Package net.shibboleth.sp.saml.saml2.profile.config.impl

Class BrowserSSOProfileConfiguration

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

net.shibboleth.profile.config.AbstractProfileConfiguration

net.shibboleth.profile.config.AbstractConditionalProfileConfiguration

net.shibboleth.sp.profile.config.AbstractConditionalProfileConfiguration

net.shibboleth.sp.saml.saml2.profile.config.impl.AbstractSAML2ProfileConfiguration

net.shibboleth.sp.saml.saml2.profile.config.impl.AbstractSAML2ArtifactConsumerProfileConfiguration

net.shibboleth.sp.saml.saml2.profile.config.impl.AbstractSAML2AssertionConsumerProfileConfiguration

net.shibboleth.sp.saml.saml2.profile.config.impl.BrowserSSOProfileConfiguration

All Implemented Interfaces:

AttributeResolvingProfileConfiguration, ConditionalProfileConfiguration, ProfileConfiguration, SAMLArtifactConsumerProfileConfiguration, SAMLAssertionConsumingProfileConfiguration, SAMLProfileConfiguration, BrowserSSOProfileConfiguration, SAML2ProfileConfiguration, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent, BrowserSSOProfileConfiguration

Direct Known Subclasses:

ECPProfileConfiguration

public class BrowserSSOProfileConfiguration
extends AbstractSAML2AssertionConsumerProfileConfiguration
implements SAMLArtifactConsumerProfileConfiguration, BrowserSSOProfileConfiguration

Configuration support for SP SAML 2.0 Browser SSO.

Field Summary

Fields

Modifier and Type	Field	Description
private Predicate<ProfileRequestContext>	allowUnsolicitedPredicate	Whether to allow empty InResponseTo values.
(package private) Function<ProfileRequestContext,Function<ProfileRequestContext,Collection<IdPAttribute>>>	attributeExtractionStrategyLookupStrategy	Lookup function for attribute extraction strategy.
private Function<ProfileRequestContext,Integer>	attributeIndexLookupStrategy	Lookup function to supply AttributeConsumingServiceIndex.
private Function<ProfileRequestContext,String>	attributeRecipientGroupIDLookupStrategy	Lookup strategy for attribute recipient group ID.
(package private) Function<ProfileRequestContext,String>	attributeResolutionPrincipalLookupStrategy	Lookup function for attribute resolution principal.
private Function<ProfileRequestContext,Collection<String>>	authnContextClassRefLookupStrategy	Lookup function to supply default authentication methods.
private Function<ProfileRequestContext,String>	authnContextComparisonLookupStrategy	Lookup function for requested AC operator.
private Predicate<ProfileRequestContext>	checkAddressPredicate	Whether to compare client and assertion addresses on inbound SSO.
private Predicate<ProfileRequestContext>	checkInResponseToPredicate	Whether to validate inbound InResponseTo values.
private Predicate<ProfileRequestContext>	extractStandardAttributesPredicate	Whether to perform standard response data extraction.
private Predicate<ProfileRequestContext>	forceAuthnPredicate	Whether to mandate forced authentication for the request.
private Function<ProfileRequestContext,Duration>	maximumTimeSinceAuthnLookupStrategy	Lookup function to supply maximum time since inbound AuthnInstant.
private Function<ProfileRequestContext,String>	nameIDFormatLookupStrategy	Lookup function to supply NameID format.
private Function<ProfileRequestContext,String>	nameQualifierLookupStrategy	Lookup function to supply SPNameQualifier.
private Function<ProfileRequestContext,Integer>	proxyCountLookupStrategy	Lookup function to supply ProxyCount.
private Function<ProfileRequestContext,Collection<RequestedAttribute>>	requestedAttributesLookupStrategy	Lookup function to supply RequestedAttributes.
private Function<ProfileRequestContext,Collection<String>>	requestedIdPAttributeNamesLookupStrategy	Lookup strategy for requested IdP attribute names to pass into resolver.
private Predicate<ProfileRequestContext>	requireNotOnOrAfterPredicate	Whether to require NotOnOrAfter value.
private Predicate<ProfileRequestContext>	requireRecipientPredicate	Whether to require Recipient value.
private Predicate<ProfileRequestContext>	resolveAttributesPredicate	Whether attributes should be resolved in the course of the profile.
private Function<ProfileRequestContext,String>	responseBindingLookupStrategy	Lookup function for response binding.
private Predicate<ProfileRequestContext>	validateAuthnContextClassRefsPredicate	Whether to validate incoming ACRs.

Fields inherited from interface net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration

FEATURE_AUTHNCONTEXT, FEATURE_FORCEAUTHN, FEATURE_NAMEIDFORMAT, FEATURE_SCOPING, FEATURE_SPNAMEQUALIFIER, PROFILE_ID

Fields inherited from interface net.shibboleth.profile.config.ProfileConfiguration

DEFAULT_DISALLOWED_FEATURES

Constructor Summary

Constructors

Modifier	Constructor	Description
	BrowserSSOProfileConfiguration()	Constructor.
protected	BrowserSSOProfileConfiguration(String profileId)	Constructor.

Method Summary

Modifier and Type	Method	Description
Function<ProfileRequestContext,Collection<IdPAttribute>>	getAttributeExtractionStrategy(ProfileRequestContext profileRequestContext)	Get a strategy function to apply to SAML responses to extract additional IdPAttribute objects from the data.
Integer	getAttributeIndex(ProfileRequestContext profileRequestContext)
String	getAttributeRecipientGroupID(ProfileRequestContext profileRequestContext)
String	getAttributeResolutionPrincipal(ProfileRequestContext profileRequestContext)	Get a principal name to feed into attribute resolution if AttributeResolvingProfileConfiguration.isResolveAttributes(ProfileRequestContext) is true.
List<String>	getAuthnContextClassRefs(ProfileRequestContext profileRequestContext)	Get the AuthnContextClassRef values to include in SAML request.
AuthnContextComparisonTypeEnumeration	getAuthnContextComparison(ProfileRequestContext profileRequestContext)
Duration	getMaximumTimeSinceAuthn(ProfileRequestContext profileRequestContext)
String	getNameIDFormat(ProfileRequestContext profileRequestContext)	Get the name identifier format to require via the SAML request.
Integer	getProxyCount(ProfileRequestContext profileRequestContext)
Collection<RequestedAttribute>	getRequestedAttributes(ProfileRequestContext profileRequestContext)
Collection<String>	getRequestedIdPAttributeNames(ProfileRequestContext profileRequestContext)
String	getResponseBinding(ProfileRequestContext profileRequestContext)	Get the SAML binding to insert into an AuthnRequest to control the response binding.
String	getSPNameQualifier(ProfileRequestContext profileRequestContext)
boolean	isAllowUnsolicited(ProfileRequestContext profileRequestContext)	Get whether the inbound SubjectConfirmationData.getInResponseTo() value may be empty, i.e., allowing the receipt of unsolicited responses.
boolean	isCheckAddress(ProfileRequestContext profileRequestContext)
boolean	isCheckInResponseTo(ProfileRequestContext profileRequestContext)
boolean	isExtractStandardAttributes(ProfileRequestContext profileRequestContext)	Get whether to perform extractioon of a set of "standard" information from a SAML response and assertions, primarily for compatibility with the older SP software.
boolean	isForceAuthn(ProfileRequestContext profileRequestContext)
boolean	isRequireNotOnOrAfter(ProfileRequestContext profileRequestContext)	Get whether the inbound SubjectConfirmationData.getNotOnOrAfter() value may be empty.
boolean	isRequireRecipient(ProfileRequestContext profileRequestContext)	Get whether the inbound SubjectConfirmationData.getRecipient() value may be empty.
boolean	isResolveAttributes(ProfileRequestContext profileRequestContext)
boolean	isValidateAuthnContextClassRefs(ProfileRequestContext profileRequestContext)	Get whether to validate the incoming assertions' AuthnContextClassRef against any RequestedAuthnContext included in the original request.
void	setAllowUnsolicited(boolean flag)	Sets whether to allow unsolicited SSO responses (i.e., explicitly allow an empty InResponseTo value).
void	setAllowUnsolicitedPredicate(Predicate<ProfileRequestContext> condition)	Sets the condition for whether to allow unsolicited SSO responses (i.e., explicitly allow an empty InResponseTo value).
void	setAttributeExtractionStrategy(Function<ProfileRequestContext,Collection<IdPAttribute>> strategy)	Set the attribute extraction strategy.
void	setAttributeExtractionStrategyLookupStrategy(Function<ProfileRequestContext,Function<ProfileRequestContext,Collection<IdPAttribute>>> strategy)	Set the lookup strategy for the attribute extraction strategy.
void	setAttributeIndex(Integer index)	Set the AttributeConsumingServiceIndex to include in the SAML request.
void	setAttributeIndexLookupStrategy(Function<ProfileRequestContext,Integer> strategy)	Set a lookup strategy for the AttributeConsumingServiceIndex to include in the SAML request.
void	setAttributeRecipientGroupID(String groupID)	Set the group of services for which attributes are being resolved.
void	setAttributeRecipientGroupIDLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the lookup strategy for the group of services for which attributes are being resolved.
void	setAttributeResolutionPrincipal(String principal)	Set a principal name to feed into attribute resolution if isResolveAttributes(ProfileRequestContext) is true.
void	setAttributeResolutionPrincipalLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set a lookup strategy for the principal name to feed into attribute resolution if isResolveAttributes(ProfileRequestContext) is true
void	setAuthnContextClassRefs(Collection<String> contexts)	Set the AuthnContextClassRef values to include in SAML request.
void	setAuthnContextClassRefsLookupStrategy(Function<ProfileRequestContext,Collection<String>> strategy)	Set a lookup strategy for the AuthnContextClassRef values to include in SAML request.
void	setAuthnContextComparison(AuthnContextComparisonTypeEnumeration comparison)	Set the comparison operator to use when issuing SAML requests containing requested context classes.
void	setAuthnContextComparisonLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set a lookup strategy for the comparison operator to use when issuing SAML requests containing requested context classes.
void	setCheckAddress(boolean flag)	Set whether the client's address must match the address in an inbound SubjectLocality element during inbound SSO.
void	setCheckAddressPredicate(Predicate<ProfileRequestContext> condition)	Set a condition to determine whether the client's address must match the address in an inbound SubjectLocality element during inbound SSO.
void	setCheckInResponseTo(boolean flag)	Set whether the inbound InResponseTo value should be checked against the outgoing request message during inbound SSO.
void	setCheckInResponseToPredicate(Predicate<ProfileRequestContext> condition)	Set a condition to determine whether the inbound InResponseTo value should be checked against the outgoing request message during inbound SSO.
void	setExtractStandardAttributes(boolean flag)	Set whether to perform standard data extraction.
void	setExtractStandardAttributesPredicate(Predicate<ProfileRequestContext> condition)	Set a condition for whether to perform standard data extraction.
void	setForceAuthn(boolean flag)	Set whether a fresh user presence proof should be required for this request.
void	setForceAuthnPredicate(Predicate<ProfileRequestContext> condition)	Set a condition to determine whether a fresh user presence proof should be required for this request.
void	setMaximumTimeSinceAuthn(Duration amount)	Set the maximum amount of time allowed to have elapsed since an incoming AuthnInstant.
void	setMaximumTimeSinceAuthnLookupStrategy(Function<ProfileRequestContext,Duration> strategy)	Set a lookup strategy for the maximum amount of time allowed to have elapsed since an incoming AuthnInstant.
void	setNameIDFormat(String format)	Set the name identifier format to require via the SAML request.
void	setNameIDFormatLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set a lookup strategy for the name identifier format to require via the SAML request.
void	setProxyCount(Integer count)	Set the maximum number of times an assertion may be proxied to signal in the SAML request.
void	setProxyCountLookupStrategy(Function<ProfileRequestContext,Integer> strategy)	Set a lookup strategy for the maximum number of times an assertion may be proxied to signal in the SAML request.
void	setRequestedAttributes(Collection<RequestedAttribute> attrs)	Set the list of RequestedAttribute objects to include in the SAML request (via extension).
void	setRequestedAttributesLookupStrategy(Function<ProfileRequestContext,Collection<RequestedAttribute>> strategy)	Set a lookup strategy for the list of RequestedAttribute objects to include in the SAML request (via extension).
void	setRequestedIdPAttributeNames(Collection<String> names)	Set IdPAttribute names to resolve (if resolving attributes).
void	setRequestedIdPAttributeNamesLookupStrategy(Function<ProfileRequestContext,Collection<String>> strategy)	Lookup strategy for IdPAttribute names to resolve (if resolving attributes).
void	setRequireNotOnOrAfter(boolean flag)	Sets whether to require SubjectConfirmationData.getNotOnOrAfter() be non-null.
void	setRequireNotOnOrAfterPredicate(Predicate<ProfileRequestContext> condition)	Sets the condition for whether to require SubjectConfirmationData.getNotOnOrAfter() be non-null.
void	setRequireRecipient(boolean flag)	Sets whether to require SubjectConfirmationData.getRecipient() be non-null.
void	setRequireRecipientPredicate(Predicate<ProfileRequestContext> condition)	Sets the condition for whether to require SubjectConfirmationData.getRecipient() be non-null.
void	setResolveAttributes(boolean flag)	Set whether attributes should be resolved during the profile.
void	setResolveAttributesPredicate(Predicate<ProfileRequestContext> condition)	Set a condition to determine whether attributes should be resolved during the profile.
void	setResponseBinding(String binding)	Set the response binding to place into the AuthnRequest.
void	setResponseBindingLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set a lookup strategy for the response binding to place into the AuthnRequest.
void	setSPNameQualifier(String qualifier)	Set the SPNameQualifier to include in the SAML request.
void	setSPNameQualifierLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set a lookup strategy for the SPNameQualifier to include in the SAML request.
void	setValidateAuthnContextClassRefs(boolean flag)	Set whether to validate the incoming assertions' AuthnContextClassRef against any RequestedAuthnContext included in the original request.
void	setValidateAuthnContextClassRefsPredicate(Predicate<ProfileRequestContext> condition)	Set a condition for whether to validate the incoming assertions' AuthnContextClassRef against any RequestedAuthnContext included in the original request.

Methods inherited from class net.shibboleth.sp.saml.saml2.profile.config.impl.AbstractSAML2AssertionConsumerProfileConfiguration

getAssertionAudiences, getAssertionLifetime, isRequireSignedAssertions, setAssertionAudiences, setAssertionAudiencesLookupStrategy, setAssertionLifetime, setAssertionLifetimeLookupStrategy, setRequireSignedAssertions, setRequireSignedAssertionsPredicate

Methods inherited from class net.shibboleth.sp.saml.saml2.profile.config.impl.AbstractSAML2ArtifactConsumerProfileConfiguration

isClientTLSArtifactRequests, isSignArtifactRequests, setClientTLSArtifactRequests, setClientTLSArtifactRequestsPredicate, setSignArtifactRequests, setSignArtifactRequestsPredicate

Methods inherited from class net.shibboleth.sp.saml.saml2.profile.config.impl.AbstractSAML2ProfileConfiguration

getMessageHandler, isEncryptionOptional, isEncryptNameIDs, isIgnoreRequestSignatures, isSignRequests, isSignResponses, setEncryptionOptional, setEncryptionOptionalPredicate, setEncryptNameIDs, setEncryptNameIDsPredicate, setIgnoreRequestSignatures, setIgnoreRequestSignaturesPredicate, setMessageHandler, setMessageHandlerLookupStrategy, setSignRequests, setSignRequestsPredicate, setSignResponses, setSignResponsesPredicate

Methods inherited from class net.shibboleth.sp.profile.config.AbstractConditionalProfileConfiguration

setDisallowedFeatures

Methods inherited from class net.shibboleth.profile.config.AbstractConditionalProfileConfiguration

getActivationCondition, setActivationCondition

Methods inherited from class net.shibboleth.profile.config.AbstractProfileConfiguration

equals, getDisallowedFeatures, getSecurityConfiguration, hashCode, isFeatureDisallowed, setDisallowedFeatures, setDisallowedFeaturesLookupStrategy, setSecurityConfiguration, setSecurityConfigurationLookupStrategy

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Methods inherited from interface net.shibboleth.profile.config.ProfileConfiguration

getDisallowedFeatures, getSecurityConfiguration, isFeatureDisallowed

Methods inherited from interface net.shibboleth.saml.saml2.profile.config.SAML2ProfileConfiguration

isEncryptionOptional, isEncryptNameIDs, isIgnoreRequestSignatures

Methods inherited from interface net.shibboleth.saml.profile.config.SAMLArtifactConsumerProfileConfiguration

isClientTLSArtifactRequests, isSignArtifactRequests

Methods inherited from interface net.shibboleth.saml.profile.config.SAMLAssertionConsumingProfileConfiguration

getAssertionAudiences, getAssertionLifetime, isRequireSignedAssertions

Methods inherited from interface net.shibboleth.saml.profile.config.SAMLProfileConfiguration

getMessageHandler, isSignRequests, isSignResponses

Field Details

resolveAttributesPredicate

@Nonnull
private Predicate<ProfileRequestContext> resolveAttributesPredicate

Whether attributes should be resolved in the course of the profile.

requestedIdPAttributeNamesLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Collection<String>> requestedIdPAttributeNamesLookupStrategy

Lookup strategy for requested IdP attribute names to pass into resolver.

attributeRecipientGroupIDLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> attributeRecipientGroupIDLookupStrategy

Lookup strategy for attribute recipient group ID.

forceAuthnPredicate

@Nonnull
private Predicate<ProfileRequestContext> forceAuthnPredicate

Whether to mandate forced authentication for the request.

checkAddressPredicate

@Nonnull
private Predicate<ProfileRequestContext> checkAddressPredicate

Whether to compare client and assertion addresses on inbound SSO.

checkInResponseToPredicate

@Nonnull
private Predicate<ProfileRequestContext> checkInResponseToPredicate

Whether to validate inbound InResponseTo values.

requireRecipientPredicate

@Nonnull
private Predicate<ProfileRequestContext> requireRecipientPredicate

Whether to require Recipient value.

requireNotOnOrAfterPredicate

@Nonnull
private Predicate<ProfileRequestContext> requireNotOnOrAfterPredicate

Whether to require NotOnOrAfter value.

allowUnsolicitedPredicate

@Nonnull
private Predicate<ProfileRequestContext> allowUnsolicitedPredicate

Whether to allow empty InResponseTo values.

maximumTimeSinceAuthnLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Duration> maximumTimeSinceAuthnLookupStrategy

Lookup function to supply maximum time since inbound AuthnInstant.

proxyCountLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy

Lookup function to supply ProxyCount.

authnContextComparisonLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> authnContextComparisonLookupStrategy

Lookup function for requested AC operator.

authnContextClassRefLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Collection<String>> authnContextClassRefLookupStrategy

Lookup function to supply default authentication methods.

validateAuthnContextClassRefsPredicate

@Nonnull
private Predicate<ProfileRequestContext> validateAuthnContextClassRefsPredicate

Whether to validate incoming ACRs.

nameIDFormatLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> nameIDFormatLookupStrategy

Lookup function to supply NameID format.

nameQualifierLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> nameQualifierLookupStrategy

Lookup function to supply SPNameQualifier.

attributeIndexLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Integer> attributeIndexLookupStrategy

Lookup function to supply AttributeConsumingServiceIndex.

requestedAttributesLookupStrategy

@Nonnull
private Function<ProfileRequestContext,Collection<RequestedAttribute>> requestedAttributesLookupStrategy

Lookup function to supply RequestedAttributes.

responseBindingLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> responseBindingLookupStrategy

Lookup function for response binding.

extractStandardAttributesPredicate

@Nonnull
private Predicate<ProfileRequestContext> extractStandardAttributesPredicate

Whether to perform standard response data extraction.

attributeExtractionStrategyLookupStrategy

@Nonnull
Function<ProfileRequestContext,Function<ProfileRequestContext,Collection<IdPAttribute>>> attributeExtractionStrategyLookupStrategy

Lookup function for attribute extraction strategy.

attributeResolutionPrincipalLookupStrategy

@Nonnull
Function<ProfileRequestContext,String> attributeResolutionPrincipalLookupStrategy

Lookup function for attribute resolution principal.

Constructor Details

BrowserSSOProfileConfiguration

public BrowserSSOProfileConfiguration()

Constructor.

BrowserSSOProfileConfiguration

protected BrowserSSOProfileConfiguration(@Nonnull @NotEmpty
 String profileId)

Constructor.

Parameters:

profileId - unique ID for this profile

Method Details

isResolveAttributes

public boolean isResolveAttributes(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

isResolveAttributes in interface AttributeResolvingProfileConfiguration

setResolveAttributes

public void setResolveAttributes(boolean flag)

Set whether attributes should be resolved during the profile.

Parameters:

flag - flag to set

setResolveAttributesPredicate

public void setResolveAttributesPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set a condition to determine whether attributes should be resolved during the profile.

Parameters:

condition - condition to set

getRequestedIdPAttributeNames

@Nonnull
@Unmodifiable
@NotLive
public Collection<String> getRequestedIdPAttributeNames(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getRequestedIdPAttributeNames in interface AttributeResolvingProfileConfiguration

setRequestedIdPAttributeNames

public void setRequestedIdPAttributeNames(@Nullable
 Collection<String> names)

Set IdPAttribute names to resolve (if resolving attributes).

Parameters:

names - IdPAttribute names to resolve

Since:

5.2.0

setRequestedIdPAttributeNamesLookupStrategy

public void setRequestedIdPAttributeNamesLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Collection<String>> strategy)

Lookup strategy for IdPAttribute names to resolve (if resolving attributes).

Parameters:

strategy - lookup strategy

Since:

5.2.0

getAttributeRecipientGroupID

@Nullable
public String getAttributeRecipientGroupID(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getAttributeRecipientGroupID in interface AttributeResolvingProfileConfiguration

setAttributeRecipientGroupID

public void setAttributeRecipientGroupID(@Nullable
 String groupID)

Set the group of services for which attributes are being resolved.

Parameters:

groupID - group identifier

setAttributeRecipientGroupIDLookupStrategy

public void setAttributeRecipientGroupIDLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set the lookup strategy for the group of services for which attributes are being resolved.

Parameters:

strategy - lookup strategy

isForceAuthn

public boolean isForceAuthn(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

isForceAuthn in interface BrowserSSOProfileConfiguration

setForceAuthn

public void setForceAuthn(boolean flag)

Set whether a fresh user presence proof should be required for this request.

Parameters:

flag - flag to set

setForceAuthnPredicate

public void setForceAuthnPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set a condition to determine whether a fresh user presence proof should be required for this request.

Parameters:

condition - condition to set

isCheckAddress

public boolean isCheckAddress(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

isCheckAddress in interface BrowserSSOProfileConfiguration

setCheckAddress

public void setCheckAddress(boolean flag)

Set whether the client's address must match the address in an inbound SubjectLocality element during inbound SSO.

Parameters:

flag - flag to set

setCheckAddressPredicate

public void setCheckAddressPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set a condition to determine whether the client's address must match the address in an inbound SubjectLocality element during inbound SSO.

Parameters:

condition - condition to set

isCheckInResponseTo

public boolean isCheckInResponseTo(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

isCheckInResponseTo in interface BrowserSSOProfileConfiguration

setCheckInResponseTo

public void setCheckInResponseTo(boolean flag)

Set whether the inbound InResponseTo value should be checked against the outgoing request message during inbound SSO.

Parameters:

flag - flag to set

setCheckInResponseToPredicate

public void setCheckInResponseToPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set a condition to determine whether the inbound InResponseTo value should be checked against the outgoing request message during inbound SSO.

Parameters:

condition - condition to set

isRequireRecipient

public boolean isRequireRecipient(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether the inbound SubjectConfirmationData.getRecipient() value may be empty.

Its presence is required by the profile, so this is provided as a bug workaround.

Note that this does not allow it to be present but invalid.

Specified by:

isRequireRecipient in interface BrowserSSOProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

whether to enforce the presence of Recipient

setRequireRecipient

public void setRequireRecipient(boolean flag)

Sets whether to require SubjectConfirmationData.getRecipient() be non-null.

Parameters:

flag - flag to set

setRequireRecipientPredicate

public void setRequireRecipientPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Sets the condition for whether to require SubjectConfirmationData.getRecipient() be non-null.

Parameters:

condition - condition to set

isRequireNotOnOrAfter

public boolean isRequireNotOnOrAfter(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether the inbound SubjectConfirmationData.getNotOnOrAfter() value may be empty.

Its presence is required by the profile, so this is provided as a bug workaround.

Note that this does not allow it to be present but invalid.

Specified by:

isRequireNotOnOrAfter in interface BrowserSSOProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

whether to enforce the presence of Recipient

setRequireNotOnOrAfter

public void setRequireNotOnOrAfter(boolean flag)

Sets whether to require SubjectConfirmationData.getNotOnOrAfter() be non-null.

Parameters:

flag - flag to set

setRequireNotOnOrAfterPredicate

public void setRequireNotOnOrAfterPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Sets the condition for whether to require SubjectConfirmationData.getNotOnOrAfter() be non-null.

Parameters:

condition - condition to set

isAllowUnsolicited

public boolean isAllowUnsolicited(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether the inbound SubjectConfirmationData.getInResponseTo() value may be empty, i.e., allowing the receipt of unsolicited responses.

Specified by:

isAllowUnsolicited in interface BrowserSSOProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

whether to allow unsolicited SSO

setAllowUnsolicited

public void setAllowUnsolicited(boolean flag)

Sets whether to allow unsolicited SSO responses (i.e., explicitly allow an empty InResponseTo value).

Defaults to true.

Parameters:

flag - flag to set

setAllowUnsolicitedPredicate

public void setAllowUnsolicitedPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Sets the condition for whether to allow unsolicited SSO responses (i.e., explicitly allow an empty InResponseTo value).

Defaults to true.

Parameters:

condition - condition to set

getMaximumTimeSinceAuthn

@Nullable
public Duration getMaximumTimeSinceAuthn(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getMaximumTimeSinceAuthn in interface BrowserSSOProfileConfiguration

setMaximumTimeSinceAuthn

public void setMaximumTimeSinceAuthn(@Nullable
 Duration amount)

Set the maximum amount of time allowed to have elapsed since an incoming AuthnInstant.

A null or 0 is interpreted as an unlimited amount.

Parameters:

amount - max time to allow

setMaximumTimeSinceAuthnLookupStrategy

public void setMaximumTimeSinceAuthnLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Duration> strategy)

Set a lookup strategy for the maximum amount of time allowed to have elapsed since an incoming AuthnInstant.

Parameters:

strategy - lookup strategy

getProxyCount

@NonNegative
@Nullable
public Integer getProxyCount(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getProxyCount in interface BrowserSSOProfileConfiguration

setProxyCount

public void setProxyCount(@Nullable @NonNegative
 Integer count)

Set the maximum number of times an assertion may be proxied to signal in the SAML request.

Parameters:

count - maximum number of times an assertion may be proxied

setProxyCountLookupStrategy

public void setProxyCountLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Integer> strategy)

Set a lookup strategy for the maximum number of times an assertion may be proxied to signal in the SAML request.

Parameters:

strategy - lookup strategy

getAuthnContextComparison

@Nullable
public AuthnContextComparisonTypeEnumeration getAuthnContextComparison(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getAuthnContextComparison in interface BrowserSSOProfileConfiguration

setAuthnContextComparison

public void setAuthnContextComparison(@Nullable
 AuthnContextComparisonTypeEnumeration comparison)

Set the comparison operator to use when issuing SAML requests containing requested context classes.

Parameters:

comparison - comparison value or null

Since:

4.0.0

setAuthnContextComparisonLookupStrategy

public void setAuthnContextComparisonLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set a lookup strategy for the comparison operator to use when issuing SAML requests containing requested context classes.

Parameters:

strategy - lookup strategy

getAuthnContextClassRefs

@Nonnull
@NonnullElements
@NotLive
@Unmodifiable
public List<String> getAuthnContextClassRefs(@Nullable
 ProfileRequestContext profileRequestContext)

Get the AuthnContextClassRef values to include in SAML request.

Specified by:

getAuthnContextClassRefs in interface BrowserSSOProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

list of class references

setAuthnContextClassRefs

public void setAuthnContextClassRefs(@Nullable @NonnullElements
 Collection<String> contexts)

Set the AuthnContextClassRef values to include in SAML request.

Parameters:

contexts - default authentication context class references to use

setAuthnContextClassRefsLookupStrategy

public void setAuthnContextClassRefsLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Collection<String>> strategy)

Set a lookup strategy for the AuthnContextClassRef values to include in SAML request.

Parameters:

strategy - lookup strategy

isValidateAuthnContextClassRefs

public boolean isValidateAuthnContextClassRefs(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether to validate the incoming assertions' AuthnContextClassRef against any RequestedAuthnContext included in the original request.

This leverages both the Hub's StateManager to recover the requested values and the IdP's existing machibery for evaluating the information in the case of inexact comparison operators.

Defaults to true.

Specified by:

isValidateAuthnContextClassRefs in interface BrowserSSOProfileConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

whether to cross check the resulting ACRs

setValidateAuthnContextClassRefs

public void setValidateAuthnContextClassRefs(boolean flag)

Set whether to validate the incoming assertions' AuthnContextClassRef against any RequestedAuthnContext included in the original request.

Parameters:

flag - flag to set

setValidateAuthnContextClassRefsPredicate

public void setValidateAuthnContextClassRefsPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set a condition for whether to validate the incoming assertions' AuthnContextClassRef against any RequestedAuthnContext included in the original request.

Parameters:

condition - condition to set

getNameIDFormat

@Nullable
public String getNameIDFormat(@Nullable
 ProfileRequestContext profileRequestContext)

Get the name identifier format to require via the SAML request.

Specified by:

getNameIDFormat in interface BrowserSSOProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

required format

setNameIDFormat

public void setNameIDFormat(@Nullable
 String format)

Set the name identifier format to require via the SAML request.

Parameters:

format - required format

setNameIDFormatLookupStrategy

public void setNameIDFormatLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set a lookup strategy for the name identifier format to require via the SAML request.

Parameters:

strategy - lookup strategy

getSPNameQualifier

@Nullable
public String getSPNameQualifier(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getSPNameQualifier in interface BrowserSSOProfileConfiguration

setSPNameQualifier

public void setSPNameQualifier(@Nullable
 String qualifier)

Set the SPNameQualifier to include in the SAML request.

Parameters:

qualifier - requested SPNameQualifier

setSPNameQualifierLookupStrategy

public void setSPNameQualifierLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set a lookup strategy for the SPNameQualifier to include in the SAML request.

Parameters:

strategy - lookup strategy

getAttributeIndex

@Nullable
public Integer getAttributeIndex(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getAttributeIndex in interface BrowserSSOProfileConfiguration

setAttributeIndex

public void setAttributeIndex(@Nullable
 Integer index)

Set the AttributeConsumingServiceIndex to include in the SAML request.

Parameters:

index - the AttributeConsumingServiceIndex

setAttributeIndexLookupStrategy

public void setAttributeIndexLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Integer> strategy)

Set a lookup strategy for the AttributeConsumingServiceIndex to include in the SAML request.

Parameters:

strategy - lookup strategy

getRequestedAttributes

@Nonnull
@NonnullElements
@Unmodifiable
@NotLive
public Collection<RequestedAttribute> getRequestedAttributes(@Nullable
 ProfileRequestContext profileRequestContext)

Specified by:

getRequestedAttributes in interface BrowserSSOProfileConfiguration

setRequestedAttributes

public void setRequestedAttributes(@Nullable @NonnullElements
 Collection<RequestedAttribute> attrs)

Set the list of RequestedAttribute objects to include in the SAML request (via extension).

Parameters:

attrs - requested attributes

setRequestedAttributesLookupStrategy

public void setRequestedAttributesLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Collection<RequestedAttribute>> strategy)

Set a lookup strategy for the list of RequestedAttribute objects to include in the SAML request (via extension).

Parameters:

strategy - lookup strategy

getResponseBinding

@Nullable
public String getResponseBinding(@Nullable
 ProfileRequestContext profileRequestContext)

Get the SAML binding to insert into an AuthnRequest to control the response binding.

Defaults tp SAMLConstants.SAML2_POST_BINDING_URI.

Specified by:

getResponseBinding in interface BrowserSSOProfileConfiguration

Parameters:

profileRequestContext - current profile request context

Returns:

response binding

setResponseBinding

public void setResponseBinding(@Nullable
 String binding)

Set the response binding to place into the AuthnRequest.

Defaults tp SAMLConstants.SAML2_POST_BINDING_URI.

Parameters:

binding - response binding

setResponseBindingLookupStrategy

public void setResponseBindingLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set a lookup strategy for the response binding to place into the AuthnRequest.

Parameters:

strategy - lookup strategy

isExtractStandardAttributes

public boolean isExtractStandardAttributes(@Nullable
 ProfileRequestContext profileRequestContext)

Get whether to perform extractioon of a set of "standard" information from a SAML response and assertions, primarily for compatibility with the older SP software.

This is essentially a built-in extraction strategy that can be supplemented via BrowserSSOProfileConfiguration.getAttributeExtractionStrategy(ProfileRequestContext).

Defaults to "true".

Specified by:

isExtractStandardAttributes in interface BrowserSSOProfileConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

whether to perform standard data extraction

setExtractStandardAttributes

public void setExtractStandardAttributes(boolean flag)

Set whether to perform standard data extraction.

Parameters:

flag - flag to set

setExtractStandardAttributesPredicate

public void setExtractStandardAttributesPredicate(@Nonnull
 Predicate<ProfileRequestContext> condition)

Set a condition for whether to perform standard data extraction.

Parameters:

condition - condition to set

getAttributeExtractionStrategy

@Nullable
public Function<ProfileRequestContext,Collection<IdPAttribute>> getAttributeExtractionStrategy(@Nullable
 ProfileRequestContext profileRequestContext)

Get a strategy function to apply to SAML responses to extract additional IdPAttribute objects from the data.

This supplements the built-in behavior that decodes any SAML Attribute objects in the validated assertion(s).

Specified by:

getAttributeExtractionStrategy in interface BrowserSSOProfileConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

extraction strategy

setAttributeExtractionStrategy

public void setAttributeExtractionStrategy(@Nonnull
 Function<ProfileRequestContext,Collection<IdPAttribute>> strategy)

Set the attribute extraction strategy.

Parameters:

strategy - strategy function

setAttributeExtractionStrategyLookupStrategy

public void setAttributeExtractionStrategyLookupStrategy(@Nonnull
 Function<ProfileRequestContext,Function<ProfileRequestContext,Collection<IdPAttribute>>> strategy)

Set the lookup strategy for the attribute extraction strategy.

Parameters:

strategy - lookup strategy

getAttributeResolutionPrincipal

@Nullable
public String getAttributeResolutionPrincipal(@Nullable
 ProfileRequestContext profileRequestContext)

Get a principal name to feed into attribute resolution if AttributeResolvingProfileConfiguration.isResolveAttributes(ProfileRequestContext) is true.

Specified by:

getAttributeResolutionPrincipal in interface BrowserSSOProfileConfiguration

Parameters:

profileRequestContext - profile request context

Returns:

principal name to use during resolution

setAttributeResolutionPrincipal

public void setAttributeResolutionPrincipal(@Nullable
 String principal)

Set a principal name to feed into attribute resolution if isResolveAttributes(ProfileRequestContext) is true.

Parameters:

principal - principal name to set

setAttributeResolutionPrincipalLookupStrategy

public void setAttributeResolutionPrincipalLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set a lookup strategy for the principal name to feed into attribute resolution if isResolveAttributes(ProfileRequestContext) is true

Parameters:

strategy - lookup strategy