Package net.shibboleth.idp.saml.profile.impl

Class ExtractSubjectFromRequest

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.saml.profile.impl.ExtractSubjectFromRequest

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ExtractSubjectFromRequest
extends AbstractProfileAction

Action that extracts a SAML Subject from an inbound message, and prepares a SubjectCanonicalizationContext to process it into a principal identity.

If the inbound message does not supply a NameIdentifier or NameID to process, then nothing is done, and the local event ID NO_SUBJECT is signaled.

A policy predicate may also be executed to control the conditions under which a subject name may be used by a requester, possibly resulting in a AuthnEventIds.INVALID_SUBJECT event.

Otherwise, a custom Principal of the appropriate type is wrapped around the identifier object and a Java Subject is prepared for canonicalization.

Event:

EventIds.PROCEED_EVENT_ID, AuthnEventIds.INVALID_SUBJECT, NO_SUBJECT

Postcondition:

If "proceed" signaled, then ProfileRequestContext.getSubcontext(SubjectCanonicalizationContext.class) != null

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	ExtractSubjectFromRequest.SubjectNameLookupFunction	Lookup function that returns the NameIdentifier or NameID from the request in the inbound message context.

Field Summary

Fields

Modifier and Type	Field	Description
private final org.slf4j.Logger	log	Class logger.
private SAMLObject	nameIdentifier	SAML 1 or 2 identifier object to wrap for c14n.
private Predicate<ProfileRequestContext>	nameIDPolicyPredicate	Predicate to validate use of NameID or NameIdentifier in subject.
static final String	NO_SUBJECT	Local event signaling that canonicalization is unnecessary.
private Function<ProfileRequestContext,String>	requesterLookupStrategy	Function used to obtain the requester ID.
private Function<ProfileRequestContext,String>	responderLookupStrategy	Function used to obtain the responder ID.

Constructor Summary

Constructors

Constructor	Description
ExtractSubjectFromRequest()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext)
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext)
void	setNameIDPolicyPredicate(Predicate<ProfileRequestContext> predicate)	Set a predicate used to validate use of the NameID or NameIdentifier in the subject.
void	setRequesterLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the strategy used to locate the requester ID for canonicalization.
void	setResponderLookupStrategy(Function<ProfileRequestContext,String> strategy)	Set the strategy used to locate the responder ID for canonicalization.

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

NO_SUBJECT

@Nonnull
@NotEmpty
public static final String NO_SUBJECT

Local event signaling that canonicalization is unnecessary.

See Also:

• Constant Field Values

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

nameIDPolicyPredicate

@Nullable
private Predicate<ProfileRequestContext> nameIDPolicyPredicate

Predicate to validate use of NameID or NameIdentifier in subject.

requesterLookupStrategy

@Nullable
private Function<ProfileRequestContext,String> requesterLookupStrategy

Function used to obtain the requester ID.

responderLookupStrategy

@Nullable
private Function<ProfileRequestContext,String> responderLookupStrategy

Function used to obtain the responder ID.

nameIdentifier

@NonnullBeforeExec
private SAMLObject nameIdentifier

SAML 1 or 2 identifier object to wrap for c14n.

Constructor Details

ExtractSubjectFromRequest

public ExtractSubjectFromRequest()
                          throws ComponentInitializationException

Constructor.

Throws:

ComponentInitializationException - if unable to initialize default objects

Method Details

setRequesterLookupStrategy

public void setRequesterLookupStrategy(@Nullable
 Function<ProfileRequestContext,String> strategy)

Set the strategy used to locate the requester ID for canonicalization.

Parameters:

strategy - lookup strategy

setResponderLookupStrategy

public void setResponderLookupStrategy(@Nullable
 Function<ProfileRequestContext,String> strategy)

Set the strategy used to locate the responder ID for canonicalization.

Parameters:

strategy - lookup strategy

setNameIDPolicyPredicate

public void setNameIDPolicyPredicate(@Nullable
 Predicate<ProfileRequestContext> predicate)

Set a predicate used to validate use of the NameID or NameIdentifier in the subject.

Parameters:

predicate - predicate to use

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doPreExecute in class AbstractConditionalProfileAction

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext)

Overrides:

doExecute in class AbstractProfileAction