Package net.shibboleth.idp.attribute.impl

Class ComputedPairwiseIdStore

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

net.shibboleth.idp.attribute.impl.ComputedPairwiseIdStore

All Implemented Interfaces:

net.shibboleth.idp.attribute.PairwiseIdStore, net.shibboleth.utilities.java.support.component.Component, net.shibboleth.utilities.java.support.component.DestructableComponent, net.shibboleth.utilities.java.support.component.InitializableComponent

public class ComputedPairwiseIdStore
extends net.shibboleth.utilities.java.support.component.AbstractInitializableComponent
implements net.shibboleth.idp.attribute.PairwiseIdStore

A PairwiseIdStore that generates a pairwise ID by computing the hash of a given attribute value, the entity ID of the recipient, and a provided salt.

The original implementation and values in common use relied on base64 encoding of the result, but due to discovery of the lack of appropriate case handling of identifiers by applications, the ability to use base32 has been added to eliminate the possibility of case conflicts.

Since:

4.0.0

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	ComputedPairwiseIdStore.Encoding	Post-digest encoding types.

Field Summary

Fields

Modifier and Type	Field	Description
private String	algorithm	JCE digest algorithm name to use.
private ComputedPairwiseIdStore.Encoding	encoding	The encoding to apply to the digest.
private Map<String,Map<String,String>>	exceptionMap	Override map to block or re-issue identifiers.
private Logger	log	Class logger.
private byte[]	salt	Salt used when computing the ID.
static String	WILDCARD_OVERRIDE	An override trigger to apply to all relying parties.

Constructor Summary

Constructors

Constructor	Description
ComputedPairwiseIdStore()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doInitialize()
String	getAlgorithm()	Get the JCE algorithm name of the digest algorithm to use (default is SHA).
net.shibboleth.idp.attribute.PairwiseId	getBySourceValue(net.shibboleth.idp.attribute.PairwiseId pid, boolean allowCreate)
private byte[]	getEffectiveSalt(String principalName, String relyingPartyId)	Get the effective salt to apply for a particular principal/RP pair, or null to refuse to generate one.
ComputedPairwiseIdStore.Encoding	getEncoding()	Get the post-digest encoding to use.
byte[]	getSalt()	Get the salt used when computing the ID.
void	setAlgorithm(String alg)	Set the JCE algorithm name of the digest algorithm to use (default is SHA).
void	setEncodedSalt(String newValue)	Set the base64-encoded salt used when computing the ID.
void	setEncoding(ComputedPairwiseIdStore.Encoding enc)	Set the post-digest encoding to use.
void	setExceptionMap(Map<String,Map<String,String>> map)	Install map of exceptions that override standard generation.
void	setSalt(byte[] newValue)	Set the salt used when computing the ID.
void	setSalt(String newValue)	Set the salt used when computing the ID.

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, doDestroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

WILDCARD_OVERRIDE

@Nonnull
@NotEmpty
public static final String WILDCARD_OVERRIDE

An override trigger to apply to all relying parties.

See Also:

Constant Field Values

log

@Nonnull
private final Logger log

Class logger.

salt

@NonnullAfterInit
private byte[] salt

Salt used when computing the ID.

algorithm

@Nonnull
@NotEmpty
private String algorithm

JCE digest algorithm name to use.

encoding

@Nonnull
private ComputedPairwiseIdStore.Encoding encoding

The encoding to apply to the digest.

exceptionMap

@Nonnull
private Map<String,Map<String,String>> exceptionMap

Override map to block or re-issue identifiers.

Constructor Detail

ComputedPairwiseIdStore

public ComputedPairwiseIdStore()

Constructor.

Method Detail

getSalt

@NonnullAfterInit
public byte[] getSalt()

Get the salt used when computing the ID.

Returns:

salt used when computing the ID

setSalt

public void setSalt(@Nullable
                    byte[] newValue)

Set the salt used when computing the ID.

An empty/null input is ignored.

Parameters:

newValue - used when computing the ID

setSalt

public void setSalt(@Nullable
                    String newValue)

Set the salt used when computing the ID.

An empty/null input is ignored.

Parameters:

newValue - used when computing the ID

setEncodedSalt

public void setEncodedSalt(@Nullable
                           String newValue)

Set the base64-encoded salt used when computing the ID.

An empty/null input is ignored.

Parameters:

newValue - used when computing the ID

getAlgorithm

@Nonnull
@NotEmpty
public String getAlgorithm()

Get the JCE algorithm name of the digest algorithm to use (default is SHA).

Returns:

JCE message digest algorithm

setAlgorithm

public void setAlgorithm(@Nonnull @NotEmpty
                         String alg)

Set the JCE algorithm name of the digest algorithm to use (default is SHA).

Parameters:

alg - JCE message digest algorithm

getEncoding

@Nonnull
public ComputedPairwiseIdStore.Encoding getEncoding()

Get the post-digest encoding to use.

Returns:

encoding

setEncoding

public void setEncoding(@Nonnull
                        ComputedPairwiseIdStore.Encoding enc)

Set the post-digest encoding to use.

Parameters:

enc - encoding

setExceptionMap

public void setExceptionMap(@Nullable @NotEmpty
                            Map<String,Map<String,String>> map)

Install map of exceptions that override standard generation.

The map is keyed by principal name (or '*' for all), and the values are a map of relying party to salt overrides. A relying party of '*' applies to all parties. A null mapped value implies that no value should be generated, while a string value is fed into the computation in place of the default salt. Specific rules trump wildcarded rules.

Parameters:

map - exceptions to apply

doInitialize

protected void doInitialize()
                     throws net.shibboleth.utilities.java.support.component.ComponentInitializationException

Overrides:

doInitialize in class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

Throws:

net.shibboleth.utilities.java.support.component.ComponentInitializationException

getBySourceValue

@Nullable
public net.shibboleth.idp.attribute.PairwiseId getBySourceValue(@Nonnull
                                                                net.shibboleth.idp.attribute.PairwiseId pid,
                                                                boolean allowCreate)
                                                         throws IOException

Specified by:

getBySourceValue in interface net.shibboleth.idp.attribute.PairwiseIdStore

Throws:

IOException

getEffectiveSalt

@Nullable
private byte[] getEffectiveSalt(@Nonnull @NotEmpty
                                String principalName,
                                @Nonnull @NotEmpty
                                String relyingPartyId)

Get the effective salt to apply for a particular principal/RP pair, or null to refuse to generate one.

Parameters:

principalName - name of subject

relyingPartyId - name of relying party scope

Returns:

salt to use