Package net.shibboleth.idp.saml.saml1.profile.config

Class BrowserSSOProfileConfiguration

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

net.shibboleth.idp.profile.config.AbstractProfileConfiguration

net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration

net.shibboleth.idp.saml.profile.config.AbstractSAMLProfileConfiguration

net.shibboleth.idp.saml.saml1.profile.config.AbstractSAML1ArtifactAwareProfileConfiguration

net.shibboleth.idp.saml.saml1.profile.config.BrowserSSOProfileConfiguration

All Implemented Interfaces:

AuthenticationProfileConfiguration, AttributeResolvingProfileConfiguration, ConditionalProfileConfiguration, ProfileConfiguration, SAMLArtifactAwareProfileConfiguration, SAMLProfileConfiguration, SAML1ProfileConfiguration, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

public class BrowserSSOProfileConfiguration
extends AbstractSAML1ArtifactAwareProfileConfiguration
implements AuthenticationProfileConfiguration, AttributeResolvingProfileConfiguration

Configuration for SAML 1 Browser SSO profile requests.

Field Summary

Fields

Modifier and Type	Field	Description
private Function<ProfileRequestContext,Set<String>>	authenticationFlowsLookupStrategy	Lookup function to supply authentication flows.
private Function<ProfileRequestContext,Collection<AuthenticationMethodPrincipal>>	defaultAuthenticationMethodsLookupStrategy	Lookup function to supply default authentication methods.
private Predicate<ProfileRequestContext>	forceAuthnPredicate	Whether to mandate forced authentication for the request.
private Predicate<ProfileRequestContext>	includeAttributeStatementPredicate	Whether responses to the authentication request should include an attribute statement.
private Function<ProfileRequestContext,Collection<String>>	nameIDFormatPrecedenceLookupStrategy	Lookup function to supply NameIdentifier formats.
private Function<ProfileRequestContext,Collection<String>>	postAuthenticationFlowsLookupStrategy	Lookup function to supply post authentication flows.
static String	PROFILE_ID	ID for this profile configuration.
private Function<ProfileRequestContext,Integer>	proxyCountLookupStrategy	Lookup function to supply proxyCount property.
private Predicate<ProfileRequestContext>	resolveAttributesPredicate	Whether attributes should be resolved in the course of the profile.

Fields inherited from class net.shibboleth.idp.saml.profile.config.AbstractSAMLProfileConfiguration

DEFAULT_ASSERTION_LIFETIME

Fields inherited from class net.shibboleth.idp.profile.config.AbstractProfileConfiguration

DEFAULT_DISALLOWED_FEATURES

Constructor Summary

Constructors

Modifier	Constructor	Description
	BrowserSSOProfileConfiguration()	Constructor.
protected	BrowserSSOProfileConfiguration(String profileId)	Constructor.

Method Summary

Modifier and Type	Method	Description
Set<String>	getAuthenticationFlows(ProfileRequestContext profileRequestContext)	Get the allowable authentication flows for this profile.
List<Principal>	getDefaultAuthenticationMethods(ProfileRequestContext profileRequestContext)	Get the default authentication methods to use, expressed as custom principals.
List<String>	getNameIDFormatPrecedence(ProfileRequestContext profileRequestContext)	Get the name identifier formats to use.
List<String>	getPostAuthenticationFlows(ProfileRequestContext profileRequestContext)	Get an ordered list of post-authentication interceptor flows to run for this profile.
Integer	getProxyCount(ProfileRequestContext profileRequestContext)	Gets the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.
boolean	isForceAuthn(ProfileRequestContext profileRequestContext)	Get whether the authentication process should include a proof of user presence.
boolean	isIncludeAttributeStatement(ProfileRequestContext profileRequestContext)	Get whether responses to the authentication request should include an attribute statement.
boolean	isResolveAttributes(ProfileRequestContext profileRequestContext)	Get whether to resolve attributes.
void	setAuthenticationFlows(Collection<String> flows)	Set the authentication flows to use.
void	setAuthenticationFlowsLookupStrategy(Function<ProfileRequestContext,Set<String>> strategy)	Set a lookup strategy for the authentication flows to use.
void	setDefaultAuthenticationMethods(Collection<AuthenticationMethodPrincipal> methods)	Set the default authentication methods to use, expressed as custom principals.
void	setDefaultAuthenticationMethodsLookupStrategy(Function<ProfileRequestContext,Collection<AuthenticationMethodPrincipal>> strategy)	Set a lookup strategy for the getDefaultAuthenticationMethods(ProfileRequestContext) method.
void	setForceAuthn(boolean flag)	Set whether a fresh user presence proof should be required for this request.
void	setForceAuthnPredicate(Predicate<ProfileRequestContext> condition)	Set a condition to determine whether a fresh user presence proof should be required for this request.
void	setIncludeAttributeStatement(boolean flag)	Set whether responses to the authentication request should include an attribute statement.
void	setIncludeAttributeStatementPredicate(Predicate<ProfileRequestContext> condition)	Set a condition to determine whether responses to the authentication request should include an attribute statement.
void	setNameIDFormatPrecedence(Collection<String> formats)	Set the name identifier formats to use.
void	setNameIDFormatPrecedenceLookupStrategy(Function<ProfileRequestContext,Collection<String>> strategy)	Set a lookup strategy for the name identifier formats to use.
void	setPostAuthenticationFlows(Collection<String> flows)	Set the ordered collection of post-authentication interceptor flows to enable.
void	setPostAuthenticationFlowsLookupStrategy(Function<ProfileRequestContext,Collection<String>> strategy)	Set a lookup strategy for the post-authentication interceptor flows to enable.
void	setProxyCount(Integer count)	Sets the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.
void	setProxyCountLookupStrategy(Function<ProfileRequestContext,Integer> strategy)	Set a lookup strategy for the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.
void	setResolveAttributes(boolean flag)	Set whether attributes should be resolved during the profile.
void	setResolveAttributesPredicate(Predicate<ProfileRequestContext> condition)	Set a condition to determine whether attributes should be resolved during the profile.

Methods inherited from class net.shibboleth.idp.saml.saml1.profile.config.AbstractSAML1ArtifactAwareProfileConfiguration

getArtifactConfiguration, setArtifactConfiguration, setArtifactConfigurationLookupStrategy

Methods inherited from class net.shibboleth.idp.saml.profile.config.AbstractSAMLProfileConfiguration

getAdditionalAudiencesForAssertion, getAssertionLifetime, isIncludeConditionsNotBefore, isSignAssertions, isSignRequests, isSignResponses, setAdditionalAudiencesForAssertion, setAdditionalAudiencesForAssertionLookupStrategy, setAssertionLifetime, setAssertionLifetimeLookupStrategy, setIncludeConditionsNotBefore, setIncludeConditionsNotBeforePredicate, setSignAssertions, setSignAssertionsPredicate, setSignRequests, setSignRequestsPredicate, setSignResponses, setSignResponsesPredicate

Methods inherited from class net.shibboleth.idp.profile.config.AbstractConditionalProfileConfiguration

getActivationCondition, setActivationCondition

Methods inherited from class net.shibboleth.idp.profile.config.AbstractProfileConfiguration

equals, getDisallowedFeatures, getInboundInterceptorFlows, getOutboundInterceptorFlows, getSecurityConfiguration, hashCode, isFeatureDisallowed, setDisallowedFeatures, setDisallowedFeaturesLookupStrategy, setInboundFlowsLookupStrategy, setInboundInterceptorFlows, setInboundInterceptorFlowsLookupStrategy, setOutboundFlowsLookupStrategy, setOutboundInterceptorFlows, setOutboundInterceptorFlowsLookupStrategy, setSecurityConfiguration, setSecurityConfigurationLookupStrategy

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

doInitialize, getId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration

isLocal

Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiedComponent

getId

Methods inherited from interface net.shibboleth.idp.profile.config.ProfileConfiguration

getInboundInterceptorFlows, getOutboundInterceptorFlows, getSecurityConfiguration

Methods inherited from interface net.shibboleth.idp.saml.profile.config.SAMLProfileConfiguration

getAdditionalAudiencesForAssertion, getAssertionLifetime, isIncludeConditionsNotBefore, isSignAssertions, isSignRequests, isSignResponses

Field Detail

PROFILE_ID

@Nonnull
@NotEmpty
public static final String PROFILE_ID

ID for this profile configuration.

See Also:

Constant Field Values

resolveAttributesPredicate

@Nonnull
private Predicate<ProfileRequestContext> resolveAttributesPredicate

Whether attributes should be resolved in the course of the profile.

includeAttributeStatementPredicate

@Nonnull
private Predicate<ProfileRequestContext> includeAttributeStatementPredicate

Whether responses to the authentication request should include an attribute statement.

forceAuthnPredicate

@Nonnull
private Predicate<ProfileRequestContext> forceAuthnPredicate

Whether to mandate forced authentication for the request.

defaultAuthenticationMethodsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Collection<AuthenticationMethodPrincipal>> defaultAuthenticationMethodsLookupStrategy

Lookup function to supply default authentication methods.

authenticationFlowsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Set<String>> authenticationFlowsLookupStrategy

Lookup function to supply authentication flows.

postAuthenticationFlowsLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Collection<String>> postAuthenticationFlowsLookupStrategy

Lookup function to supply post authentication flows.

nameIDFormatPrecedenceLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Collection<String>> nameIDFormatPrecedenceLookupStrategy

Lookup function to supply NameIdentifier formats.

proxyCountLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy

Lookup function to supply proxyCount property.

Constructor Detail

BrowserSSOProfileConfiguration

public BrowserSSOProfileConfiguration()

Constructor.

BrowserSSOProfileConfiguration

protected BrowserSSOProfileConfiguration(@Nonnull @NotEmpty
                                         String profileId)

Constructor.

Parameters:

profileId - unique ID for this profile

Method Detail

isResolveAttributes

public boolean isResolveAttributes(@Nullable
                                   ProfileRequestContext profileRequestContext)

Get whether to resolve attributes.

Specified by:

isResolveAttributes in interface AttributeResolvingProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

true iff resolution should be done

setResolveAttributes

public void setResolveAttributes(boolean flag)

Set whether attributes should be resolved during the profile.

Parameters:

flag - flag to set

setResolveAttributesPredicate

public void setResolveAttributesPredicate(@Nonnull
                                          Predicate<ProfileRequestContext> condition)

Set a condition to determine whether attributes should be resolved during the profile.

Parameters:

condition - condition to set

isIncludeAttributeStatement

public boolean isIncludeAttributeStatement(@Nullable
                                           ProfileRequestContext profileRequestContext)

Get whether responses to the authentication request should include an attribute statement.

Default is true

Parameters:

profileRequestContext - current profile request context

Returns:

whether responses to the authentication request should include an attribute statement

setIncludeAttributeStatement

public void setIncludeAttributeStatement(boolean flag)

Set whether responses to the authentication request should include an attribute statement.

Parameters:

flag - flag to set

setIncludeAttributeStatementPredicate

public void setIncludeAttributeStatementPredicate(@Nonnull
                                                  Predicate<ProfileRequestContext> condition)

Set a condition to determine whether responses to the authentication request should include an attribute statement.

Parameters:

condition - condition to set

isForceAuthn

public boolean isForceAuthn(@Nullable
                            ProfileRequestContext profileRequestContext)

Get whether the authentication process should include a proof of user presence.

Specified by:

isForceAuthn in interface AuthenticationProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

true iff authentication should require user presence

setForceAuthn

public void setForceAuthn(boolean flag)

Set whether a fresh user presence proof should be required for this request.

Parameters:

flag - flag to set

setForceAuthnPredicate

public void setForceAuthnPredicate(@Nonnull
                                   Predicate<ProfileRequestContext> condition)

Set a condition to determine whether a fresh user presence proof should be required for this request.

Parameters:

condition - condition to set

getDefaultAuthenticationMethods

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public List<Principal> getDefaultAuthenticationMethods(@Nullable
                                                       ProfileRequestContext profileRequestContext)

Get the default authentication methods to use, expressed as custom principals.

Specified by:

getDefaultAuthenticationMethods in interface AuthenticationProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

default authentication methods to use

setDefaultAuthenticationMethods

public void setDefaultAuthenticationMethods(@Nullable @NonnullElements
                                            Collection<AuthenticationMethodPrincipal> methods)

Set the default authentication methods to use, expressed as custom principals.

Parameters:

methods - default authentication methods to use

setDefaultAuthenticationMethodsLookupStrategy

public void setDefaultAuthenticationMethodsLookupStrategy(@Nonnull
                                                          Function<ProfileRequestContext,Collection<AuthenticationMethodPrincipal>> strategy)

Set a lookup strategy for the getDefaultAuthenticationMethods(ProfileRequestContext) method.

Parameters:

strategy - lookup strategy

Since:

3.3.0

getAuthenticationFlows

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public Set<String> getAuthenticationFlows(@Nullable
                                          ProfileRequestContext profileRequestContext)

Get the allowable authentication flows for this profile.

The flow IDs returned MUST NOT contain the AuthenticationFlowDescriptor.FLOW_ID_PREFIX prefix common to all interceptor flows.

Specified by:

getAuthenticationFlows in interface AuthenticationProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

a set of authentication flow IDs to allow

setAuthenticationFlows

public void setAuthenticationFlows(@Nullable @NonnullElements
                                   Collection<String> flows)

Set the authentication flows to use.

Parameters:

flows - flow identifiers to use

setAuthenticationFlowsLookupStrategy

public void setAuthenticationFlowsLookupStrategy(@Nonnull
                                                 Function<ProfileRequestContext,Set<String>> strategy)

Set a lookup strategy for the authentication flows to use.

Parameters:

strategy - lookup strategy

Since:

3.3.0

getPostAuthenticationFlows

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public List<String> getPostAuthenticationFlows(@Nullable
                                               ProfileRequestContext profileRequestContext)

Get an ordered list of post-authentication interceptor flows to run for this profile.

The flow IDs returned MUST NOT contain the ProfileInterceptorFlowDescriptor.FLOW_ID_PREFIX prefix common to all interceptor flows.

Specified by:

getPostAuthenticationFlows in interface AuthenticationProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

a set of interceptor flow IDs to enable

setPostAuthenticationFlows

public void setPostAuthenticationFlows(@Nullable @NonnullElements
                                       Collection<String> flows)

Set the ordered collection of post-authentication interceptor flows to enable.

Parameters:

flows - flow identifiers to enable

setPostAuthenticationFlowsLookupStrategy

public void setPostAuthenticationFlowsLookupStrategy(@Nonnull
                                                     Function<ProfileRequestContext,Collection<String>> strategy)

Set a lookup strategy for the post-authentication interceptor flows to enable.

Parameters:

strategy - lookup strategy

Since:

3.3.0

getNameIDFormatPrecedence

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public List<String> getNameIDFormatPrecedence(@Nullable
                                              ProfileRequestContext profileRequestContext)

Get the name identifier formats to use.

Parameters:

profileRequestContext - profile request context

Returns:

the formats to use

setNameIDFormatPrecedence

public void setNameIDFormatPrecedence(@Nonnull @NonnullElements
                                      Collection<String> formats)

Set the name identifier formats to use.

Parameters:

formats - name identifier formats to use

setNameIDFormatPrecedenceLookupStrategy

public void setNameIDFormatPrecedenceLookupStrategy(@Nonnull
                                                    Function<ProfileRequestContext,Collection<String>> strategy)

Set a lookup strategy for the name identifier formats to use.

Parameters:

strategy - lookup strategy

Since:

3.3.0

getProxyCount

@Nullable
public Integer getProxyCount(@Nullable
                             ProfileRequestContext profileRequestContext)

Gets the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.

Specified by:

getProxyCount in interface AuthenticationProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

maximum number of times an assertion or authentication may be proxied

setProxyCount

public void setProxyCount(@Nullable @NonNegative
                          Integer count)

Sets the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.

Parameters:

count - proxy count

Since:

4.0.0

setProxyCountLookupStrategy

public void setProxyCountLookupStrategy(@Nonnull
                                        Function<ProfileRequestContext,Integer> strategy)

Set a lookup strategy for the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.

Parameters:

strategy - lookup strategy

Since:

4.0.0