Package net.shibboleth.idp.authn.impl

Class X500SubjectCanonicalization

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.idp.authn.SubjectCanonicalizationFlowDescriptor
net.shibboleth.idp.authn.AbstractSubjectCanonicalizer
net.shibboleth.idp.authn.impl.X500SubjectCanonicalization
All Implemented Interfaces:
Function<SubjectCanonicalizationContext,String>, Predicate<ProfileRequestContext>, SubjectCanonicalizer, FlowDescriptor, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent
public class X500SubjectCanonicalization extends AbstractSubjectCanonicalizer
A SubjectCanonicalizer that transforms the input Subject into a principal name by searching for one and only one X509Certificate public credential, or in its absence one and only one X500Principal.

A list of OIDs is used to locate an RDN to extract from the Subject DN and use as the principal name after applying the transforms from the base class.

Alternatively, a list of subjectAltName extension types may be specified, which takes precedence over the subject, if a match is found.

  • Field Details

    • CN_OID

      @Nonnull @NotEmpty private static final String CN_OID
      Common Name (CN) OID.
      See Also:

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • subjectAltNameTypes

      @Nonnull private List<Integer> subjectAltNameTypes
      subjectAltName types to search for.

    • objectIds

      @Nonnull private List<String> objectIds
      OIDs to search for.

  • Constructor Details

    • X500SubjectCanonicalization

      public X500SubjectCanonicalization()
      Constructor.

  • Method Details

    • setSubjectAltNameTypes

      public void setSubjectAltNameTypes(@Nullable List<Integer> types)
      Set the subjectAltName types to search for, in order of preference.
      Parameters:
      types - types to search for

    • setObjectIds

      public void setObjectIds(@Nullable List<String> ids)
      Set the OIDs to search for, in order of preference.
      Parameters:
      ids - RDN OIDs to search for

    • doApply

      @Nullable protected String doApply(@Nonnull SubjectCanonicalizationContext c14nContext)
      Performs c14n if possible.
      Specified by:
      doApply in class AbstractSubjectCanonicalizer
      Parameters:
      c14nContext - the current subject canonicalization context
      Returns:
      event indicating result of function

    • findRDN

      @Nullable protected String findRDN(@Nonnull org.cryptacular.x509.dn.RDNSequence sequence, @Nonnull @NotEmpty String oid)
      Find an RDN with the specified OID.
      Parameters:
      sequence - the DN components
      oid - the OID to look for
      Returns:
      the first matching RDN value, or null

    • getX500Principal

      @Nullable private X500Principal getX500Principal(@Nonnull SubjectCanonicalizationContext c14nContext)
      Helper method that returns the first and only X500Principal, returning null otherwise.
      Parameters:
      c14nContext - input context
      Returns:
      the only matching principal or null

    • getCertificate

      @Nullable private X509Certificate getCertificate(@Nonnull SubjectCanonicalizationContext c14nContext)
      Helper method that returns the first and only X509Certificate, returning null otherwise.
      Parameters:
      c14nContext - input context
      Returns:
      the only certificate or null