Package net.shibboleth.idp.saml.saml2.profile.config.impl

# Class BrowserSSOProfileConfiguration

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.profile.config.AbstractProfileConfiguration
net.shibboleth.profile.config.AbstractConditionalProfileConfiguration
net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration
net.shibboleth.idp.saml.profile.config.impl.AbstractSAMLProfileConfiguration
net.shibboleth.idp.saml.saml2.profile.config.impl.AbstractSAML2ProfileConfiguration
net.shibboleth.idp.saml.saml2.profile.config.impl.AbstractSAML2ArtifactAwareProfileConfiguration
net.shibboleth.idp.saml.saml2.profile.config.impl.AbstractSAML2AssertionProducingProfileConfiguration
net.shibboleth.idp.saml.saml2.profile.config.impl.BrowserSSOProfileConfiguration

All Implemented Interfaces:
  `AuthenticationProfileConfiguration`, `InterceptorAwareProfileConfiguration`, `BrowserSSOProfileConfiguration`, `SAMLProfileConfiguration`, `BrowserSSOProfileConfiguration`, `AttributeResolvingProfileConfiguration`, `ConditionalProfileConfiguration`, `ProfileConfiguration`, `SAMLArtifactAwareProfileConfiguration`, `SAMLArtifactConsumerProfileConfiguration`, `SAMLAssertionConsumingProfileConfiguration`, `SAMLAssertionProducingProfileConfiguration`, `SAMLProfileConfiguration`, `BrowserSSOProfileConfiguration`, `SAML2AssertionProducingProfileConfiguration`, `SAML2ProfileConfiguration`, `Component`, `DestructableComponent`, `IdentifiableComponent`, `IdentifiedComponent`, `InitializableComponent`

Direct Known Subclasses:
  `ECPProfileConfiguration`, `SSOSProfileConfiguration`

public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProducingProfileConfiguration implements AuthenticationProfileConfiguration, BrowserSSOProfileConfiguration
Configuration support for IdP and proxied SAML 2.0 Browser SSO.

## Field Summary

Fields
Modifier and Type
Field
Description
`private Predicate<ProfileRequestContext>`
`allowDelegationPredicate`
The predicate used to determine if produced assertions may be delegated.
`private Function<ProfileRequestContext,Integer>`
`attributeIndexLookupStrategy`
Lookup function to supply AttributeConsumingServiceIndex in request.
`private Function<ProfileRequestContext,String>`
`attributeRecipientGroupIDLookupStrategy`
Lookup strategy for attribute recipient group ID.
`private Function<ProfileRequestContext,Set<String>>`
`authenticationFlowsLookupStrategy`
Lookup function to supply authentication flows.
`private Function<ProfileRequestContext,String>`
`authnContextComparisonLookupStrategy`
Lookup function for requested AC operator.
`private Function<ProfileRequestContext,Function<ProfileRequestContext,Collection<Principal>>>`
`authnContextTranslationStrategyExLookupStrategy`
Lookup function to supply the strategy function for translating fully-generic data.
`private Function<ProfileRequestContext,Function<AuthnContext,Collection<Principal>>>`
`authnContextTranslationStrategyLookupStrategy`
Lookup function to supply the strategy function for translating SAML 2.0 AuthnContext data.
`private Predicate<ProfileRequestContext>`
`checkAddressPredicate`
Whether to compare client and assertion addresses on inbound SSO.
`private Predicate<ProfileRequestContext>`
`checkInResponseToPredicate`
Whether to validate inbound InResponseTo values.
`private Function<ProfileRequestContext,Collection<Principal>>`
`defaultAuthenticationContextsLookupStrategy`
Lookup function to supply default authentication methods.
`private Predicate<ProfileRequestContext>`
`forceAuthnPredicate`
Whether to mandate forced authentication for the request.
`private Predicate<ProfileRequestContext>`
`ignoreScoping`
Whether to ignore Scoping elements within AuthnRequest.
`private Predicate<ProfileRequestContext>`
`includeAttributeStatementPredicate`
Whether responses to the authentication request should include an attribute statement.
`private Function<ProfileRequestContext,Duration>`
`maxAgeLookupStrategy`
Lookup function for max-age setting.
`private Function<ProfileRequestContext,Duration>`
`maximumSPSessionLifetimeLookupStrategy`
Lookup function to supply maximum session lifetime.
`private Function<ProfileRequestContext,Duration>`
`maximumTimeSinceAuthnLookupStrategy`
Lookup function to supply maximum time since inbound AuthnInstant.
`private Function<ProfileRequestContext,Long>`
`maximumTokenDelegationChainLengthLookupStrategy`
Lookup function to supply maximum delegation chain length.
`private Function<ProfileRequestContext,Collection<String>>`
`nameIDFormatPrecedenceLookupStrategy`
Lookup function to supply NameID formats.
`private Function<ProfileRequestContext,Collection<String>>`
`postAuthenticationFlowsLookupStrategy`
Lookup function to supply post authentication flows.
`static final String`
`PROFILE_COUNTER`
Name of profile counter.
`private Predicate<ProfileRequestContext>`
`proxiedAuthnInstantPredicate`
Whether authentication results should carry the proxied AuthnInstant.
`private Function<ProfileRequestContext,Collection<String>>`
`proxyAudiencesLookupStrategy`
Lookup function to supply proxy audiences.
`private Function<ProfileRequestContext,Integer>`
`proxyCountLookupStrategy`
Lookup function to supply proxyCount property.
`private Predicate<ProfileRequestContext>`
`randomizeFriendlyNamePredicate`
Whether the FriendlyName attribute should be randomized when encoding Attributes.
`private Function<ProfileRequestContext,Collection<RequestedAttribute>>`
`requestedAttributesLookupStrategy`
Lookup function to supply RequestedAttributes in request.
`private Function<ProfileRequestContext,Collection<String>>`
`requestedIdPAttributeNamesLookupStrategy`
Lookup strategy for requested IdP attribute names to pass into resolver.
`private Predicate<ProfileRequestContext>`
`requireSignedAssertionsPredicate`
Whether to require assertions be signed.
`private Predicate<ProfileRequestContext>`
`requireSignedRequestsPredicate`
Whether to require requests be signed.
`private Predicate<ProfileRequestContext>`
`resolveAttributesPredicate`
Whether attributes should be resolved in the course of the profile.
`private Predicate<ProfileRequestContext>`
`skipEndpointValidationWhenSignedPredicate`
Whether the response endpoint should be validated if the request is signed.
`private Function<ProfileRequestContext,String>`
`spNameQualifierLookupStrategy`
Lookup function to supply SPNameQualifier in request.
`private Predicate<ProfileRequestContext>`
`suppressAuthenticatingAuthorityPredicate`
The predicate used to determine whether to suppress `AuthenticatingAuthority` when possible.

### Fields inherited from interface net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration

`DEFAULT_DELEGATION_CHAIN_LENGTH`

### Fields inherited from interface net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration

`FEATURE_AUTHNCONTEXT, FEATURE_FORCEAUTHN, FEATURE_NAMEIDFORMAT, FEATURE_SCOPING, FEATURE_SPNAMEQUALIFIER, PROFILE_ID`

### Fields inherited from interface net.shibboleth.profile.config.ProfileConfiguration

`DEFAULT_DISALLOWED_FEATURES`

### Fields inherited from interface net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration

`DEFAULT_ASSERTION_LIFETIME`

## Constructor Summary

Constructors
Modifier
Constructor
Description
``
`BrowserSSOProfileConfiguration()`
Constructor.
`protected`
`BrowserSSOProfileConfiguration(String profileId)`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`Integer`
`getAttributeIndex(ProfileRequestContext profileRequestContext)`
`String`
`getAttributeRecipientGroupID(ProfileRequestContext profileRequestContext)`
`Set<String>`
`getAuthenticationFlows(ProfileRequestContext profileRequestContext)`
Deprecated, for removal: This API element is subject to removal in a future version.
`AuthnContextComparisonTypeEnumeration`
`getAuthnContextComparison(ProfileRequestContext profileRequestContext)`
`Function<AuthnContext,Collection<Principal>>`
`getAuthnContextTranslationStrategy(ProfileRequestContext profileRequestContext)`
Get the function to use to translate an inbound proxied SAML 2.0 `AuthnContext` into the appropriate set of custom `Principal` objects to populate into the subject.
`Function<ProfileRequestContext,Collection<Principal>>`
`getAuthnContextTranslationStrategyEx(ProfileRequestContext profileRequestContext)`
Get the function to use to translate an inbound proxied response into the appropriate set of custom `Principal` objects to populate into the subject.
`List<Principal>`
`getDefaultAuthenticationMethods(ProfileRequestContext profileRequestContext)`
Get the default authentication methods to use, expressed as custom principals.
`Duration`
`getMaxAge(ProfileRequestContext profileRequestContext)`
Get duration since an `AuthenticationResult` was created that allows it to be reused for this request.
`Duration`
`getMaximumSPSessionLifetime(ProfileRequestContext profileRequestContext)`
Get the maximum amount of time the service provider should maintain a session for the user based on the authentication assertion.
`Duration`
`getMaximumTimeSinceAuthn(ProfileRequestContext profileRequestContext)`
`long`
`getMaximumTokenDelegationChainLength(ProfileRequestContext profileRequestContext)`
Deprecated, for removal: This API element is subject to removal in a future version.
`List<String>`
`getNameIDFormatPrecedence(ProfileRequestContext profileRequestContext)`
Get the name identifier formats to use.
`List<String>`
`getPostAuthenticationFlows(ProfileRequestContext profileRequestContext)`
Get an ordered list of post-authentication interceptor flows to run for this profile.
`Set<String>`
`getProxyAudiences(ProfileRequestContext profileRequestContext)`
Gets the unmodifiable collection of audiences for a proxied assertion.
`Integer`
`getProxyCount(ProfileRequestContext profileRequestContext)`
Gets the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.
`Collection<RequestedAttribute>`
`getRequestedAttributes(ProfileRequestContext profileRequestContext)`
`Collection<String>`
`getRequestedIdPAttributeNames(ProfileRequestContext profileRequestContext)`
`String`
`getSPNameQualifier(ProfileRequestContext profileRequestContext)`
`boolean`
`isAllowDelegation(ProfileRequestContext profileRequestContext)`
Deprecated, for removal: This API element is subject to removal in a future version.
`boolean`
`isCheckAddress(ProfileRequestContext profileRequestContext)`
`boolean`
`isCheckInResponseTo(ProfileRequestContext profileRequestContext)`
`boolean`
`isForceAuthn(ProfileRequestContext profileRequestContext)`
Get whether the authentication process should include a proof of user presence.
`boolean`
`isIgnoreScoping(ProfileRequestContext profileRequestContext)`
Gets whether Scoping elements in requests should be ignored/omitted.
`boolean`
`isIncludeAttributeStatement(ProfileRequestContext profileRequestContext)`
Get whether responses to the authentication request should include an attribute statement.
`boolean`
`isProxiedAuthnInstant(ProfileRequestContext profileRequestContext)`
Gets whether authentication results produced by use of this profile should carry the proxied assertion's AuthnInstant, rather than the current time.
`boolean`
`isRandomizeFriendlyName(ProfileRequestContext profileRequestContext)`
Gets whether to randomize/perturb the FriendlyName attribute when encoding SAML 2.0 Attributes to enable probing of invalid behavior by relying parties.
`boolean`
`isRequireSignedAssertions(ProfileRequestContext profileRequestContext)`
`boolean`
`isRequireSignedRequests(ProfileRequestContext profileRequestContext)`
Get whether to require signed requests.
`boolean`
`isResolveAttributes(ProfileRequestContext profileRequestContext)`
`boolean`
`isSkipEndpointValidationWhenSigned(ProfileRequestContext profileRequestContext)`
Get condition to determine whether the response endpoint should be validated if the request is signed.
`boolean`
`isSuppressAuthenticatingAuthority(ProfileRequestContext profileRequestContext)`
Gets whether to suppress inclusion of `AuthenticatingAuthority` element.
`void`
`setAllowDelegation(boolean flag)`
Deprecated, for removal: This API element is subject to removal in a future version.
`void`
`setAllowDelegationPredicate(Predicate<ProfileRequestContext> predicate)`
Deprecated, for removal: This API element is subject to removal in a future version.
`void`
`setAttributeIndex(Integer index)`
Sets the AttributeConsumingServiceIndex to include in requests.
`void`
`setAttributeIndexLookupStrategy(Function<ProfileRequestContext,Integer> strategy)`
Sets a lookup strategy for the AttributeConsumingServiceIndex to include in requests.
`void`
`setAttributeRecipientGroupID(String groupID)`
Set the group of services for which attributes are being resolved.
`void`
`setAttributeRecipientGroupIDLookupStrategy(Function<ProfileRequestContext,String> strategy)`
Set the lookup strategy for the group of services for which attributes are being resolved.
`void`
`setAuthenticationFlows(Collection<String> flows)`
Deprecated, for removal: This API element is subject to removal in a future version.
`void`
`setAuthenticationFlowsLookupStrategy(Function<ProfileRequestContext,Set<String>> strategy)`
Deprecated, for removal: This API element is subject to removal in a future version.
`void`
`setAuthnContextComparison(AuthnContextComparisonTypeEnumeration comparison)`
Set the comparison operator to use when issuing SAML requests containing requested context classes.
`void`
`setAuthnContextComparisonLookupStrategy(Function<ProfileRequestContext,String> strategy)`
Set a lookup strategy for the comparison operator to use when issuing SAML requests containing requested context classes.
`void`
`setAuthnContextTranslationStrategy(Function<AuthnContext,Collection<Principal>> strategy)`
Set the function to use to translate an inbound proxied SAML 2.0 `AuthnContext` into the appropriate set of custom `Principal` objects to populate into the subject.
`void`
`setAuthnContextTranslationStrategyEx(Function<ProfileRequestContext,Collection<Principal>> strategy)`
Set the function to use to translate an inbound proxied response into the appropriate set of custom `Principal` objects to populate into the subject.
`void`
`setAuthnContextTranslationStrategyExLookupStrategy(Function<ProfileRequestContext,Function<ProfileRequestContext,Collection<Principal>>> strategy)`
Set a lookup strategy for the function to use to translate an inbound proxied response into the appropriate set of custom `Principal` objects to populate into the subject.
`void`
`setAuthnContextTranslationStrategyLookupStrategy(Function<ProfileRequestContext,Function<AuthnContext,Collection<Principal>>> strategy)`
Set a lookup strategy for the function to use to translate an inbound proxied SAML 2.0 `AuthnContext` into the appropriate set of custom `Principal` objects to populate into the subject.
`void`
`setCheckAddress(boolean flag)`
Set whether the client's address must match the address in an inbound `SubjectLocality` element during inbound SSO.
`void`
`setCheckAddressPredicate(Predicate<ProfileRequestContext> condition)`
Set a condition to determine whether the client's address must match the address in an inbound `SubjectLocality` element during inbound SSO.
`void`
`setCheckInResponseTo(boolean flag)`
Set whether the inbound InResponseTo value should be checked against the outgoing request message during inbound SSO.
`void`
`setCheckInResponseToPredicate(Predicate<ProfileRequestContext> condition)`
Set a condition to determine whether the inbound InResponseTo value should be checked against the outgoing request message during inbound SSO.
`void`
`setDefaultAuthenticationMethods(Collection<Principal> contexts)`
Set the default authentication contexts to use, expressed as custom principals.
`void`
`setDefaultAuthenticationMethodsLookupStrategy(Function<ProfileRequestContext,Collection<Principal>> strategy)`
Set a lookup strategy for the authentication contexts to use, expressed as custom principals.
`void`
`setForceAuthn(boolean flag)`
Set whether a fresh user presence proof should be required for this request.
`void`
`setForceAuthnPredicate(Predicate<ProfileRequestContext> condition)`
Set a condition to determine whether a fresh user presence proof should be required for this request.
`void`
`setIgnoreScoping(boolean flag)`
Sets whether Scoping elements in requests should be ignored/omitted.
`void`
`setIgnoreScopingPredicate(Predicate<ProfileRequestContext> condition)`
Sets a condition to determine whether Scoping elements in requests should be ignored/omitted.
`void`
`setIncludeAttributeStatement(boolean flag)`
Set whether responses to the authentication request should include an attribute statement.
`void`
`setIncludeAttributeStatementPredicate(Predicate<ProfileRequestContext> condition)`
Set a condition to determine whether responses to the authentication request should include an attribute statement.
`void`
`setMaxAge(Duration maxAge)`
Sets allowed duration between an `AuthenticationResult` creation and its reuse for this request.
`void`
`setMaxAgeLookupStrategy(Function<ProfileRequestContext,Duration> strategy)`
Sets lookup strategy for the allowed duration between an `AuthenticationResult` creation and its reuse for this request.
`void`
`setMaximumSPSessionLifetime(Duration lifetime)`
Set the maximum amount of time the service provider should maintain a session for the user based on the authentication assertion.
`void`
`setMaximumSPSessionLifetimeLookupStrategy(Function<ProfileRequestContext,Duration> strategy)`
Set a lookup strategy for the maximum amount of time the service provider should maintain a session for the user.
`void`
`setMaximumTimeSinceAuthn(Duration amount)`
Set the maximum amount of time allowed to have elapsed since an incoming AuthnInstant.
`void`
`setMaximumTimeSinceAuthnLookupStrategy(Function<ProfileRequestContext,Duration> strategy)`
Set a lookup strategy for the maximum amount of time allowed to have elapsed since an incoming AuthnInstant.
`void`
`setMaximumTokenDelegationChainLength(long length)`
Deprecated, for removal: This API element is subject to removal in a future version.
`void`
`setMaximumTokenDelegationChainLengthLookupStrategy(Function<ProfileRequestContext,Long> strategy)`
Deprecated, for removal: This API element is subject to removal in a future version.
`void`
`setNameIDFormatPrecedence(Collection<String> formats)`
Set the name identifier formats to use.
`void`
`setNameIDFormatPrecedenceLookupStrategy(Function<ProfileRequestContext,Collection<String>> strategy)`
Set a lookup strategy for the name identifier formats to use.
`void`
`setPostAuthenticationFlows(Collection<String> flows)`
Set the ordered collection of post-authentication interceptor flows to enable.
`void`
`setPostAuthenticationFlowsLookupStrategy(Function<ProfileRequestContext,Collection<String>> strategy)`
Set a lookup strategy for the post-authentication interceptor flows to enable.
`void`
`setProxiedAuthnInstant(boolean flag)`
Sets whether authentication results produced by use of this profile should carry the proxied assertion's AuthnInstant, rather than the current time.
`void`
`setProxiedAuthnInstantPredicate(Predicate<ProfileRequestContext> condition)`
Sets condition to determine whether authentication results produced by use of this profile should carry the proxied assertion's AuthnInstant, rather than the current time.
`void`
`setProxyAudiences(Collection<String> audiences)`
Set the proxy audiences to be added to responses.
`void`
`setProxyAudiencesLookupStrategy(Function<ProfileRequestContext,Collection<String>> strategy)`
Set a lookup strategy for the proxy audiences to be added to responses.
`void`
`setProxyCount(Integer count)`
Set the maximum number of times an assertion may be proxied.
`void`
`setProxyCountLookupStrategy(Function<ProfileRequestContext,Integer> strategy)`
Set a lookup strategy for the maximum number of times an assertion may be proxied.
`void`
`setRandomizeFriendlyName(boolean flag)`
Set whether to randomize/perturb the FriendlyName attribute when encoding SAML 2.0 Attributes to enable probing of invalid behavior by relying parties.
`void`
`setRandomizeFriendlyNamePredicate(Predicate<ProfileRequestContext> condition)`
Set condition to determine whether to randomize/perturb the FriendlyName attribute when encoding SAML 2.0 Attributes to enable probing of invalid behavior by relying parties.
`void`
`setRequestedAttributes(Collection<RequestedAttribute> attrs)`
Set the `RequestedAttribute` objects to include in request.
`void`
`setRequestedAttributesLookupStrategy(Function<ProfileRequestContext,Collection<RequestedAttribute>> strategy)`
Set a lookup strategy for the name identifier formats to use.
`void`
`setRequestedIdPAttributeNames(Collection<String> names)`
Set `IdPAttribute` names to resolve (if resolving attributes).
`void`
`setRequestedIdPAttributeNamesLookupStrategy(Function<ProfileRequestContext,Collection<String>> strategy)`
Lookup strategy for `IdPAttribute` names to resolve (if resolving attributes).
`void`
`setRequireSignedAssertions(boolean flag)`
Set whether to require signed assertions.
`void`
`setRequireSignedAssertionsPredicate(Predicate<ProfileRequestContext> condition)`
Set a condition to determine whether to require signed assertions.
`void`
`setRequireSignedRequests(boolean flag)`
Set whether to require signed requests.
`void`
`setRequireSignedRequestsPredicate(Predicate<ProfileRequestContext> condition)`
Set a condition to determine whether to require signed requests.
`void`
`setResolveAttributes(boolean flag)`
Set whether attributes should be resolved during the profile.
`void`
`setResolveAttributesPredicate(Predicate<ProfileRequestContext> condition)`
Set a condition to determine whether attributes should be resolved during the profile.
`void`
`setSkipEndpointValidationWhenSigned(boolean flag)`
Set whether the response endpoint should be validated if the request is signed.
`void`
`setSkipEndpointValidationWhenSignedPredicate(Predicate<ProfileRequestContext> condition)`
Set condition to determine whether the response endpoint should be validated if the request is signed.
`void`
`setSPNameQualifier(String qualifier)`
Sets the SPNameQualifier to include in requests.
`void`
`setSPNameQualifierLookupStrategy(Function<ProfileRequestContext,String> strategy)`
Sets a lookup strategy for the SPNameQualifier to include in requests.
`void`
`setSuppressAuthenticatingAuthority(boolean flag)`
Sets whether to suppress inclusion of `AuthenticatingAuthority` element.
`void`
`setSuppressAuthenticatingAuthorityPredicate(Predicate<ProfileRequestContext> condition)`
Sets condition to determine whether to suppress inclusion of `AuthenticatingAuthority` element.

### Methods inherited from class net.shibboleth.idp.saml.saml2.profile.config.impl.AbstractSAML2AssertionProducingProfileConfiguration

`getAssertionAudiences, getAssertionLifetime, isEncryptAssertions, isEncryptAttributes, isIncludeConditionsNotBefore, isSignAssertions, setAdditionalAudiencesForAssertion, setAdditionalAudiencesForAssertionLookupStrategy, setAssertionAudiences, setAssertionAudiencesLookupStrategy, setAssertionLifetime, setAssertionLifetimeLookupStrategy, setEncryptAssertions, setEncryptAssertionsPredicate, setEncryptAttributes, setEncryptAttributesPredicate, setIncludeConditionsNotBefore, setIncludeConditionsNotBeforePredicate, setSignAssertions, setSignAssertionsPredicate`

### Methods inherited from class net.shibboleth.idp.saml.saml2.profile.config.impl.AbstractSAML2ArtifactAwareProfileConfiguration

`getArtifactConfiguration, isClientTLSArtifactRequests, isSignArtifactRequests, setArtifactConfiguration, setArtifactConfigurationLookupStrategy, setClientTLSArtifactRequests, setClientTLSArtifactRequestsPredicate, setSignArtifactRequests, setSignArtifactRequestsPredicate`

### Methods inherited from class net.shibboleth.idp.saml.saml2.profile.config.impl.AbstractSAML2ProfileConfiguration

`isEncryptionOptional, isEncryptNameIDs, isIgnoreRequestSignatures, setEncryptionOptional, setEncryptionOptionalPredicate, setEncryptNameIDs, setEncryptNameIDsPredicate, setIgnoreRequestSignatures, setIgnoreRequestSignaturesPredicate`

### Methods inherited from class net.shibboleth.idp.saml.profile.config.impl.AbstractSAMLProfileConfiguration

`getMessageHandler, isSignRequests, isSignResponses, setMessageDecorator, setMessageHandler, setMessageHandlerLookupStrategy, setSignRequests, setSignRequestsPredicate, setSignResponses, setSignResponsesPredicate`

### Methods inherited from class net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration

`getInboundInterceptorFlows, getOutboundInterceptorFlows, setInboundInterceptorFlows, setInboundInterceptorFlowsLookupStrategy, setOutboundInterceptorFlows, setOutboundInterceptorFlowsLookupStrategy`

### Methods inherited from class net.shibboleth.profile.config.AbstractConditionalProfileConfiguration

`getActivationCondition, setActivationCondition`

### Methods inherited from class net.shibboleth.profile.config.AbstractProfileConfiguration

`equals, getDisallowedFeatures, getSecurityConfiguration, hashCode, isFeatureDisallowed, setDisallowedFeatures, setDisallowedFeaturesLookupStrategy, setSecurityConfiguration, setSecurityConfigurationLookupStrategy`

### Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

`setId`

### Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

`doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException`

### Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

`checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized`

### Methods inherited from class java.lang.Object

`clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration

`isLocal`

### Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

`getId`

### Methods inherited from interface net.shibboleth.idp.profile.config.InterceptorAwareProfileConfiguration

`getInboundInterceptorFlows, getOutboundInterceptorFlows`

### Methods inherited from interface net.shibboleth.profile.config.ProfileConfiguration

`getDisallowedFeatures, getSecurityConfiguration, isFeatureDisallowed`

### Methods inherited from interface net.shibboleth.saml.saml2.profile.config.SAML2ProfileConfiguration

`isEncryptionOptional, isEncryptNameIDs, isIgnoreRequestSignatures`

### Methods inherited from interface net.shibboleth.saml.profile.config.SAMLArtifactConsumerProfileConfiguration

`isClientTLSArtifactRequests, isSignArtifactRequests`

### Methods inherited from interface net.shibboleth.saml.profile.config.SAMLAssertionConsumingProfileConfiguration

`getAssertionAudiences, getAssertionLifetime`

### Methods inherited from interface net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration

`getAssertionAudiences, getAssertionLifetime, isIncludeConditionsNotBefore, isSignAssertions`

### Methods inherited from interface net.shibboleth.saml.profile.config.SAMLProfileConfiguration

`getMessageHandler, isSignRequests, isSignResponses`

## Field Details

### PROFILE_COUNTER

@Nonnull @NotEmpty public static final String PROFILE_COUNTER
Name of profile counter.

See Also:
  - Constant Field Values

### resolveAttributesPredicate

@Nonnull private Predicate<ProfileRequestContext> resolveAttributesPredicate
Whether attributes should be resolved in the course of the profile.

### requestedIdPAttributeNamesLookupStrategy

@Nonnull private Function<ProfileRequestContext,Collection<String>> requestedIdPAttributeNamesLookupStrategy
Lookup strategy for requested IdP attribute names to pass into resolver.

### attributeRecipientGroupIDLookupStrategy

@Nonnull private Function<ProfileRequestContext,String> attributeRecipientGroupIDLookupStrategy
Lookup strategy for attribute recipient group ID.

### includeAttributeStatementPredicate

@Nonnull private Predicate<ProfileRequestContext> includeAttributeStatementPredicate
Whether responses to the authentication request should include an attribute statement.

### ignoreScoping

@Nonnull private Predicate<ProfileRequestContext> ignoreScoping
Whether to ignore Scoping elements within AuthnRequest.

### forceAuthnPredicate

@Nonnull private Predicate<ProfileRequestContext> forceAuthnPredicate
Whether to mandate forced authentication for the request.

### maxAgeLookupStrategy

@Nonnull private Function<ProfileRequestContext,Duration> maxAgeLookupStrategy
Lookup function for max-age setting.

### checkAddressPredicate

@Nonnull private Predicate<ProfileRequestContext> checkAddressPredicate
Whether to compare client and assertion addresses on inbound SSO.

### checkInResponseToPredicate

@Nonnull private Predicate<ProfileRequestContext> checkInResponseToPredicate
Whether to validate inbound InResponseTo values.

### skipEndpointValidationWhenSignedPredicate

@Nonnull private Predicate<ProfileRequestContext> skipEndpointValidationWhenSignedPredicate
Whether the response endpoint should be validated if the request is signed.

### randomizeFriendlyNamePredicate

@Nonnull private Predicate<ProfileRequestContext> randomizeFriendlyNamePredicate
Whether the FriendlyName attribute should be randomized when encoding Attributes.

### proxyCountLookupStrategy

@Nonnull private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy
Lookup function to supply proxyCount property.

### proxyAudiencesLookupStrategy

@Nonnull private Function<ProfileRequestContext,Collection<String>> proxyAudiencesLookupStrategy
Lookup function to supply proxy audiences.

### proxiedAuthnInstantPredicate

@Nonnull private Predicate<ProfileRequestContext> proxiedAuthnInstantPredicate
Whether authentication results should carry the proxied AuthnInstant.

### suppressAuthenticatingAuthorityPredicate

@Nonnull private Predicate<ProfileRequestContext> suppressAuthenticatingAuthorityPredicate
The predicate used to determine whether to suppress `AuthenticatingAuthority` when possible.

### requireSignedRequestsPredicate

@Nonnull private Predicate<ProfileRequestContext> requireSignedRequestsPredicate
Whether to require requests be signed.

### requireSignedAssertionsPredicate

@Nonnull private Predicate<ProfileRequestContext> requireSignedAssertionsPredicate
Whether to require assertions be signed.

### maximumSPSessionLifetimeLookupStrategy

@Nonnull private Function<ProfileRequestContext,Duration> maximumSPSessionLifetimeLookupStrategy
Lookup function to supply maximum session lifetime.

### maximumTimeSinceAuthnLookupStrategy

@Nonnull private Function<ProfileRequestContext,Duration> maximumTimeSinceAuthnLookupStrategy
Lookup function to supply maximum time since inbound AuthnInstant.

### allowDelegationPredicate

@Nonnull private Predicate<ProfileRequestContext> allowDelegationPredicate
The predicate used to determine if produced assertions may be delegated.

### maximumTokenDelegationChainLengthLookupStrategy

@Nonnull private Function<ProfileRequestContext,Long> maximumTokenDelegationChainLengthLookupStrategy
Lookup function to supply maximum delegation chain length.

### authnContextTranslationStrategyLookupStrategy

@Nonnull private Function<ProfileRequestContext,Function<AuthnContext,Collection<Principal>>> authnContextTranslationStrategyLookupStrategy
Lookup function to supply the strategy function for translating SAML 2.0 AuthnContext data.

### authnContextTranslationStrategyExLookupStrategy

@Nonnull private Function<ProfileRequestContext,Function<ProfileRequestContext,Collection<Principal>>> authnContextTranslationStrategyExLookupStrategy
Lookup function to supply the strategy function for translating fully-generic data.

### authnContextComparisonLookupStrategy

@Nonnull private Function<ProfileRequestContext,String> authnContextComparisonLookupStrategy
Lookup function for requested AC operator.

### defaultAuthenticationContextsLookupStrategy

@Nonnull private Function<ProfileRequestContext,Collection<Principal>> defaultAuthenticationContextsLookupStrategy
Lookup function to supply default authentication methods.

### authenticationFlowsLookupStrategy

@Nonnull private Function<ProfileRequestContext,Set<String>> authenticationFlowsLookupStrategy
Lookup function to supply authentication flows.

### postAuthenticationFlowsLookupStrategy

@Nonnull private Function<ProfileRequestContext,Collection<String>> postAuthenticationFlowsLookupStrategy
Lookup function to supply post authentication flows.

### nameIDFormatPrecedenceLookupStrategy

@Nonnull private Function<ProfileRequestContext,Collection<String>> nameIDFormatPrecedenceLookupStrategy
Lookup function to supply NameID formats.

### spNameQualifierLookupStrategy

@Nonnull private Function<ProfileRequestContext,String> spNameQualifierLookupStrategy
Lookup function to supply SPNameQualifier in request.

### attributeIndexLookupStrategy

@Nonnull private Function<ProfileRequestContext,Integer> attributeIndexLookupStrategy
Lookup function to supply AttributeConsumingServiceIndex in request.

### requestedAttributesLookupStrategy

@Nonnull private Function<ProfileRequestContext,Collection<RequestedAttribute>> requestedAttributesLookupStrategy
Lookup function to supply RequestedAttributes in request.

## Constructor Details

### BrowserSSOProfileConfiguration

public BrowserSSOProfileConfiguration()
Constructor.

### BrowserSSOProfileConfiguration

protected BrowserSSOProfileConfiguration(@Nonnull @NotEmpty String profileId)
Constructor.

Parameters:
  `profileId` - unique ID for this profile

## Method Details

### isResolveAttributes

public boolean isResolveAttributes(@Nullable ProfileRequestContext profileRequestContext)

Specified by:
  `isResolveAttributes` in interface `AttributeResolvingProfileConfiguration`

### setResolveAttributes

public void setResolveAttributes(boolean flag)
Set whether attributes should be resolved during the profile.

Parameters:
  `flag` - flag to set

### setResolveAttributesPredicate

public void setResolveAttributesPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
Set a condition to determine whether attributes should be resolved during the profile.

Parameters:
  `condition` - condition to set

### getRequestedIdPAttributeNames

@Nonnull @Unmodifiable @NotLive public Collection<String> getRequestedIdPAttributeNames(@Nullable ProfileRequestContext profileRequestContext)

Specified by:
  `getRequestedIdPAttributeNames` in interface `AttributeResolvingProfileConfiguration`

### setRequestedIdPAttributeNames

public void setRequestedIdPAttributeNames(@Nullable Collection<String> names)
Set `IdPAttribute` names to resolve (if resolving attributes).

Parameters:
  `names` - `IdPAttribute` names to resolve
Since:
  5.2.0

### setRequestedIdPAttributeNamesLookupStrategy

public void setRequestedIdPAttributeNamesLookupStrategy(@Nonnull Function<ProfileRequestContext,Collection<String>> strategy)
Lookup strategy for `IdPAttribute` names to resolve (if resolving attributes).

Parameters:
  `strategy` - lookup strategy
Since:
  5.2.0

### getAttributeRecipientGroupID

@Nullable public String getAttributeRecipientGroupID(@Nullable ProfileRequestContext profileRequestContext)

Specified by:
  `getAttributeRecipientGroupID` in interface `AttributeResolvingProfileConfiguration`

### setAttributeRecipientGroupID

public void setAttributeRecipientGroupID(@Nullable String groupID)
Set the group of services for which attributes are being resolved.

Parameters:
  `groupID` - group identifier
Since:
  5.2.0

### setAttributeRecipientGroupIDLookupStrategy

public void setAttributeRecipientGroupIDLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
Set the lookup strategy for the group of services for which attributes are being resolved.

Parameters:
  `strategy` - lookup strategy
Since:
  5.2.0

### isIncludeAttributeStatement

public boolean isIncludeAttributeStatement(@Nullable ProfileRequestContext profileRequestContext)
Get whether responses to the authentication request should include an attribute statement.

Default is true

Specified by:
  `isIncludeAttributeStatement` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  whether responses to the authentication request should include an attribute statement

### setIncludeAttributeStatement

public void setIncludeAttributeStatement(boolean flag)
Set whether responses to the authentication request should include an attribute statement.

Parameters:
  `flag` - flag to set

### setIncludeAttributeStatementPredicate

public void setIncludeAttributeStatementPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
Set a condition to determine whether responses to the authentication request should include an attribute statement.

Parameters:
  `condition` - condition to set

### isIgnoreScoping

public boolean isIgnoreScoping(@Nullable ProfileRequestContext profileRequestContext)
Gets whether Scoping elements in requests should be ignored/omitted.

Specified by:
  `isIgnoreScoping` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  whether Scoping elements in requests should be ignored/omitted

### setIgnoreScoping

public void setIgnoreScoping(boolean flag)
Sets whether Scoping elements in requests should be ignored/omitted.

Defaults to false.

Parameters:
  `flag` - flag to set
Since:
  4.0.0

### setIgnoreScopingPredicate

public void setIgnoreScopingPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
Sets a condition to determine whether Scoping elements in requests should be ignored/omitted.

Parameters:
  `condition` - condition to set
Since:
  4.0.0

### isForceAuthn

public boolean isForceAuthn(@Nullable ProfileRequestContext profileRequestContext)
Get whether the authentication process should include a proof of user presence.

Specified by:
  `isForceAuthn` in interface `AuthenticationProfileConfiguration`
Specified by:
  `isForceAuthn` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  true iff authentication should require user presence

### setForceAuthn

public void setForceAuthn(boolean flag)
Set whether a fresh user presence proof should be required for this request.

Parameters:
  `flag` - flag to set

### setForceAuthnPredicate

public void setForceAuthnPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
Set a condition to determine whether a fresh user presence proof should be required for this request.

Parameters:
  `condition` - condition to set

### getMaxAge

@ConfigurationSetting(name="maxAge") @Nullable public Duration getMaxAge(@Nullable ProfileRequestContext profileRequestContext)
Get duration since an `AuthenticationResult` was created that allows it to be reused for this request.

If null, no constraint is applied.

Specified by:
  `getMaxAge` in interface `AuthenticationProfileConfiguration`
Parameters:
  `profileRequestContext` - profile request context
Returns:
  allowable duration

### setMaxAge

public void setMaxAge(@Nullable Duration maxAge)
Sets allowed duration between an `AuthenticationResult` creation and its reuse for this request.

Parameters:
  `maxAge` - allowed duration
Since:
  5.2.0

### setMaxAgeLookupStrategy

public void setMaxAgeLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
Sets lookup strategy for the allowed duration between an `AuthenticationResult` creation and its reuse for this request.

Parameters:
  `strategy` - lookup strategy
Since:
  5.2.0

### isCheckAddress

public boolean isCheckAddress(@Nullable ProfileRequestContext profileRequestContext)

Specified by:
  `isCheckAddress` in interface `BrowserSSOProfileConfiguration`

### setCheckAddress

public void setCheckAddress(boolean flag)
Set whether the client's address must match the address in an inbound `SubjectLocality` element during inbound SSO.

Parameters:
  `flag` - flag to set
Since:
  4.0.0

### setCheckAddressPredicate

public void setCheckAddressPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
Set a condition to determine whether the client's address must match the address in an inbound `SubjectLocality` element during inbound SSO.

Parameters:
  `condition` - condition to set
Since:
  4.0.0

### isCheckInResponseTo

public boolean isCheckInResponseTo(@Nullable ProfileRequestContext profileRequestContext)

Specified by:
  `isCheckInResponseTo` in interface `BrowserSSOProfileConfiguration`

### setCheckInResponseTo

public void setCheckInResponseTo(boolean flag)
Set whether the inbound InResponseTo value should be checked against the outgoing request message during inbound SSO.

Parameters:
  `flag` - flag to set
Since:
  5.2.0

### setCheckInResponseToPredicate

public void setCheckInResponseToPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
Set a condition to determine whether the inbound InResponseTo value should be checked against the outgoing request message during inbound SSO.

Parameters:
  `condition` - condition to set
Since:
  5.2.0

### isSkipEndpointValidationWhenSigned

public boolean isSkipEndpointValidationWhenSigned(@Nullable ProfileRequestContext profileRequestContext)
Get condition to determine whether the response endpoint should be validated if the request is signed.

Specified by:
  `isSkipEndpointValidationWhenSigned` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  condition

### setSkipEndpointValidationWhenSigned

public void setSkipEndpointValidationWhenSigned(boolean flag)
Set whether the response endpoint should be validated if the request is signed.

Parameters:
  `flag` - flag to set
Since:
  3.4.0

### setSkipEndpointValidationWhenSignedPredicate

public void setSkipEndpointValidationWhenSignedPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
Set condition to determine whether the response endpoint should be validated if the request is signed.

Parameters:
  `condition` - condition to set
Since:
  3.4.0

### isRandomizeFriendlyName

public boolean isRandomizeFriendlyName(@Nullable ProfileRequestContext profileRequestContext)
Gets whether to randomize/perturb the FriendlyName attribute when encoding SAML 2.0 Attributes to enable probing of invalid behavior by relying parties.

Specified by:
  `isRandomizeFriendlyName` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  true iff the FriendlyName should be randomized

### setRandomizeFriendlyName

public void setRandomizeFriendlyName(boolean flag)
Set whether to randomize/perturb the FriendlyName attribute when encoding SAML 2.0 Attributes to enable probing of invalid behavior by relying parties.

Parameters:
  `flag` - flag to set
Since:
  5.1.0

### setRandomizeFriendlyNamePredicate

public void setRandomizeFriendlyNamePredicate(@Nonnull Predicate<ProfileRequestContext> condition)
Set condition to determine whether to randomize/perturb the FriendlyName attribute when encoding SAML 2.0 Attributes to enable probing of invalid behavior by relying parties.

Parameters:
  `condition` - condition to set
Since:
  5.1.0

### getProxyCount

@Nullable public Integer getProxyCount(@Nullable ProfileRequestContext profileRequestContext)
Gets the maximum number of times an assertion may be proxied outbound and/or the maximum number of hops between the relying party and a proxied authentication authority inbound.

Specified by:
  `getProxyCount` in interface `AuthenticationProfileConfiguration`
Specified by:
  `getProxyCount` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  maximum number of times an assertion or authentication may be proxied

### setProxyCount

public void setProxyCount(@Nullable @NonNegative Integer count)
Set the maximum number of times an assertion may be proxied.

Parameters:
  `count` - maximum number of times an assertion may be proxied

### setProxyCountLookupStrategy

public void setProxyCountLookupStrategy(@Nonnull Function<ProfileRequestContext,Integer> strategy)
Set a lookup strategy for the maximum number of times an assertion may be proxied.

Parameters:
  `strategy` - lookup strategy

### getProxyAudiences

@Nonnull @NotLive @Unmodifiable public Set<String> getProxyAudiences(@Nullable ProfileRequestContext profileRequestContext)
Gets the unmodifiable collection of audiences for a proxied assertion.

Specified by:
  `getProxyAudiences` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  audiences for a proxied assertion

### setProxyAudiences

public void setProxyAudiences(@Nullable Collection<String> audiences)
Set the proxy audiences to be added to responses.

Parameters:
  `audiences` - proxy audiences to be added to responses

### setProxyAudiencesLookupStrategy

public void setProxyAudiencesLookupStrategy(@Nonnull Function<ProfileRequestContext,Collection<String>> strategy)
Set a lookup strategy for the proxy audiences to be added to responses.

Parameters:
  `strategy` - lookup strategy

### isSuppressAuthenticatingAuthority

public boolean isSuppressAuthenticatingAuthority(@Nullable ProfileRequestContext profileRequestContext)
Gets whether to suppress inclusion of `AuthenticatingAuthority` element.

Defaults to false.

Specified by:
  `isSuppressAuthenticatingAuthority` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  true iff the element should be suppressed when possible

### setSuppressAuthenticatingAuthority

public void setSuppressAuthenticatingAuthority(boolean flag)
Sets whether to suppress inclusion of `AuthenticatingAuthority` element.

Defaults to false.

Parameters:
  `flag` - flag to set
Since:
  4.2.0

### setSuppressAuthenticatingAuthorityPredicate

public void setSuppressAuthenticatingAuthorityPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
Sets condition to determine whether to suppress inclusion of `AuthenticatingAuthority` element.

Parameters:
  `condition` - condition to set
Since:
  4.2.0

### isProxiedAuthnInstant

public boolean isProxiedAuthnInstant(@Nullable ProfileRequestContext profileRequestContext)
Gets whether authentication results produced by use of this profile should carry the proxied assertion's AuthnInstant, rather than the current time.

Defaults to true.

Specified by:
  `isProxiedAuthnInstant` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  whether to proxy across the inbound AuthnInstant

### setProxiedAuthnInstant

public void setProxiedAuthnInstant(boolean flag)
Sets whether authentication results produced by use of this profile should carry the proxied assertion's AuthnInstant, rather than the current time.

Parameters:
  `flag` - flag to set
Since:
  4.0.0

### setProxiedAuthnInstantPredicate

public void setProxiedAuthnInstantPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
Sets condition to determine whether authentication results produced by use of this profile should carry the proxied assertion's AuthnInstant, rather than the current time.

Parameters:
  `condition` - condition to set
Since:
  4.0.0

### isRequireSignedRequests

public boolean isRequireSignedRequests(@Nullable ProfileRequestContext profileRequestContext)
Get whether to require signed requests.

Specified by:
  `isRequireSignedRequests` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  whether to require signed requests

### setRequireSignedRequests

public void setRequireSignedRequests(boolean flag)
Set whether to require signed requests.

Parameters:
  `flag` - flag to set
Since:
  4.3.0

### setRequireSignedRequestsPredicate

public void setRequireSignedRequestsPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
Set a condition to determine whether to require signed requests.

Parameters:
  `condition` - condition to set
Since:
  4.3.0

### isRequireSignedAssertions

public boolean isRequireSignedAssertions(@Nullable ProfileRequestContext profileRequestContext)

Specified by:
  `isRequireSignedAssertions` in interface `SAMLAssertionConsumingProfileConfiguration`

### setRequireSignedAssertions

public void setRequireSignedAssertions(boolean flag)
Set whether to require signed assertions.

Parameters:
  `flag` - flag to set
Since:
  5.0.0

### setRequireSignedAssertionsPredicate

public void setRequireSignedAssertionsPredicate(@Nonnull Predicate<ProfileRequestContext> condition)
Set a condition to determine whether to require signed assertions.

Parameters:
  `condition` - condition to set
Since:
  5.0.0

### getMaximumSPSessionLifetime

@Nullable public Duration getMaximumSPSessionLifetime(@Nullable ProfileRequestContext profileRequestContext)
Get the maximum amount of time the service provider should maintain a session for the user based on the authentication assertion. A null or 0 is interpreted as an unlimited lifetime.

Specified by:
  `getMaximumSPSessionLifetime` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  max lifetime of service provider should maintain a session

### setMaximumSPSessionLifetime

public void setMaximumSPSessionLifetime(@Nullable Duration lifetime)
Set the maximum amount of time the service provider should maintain a session for the user based on the authentication assertion. A null or 0 is interpreted as an unlimited lifetime.

Parameters:
  `lifetime` - max lifetime of service provider should maintain a session

### setMaximumSPSessionLifetimeLookupStrategy

public void setMaximumSPSessionLifetimeLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
Set a lookup strategy for the maximum amount of time the service provider should maintain a session for the user.

Parameters:
  `strategy` - lookup strategy
Since:
  3.4.0

### getMaximumTimeSinceAuthn

@NonNegative @Nullable public Duration getMaximumTimeSinceAuthn(@Nullable ProfileRequestContext profileRequestContext)

Specified by:
  `getMaximumTimeSinceAuthn` in interface `BrowserSSOProfileConfiguration`

### setMaximumTimeSinceAuthn

public void setMaximumTimeSinceAuthn(@Nullable Duration amount)
Set the maximum amount of time allowed to have elapsed since an incoming AuthnInstant.

A null or 0 is interpreted as an unlimited amount.

Parameters:
  `amount` - max time to allow
Since:
  4.0.0

### setMaximumTimeSinceAuthnLookupStrategy

public void setMaximumTimeSinceAuthnLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
Set a lookup strategy for the maximum amount of time allowed to have elapsed since an incoming AuthnInstant.

Parameters:
  `strategy` - lookup strategy
Since:
  4.0.0

### isAllowDelegation

@Deprecated(since="5.0.0", forRemoval=true) public boolean isAllowDelegation(@Nullable ProfileRequestContext profileRequestContext)
Deprecated, for removal: This API element is subject to removal in a future version.
Get the predicate used to determine if produced assertions may be delegated.

Specified by:
  `isAllowDelegation` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  predicate used to determine if produced assertions may be delegated

### setAllowDelegation

@Deprecated(since="5.0.0", forRemoval=true) public void setAllowDelegation(boolean flag)
Deprecated, for removal: This API element is subject to removal in a future version.
Set whether produced assertions may be delegated.

Parameters:
  `flag` - flag to set

### setAllowDelegationPredicate

@Deprecated(since="5.0.0", forRemoval=true) public void setAllowDelegationPredicate(@Nonnull Predicate<ProfileRequestContext> predicate)
Deprecated, for removal: This API element is subject to removal in a future version.
Set the predicate used to determine if produced assertions may be delegated.

Parameters:
  `predicate` - used to determine if produced assertions may be delegated

### getMaximumTokenDelegationChainLength

@Deprecated(since="5.0.0", forRemoval=true) @NonNegative public long getMaximumTokenDelegationChainLength(@Nullable ProfileRequestContext profileRequestContext)
Deprecated, for removal: This API element is subject to removal in a future version.
Get the limits on the total number of delegates that may be derived from the initial SAML token.

Specified by:
  `getMaximumTokenDelegationChainLength` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  the limit on the total number of delegates that may be derived from the initial SAML token

### setMaximumTokenDelegationChainLength

@Deprecated(since="5.0.0", forRemoval=true) public void setMaximumTokenDelegationChainLength(@NonNegative long length)
Deprecated, for removal: This API element is subject to removal in a future version.
Set the limits on the total number of delegates that may be derived from the initial SAML token.

Parameters:
  `length` - the limit on the total number of delegates that may be derived from the initial SAML token

### setMaximumTokenDelegationChainLengthLookupStrategy

@Deprecated(since="5.0.0", forRemoval=true) public void setMaximumTokenDelegationChainLengthLookupStrategy(@Nonnull Function<ProfileRequestContext,Long> strategy)
Deprecated, for removal: This API element is subject to removal in a future version.
Set a lookup strategy for the limits on the total number of delegates that may be derived from the initial SAML token.

Parameters:
  `strategy` - lookup strategy
Since:
  3.4.0

### getAuthnContextTranslationStrategy

@Nullable public Function<AuthnContext,Collection<Principal>> getAuthnContextTranslationStrategy(@Nullable ProfileRequestContext profileRequestContext)
Get the function to use to translate an inbound proxied SAML 2.0 `AuthnContext` into the appropriate set of custom `Principal` objects to populate into the subject.

Specified by:
  `getAuthnContextTranslationStrategy` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  translation function

### setAuthnContextTranslationStrategy

public void setAuthnContextTranslationStrategy(@Nullable Function<AuthnContext,Collection<Principal>> strategy)
Set the function to use to translate an inbound proxied SAML 2.0 `AuthnContext` into the appropriate set of custom `Principal` objects to populate into the subject.

Parameters:
  `strategy` - translation function
Since:
  4.0.0

### setAuthnContextTranslationStrategyLookupStrategy

public void setAuthnContextTranslationStrategyLookupStrategy(@Nonnull Function<ProfileRequestContext,Function<AuthnContext,Collection<Principal>>> strategy)
Set a lookup strategy for the function to use to translate an inbound proxied SAML 2.0 `AuthnContext` into the appropriate set of custom `Principal` objects to populate into the subject.

Parameters:
  `strategy` - lookup strategy
Since:
  4.0.0

### getAuthnContextTranslationStrategyEx

@Nullable public Function<ProfileRequestContext,Collection<Principal>> getAuthnContextTranslationStrategyEx(@Nullable ProfileRequestContext profileRequestContext)
Get the function to use to translate an inbound proxied response into the appropriate set of custom `Principal` objects to populate into the subject.

This differs from the original in that the input is the entire `ProfileRequestContext` of the proxied authentication state rather than the SAML `AuthnContext` directly.

Specified by:
  `getAuthnContextTranslationStrategyEx` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  translation function

### setAuthnContextTranslationStrategyEx

public void setAuthnContextTranslationStrategyEx(@Nullable Function<ProfileRequestContext,Collection<Principal>> strategy)
Set the function to use to translate an inbound proxied response into the appropriate set of custom `Principal` objects to populate into the subject.

This differs from the original in that the input is the entire `ProfileRequestContext` of the proxied authentication state rather than the SAML `AuthnContext` directly.

Parameters:
  `strategy` - translation function
Since:
  4.1.0

### setAuthnContextTranslationStrategyExLookupStrategy

public void setAuthnContextTranslationStrategyExLookupStrategy(@Nonnull Function<ProfileRequestContext,Function<ProfileRequestContext,Collection<Principal>>> strategy)
Set a lookup strategy for the function to use to translate an inbound proxied response into the appropriate set of custom `Principal` objects to populate into the subject.

This differs from the original in that the input is the entire `ProfileRequestContext` of the proxied authentication state rather than the SAML `AuthnContext` directly.

Parameters:
  `strategy` - lookup strategy
Since:
  4.1.0

### getAuthnContextComparison

@Nullable public AuthnContextComparisonTypeEnumeration getAuthnContextComparison(@Nullable ProfileRequestContext profileRequestContext)

Specified by:
  `getAuthnContextComparison` in interface `BrowserSSOProfileConfiguration`

### setAuthnContextComparison

public void setAuthnContextComparison(@Nullable AuthnContextComparisonTypeEnumeration comparison)
Set the comparison operator to use when issuing SAML requests containing requested context classes.

Parameters:
  `comparison` - comparison value or null
Since:
  4.0.0

### setAuthnContextComparisonLookupStrategy

public void setAuthnContextComparisonLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
Set a lookup strategy for the comparison operator to use when issuing SAML requests containing requested context classes.

Parameters:
  `strategy` - lookup strategy
Since:
  4.0.0

### getDefaultAuthenticationMethods

@Nonnull @NotLive @Unmodifiable public List<Principal> getDefaultAuthenticationMethods(@Nullable ProfileRequestContext profileRequestContext)
Get the default authentication methods to use, expressed as custom principals.

Specified by:
  `getDefaultAuthenticationMethods` in interface `AuthenticationProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  default authentication methods to use

### setDefaultAuthenticationMethods

public void setDefaultAuthenticationMethods(@Nullable Collection<Principal> contexts)
Set the default authentication contexts to use, expressed as custom principals.

Parameters:
  `contexts` - default authentication contexts to use

### setDefaultAuthenticationMethodsLookupStrategy

public void setDefaultAuthenticationMethodsLookupStrategy(@Nonnull Function<ProfileRequestContext,Collection<Principal>> strategy)
Set a lookup strategy for the authentication contexts to use, expressed as custom principals.

Parameters:
  `strategy` - lookup strategy
Since:
  3.3.0

### getAuthenticationFlows

@Deprecated(since="5.2.0", forRemoval=true) @Nonnull @NotLive @Unmodifiable public Set<String> getAuthenticationFlows(@Nullable ProfileRequestContext profileRequestContext)
Deprecated, for removal: This API element is subject to removal in a future version.
Get the allowable authentication flows for this profile.

The flow IDs returned MUST NOT contain the `AuthenticationFlowDescriptor.FLOW_ID_PREFIX` prefix common to all interceptor flows.

Specified by:
  `getAuthenticationFlows` in interface `AuthenticationProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  a set of authentication flow IDs to allow

### setAuthenticationFlows

@Deprecated(since="5.2.0", forRemoval=true) public void setAuthenticationFlows(@Nullable Collection<String> flows)
Deprecated, for removal: This API element is subject to removal in a future version.
Set the authentication flows to use.

Parameters:
  `flows` - flow identifiers to use

### setAuthenticationFlowsLookupStrategy

@Deprecated(since="5.2.0", forRemoval=true) public void setAuthenticationFlowsLookupStrategy(@Nonnull Function<ProfileRequestContext,Set<String>> strategy)
Deprecated, for removal: This API element is subject to removal in a future version.
Set a lookup strategy for the authentication flows to use.

Parameters:
  `strategy` - lookup strategy
Since:
  3.3.0

### getPostAuthenticationFlows

@Nonnull @NotLive @Unmodifiable public List<String> getPostAuthenticationFlows(@Nullable ProfileRequestContext profileRequestContext)
Get an ordered list of post-authentication interceptor flows to run for this profile.

The flow IDs returned MUST NOT contain the `ProfileInterceptorFlowDescriptor.FLOW_ID_PREFIX` prefix common to all interceptor flows.

Specified by:
  `getPostAuthenticationFlows` in interface `AuthenticationProfileConfiguration`
Parameters:
  `profileRequestContext` - current profile request context
Returns:
  a set of interceptor flow IDs to enable

### setPostAuthenticationFlows

public void setPostAuthenticationFlows(@Nullable Collection<String> flows)
Set the ordered collection of post-authentication interceptor flows to enable.

Parameters:
  `flows` - flow identifiers to enable

### setPostAuthenticationFlowsLookupStrategy

public void setPostAuthenticationFlowsLookupStrategy(@Nonnull Function<ProfileRequestContext,Collection<String>> strategy)
Set a lookup strategy for the post-authentication interceptor flows to enable.

Parameters:
  `strategy` - lookup strategy
Since:
  3.3.0

### getNameIDFormatPrecedence

@Nonnull @NotLive @Unmodifiable public List<String> getNameIDFormatPrecedence(@Nullable ProfileRequestContext profileRequestContext)
Get the name identifier formats to use.

Specified by:
  `getNameIDFormatPrecedence` in interface `BrowserSSOProfileConfiguration`
Parameters:
  `profileRequestContext` - profile request context
Returns:
  the formats to use

### setNameIDFormatPrecedence

public void setNameIDFormatPrecedence(@Nullable Collection<String> formats)
Set the name identifier formats to use.

Parameters:
  `formats` - name identifier formats to use

### setNameIDFormatPrecedenceLookupStrategy

public void setNameIDFormatPrecedenceLookupStrategy(@Nonnull Function<ProfileRequestContext,Collection<String>> strategy)
Set a lookup strategy for the name identifier formats to use.

Parameters:
  `strategy` - lookup strategy
Since:
  3.3.0

### getSPNameQualifier

@Nullable public String getSPNameQualifier(@Nullable ProfileRequestContext profileRequestContext)

Specified by:
  `getSPNameQualifier` in interface `BrowserSSOProfileConfiguration`

### setSPNameQualifier

public void setSPNameQualifier(@Nullable String qualifier)
Sets the SPNameQualifier to include in requests.

Parameters:
  `qualifier` - the SPNameQualifier to include
Since:
  5.0.0

### setSPNameQualifierLookupStrategy

public void setSPNameQualifierLookupStrategy(@Nonnull Function<ProfileRequestContext,String> strategy)
Sets a lookup strategy for the SPNameQualifier to include in requests.

Parameters:
  `strategy` - lookup strategy
Since:
  5.0.0

### getAttributeIndex

@Nullable public Integer getAttributeIndex(@Nullable ProfileRequestContext profileRequestContext)

Specified by:
  `getAttributeIndex` in interface `BrowserSSOProfileConfiguration`

### setAttributeIndex

public void setAttributeIndex(@Nullable Integer index)
Sets the AttributeConsumingServiceIndex to include in requests.

Parameters:
  `index` - the index to include
Since:
  5.0.0

### setAttributeIndexLookupStrategy

public void setAttributeIndexLookupStrategy(@Nonnull Function<ProfileRequestContext,Integer> strategy)
Sets a lookup strategy for the AttributeConsumingServiceIndex to include in requests.

Parameters:
  `strategy` - lookup strategy
Since:
  5.0.0

### getRequestedAttributes

@Nonnull @NotLive @Unmodifiable public Collection<RequestedAttribute> getRequestedAttributes(@Nullable ProfileRequestContext profileRequestContext)

Specified by:
  `getRequestedAttributes` in interface `BrowserSSOProfileConfiguration`

### setRequestedAttributes

public void setRequestedAttributes(@Nullable Collection<RequestedAttribute> attrs)
Set the `RequestedAttribute` objects to include in request.

Parameters:
  `attrs` - requested attributes to include
Since:
  5.0.0

### setRequestedAttributesLookupStrategy

public void setRequestedAttributesLookupStrategy(@Nonnull Function<ProfileRequestContext,Collection<RequestedAttribute>> strategy)
Set a lookup strategy for the name identifier formats to use.

Parameters:
  `strategy` - lookup strategy
Since:
  5.0.0