Package org.opensaml.saml.saml2.wssecurity.messaging.impl

# Class DefaultSAML20AssertionValidationContextBuilder

java.lang.Object
org.opensaml.saml.saml2.wssecurity.messaging.impl.DefaultSAML20AssertionValidationContextBuilder

All Implemented Interfaces:
  `Function<SAML20AssertionTokenValidationInput,ValidationContext>`

public class DefaultSAML20AssertionValidationContextBuilder extends Object implements Function<SAML20AssertionTokenValidationInput,ValidationContext>
Function which implements default behavior for building an instance of `ValidationContext` from an instance of `SAML20AssertionTokenValidationInput`.

## Field Summary

Fields
Modifier and Type
Field
Description
`private org.slf4j.Logger`
`log`
Logger.
`private Function<Pair<MessageContext,Assertion>,CriteriaSet>`
`signatureCriteriaSetFunction`
A function for resolving the signature validation CriteriaSet for a particular function.
`private boolean`
`signatureRequired`
Flag indicating whether an Assertion signature is required.

## Constructor Summary

Constructors
Constructor
Description
`DefaultSAML20AssertionValidationContextBuilder()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`ValidationContext`
`apply(SAML20AssertionTokenValidationInput input)`
`protected Map<String,Object>`
`buildStaticParameters(SAML20AssertionTokenValidationInput input)`
Build the static parameters map for input to the `ValidationContext`.
`protected X509Certificate`
`getAttesterCertificate(SAML20AssertionTokenValidationInput input)`
Get the attesting entity's `X509Certificate`.
`protected String`
`getAttesterIPAddress(SAML20AssertionTokenValidationInput input)`
Get the attester's IP address.
`protected PublicKey`
`getAttesterPublicKey(SAML20AssertionTokenValidationInput input)`
Get the attesting entity's `PublicKey`.
`protected CriteriaSet`
`getSignatureCriteriaSet(SAML20AssertionTokenValidationInput input)`
Get the signature validation criteria set.
`Function<Pair<MessageContext,Assertion>,CriteriaSet>`
`getSignatureCriteriaSetFunction()`
Get the function for resolving the signature validation CriteriaSet for a particular function.
`protected Set<InetAddress>`
`getValidAddresses(SAML20AssertionTokenValidationInput input)`
Get the set of addresses which are valid for subject confirmation.
`protected Set<String>`
`getValidAudiences(SAML20AssertionTokenValidationInput input)`
Get the valid audiences for attestation.
`protected Set<String>`
`getValidRecipients(SAML20AssertionTokenValidationInput input)`
Get the valid recipient endpoints for attestation.
`boolean`
`isSignatureRequired()`
Get the flag indicating whether an Assertion signature is required.
`void`
`setSignatureCriteriaSetFunction(Function<Pair<MessageContext,Assertion>,CriteriaSet> function)`
Set the function for resolving the signature validation CriteriaSet for a particular function.
`void`
`setSignatureRequired(boolean flag)`
Set the flag indicating whether an Assertion signature is required.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface java.util.function.Function

`andThen, compose`

## Field Details

### log

@Nonnull private org.slf4j.Logger log
Logger.

### signatureCriteriaSetFunction

@Nullable private Function<Pair<MessageContext,Assertion>,CriteriaSet> signatureCriteriaSetFunction
A function for resolving the signature validation CriteriaSet for a particular function.

### signatureRequired

private boolean signatureRequired
Flag indicating whether an Assertion signature is required.

## Constructor Details

### DefaultSAML20AssertionValidationContextBuilder

public DefaultSAML20AssertionValidationContextBuilder()
Constructor.

## Method Details

### isSignatureRequired

public boolean isSignatureRequired()
Get the flag indicating whether an Assertion signature is required.

Defaults to: `true`.

Returns:
  true if required, false if not

### setSignatureRequired

public void setSignatureRequired(boolean flag)
Set the flag indicating whether an Assertion signature is required.

Defaults to: `true`.

Parameters:
  `flag` - true if required, false if not

### getSignatureCriteriaSetFunction

@Nullable public Function<Pair<MessageContext,Assertion>,CriteriaSet> getSignatureCriteriaSetFunction()
Get the function for resolving the signature validation CriteriaSet for a particular function.

Defaults to: `null`.

Returns:
  a criteria set instance, or null

### setSignatureCriteriaSetFunction

public void setSignatureCriteriaSetFunction(@Nullable Function<Pair<MessageContext,Assertion>,CriteriaSet> function)
Set the function for resolving the signature validation CriteriaSet for a particular function.

Defaults to: `null`.

Parameters:
  `function` - the resolving function, may be null

### apply

@Nullable public ValidationContext apply(@Nullable SAML20AssertionTokenValidationInput input)

Specified by:
  `apply` in interface `Function<SAML20AssertionTokenValidationInput,ValidationContext>`

### buildStaticParameters

@Nonnull @Unmodifiable @NotLive protected Map<String,Object> buildStaticParameters(@Nonnull SAML20AssertionTokenValidationInput input)
Build the static parameters map for input to the `ValidationContext`.

Parameters:
  `input` - the assertion validation input
Returns:
  the static parameters map

### getSignatureCriteriaSet

@Nonnull protected CriteriaSet getSignatureCriteriaSet(@Nonnull SAML20AssertionTokenValidationInput input)
Get the signature validation criteria set.

This implementation first evaluates the result of applying the function `getSignatureCriteriaSetFunction()`, if configured. If that evaluation did not produce an `EntityIdCriterion`, one is added based on the issuer of the `Assertion`. If that evaluation did not produce an instance of `UsageCriterion`, one is added with the value of `UsageType.SIGNING`.

Parameters:
  `input` - the assertion validation input
Returns:
  the criteria set based on the message context data

### getAttesterCertificate

@Nullable protected X509Certificate getAttesterCertificate(@Nonnull SAML20AssertionTokenValidationInput input)
Get the attesting entity's `X509Certificate`.

This implementation returns the client TLS certificate present in the `HttpServletRequest`, or null if one is not present.

Parameters:
  `input` - the assertion validation input
Returns:
  the entity certificate, or null

### getAttesterPublicKey

@Nullable protected PublicKey getAttesterPublicKey(@Nonnull SAML20AssertionTokenValidationInput input)
Get the attesting entity's `PublicKey`.

This implementation returns null. Subclasses should override to implement specific logic.

Parameters:
  `input` - the assertion validation input
Returns:
  the entity public key, or null

### getValidRecipients

@Nonnull protected Set<String> getValidRecipients(@Nonnull SAML20AssertionTokenValidationInput input)
Get the valid recipient endpoints for attestation.

This implementation returns a set containing the 2 values;

1. `HttpServletRequest.getRequestURL()`
2. if present, `AbstractSAMLEntityContext.getEntityId()`

Parameters:
  `input` - the assertion validation input
Returns:
  set of recipient endpoint URI's

### getValidAddresses

@Nonnull @Unmodifiable @NotLive protected Set<InetAddress> getValidAddresses(@Nonnull SAML20AssertionTokenValidationInput input)
Get the set of addresses which are valid for subject confirmation.

This implementation simply returns the set based on `getAttesterIPAddress(SAML20AssertionTokenValidationInput)`, if that produces a value. Otherwise an empty set is returned.

Parameters:
  `input` - the assertion validation input
Returns:
  the set of valid addresses

### getAttesterIPAddress

@Nullable protected String getAttesterIPAddress(@Nonnull SAML20AssertionTokenValidationInput input)
Get the attester's IP address.

This implementation returns the value of `ServletRequest.getRemoteAddr()`.

Parameters:
  `input` - the assertion validation input
Returns:
  the IP address of the attester

### getValidAudiences

@Nonnull @Unmodifiable @NotLive protected Set<String> getValidAudiences(@Nonnull SAML20AssertionTokenValidationInput input)
Get the valid audiences for attestation.

This implementation returns a set containing the single entityID held by the message context's `AbstractSAMLEntityContext.getEntityId()`, if present. Otherwise an empty set is returned.

Parameters:
  `input` - the assertion validation input
Returns:
  set of audience URI's