Package net.shibboleth.idp.saml.saml2.profile.impl

# Class ValidateSAMLAuthentication

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.profile.action.AbstractProfileAction
org.opensaml.profile.action.AbstractConditionalProfileAction
net.shibboleth.idp.profile.AbstractProfileAction
net.shibboleth.idp.authn.AbstractAuthenticationAction
net.shibboleth.idp.authn.AbstractValidationAction
net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication

All Implemented Interfaces:
  `PrincipalSupportingComponent`, `Component`, `DestructableComponent`, `InitializableComponent`, `ProfileAction`, `Aware`, `MessageSource`, `MessageSourceAware`, `Action`

public class ValidateSAMLAuthentication extends AbstractValidationAction
An action that produces an `AuthenticationResult` based on an inbound SAML 2.0 SSO response.

A `SAMLAuthnContext` is used as the basis of the result and the lack of a context is a signal to record a failure. Actual validation is all upstream of this action, but the use of the ValidationAction subclass is a convenience for auditing and handling the result.

Event:
  `EventIds.PROCEED_EVENT_ID`, `EventIds.INVALID_PROFILE_CTX`, `IdPEventIds.INVALID_RELYING_PARTY_CTX`, `IdPEventIds.INVALID_PROFILE_CONFIG`
Precondition:

      ProfileRequestContext.getSubcontext(AuthenticationContext.class).getAttemptedFlow() != null

Postcondition:
  If AuthenticationContext.getSubcontext(SAMLAuthnContext.class) != null, then an `AuthenticationResult` is saved to the `AuthenticationContext`.

## Field Summary

Fields
Modifier and Type
Field
Description
`private boolean`
`acceptUnfilteredAttributes`
Whether to accept decoded attributes that no filter rules applied to.
`private AttributeContext`
`attributeContext`
Context for externally supplied inbound attributes.
`private Function<ProfileRequestContext,Collection<IdPAttribute>>`
`attributeExtractionStrategy`
Pluggable strategy function for generalized extraction of data.
`private ReloadableService<AttributeFilter>`
`attributeFilterService`
Service used to get the engine used to filter attributes.
`private Function<AuthnContext,Collection<Principal>>`
`authnContextTranslator`
Incoming context translation function.
`private Function<ProfileRequestContext,Collection<Principal>>`
`authnContextTranslatorEx`
Incoming context extended translation function.
`private boolean`
`decodeNameID`
Whether to apply transcoder registry to NameID elements.
`private static final String`
`DEFAULT_METRIC_NAME`
Default prefix for metrics.
`private final org.slf4j.Logger`
`log`
Class logger.
`private String`
`loggedAttributeId`
An IdPAttribute ID to log as a "name" in place of the NameID for "info" purposes.
`private MetadataResolver`
`metadataResolver`
Optional supplemental metadata source for filtering.
`private BrowserSSOProfileConfiguration`
`profileConfiguration`
Store off profile config.
`private Function<ProfileRequestContext,RelyingPartyContext>`
`relyingPartyContextLookupStrategy`
Strategy used to look up a `RelyingPartyContext` for configuration options.
`private SAMLAuthnContext`
`samlAuthnContext`
Context containing the result to validate.
`private ReloadableService<AttributeTranscoderRegistry>`
`transcoderRegistry`
Transcoder registry service object.

## Constructor Summary

Constructors
Constructor
Description
`ValidateSAMLAuthentication()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`private ProxyAuthenticationPrincipal`
`buildProxyPrincipal(AuthnContext authnContext)`
Construct a populated `ProxyAuthenticationPrincipal` based on the inbound assertion.
`private void`
`decodeAttribute(AttributeTranscoderRegistry registry, ProfileRequestContext profileRequestContext, Attribute input, Multimap<String,IdPAttribute> results)`
Access the registry of transcoding rules to decode the input `Attribute`.
`private void`
`decodeNameID(AttributeTranscoderRegistry registry, ProfileRequestContext profileRequestContext, NameID input, Multimap<String,IdPAttribute> results)`
Access the registry of transcoding rules to decode the input `NameID`.
`protected void`
`doExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)`
Performs this authentication action.
`protected boolean`
`doPreExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)`
Performs this authentication action's pre-execute step.
`private void`
`filterAttributes(ProfileRequestContext profileRequestContext)`
Filter inbound attributes.
`protected void`
`logSuccess()`
Log a successful authentication based on a designated attribute ID or the NameID value.
`private void`
`populateFilterContext(ProfileRequestContext profileRequestContext, AttributeFilterContext filterContext)`
Fill in the filter context data.
`protected Subject`
`populateSubject(Subject subject)`
Subclasses must override this method to complete the population of the `Subject` with `Principal` and credential information based on the validation they perform.
`private void`
`processAttributes(ProfileRequestContext profileRequestContext)`
Process the inbound SAML Attributes and optionally NameID(s).
`void`
`setAcceptUnfilteredAttributes(boolean flag)`
Set whether to accept decoded `IdPAttribute` objects pulled from the assertions if no filtering rule applied to them.
`void`
`setAttributeExtractionStrategy(Function<ProfileRequestContext,Collection<IdPAttribute>> strategy)`
Sets the strategy function to invoke for generalized extraction of data into `IdPAttribute` objects for inclusion in the `AuthenticationResult`.
`void`
`setAttributeFilter(ReloadableService<AttributeFilter> filterService)`
Sets the filter service to use for inbound attributes.
`void`
`setDecodeNameID(boolean flag)`
Sets whether to apply the `AttributeTranscoderRegistry` to any `NameID` elements in the assertion(s).
`void`
`setLoggedAttributeId(String id)`
Set an attribute ID to pull a "name" from for logging purposes.
`void`
`setMetadataResolver(MetadataResolver resolver)`
Set a metadata source to use during filtering.
`void`
`setRelyingPartyContextLookupStrategy(Function<ProfileRequestContext,RelyingPartyContext> strategy)`
Set the strategy used to return the `RelyingPartyContext` for configuration options.
`void`
`setTranscoderRegistry(ReloadableService<AttributeTranscoderRegistry> registry)`
Sets the registry of transcoding rules to apply to encode attributes.

### Methods inherited from class net.shibboleth.idp.authn.AbstractValidationAction

`addDefaultPrincipals, buildAuthenticationResult, getClassifiedErrors, getCleanupHook, getMetricName, getRequesterLookupStrategy, getResponderLookupStrategy, getResultCachingPredicate, getSubject, getSupportedPrincipals, handleError, handleError, handleWarning, recordFailure, recordSuccess, setAddDefaultPrincipals, setClassifiedMessages, setCleanupHook, setMetricName, setRequesterLookupStrategy, setResponderLookupStrategy, setResultCachingPredicate, setSupportedPrincipals`

### Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

`doExecute, doPreExecute, setAuthenticationContextLookupStrategy`

### Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

`doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy`

### Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

`getActivationCondition, setActivationCondition`

### Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

`doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier`

### Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

`checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

`initialize, isInitialized`

## Field Details

### DEFAULT_METRIC_NAME

@Nonnull @NotEmpty private static final String DEFAULT_METRIC_NAME
Default prefix for metrics.

See Also:
  - Constant Field Values

### log

@Nonnull private final org.slf4j.Logger log
Class logger.

### transcoderRegistry

@Nullable private ReloadableService<AttributeTranscoderRegistry> transcoderRegistry
Transcoder registry service object.

### attributeFilterService

@Nullable private ReloadableService<AttributeFilter> attributeFilterService
Service used to get the engine used to filter attributes.

### metadataResolver

@Nullable private MetadataResolver metadataResolver
Optional supplemental metadata source for filtering.

### relyingPartyContextLookupStrategy

@Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy
Strategy used to look up a `RelyingPartyContext` for configuration options.

### attributeExtractionStrategy

@Nullable private Function<ProfileRequestContext,Collection<IdPAttribute>> attributeExtractionStrategy
Pluggable strategy function for generalized extraction of data.

### decodeNameID

private boolean decodeNameID
Whether to apply transcoder registry to NameID elements.

### acceptUnfilteredAttributes

private boolean acceptUnfilteredAttributes
Whether to accept decoded attributes that no filter rules applied to.

### loggedAttributeId

@Nullable @NotEmpty private String loggedAttributeId
An IdPAttribute ID to log as a "name" in place of the NameID for "info" purposes.

### samlAuthnContext

@NonnullBeforeExec private SAMLAuthnContext samlAuthnContext
Context containing the result to validate.

### profileConfiguration

@NonnullBeforeExec private BrowserSSOProfileConfiguration profileConfiguration
Store off profile config.

### authnContextTranslator

@Nullable private Function<AuthnContext,Collection<Principal>> authnContextTranslator
Incoming context translation function.

### authnContextTranslatorEx

@Nullable private Function<ProfileRequestContext,Collection<Principal>> authnContextTranslatorEx
Incoming context extended translation function.

### attributeContext

@Nullable private AttributeContext attributeContext
Context for externally supplied inbound attributes.

## Constructor Details

### ValidateSAMLAuthentication

public ValidateSAMLAuthentication()
Constructor.

## Method Details

### setTranscoderRegistry

public void setTranscoderRegistry(@Nullable ReloadableService<AttributeTranscoderRegistry> registry)
Sets the registry of transcoding rules to apply to encode attributes.

Parameters:
  `registry` - registry service interface

### setAttributeFilter

public void setAttributeFilter(@Nullable ReloadableService<AttributeFilter> filterService)
Sets the filter service to use for inbound attributes.

Parameters:
  `filterService` - optional filter service for inbound attributes

### setMetadataResolver

public void setMetadataResolver(@Nullable MetadataResolver resolver)
Set a metadata source to use during filtering.

Parameters:
  `resolver` - metadata resolver

### setRelyingPartyContextLookupStrategy

public void setRelyingPartyContextLookupStrategy(@Nonnull Function<ProfileRequestContext,RelyingPartyContext> strategy)
Set the strategy used to return the `RelyingPartyContext` for configuration options.

Parameters:
  `strategy` - lookup strategy

### setAttributeExtractionStrategy

public void setAttributeExtractionStrategy(@Nullable Function<ProfileRequestContext,Collection<IdPAttribute>> strategy)
Sets the strategy function to invoke for generalized extraction of data into `IdPAttribute` objects for inclusion in the `AuthenticationResult`.

Parameters:
  `strategy` - extraction strategy

### setDecodeNameID

public void setDecodeNameID(boolean flag)
Sets whether to apply the `AttributeTranscoderRegistry` to any `NameID` elements in the assertion(s).

Defaults to false mainly for backward compatibility.

Parameters:
  `flag` - flag to set
Since:
  5.2.0

### setAcceptUnfilteredAttributes

public void setAcceptUnfilteredAttributes(boolean flag)
Set whether to accept decoded `IdPAttribute` objects pulled from the assertions if no filtering rule applied to them.

This is a variant of the original SP's "wildcard" rule support to allow non-enumerated attributes to be accepted.

Parameters:
  `flag` -

### setLoggedAttributeId

public void setLoggedAttributeId(@Nullable @NotEmpty String id)
Set an attribute ID to pull a "name" from for logging purposes.

Parameters:
  `id` - attribute ID
Since:
  4.2.0

### doPreExecute

protected boolean doPreExecute(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull AuthenticationContext authenticationContext)
Performs this authentication action's pre-execute step. Default implementation just returns true.

Overrides:
  `doPreExecute` in class `AbstractValidationAction`
Parameters:
  `profileRequestContext` - the current IdP profile request context
  `authenticationContext` - the current authentication context
Returns:
  true iff execution should continue

### doExecute

protected void doExecute(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull AuthenticationContext authenticationContext)
Performs this authentication action. Default implementation throws an exception.

Overrides:
  `doExecute` in class `AbstractAuthenticationAction`
Parameters:
  `profileRequestContext` - the current IdP profile request context
  `authenticationContext` - the current authentication context

### logSuccess

protected void logSuccess()
Log a successful authentication based on a designated attribute ID or the NameID value.

### populateSubject

@Nonnull protected Subject populateSubject(@Nonnull Subject subject)
Subclasses must override this method to complete the population of the `Subject` with `Principal` and credential information based on the validation they perform.

Typically this will include attaching a `UsernamePrincipal`, but this is not a requirement if other components are suitably overridden.

Specified by:
  `populateSubject` in class `AbstractValidationAction`
Parameters:
  `subject` - subject to populate
Returns:
  the input subject

### buildProxyPrincipal

@Nonnull private ProxyAuthenticationPrincipal buildProxyPrincipal(@Nonnull AuthnContext authnContext)
Construct a populated `ProxyAuthenticationPrincipal` based on the inbound assertion.

Parameters:
  `authnContext` - the SAML `AuthnContext` issued by the proxied IdP
Returns:
  a constructed `ProxyAuthenticationPrincipal` to include in the `Subject`

### processAttributes

private void processAttributes(@Nonnull ProfileRequestContext profileRequestContext)
Process the inbound SAML Attributes and optionally NameID(s).

Parameters:
  `profileRequestContext` - current profile request context

### decodeAttribute

private void decodeAttribute(@Nonnull AttributeTranscoderRegistry registry, @Nonnull ProfileRequestContext profileRequestContext, @Nonnull Attribute input, @Nonnull @Live Multimap<String,IdPAttribute> results) throws AttributeDecodingException
Access the registry of transcoding rules to decode the input `Attribute`.

Parameters:
  `registry` - registry of transcoding rules
  `profileRequestContext` - current profile request context
  `input` - input object
  `results` - collection to add results to
Throws:
  `AttributeDecodingException` - if an error occurs or no results were obtained

### decodeNameID

private void decodeNameID(@Nonnull AttributeTranscoderRegistry registry, @Nonnull ProfileRequestContext profileRequestContext, @Nonnull NameID input, @Nonnull @Live Multimap<String,IdPAttribute> results) throws AttributeDecodingException
Access the registry of transcoding rules to decode the input `NameID`.

Parameters:
  `registry` - registry of transcoding rules
  `profileRequestContext` - current profile request context
  `input` - input object
  `results` - collection to add results to
Throws:
  `AttributeDecodingException` - if an error occurs or no results were obtained
Since:
  5.2.0

### filterAttributes

private void filterAttributes(@Nonnull ProfileRequestContext profileRequestContext)
Filter inbound attributes.

Parameters:
  `profileRequestContext` - current profile request context

### populateFilterContext

private void populateFilterContext(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull AttributeFilterContext filterContext)
Fill in the filter context data.

Parameters:
  `profileRequestContext` - current profile request context
  `filterContext` - context to populate