Package net.shibboleth.idp.authn.context.logic

Class AbstractAuthenticationResultPredicate

java.lang.Object
net.shibboleth.idp.authn.context.logic.AbstractAuthenticationResultPredicate
All Implemented Interfaces:
Predicate<ProfileRequestContext>
Direct Known Subclasses:
AuthenticationResultPredicate, PrincipalInResultPredicate
public abstract class AbstractAuthenticationResultPredicate extends Object implements Predicate<ProfileRequestContext>
Base class for predicates that operate on AuthenticationResult instances.

This layer handles accessing active results and filters by flow ID, subsequently invoking a checker method for each result. Both OR and AND semantics are supported across multiple results.

An empty result list evaluates to false regardless of those semantics.

If no flows are specified, then only the absence of any results will result in a true outcome.

Since:
5.2.0

  • Field Details

    • includeIntermediateResults

      private boolean includeIntermediateResults
      Whether to pull results from AuthenticationContext instead of SubjectContext.

    • includedFlows

      @Nonnull private Set<String> includedFlows
      Flow IDs to filter results against, ignoring the others.

  • Constructor Details

    • AbstractAuthenticationResultPredicate

      public AbstractAuthenticationResultPredicate()
      Constructor.

  • Method Details

    • isIncludeIntermediateResults

      public boolean isIncludeIntermediateResults()
      Gets whether pull results from AuthenticationContext instead of SubjectContext.
      Returns:
      as above

    • setIncludeIntermediateResults

      public void setIncludeIntermediateResults(boolean flag)
      Sets whether pull results from AuthenticationContext instead of SubjectContext.

      Defaults to false, meaning reliance only on SubjectContext.

      Parameters:
      flag - flag to set

    • getIncludedFlows

      @Nonnull public Set<String> getIncludedFlows()
      Gets the specific flow IDs (with the "authn/" prefix added) to pull results from, ignoring others.
      Returns:
      as above

    • setIncludedFlows

      public void setIncludedFlows(@Nullable Collection<String> flows)
      Sets specific flow IDs (minus the "authn/" prefix) to pull results from, ignoring others.
      Parameters:
      flows - flow IDs to include in evaluation of condition

    • test

      public boolean test(@Nullable ProfileRequestContext input)
      Specified by:
      test in interface Predicate<ProfileRequestContext>

    • getAuthenticationResults

      @Nonnull protected Collection<AuthenticationResult> getAuthenticationResults(@Nonnull ProfileRequestContext profileRequestContext)
      Extract all of the relevant results from either the active AuthenticationContext or SubjectContext as directed, including any nested results such as found with the MFA flow.
      Parameters:
      profileRequestContext - profile request context
      Returns:
      filtered results

    • doMatch

      protected abstract boolean doMatch(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull AuthenticationResult result)
      Evaluate an AuthenticationResult for a match.

      The default evaluation is simply that its existence is sufficient, but subclasses may override for more specific cases.

      Parameters:
      profileRequestContext - profile request context
      result - result to evaluate
      Returns:
      true iff the subclass deems this a matching result