Package net.shibboleth.idp.saml.saml2.profile.impl

# Class ProcessAssertionsForAuthentication

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.saml.saml2.profile.impl.ProcessAssertionsForAuthentication

All Implemented Interfaces:
  `Component`, `DestructableComponent`, `InitializableComponent`, `ProfileAction`, `Aware`, `MessageSource`, `MessageSourceAware`, `Action`

public class ProcessAssertionsForAuthentication extends AbstractProfileAction
Perform processing of a SAML 2 Response's Assertions that have been validated by earlier actions for use in finalization of SAML-based authentication by later actions.

The result of this action is to strip any invalid assertions from the response, and to preserve the "best"/selected `AuthnStatement` and any other content required in a pluggable manner.

The default behavior is to store the statement and the related `Subject` in a `SAMLAuthnContext` located by a lookup strategy.

Event:
  `EventIds.PROCEED_EVENT_ID`, `EventIds.INVALID_MESSAGE`, `AuthnEventIds.INVALID_CREDENTIALS`
Postcondition:
  the selected statement is passed into the supplied `BiConsumer`

## Nested Class Summary

Nested Classes
Modifier and Type
Class
Description
`private final class`
`ProcessAssertionsForAuthentication.AssertionContainsAuthenticationStatement`
Predicate for assertions containing at least 1 AuthenticationStatement.
`private final class`
`ProcessAssertionsForAuthentication.AssertionContainsConfirmedSubject`
Predicate for assertions which have been validated and have a confirmed Subject.
`private final class`
`ProcessAssertionsForAuthentication.AssertionIsValid`
Predicate for valid assertions.
`private final class`
`ProcessAssertionsForAuthentication.DefaultResponseResolver`
The default response resolver function.
`private final class`
`ProcessAssertionsForAuthentication.DefaultSAMLConsumer`
Default implementation of a "sink" for the SAML objects preserved by this action.

## Field Summary

Fields
Modifier and Type
Field
Description
`private Function<List<Assertion>,Assertion>`
`authnAssertionSelectionStrategy`
Selection strategy for multiple valid authn Assertions.
`private Function<Assertion,AuthnStatement>`
`authnStatementSelectionStrategy`
Selection strategy for multiple AuthnStatements.
`private final org.slf4j.Logger`
`log`
Logger.
`private Response`
`response`
The Response to process.
`private Function<ProfileRequestContext,Response>`
`responseResolver`
The resolver for the response to be processed.
`private BiConsumer<ProfileRequestContext,AuthnStatement>`
`samlConsumer`
"Sink" for preserving SAML objects.
`private Function<ProfileRequestContext,SAMLAuthnContext>`
`samlContextLookupStrategy`
Lookup strategy to locate the SAML context.

## Constructor Summary

Constructors
Constructor
Description
`ProcessAssertionsForAuthentication()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`protected void`
`doExecute(ProfileRequestContext profileRequestContext)`
`protected boolean`
`doPreExecute(ProfileRequestContext profileRequestContext)`
`void`
`setAuthnAssertionSelectionStrategy(Function<List<Assertion>,Assertion> strategy)`
Set the strategy function for selecting which of multiple valid Assertions to use.
`void`
`setAuthnStatementSelectionStrategy(Function<Assertion,AuthnStatement> strategy)`
Set the strategy function for selecting which of multiple AuthnStatements to use.
`void`
`setResponseResolver(Function<ProfileRequestContext,Response> strategy)`
Set the strategy function which resolves the response to process.
`void`
`setSAMLAuthnContextLookupStrategy(Function<ProfileRequestContext,SAMLAuthnContext> strategy)`
Set the lookup strategy used to locate the `SAMLAuthnContext`.
`void`
`setSAMLConsumer(BiConsumer<ProfileRequestContext,AuthnStatement> consumer)`
Set the `BiConsumer` used to save off the SAML statemen and any related objects as a result of this action.

### Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

`doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy`

### Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

`getActivationCondition, setActivationCondition`

### Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

`doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier`

### Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

`checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

`initialize, isInitialized`

## Field Details

### log

@Nonnull private final org.slf4j.Logger log
Logger.

### responseResolver

@Nonnull private Function<ProfileRequestContext,Response> responseResolver
The resolver for the response to be processed.

### samlContextLookupStrategy

@Nonnull private Function<ProfileRequestContext,SAMLAuthnContext> samlContextLookupStrategy
Lookup strategy to locate the SAML context.

### samlConsumer

@Nonnull private BiConsumer<ProfileRequestContext,AuthnStatement> samlConsumer
"Sink" for preserving SAML objects.

### authnAssertionSelectionStrategy

@Nonnull private Function<List<Assertion>,Assertion> authnAssertionSelectionStrategy
Selection strategy for multiple valid authn Assertions.

### authnStatementSelectionStrategy

@Nonnull private Function<Assertion,AuthnStatement> authnStatementSelectionStrategy
Selection strategy for multiple AuthnStatements.

### response

@NonnullBeforeExec private Response response
The Response to process.

## Constructor Details

### ProcessAssertionsForAuthentication

public ProcessAssertionsForAuthentication()
Constructor.

## Method Details

### setAuthnAssertionSelectionStrategy

public void setAuthnAssertionSelectionStrategy(@Nonnull Function<List<Assertion>,Assertion> strategy)
Set the strategy function for selecting which of multiple valid Assertions to use.

Parameters:
  `strategy` - the new strategy function

### setAuthnStatementSelectionStrategy

public void setAuthnStatementSelectionStrategy(@Nonnull Function<Assertion,AuthnStatement> strategy)
Set the strategy function for selecting which of multiple AuthnStatements to use.

Parameters:
  `strategy` - the new strategy function

### setResponseResolver

public void setResponseResolver(@Nonnull Function<ProfileRequestContext,Response> strategy)
Set the strategy function which resolves the response to process.

Parameters:
  `strategy` - the new strategy function

### setSAMLAuthnContextLookupStrategy

public void setSAMLAuthnContextLookupStrategy(@Nonnull Function<ProfileRequestContext,SAMLAuthnContext> strategy)
Set the lookup strategy used to locate the `SAMLAuthnContext`.

Parameters:
  `strategy` - the new strategy function

### setSAMLConsumer

public void setSAMLConsumer(@Nonnull BiConsumer<ProfileRequestContext,AuthnStatement> consumer)
Set the `BiConsumer` used to save off the SAML statemen and any related objects as a result of this action.

This insulates the actiion from the specific context in which it may be used. The supplied consumer MUST establish any non-successful event via the supplied context if it fails.

Parameters:
  `consumer` - consumer to set

### doPreExecute

protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext)

Overrides:
  `doPreExecute` in class `AbstractConditionalProfileAction`

### doExecute

protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext)

Overrides:
  `doExecute` in class `AbstractProfileAction`