Class AuthenticationFlowDescriptor

    • Field Detail

      • STORAGE_EXPIRATION_OFFSET

        @Nonnull
        public static final Duration STORAGE_EXPIRATION_OFFSET
        Additional allowance for storage of result records to avoid race conditions during use.
      • order

        private int order
        Spring auto-wiring order.
      • supportsNonBrowser

        private boolean supportsNonBrowser
        Whether this flow supports non-browser clients.
      • supportsPassive

        private boolean supportsPassive
        Whether this flow supports passive authentication.
      • supportsForced

        private boolean supportsForced
        Whether this flow supports forced authentication.
      • proxyRestrictionsEnforced

        private boolean proxyRestrictionsEnforced
        Whether this flow should honor proxy restrictions toward RPs.
      • proxyScopingEnforced

        private boolean proxyScopingEnforced
        Whether this flow should honor proxy scoping restrictions toward IdPs.
      • discoveryRequired

        private boolean discoveryRequired
        Whether this flow should invoke discovery if no authenticating authority populated.
      • lifetime

        @Nullable
        private Duration lifetime
        Maximum amount of time since first usage that a flow should be considered active.
      • inactivityTimeout

        @Nonnull
        private Duration inactivityTimeout
        Maximum amount of time since last usage that a flow should be considered active.
      • stringBasedPrincipals

        @Nonnull
        private Set<String> stringBasedPrincipals
        Supported principals provided by delimited strings, for post-initialization override via PrincipalServiceManager.
      • supportedPrincipals

        @Nonnull
        private Subject supportedPrincipals
        Supported principals, indexed by type, that the flow can produce. Implemented for the moment using the Subject class for convenience to allow for class-based lookup in the getSupportedPrincipals(java.lang.Class<T>) method.
      • activationCondition

        @Nonnull
        private Predicate<ProfileRequestContext> activationCondition
        Predicate that must be true for this flow to be usable for a given request.
      • principalServiceManager

        @Nullable
        private PrincipalServiceManager principalServiceManager
        Access to principal services.
    • Constructor Detail

      • AuthenticationFlowDescriptor

        public AuthenticationFlowDescriptor()
        Constructor.
    • Method Detail

      • getOrder

        public int getOrder()
        Specified by:
        getOrder in interface Ordered
      • setOrder

        public void setOrder​(int priority)
        Set the order/priority value for the bean.
        Parameters:
        priority - priority value
      • isNonBrowserSupported

        public boolean isNonBrowserSupported()
        Get whether this flow supports non-browser clients.
        Returns:
        whether this flow supports non-browser clients
      • setNonBrowserSupported

        public void setNonBrowserSupported​(boolean isSupported)
        Set whether this flow supports non-browser clients.
        Parameters:
        isSupported - whether this flow supports non-browser clients
      • isPassiveAuthenticationSupported

        public boolean isPassiveAuthenticationSupported()
        Get whether this flow supports passive authentication.
        Returns:
        whether this flow supports passive authentication
      • setPassiveAuthenticationSupported

        public void setPassiveAuthenticationSupported​(boolean isSupported)
        Set whether this flow supports passive authentication.
        Parameters:
        isSupported - whether this flow supports passive authentication
      • isForcedAuthenticationSupported

        public boolean isForcedAuthenticationSupported()
        Get whether this flow supports forced authentication.
        Returns:
        whether this flow supports forced authentication
      • setForcedAuthenticationSupported

        public void setForcedAuthenticationSupported​(boolean isSupported)
        Set whether this flow supports forced authentication.
        Parameters:
        isSupported - whether this flow supports forced authentication.
      • isProxyRestrictionsEnforced

        public boolean isProxyRestrictionsEnforced()
        Gets whether this flow's results should honor restrictions on proxying toward RPs.
        Returns:
        true iff proxying restrictions issued by IdPs should be honored
        Since:
        4.0.0
      • setProxyRestrictionsEnforced

        public void setProxyRestrictionsEnforced​(boolean flag)
        Sets whether this flow's results should honor restrictions on proxying toward RPs

        Defaults to true.

        Parameters:
        flag - flag to set
        Since:
        4.0.0
      • isProxyScopingEnforced

        public boolean isProxyScopingEnforced()
        Gets whether this flow's results should honor restrictions on proxying toward IdPs.
        Returns:
        true iff proxying restrictions issued by RPs should be honored
        Since:
        4.0.0
      • setProxyScopingEnforced

        public void setProxyScopingEnforced​(boolean flag)
        Sets whether this flow's results should honor restrictions on proxying toward IdPs.

        Defaults to false. Should be enabled for flows that represent proxied authentication.

        Parameters:
        flag - flag to set
        Since:
        4.0.0
      • getReuseCondition

        @Nonnull
        public Predicate<ProfileRequestContext> getReuseCondition()
        Get condition controlling whether results from this flow should be reused for SSO.
        Returns:
        condition
        Since:
        4.0.1
      • setReuseCondition

        public void setReuseCondition​(@Nonnull
                                      Predicate<ProfileRequestContext> condition)
        Set condition controlling whether results from this flow should be reused for SSO.

        Defaults to a built-in condition that applies SP-imposed proxying rules on hop count when the flow is configured to enforce this.

        Parameters:
        condition - condition to set
        Since:
        3.4.0
      • setRevocationCondition

        public void setRevocationCondition​(@Nullable
                                           BiPredicate<ProfileRequestContext,​AuthenticationResult> condition)
        Set condition controlling whether a result from this flow should be considered revoked.
        Parameters:
        condition - condition to set
        Since:
        4.3.0
      • getSubjectDecorator

        @Nullable
        public BiConsumer<ProfileRequestContext,​Subject> getSubjectDecorator()
        Gets a subject decorating component called prior to completing authentication and passing control to subject canonicalization.
        Returns:
        subject decorator
        Since:
        4.1.0
      • setSubjectDecorator

        public void setSubjectDecorator​(@Nullable
                                        BiConsumer<ProfileRequestContext,​Subject> decorator)
        Sets a subject decorating component called prior to completing authentication and passing control to subject canonicalization.
        Parameters:
        decorator - the decorator to set
        Since:
        4.1.0
      • getLifetime

        @Nullable
        public Duration getLifetime()
        Get the maximum amount of time, since first usage, a flow should be considered active. A null indicates that there is no upper limit on the lifetime on an active flow.
        Returns:
        maximum amount of time a flow should be considered active
      • setLifetime

        public void setLifetime​(@Nullable
                                Duration flowLifetime)
        Set the maximum amount of time, since first usage, a flow should be considered active. A null value indicates that there is no upper limit on the lifetime on an active flow.
        Parameters:
        flowLifetime - the lifetime for the flow
      • getInactivityTimeout

        @Nonnull
        public Duration getInactivityTimeout()
        Get the maximum amount of time, since the last usage, a flow should be considered active.

        Defaults to 30 minutes.

        Returns:
        the duration
      • setInactivityTimeout

        public void setInactivityTimeout​(@Nonnull
                                         Duration timeout)
        Set the maximum amount of time, since the last usage, a flow should be considered active.
        Parameters:
        timeout - the flow inactivity timeout, must be greater than zero
      • isResultActive

        public boolean isResultActive​(@Nonnull
                                      AuthenticationResult result)
        Check if a result generated by this flow is still active.
        Parameters:
        result - AuthenticationResult to check
        Returns:
        true iff the result remains valid
      • setSupportedPrincipals

        public void setSupportedPrincipals​(@Nonnull @NonnullElements
                                           Collection<Principal> principals)
        Set supported non-user-specific principals that the flow may produce when it operates.
        Parameters:
        principals - supported principals to add
      • setSupportedPrincipalsByString

        public void setSupportedPrincipalsByString​(@Nonnull @NonnullElements
                                                   Collection<String> principals)
        Set supported non-user-specific principals that the flow may produce when it operates.

        The principals must be prefixed by the ID of the relevant PrincipalService followed by a '/'.

        Setting an empty list will leave any existing set unchanged. This is primarily provided to allow property-based override of an XML-based collection established with the previous method.

        Parameters:
        principals - supported principals to add
        Since:
        4.1.0
      • setActivationCondition

        public void setActivationCondition​(@Nonnull
                                           Predicate<ProfileRequestContext> condition)
        Set the activation condition in the form of a Predicate such that iff the condition evaluates to true should the corresponding flow be allowed/possible.
        Parameters:
        condition - predicate that controls activation of the flow
      • setResultSerializer

        public void setResultSerializer​(@Nonnull
                                        StorageSerializer<AuthenticationResult> serializer)
        Set a custom serializer for results produced by this flow.
        Parameters:
        serializer - the custom serializer
      • setPrincipalWeightMap

        public void setPrincipalWeightMap​(@Nullable @NonnullElements
                                          Map<Principal,​Integer> map)
        Set the map of Principals to weight values to impose a sort order on any matching Principals found in the authentication result.

        This was moved from a stand-alone bean into the descriptor beans in order to eliminate stand-alone beans from the flow descriptor configuration files(s).

        Parameters:
        map - map to set
        Since:
        4.0.0
      • setPrincipalServiceManager

        public void setPrincipalServiceManager​(@Nullable
                                               PrincipalServiceManager manager)
        Sets a PrincipalServiceManager to use for string-based principal processing.
        Parameters:
        manager - manager to set
        Since:
        4.0.1
      • newAuthenticationResult

        @Nonnull
        public AuthenticationResult newAuthenticationResult​(@Nonnull
                                                            Subject subject)
        Creates a new instance of a compatible AuthenticationResult for use with the corresponding flow.
        Parameters:
        subject - the subject for the result
        Returns:
        the new result
      • getHighestWeighted

        @Nullable
        public <T extends Principal> T getHighestWeighted​(@Nonnull @NonnullElements
                                                          Collection<T> principals)
        Apply the current weighted map to find the highest-weighted object amongst the inputs.
        Type Parameters:
        T - principal type
        Parameters:
        principals - input collection
        Returns:
        the highest weighted as governed by the map set via setPrincipalWeightMap(Map)
        Since:
        4.0.0
      • hashCode

        public int hashCode()
        Overrides:
        hashCode in class Object