthenticationResultdeserialize(long version, String context, String key, String value, Long expiration)protected voiddoInitialize()booleanequals(Object obj)<T extends Principal>
TgetHighestWeighted(Collection<T> principals)Apply the current weighted map to find the highest-weighted object amongst the inputs.DurationgetInactivityTimeout()Get the maximum amount of time, since the last usage, a flow should be considered active.DurationgetLifetime()Get the maximum amount of time, since first usage, a flow should be considered active.intgetOrder()Predicate<ProfileRequestContext>getReuseCondition()Get condition controlling whether results from this flow should be reused for SSO.BiPredicate<ProfileRequestContext,AuthenticationResult>getRevocationCondition()Get condition controlling whether a result from this flow should be considered revoked.BiConsumer<ProfileRequestContext,Subject>getSubjectDecorator()Gets a subject decorating component called prior to completing authentication and passing control to subject canonicalization.Collection<Principal>getSupportedPrincipals()Get a collection of supported non-user-specific principals that the flow may produce when it operates.<T extends Principal>
Set<T>getSupportedPrincipals(Class<T> c)Get an immutable set of supported custom principals that the component produces, supports, contains, etc.inthashCode()booleanisDiscoveryRequired()Gets whether to invoke discovery subflow ifAuthenticationContext.getAuthenticatingAuthority()is null.booleanisForcedAuthenticationSupported()Get whether this flow supports forced authentication.booleanisNonBrowserSupported()Get whether this flow supports non-browser clients.booleanisPassiveAuthenticationSupported()Get whether this flow supports passive authentication.booleanisProxyRestrictionsEnforced()Gets whether this flow's results should honor restrictions on proxying toward RPs.booleanisProxyScopingEnforced()Gets whether this flow's results should honor restrictions on proxying toward IdPs.booleanisResultActive(AuthenticationResult result)Check if a result generated by this flow is still active.AuthenticationResultnewAuthenticationResult(Subject subject)Creates a new instance of a compatibleAuthenticationResultfor use with the corresponding flow.Stringserialize(AuthenticationResult instance)voidsetActivationCondition(Predicate<ProfileRequestContext> condition)Set the activation condition in the form of aPredicatesuch that iff the condition evaluates to true should the corresponding flow be allowed/possible.voidsetDiscoveryRequired(boolean flag)Sets whether to invoke discovery subflow ifAuthenticationContext.getAuthenticatingAuthority()is null.voidsetForcedAuthenticationSupported(boolean isSupported)Set whether this flow supports forced authentication.voidsetInactivityTimeout(Duration timeout)Set the maximum amount of time, since the last usage, a flow should be considered active.voidsetLifetime(Duration flowLifetime)Set the maximum amount of time, since first usage, a flow should be considered active.voidsetNonBrowserSupported(boolean isSupported)Set whether this flow supports non-browser clients.voidsetOrder(int priority)Set the order/priority value for the bean.voidsetPassiveAuthenticationSupported(boolean isSupported)Set whether this flow supports passive authentication.voidsetPrincipalServiceManager(PrincipalServiceManager manager)Sets aPrincipalServiceManagerto use for string-based principal processing.voidsetPrincipalWeightMap(Map<Principal,Integer> map)Set the map of Principals to weight values to impose a sort order on any matching Principals found in the authentication result.voidsetProxyRestrictionsEnforced(boolean flag)Sets whether this flow's results should honor restrictions on proxying toward RPsvoidsetProxyScopingEnforced(boolean flag)Sets whether this flow's results should honor restrictions on proxying toward IdPs.voidsetResultSerializer(StorageSerializer<AuthenticationResult> serializer)Set a custom serializer for results produced by this flow.voidsetReuseCondition(Predicate<ProfileRequestContext> condition)Set condition controlling whether results from this flow should be reused for SSO.voidsetRevocationCondition(BiPredicate<ProfileRequestContext,AuthenticationResult> condition)Set condition controlling whether a result from this flow should be considered revoked.voidsetSubjectDecorator(BiConsumer<ProfileRequestContext,Subject> decorator)Sets a subject decorating component called prior to completing authentication and passing control to subject canonicalization.voidsetSupportedPrincipals(Collection<Principal> principals)Set supported non-user-specific principals that the flow may produce when it operates.voidsetSupportedPrincipalsByString(Collection<String> principals)Set supported non-user-specific principals that the flow may produce when it operates.booleantest(ProfileRequestContext input)StringtoString()-
Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent
setId
-
Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent
getId
-
Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent
destroy, doDestroy, initialize, isDestroyed, isInitialized
-
Methods inherited from class java.lang.Object
clone, finalize, getClass, notify, notifyAll, wait, wait, wait
-
Methods inherited from interface net.shibboleth.utilities.java.support.component.DestructableComponent
destroy, isDestroyed
-
Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiableComponent
setId
-
Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiedComponent
getId
-
Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent
initialize, isInitialized
-
-
-
-
Field Detail
-
FLOW_ID_PREFIX
@Nonnull @NotEmpty public static final String FLOW_ID_PREFIX
Prefix convention for flow IDs.- See Also:
- Constant Field Values
-
STORAGE_EXPIRATION_OFFSET
@Nonnull public static final Duration STORAGE_EXPIRATION_OFFSET
Additional allowance for storage of result records to avoid race conditions during use.
-
order
private int order
Spring auto-wiring order.
-
supportsNonBrowser
private boolean supportsNonBrowser
Whether this flow supports non-browser clients.
-
supportsPassive
private boolean supportsPassive
Whether this flow supports passive authentication.
-
supportsForced
private boolean supportsForced
Whether this flow supports forced authentication.
-
proxyRestrictionsEnforced
private boolean proxyRestrictionsEnforced
Whether this flow should honor proxy restrictions toward RPs.
-
proxyScopingEnforced
private boolean proxyScopingEnforced
Whether this flow should honor proxy scoping restrictions toward IdPs.
-
discoveryRequired
private boolean discoveryRequired
Whether this flow should invoke discovery if no authenticating authority populated.
-
reuseCondition
@Nonnull private Predicate<ProfileRequestContext> reuseCondition
Whether this flow allows reuse of its results.
-
revocationCondition
@Nullable private BiPredicate<ProfileRequestContext,AuthenticationResult> revocationCondition
Whether a result from this flow should be considered revoked.
-
lifetime
@Nullable private Duration lifetime
Maximum amount of time since first usage that a flow should be considered active.
-
inactivityTimeout
@Nonnull private Duration inactivityTimeout
Maximum amount of time since last usage that a flow should be considered active.
-
stringBasedPrincipals
@Nonnull private Set<String> stringBasedPrincipals
Supported principals provided by delimited strings, for post-initialization override viaPrincipalServiceManager.
-
supportedPrincipals
@Nonnull private Subject supportedPrincipals
Supported principals, indexed by type, that the flow can produce. Implemented for the moment using the Subject class for convenience to allow for class-based lookup in thegetSupportedPrincipals(java.lang.Class<T>)method.
-
activationCondition
@Nonnull private Predicate<ProfileRequestContext> activationCondition
Predicate that must be true for this flow to be usable for a given request.
-
resultSerializer
@Nullable private StorageSerializer<AuthenticationResult> resultSerializer
Custom serializer for the results generated by this flow.
-
principalWeightMap
@Nullable @NonnullElements private Map<Principal,Integer> principalWeightMap
Weighted sort oredering of custom Principals produced by flow(s).
-
principalServiceManager
@Nullable private PrincipalServiceManager principalServiceManager
Access to principal services.
-
subjectDecorator
@Nullable private BiConsumer<ProfileRequestContext,Subject> subjectDecorator
Customizes subject prior to triggering subject canonicalization.
-
-
Method Detail
-
setOrder
public void setOrder(int priority)
Set the order/priority value for the bean.- Parameters:
priority- priority value
-
isNonBrowserSupported
public boolean isNonBrowserSupported()
Get whether this flow supports non-browser clients.- Returns:
- whether this flow supports non-browser clients
-
setNonBrowserSupported
public void setNonBrowserSupported(boolean isSupported)
Set whether this flow supports non-browser clients.- Parameters:
isSupported- whether this flow supports non-browser clients
-
isPassiveAuthenticationSupported
public boolean isPassiveAuthenticationSupported()
Get whether this flow supports passive authentication.- Returns:
- whether this flow supports passive authentication
-
setPassiveAuthenticationSupported
public void setPassiveAuthenticationSupported(boolean isSupported)
Set whether this flow supports passive authentication.- Parameters:
isSupported- whether this flow supports passive authentication
-
isForcedAuthenticationSupported
public boolean isForcedAuthenticationSupported()
Get whether this flow supports forced authentication.- Returns:
- whether this flow supports forced authentication
-
setForcedAuthenticationSupported
public void setForcedAuthenticationSupported(boolean isSupported)
Set whether this flow supports forced authentication.- Parameters:
isSupported- whether this flow supports forced authentication.
-
isProxyRestrictionsEnforced
public boolean isProxyRestrictionsEnforced()
Gets whether this flow's results should honor restrictions on proxying toward RPs.- Returns:
- true iff proxying restrictions issued by IdPs should be honored
- Since:
- 4.0.0
-
setProxyRestrictionsEnforced
public void setProxyRestrictionsEnforced(boolean flag)
Sets whether this flow's results should honor restrictions on proxying toward RPsDefaults to true.
- Parameters:
flag- flag to set- Since:
- 4.0.0
-
isProxyScopingEnforced
public boolean isProxyScopingEnforced()
Gets whether this flow's results should honor restrictions on proxying toward IdPs.- Returns:
- true iff proxying restrictions issued by RPs should be honored
- Since:
- 4.0.0
-
setProxyScopingEnforced
public void setProxyScopingEnforced(boolean flag)
Sets whether this flow's results should honor restrictions on proxying toward IdPs.Defaults to false. Should be enabled for flows that represent proxied authentication.
- Parameters:
flag- flag to set- Since:
- 4.0.0
-
isDiscoveryRequired
public boolean isDiscoveryRequired()
Gets whether to invoke discovery subflow ifAuthenticationContext.getAuthenticatingAuthority()is null.- Returns:
- whether to invoke discovery
- Since:
- 4.0.0
-
setDiscoveryRequired
public void setDiscoveryRequired(boolean flag)
Sets whether to invoke discovery subflow ifAuthenticationContext.getAuthenticatingAuthority()is null.Defaults to false.
- Parameters:
flag- flag to set- Since:
- 4.0.0
-
getReuseCondition
@Nonnull public Predicate<ProfileRequestContext> getReuseCondition()
Get condition controlling whether results from this flow should be reused for SSO.- Returns:
- condition
- Since:
- 4.0.1
-
setReuseCondition
public void setReuseCondition(@Nonnull Predicate<ProfileRequestContext> condition)Set condition controlling whether results from this flow should be reused for SSO.Defaults to a built-in condition that applies SP-imposed proxying rules on hop count when the flow is configured to enforce this.
- Parameters:
condition- condition to set- Since:
- 3.4.0
-
getRevocationCondition
@Nonnull public BiPredicate<ProfileRequestContext,AuthenticationResult> getRevocationCondition()
Get condition controlling whether a result from this flow should be considered revoked.- Returns:
- condition
- Since:
- 4.3.0
-
setRevocationCondition
public void setRevocationCondition(@Nullable BiPredicate<ProfileRequestContext,AuthenticationResult> condition)Set condition controlling whether a result from this flow should be considered revoked.- Parameters:
condition- condition to set- Since:
- 4.3.0
-
getSubjectDecorator
@Nullable public BiConsumer<ProfileRequestContext,Subject> getSubjectDecorator()
Gets a subject decorating component called prior to completing authentication and passing control to subject canonicalization.- Returns:
- subject decorator
- Since:
- 4.1.0
-
setSubjectDecorator
public void setSubjectDecorator(@Nullable BiConsumer<ProfileRequestContext,Subject> decorator)Sets a subject decorating component called prior to completing authentication and passing control to subject canonicalization.- Parameters:
decorator- the decorator to set- Since:
- 4.1.0
-
getLifetime
@Nullable public Duration getLifetime()
Get the maximum amount of time, since first usage, a flow should be considered active. A null indicates that there is no upper limit on the lifetime on an active flow.- Returns:
- maximum amount of time a flow should be considered active
-
setLifetime
public void setLifetime(@Nullable Duration flowLifetime)Set the maximum amount of time, since first usage, a flow should be considered active. A null value indicates that there is no upper limit on the lifetime on an active flow.- Parameters:
flowLifetime- the lifetime for the flow
-
getInactivityTimeout
@Nonnull public Duration getInactivityTimeout()
Get the maximum amount of time, since the last usage, a flow should be considered active.Defaults to 30 minutes.
- Returns:
- the duration
-
setInactivityTimeout
public void setInactivityTimeout(@Nonnull Duration timeout)Set the maximum amount of time, since the last usage, a flow should be considered active.- Parameters:
timeout- the flow inactivity timeout, must be greater than zero
-
isResultActive
public boolean isResultActive(@Nonnull AuthenticationResult result)Check if a result generated by this flow is still active.- Parameters:
result-AuthenticationResultto check- Returns:
- true iff the result remains valid
-
getSupportedPrincipals
@Nonnull @NonnullElements @Unmodifiable public <T extends Principal> Set<T> getSupportedPrincipals(@Nonnull Class<T> c)
Get an immutable set of supported custom principals that the component produces, supports, contains, etc.- Specified by:
getSupportedPrincipalsin interfacePrincipalSupportingComponent- Type Parameters:
T- type of Principal to inquire on- Parameters:
c- type of Principal to inquire on- Returns:
- a set of matching principals
-
getSupportedPrincipals
@Nonnull @NonnullElements public Collection<Principal> getSupportedPrincipals()
Get a collection of supported non-user-specific principals that the flow may produce when it operates.The
Collection.remove(java.lang.Object)method is not supported.- Returns:
- a live collection of supported principals
-
setSupportedPrincipals
public void setSupportedPrincipals(@Nonnull @NonnullElements Collection<Principal> principals)
Set supported non-user-specific principals that the flow may produce when it operates.- Parameters:
principals- supported principals to add
-
setSupportedPrincipalsByString
public void setSupportedPrincipalsByString(@Nonnull @NonnullElements Collection<String> principals)
Set supported non-user-specific principals that the flow may produce when it operates.The principals must be prefixed by the ID of the relevant
PrincipalServicefollowed by a '/'.Setting an empty list will leave any existing set unchanged. This is primarily provided to allow property-based override of an XML-based collection established with the previous method.
- Parameters:
principals- supported principals to add- Since:
- 4.1.0
-
setActivationCondition
public void setActivationCondition(@Nonnull Predicate<ProfileRequestContext> condition)Set the activation condition in the form of aPredicatesuch that iff the condition evaluates to true should the corresponding flow be allowed/possible.- Parameters:
condition- predicate that controls activation of the flow
-
test
public boolean test(@Nullable ProfileRequestContext input)- Specified by:
testin interfacePredicate<ProfileRequestContext>
-
setResultSerializer
public void setResultSerializer(@Nonnull StorageSerializer<AuthenticationResult> serializer)Set a custom serializer for results produced by this flow.- Parameters:
serializer- the custom serializer
-
setPrincipalWeightMap
public void setPrincipalWeightMap(@Nullable @NonnullElements Map<Principal,Integer> map)
Set the map of Principals to weight values to impose a sort order on any matching Principals found in the authentication result.This was moved from a stand-alone bean into the descriptor beans in order to eliminate stand-alone beans from the flow descriptor configuration files(s).
- Parameters:
map- map to set- Since:
- 4.0.0
-
setPrincipalServiceManager
public void setPrincipalServiceManager(@Nullable PrincipalServiceManager manager)Sets aPrincipalServiceManagerto use for string-based principal processing.- Parameters:
manager- manager to set- Since:
- 4.0.1
-
doInitialize
protected void doInitialize() throws ComponentInitializationException- Overrides:
doInitializein classAbstractIdentifiedInitializableComponent- Throws:
ComponentInitializationException
-
newAuthenticationResult
@Nonnull public AuthenticationResult newAuthenticationResult(@Nonnull Subject subject)
Creates a new instance of a compatibleAuthenticationResultfor use with the corresponding flow.- Parameters:
subject- the subject for the result- Returns:
- the new result
-
serialize
@Nonnull @NotEmpty public String serialize(@Nonnull AuthenticationResult instance) throws IOException
- Specified by:
serializein interfaceStorageSerializer<AuthenticationResult>- Throws:
IOException
-
deserialize
@Nonnull public AuthenticationResult deserialize(long version, @Nonnull @NotEmpty String context, @Nonnull @NotEmpty String key, @Nonnull @NotEmpty String value, @Nonnull Long expiration) throws IOException
- Specified by:
deserializein interfaceStorageSerializer<AuthenticationResult>- Throws:
IOException
-
getHighestWeighted
@Nullable public <T extends Principal> T getHighestWeighted(@Nonnull @NonnullElements Collection<T> principals)
Apply the current weighted map to find the highest-weighted object amongst the inputs.- Type Parameters:
T- principal type- Parameters:
principals- input collection- Returns:
- the highest weighted as governed by the map set via
setPrincipalWeightMap(Map) - Since:
- 4.0.0
-
-