Package net.shibboleth.sp.credential.impl

Class StaticMapCredentialResolver

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

net.shibboleth.sp.credential.AbstractOrderedCredentialResolver

net.shibboleth.sp.credential.impl.StaticMapCredentialResolver

All Implemented Interfaces:

Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent, Resolver<Credential,CriteriaSet>, OrderedCredentialResolver, CredentialResolver, Ordered

public class StaticMapCredentialResolver
extends AbstractOrderedCredentialResolver

A static resolver that relies on maps to associate credentials with the core objects that constitute an SP deployment, primarily assuming limited, exception-driven rules to avoid scaling problems.

The "exact" matching map is constructed as a nested three-level map, from Agent to Application to RelyingParty and finally to the list of credentials. Each layer uses a null key to signify "any" as a wildcard match.

The resolver recognizes these Criterion types:

• ProfileRequestContextCriterion - used only for predicate evaluation
• AgentIDCriterion - used for Agent-indexed rules
• ApplicationIDCriterion - used for Application-based rules
• EntityIdCriterion - used for relying party-based rules

The absence of a criterion for map-based rules does not prevent rules applying to "any" of an object being applied.

Nested Class Summary

Nested classes/interfaces inherited from class net.shibboleth.sp.credential.AbstractOrderedCredentialResolver

AbstractOrderedCredentialResolver.UsageCriterionPredicate

Field Summary

Fields

Modifier and Type	Field	Description
private Map<String,Map<String,Map<String,List<Credential>>>>	exactMatchCredentialMap	Maps between exact names of objects and credentials.
private final org.slf4j.Logger	log	Class logger.
private Map<Predicate<ProfileRequestContext>,List<Credential>>	predicateCredentialMap	Maps between arbitrary conditions and credentials.

Fields inherited from interface org.springframework.core.Ordered

HIGHEST_PRECEDENCE, LOWEST_PRECEDENCE

Constructor Summary

Constructors

Constructor	Description
StaticMapCredentialResolver()	Constructor.

Method Summary

Modifier and Type	Method	Description
Iterable<Credential>	doResolve(CriteriaSet criteria)	Subclasses implement this method to resolve the underlying objects.
private void	resolveForAgent(List<Credential> accumulator, String agentID, CriteriaSet criteria)	Resolves the nested mappings for the given Agent ID (or null) using the additional criteria.
private void	resolveForApplication(List<Credential> accumulator, Map<String,Map<String,List<Credential>>> applicationRules, String applicationID, CriteriaSet criteria)	Resolves the nested mappings for the given Application ID (or null) using the additional criteria.
private void	resolveForRelyingParty(List<Credential> accumulator, Map<String,List<Credential>> relyingPartyRules, String relyingPartyID)	Resolves the nested mappings for the given relying party ID (or null).
void	setAgentRules(Map<String,Map<String,List<Credential>>> map)	Installs mappings based on Agent and RelyingParty IDs.
void	setAgentRulesEx(Map<String,Map<String,Map<String,List<Credential>>>> map)	Installs mappings based on Agent, Application, and RelyingParty Ids.
void	setPredicateRules(Map<Predicate<ProfileRequestContext>,List<Credential>> map)	Installs the map of conditions to apply to match to credentials.

Methods inherited from class net.shibboleth.sp.credential.AbstractOrderedCredentialResolver

getOrder, resolve, resolveSingle, setFilterByUsage, setOrder, setProtocols

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

exactMatchCredentialMap

@Nonnull
private Map<String,Map<String,Map<String,List<Credential>>>> exactMatchCredentialMap

Maps between exact names of objects and credentials.

predicateCredentialMap

@Nonnull
private Map<Predicate<ProfileRequestContext>,List<Credential>> predicateCredentialMap

Maps between arbitrary conditions and credentials.

Constructor Details

StaticMapCredentialResolver

public StaticMapCredentialResolver()

Constructor.

Method Details

setAgentRules

public void setAgentRules(@Nonnull
 Map<String,Map<String,List<Credential>>> map)

Installs mappings based on Agent and RelyingParty IDs.

This method produces mappings that ignore the Application identifier, which is the recommended approach.

A null map key signifies a wildcard match (ignoring that component).

Parameters:

map - rules to add

setAgentRulesEx

public void setAgentRulesEx(@Nonnull
 Map<String,Map<String,Map<String,List<Credential>>>> map)

Installs mappings based on Agent, Application, and RelyingParty Ids.

This method produces mappings that can include the Application identifier, which is the most complex approach.

Note that this method does not currently make a cooy of the map or its contents, so the input must not be subsequently modified.

Parameters:

map - rules to add

setPredicateRules

public void setPredicateRules(@Nullable
 Map<Predicate<ProfileRequestContext>,List<Credential>> map)

Installs the map of conditions to apply to match to credentials.

This is a generic approach that allows arbitrary rules to be implemented in scripts or in Java to determine whether particular credentials should be resolved for a request.

Parameters:

map - rules to add

doResolve

@Nonnull
@NotLive
@Unmodifiable
public Iterable<Credential> doResolve(@Nullable
 CriteriaSet criteria)
                               throws ResolverException

Subclasses implement this method to resolve the underlying objects.

Specified by:

doResolve in class AbstractOrderedCredentialResolver

Parameters:

criteria - criteria for resolution

Returns:

resolved credential iterator

Throws:

ResolverException - if an error occurs

resolveForAgent

private void resolveForAgent(@Nonnull
 List<Credential> accumulator,
 @Nullable
 String agentID,
 @Nullable
 CriteriaSet criteria)

Resolves the nested mappings for the given Agent ID (or null) using the additional criteria.

Parameters:

accumulator - list to populate

agentID - supplied Agent ID or null

criteria - remaining criteria

resolveForApplication

private void resolveForApplication(@Nonnull
 List<Credential> accumulator,
 @Nonnull
 Map<String,Map<String,List<Credential>>> applicationRules,
 @Nullable
 String applicationID,
 @Nullable
 CriteriaSet criteria)

Resolves the nested mappings for the given Application ID (or null) using the additional criteria.

Parameters:

accumulator - list to populate

applicationRules - nested mappings

applicationID - supplied Application ID or null

criteria - remaining criteria

resolveForRelyingParty

private void resolveForRelyingParty(@Nonnull
 List<Credential> accumulator,
 @Nonnull
 Map<String,List<Credential>> relyingPartyRules,
 @Nullable
 String relyingPartyID)

Resolves the nested mappings for the given relying party ID (or null).

Parameters:

accumulator - list to populate

relyingPartyRules - nested mappings

relyingPartyID - supplied relying party ID or null