Package org.opensaml.saml.saml2.wssecurity.messaging.impl

Class WSSecuritySAML20AssertionTokenSecurityHandler

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.messaging.handler.AbstractMessageHandler

org.opensaml.saml.saml2.wssecurity.messaging.impl.WSSecuritySAML20AssertionTokenSecurityHandler

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, MessageHandler

public class WSSecuritySAML20AssertionTokenSecurityHandler
extends AbstractMessageHandler

A security handler which resolves SAML 2.0 Assertion tokens from a SOAP envelope's wsse:Security header, validates them, and makes them available via via the WSSecurityContext.

Field Summary

Fields

Modifier and Type	Field	Description
private Function<Pair<MessageContext,Assertion>,SAML20AssertionValidator>	assertionValidatorLookup	The SAML 2.0 Assertion validator lookup function.
private NonnullSupplier<HttpServletRequest>	httpServletRequestSupplier	Supplier for the Current HTTP request, if available.
private boolean	invalidFatal	Flag which indicates whether a failure of Assertion validation should be considered fatal.
private final org.slf4j.Logger	log	Class logger.
private Function<SAML20AssertionTokenValidationInput,ValidationContext>	validationContextBuilder	Function that builds a ValidationContext instance based on a SAML20AssertionTokenValidationInput instance.

Constructor Summary

Constructors

Constructor	Description
WSSecuritySAML20AssertionTokenSecurityHandler()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected ValidationContext	buildValidationContext(MessageContext messageContext, Assertion assertion)	Build the Assertion ValidationContext.
protected void	doInitialize()
protected void	doInvoke(MessageContext messageContext)	Performs the handler logic.
SAML20AssertionValidator	getAssertionValidator(MessageContext messageContext, Assertion assertion)	Get the configured Assertion validator.
Function<Pair<MessageContext,Assertion>,SAML20AssertionValidator>	getAssertionValidatorLookup()	Get the Assertion validator lookup function.
HttpServletRequest	getHttpServletRequest()	Get the current HTTP request if available.
NonnullSupplier<HttpServletRequest>	getHttpServletRequestSupplier()	Get the supplier for HTTP request if available.
Function<SAML20AssertionTokenValidationInput,ValidationContext>	getValidationContextBuilder()	Get the function that builds a ValidationContext instance based on a SAML20AssertionTokenValidationInput instance.
boolean	isInvalidFatal()	Get flag which indicates whether a failure of Assertion validation should be considered a fatal processing error.
protected void	processResult(ValidationContext validationContext, ValidationResult validationResult, SAML20AssertionToken token, MessageContext messageContext)	Process the result of the token validation.
protected List<Assertion>	resolveAssertions(MessageContext messageContext)	Resolve the SAML 2.0 Assertions token from the SOAP envelope.
void	setAssertionValidator(SAML20AssertionValidator validator)	Set a locally-configured Assertion validator.
void	setAssertionValidatorLookup(Function<Pair<MessageContext,Assertion>,SAML20AssertionValidator> function)	Set the Assertion validator lookup function.
void	setHttpServletRequestSupplier(NonnullSupplier<HttpServletRequest> requestSupplier)	Set the current HTTP request Supplier.
void	setInvalidFatal(boolean flag)	Set flag which indicates whether a failure of Assertion validation should be considered a fatal processing error.
void	setValidationContextBuilder(Function<SAML20AssertionTokenValidationInput,ValidationContext> builder)	Set the function that builds a ValidationContext instance based on a SAML20AssertionTokenValidationInput instance.

Methods inherited from class org.opensaml.messaging.handler.AbstractMessageHandler

doPostInvoke, doPostInvoke, doPreInvoke, getActivationCondition, getLogPrefix, invoke, isPreInvokeCalled, setActivationCondition

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

httpServletRequestSupplier

@Nullable
private NonnullSupplier<HttpServletRequest> httpServletRequestSupplier

Supplier for the Current HTTP request, if available.

invalidFatal

private boolean invalidFatal

Flag which indicates whether a failure of Assertion validation should be considered fatal.

assertionValidatorLookup

@Nonnull
private Function<Pair<MessageContext,Assertion>,SAML20AssertionValidator> assertionValidatorLookup

The SAML 2.0 Assertion validator lookup function.

validationContextBuilder

@NonnullAfterInit
private Function<SAML20AssertionTokenValidationInput,ValidationContext> validationContextBuilder

Function that builds a ValidationContext instance based on a SAML20AssertionTokenValidationInput instance.

Constructor Details

WSSecuritySAML20AssertionTokenSecurityHandler

public WSSecuritySAML20AssertionTokenSecurityHandler()

Constructor.

Method Details

getValidationContextBuilder

@NonnullAfterInit
public Function<SAML20AssertionTokenValidationInput,ValidationContext> getValidationContextBuilder()

Get the function that builds a ValidationContext instance based on a SAML20AssertionTokenValidationInput instance.

Defaults to an instance of DefaultSAML20AssertionValidationContextBuilder.

Returns:

the builder function

setValidationContextBuilder

public void setValidationContextBuilder(@Nonnull
 Function<SAML20AssertionTokenValidationInput,ValidationContext> builder)

Set the function that builds a ValidationContext instance based on a SAML20AssertionTokenValidationInput instance.

Defaults to an instance of DefaultSAML20AssertionValidationContextBuilder.

Parameters:

builder - the builder function

getHttpServletRequest

@Nullable
public HttpServletRequest getHttpServletRequest()

Get the current HTTP request if available.

Returns:

current HTTP request

getHttpServletRequestSupplier

@Nullable
public NonnullSupplier<HttpServletRequest> getHttpServletRequestSupplier()

Get the supplier for HTTP request if available.

Returns:

current HTTP request

setHttpServletRequestSupplier

public void setHttpServletRequestSupplier(@Nullable
 NonnullSupplier<HttpServletRequest> requestSupplier)

Set the current HTTP request Supplier.

Parameters:

requestSupplier - Supplier for the current HTTP request

isInvalidFatal

public boolean isInvalidFatal()

Get flag which indicates whether a failure of Assertion validation should be considered a fatal processing error.

Defaults to: true.

Returns:

Returns the invalidFatal.

setInvalidFatal

public void setInvalidFatal(boolean flag)

Set flag which indicates whether a failure of Assertion validation should be considered a fatal processing error.

Defaults to: true.

Parameters:

flag - The invalidFatal to set.

getAssertionValidator

@Nullable
public SAML20AssertionValidator getAssertionValidator(@Nullable
 MessageContext messageContext,
 @Nullable
 Assertion assertion)

Get the configured Assertion validator.

Parameters:

messageContext - input message context

assertion - input assertion

Returns:

the configured Assertion validator, or null

setAssertionValidator

public void setAssertionValidator(@Nullable
 SAML20AssertionValidator validator)

Set a locally-configured Assertion validator.

Parameters:

validator - the local Assertion validator, may be null

getAssertionValidatorLookup

@Nullable
public Function<Pair<MessageContext,Assertion>,SAML20AssertionValidator> getAssertionValidatorLookup()

Get the Assertion validator lookup function.

Returns:

the Assertion validator lookup function, or null

setAssertionValidatorLookup

public void setAssertionValidatorLookup(@Nonnull
 Function<Pair<MessageContext,Assertion>,SAML20AssertionValidator> function)

Set the Assertion validator lookup function.

Parameters:

function - the Assertion validator lookup function, may be null

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractInitializableComponent

Throws:

ComponentInitializationException

doInvoke

protected void doInvoke(@Nonnull
 MessageContext messageContext)
                 throws MessageHandlerException

Performs the handler logic.

Specified by:

doInvoke in class AbstractMessageHandler

Parameters:

messageContext - the message context on which to invoke the handler

Throws:

MessageHandlerException - if there is an error invoking the handler on the message context

processResult

protected void processResult(@Nonnull
 ValidationContext validationContext,
 @Nonnull
 ValidationResult validationResult,
 @Nonnull
 SAML20AssertionToken token,
 @Nonnull
 MessageContext messageContext)
                      throws MessageHandlerException

Process the result of the token validation.

Parameters:

validationContext - the Assertion validation context

validationResult - the Assertion validation result

token - the token being produced

messageContext - the current message context

Throws:

MessageHandlerException - if the Assertion was invalid or indeterminate and idInvalidFatal is true

buildValidationContext

@Nonnull
protected ValidationContext buildValidationContext(@Nonnull
 MessageContext messageContext,
 @Nonnull
 Assertion assertion)
                                            throws MessageHandlerException

Build the Assertion ValidationContext.

Parameters:

messageContext - the current message context

assertion - the assertion which is to be validated

Returns:

the new Assertion validation context to use

Throws:

MessageHandlerException - if no validation context instance could be built

resolveAssertions

@Nonnull
@Unmodifiable
@NotLive
protected List<Assertion> resolveAssertions(@Nonnull
 MessageContext messageContext)

Resolve the SAML 2.0 Assertions token from the SOAP envelope.

Parameters:

messageContext - the current message context

Returns:

the list of resolved Assertions, or an empty list