Package org.opensaml.saml.saml2.assertion

# Class SAML20AssertionValidator

java.lang.Object
org.opensaml.saml.saml2.assertion.SAML20AssertionValidator

public class SAML20AssertionValidator extends Object
A component capable of performing core validation of SAML version 2.0 `Assertion` instances.

Supports the following `ValidationContext` static parameters:

- `SAML2AssertionValidationParameters.VALID_ISSUERS`: Optional.
- `SAML2AssertionValidationParameters.SIGNATURE_REQUIRED`: Optional. If not supplied, defaults to 'true'. If an Assertion is signed, the signature is always evaluated and the result factored into the overall validation result, regardless of the value of this setting.
- `SAML2AssertionValidationParameters.SIGNATURE_VALIDATION_CRITERIA_SET`: Optional. If not supplied, a minimal criteria set will be constructed which contains an `EntityIdCriterion` containing the Assertion Issuer entityID, and a `UsageCriterion` of `UsageType.SIGNING`. If it is supplied, but either of those criteria are absent from the criteria set, they will be added with the above values.
- `SAML2AssertionValidationParameters.SIGNATURE_VALIDATION_TRUST_ENGINE`: Optional. If not supplied, defaults to the locally-injected instance.
- `SAML2AssertionValidationParameters.SIGNATURE_VALIDATION_PREVALIDATOR`: Optional. If not supplied, defaults to the locally-injected instance.
- `SAML2AssertionValidationParameters.CLOCK_SKEW`: Optional. If not present the default clock skew of `DEFAULT_CLOCK_SKEW` will be used.
- `SAML2AssertionValidationParameters.LIFETIME`: Optional. If not present the default lifetime of `DEFAULT_LIFETIME` will be used.
- `SAML2AssertionValidationParameters.COND_REQUIRED_CONDITIONS`: Optional.

Supports the following `ValidationContext` dynamic parameters:

- `SAML2AssertionValidationParameters.CONFIRMED_SUBJECT_CONFIRMATION`: Optional. Will be present after validation iff subject confirmation was successfully performed.

## Field Summary

Fields
Modifier and Type
Field
Description
`private AssertionValidator`
`assertionValidator`
Generic validator.
`private LazyMap<QName,ConditionValidator>`
`conditionValidators`
Registered `Condition` validators.
`static final Duration`
`DEFAULT_CLOCK_SKEW`
Default clock skew of 5 minutes.
`static final Duration`
`DEFAULT_LIFETIME`
Default lifetime for IssueInstant of 5 minutes.
`private final org.slf4j.Logger`
`log`
Class logger.
`private SignaturePrevalidator`
`signaturePrevalidator`
SAML signature profile validator.
`private LazyMap<QName,StatementValidator>`
`statementValidators`
Registered `Statement` validators.
`private LazyMap<String,SubjectConfirmationValidator>`
`subjectConfirmationValidators`
Registered `SubjectConfirmation` validators.
`private SignatureTrustEngine`
`trustEngine`
Trust engine for signature evaluation.

## Constructor Summary

Constructors
Constructor
Description
`SAML20AssertionValidator(Collection<ConditionValidator> newConditionValidators, Collection<SubjectConfirmationValidator> newConfirmationValidators, Collection<StatementValidator> newStatementValidators, AssertionValidator newAssertionValidator, SignatureTrustEngine newTrustEngine, SignaturePrevalidator newSignaturePrevalidator)`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`static Duration`
`getClockSkew(ValidationContext context)`
Gets the clock skew from the `ValidationContext.getStaticParameters()` parameters.
`private static Duration`
`getDurationParam(ValidationContext context, String paramName, Duration defaultDuration)`
Gets the clock skew from the `ValidationContext.getStaticParameters()` parameters.
`static Duration`
`getLifetime(ValidationContext context)`
Gets the lifetime duration from the `ValidationContext.getStaticParameters()` parameters.
`protected CriteriaSet`
`getSignatureValidationCriteriaSet(Assertion token, ValidationContext context)`
Get the criteria set that will be used in evaluating the Assertion signature via the supplied trust engine.
`protected SignaturePrevalidator`
`getSignatureValidationPrevalidator(Assertion token, ValidationContext context)`
Get the signature trust engine that will be used in evaluating the Assertion signature.
`protected SignatureTrustEngine`
`getSignatureValidationTrustEngine(Assertion token, ValidationContext context)`
Get the signature trust engine that will be used in evaluating the Assertion signature.
`protected void`
`log(Assertion assertion, ValidationContext context)`
Log the Assertion which is being validated, along with the supplied validation context parameters.
`protected ValidationResult`
`performSignatureValidation(Assertion token, ValidationContext context)`
Handle the actual signature validation.
`ValidationResult`
`validate(Assertion assertion, ValidationContext context)`
Validate the supplied SAML 2 `Assertion`, using the parameters from the supplied `ValidationContext`.
`protected ValidationResult`
`validateBasicData(Assertion assertion, ValidationContext context)`
Validate basic Assertion data, such as version, issuer and issue instant.
`protected ValidationResult`
`validateConditions(Assertion assertion, ValidationContext context)`
Validates the conditions on the assertion.
`protected ValidationResult`
`validateConditionsTimeBounds(Assertion assertion, ValidationContext context)`
Validates the NotBefore and NotOnOrAfter Conditions constraints on the assertion.
`protected ValidationResult`
`validateIssueInstant(Assertion assertion, ValidationContext context)`
Validates the Assertion IssueInstant.
`protected ValidationResult`
`validateIssuer(Assertion assertion, ValidationContext context)`
Validates the Assertion `Issuer`.
`protected ValidationResult`
`validateRequiredConditions(Assertion assertion, ValidationContext context)`
Validate that all conditions indicated to be required are present in the assertion.
`protected ValidationResult`
`validateSignature(Assertion token, ValidationContext context)`
Validates the signature of the assertion, if it is signed.
`protected ValidationResult`
`validateStatements(Assertion assertion, ValidationContext context)`
Validates the statements within the assertion.
`protected ValidationResult`
`validateSubjectConfirmation(Assertion assertion, ValidationContext context)`
Validates the subject confirmations of the assertion.
`protected ValidationResult`
`validateVersion(Assertion assertion, ValidationContext context)`
Validates that the assertion is a `SAMLVersion.VERSION_20` assertion.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### DEFAULT_CLOCK_SKEW

@Nonnull public static final Duration DEFAULT_CLOCK_SKEW
Default clock skew of 5 minutes.

### DEFAULT_LIFETIME

@Nonnull public static final Duration DEFAULT_LIFETIME
Default lifetime for IssueInstant of 5 minutes.

### log

@Nonnull private final org.slf4j.Logger log
Class logger.

### conditionValidators

@Nonnull private LazyMap<QName,ConditionValidator> conditionValidators
Registered `Condition` validators.

### subjectConfirmationValidators

@Nonnull private LazyMap<String,SubjectConfirmationValidator> subjectConfirmationValidators
Registered `SubjectConfirmation` validators.

### statementValidators

@Nonnull private LazyMap<QName,StatementValidator> statementValidators
Registered `Statement` validators.

### assertionValidator

@Nullable private AssertionValidator assertionValidator
Generic validator.

### trustEngine

@Nullable private SignatureTrustEngine trustEngine
Trust engine for signature evaluation.

### signaturePrevalidator

@Nullable private SignaturePrevalidator signaturePrevalidator
SAML signature profile validator.

## Constructor Details

### SAML20AssertionValidator

public SAML20AssertionValidator(@Nullable Collection<ConditionValidator> newConditionValidators, @Nullable Collection<SubjectConfirmationValidator> newConfirmationValidators, @Nullable Collection<StatementValidator> newStatementValidators, @Nullable AssertionValidator newAssertionValidator, @Nullable SignatureTrustEngine newTrustEngine, @Nullable SignaturePrevalidator newSignaturePrevalidator)
Constructor.

Parameters:
  `newConditionValidators` - validators used to validate the `Condition`s within the assertion
  `newConfirmationValidators` - validators used to validate `SubjectConfirmation` methods within the assertion
  `newStatementValidators` - validators used to validate `Statement`s within the assertion
  `newAssertionValidator` - generic validator extension point
  `newTrustEngine` - the trust used to validate the Assertion signature
  `newSignaturePrevalidator` - the signature pre-validator used to pre-validate the Assertion signature
Since:
  4.1.0

## Method Details

### getLifetime

@Nonnull public static Duration getLifetime(@Nonnull ValidationContext context)
Gets the lifetime duration from the `ValidationContext.getStaticParameters()` parameters. If the parameter is not set or is not a non-zero `Duration` then the `DEFAULT_LIFETIME` is used.

Parameters:
  `context` - current validation context
Returns:
  the lifetime duration

### getClockSkew

@Nonnull public static Duration getClockSkew(@Nonnull ValidationContext context)
Gets the clock skew from the `ValidationContext.getStaticParameters()` parameters. If the parameter is not set or is not a non-zero `Duration` then the `DEFAULT_CLOCK_SKEW` is used.

Parameters:
  `context` - current validation context
Returns:
  the clock skew

### getDurationParam

@Nonnull private static Duration getDurationParam(@Nonnull ValidationContext context, @Nonnull String paramName, @Nonnull Duration defaultDuration)
Gets the clock skew from the `ValidationContext.getStaticParameters()` parameters. If the parameter is not set or is not a non-zero `Duration` then the `DEFAULT_CLOCK_SKEW` is used.

Parameters:
  `context` - current validation context
  `paramName` - name of the duration parameter to process
  `defaultDuration` - the default duration to use if not parameter not present in context
Returns:
  the clock skew

### validate

@Nonnull public ValidationResult validate(@Nonnull Assertion assertion, @Nonnull ValidationContext context) throws AssertionValidationException
Validate the supplied SAML 2 `Assertion`, using the parameters from the supplied `ValidationContext`.

Parameters:
  `assertion` - the assertion being evaluated
  `context` - the current validation context
Returns:
  the validation result
Throws:
  `AssertionValidationException` - if there is a fatal error evaluating the validity of the assertion

### log

protected void log(@Nonnull Assertion assertion, @Nonnull ValidationContext context)
Log the Assertion which is being validated, along with the supplied validation context parameters.

Parameters:
  `assertion` - the SAML 2 Assertion being validated
  `context` - current validation context

### validateBasicData

@Nonnull protected ValidationResult validateBasicData(@Nonnull Assertion assertion, @Nonnull ValidationContext context) throws AssertionValidationException
Validate basic Assertion data, such as version, issuer and issue instant.

Parameters:
  `assertion` - the assertion being evaluated
  `context` - the current validation context
Returns:
  the validation result
Throws:
  `AssertionValidationException` - if there is a fatal error evaluating the validity of the assertion

### validateVersion

@Nonnull protected ValidationResult validateVersion(@Nonnull Assertion assertion, @Nonnull ValidationContext context) throws AssertionValidationException
Validates that the assertion is a `SAMLVersion.VERSION_20` assertion.

Parameters:
  `assertion` - the assertion to validate
  `context` - current validation context
Returns:
  result of the validation evaluation
Throws:
  `AssertionValidationException` - thrown if there is a problem validating the version

### validateIssueInstant

@Nonnull protected ValidationResult validateIssueInstant(@Nonnull Assertion assertion, @Nonnull ValidationContext context) throws AssertionValidationException
Validates the Assertion IssueInstant.

Parameters:
  `assertion` - the assertion to validate
  `context` - current validation context
Returns:
  the result of the validation evaluation
Throws:
  `AssertionValidationException` - if there is a problem validating the IssueInstant

### validateIssuer

@Nonnull protected ValidationResult validateIssuer(@Nonnull Assertion assertion, @Nonnull ValidationContext context) throws AssertionValidationException
Validates the Assertion `Issuer`.

Parameters:
  `assertion` - the assertion to validate
  `context` - current validation context
Returns:
  the result of the validation evaluation
Throws:
  `AssertionValidationException` - if there is a problem validating the Issuer

### validateSignature

@Nonnull protected ValidationResult validateSignature(@Nonnull Assertion token, @Nonnull ValidationContext context) throws AssertionValidationException
Validates the signature of the assertion, if it is signed.

Parameters:
  `token` - assertion whose signature will be validated
  `context` - current validation context
Returns:
  the result of the signature validation
Throws:
  `AssertionValidationException` - thrown if there is a problem determining the validity of the signature

### performSignatureValidation

@Nonnull protected ValidationResult performSignatureValidation(@Nonnull Assertion token, @Nonnull ValidationContext context) throws AssertionValidationException
Handle the actual signature validation.

Parameters:
  `token` - assertion whose signature will be validated
  `context` - current validation context
Returns:
  the validation result
Throws:
  `AssertionValidationException` - thrown if there is a problem determining the validity of the signature

### getSignatureValidationTrustEngine

@Nullable protected SignatureTrustEngine getSignatureValidationTrustEngine(@Nonnull Assertion token, @Nonnull ValidationContext context)
Get the signature trust engine that will be used in evaluating the Assertion signature.

Parameters:
  `token` - assertion whose signature will be validated
  `context` - current validation context
Returns:
  the criteria set to use

### getSignatureValidationPrevalidator

@Nullable protected SignaturePrevalidator getSignatureValidationPrevalidator(@Nonnull Assertion token, @Nonnull ValidationContext context)
Get the signature trust engine that will be used in evaluating the Assertion signature.

Parameters:
  `token` - assertion whose signature will be validated
  `context` - current validation context
Returns:
  the criteria set to use

### getSignatureValidationCriteriaSet

@Nonnull protected CriteriaSet getSignatureValidationCriteriaSet(@Nonnull Assertion token, @Nonnull ValidationContext context)
Get the criteria set that will be used in evaluating the Assertion signature via the supplied trust engine.

Parameters:
  `token` - assertion whose signature will be validated
  `context` - current validation context
Returns:
  the criteria set to use

### validateConditions

@Nonnull protected ValidationResult validateConditions(@Nonnull Assertion assertion, @Nonnull ValidationContext context) throws AssertionValidationException
Validates the conditions on the assertion. Condition validators are looked up by the element QName and, if present, the schema type of the condition. If no validator can be found for the Condition the validation process fails.

Parameters:
  `assertion` - the assertion whose conditions will be validated
  `context` - current validation context
Returns:
  the result of the validation evaluation
Throws:
  `AssertionValidationException` - thrown if there is a problem determining the validity of the conditions

### validateRequiredConditions

@Nonnull protected ValidationResult validateRequiredConditions(@Nonnull Assertion assertion, @Nonnull ValidationContext context)
Validate that all conditions indicated to be required are present in the assertion.

Parameters:
  `assertion` - the assertion whose conditions will be evaluated
  `context` - current validation context
Returns:
  the result of the validation evaluation

### validateConditionsTimeBounds

@Nonnull protected ValidationResult validateConditionsTimeBounds(@Nonnull Assertion assertion, @Nonnull ValidationContext context) throws AssertionValidationException
Validates the NotBefore and NotOnOrAfter Conditions constraints on the assertion.

Parameters:
  `assertion` - the assertion whose conditions will be validated
  `context` - current validation context
Returns:
  the result of the validation evaluation
Throws:
  `AssertionValidationException` - thrown if there is a problem determining the validity of the conditions

### validateSubjectConfirmation

@Nonnull protected ValidationResult validateSubjectConfirmation(@Nonnull Assertion assertion, @Nonnull ValidationContext context) throws AssertionValidationException
Validates the subject confirmations of the assertion. Validators are looked up by the subject confirmation method. If any one subject confirmation is met the subject is considered confirmed per the SAML specification.

Parameters:
  `assertion` - assertion whose subject is being confirmed
  `context` - current validation context
Returns:
  the result of the validation
Throws:
  `AssertionValidationException` - thrown if there is a problem determining the validity the subject

### validateStatements

@Nonnull protected ValidationResult validateStatements(@Nonnull Assertion assertion, @Nonnull ValidationContext context) throws AssertionValidationException
Validates the statements within the assertion. Validators are looked up by the Statement's element QName or, if present, its schema type. Any statement for which a validator can not be found is simply ignored.

Parameters:
  `assertion` - assertion whose statements are being validated
  `context` - current validation context
Returns:
  result of the validation
Throws:
  `AssertionValidationException` - thrown if there is a problem determining the validity the statements