Package org.opensaml.saml.saml2.assertion.messaging.impl

# Class DefaultAssertionValidationContextBuilder

java.lang.Object
org.opensaml.saml.saml2.assertion.messaging.impl.DefaultAssertionValidationContextBuilder

All Implemented Interfaces:
  `Function<AssertionValidationInput,ValidationContext>`

public class DefaultAssertionValidationContextBuilder extends Object implements Function<AssertionValidationInput,ValidationContext>
Function which implements default behavior for building an instance of `ValidationContext` from an instance of `AssertionValidationInput`.

## Nested Class Summary

Nested Classes
Modifier and Type
Class
Description
`static class`
`DefaultAssertionValidationContextBuilder.DefaultSelfEntityIDLookupFunction`
Default strategy for resolving the self entityID.
`static class`
`DefaultAssertionValidationContextBuilder.DefaultValidInResponseToLookupFunction`
Default strategy for resolving the valid InResponseTo value.
`static class`
`DefaultAssertionValidationContextBuilder.DefaultValidIssuersLookupFunction`
Default strategy for resolving the valid Issuers.

## Field Summary

Fields
Modifier and Type
Field
Description
`private Function<InOutOperationContext,Set<String>>`
`additionalAudiences`
Function for determining additional valid audience values.
`private Predicate<InOutOperationContext>`
`addressRequired`
Predicate for determining whether an Assertion SubjectConfirmationData Address is required.
`private Predicate<InOutOperationContext>`
`checkAddress`
Predicate for determining whether an Assertion's network address(es) should be checked.
`private Function<InOutOperationContext,Duration>`
`clockSkew`
A function for resolving the clock skew to apply.
`private Predicate<InOutOperationContext>`
`includeSelfEntityIDAsRecipient`
Predicate for determining whether to include the self entityID as a valid Recipient.
`private Function<InOutOperationContext,String>`
`inResponseTo`
Function for determining the valid InResponseTo value.
`private Predicate<InOutOperationContext>`
`inResponseToIgnored`
Predicate for determining whether an Assertion SubjectConfirmationData InResponseTo is ignored.
`private Predicate<InOutOperationContext>`
`inResponseToRequired`
Predicate for determining whether an Assertion SubjectConfirmationData InResponseTo is required.
`private Function<InOutOperationContext,Duration>`
`lifetime`
A function for resolving the lifetime to apply.
`private org.slf4j.Logger`
`log`
Logger.
`private Function<InOutOperationContext,Duration>`
`maximumTimeSinceAuthn`
Function for determining the max allowed time since authentication.
`private Predicate<InOutOperationContext>`
`notBeforeRequired`
Predicate for determining whether an Assertion SubjectConfirmationData NotBefore is required.
`private Predicate<InOutOperationContext>`
`notOnOrAfterRequired`
Predicate for determining whether an Assertion SubjectConfirmationData NotOnOrAfter is required.
`private Predicate<InOutOperationContext>`
`recipientRequired`
Predicate for determining whether an Assertion SubjectConfirmationData Recipient is required.
`private Set<QName>`
`requiredConditions`
The set of required Conditions.
`private Predicate<InOutOperationContext>`
`requireEntityIssuer`
Predicate for determining whether to require issuer be of the `NameIDType.ENTITY` format.
`private Function<InOutOperationContext,SecurityParametersContext>`
`securityParametersLookupStrategy`
Resolver for security parameters context.
`private Function<InOutOperationContext,String>`
`selfEntityID`
Function for determining the self entityID.
`private Function<Pair<InOutOperationContext,Assertion>,CriteriaSet>`
`signatureCriteriaSetFunction`
A function for resolving the signature validation CriteriaSet for a particular function.
`private Predicate<InOutOperationContext>`
`signatureRequired`
Predicate for determining whether an Assertion signature is required.
`private Function<InOutOperationContext,Set<String>>`
`validIssuers`
Function for determining additional valid Issuer values.

## Constructor Summary

Constructors
Constructor
Description
`DefaultAssertionValidationContextBuilder()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`ValidationContext`
`apply(AssertionValidationInput input)`
`protected Map<String,Object>`
`buildStaticParameters(AssertionValidationInput input)`
Build the static parameters map for input to the `ValidationContext`.
`Function<InOutOperationContext,Set<String>>`
`getAdditionalAudiences()`
Get the function for determining additional audience values.
`Predicate<InOutOperationContext>`
`getAddressRequired()`
Get the predicate which determines whether an Assertion SubjectConfirmationData Address is required.
`protected X509Certificate`
`getAttesterCertificate(AssertionValidationInput input)`
Get the attesting entity's `X509Certificate`.
`protected String`
`getAttesterIPAddress(AssertionValidationInput input)`
Get the attester's IP address.
`protected PublicKey`
`getAttesterPublicKey(AssertionValidationInput input)`
Get the attesting entity's `PublicKey`.
`Predicate<InOutOperationContext>`
`getCheckAddress()`
Get the predicate which determines whether an Assertion's network address(es) should be checked.
`Function<InOutOperationContext,Duration>`
`getClockSkew()`
Get the strategy by which to resolve the clock skew.
`Predicate<InOutOperationContext>`
`getIncludeSelfEntityIDAsRecipient()`
Get the predicate which determines whether to include the self entityID as a valid Recipient.
`Function<InOutOperationContext,String>`
`getInResponseTo()`
Get the function for determining the valid InResponseTo.
`Predicate<InOutOperationContext>`
`getInResponseToIgnored()`
Get the predicate which determines whether an Assertion SubjectConfirmationData InResponseTo is ignored.
`Predicate<InOutOperationContext>`
`getInResponseToRequired()`
Get the predicate which determines whether an Assertion SubjectConfirmationData InResponseTo is required.
`Function<InOutOperationContext,Duration>`
`getLifetime()`
Get the strategy by which to resolve the lifetime.
`Function<InOutOperationContext,Duration>`
`getMaximumTimeSinceAuthn()`
Get the function for determining the max allowed time since authentication.
`Predicate<InOutOperationContext>`
`getNotBeforeRequired()`
Get the predicate which determines whether an Assertion SubjectConfirmationData NotBefore is required.
`Predicate<InOutOperationContext>`
`getNotOnOrAfterRequired()`
Get the predicate which determines whether an Assertion SubjectConfirmationData NotOnOrAfter is required.
`Predicate<InOutOperationContext>`
`getRecipientRequired()`
Get the predicate which determines whether an Assertion SubjectConfirmationData Recipient is required.
`Set<QName>`
`getRequiredConditions()`
Get the set of required Conditions.
`protected Set<QName>`
`getRequiredConditions(AssertionValidationInput input)`
Get the set of required Conditions.
`Predicate<InOutOperationContext>`
`getRequireEntityIssuer()`
Get the predicate which determines whether to require the Issuer contain the `NameIDType.ENTITY` Format.
`Function<InOutOperationContext,SecurityParametersContext>`
`getSecurityParametersLookupStrategy()`
Get the strategy by which to resolve a `SecurityParametersContext`.
`Function<InOutOperationContext,String>`
`getSelfEntityID()`
Get the function for determining the self entityID.
`protected CriteriaSet`
`getSignatureCriteriaSet(AssertionValidationInput input)`
Get the signature validation criteria set.
`Function<Pair<InOutOperationContext,Assertion>,CriteriaSet>`
`getSignatureCriteriaSetFunction()`
Get the function for resolving the signature validation CriteriaSet for a particular function.
`Predicate<InOutOperationContext>`
`getSignatureRequired()`
Get the predicate which determines whether an Assertion signature is required.
`protected Set<InetAddress>`
`getValidAddresses(AssertionValidationInput input)`
Get the set of addresses which are valid for subject confirmation.
`protected Set<String>`
`getValidAudiences(AssertionValidationInput input)`
Get the valid audiences for attestation.
`Function<InOutOperationContext,Set<String>>`
`getValidIssuers()`
Get the function for determining the valid Issuer values
`protected Set<String>`
`getValidRecipients(AssertionValidationInput input)`
Get the valid recipient endpoints for attestation.
`private void`
`populateConditionsParameters(Map<String,Object> staticParams, AssertionValidationInput input)`
Populate the static Conditions parameters.
`protected void`
`populateSignatureCriteriaFromInboundContext(CriteriaSet criteriaSet, MessageContext inboundContext)`
Populate signature criteria from the specified `MessageContext`.
`private void`
`populateSignatureParameters(Map<String,Object> staticParams, AssertionValidationInput input)`
Populate the static signature parameters.
`private void`
`populateStatementParams(Map<String,Object> staticParams, AssertionValidationInput input, Set<InetAddress> validAddresses, Boolean checkAddressEnabled)`
Populate the static Statement params.
`private void`
`populateSubjectConfirmationParameters(Map<String,Object> staticParams, AssertionValidationInput input, Set<InetAddress> validAddresses, Boolean checkAddressEnabled)`
Populate the static SubjectConfirmation parameters.
`void`
`setAdditionalAudiences(Function<InOutOperationContext,Set<String>> function)`
Set the function for determining additional audience values.
`void`
`setAddressRequired(Predicate<InOutOperationContext> predicate)`
Set the predicate which determines whether an Assertion SubjectConfirmationData Address is required.
`void`
`setCheckAddress(Predicate<InOutOperationContext> predicate)`
Set the predicate which determines whether an Assertion's network address(es) should be checked.
`void`
`setClockSkew(Duration skew)`
Set the clock skew.
`void`
`setClockSkewLookupStrategy(Function<InOutOperationContext,Duration> strategy)`
Set the strategy by which to resolve the clock skew.
`void`
`setIncludeSelfEntityIDAsRecipient(Predicate<InOutOperationContext> predicate)`
Set the predicate which determines whether to include the self entityID as a valid Recipient.
`void`
`setInResponseTo(Function<InOutOperationContext,String> function)`
Set the function for determining the valid InResponseTo.
`void`
`setInResponseToIgnored(Predicate<InOutOperationContext> predicate)`
Set the predicate which determines whether an Assertion SubjectConfirmationData InResponseTo is ignored.
`void`
`setInResponseToRequired(Predicate<InOutOperationContext> predicate)`
Set the predicate which determines whether an Assertion SubjectConfirmationData InResponseTo is required.
`void`
`setLifetime(Duration duration)`
Set the lifetime.
`void`
`setLifetimeLookupStrategy(Function<InOutOperationContext,Duration> strategy)`
Set the strategy by which to resolve the lifetime.
`void`
`setMaximumTimeSinceAuthn(Function<InOutOperationContext,Duration> function)`
Set the function for determining the max allowed time since authentication.
`void`
`setNotBeforeRequired(Predicate<InOutOperationContext> predicate)`
Set the predicate which determines whether an Assertion SubjectConfirmationData NotBefore is required.
`void`
`setNotOnOrAfterRequired(Predicate<InOutOperationContext> predicate)`
Set the predicate which determines whether an Assertion SubjectConfirmationData NotOnOrAfter is required.
`void`
`setRecipientRequired(Predicate<InOutOperationContext> predicate)`
Set the predicate which determines whether an Assertion SubjectConfirmationData Recipient is required.
`void`
`setRequiredConditions(Set<QName> conditions)`
Set the set of required Conditions.
`void`
`setRequireEntityIssuer(Predicate<InOutOperationContext> predicate)`
Get the predicate which determines whether to require the Issuer contain the `NameIDType.ENTITY` Format.
`void`
`setSecurityParametersLookupStrategy(Function<InOutOperationContext,SecurityParametersContext> strategy)`
Set the strategy by which to resolve a `SecurityParametersContext`.
`void`
`setSelfEntityID(Function<InOutOperationContext,String> function)`
Set the function for determining the self entityID.
`void`
`setSignatureCriteriaSetFunction(Function<Pair<InOutOperationContext,Assertion>,CriteriaSet> function)`
Set the function for resolving the signature validation CriteriaSet for a particular function.
`void`
`setSignatureRequired(Predicate<InOutOperationContext> predicate)`
Set the predicate which determines whether an Assertion signature is required.
`void`
`setValidIssuers(Function<InOutOperationContext,Set<String>> function)`
Set the function for determining the valid Issuer values

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface java.util.function.Function

`andThen, compose`

## Field Details

### log

@Nonnull private org.slf4j.Logger log
Logger.

### clockSkew

@Nullable private Function<InOutOperationContext,Duration> clockSkew
A function for resolving the clock skew to apply.

### lifetime

@Nullable private Function<InOutOperationContext,Duration> lifetime
A function for resolving the lifetime to apply.

### signatureCriteriaSetFunction

@Nullable private Function<Pair<InOutOperationContext,Assertion>,CriteriaSet> signatureCriteriaSetFunction
A function for resolving the signature validation CriteriaSet for a particular function.

### signatureRequired

@Nonnull private Predicate<InOutOperationContext> signatureRequired
Predicate for determining whether an Assertion signature is required.

### checkAddress

@Nonnull private Predicate<InOutOperationContext> checkAddress
Predicate for determining whether an Assertion's network address(es) should be checked.

### maximumTimeSinceAuthn

@Nullable private Function<InOutOperationContext,Duration> maximumTimeSinceAuthn
Function for determining the max allowed time since authentication.

### includeSelfEntityIDAsRecipient

@Nonnull private Predicate<InOutOperationContext> includeSelfEntityIDAsRecipient
Predicate for determining whether to include the self entityID as a valid Recipient.

### additionalAudiences

@Nullable private Function<InOutOperationContext,Set<String>> additionalAudiences
Function for determining additional valid audience values.

### validIssuers

@Nonnull private Function<InOutOperationContext,Set<String>> validIssuers
Function for determining additional valid Issuer values.

### selfEntityID

@Nonnull private Function<InOutOperationContext,String> selfEntityID
Function for determining the self entityID.

### requireEntityIssuer

@Nonnull private Predicate<InOutOperationContext> requireEntityIssuer
Predicate for determining whether to require issuer be of the `NameIDType.ENTITY` format.

### inResponseTo

@Nullable private Function<InOutOperationContext,String> inResponseTo
Function for determining the valid InResponseTo value.

### inResponseToIgnored

@Nonnull private Predicate<InOutOperationContext> inResponseToIgnored
Predicate for determining whether an Assertion SubjectConfirmationData InResponseTo is ignored.

### inResponseToRequired

@Nonnull private Predicate<InOutOperationContext> inResponseToRequired
Predicate for determining whether an Assertion SubjectConfirmationData InResponseTo is required.

### recipientRequired

@Nonnull private Predicate<InOutOperationContext> recipientRequired
Predicate for determining whether an Assertion SubjectConfirmationData Recipient is required.

### notBeforeRequired

@Nonnull private Predicate<InOutOperationContext> notBeforeRequired
Predicate for determining whether an Assertion SubjectConfirmationData NotBefore is required.

### notOnOrAfterRequired

@Nonnull private Predicate<InOutOperationContext> notOnOrAfterRequired
Predicate for determining whether an Assertion SubjectConfirmationData NotOnOrAfter is required.

### addressRequired

@Nonnull private Predicate<InOutOperationContext> addressRequired
Predicate for determining whether an Assertion SubjectConfirmationData Address is required.

### requiredConditions

@Nonnull private Set<QName> requiredConditions
The set of required Conditions.

### securityParametersLookupStrategy

private Function<InOutOperationContext,SecurityParametersContext> securityParametersLookupStrategy
Resolver for security parameters context.

## Constructor Details

### DefaultAssertionValidationContextBuilder

public DefaultAssertionValidationContextBuilder()
Constructor.

## Method Details

### getClockSkew

@Nullable public Function<InOutOperationContext,Duration> getClockSkew()
Get the strategy by which to resolve the clock skew.

Returns:
  lookup strategy
Since:
  4.1.0

### setClockSkew

public void setClockSkew(@Nullable Duration skew)
Set the clock skew.

Parameters:
  `skew` - clock skew
Since:
  4.1.0

### setClockSkewLookupStrategy

public void setClockSkewLookupStrategy(@Nullable Function<InOutOperationContext,Duration> strategy)
Set the strategy by which to resolve the clock skew.

Parameters:
  `strategy` - lookup strategy
Since:
  4.1.0

### getLifetime

@Nullable public Function<InOutOperationContext,Duration> getLifetime()
Get the strategy by which to resolve the lifetime.

Returns:
  lookup strategy
Since:
  4.2.0

### setLifetime

public void setLifetime(@Nullable Duration duration)
Set the lifetime.

Parameters:
  `duration` - lifetime
Since:
  4.2.0

### setLifetimeLookupStrategy

public void setLifetimeLookupStrategy(@Nullable Function<InOutOperationContext,Duration> strategy)
Set the strategy by which to resolve the lifetime.

Parameters:
  `strategy` - lookup strategy
Since:
  4.2.0

### getSecurityParametersLookupStrategy

@Nonnull public Function<InOutOperationContext,SecurityParametersContext> getSecurityParametersLookupStrategy()
Get the strategy by which to resolve a `SecurityParametersContext`.

Returns:
  the lookup strategy

### setSecurityParametersLookupStrategy

public void setSecurityParametersLookupStrategy(@Nonnull Function<InOutOperationContext,SecurityParametersContext> strategy)
Set the strategy by which to resolve a `SecurityParametersContext`.

Parameters:
  `strategy` - the strategy function

### getRequiredConditions

@Nonnull public Set<QName> getRequiredConditions()
Get the set of required Conditions.

Returns:
  the required conditions, may be null

### setRequiredConditions

public void setRequiredConditions(@Nullable Set<QName> conditions)
Set the set of required Conditions.

Parameters:
  `conditions` - the required conditions

### getIncludeSelfEntityIDAsRecipient

@Nonnull public Predicate<InOutOperationContext> getIncludeSelfEntityIDAsRecipient()
Get the predicate which determines whether to include the self entityID as a valid Recipient.

Defaults to an always false predicate;

Returns:
  the predicate

### setIncludeSelfEntityIDAsRecipient

public void setIncludeSelfEntityIDAsRecipient(@Nonnull Predicate<InOutOperationContext> predicate)
Set the predicate which determines whether to include the self entityID as a valid Recipient.

Defaults to an always false predicate.

Parameters:
  `predicate` - the predicate, must be non-null

### getSignatureRequired

@Nonnull public Predicate<InOutOperationContext> getSignatureRequired()
Get the predicate which determines whether an Assertion signature is required.

Defaults to an always true predicate;

Returns:
  the predicate

### setSignatureRequired

public void setSignatureRequired(@Nonnull Predicate<InOutOperationContext> predicate)
Set the predicate which determines whether an Assertion signature is required.

Defaults to an always true predicate.

Parameters:
  `predicate` - the predicate, must be non-null

### setInResponseTo

public void setInResponseTo(@Nullable Function<InOutOperationContext,String> function)
Set the function for determining the valid InResponseTo.

Defaults to null.

Parameters:
  `function` - the function, may be null

### getInResponseTo

@Nullable public Function<InOutOperationContext,String> getInResponseTo()
Get the function for determining the valid InResponseTo.

Defaults to null.

Returns:
  the function

### getInResponseToRequired

@Nonnull public Predicate<InOutOperationContext> getInResponseToRequired()
Get the predicate which determines whether an Assertion SubjectConfirmationData InResponseTo is required.

Defaults to an always false predicate;

Returns:
  the predicate

### setInResponseToRequired

public void setInResponseToRequired(@Nonnull Predicate<InOutOperationContext> predicate)
Set the predicate which determines whether an Assertion SubjectConfirmationData InResponseTo is required.

Defaults to an always false predicate.

Parameters:
  `predicate` - the predicate, must be non-null

### getInResponseToIgnored

@Nonnull public Predicate<InOutOperationContext> getInResponseToIgnored()
Get the predicate which determines whether an Assertion SubjectConfirmationData InResponseTo is ignored.

Defaults to an always false predicate;

Returns:
  the predicate
Since:
  5.2.0

### setInResponseToIgnored

public void setInResponseToIgnored(@Nonnull Predicate<InOutOperationContext> predicate)
Set the predicate which determines whether an Assertion SubjectConfirmationData InResponseTo is ignored.

Defaults to an always false predicate.

Parameters:
  `predicate` - the predicate, must be non-null
Since:
  5.2.0

### getRecipientRequired

@Nonnull public Predicate<InOutOperationContext> getRecipientRequired()
Get the predicate which determines whether an Assertion SubjectConfirmationData Recipient is required.

Defaults to an always false predicate;

Returns:
  the predicate

### setRecipientRequired

public void setRecipientRequired(@Nonnull Predicate<InOutOperationContext> predicate)
Set the predicate which determines whether an Assertion SubjectConfirmationData Recipient is required.

Defaults to an always false predicate.

Parameters:
  `predicate` - the predicate, must be non-null

### getNotBeforeRequired

@Nonnull public Predicate<InOutOperationContext> getNotBeforeRequired()
Get the predicate which determines whether an Assertion SubjectConfirmationData NotBefore is required.

Defaults to an always false predicate;

Returns:
  the predicate

### setNotBeforeRequired

public void setNotBeforeRequired(@Nonnull Predicate<InOutOperationContext> predicate)
Set the predicate which determines whether an Assertion SubjectConfirmationData NotBefore is required.

Defaults to an always false predicate.

Parameters:
  `predicate` - the predicate, must be non-null

### getNotOnOrAfterRequired

@Nonnull public Predicate<InOutOperationContext> getNotOnOrAfterRequired()
Get the predicate which determines whether an Assertion SubjectConfirmationData NotOnOrAfter is required.

Defaults to an always false predicate;

Returns:
  the predicate

### setNotOnOrAfterRequired

public void setNotOnOrAfterRequired(@Nonnull Predicate<InOutOperationContext> predicate)
Set the predicate which determines whether an Assertion SubjectConfirmationData NotOnOrAfter is required.

Defaults to an always false predicate.

Parameters:
  `predicate` - the predicate, must be non-null

### getAddressRequired

@Nonnull public Predicate<InOutOperationContext> getAddressRequired()
Get the predicate which determines whether an Assertion SubjectConfirmationData Address is required.

Defaults to an always false predicate;

Returns:
  the predicate

### setAddressRequired

public void setAddressRequired(@Nonnull Predicate<InOutOperationContext> predicate)
Set the predicate which determines whether an Assertion SubjectConfirmationData Address is required.

Defaults to an always false predicate.

Parameters:
  `predicate` - the predicate, must be non-null

### getCheckAddress

@Nonnull public Predicate<InOutOperationContext> getCheckAddress()
Get the predicate which determines whether an Assertion's network address(es) should be checked.

Defaults to an always true predicate;

Returns:
  the predicate

### setCheckAddress

public void setCheckAddress(@Nonnull Predicate<InOutOperationContext> predicate)
Set the predicate which determines whether an Assertion's network address(es) should be checked.

Defaults to an always true predicate.

Parameters:
  `predicate` - the predicate, must be non-null

### getAdditionalAudiences

@Nullable public Function<InOutOperationContext,Set<String>> getAdditionalAudiences()
Get the function for determining additional audience values.

Defaults to null.

Returns:
  the function

### setAdditionalAudiences

public void setAdditionalAudiences(@Nullable Function<InOutOperationContext,Set<String>> function)
Set the function for determining additional audience values.

Defaults to null.

Parameters:
  `function` - the function, may be null

### getSelfEntityID

@Nonnull public Function<InOutOperationContext,String> getSelfEntityID()
Get the function for determining the self entityID.

Defaults to an implementation which resolves from the inbound `SAMLSelfEntityContext`.

Returns:
  the function

### setSelfEntityID

public void setSelfEntityID(@Nonnull Function<InOutOperationContext,String> function)
Set the function for determining the self entityID.

Defaults to an implementation which resolves from the inbound `SAMLSelfEntityContext`.

Parameters:
  `function` - the function, may be null

### getValidIssuers

@Nonnull public Function<InOutOperationContext,Set<String>> getValidIssuers()
Get the function for determining the valid Issuer values

Defaults to an implementation which resolves the outbound SAML peer entityID.

Returns:
  the function

### setValidIssuers

public void setValidIssuers(@Nonnull Function<InOutOperationContext,Set<String>> function)
Set the function for determining the valid Issuer values

Defaults to an implementation which resolves the outbound SAML peer entityID.

Parameters:
  `function` - the function, may be null

### getRequireEntityIssuer

@Nonnull public Predicate<InOutOperationContext> getRequireEntityIssuer()
Get the predicate which determines whether to require the Issuer contain the `NameIDType.ENTITY` Format.

Returns:
  predicate
Since:
  5.2.0

### setRequireEntityIssuer

public void setRequireEntityIssuer(@Nonnull Predicate<InOutOperationContext> predicate)
Get the predicate which determines whether to require the Issuer contain the `NameIDType.ENTITY` Format.

Defaults to false.

Parameters:
  `predicate` - the condition to set
Since:
  5.2.0

### getMaximumTimeSinceAuthn

@Nullable public Function<InOutOperationContext,Duration> getMaximumTimeSinceAuthn()
Get the function for determining the max allowed time since authentication.

Defaults to null.

Returns:
  the function

### setMaximumTimeSinceAuthn

public void setMaximumTimeSinceAuthn(@Nullable Function<InOutOperationContext,Duration> function)
Set the function for determining the max allowed time since authentication.

Defaults to null.

Parameters:
  `function` - the function, may be null

### getSignatureCriteriaSetFunction

@Nullable public Function<Pair<InOutOperationContext,Assertion>,CriteriaSet> getSignatureCriteriaSetFunction()
Get the function for resolving the signature validation CriteriaSet for a particular function.

Defaults to: `null`.

Returns:
  a criteria set instance, or null

### setSignatureCriteriaSetFunction

public void setSignatureCriteriaSetFunction(@Nullable Function<Pair<InOutOperationContext,Assertion>,CriteriaSet> function)
Set the function for resolving the signature validation CriteriaSet for a particular function.

Defaults to: `null`.

Parameters:
  `function` - the resolving function, may be null

### apply

@Nullable public ValidationContext apply(@Nullable AssertionValidationInput input)

Specified by:
  `apply` in interface `Function<AssertionValidationInput,ValidationContext>`

### buildStaticParameters

@Nonnull protected Map<String,Object> buildStaticParameters(@Nonnull AssertionValidationInput input)
Build the static parameters map for input to the `ValidationContext`.

Parameters:
  `input` - the assertion validation input
Returns:
  the static parameters map

### populateSignatureParameters

private void populateSignatureParameters(@Nonnull Map<String,Object> staticParams, @Nonnull AssertionValidationInput input)
Populate the static signature parameters.

Parameters:
  `staticParams` - the parameters being populated
  `input` - validation input

### populateConditionsParameters

private void populateConditionsParameters(@Nonnull Map<String,Object> staticParams, @Nonnull AssertionValidationInput input)
Populate the static Conditions parameters.

Parameters:
  `staticParams` - the parameters being populated
  `input` - validation input

### populateSubjectConfirmationParameters

private void populateSubjectConfirmationParameters(@Nonnull Map<String,Object> staticParams, @Nonnull AssertionValidationInput input, @Nonnull Set<InetAddress> validAddresses, @Nonnull Boolean checkAddressEnabled)
Populate the static SubjectConfirmation parameters.

Parameters:
  `staticParams` - the parameters being populated
  `input` - validation input
  `validAddresses` - the valid addresses
  `checkAddressEnabled` - whether address checking is enabled

### populateStatementParams

private void populateStatementParams(@Nonnull Map<String,Object> staticParams, @Nonnull AssertionValidationInput input, @Nonnull Set<InetAddress> validAddresses, @Nonnull Boolean checkAddressEnabled)
Populate the static Statement params.

Parameters:
  `staticParams` - the parameters being populated
  `input` - validation input
  `validAddresses` - the valid addresses
  `checkAddressEnabled` - whether address checking is enabled

### getRequiredConditions

@Nonnull protected Set<QName> getRequiredConditions(@Nonnull AssertionValidationInput input)
Get the set of required Conditions.

The default behavior is to return the locally-configured data via `getRequiredConditions()`.

Parameters:
  `input` - the assertion validation input
Returns:
  the set of required Condition names, may be null

### getSignatureCriteriaSet

@Nonnull protected CriteriaSet getSignatureCriteriaSet(@Nonnull AssertionValidationInput input)
Get the signature validation criteria set.

This implementation first evaluates the result of applying the function `getSignatureCriteriaSetFunction()`, if configured. If that evaluation did not produce an `EntityIdCriterion`, one is added based on the issuer of the `Assertion`. If that evaluation did not produce an instance of `UsageCriterion`, one is added with the value of `UsageType.SIGNING`.

Finally the following criteria are added if not already present and if the corresponding data is available in the inbound `MessageContext`:

- `RoleDescriptorCriterion`
- `EntityRoleCriterion`
- `ProtocolCriterion`

Parameters:
  `input` - the assertion validation input
Returns:
  the criteria set based on the message context data

### populateSignatureCriteriaFromInboundContext

protected void populateSignatureCriteriaFromInboundContext(@Nonnull CriteriaSet criteriaSet, @Nonnull MessageContext inboundContext)
Populate signature criteria from the specified `MessageContext`.

- `RoleDescriptorCriterion`
- `EntityRoleCriterion`
- `ProtocolCriterion`

Parameters:
  `criteriaSet` - the criteria set to populate
  `inboundContext` - the inbound message context

### getAttesterCertificate

@Nullable protected X509Certificate getAttesterCertificate(@Nonnull AssertionValidationInput input)
Get the attesting entity's `X509Certificate`.

This implementation returns the client TLS certificate present in the `HttpServletRequest`, or null if one is not present.

Parameters:
  `input` - the assertion validation input
Returns:
  the entity certificate, or null

### getAttesterPublicKey

@Nullable protected PublicKey getAttesterPublicKey(@Nonnull AssertionValidationInput input)
Get the attesting entity's `PublicKey`.

This implementation returns null. Subclasses should override to implement specific logic.

Parameters:
  `input` - the assertion validation input
Returns:
  the entity public key, or null

### getValidRecipients

@Nonnull @Unmodifiable @NotLive protected Set<String> getValidRecipients(@Nonnull AssertionValidationInput input)
Get the valid recipient endpoints for attestation.

This implementation returns a set containing the 2 values;

1. the result of evaluating `SAMLBindingSupport.getActualReceiverEndpointURI(MessageContext, HttpServletRequest)`
2. if enabled via the eval of `getIncludeSelfEntityIDAsRecipient()`, the value from evaluating `getSelfEntityID()` if non-null

Parameters:
  `input` - the assertion validation input
Returns:
  set of recipient endpoint URI's

### getValidAddresses

@Nonnull @Unmodifiable @NotLive protected Set<InetAddress> getValidAddresses(@Nonnull AssertionValidationInput input)
Get the set of addresses which are valid for subject confirmation.

This implementation simply returns the set based on `getAttesterIPAddress(AssertionValidationInput)`, if that produces a value. Otherwise an empty set is returned.

Parameters:
  `input` - the assertion validation input
Returns:
  the set of valid addresses

### getAttesterIPAddress

@Nullable protected String getAttesterIPAddress(@Nonnull AssertionValidationInput input)
Get the attester's IP address.

This implementation returns the value of `ServletRequest.getRemoteAddr()`.

Parameters:
  `input` - the assertion validation input
Returns:
  the IP address of the attester

### getValidAudiences

@Nonnull @Unmodifiable @NotLive protected Set<String> getValidAudiences(@Nonnull AssertionValidationInput input)
Get the valid audiences for attestation.

This implementation returns a set containing the union of:

1. the result of `getSelfEntityID()`, if non-null
2. the result of evaluating `getAdditionalAudiences()`, if non-null

Parameters:
  `input` - the assertion validation input
Returns:
  set of audience URI's