Package net.shibboleth.idp.saml.saml2.profile.impl

Class ProcessAssertionsForAuthentication

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.saml.saml2.profile.impl.ProcessAssertionsForAuthentication

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ProcessAssertionsForAuthentication
extends AbstractProfileAction

Perform processing of a SAML 2 Response's Assertions that have been validated by earlier actions for use in finalization of SAML-based authentication by later actions.

The result of this action is to strip any invalid assertions from the response, and to preserve the "best"/selected AuthnStatement and any other content required in a pluggable manner.

The default behavior is to store the statement and the related Subject in a SAMLAuthnContext located by a lookup strategy.

Event:

EventIds.PROCEED_EVENT_ID, EventIds.INVALID_MESSAGE, AuthnEventIds.INVALID_CREDENTIALS

Postcondition:

the selected statement is passed into the supplied BiConsumer

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
private final class	ProcessAssertionsForAuthentication.AssertionContainsAuthenticationStatement	Predicate for assertions containing at least 1 AuthenticationStatement.
private final class	ProcessAssertionsForAuthentication.AssertionContainsConfirmedSubject	Predicate for assertions which have been validated and have a confirmed Subject.
private final class	ProcessAssertionsForAuthentication.AssertionIsValid	Predicate for valid assertions.
private final class	ProcessAssertionsForAuthentication.DefaultResponseResolver	The default response resolver function.
private final class	ProcessAssertionsForAuthentication.DefaultSAMLConsumer	Default implementation of a "sink" for the SAML objects preserved by this action.

Field Summary

Fields

Modifier and Type	Field	Description
private Function<List<Assertion>,Assertion>	authnAssertionSelectionStrategy	Selection strategy for multiple valid authn Assertions.
private Function<Assertion,AuthnStatement>	authnStatementSelectionStrategy	Selection strategy for multiple AuthnStatements.
private final org.slf4j.Logger	log	Logger.
private Response	response	The Response to process.
private Function<ProfileRequestContext,Response>	responseResolver	The resolver for the response to be processed.
private BiConsumer<ProfileRequestContext,AuthnStatement>	samlConsumer	"Sink" for preserving SAML objects.
private Function<ProfileRequestContext,SAMLAuthnContext>	samlContextLookupStrategy	Lookup strategy to locate the SAML context.

Constructor Summary

Constructors

Constructor	Description
ProcessAssertionsForAuthentication()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
void	setAuthnAssertionSelectionStrategy(Function<List<Assertion>,Assertion> strategy)	Set the strategy function for selecting which of multiple valid Assertions to use.
void	setAuthnStatementSelectionStrategy(Function<Assertion,AuthnStatement> strategy)	Set the strategy function for selecting which of multiple AuthnStatements to use.
void	setResponseResolver(Function<ProfileRequestContext,Response> strategy)	Set the strategy function which resolves the response to process.
void	setSAMLAuthnContextLookupStrategy(Function<ProfileRequestContext,SAMLAuthnContext> strategy)	Set the lookup strategy used to locate the SAMLAuthnContext.
void	setSAMLConsumer(BiConsumer<ProfileRequestContext,AuthnStatement> consumer)	Set the BiConsumer used to save off the SAML statemen and any related objects as a result of this action.

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Logger.

responseResolver

@Nonnull
private Function<ProfileRequestContext,Response> responseResolver

The resolver for the response to be processed.

samlContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,SAMLAuthnContext> samlContextLookupStrategy

Lookup strategy to locate the SAML context.

samlConsumer

@Nonnull
private BiConsumer<ProfileRequestContext,AuthnStatement> samlConsumer

"Sink" for preserving SAML objects.

authnAssertionSelectionStrategy

@Nonnull
private Function<List<Assertion>,Assertion> authnAssertionSelectionStrategy

Selection strategy for multiple valid authn Assertions.

authnStatementSelectionStrategy

@Nonnull
private Function<Assertion,AuthnStatement> authnStatementSelectionStrategy

Selection strategy for multiple AuthnStatements.

response

@NonnullBeforeExec
private Response response

The Response to process.

Constructor Details

ProcessAssertionsForAuthentication

public ProcessAssertionsForAuthentication()

Constructor.

Method Details

setAuthnAssertionSelectionStrategy

public void setAuthnAssertionSelectionStrategy(@Nonnull
 Function<List<Assertion>,Assertion> strategy)

Set the strategy function for selecting which of multiple valid Assertions to use.

Parameters:

strategy - the new strategy function

setAuthnStatementSelectionStrategy

public void setAuthnStatementSelectionStrategy(@Nonnull
 Function<Assertion,AuthnStatement> strategy)

Set the strategy function for selecting which of multiple AuthnStatements to use.

Parameters:

strategy - the new strategy function

setResponseResolver

public void setResponseResolver(@Nonnull
 Function<ProfileRequestContext,Response> strategy)

Set the strategy function which resolves the response to process.

Parameters:

strategy - the new strategy function

setSAMLAuthnContextLookupStrategy

public void setSAMLAuthnContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,SAMLAuthnContext> strategy)

Set the lookup strategy used to locate the SAMLAuthnContext.

Parameters:

strategy - the new strategy function

setSAMLConsumer

public void setSAMLConsumer(@Nonnull
 BiConsumer<ProfileRequestContext,AuthnStatement> consumer)

Set the BiConsumer used to save off the SAML statemen and any related objects as a result of this action.

This insulates the actiion from the specific context in which it may be used. The supplied consumer MUST establish any non-successful event via the supplied context if it fails.

Parameters:

consumer - consumer to set

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractConditionalProfileAction

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction