Package net.shibboleth.sp.saml.saml2.profile.impl

Class AddAuthnRequest

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.sp.profile.AbstractAgentRequestAction
net.shibboleth.sp.profile.AbstractAgentAction
net.shibboleth.sp.profile.AbstractApplicationAction
net.shibboleth.sp.saml.saml2.profile.impl.AddAuthnRequest
All Implemented Interfaces:
Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action
public class AddAuthnRequest extends AbstractApplicationAction
Action that creates an AuthnRequest and sets it as the message returned by InOutOperationContext.getOutboundMessageContext().

If an issuer value is returned via a lookup strategy, then it's set as the Issuer of the message.

Various other values are derived from the active configuration such as RequestedAuthnContext, NameIDPolicy, and Scoping. This process is much more complex than the IdP, as it requires marrying together inputs from the agent against the profile configuration, including enforcing limits on what the agent can override/supply.

This action is also responsible for creating a StateDataContext and populating a SAMLStateData object with any relevant state necessary to preserve.

Event:
EventIds.PROCEED_EVENT_ID, EventIds.INVALID_MESSAGE, EventIds.INVALID_MSG_CTX, EventIds.INVALID_PROFILE_CTX, IdPEventIds.INVALID_PROFILE_CONFIG
Postcondition:
ProfileRequestContext.getOutboundMessageContext().getMessage() != null, ProfileRequestContext.ensureSubcontext(StateDataContext.class).getStateData() != null

  • Field Details

  • Constructor Details

    • AddAuthnRequest

      public AddAuthnRequest()
      Constructor.

  • Method Details

    • setOverwriteExisting

      public void setOverwriteExisting(boolean flag)
      Set whether to overwrite an existing message.
      Parameters:
      flag - flag to set

    • setIdentifierGeneratorLookupStrategy

      public void setIdentifierGeneratorLookupStrategy(@Nonnull Function<ProfileRequestContext,IdentifierGenerationStrategy> strategy)
      Set the strategy used to locate the IdentifierGenerationStrategy to use.
      Parameters:
      strategy - lookup strategy

    • setStateDataContextCreationStrategy

      public void setStateDataContextCreationStrategy(@Nonnull Function<ProfileRequestContext,StateDataContext> strategy)
      Sets the strategy used to create the StateDataContext.
      Parameters:
      strategy - creation strategy

    • setIssuerLookupStrategy

      public void setIssuerLookupStrategy(@Nullable Function<ProfileRequestContext,String> strategy)
      Set the strategy used to locate the issuer value to use.
      Parameters:
      strategy - lookup strategy

    • setNameIDLookupStrategy

      public void setNameIDLookupStrategy(@Nullable Function<ProfileRequestContext,NameID> strategy)
      Set optional strategy to derive a NameID to populate into the AuthnRequest's Subject element.
      Parameters:
      strategy - lookup strategy

    • setInboundBindingMap

      public void setInboundBindingMap(@Nullable Map<String,String> map)
      Set mapping of legacy binding tokens to SAML binding constants.

      This is a legacy compatibility feature allowing binding-specific response endpoints to be supported. Agents will supply a structure that maps endpoints to binding tokens (e.g., POST, Artifact) and this mapping determines the binding constants to use in requests. This is a simplification to avoid contaminating agents with SAML constants.

      Parameters:
      map - binding map

    • setResponseLocationRequired

      public void setResponseLocationRequired(boolean flag)
      Sets whether to signal failure if unable to establish an Assertion Consumer Service location to add to the request.

      Defaults to false. Usually needed only for ECP.

      Parameters:
      flag -

    • doPreExecute

      protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doPreExecute in class AbstractApplicationAction

    • doExecute

      protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext)
      Overrides:
      doExecute in class AbstractProfileAction

    • setResponseEndpoint

      private boolean setResponseEndpoint(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull AuthnRequest authnRequest)
      Sets the response endpoint and binding attributes in the request.

      This is messy due to support for legacy SPs avoiding metadata changes by allowing for the older design of an endpoint per binding. Some of these cases aren't expected to arise but are implemented for completeness.

      Parameters:
      profileRequestContext - profile request context
      authnRequest - request message
      Returns:
      true iff successful in picking an endpoint

    • setForceAuthn

      private void setForceAuthn(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull AuthnRequest authnRequest)
      Set ForceAuthn appropriately.
      Parameters:
      profileRequestContext - profile request context
      authnRequest - request object

    • buildNameIDPolicy

      @Nonnull NameIDPolicy buildNameIDPolicy(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull SAMLObjectBuilder<NameIDPolicy> builder)
      Build NameIDPolicy object for request.
      Parameters:
      profileRequestContext - profile request context
      builder - object builder
      Returns:
      policy object

    • buildRequestedAuthnContext

      @Nullable private RequestedAuthnContext buildRequestedAuthnContext(@Nullable ProfileRequestContext profileRequestContext)
      Build a RequestedAuthnContext if warranted.
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      the object to include in the request, or null

    • buildSubject

      @Nullable private Subject buildSubject(@Nonnull ProfileRequestContext profileRequestContext)
      Build a Subject element if necessary.
      Parameters:
      profileRequestContext - profile request context
      Returns:
      the Subject element to include

    • buildScoping

      @Nullable private Scoping buildScoping(@Nonnull ProfileRequestContext profileRequestContext)
      Build a Scoping element, decrementing the proxy count if set.
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      populated Scoping

    • buildExtensions

      @Nullable private Extensions buildExtensions(@Nonnull ProfileRequestContext profileRequestContext)
      Build RequestedAttributes extension if required.
      Parameters:
      profileRequestContext - current profile request context
      Returns:
      extension or null