Package net.shibboleth.idp.authn.impl
@NonnullElements
package net.shibboleth.idp.authn.impl
Implementation of various authentication actions.
-
ClassesClassDescriptionBase class for validation actions that includes new audit logging support.An action that extracts a resolved
IdPAttributevalue from anAttributeContextchild obtained via lookup function (by default a child of theSubjectCanonicalizationContext), and uses it as the result of subject canonicalization.Manager ofAuthenticationFlowDescriptorobjects.Handles serialization of results, delegating handling ofPrincipalobjects to one or morePrincipalSerializerplugins.DefaultPrincipalDeterminationStrategy<T extends Principal>Function that returns the first customPrincipalof a particular type found on theAuthenticationResultreturned byAuthenticationContext.getAuthenticationResult().Action that implements a JSON REST API for theAccountLockoutManagerinterface.Implementation of theExternalAuthenticationAPI that handles moving information in and out of request attributes.An action that extracts an asserted user identity from the incoming request, creates aUsernameContext, and attaches it to theAuthenticationContext.An action that extracts the user-agent's IP address from the incoming request, creates aUserAgentContext, and attaches it to theAuthenticationContext.An action that extracts the user-agent's identifier from the incoming request, creates aUserAgentContext, and attaches it to theAuthenticationContext./** An action that extracts a username and password from the HTTPHttpHeaders.AUTHORIZATIONheader, creates aUsernamePasswordContext, and attaches it to theAuthenticationContext.An action that extracts a username and password from an HTTP form body or query string, creates aUsernamePasswordContext, and attaches it to theAuthenticationContext.An authentication stage that extracts a username/password from the WSS Username/Password attached to a SOAP message.An action that extracts an X.509 certificate from the standard servlet request attribute, creates aCertificateContext, and attaches it to theAuthenticationContext.An authentication action that filters out potential authentication flows if the request requires forced authentication or max age behavior and the flows don't support forced authentication.An authentication action that filters out potential authentication flows if the request requires non-browser support and the flows require a browser.An authentication action that runs after a completed authentication flow (or the reuse of an active result) and transfers information from other contexts into aSubjectContextchild of theProfileRequestContext.An authentication action that completes MFA by producing a finalAuthenticationResultout of whatever constituent parts and pieces exist, by means of an overridable function, storing it in theAuthenticationContextand preparing a freshSubjectCanonicalizationContextto operate on.Default merging strategy to combine individualAuthenticationResultobjects into a single result.A password validator that authenticates against Apache htpasswd files.An action that creates anRequestedPrincipalContextand attaches it to the currentAuthenticationContext, if the profile request context contains aRelyingPartyContextwith anAuthenticationProfileConfigurationcontaining one or more default authentication methods.A password validator that authenticates against JAAS.A password validator that authenticates against Kerberos natively, with optional service ticket verification.Implementation ofCredentialConfigthat loads keystore and truststore data using aResource.A password validator that authenticates against LDAP natively.An action that populates anAuthenticationContextwith theAuthenticationFlowDescriptorobjects configured into the IdP, potential flows filtered by flow IDs from a lookup function.An action that creates and populates aMultiFactorAuthenticationContextwith the set of transition rules to use for coordinating activity, the executingAuthenticationFlowDescriptorand with any active "factors" found, if an active result from the MFA flow is present in theAuthenticationContext.An action that populates aSubjectCanonicalizationContextwith theSubjectCanonicalizationFlowDescriptorobjects configured into the IdP.An action to populate a username into a clearedUsernamePasswordContext, either from a form submission, a cookie, or an existing session to "prime" the login view.An action that extracts configured parameters from a servlet request and populatesAuthenticationContext.getAuthenticationStateMap()with the data.An implementation of theloginConfigStrategyforJAASCredentialValidatorwhich uses a supplied map to resolve the JAAS config to use.Extracts authentication information from the request and returns it via the IdP's external authentication interface.An authentication action that selects an authentication flow to invoke, or re-uses an existing result for SSO.A canonicalization action that selects a canonicalization flow to invoke.An action that operates on aSubjectCanonicalizationContextchild of the currentProfileRequestContext, and transforms the inputSubjectinto a principal name by searching for one and only oneUsernamePrincipalcustom principal.A predicate that determines if this action can run or not.Implementation ofEnumeratableAccountLockoutManagerinterface that relies on aStorageServiceto track lockout state.A function to generate a key for lockout storage.An authentication action that acts as the driver regulating execution of transitions between MFA stages.An action that processes a list ofCredentialValidatorobjects to produce anAuthenticationResult.A default cleanup hook that removes theUsernamePasswordContextfrom the tree.An action that checks for anExternalAuthenticationContextand directly produces anAuthenticationResultor records error state based on the contents.A default cleanup hook that removes aCertificateContextfrom the tree.An action that executes a deployer-supplied function and produces anAuthenticationResultbased on the function result.An action that checks for aUsernameContextand directly produces anAuthenticationResultbased on that identity.An action that ensures that a user-agent address found within aUserAgentContextis within a given range and generates anAuthenticationResult.An action that operates on aSubjectCanonicalizationContextchild of the currentProfileRequestContext, and transforms the inputSubjectinto a principal name by searching for one and only oneX509Certificatepublic credential, or in its absence one and only oneX500Principal.A predicate that determines if this action can run or not.Servlet compatible with theExternalAuthenticationinterface that extracts and validates an X.509 client certificate for user authentication.A credential validator that validates an X.509 certificate.Servlet filter to translate Apache mod_ssl certificate variables into Java servlet attributes.Implementation ofCredentialConfigthat loads trust and key material using aResource.