Package net.shibboleth.idp.saml.profile.impl

# Class ExtractSubjectFromRequest

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.saml.profile.impl.ExtractSubjectFromRequest

All Implemented Interfaces:
  `Component`, `DestructableComponent`, `InitializableComponent`, `ProfileAction`, `Aware`, `MessageSource`, `MessageSourceAware`, `Action`

public class ExtractSubjectFromRequest extends AbstractProfileAction
Action that extracts a SAML Subject from an inbound message, and prepares a `SubjectCanonicalizationContext` to process it into a principal identity.

If the inbound message does not supply a `NameIdentifier` or `NameID` to process, then nothing is done, and the local event ID `NO_SUBJECT` is signaled.

A policy predicate may also be executed to control the conditions under which a subject name may be used by a requester, possibly resulting in a `AuthnEventIds.INVALID_SUBJECT` event.

Otherwise, a custom `Principal` of the appropriate type is wrapped around the identifier object and a Java `Subject` is prepared for canonicalization.

Event:
  `EventIds.PROCEED_EVENT_ID`, `AuthnEventIds.INVALID_SUBJECT`, `NO_SUBJECT`
Postcondition:
  If "proceed" signaled, then ProfileRequestContext.getSubcontext(SubjectCanonicalizationContext.class) != null

## Nested Class Summary

Nested Classes
Modifier and Type
Class
Description
`static class`
`ExtractSubjectFromRequest.SubjectNameLookupFunction`
Lookup function that returns the `NameIdentifier` or `NameID` from the request in the inbound message context.

## Field Summary

Fields
Modifier and Type
Field
Description
`private final org.slf4j.Logger`
`log`
Class logger.
`private SAMLObject`
`nameIdentifier`
SAML 1 or 2 identifier object to wrap for c14n.
`private Predicate<ProfileRequestContext>`
`nameIDPolicyPredicate`
Predicate to validate use of `NameID` or `NameIdentifier` in subject.
`static final String`
`NO_SUBJECT`
Local event signaling that canonicalization is unnecessary.
`private Function<ProfileRequestContext,String>`
`requesterLookupStrategy`
Function used to obtain the requester ID.
`private Function<ProfileRequestContext,String>`
`responderLookupStrategy`
Function used to obtain the responder ID.

## Constructor Summary

Constructors
Constructor
Description
`ExtractSubjectFromRequest()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`protected void`
`doExecute(ProfileRequestContext profileRequestContext)`
`protected boolean`
`doPreExecute(ProfileRequestContext profileRequestContext)`
`void`
`setNameIDPolicyPredicate(Predicate<ProfileRequestContext> predicate)`
Set a predicate used to validate use of the `NameID` or `NameIdentifier` in the subject.
`void`
`setRequesterLookupStrategy(Function<ProfileRequestContext,String> strategy)`
Set the strategy used to locate the requester ID for canonicalization.
`void`
`setResponderLookupStrategy(Function<ProfileRequestContext,String> strategy)`
Set the strategy used to locate the responder ID for canonicalization.

### Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

`doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy`

### Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

`getActivationCondition, setActivationCondition`

### Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

`doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier`

### Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

`checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

`initialize, isInitialized`

## Field Details

### NO_SUBJECT

@Nonnull @NotEmpty public static final String NO_SUBJECT
Local event signaling that canonicalization is unnecessary.

See Also:
  - Constant Field Values

### log

@Nonnull private final org.slf4j.Logger log
Class logger.

### nameIDPolicyPredicate

@Nullable private Predicate<ProfileRequestContext> nameIDPolicyPredicate
Predicate to validate use of `NameID` or `NameIdentifier` in subject.

### requesterLookupStrategy

@Nullable private Function<ProfileRequestContext,String> requesterLookupStrategy
Function used to obtain the requester ID.

### responderLookupStrategy

@Nullable private Function<ProfileRequestContext,String> responderLookupStrategy
Function used to obtain the responder ID.

### nameIdentifier

@NonnullBeforeExec private SAMLObject nameIdentifier
SAML 1 or 2 identifier object to wrap for c14n.

## Constructor Details

### ExtractSubjectFromRequest

public ExtractSubjectFromRequest() throws ComponentInitializationException
Constructor.

Throws:
  `ComponentInitializationException` - if unable to initialize default objects

## Method Details

### setRequesterLookupStrategy

public void setRequesterLookupStrategy(@Nullable Function<ProfileRequestContext,String> strategy)
Set the strategy used to locate the requester ID for canonicalization.

Parameters:
  `strategy` - lookup strategy

### setResponderLookupStrategy

public void setResponderLookupStrategy(@Nullable Function<ProfileRequestContext,String> strategy)
Set the strategy used to locate the responder ID for canonicalization.

Parameters:
  `strategy` - lookup strategy

### setNameIDPolicyPredicate

public void setNameIDPolicyPredicate(@Nullable Predicate<ProfileRequestContext> predicate)
Set a predicate used to validate use of the `NameID` or `NameIdentifier` in the subject.

Parameters:
  `predicate` - predicate to use

### doPreExecute

protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext)

Overrides:
  `doPreExecute` in class `AbstractConditionalProfileAction`

### doExecute

protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext)

Overrides:
  `doExecute` in class `AbstractProfileAction`