Package net.shibboleth.sp.saml.saml2.profile.impl

Class ProcessAssertionsForAuthentication

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.sp.profile.AbstractAgentRequestAction

net.shibboleth.sp.profile.AbstractAgentAction

net.shibboleth.sp.profile.AbstractApplicationAction

net.shibboleth.sp.saml.saml2.profile.impl.ProcessAssertionsForAuthentication

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ProcessAssertionsForAuthentication
extends AbstractApplicationAction

Perform processing of a SAML 2 Response's Assertions that have been validated by earlier actions for use in finalization of SAML-based authentication by later actions.

The result of this action is to strip any invalid assertions from the response, and to preserve the "best"/selected AuthnStatement and any other content required in a pluggable manner.

This is a copy of an IdP action for the time being as there was no way to override the desired behavior.

Event:

EventIds.PROCEED_EVENT_ID, EventIds.INVALID_MESSAGE

Postcondition:

the selected statement is passed into the supplied BiConsumer

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
private final class	ProcessAssertionsForAuthentication.AssertionContainsAuthenticationStatement	Predicate for assertions containing at least 1 AuthenticationStatement.
private final class	ProcessAssertionsForAuthentication.AssertionContainsConfirmedSubject	Predicate for assertions which have been validated and have a confirmed Subject.
private final class	ProcessAssertionsForAuthentication.AssertionIsValid	Predicate for valid assertions.

Field Summary

Fields

Modifier and Type	Field	Description
private PrincipalEvalPredicateFactoryRegistry	evalRegistry	The registry of predicate factories for custom principal evaluation.
private final org.slf4j.Logger	log	Logger.
private Response	response	The Response to process.
private Function<ProfileRequestContext,Response>	responseResolver	The resolver for the response to be processed.
private BiConsumer<ProfileRequestContext,AuthnStatement>	samlConsumer	"Sink" for preserving SAML objects.
private SAMLStateData	stateData	State data to validate.
private Function<ProfileRequestContext,StateDataContext>	stateDataContextLookupStrategy	Strategy used to locate the StateDataContext to check.

Constructor Summary

Constructors

Constructor	Description
ProcessAssertionsForAuthentication()	Constructor.

Method Summary

Modifier and Type	Method	Description
private void	addValidationError(String msg)	Adds a validation error for the agent regarding the failure.
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected void	doInitialize()
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
private boolean	isAcceptable(RequestedPrincipalContext helperContext, AuthnContext authnContext)	Process an AuthnContext for compatibility with the request as brokered by the populated RequestedPrincipalContext.
void	setPrincipalEvalPredicateFactoryRegistry(PrincipalEvalPredicateFactoryRegistry registry)	Set the registry of predicate factories for custom principal evaluation.
void	setResponseResolver(Function<ProfileRequestContext,Response> strategy)	Set the strategy function which resolves the response to process.
void	setSAMLConsumer(BiConsumer<ProfileRequestContext,AuthnStatement> consumer)	Set the BiConsumer used to save off the SAML statemen and any related objects as a result of this action.
void	setStateDataContextLookupStrategy(Function<ProfileRequestContext,StateDataContext> strategy)	Sets the strategy used to lookup the StateDataContext.

Methods inherited from class net.shibboleth.sp.profile.AbstractApplicationAction

ensureApplication, getApplication

Methods inherited from class net.shibboleth.sp.profile.AbstractAgentAction

ensureAgent, getAgent

Methods inherited from class net.shibboleth.sp.profile.AbstractAgentRequestAction

ensureAgentRequestContext, getAgentRequestContext, setAgentRequestContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Logger.

responseResolver

@NonnullAfterInit
private Function<ProfileRequestContext,Response> responseResolver

The resolver for the response to be processed.

samlConsumer

@NonnullAfterInit
private BiConsumer<ProfileRequestContext,AuthnStatement> samlConsumer

"Sink" for preserving SAML objects.

stateDataContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,StateDataContext> stateDataContextLookupStrategy

Strategy used to locate the StateDataContext to check.

evalRegistry

@NonnullBeforeExec
private PrincipalEvalPredicateFactoryRegistry evalRegistry

The registry of predicate factories for custom principal evaluation.

response

@NonnullBeforeExec
private Response response

The Response to process.

stateData

@NonnullBeforeExec
private SAMLStateData stateData

State data to validate.

Constructor Details

ProcessAssertionsForAuthentication

public ProcessAssertionsForAuthentication()

Constructor.

Method Details

setResponseResolver

public void setResponseResolver(@Nonnull
 Function<ProfileRequestContext,Response> strategy)

Set the strategy function which resolves the response to process.

Parameters:

strategy - the new strategy function

setSAMLConsumer

public void setSAMLConsumer(@Nonnull
 BiConsumer<ProfileRequestContext,AuthnStatement> consumer)

Set the BiConsumer used to save off the SAML statemen and any related objects as a result of this action.

This insulates the actiion from the specific context in which it may be used. The supplied consumer MUST establish any non-successful event via the supplied context if it fails.

Parameters:

consumer - consumer to set

setStateDataContextLookupStrategy

public void setStateDataContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,StateDataContext> strategy)

Sets the strategy used to lookup the StateDataContext.

Parameters:

strategy - lookup strategy

setPrincipalEvalPredicateFactoryRegistry

public void setPrincipalEvalPredicateFactoryRegistry(@Nonnull
 PrincipalEvalPredicateFactoryRegistry registry)

Set the registry of predicate factories for custom principal evaluation.

Parameters:

registry - predicate factory registry

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractApplicationAction

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction

isAcceptable

private boolean isAcceptable(@Nonnull
 RequestedPrincipalContext helperContext,
 @Nullable
 AuthnContext authnContext)

Process an AuthnContext for compatibility with the request as brokered by the populated RequestedPrincipalContext.

Parameters:

helperContext - populated context to drive context evaluation

authnContext - input context object from assertion statement

Returns:

true iff the context carries an ACR that is compatible with the request

addValidationError

private void addValidationError(@Nonnull
 String msg)

Adds a validation error for the agent regarding the failure.

Parameters:

msg - error message