org.picketlink.identity.federation.bindings.jboss.auth

Class SAML2STSLoginModule

java.lang.Object

org.jboss.security.auth.spi.AbstractServerLoginModule

org.picketlink.identity.federation.bindings.jboss.auth.SAMLTokenFromHttpRequestAbstractLoginModule

org.picketlink.identity.federation.bindings.jboss.auth.SAML2STSCommonLoginModule

org.picketlink.identity.federation.bindings.jboss.auth.SAML2STSLoginModule

All Implemented Interfaces:

LoginModule

public class SAML2STSLoginModule
extends org.picketlink.identity.federation.bindings.jboss.auth.SAML2STSCommonLoginModule

This LoginModule authenticates clients by validating their SAML assertions with an external security token service (such as PicketLinkSTS). If the supplied assertion contains roles, these roles are extracted and included in the Group returned by the getRoleSets method.

This module defines the following module options:

configFile - this property identifies the properties file that will be used to establish communication with the external security token service.

cache.invalidation: set it to true if you require invalidation of JBoss Auth Cache at SAML Principal expiration.

jboss.security.security_domain: name of the security domain where this login module is configured. This is only required if the cache.invalidation option is configured.

roleKey: a comma separated list of strings that define the attributes in SAML assertion for user roles

localValidation: if you want to validate the assertion locally for signature and expiry

Any properties specified besides the above properties are assumed to be used to configure how the STSClient will connect to the STS. For example, the JBossWS StubExt.PROPERTY_SOCKET_FACTORY can be specified in order to inform the socket factory that must be used to connect to the STS. All properties will be set in the request context of the Dispatch instance used by the STSClient to send requests to the STS.

An example of a configFile can be seen bellow:

 serviceName=PicketLinkSTS
 portName=PicketLinkSTSPort
 endpointAddress=http://localhost:8080/picketlink-sts/PicketLinkSTS
 username=JBoss
 password=JBoss
 

The first three properties specify the STS endpoint URL, service name, and port name. The last two properties specify the username and password that are to be used by the application server to authenticate to the STS and have the SAML assertions validated.

NOTE: Sub-classes can use SAML2STSCommonLoginModule.getSTSClient() method to customize the STSClient class to make calls to STS/

Author:

Stefan Guilhen, Anil.Saldhana@redhat.com