Package net.shibboleth.sp.saml.saml2.profile.impl

Class ExtractSAMLAttributes

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.sp.profile.AbstractAgentRequestAction

net.shibboleth.sp.profile.AbstractAgentAction

net.shibboleth.sp.profile.AbstractApplicationAction

net.shibboleth.sp.saml.saml2.profile.impl.ExtractSAMLAttributes

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ExtractSAMLAttributes
extends AbstractApplicationAction

An action that extracts IdPAttribute objects from an inbound SAML 2.0 SSO response.

Attributes decoded from the assertion(s) are in an unfiltered state and subject to the filtering service. Any other data extracted is stored directly in the filtered set.

There are three supplemental sets: the optional "standard" set extracted from the message, an optional profile config-supplied strategy function, and an optional use of the AttributeResolver associated with the Application.

Event:

EventIds.PROCEED_EVENT_ID, EventIds.INVALID_PROFILE_CTX, EventIds.MESSAGE_PROC_ERROR, IdPEventIds.INVALID_RELYING_PARTY_CTX, IdPEventIds.INVALID_PROFILE_CONFIG

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	ExtractSAMLAttributes.StandardExtractionStrategy	Built-in function to perform "standard" extraction of data into attributes.

Field Summary

Fields

Modifier and Type	Field	Description
private boolean	acceptUnfilteredAttributes	Whether to accept decoded attributes that no filter rules applied to.
private AttributeContext	attributeContext	Context for externally supplied inbound attributes.
private Function<ProfileRequestContext,AttributeContext>	attributeContextCreationStrategy	Strategy used to create AttributeContext to hold results.
private static final String	DEFAULT_METRIC_NAME	Default prefix for metrics.
private Function<ProfileRequestContext,String>	issuerLookupStrategy	Function used to obtain the issuer ID.
private final org.slf4j.Logger	log	Class logger.
private BrowserSSOProfileConfiguration	profileConfiguration	Store off profile config.
private Function<ProfileRequestContext,RelyingPartyContext>	relyingPartyContextLookupStrategy	Strategy used to look up a RelyingPartyContext for configuration options.
private Function<ProfileRequestContext,String>	requesterLookupStrategy	Function used to obtain the requester ID.
private SAMLTokenContext	samlTokenContext	Context containing the token(s) to process.
private Function<ProfileRequestContext,SAMLTokenContext>	samlTokenContextLookupStrategy	Strategy used to look up SAMLTokenContext to operate on.
private Function<SAMLTokenContext,Collection<IdPAttribute>>	standardExtractionStrategy	Strategy for pulling out "standard" data from the response.

Constructor Summary

Constructors

Constructor	Description
ExtractSAMLAttributes()	Constructor.

Method Summary

Modifier and Type	Method	Description
private void	decodeAttribute(AttributeTranscoderRegistry registry, ProfileRequestContext profileRequestContext, Attribute input, Multimap<String,IdPAttribute> results)	Access the registry of transcoding rules to decode the input Attribute.
private void	decodeNameID(AttributeTranscoderRegistry registry, ProfileRequestContext profileRequestContext, NameID input, Multimap<String,IdPAttribute> results)	Access the registry of transcoding rules to decode the input NameID.
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
private void	filterAttributes(ProfileRequestContext profileRequestContext)	Check for inbound attributes and apply filtering.
private Response	getResponse(ProfileRequestContext profileRequestContext)	Get the inbound Response message.
private void	populateFilterContext(ProfileRequestContext profileRequestContext, AttributeFilterContext filterContext)	Fill in the filter context data.
private void	processAttributes(ProfileRequestContext profileRequestContext)	Process the inbound SAML Attributes and NameID.
private Collection<IdPAttribute>	resolveAttributes(ProfileRequestContext profileRequestContext)	Perform internal attribute resolution using the Application-associated AttributeResolver service.
void	setAcceptUnfilteredAttributes(boolean flag)	Set whether to accept decoded IdPAttribute objects pulled from the assertions if no filtering rule applied to them.
void	setAttributeContextCreationStrategy(Function<ProfileRequestContext,AttributeContext> strategy)	Set the strategy used to create the AttributeContext to hold results.
void	setIssuerLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the strategy used to locate the attribute issuer ID for filtering.
void	setRelyingPartyContextLookupStrategy(Function<ProfileRequestContext,RelyingPartyContext> strategy)	Set the strategy used to return the RelyingPartyContext for configuration options.
void	setRequesterLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the strategy used to locate the attribute requester ID for filtering.
void	setSAMLTokenContextLookupStrategy(Function<ProfileRequestContext,SAMLTokenContext> strategy)	Set the strategy used to return the SAMLTokenContext for input.
void	setStandardExtractionStrategy(Function<SAMLTokenContext,Collection<IdPAttribute>> strategy)	Set the strategy function to call for "standard" attribute extraction, if enabled.

Methods inherited from class net.shibboleth.sp.profile.AbstractApplicationAction

ensureApplication, getApplication

Methods inherited from class net.shibboleth.sp.profile.AbstractAgentAction

ensureAgent, getAgent

Methods inherited from class net.shibboleth.sp.profile.AbstractAgentRequestAction

ensureAgentRequestContext, getAgentRequestContext, setAgentRequestContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

DEFAULT_METRIC_NAME

@Nonnull
@NotEmpty
private static final String DEFAULT_METRIC_NAME

Default prefix for metrics.

See Also:

• Constant Field Values

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

relyingPartyContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy

Strategy used to look up a RelyingPartyContext for configuration options.

samlTokenContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,SAMLTokenContext> samlTokenContextLookupStrategy

Strategy used to look up SAMLTokenContext to operate on.

requesterLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> requesterLookupStrategy

Function used to obtain the requester ID.

issuerLookupStrategy

@Nonnull
private Function<ProfileRequestContext,String> issuerLookupStrategy

Function used to obtain the issuer ID.

attributeContextCreationStrategy

@Nonnull
private Function<ProfileRequestContext,AttributeContext> attributeContextCreationStrategy

Strategy used to create AttributeContext to hold results.

standardExtractionStrategy

@Nullable
private Function<SAMLTokenContext,Collection<IdPAttribute>> standardExtractionStrategy

Strategy for pulling out "standard" data from the response.

acceptUnfilteredAttributes

private boolean acceptUnfilteredAttributes

Whether to accept decoded attributes that no filter rules applied to.

samlTokenContext

@NonnullBeforeExec
private SAMLTokenContext samlTokenContext

Context containing the token(s) to process.

profileConfiguration

@NonnullBeforeExec
private BrowserSSOProfileConfiguration profileConfiguration

Store off profile config.

attributeContext

@NonnullBeforeExec
private AttributeContext attributeContext

Context for externally supplied inbound attributes.

Constructor Details

ExtractSAMLAttributes

public ExtractSAMLAttributes()

Constructor.

Method Details

setRelyingPartyContextLookupStrategy

public void setRelyingPartyContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,RelyingPartyContext> strategy)

Set the strategy used to return the RelyingPartyContext for configuration options.

Parameters:

strategy - lookup strategy

setSAMLTokenContextLookupStrategy

public void setSAMLTokenContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,SAMLTokenContext> strategy)

Set the strategy used to return the SAMLTokenContext for input.

Parameters:

strategy - lookup strategy

setRequesterLookupStrategy

public void setRequesterLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set the strategy used to locate the attribute requester ID for filtering.

Parameters:

strategy - lookup strategy

setIssuerLookupStrategy

public void setIssuerLookupStrategy(@Nonnull
 Function<ProfileRequestContext,String> strategy)

Set the strategy used to locate the attribute issuer ID for filtering.

Parameters:

strategy - lookup strategy

setAttributeContextCreationStrategy

public void setAttributeContextCreationStrategy(@Nonnull
 Function<ProfileRequestContext,AttributeContext> strategy)

Set the strategy used to create the AttributeContext to hold results.

Parameters:

strategy - creation strategy

setStandardExtractionStrategy

public void setStandardExtractionStrategy(@Nullable
 Function<SAMLTokenContext,Collection<IdPAttribute>> strategy)

Set the strategy function to call for "standard" attribute extraction, if enabled.

Parameters:

strategy - strategy function

setAcceptUnfilteredAttributes

public void setAcceptUnfilteredAttributes(boolean flag)

Set whether to accept decoded IdPAttribute objects pulled from the assertions if no filtering rule applied to them.

This is a variant of the original SP's "wildcard" rule support to allow non-enumerated attributes to be accepted.

Parameters:

flag -

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractApplicationAction

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction

getResponse

@Nonnull
private Response getResponse(@Nonnull
 ProfileRequestContext profileRequestContext)

Get the inbound Response message.

Parameters:

profileRequestContext - profile request context

Returns:

inbound message

processAttributes

private void processAttributes(@Nonnull
 ProfileRequestContext profileRequestContext)

Process the inbound SAML Attributes and NameID.

Parameters:

profileRequestContext - current profile request context

decodeAttribute

private void decodeAttribute(@Nonnull
 AttributeTranscoderRegistry registry,
 @Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 Attribute input,
 @Nonnull @Live
 Multimap<String,IdPAttribute> results)
                      throws AttributeDecodingException

Access the registry of transcoding rules to decode the input Attribute.

Parameters:

registry - registry of transcoding rules

profileRequestContext - current profile request context

input - input object

results - collection to add results to

Throws:

AttributeDecodingException - if an error occurs or no results were obtained

decodeNameID

private void decodeNameID(@Nonnull
 AttributeTranscoderRegistry registry,
 @Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 NameID input,
 @Nonnull @Live
 Multimap<String,IdPAttribute> results)
                   throws AttributeDecodingException

Access the registry of transcoding rules to decode the input NameID.

Parameters:

registry - registry of transcoding rules

profileRequestContext - current profile request context

input - input object

results - collection to add results to

Throws:

AttributeDecodingException - if an error occurs or no results were obtained

filterAttributes

private void filterAttributes(@Nonnull
 ProfileRequestContext profileRequestContext)

Check for inbound attributes and apply filtering.

Parameters:

profileRequestContext - current profile request context

populateFilterContext

private void populateFilterContext(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AttributeFilterContext filterContext)

Fill in the filter context data.

Parameters:

profileRequestContext - current profile request context

filterContext - context to populate

resolveAttributes

@Nullable
private Collection<IdPAttribute> resolveAttributes(@Nonnull
 ProfileRequestContext profileRequestContext)

Perform internal attribute resolution using the Application-associated AttributeResolver service.

Parameters:

profileRequestContext - profile request context

Returns:

resolved attributes