Package net.shibboleth.idp.saml.saml2.profile.config

Class AttributeSourcedAuthnContextTranslationStrategy

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.idp.saml.saml2.profile.config.AttributeSourcedAuthnContextTranslationStrategy
All Implemented Interfaces:
Function<ProfileRequestContext,Collection<Principal>>, Component, DestructableComponent, InitializableComponent
public class AttributeSourcedAuthnContextTranslationStrategy extends AbstractInitializableComponent implements Function<ProfileRequestContext,Collection<Principal>>
Implementation of the SSO authnContextTranslationStrategyEx hook that translates decoded IdPAttribute values into (optionally mapped) values in the form of AuthnContextClassRefPrincipal objects.

This is primarily used for proxying via SAML to non-compliant IdPs (i.e., virtually all of them) that can't be bothered to properly support the use of Authentication Context to carry what it was literally designed to carry.

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Class logger.

    • attributeContextLookupStrategy

      @Nonnull private Function<ProfileRequestContext,AttributeContext> attributeContextLookupStrategy
      Lookup strategy for AttributeContext to pull from.

    • attributeSourceIDs

      @Nonnull private Set<String> attributeSourceIDs
      Attribute sources to pull from.

    • valueMappings

      @Nonnull private Map<String,Principal> valueMappings
      Translation map to convert values if necessary.

  • Constructor Details

    • AttributeSourcedAuthnContextTranslationStrategy

      public AttributeSourcedAuthnContextTranslationStrategy()
      Constructor.

  • Method Details

    • setAttributeContextLookupStrategy

      public void setAttributeContextLookupStrategy(@Nonnull Function<ProfileRequestContext,AttributeContext> strategy)
      Sets the lookup strategy for the AttributeContext to pull from.
      Parameters:
      strategy - lookup strategy

    • setAttributeSourceIDs

      public void setAttributeSourceIDs(@Nonnull Collection<String> sources)
      Sets the names of the IdPAttribute objects to check for values to map in.
      Parameters:
      sources - IdPAttribute IDs to check for

    • setValueMappings

      @Deprecated(since="5.2.0", forRemoval=true) public void setValueMappings(@Nullable Map<String,String> mappings)
      Deprecated, for removal: This API element is subject to removal in a future version.
      Sets the mappings to transform StringAttributeValue data into different values for use as AuthnContextClassRefPrincipal objects.

      Note that null keys are ignored, but null values are allowed, which suppresses the mapping of a value caising it to be skipped. Also, keys are not trimmed, but values are, to ensure the result is a valid context class reference.

      This is deprecated in favor of the type-neutral variant.

      Parameters:
      mappings - the value mappings

    • setMappings

      public void setMappings(@Nullable Map<String,Principal> mappings)
      Sets the mappings to transform StringAttributeValue data into different values for use as Principal objects.

      Note that null keys are ignored, but null values are allowed, which suppresses the mapping of a value caising it to be skipped. Also, keys are not trimmed, but values are, to ensure the result is a valid context class reference.

      Parameters:
      mappings - the value mappings

    • apply

      @Nullable public Collection<Principal> apply(@Nullable ProfileRequestContext input)
      Specified by:
      apply in interface Function<ProfileRequestContext,Collection<Principal>>

    • addMappedValues

      private void addMappedValues(@Nonnull Set<Principal> results, @Nonnull IdPAttribute source)