Package net.shibboleth.idp.authn.impl

Class AttributeSourcedSubjectCanonicalization

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.idp.authn.SubjectCanonicalizationFlowDescriptor
net.shibboleth.idp.authn.AbstractSubjectCanonicalizer
net.shibboleth.idp.authn.impl.AttributeSourcedSubjectCanonicalization
All Implemented Interfaces:
Function<SubjectCanonicalizationContext,String>, Predicate<ProfileRequestContext>, SubjectCanonicalizer, FlowDescriptor, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent
public class AttributeSourcedSubjectCanonicalization extends AbstractSubjectCanonicalizer
A SubjectCanonicalizer that resolves attributes and then extracts a resolved IdPAttribute value from an AttributeContext child obtained via lookup function (by default a child of the SubjectCanonicalizationContext), and uses it as the result of subject canonicalization.

String and scoped attribute values are supported.

Since:
5.2.0

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • resolverService

      @NonnullAfterInit private ReloadableService<AttributeResolver> resolverService
      Attribute resolver service.

    • resolutionCondition

      @Nonnull private Predicate<ProfileRequestContext> resolutionCondition
      Condition controlling whether to run the attribute resolver.

    • delimiter

      private char delimiter
      Delimiter to use for scoped attribute serialization.

    • resolveFromSubject

      private boolean resolveFromSubject
      Whether to also (or instead) check the original Subject for IdPAttributePrincipals.

    • attributesToResolve

      @Nonnull private Collection<String> attributesToResolve
      Attributes to resolve if explicit.

    • attributeSourceIds

      @Nonnull private List<String> attributeSourceIds
      Ordered list of attributes to look for and read from.

    • issuerLookupStrategy

      @Nullable private Function<ProfileRequestContext,String> issuerLookupStrategy
      Strategy used to locate the identity of the issuer associated with the attribute resolution.

    • recipientLookupStrategy

      @Nullable private Function<ProfileRequestContext,String> recipientLookupStrategy
      Strategy used to locate the identity of the recipient associated with the attribute resolution.

    • principalNameLookupStrategy

      @Nullable private Function<ProfileRequestContext,String> principalNameLookupStrategy
      Strategy used to locate the principal name associated with the attribute resolution.

  • Constructor Details

    • AttributeSourcedSubjectCanonicalization

      public AttributeSourcedSubjectCanonicalization()
      Constructor.

  • Method Details

    • setAttributeResolver

      public void setAttributeResolver(@Nonnull ReloadableService<AttributeResolver> service)
      Set the AttributeResolver service instance to use.
      Parameters:
      service - service to use

    • setResolutionCondition

      public void setResolutionCondition(@Nonnull Predicate<ProfileRequestContext> condition)
      Set a condition to evaluate to decide whether to resolve attributes.

      Defaults to true.

      Parameters:
      condition - condition to set

    • setScopedDelimiter

      public void setScopedDelimiter(char ch)
      Set the delimiter to use for serializing scoped attribute values.

      Defaults to '@'.

      Parameters:
      ch - delimiter to use

    • setResolveFromSubject

      public void setResolveFromSubject(boolean flag)
      Whether to include any IdPAttributePrincipal objects found in the input Subject when searching for a matching attribute ID.

      Defaults to false.

      Parameters:
      flag - flag to set

    • setAttributesToResolve

      public void setAttributesToResolve(@Nonnull Collection<String> ids)
      Set the attribute IDs to resolve.
      Parameters:
      ids - attribute IDs to resolve

    • setAttributeSourceIds

      public void setAttributeSourceIds(@Nonnull List<String> ids)
      Set the attribute IDs to read from in order of preference.
      Parameters:
      ids - attribute IDs to read from

    • setIssuerLookupStrategy

      public void setIssuerLookupStrategy(@Nullable Function<ProfileRequestContext,String> strategy)
      Set the strategy used to lookup the issuer for this attribute resolution.
      Parameters:
      strategy - lookup strategy

    • setRecipientLookupStrategy

      public void setRecipientLookupStrategy(@Nullable Function<ProfileRequestContext,String> strategy)
      Set the strategy used to lookup the recipient for this attribute resolution.
      Parameters:
      strategy - lookup strategy

    • setPrincipalNameLookupStrategy

      public void setPrincipalNameLookupStrategy(@Nullable Function<ProfileRequestContext,String> strategy)
      Set the strategy used to locate the principal name for this attribute resolution.
      Parameters:
      strategy - lookup strategy

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractSubjectCanonicalizer
      Throws:
      ComponentInitializationException

    • doApply

      @Nullable protected String doApply(@Nonnull SubjectCanonicalizationContext c14nContext)
      Performs c14n if possible.
      Specified by:
      doApply in class AbstractSubjectCanonicalizer
      Parameters:
      c14nContext - the current subject canonicalization context
      Returns:
      event indicating result of function

    • extractSubjectSourcedAttributes

      @Nonnull private Map<String,IdPAttribute> extractSubjectSourcedAttributes(@Nonnull SubjectCanonicalizationContext c14nContext)
      Extract and populate a map of any attributes found in the Subject.
      Parameters:
      c14nContext - source of Subject
      Returns:
      possibly empty map

    • resolveAttributes

      private Map<String,IdPAttribute> resolveAttributes(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull SubjectCanonicalizationContext c14nContext)
      Perform attribute resolution inline.
      Parameters:
      profileRequestContext - profile request context
      c14nContext - subject c14n context
      Returns:
      the resolved map of attributes

    • findValue

      @Nullable private String findValue(@Nonnull IdPAttribute attribute)
      Check for a compatible value in the input attribute.
      Parameters:
      attribute - input attribute
      Returns:
      value to use for result, or null