Package net.shibboleth.idp.cas.proxy.impl

# Class HttpClientProxyValidator

java.lang.Object
net.shibboleth.idp.cas.proxy.impl.HttpClientProxyValidator

All Implemented Interfaces:
  `ProxyValidator`

public class HttpClientProxyValidator extends Object implements ProxyValidator
Authenticates a CAS proxy callback endpoint using an `HttpClient` instance to establish the connection and a `TrustEngine` to verify the TLS certificate presented by the remote peer. The endpoint is validated if and only if the following requirements are met:

1. Proxy callback URI specifies the `https` scheme.
2. The TLS certificate presented by the remote peer is trusted.
3. The HTTP response status code is approved via `setAllowedResponseCodes(Set)` (only 200 by default).

## Field Summary

Fields
Modifier and Type
Field
Description
`private Set<Integer>`
`allowedResponseCodes`
List of HTTP response codes permitted for successful proxy callback.
`private final org.apache.hc.client5.http.classic.HttpClient`
`httpClient`
HTTP client that connects to proxy callback endpoint.
`protected static final String`
`HTTPS_SCHEME`
Required https scheme for proxy callbacks.
`private final org.slf4j.Logger`
`log`
Class logger.
`private final HttpClientSecurityParameters`
`securityParameters`
HTTP client security parameters.
`private final Function<ProfileRequestContext,ServiceContext>`
`serviceCtxLookupFunction`
Looks up a ServiceContext from the profile request context.

## Constructor Summary

Constructors
Constructor
Description
`HttpClientProxyValidator(org.apache.hc.client5.http.classic.HttpClient client, HttpClientSecurityParameters parameters)`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`protected int`
`connect(URI uri, Service service)`
Connect to the given CAS proxy callback endpoint and return the HTTP response code.
`void`
`setAllowedResponseCodes(Set<Integer> responseCodes)`
Sets the HTTP response codes permitted for successful authentication of the proxy callback URL.
`private static void`
`setCASTLSTrustEngineCriteria(org.apache.hc.client5.http.protocol.HttpClientContext context, URI requestUri, Service service)`
Install TLS trust criteria.
`void`
`validate(ProfileRequestContext profileRequestContext, URI proxyCallbackUri)`
Validates the proxy callback endpoint.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### HTTPS_SCHEME

@Nonnull @NotEmpty protected static final String HTTPS_SCHEME
Required https scheme for proxy callbacks.

See Also:
  - Constant Field Values

### log

@Nonnull private final org.slf4j.Logger log
Class logger.

### serviceCtxLookupFunction

@Nonnull private final Function<ProfileRequestContext,ServiceContext> serviceCtxLookupFunction
Looks up a ServiceContext from the profile request context.

### httpClient

@Nonnull private final org.apache.hc.client5.http.classic.HttpClient httpClient
HTTP client that connects to proxy callback endpoint.

### securityParameters

@Nonnull private final HttpClientSecurityParameters securityParameters
HTTP client security parameters.

### allowedResponseCodes

@NotEmpty private Set<Integer> allowedResponseCodes
List of HTTP response codes permitted for successful proxy callback.

## Constructor Details

### HttpClientProxyValidator

public HttpClientProxyValidator(@Nonnull org.apache.hc.client5.http.classic.HttpClient client, @Nonnull HttpClientSecurityParameters parameters)
Constructor.

Parameters:
  `client` - HttpClient to use
  `parameters` - security parameters for client

## Method Details

### setAllowedResponseCodes

public void setAllowedResponseCodes(@Nonnull @NotEmpty Set<Integer> responseCodes)
Sets the HTTP response codes permitted for successful authentication of the proxy callback URL.

Parameters:
  `responseCodes` - One or more HTTP response codes.

### validate

public void validate(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull URI proxyCallbackUri) throws GeneralSecurityException
Validates the proxy callback endpoint.

Specified by:
  `validate` in interface `ProxyValidator`
Parameters:
  `profileRequestContext` - Profile request context.
  `proxyCallbackUri` - Proxy callback URI to validate.
Throws:
  `GeneralSecurityException` - On validation failure.

### connect

protected int connect(@Nonnull URI uri, @Nonnull Service service) throws GeneralSecurityException
Connect to the given CAS proxy callback endpoint and return the HTTP response code. TLS peer certificate validation is an essential security aspect of establishing the connection.

Parameters:
  `uri` - CAS proxy callback URI to connect to.
  `service` - CAS service requesting the connection.
Returns:
  HTTP response code.
Throws:
  `GeneralSecurityException` - On connection errors, e.g. invalid/untrusted cert.

### setCASTLSTrustEngineCriteria

private static void setCASTLSTrustEngineCriteria(@Nonnull org.apache.hc.client5.http.protocol.HttpClientContext context, @Nonnull URI requestUri, @Nonnull Service service)
Install TLS trust criteria.

Parameters:
  `context` - client context
  `requestUri` - URI to obtain hostname
  `service` - CAS service