Package net.shibboleth.idp.authn.impl

Class ValidateCredentials

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.authn.AbstractAuthenticationAction

net.shibboleth.idp.authn.AbstractValidationAction

net.shibboleth.idp.authn.impl.AbstractAuditingValidationAction

net.shibboleth.idp.authn.impl.ValidateCredentials

All Implemented Interfaces:

CredentialValidator.ErrorHandler, CredentialValidator.WarningHandler, PrincipalSupportingComponent, Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ValidateCredentials
extends AbstractAuditingValidationAction
implements CredentialValidator.WarningHandler, CredentialValidator.ErrorHandler

An action that processes a list of CredentialValidator objects to produce an AuthenticationResult.

Since:

4.0.0

Event:

EventIds.PROCEED_EVENT_ID, others on error

Precondition:

ProfileRequestContext.getSubcontext(AuthenticationContext.class).getAttemptedFlow() != null

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	ValidateCredentials.UsernamePasswordCleanupHook	A default cleanup hook that removes the UsernamePasswordContext from the tree.

Field Summary

Fields

Modifier and Type	Field	Description
private List<CredentialValidator>	credentialValidators	Ordered list of validators.
private CredentialValidator	currentValidator	Currently executing validator.
private static final String	DEFAULT_METRIC_NAME	Default prefix for metrics.
private boolean	errorSignaled	Tracks whether an error event was signaled.
private AccountLockoutManager	lockoutManager	Optional lockout management interface.
private final org.slf4j.Logger	log	Class logger.
private boolean	requireAll	Whether all validators must succeed.
private Collection<Subject>	results	Results from successful validators.
private boolean	warningSignaled	Tracks whether a warning event was signaled.

Constructor Summary

Constructors

Constructor	Description
ValidateCredentials()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)	Performs this authentication action.
protected Map<String,String>	getAuditFields(ProfileRequestContext profileRequestContext)	Subclasses can override this method to supply additional audit fields to store.
String	getMetricName()	Get the base name to use for metrics reported.
void	handleError(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext, Exception e, String eventId)	Adds an exception encountered during the action to an AuthenticationErrorContext, creating one if necessary, beneath the AuthenticationContext.
void	handleError(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext, String message, String eventId)	Evaluates a message as a potential match as a "classified" error and if matched, the classification label is attached to an AuthenticationErrorContext and used as the resulting event for the action.
void	handleWarning(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext, String message, String eventId)	Evaluates a message as a potential match as a "classified" warning and if matched, the classification label is attached to an AuthenticationWarningContext and used as the resulting event for the action.
protected Subject	populateSubject(Subject subject)	Subclasses must override this method to complete the population of the Subject with Principal and credential information based on the validation they perform.
protected void	recordSuccess(ProfileRequestContext profileRequestContext)	Record a successful authentication attempt against the configured counter.
void	setLockoutManager(AccountLockoutManager manager)	Set an account lockout management component.
void	setRequireAll(boolean flag)	Set whether to execute and require success from all configured validators, or stop at the first successful result.
void	setValidators(List<CredentialValidator> validators)	Set the list of validators to use.

Methods inherited from class net.shibboleth.idp.authn.impl.AbstractAuditingValidationAction

doAudit, doExecute, getAuditContext, recordFailure, setAuditContextCreationStrategy, setPopulateAuditContextAction, setWriteAuditLogAction

Methods inherited from class net.shibboleth.idp.authn.AbstractValidationAction

addDefaultPrincipals, buildAuthenticationResult, doPreExecute, getClassifiedErrors, getCleanupHook, getRequesterLookupStrategy, getResponderLookupStrategy, getResultCachingPredicate, getSubject, getSupportedPrincipals, setAddDefaultPrincipals, setClassifiedMessages, setCleanupHook, setMetricName, setRequesterLookupStrategy, setResponderLookupStrategy, setResultCachingPredicate, setSupportedPrincipals

Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

doExecute, doPreExecute, setAuthenticationContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

DEFAULT_METRIC_NAME

@Nonnull
@NotEmpty
private static final String DEFAULT_METRIC_NAME

Default prefix for metrics.

See Also:

• Constant Field Values

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

credentialValidators

@Nonnull
private List<CredentialValidator> credentialValidators

Ordered list of validators.

requireAll

private boolean requireAll

Whether all validators must succeed.

lockoutManager

@Nullable
private AccountLockoutManager lockoutManager

Optional lockout management interface.

results

@Nonnull
private Collection<Subject> results

Results from successful validators.

currentValidator

@Nullable
private CredentialValidator currentValidator

Currently executing validator.

warningSignaled

private boolean warningSignaled

Tracks whether a warning event was signaled.

errorSignaled

private boolean errorSignaled

Tracks whether an error event was signaled.

Constructor Details

ValidateCredentials

public ValidateCredentials()

Constructor.

Method Details

setLockoutManager

public void setLockoutManager(@Nullable
 AccountLockoutManager manager)

Set an account lockout management component.

Parameters:

manager - lockout manager

setValidators

public void setValidators(@Nullable
 List<CredentialValidator> validators)

Set the list of validators to use.

Parameters:

validators - validators to use

setRequireAll

public void setRequireAll(boolean flag)

Set whether to execute and require success from all configured validators, or stop at the first successful result.

Parameters:

flag - flag to set

getMetricName

@Nonnull
@NotEmpty
public String getMetricName()

Get the base name to use for metrics reported.

Overrides:

getMetricName in class AbstractValidationAction

Returns:

root for name of metrics

handleWarning

public void handleWarning(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext,
 @Nullable
 String message,
 @Nonnull @NotEmpty
 String eventId)

Evaluates a message as a potential match as a "classified" warning and if matched, the classification label is attached to an AuthenticationWarningContext and used as the resulting event for the action.

If no match, the supplied eventId is used as the result.

If multiple matches, the first matching label is used as the result, but each match is added to the context.

Specified by:

handleWarning in interface CredentialValidator.WarningHandler

Overrides:

handleWarning in class AbstractValidationAction

Parameters:

profileRequestContext - the current profile request context

authenticationContext - the current authentication context

message - to process

eventId - the event to "return" via an EventContext if the message is not classified

handleError

public void handleError(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext,
 @Nullable
 String message,
 @Nonnull @NotEmpty
 String eventId)

Evaluates a message as a potential match as a "classified" error and if matched, the classification label is attached to an AuthenticationErrorContext and used as the resulting event for the action.

If no match, the supplied eventId is used as the result.

If multiple matches, the first matching label is used as the result, but each match is added to the context.

Specified by:

handleError in interface CredentialValidator.ErrorHandler

Overrides:

handleError in class AbstractValidationAction

Parameters:

profileRequestContext - the current profile request context

authenticationContext - the current authentication context

message - to process

eventId - the event to "return" via an EventContext if the message is not classified

handleError

public void handleError(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext,
 @Nonnull
 Exception e,
 @Nonnull @NotEmpty
 String eventId)

Adds an exception encountered during the action to an AuthenticationErrorContext, creating one if necessary, beneath the AuthenticationContext.

The exception message is evaluated as a potential match as a "classified" error and if matched, the classification label is attached to the AuthenticationErrorContext and used as the resulting event for the action.

Specified by:

handleError in interface CredentialValidator.ErrorHandler

Overrides:

handleError in class AbstractValidationAction

Parameters:

profileRequestContext - the current profile request context

authenticationContext - the current authentication context

e - the exception to process

eventId - the event to "return" via an EventContext if the exception message is not classified

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Performs this authentication action. Default implementation throws an exception.

Overrides:

doExecute in class AbstractAuthenticationAction

Parameters:

profileRequestContext - the current IdP profile request context

authenticationContext - the current authentication context

populateSubject

@Nonnull
protected Subject populateSubject(@Nonnull
 Subject subject)

Subclasses must override this method to complete the population of the Subject with Principal and credential information based on the validation they perform.

Typically this will include attaching a UsernamePrincipal, but this is not a requirement if other components are suitably overridden.

Specified by:

populateSubject in class AbstractValidationAction

Parameters:

subject - subject to populate

Returns:

the input subject

recordSuccess

protected void recordSuccess(@Nonnull
 ProfileRequestContext profileRequestContext)

Record a successful authentication attempt against the configured counter. Records nothing if the metrics registry is not installed into the runtime.

Also optionally clears account lockout state.

Overrides:

recordSuccess in class AbstractAuditingValidationAction

Parameters:

profileRequestContext - profile request context

getAuditFields

@Nonnull
@Unmodifiable
@NotLive
protected Map<String,String> getAuditFields(@Nonnull
 ProfileRequestContext profileRequestContext)

Subclasses can override this method to supply additional audit fields to store.

Overrides:

getAuditFields in class AbstractAuditingValidationAction

Parameters:

profileRequestContext - profile request context

Returns:

audit fields