Package net.shibboleth.sp.credential

Class AbstractStorageServiceCredentialResolver<T extends Credential>

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.sp.credential.AbstractOrderedCredentialResolver
net.shibboleth.sp.credential.AbstractStorageServiceCredentialResolver<T>
Type Parameters:
T - the type of credential supported
All Implemented Interfaces:
Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent, Resolver<Credential,CriteriaSet>, OrderedCredentialResolver, CredentialResolver, Ordered
Direct Known Subclasses:
X509CredentialStorageServiceResolver, X509KeyStoreStorageServiceResolver
public abstract class AbstractStorageServiceCredentialResolver<T extends Credential> extends AbstractOrderedCredentialResolver
A dymamic resolver that relies on a StorageService to retrieve blobs of information that its subclasses will understand how to turn into a specifically known type of Credential.

Typically more than one object from storage will be required to construct the expected type of Credential, and subclasses are expected to govern exactly how that occurs.

The resolver functions by evaluating a Velocity Template with information pulled from the supplied CriteriaSet to allow dynamic construction of the storage context and key to retrieve. The resulting values are passed to the subclass to further process into specific lookup values to retrieve.

The resolver recognizes these Criterion types natively and supplies them as input to the template:

In addition, the entire CriteriaSet is also supplied as an extension point, and if supplied, the entityID is transformed by a pluggable function, by default into a SHA-1 hash that is hex-encoded in lower case.

Note that subclasses are required to perform evaluation of intended usage based on the UsageCriterion such that any resolved credentials are assumed to either match the caller's expectations or not carry any usage designation at all.

TODO: implement caching layer here or in subclasses somehow

  • Field Details

  • Constructor Details

    • AbstractStorageServiceCredentialResolver

      public AbstractStorageServiceCredentialResolver(@Nonnull @ParameterName(name="type") Class<T> type)
      Constructor.
      Parameters:
      type - class type of generic parameter

  • Method Details

    • setCacheEnabled

      public void setCacheEnabled(boolean flag)
      Sets whether to enable caching.

      Defaults to false.

      When enabled, any ProfileRequestContextCriterion is remoed from input criteria.

      Parameters:
      flag - flag to set

    • getStorageService

      @NonnullAfterInit public StorageService getStorageService()
      Gets the StorageService to use.
      Returns:
      storage service

    • setStorageService

      public void setStorageService(@Nonnull StorageService storage)
      Sets the StorageService to use.
      Parameters:
      storage - storage service

    • getVelocityEngine

      @NonnullAfterInit public org.apache.velocity.app.VelocityEngine getVelocityEngine()
      Gets the VelocityEngine to use.
      Returns:
      Velocity engine

    • setVelocityEngine

      public void setVelocityEngine(@Nonnull org.apache.velocity.app.VelocityEngine engine)
      Sets the VelocityEngine to use.
      Parameters:
      engine - Velocity engine

    • setEntityIDTransformStrategy

      public void setEntityIDTransformStrategy(@Nonnull Function<String,String> strategy)
      Sets the transform to apply to the entityID if supplied.

      Defaults to a SHA-1 hash as a hex-encoded lower-case string.

      Parameters:
      strategy - transform strategy

    • setMaximumCachedElements

      public void setMaximumCachedElements(@Nonnull @Positive Integer max)
      Sets the maximum cache size.

      Defaults to 500.

      Parameters:
      max - maximum size

    • setExpireAfterAccess

      public void setExpireAfterAccess(@Nullable @Positive Duration exp)
      Sets the cache policy to expire entries after access, with the time reset on each access.

      Defaults to 4 hours.

      Mutually exclusive with setExpireAfterWrite(Duration).

      Parameters:
      exp - threshold

    • setExpireAfterWrite

      public void setExpireAfterWrite(@Nullable @Positive Duration exp)
      Sets the cache policy to expire entries after creation.

      Defaults to null.

      Mutually exclusive with setExpireAfterAccess(Duration).

      Parameters:
      exp - threshold

    • setContextTemplate

      public void setContextTemplate(@Nonnull String template)
      Sets the Velocity template to use to construct the storage context.

      Defaults to "net.shibboleth.sp.credential.resolver.id" where "id" is the component ID.

      Parameters:
      template - template for storage context

    • setUsageMap

      public void setUsageMap(@Nullable Map<UsageType,String> map)
      Sets a map from UsageType to string tokens, allowing customizable injection of a string into the Velocity context to abbreviate or otherwise control what to resolve based on a supplied UsageCriterion.

      Defaults to "-signing", "-encryption", and "-signing" for UsageType.SIGNING, UsageType.ENCRYPTION, and UsageType.UNSPECIFIED respectively, which is compatible with the advisable step of separating keys by usage.

      Parameters:
      map - map of usage types to string values

    • setProtocolMap

      public void setProtocolMap(@Nullable Map<String,String> map)
      Sets a map from protocol constants to string tokens, allowing customizable injection of a string into the Velocity context to abbreviate or otherwise control what to resolve based on a supplied ProtocolCriterion.

      Defaults to empty, as most resolvers are xepected to be protocol specific more generally.

      Parameters:
      map - map of usage types to string values

    • doInitialize

      protected void doInitialize() throws ComponentInitializationException
      Overrides:
      doInitialize in class AbstractIdentifiedInitializableComponent
      Throws:
      ComponentInitializationException

    • doResolve

      @Nonnull @NotLive @Unmodifiable protected Iterable<Credential> doResolve(@Nullable CriteriaSet criteria) throws ResolverException
      Subclasses implement this method to resolve the underlying objects.
      Specified by:
      doResolve in class AbstractOrderedCredentialResolver
      Parameters:
      criteria - criteria for resolution
      Returns:
      resolved credential iterator
      Throws:
      ResolverException - if an error occurs

    • populateVelocityContext

      @Nonnull protected org.apache.velocity.VelocityContext populateVelocityContext(@Nullable CriteriaSet criteria)
      Populate and return a VelocityContext with the necessary criteria information.
      Parameters:
      criteria - input to resolver
      Returns:
      the populated context

    • doResolve

      @Nonnull @NotLive @Unmodifiable protected abstract Iterable<Credential> doResolve(@Nonnull org.apache.velocity.VelocityContext velocityContext, @Nullable CriteriaSet criteria, @Nonnull String storageContext) throws ResolverException
      Perform the resolution as required for the specific type of Credential.

      Subclasses implement this by taking the supplied information and adjusting it if required to perform one or more storage lookups for information needed to construct the resolved credential(s).

      Most often, a single Credential (at most) will be returned as it is complex to store the information needed for multiple objects without some fairly exotic tricks, but this is left to the subclass to decide.

      Parameters:
      velocityContext - Velocity context constructed from criteria
      criteria - input to resolver
      storageContext - evaluated storage context
      Returns:
      zero or more resolved credentials
      Throws:
      ResolverException - on errors, generally wrapped from storage service