Package net.shibboleth.sp.saml.saml2.profile.config

Interface BrowserSSOProfileConfiguration

All Superinterfaces:

AttributeResolvingProfileConfiguration, BrowserSSOProfileConfiguration, Component, IdentifiedComponent, ProfileConfiguration, SAML2ProfileConfiguration, SAMLArtifactConsumerProfileConfiguration, SAMLAssertionConsumingProfileConfiguration, SAMLProfileConfiguration

All Known Subinterfaces:

ECPProfileConfiguration

All Known Implementing Classes:

BrowserSSOProfileConfiguration, ECPProfileConfiguration

public interface BrowserSSOProfileConfiguration
extends SAMLArtifactConsumerProfileConfiguration, BrowserSSOProfileConfiguration

Configuration support for SP SAML 2.0 Browser SSO.

Field Summary

Fields inherited from interface net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration

FEATURE_AUTHNCONTEXT, FEATURE_FORCEAUTHN, FEATURE_NAMEIDFORMAT, FEATURE_SCOPING, FEATURE_SPNAMEQUALIFIER, PROFILE_ID

Fields inherited from interface net.shibboleth.profile.config.ProfileConfiguration

DEFAULT_DISALLOWED_FEATURES

Method Summary

Modifier and Type	Method	Description
Function<ProfileRequestContext,Collection<IdPAttribute>>	getAttributeExtractionStrategy(ProfileRequestContext profileRequestContext)	Get a strategy function to apply to SAML responses to extract additional IdPAttribute objects from the data.
String	getAttributeResolutionPrincipal(ProfileRequestContext profileRequestContext)	Get a principal name to feed into attribute resolution if AttributeResolvingProfileConfiguration.isResolveAttributes(ProfileRequestContext) is true.
List<String>	getAuthnContextClassRefs(ProfileRequestContext profileRequestContext)	Get the AuthnContextClassRef values to include in SAML request.
String	getNameIDFormat(ProfileRequestContext profileRequestContext)	Get the name identifier format to require via the SAML request.
String	getResponseBinding(ProfileRequestContext profileRequestContext)	Get the SAML binding to insert into an AuthnRequest to control the response binding.
boolean	isAllowUnsolicited(ProfileRequestContext profileRequestContext)	Get whether the inbound SubjectConfirmationData.getInResponseTo() value may be empty, i.e., allowing the receipt of unsolicited responses.
boolean	isExtractStandardAttributes(ProfileRequestContext profileRequestContext)	Get whether to perform extractioon of a set of "standard" information from a SAML response and assertions, primarily for compatibility with the older SP software.
boolean	isRequireNotOnOrAfter(ProfileRequestContext profileRequestContext)	Get whether the inbound SubjectConfirmationData.getNotOnOrAfter() value may be empty.
boolean	isRequireRecipient(ProfileRequestContext profileRequestContext)	Get whether the inbound SubjectConfirmationData.getRecipient() value may be empty.
boolean	isValidateAuthnContextClassRefs(ProfileRequestContext profileRequestContext)	Get whether to validate the incoming assertions' AuthnContextClassRef against any RequestedAuthnContext included in the original request.

Methods inherited from interface net.shibboleth.profile.config.AttributeResolvingProfileConfiguration

getAttributeRecipientGroupID, getRequestedIdPAttributeNames, isResolveAttributes

Methods inherited from interface net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration

getAttributeIndex, getAuthnContextComparison, getMaximumTimeSinceAuthn, getProxyCount, getRequestedAttributes, getSPNameQualifier, isCheckAddress, isCheckInResponseTo, isForceAuthn

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Methods inherited from interface net.shibboleth.profile.config.ProfileConfiguration

getDisallowedFeatures, getSecurityConfiguration, isFeatureDisallowed

Methods inherited from interface net.shibboleth.saml.saml2.profile.config.SAML2ProfileConfiguration

isEncryptionOptional, isEncryptNameIDs, isIgnoreRequestSignatures

Methods inherited from interface net.shibboleth.saml.profile.config.SAMLArtifactConsumerProfileConfiguration

isClientTLSArtifactRequests, isSignArtifactRequests

Methods inherited from interface net.shibboleth.saml.profile.config.SAMLAssertionConsumingProfileConfiguration

getAssertionAudiences, getAssertionLifetime, isRequireSignedAssertions

Methods inherited from interface net.shibboleth.saml.profile.config.SAMLProfileConfiguration

getMessageHandler, isSignRequests, isSignResponses

Method Details

isAllowUnsolicited

@ConfigurationSetting(name="allowUnsolicited")
boolean isAllowUnsolicited(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether the inbound SubjectConfirmationData.getInResponseTo() value may be empty, i.e., allowing the receipt of unsolicited responses.

Parameters:

profileRequestContext - current profile request context

Returns:

whether to allow unsolicited SSO

isRequireRecipient

@ConfigurationSetting(name="requireRecipient")
boolean isRequireRecipient(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether the inbound SubjectConfirmationData.getRecipient() value may be empty.

Its presence is required by the profile, so this is provided as a bug workaround.

Note that this does not allow it to be present but invalid.

Parameters:

profileRequestContext - current profile request context

Returns:

whether to enforce the presence of Recipient

isRequireNotOnOrAfter

@ConfigurationSetting(name="requireNotOnOrAfter")
boolean isRequireNotOnOrAfter(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether the inbound SubjectConfirmationData.getNotOnOrAfter() value may be empty.

Its presence is required by the profile, so this is provided as a bug workaround.

Note that this does not allow it to be present but invalid.

Parameters:

profileRequestContext - current profile request context

Returns:

whether to enforce the presence of Recipient

getAuthnContextClassRefs

@ConfigurationSetting(name="authnContextClassRefs")
@Nonnull
@NotLive
@Unmodifiable
List<String> getAuthnContextClassRefs(@Nullable
 ProfileRequestContext profileRequestContext)

Get the AuthnContextClassRef values to include in SAML request.

Parameters:

profileRequestContext - current profile request context

Returns:

list of class references

isValidateAuthnContextClassRefs

@ConfigurationSetting(name="validateAuthnContextClassRefs")
boolean isValidateAuthnContextClassRefs(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether to validate the incoming assertions' AuthnContextClassRef against any RequestedAuthnContext included in the original request.

This leverages both the Hub's StateManager to recover the requested values and the IdP's existing machibery for evaluating the information in the case of inexact comparison operators.

Defaults to true.

Parameters:

profileRequestContext - profile request context

Returns:

whether to cross check the resulting ACRs

getNameIDFormat

@ConfigurationSetting(name="nameIDFormat")
@Nullable
String getNameIDFormat(@Nullable
 ProfileRequestContext profileRequestContext)

Get the name identifier format to require via the SAML request.

Parameters:

profileRequestContext - current profile request context

Returns:

required format

getResponseBinding

@ConfigurationSetting(name="responseBinding")
@Nullable
String getResponseBinding(@Nullable
 ProfileRequestContext profileRequestContext)

Get the SAML binding to insert into an AuthnRequest to control the response binding.

Defaults tp SAMLConstants.SAML2_POST_BINDING_URI.

Parameters:

profileRequestContext - current profile request context

Returns:

response binding

isExtractStandardAttributes

@ConfigurationSetting(name="extractStandardAttributes")
boolean isExtractStandardAttributes(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether to perform extractioon of a set of "standard" information from a SAML response and assertions, primarily for compatibility with the older SP software.

This is essentially a built-in extraction strategy that can be supplemented via getAttributeExtractionStrategy(ProfileRequestContext).

Defaults to "true".

Parameters:

profileRequestContext - profile request context

Returns:

whether to perform standard data extraction

getAttributeExtractionStrategy

@ConfigurationSetting(name="attributeExtractionStrategy")
@Nullable
Function<ProfileRequestContext,Collection<IdPAttribute>> getAttributeExtractionStrategy(@Nullable
 ProfileRequestContext profileRequestContext)

Get a strategy function to apply to SAML responses to extract additional IdPAttribute objects from the data.

This supplements the built-in behavior that decodes any SAML Attribute objects in the validated assertion(s).

Parameters:

profileRequestContext - profile request context

Returns:

extraction strategy

getAttributeResolutionPrincipal

@ConfigurationSetting(name="attributeResolutionPrincipal")
@Nullable
String getAttributeResolutionPrincipal(@Nullable
 ProfileRequestContext profileRequestContext)

Get a principal name to feed into attribute resolution if AttributeResolvingProfileConfiguration.isResolveAttributes(ProfileRequestContext) is true.

Parameters:

profileRequestContext - profile request context

Returns:

principal name to use during resolution