Package net.shibboleth.idp.authn

# Class AuthenticationFlowDescriptor

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.idp.authn.AuthenticationFlowDescriptor

All Implemented Interfaces:
  `Predicate<ProfileRequestContext>`, `PrincipalSupportingComponent`, `FlowDescriptor`, `Component`, `DestructableComponent`, `IdentifiableComponent`, `IdentifiedComponent`, `InitializableComponent`, `StorageSerializer<AuthenticationResult>`, `Ordered`

public class AuthenticationFlowDescriptor extends AbstractIdentifiableInitializableComponent implements FlowDescriptor, PrincipalSupportingComponent, Predicate<ProfileRequestContext>, StorageSerializer<AuthenticationResult>, Ordered
A descriptor for an authentication flow.

A flow models a sequence of profile actions that performs authentication in a particular way and satisfies various constraints that may apply to an authentication request. Some of these constraints are directly exposed as properties of the flow, and others can be found by examining the list of extended `Principal`s that the flow exposes.

## Nested Class Summary

Nested Classes
Modifier and Type
Class
Description
`private final class`
`AuthenticationFlowDescriptor.ProxyCountPredicate`
A `Predicate` that implements a cross-check between an effective proxy count of zero and whether a descriptor is honoring the limit.
`private final class`
`AuthenticationFlowDescriptor.WeightedComparator<T>`
A `Comparator` that compares the mapped weights of the two operands, using a weight of zero for any unmapped values.

## Field Summary

Fields
Modifier and Type
Field
Description
`private Predicate<ProfileRequestContext>`
`activationCondition`
Predicate that must be true for this flow to be usable for a given request.
`private boolean`
`discoveryRequired`
Whether this flow should invoke discovery if no authenticating authority populated.
`static final String`
`FLOW_ID_PREFIX`
Prefix convention for flow IDs.
`private String`
`flowId`
Optional flow ID that may differ from component ID.
`private Duration`
`inactivityTimeout`
Maximum amount of time since last usage that a flow should be considered active.
`private Duration`
`lifetime`
Maximum amount of time since first usage that a flow should be considered active.
`private int`
`order`
Spring auto-wiring order.
`private PrincipalServiceManager`
`principalServiceManager`
Access to principal services.
`private Map<Principal,Integer>`
`principalWeightMap`
Weighted sort oredering of custom Principals produced by flow(s).
`private boolean`
`proxyRestrictionsEnforced`
Whether this flow should honor proxy restrictions toward RPs.
`private boolean`
`proxyScopingEnforced`
Whether this flow should honor proxy scoping restrictions toward IdPs.
`private Function<ProfileRequestContext,Duration>`
`resultLifetimeLookupStrategy`
Lookup strategy for per-result lifetime.
`private StorageSerializer<AuthenticationResult>`
`resultSerializer`
Custom serializer for the results generated by this flow.
`private Function<ProfileRequestContext,Duration>`
`resultTimeoutLookupStrategy`
Lookup strategy for per-result timeout.
`private Predicate<ProfileRequestContext>`
`reuseCondition`
Whether this flow allows reuse of its results.
`private BiPredicate<ProfileRequestContext,AuthenticationResult>`
`revocationCondition`
Whether a result from this flow should be considered revoked.
`static final Duration`
`STORAGE_EXPIRATION_OFFSET`
Additional allowance for storage of result records to avoid race conditions during use.
`private Set<String>`
`stringBasedPrincipals`
Supported principals provided by delimited strings, for post-initialization override via `PrincipalServiceManager`.
`private BiConsumer<ProfileRequestContext,Subject>`
`subjectDecorator`
Customizes subject prior to triggering subject canonicalization.
`private Subject`
`supportedPrincipals`
Supported principals, indexed by type, that the flow can produce.
`private boolean`
`supportsForced`
Whether this flow supports forced authentication.
`private boolean`
`supportsNonBrowser`
Whether this flow supports non-browser clients.
`private boolean`
`supportsPassive`
Whether this flow supports passive authentication.

### Fields inherited from interface org.springframework.core.Ordered

`HIGHEST_PRECEDENCE, LOWEST_PRECEDENCE`

## Constructor Summary

Constructors
Constructor
Description
`AuthenticationFlowDescriptor()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`AuthenticationResult`
`deserialize(long version, String context, String key, String value, Long expiration)`
`protected void`
`doInitialize()`
`boolean`
`equals(Object obj)`
`String`
`getFlowId()`
Gets the webflow ID for this descriptor (inclusive of the authn/ prefix).
`<T extends Principal>
T`
`getHighestWeighted(Collection<T> principals)`
Apply the current weighted map to find the highest-weighted object amongst the inputs.
`Duration`
`getInactivityTimeout()`
Get the maximum amount of time, since the last usage, a flow result should be considered active, if not overridden.
`Duration`
`getLifetime()`
Get the maximum amount of time, since first usage, a flow result should be considered active, if not overridden.
`int`
`getOrder()`
`Function<ProfileRequestContext,Duration>`
`getResultLifetimeLookupStrategy()`
Get the lookup strategy to compute a per-result lifetime to apply to a given result.
`Function<ProfileRequestContext,Duration>`
`getResultTimeoutLookupStrategy()`
Get the lookup strategy to compute a per-result timeout to apply to a given result.
`Predicate<ProfileRequestContext>`
`getReuseCondition()`
Get condition controlling whether results from this flow should be reused for SSO.
`BiPredicate<ProfileRequestContext,AuthenticationResult>`
`getRevocationCondition()`
Get condition controlling whether a result from this flow should be considered revoked.
`BiConsumer<ProfileRequestContext,Subject>`
`getSubjectDecorator()`
Gets a subject decorating component called prior to completing authentication and passing control to subject canonicalization.
`Collection<Principal>`
`getSupportedPrincipals()`
Get a collection of supported non-user-specific principals that the flow may produce when it operates.
`<T extends Principal>
Set<T>`
`getSupportedPrincipals(Class<T> c)`
Get an immutable set of supported custom principals that the component produces, supports, contains, etc.
`int`
`hashCode()`
`boolean`
`isDiscoveryRequired()`
Gets whether to invoke discovery subflow if `AuthenticationContext.getAuthenticatingAuthority()` is null.
`boolean`
`isForcedAuthenticationSupported()`
Get whether this flow supports forced authentication.
`boolean`
`isNonBrowserSupported()`
Get whether this flow supports non-browser clients.
`boolean`
`isPassiveAuthenticationSupported()`
Get whether this flow supports passive authentication.
`boolean`
`isProxyRestrictionsEnforced()`
Gets whether this flow's results should honor restrictions on proxying toward RPs.
`boolean`
`isProxyScopingEnforced()`
Gets whether this flow's results should honor restrictions on proxying toward IdPs.
`boolean`
`isResultActive(AuthenticationResult result)`
Check if a result generated by this flow is still active.
`AuthenticationResult`
`newAuthenticationResult(Subject subject)`
Creates a new instance of a compatible `AuthenticationResult` for use with the corresponding flow.
`String`
`serialize(AuthenticationResult instance)`
`void`
`setActivationCondition(Predicate<ProfileRequestContext> condition)`
Set the activation condition in the form of a `Predicate` such that iff the condition evaluates to true should the corresponding flow be allowed/possible.
`void`
`setDiscoveryRequired(boolean flag)`
Sets whether to invoke discovery subflow if `AuthenticationContext.getAuthenticatingAuthority()` is null.
`void`
`setFlowId(String id)`
Sets the webflow ID for this descriptor.
`void`
`setForcedAuthenticationSupported(boolean isSupported)`
Set whether this flow supports forced authentication.
`void`
`setInactivityTimeout(Duration timeout)`
Set the maximum amount of time, since the last usage, a flow result should be considered active, if not overridden.
`void`
`setLifetime(Duration flowLifetime)`
Set the maximum amount of time, since first usage, a flow result should be considered active, if not overridden.
`void`
`setNonBrowserSupported(boolean isSupported)`
Set whether this flow supports non-browser clients.
`void`
`setOrder(int priority)`
Set the order/priority value for the bean.
`void`
`setPassiveAuthenticationSupported(boolean isSupported)`
Set whether this flow supports passive authentication.
`void`
`setPrincipalServiceManager(PrincipalServiceManager manager)`
Sets a `PrincipalServiceManager` to use for string-based principal processing.
`void`
`setPrincipalWeightMap(Map<Principal,Integer> map)`
Set the map of Principals to weight values to impose a sort order on any matching Principals found in the authentication result.
`void`
`setProxyRestrictionsEnforced(boolean flag)`
Sets whether this flow's results should honor restrictions on proxying toward RPs
`void`
`setProxyScopingEnforced(boolean flag)`
Sets whether this flow's results should honor restrictions on proxying toward IdPs.
`void`
`setResultLifetimeLookupStrategy(Function<ProfileRequestContext,Duration> strategy)`
Set the lookup strategy to compute a per-result lifetime to apply to a given result.
`void`
`setResultSerializer(StorageSerializer<AuthenticationResult> serializer)`
Set a custom serializer for results produced by this flow.
`void`
`setResultTimeoutLookupStrategy(Function<ProfileRequestContext,Duration> strategy)`
Set the lookup strategy to compute a per-result timeout to apply to a given result.
`void`
`setReuseCondition(Predicate<ProfileRequestContext> condition)`
Set condition controlling whether results from this flow should be reused for SSO.
`void`
`setRevocationCondition(BiPredicate<ProfileRequestContext,AuthenticationResult> condition)`
Set condition controlling whether a result from this flow should be considered revoked.
`void`
`setSubjectDecorator(BiConsumer<ProfileRequestContext,Subject> decorator)`
Sets a subject decorating component called prior to completing authentication and passing control to subject canonicalization.
`void`
`setSupportedPrincipals(Collection<Principal> principals)`
Set supported non-user-specific principals that the flow may produce when it operates.
`void`
`setSupportedPrincipalsByString(Collection<String> principals)`
Set supported non-user-specific principals that the flow may produce when it operates.
`boolean`
`test(ProfileRequestContext input)`
`String`
`toString()`

### Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

`setId`

### Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

`ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException`

### Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

`checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized`

### Methods inherited from class java.lang.Object

`clone, finalize, getClass, notify, notifyAll, wait, wait, wait`

### Methods inherited from interface net.shibboleth.shared.component.DestructableComponent

`destroy, isDestroyed`

### Methods inherited from interface net.shibboleth.shared.component.IdentifiableComponent

`setId`

### Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

`getId`

### Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

`initialize, isInitialized`

### Methods inherited from interface java.util.function.Predicate

`and, negate, or`

## Field Details

### FLOW_ID_PREFIX

@Nonnull @NotEmpty public static final String FLOW_ID_PREFIX
Prefix convention for flow IDs.

See Also:
  - Constant Field Values

### STORAGE_EXPIRATION_OFFSET

@Nonnull public static final Duration STORAGE_EXPIRATION_OFFSET
Additional allowance for storage of result records to avoid race conditions during use.

### flowId

@NonnullAfterInit private String flowId
Optional flow ID that may differ from component ID.

### order

private int order
Spring auto-wiring order.

### supportsNonBrowser

private boolean supportsNonBrowser
Whether this flow supports non-browser clients.

### supportsPassive

private boolean supportsPassive
Whether this flow supports passive authentication.

### supportsForced

private boolean supportsForced
Whether this flow supports forced authentication.

### proxyRestrictionsEnforced

private boolean proxyRestrictionsEnforced
Whether this flow should honor proxy restrictions toward RPs.

### proxyScopingEnforced

private boolean proxyScopingEnforced
Whether this flow should honor proxy scoping restrictions toward IdPs.

### discoveryRequired

private boolean discoveryRequired
Whether this flow should invoke discovery if no authenticating authority populated.

### reuseCondition

@Nonnull private Predicate<ProfileRequestContext> reuseCondition
Whether this flow allows reuse of its results.

### revocationCondition

@Nullable private BiPredicate<ProfileRequestContext,AuthenticationResult> revocationCondition
Whether a result from this flow should be considered revoked.

### lifetime

@Nullable private Duration lifetime
Maximum amount of time since first usage that a flow should be considered active.

### inactivityTimeout

@Nonnull private Duration inactivityTimeout
Maximum amount of time since last usage that a flow should be considered active.

### resultLifetimeLookupStrategy

@Nonnull private Function<ProfileRequestContext,Duration> resultLifetimeLookupStrategy
Lookup strategy for per-result lifetime.

### resultTimeoutLookupStrategy

@Nonnull private Function<ProfileRequestContext,Duration> resultTimeoutLookupStrategy
Lookup strategy for per-result timeout.

### stringBasedPrincipals

@Nonnull private Set<String> stringBasedPrincipals
Supported principals provided by delimited strings, for post-initialization override via `PrincipalServiceManager`.

### supportedPrincipals

@Nonnull private Subject supportedPrincipals
Supported principals, indexed by type, that the flow can produce. Implemented for the moment using the Subject class for convenience to allow for class-based lookup in the `getSupportedPrincipals(java.lang.Class<T>)` method.

### activationCondition

@Nonnull private Predicate<ProfileRequestContext> activationCondition
Predicate that must be true for this flow to be usable for a given request.

### resultSerializer

@Nullable private StorageSerializer<AuthenticationResult> resultSerializer
Custom serializer for the results generated by this flow.

### principalWeightMap

@Nonnull private Map<Principal,Integer> principalWeightMap
Weighted sort oredering of custom Principals produced by flow(s).

### principalServiceManager

@Nullable private PrincipalServiceManager principalServiceManager
Access to principal services.

### subjectDecorator

@Nullable private BiConsumer<ProfileRequestContext,Subject> subjectDecorator
Customizes subject prior to triggering subject canonicalization.

## Constructor Details

### AuthenticationFlowDescriptor

public AuthenticationFlowDescriptor()
Constructor.

## Method Details

### getFlowId

@NonnullAfterInit public String getFlowId()
Gets the webflow ID for this descriptor (inclusive of the authn/ prefix).

Returns:
  webflow ID
Since:
  5.2.0

### setFlowId

public void setFlowId(@Nullable String id)
Sets the webflow ID for this descriptor.

This defaults to the component ID, but can be overridden to allow multiple components to be defined for a given webflow.

Parameters:
  `id` - webflow ID
Since:
  5.2.0

### getOrder

public int getOrder()

Specified by:
  `getOrder` in interface `Ordered`

### setOrder

public void setOrder(int priority)
Set the order/priority value for the bean.

Parameters:
  `priority` - priority value

### isNonBrowserSupported

public boolean isNonBrowserSupported()
Get whether this flow supports non-browser clients.

Returns:
  whether this flow supports non-browser clients

### setNonBrowserSupported

public void setNonBrowserSupported(boolean isSupported)
Set whether this flow supports non-browser clients.

Parameters:
  `isSupported` - whether this flow supports non-browser clients

### isPassiveAuthenticationSupported

public boolean isPassiveAuthenticationSupported()
Get whether this flow supports passive authentication.

Returns:
  whether this flow supports passive authentication

### setPassiveAuthenticationSupported

public void setPassiveAuthenticationSupported(boolean isSupported)
Set whether this flow supports passive authentication.

Parameters:
  `isSupported` - whether this flow supports passive authentication

### isForcedAuthenticationSupported

public boolean isForcedAuthenticationSupported()
Get whether this flow supports forced authentication.

Returns:
  whether this flow supports forced authentication

### setForcedAuthenticationSupported

public void setForcedAuthenticationSupported(boolean isSupported)
Set whether this flow supports forced authentication.

Parameters:
  `isSupported` - whether this flow supports forced authentication.

### isProxyRestrictionsEnforced

public boolean isProxyRestrictionsEnforced()
Gets whether this flow's results should honor restrictions on proxying toward RPs.

Returns:
  true iff proxying restrictions issued by IdPs should be honored
Since:
  4.0.0

### setProxyRestrictionsEnforced

public void setProxyRestrictionsEnforced(boolean flag)
Sets whether this flow's results should honor restrictions on proxying toward RPs

Defaults to true.

Parameters:
  `flag` - flag to set
Since:
  4.0.0

### isProxyScopingEnforced

public boolean isProxyScopingEnforced()
Gets whether this flow's results should honor restrictions on proxying toward IdPs.

Returns:
  true iff proxying restrictions issued by RPs should be honored
Since:
  4.0.0

### setProxyScopingEnforced

public void setProxyScopingEnforced(boolean flag)
Sets whether this flow's results should honor restrictions on proxying toward IdPs.

Defaults to false. Should be enabled for flows that represent proxied authentication.

Parameters:
  `flag` - flag to set
Since:
  4.0.0

### isDiscoveryRequired

public boolean isDiscoveryRequired()
Gets whether to invoke discovery subflow if `AuthenticationContext.getAuthenticatingAuthority()` is null.

Returns:
  whether to invoke discovery
Since:
  4.0.0

### setDiscoveryRequired

public void setDiscoveryRequired(boolean flag)
Sets whether to invoke discovery subflow if `AuthenticationContext.getAuthenticatingAuthority()` is null.

Defaults to false.

Parameters:
  `flag` - flag to set
Since:
  4.0.0

### getReuseCondition

@Nonnull public Predicate<ProfileRequestContext> getReuseCondition()
Get condition controlling whether results from this flow should be reused for SSO.

Returns:
  condition
Since:
  4.0.1

### setReuseCondition

public void setReuseCondition(@Nonnull Predicate<ProfileRequestContext> condition)
Set condition controlling whether results from this flow should be reused for SSO.

Defaults to a built-in condition that applies SP-imposed proxying rules on hop count when the flow is configured to enforce this.

Parameters:
  `condition` - condition to set
Since:
  3.4.0

### getRevocationCondition

@Nullable public BiPredicate<ProfileRequestContext,AuthenticationResult> getRevocationCondition()
Get condition controlling whether a result from this flow should be considered revoked.

Returns:
  condition
Since:
  4.3.0

### setRevocationCondition

public void setRevocationCondition(@Nullable BiPredicate<ProfileRequestContext,AuthenticationResult> condition)
Set condition controlling whether a result from this flow should be considered revoked.

Parameters:
  `condition` - condition to set
Since:
  4.3.0

### getSubjectDecorator

@Nullable public BiConsumer<ProfileRequestContext,Subject> getSubjectDecorator()
Gets a subject decorating component called prior to completing authentication and passing control to subject canonicalization.

Returns:
  subject decorator
Since:
  4.1.0

### setSubjectDecorator

public void setSubjectDecorator(@Nullable BiConsumer<ProfileRequestContext,Subject> decorator)
Sets a subject decorating component called prior to completing authentication and passing control to subject canonicalization.

Parameters:
  `decorator` - the decorator to set
Since:
  4.1.0

### getLifetime

@Nullable public Duration getLifetime()
Get the maximum amount of time, since first usage, a flow result should be considered active, if not overridden.

A null indicates that there is no upper limit on the lifetime.

Returns:
  maximum amount of time a flow should be considered active

### setLifetime

public void setLifetime(@Nullable Duration flowLifetime)
Set the maximum amount of time, since first usage, a flow result should be considered active, if not overridden.

A null value indicates that there is no upper limit on the lifetime.

Parameters:
  `flowLifetime` - the lifetime for the flow

### getInactivityTimeout

@Nonnull public Duration getInactivityTimeout()
Get the maximum amount of time, since the last usage, a flow result should be considered active, if not overridden.

Defaults to 30 minutes.

Returns:
  the duration

### setInactivityTimeout

public void setInactivityTimeout(@Nonnull Duration timeout)
Set the maximum amount of time, since the last usage, a flow result should be considered active, if not overridden.

Parameters:
  `timeout` - the flow inactivity timeout, must be greater than zero

### getResultLifetimeLookupStrategy

@Nonnull public Function<ProfileRequestContext,Duration> getResultLifetimeLookupStrategy()
Get the lookup strategy to compute a per-result lifetime to apply to a given result.

Returns:
  lookup strategy
Since:
  5.2.0

### setResultLifetimeLookupStrategy

public void setResultLifetimeLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
Set the lookup strategy to compute a per-result lifetime to apply to a given result.

Defaults to returning null, deferring to flow default.

Parameters:
  `strategy` - lookup strategy
Since:
  5.2.0

### getResultTimeoutLookupStrategy

@Nonnull public Function<ProfileRequestContext,Duration> getResultTimeoutLookupStrategy()
Get the lookup strategy to compute a per-result timeout to apply to a given result.

Returns:
  lookup strategy
Since:
  5.2.0

### setResultTimeoutLookupStrategy

public void setResultTimeoutLookupStrategy(@Nonnull Function<ProfileRequestContext,Duration> strategy)
Set the lookup strategy to compute a per-result timeout to apply to a given result.

Defaults to returning null, deferring to flow default.

Parameters:
  `strategy` - lookup strategy
Since:
  5.2.0

### isResultActive

public boolean isResultActive(@Nonnull AuthenticationResult result)
Check if a result generated by this flow is still active.

Parameters:
  `result` - `AuthenticationResult` to check
Returns:
  true iff the result remains valid

### getSupportedPrincipals

@Nonnull @Unmodifiable public <T extends Principal> Set<T> getSupportedPrincipals(@Nonnull Class<T> c)
Get an immutable set of supported custom principals that the component produces, supports, contains, etc.

Specified by:
  `getSupportedPrincipals` in interface `PrincipalSupportingComponent`
Type Parameters:
  `T` - type of Principal to inquire on
Parameters:
  `c` - type of Principal to inquire on
Returns:
  a set of matching principals

### getSupportedPrincipals

@Nonnull public Collection<Principal> getSupportedPrincipals()
Get a collection of supported non-user-specific principals that the flow may produce when it operates.

The `Collection.remove(java.lang.Object)` method is not supported.

Returns:
  a live collection of supported principals

### setSupportedPrincipals

public void setSupportedPrincipals(@Nonnull Collection<Principal> principals)
Set supported non-user-specific principals that the flow may produce when it operates.

Parameters:
  `principals` - supported principals to add

### setSupportedPrincipalsByString

public void setSupportedPrincipalsByString(@Nonnull Collection<String> principals)
Set supported non-user-specific principals that the flow may produce when it operates.

The principals must be prefixed by the ID of the relevant `PrincipalService` followed by a '/'.

Setting an empty list will leave any existing set unchanged. This is primarily provided to allow property-based override of an XML-based collection established with the previous method.

Parameters:
  `principals` - supported principals to add
Since:
  4.1.0

### setActivationCondition

public void setActivationCondition(@Nonnull Predicate<ProfileRequestContext> condition)
Set the activation condition in the form of a `Predicate` such that iff the condition evaluates to true should the corresponding flow be allowed/possible.

Parameters:
  `condition` - predicate that controls activation of the flow

### test

public boolean test(@Nullable ProfileRequestContext input)

Specified by:
  `test` in interface `Predicate<ProfileRequestContext>`

### setResultSerializer

public void setResultSerializer(@Nonnull StorageSerializer<AuthenticationResult> serializer)
Set a custom serializer for results produced by this flow.

Parameters:
  `serializer` - the custom serializer

### setPrincipalWeightMap

public void setPrincipalWeightMap(@Nullable Map<Principal,Integer> map)
Set the map of Principals to weight values to impose a sort order on any matching Principals found in the authentication result.

This was moved from a stand-alone bean into the descriptor beans in order to eliminate stand-alone beans from the flow descriptor configuration files(s).

Parameters:
  `map` - map to set
Since:
  4.0.0

### setPrincipalServiceManager

public void setPrincipalServiceManager(@Nullable PrincipalServiceManager manager)
Sets a `PrincipalServiceManager` to use for string-based principal processing.

Parameters:
  `manager` - manager to set
Since:
  4.0.1

### doInitialize

protected void doInitialize() throws ComponentInitializationException

Overrides:
  `doInitialize` in class `AbstractIdentifiedInitializableComponent`
Throws:
  `ComponentInitializationException`

### newAuthenticationResult

@Nonnull public AuthenticationResult newAuthenticationResult(@Nonnull Subject subject)
Creates a new instance of a compatible `AuthenticationResult` for use with the corresponding flow.

Parameters:
  `subject` - the subject for the result
Returns:
  the new result

### serialize

@Nonnull @NotEmpty public String serialize(@Nonnull AuthenticationResult instance) throws IOException

Specified by:
  `serialize` in interface `StorageSerializer<AuthenticationResult>`
Throws:
  `IOException`

### deserialize

@Nonnull public AuthenticationResult deserialize(long version, @Nonnull @NotEmpty String context, @Nonnull @NotEmpty String key, @Nonnull @NotEmpty String value, @Nullable Long expiration) throws IOException

Specified by:
  `deserialize` in interface `StorageSerializer<AuthenticationResult>`
Throws:
  `IOException`

### getHighestWeighted

@Nullable public <T extends Principal> T getHighestWeighted(@Nonnull Collection<T> principals)
Apply the current weighted map to find the highest-weighted object amongst the inputs.

Type Parameters:
  `T` - principal type
Parameters:
  `principals` - input collection
Returns:
  the highest weighted as governed by the map set via `setPrincipalWeightMap(Map)`
Since:
  4.0.0

### hashCode

public int hashCode()

Overrides:
  `hashCode` in class `Object`

### equals

public boolean equals(Object obj)

Overrides:
  `equals` in class `Object`

### toString

public String toString()

Overrides:
  `toString` in class `Object`