Package net.shibboleth.idp.authn.impl

# Class RemoteUserAuthServlet

java.lang.Object
jakarta.servlet.GenericServlet
jakarta.servlet.http.HttpServlet
net.shibboleth.idp.authn.impl.RemoteUserAuthServlet

All Implemented Interfaces:
  `Servlet`, `ServletConfig`, `Serializable`

public class RemoteUserAuthServlet extends HttpServlet
Extracts authentication information from the request and returns it via the IdP's external authentication interface.

Common usage allows for extraction of REMOTE_USER or a username from request attributes or headers.

More advanced features include the ability to directly consume a `Subject` from a request attribute (in which case it is returned sight unseen directly to the IdP as the external result) and the ability to check a header for strings containing authentication method identifiers which can be mapped back into custom `Principal` objects (in which case they are attached to a newly constructed `Subject` to return).

See Also:
  - Serialized Form

## Field Summary

Fields
Modifier and Type
Field
Description
`private static final String`
`AUTHN_AUTHORITY_HEADER_PARAM`
Init parameter identifying a header to check for one or more proxied authenticating authority strings.
`private static final String`
`AUTHN_METHOD_HEADER_PARAM`
Init parameter identifying a header to check for one or more authentication method strings.
`private String`
`authnAuthorityHeader`
Header to check for proxied authenticating authority strings.
`private String`
`authnMethodHeader`
Header to check for authentication method strings.
`private static final String`
`CHECK_ATTRIBUTES_PARAM`
Init parameter controlling what attributes to check.
`private static final String`
`CHECK_HEADERS_PARAM`
Init parameter controlling what headers to check.
`private static final String`
`CHECK_REMOTE_USER_PARAM`
Init parameter controlling whether to check for REMOTE_USER.
`private Collection<String>`
`checkAttributes`
List of request attributes to check for an identity.
`private Collection<String>`
`checkHeaders`
List of request headers to check for an identity.
`private boolean`
`checkRemoteUser`
Whether to check REMOTE_USER for an identity.
`private final org.slf4j.Logger`
`log`
Class logger.
`private static final long`
`serialVersionUID`
Serial UID.
`private static final String`
`SUBJECT_ATTRIBUTE_PARAM`
Init parameter identifying an attribute to check for a Subject.
`private String`
`subjectAttribute`
Request attribute to check for a `Subject`.

### Fields inherited from class jakarta.servlet.http.HttpServlet

`LEGACY_DO_HEAD`

## Constructor Summary

Constructors
Constructor
Description
`RemoteUserAuthServlet()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`AuthenticationFlowDescriptor`
`getAuthenticationFlowDescriptor(String key, HttpServletRequest httpRequest)`
Get the executing `AuthenticationFlowDescriptor`.
`Principal`
`getPrincipal(AuthenticationFlowDescriptor descriptor, String method)`
Locate a custom `Principal` matching a string, supported by the flow descriptor.
`void`
`init(ServletConfig config)`
`protected void`
`service(HttpServletRequest httpRequest, HttpServletResponse httpResponse)`
`void`
`setAuthnAuthorityHeader(String header)`
Set the name of a request header to check for authenticating authority strings.
`void`
`setAuthnMethodHeader(String header)`
Set the name of a request header to check for authentication method strings.
`void`
`setCheckAttributes(Collection<String> attributes)`
Set the list of request attributes to check for an identity.
`void`
`setCheckHeaders(Collection<String> headers)`
Set the list of request headers to check for an identity.
`void`
`setCheckRemoteUser(boolean flag)`
Set whether to check REMOTE_USER for an identity.
`void`
`setSubjectAttribute(String attribute)`
Set the name of a request attribute to check for a `Subject`.

### Methods inherited from class jakarta.servlet.http.HttpServlet

`doDelete, doGet, doHead, doOptions, doPatch, doPost, doPut, doTrace, getLastModified, isSensitiveHeader, service`

### Methods inherited from class jakarta.servlet.GenericServlet

`destroy, getInitParameter, getInitParameterNames, getServletConfig, getServletContext, getServletInfo, getServletName, init, log, log`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### serialVersionUID

private static final long serialVersionUID
Serial UID.

See Also:
  - Constant Field Values

### CHECK_REMOTE_USER_PARAM

@Nonnull @NotEmpty private static final String CHECK_REMOTE_USER_PARAM
Init parameter controlling whether to check for REMOTE_USER.

See Also:
  - Constant Field Values

### CHECK_ATTRIBUTES_PARAM

@Nonnull @NotEmpty private static final String CHECK_ATTRIBUTES_PARAM
Init parameter controlling what attributes to check.

See Also:
  - Constant Field Values

### CHECK_HEADERS_PARAM

@Nonnull @NotEmpty private static final String CHECK_HEADERS_PARAM
Init parameter controlling what headers to check.

See Also:
  - Constant Field Values

### SUBJECT_ATTRIBUTE_PARAM

@Nonnull @NotEmpty private static final String SUBJECT_ATTRIBUTE_PARAM
Init parameter identifying an attribute to check for a Subject.

See Also:
  - Constant Field Values

### AUTHN_METHOD_HEADER_PARAM

@Nonnull @NotEmpty private static final String AUTHN_METHOD_HEADER_PARAM
Init parameter identifying a header to check for one or more authentication method strings.

See Also:
  - Constant Field Values

### AUTHN_AUTHORITY_HEADER_PARAM

@Nonnull @NotEmpty private static final String AUTHN_AUTHORITY_HEADER_PARAM
Init parameter identifying a header to check for one or more proxied authenticating authority strings.

See Also:
  - Constant Field Values

### log

@Nonnull private final org.slf4j.Logger log
Class logger.

### checkRemoteUser

private boolean checkRemoteUser
Whether to check REMOTE_USER for an identity. Defaults to true.

### checkAttributes

@Nonnull private Collection<String> checkAttributes
List of request attributes to check for an identity.

### checkHeaders

@Nonnull private Collection<String> checkHeaders
List of request headers to check for an identity.

### subjectAttribute

@Nullable @NotEmpty private String subjectAttribute
Request attribute to check for a `Subject`.

### authnMethodHeader

@Nullable @NotEmpty private String authnMethodHeader
Header to check for authentication method strings.

### authnAuthorityHeader

@Nullable @NotEmpty private String authnAuthorityHeader
Header to check for proxied authenticating authority strings.

## Constructor Details

### RemoteUserAuthServlet

public RemoteUserAuthServlet()
Constructor.

## Method Details

### setCheckRemoteUser

public void setCheckRemoteUser(boolean flag)
Set whether to check REMOTE_USER for an identity.

Parameters:
  `flag` - value to set

### setCheckAttributes

public void setCheckAttributes(@Nonnull Collection<String> attributes)
Set the list of request attributes to check for an identity.

Parameters:
  `attributes` - list of request attributes to check

### setCheckHeaders

public void setCheckHeaders(@Nonnull Collection<String> headers)
Set the list of request headers to check for an identity.

Parameters:
  `headers` - list of request headers to check

### setSubjectAttribute

public void setSubjectAttribute(@Nullable @NotEmpty String attribute)
Set the name of a request attribute to check for a `Subject`.

Parameters:
  `attribute` - request attribute name

### setAuthnMethodHeader

public void setAuthnMethodHeader(@Nullable @NotEmpty String header)
Set the name of a request header to check for authentication method strings.

Parameters:
  `header` - request header name

### setAuthnAuthorityHeader

public void setAuthnAuthorityHeader(@Nullable @NotEmpty String header)
Set the name of a request header to check for authenticating authority strings.

Parameters:
  `header` - request header name
Since:
  3.4.0

### init

public void init(ServletConfig config) throws ServletException

Specified by:
  `init` in interface `Servlet`
Overrides:
  `init` in class `HttpServlet`
Throws:
  `ServletException`

### service

protected void service(HttpServletRequest httpRequest, HttpServletResponse httpResponse) throws ServletException, IOException

Overrides:
  `service` in class `HttpServlet`
Throws:
  `ServletException`
  `IOException`

### getAuthenticationFlowDescriptor

@Nullable public AuthenticationFlowDescriptor getAuthenticationFlowDescriptor(@Nonnull @NotEmpty String key, @Nonnull HttpServletRequest httpRequest) throws ExternalAuthenticationException
Get the executing `AuthenticationFlowDescriptor`.

Parameters:
  `key` - external authentication key
  `httpRequest` - servlet request
Returns:
  active descriptor, or null
Throws:
  `ExternalAuthenticationException` - if unable to access the profile context

### getPrincipal

@Nullable public Principal getPrincipal(@Nonnull AuthenticationFlowDescriptor descriptor, @Nonnull @NotEmpty String method)
Locate a custom `Principal` matching a string, supported by the flow descriptor.

Parameters:
  `descriptor` - flow descriptor
  `method` - method string
Returns:
  a custom `Principal` or null