Package org.opensaml.saml.saml2.assertion.impl

Class OneTimeUseConditionValidator

java.lang.Object

org.opensaml.saml.saml2.assertion.impl.OneTimeUseConditionValidator

All Implemented Interfaces:

ConditionValidator

@ThreadSafe
public class OneTimeUseConditionValidator
extends Object
implements ConditionValidator

ConditionValidator used for OneTimeUse conditions.

Supports the following ValidationContext static parameters:

• SAML2AssertionValidationParameters.COND_ONE_TIME_USE_EXPIRES: Optional. If not supplied, defaults to the validator-wide value supplied at construction, or the default value, as retrieved via getReplayCacheExpires().

Supports the following ValidationContext dynamic parameters:

• None.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CACHE_CONTEXT	Cache context name.
private org.slf4j.Logger	log	Logger.
private final ReplayCache	replayCache	Replay cache used to track which assertions have been used.
private final Duration	replayCacheExpires	Time for disposal of value from cache.

Constructor Summary

Constructors

Constructor	Description
OneTimeUseConditionValidator(ReplayCache replay, Duration expires)	Constructor.

Method Summary

Modifier and Type	Method	Description
protected String	getCacheValue(Assertion assertion)	Get the string value which will be tracked in the cache for purposes of one-time use detection.
protected Instant	getExpires(Assertion assertion, ValidationContext context)	Get the one-time use expiration time for the assertion being evaluated.
protected Duration	getReplayCacheExpires()	Get the configured validator cache expiration interval.
QName	getServicedCondition()	Gets the element or schema type QName of the condition handled by this validator.
ValidationResult	validate(Condition condition, Assertion assertion, ValidationContext context)	Validates the given condition.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

CACHE_CONTEXT

@Nonnull
@NotEmpty
public static final String CACHE_CONTEXT

Cache context name.

log

@Nonnull
private org.slf4j.Logger log

Logger.

replayCache

@Nonnull
private final ReplayCache replayCache

Replay cache used to track which assertions have been used.

replayCacheExpires

@Nonnull
private final Duration replayCacheExpires

Time for disposal of value from cache.

Constructor Details

OneTimeUseConditionValidator

public OneTimeUseConditionValidator(@Nonnull
 ReplayCache replay,
 @Nullable
 Duration expires)

Constructor.

Parameters:

replay - reply cache used to track which assertions have been used

expires - time for disposal of tracked assertion from the replay cache. May be null, then defaults to 8 hours

Method Details

getServicedCondition

@Nonnull
public QName getServicedCondition()

Gets the element or schema type QName of the condition handled by this validator.

Specified by:

getServicedCondition in interface ConditionValidator

Returns:

element or schema type QName of the statement handled by this validator

validate

@Nonnull
public ValidationResult validate(@Nonnull
 Condition condition,
 @Nonnull
 Assertion assertion,
 @Nonnull
 ValidationContext context)
                          throws AssertionValidationException

Validates the given condition.

Specified by:

validate in interface ConditionValidator

Parameters:

condition - condition to be evaluated

assertion - assertion bearing the condition

context - current Assertion validation context

Returns:

the result of the condition evaluation

Throws:

AssertionValidationException - if there is a problem processing the validation operation

getReplayCacheExpires

@Nonnull
protected Duration getReplayCacheExpires()

Get the configured validator cache expiration interval.

Returns:

the configured cache expiration interval

getExpires

@Nonnull
protected Instant getExpires(Assertion assertion,
 ValidationContext context)

Get the one-time use expiration time for the assertion being evaluated.

Defaults to Instant.now().plus(getReplayCacheExpires()).

A subclass might override this to base expiration on data from the assertion or the validation context.

Parameters:

assertion - the SAML 2 Assertion being evaluated

context - the current validation context

Returns:

the effective one-time use expiration for the assertion being evaluated

getCacheValue

@Nonnull
protected String getCacheValue(@Nonnull
 Assertion assertion)
                        throws AssertionValidationException

Get the string value which will be tracked in the cache for purposes of one-time use detection.

Parameters:

assertion - the SAML 2 Assertion to evaluate

Returns:

the cache value

Throws:

AssertionValidationException - thrown if there is a problem calculating the cached value