org.picketlink.identity.federation.bindings.tomcat.sp

Class BaseFormAuthenticator

java.lang.Object

FormAuthenticator

org.picketlink.identity.federation.bindings.tomcat.sp.BaseFormAuthenticator

Direct Known Subclasses:

AbstractSPFormAuthenticator

public abstract class BaseFormAuthenticator
extends FormAuthenticator

Base Class for Service Provider Form Authenticators

Since:

Jun 9, 2009

Author:

Anil.Saldhana@redhat.com

Field Summary

Fields

Modifier and Type	Field and Description
protected PicketLinkAuditHelper	auditHelper
protected String	canonicalizationMethod
protected SAML2HandlerChain	chain
protected Map<String,Object>	chainConfigOptions
protected Lock	chainLock A Lock for Handler operations in the chain
protected String	configFile
protected SAMLConfigurationProvider	configProvider The user can inject a fully qualified name of a SAMLConfigurationProvider
protected boolean	enableAudit
protected String	identityURL
protected String	idpAddress
protected X509Certificate	idpCertificate If the service provider is configured with an IDP metadata file, then this certificate can be picked up from the metadata
protected String	issuerID
protected TrustKeyManager	keyManager
protected static PicketLinkLogger	logger
protected PicketLinkType	picketLinkConfiguration
protected String	samlHandlerChainClass
protected boolean	saveRestoreRequest
protected String	serviceURL
protected SPType	spConfiguration
protected Timer	timer
protected int	timerInterval

Constructor Summary

Constructors

Constructor and Description
BaseFormAuthenticator()

Method Summary

Modifier and Type	Method and Description
protected boolean	doSupportSignature() Indicates if digital signatures/validation of SAML assertions are enabled.
protected abstract String	getBinding() Return the SAML Binding that this authenticator supports
String	getConfigFile() Get the name of the configuration file
SPType	getConfiguration() Get the SPType
String	getIdentityURL() Get the Identity URL
X509Certificate	getIdpCertificate() Get the X509Certificate of the IDP if provided via the IDP metadata file
protected IDPSSODescriptorType	getIDPSSODescriptor(EntitiesDescriptorType entities)
protected IDPSSODescriptorType	handleMetadata(EntitiesDescriptorType entities)
protected IDPSSODescriptorType	handleMetadata(EntityDescriptorType entityDescriptor)
protected void	initializeHandlerChain()
protected abstract void	initKeyProvider(Context context)
protected boolean	localAuthentication(Request request, Response response, LoginConfig loginConfig) Fall back on local authentication at the service provider side
protected void	populateChainConfig()
protected void	processConfiguration() Process the configuration from the configuration file
protected void	processIDPMetadataFile(String idpMetadataFile) Attempt to process a metadata file available locally
protected void	register(Request request, Response response, Principal principal, String arg3, String arg4, String arg5) This method is a hack!!! Tomcat on account of Servlet3 changed their authenticator method signatures We utilize Java Reflection to identify the super register method on the first call and save it.
protected void	sendToLogoutPage(Request request, Response response, Session session)
void	setAuditHelper(PicketLinkAuditHelper auditHelper)
void	setConfigFile(String configFile) Set the name of the configuration file
void	setConfigProvider(SAMLConfigurationProvider configProvider) Set an instance of the SAMLConfigurationProvider
void	setConfigProvider(String cp) Set the SAMLConfigurationProvider fqn
void	setIdpAddress(String idpAddress) If the request.getRemoteAddr is not exactly the IDP address that you have keyed in your deployment descriptor for keystore alias, you can set it here explicitly
void	setIssuerID(String issuerID) Set a separate issuer id
void	setLogOutPage(String logOutPage) Set the logout page
void	setSamlHandlerChainClass(String samlHandlerChainClass) Set the SAML Handler Chain Class fqn
void	setSaveRestoreRequest(boolean saveRestoreRequest) Set whether the authenticator saves/restores the request during form authentication
void	setServiceURL(String serviceURL) Set the service URL
void	setTimerInterval(String value) Set the Timer Value to reload the configuration
protected void	startPicketLink()
void	testStart()
protected boolean	validate(Request request) Perform validation os the request object

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

logger

protected static final PicketLinkLogger logger

enableAudit

protected boolean enableAudit

auditHelper

protected PicketLinkAuditHelper auditHelper

keyManager

protected TrustKeyManager keyManager

spConfiguration

protected SPType spConfiguration

picketLinkConfiguration

protected PicketLinkType picketLinkConfiguration

serviceURL

protected String serviceURL

identityURL

protected String identityURL

issuerID

protected String issuerID

configFile

protected String configFile

idpCertificate

protected transient X509Certificate idpCertificate

If the service provider is configured with an IDP metadata file, then this certificate can be picked up from the metadata

chain

protected transient SAML2HandlerChain chain

samlHandlerChainClass

protected transient String samlHandlerChainClass

chainConfigOptions

protected Map<String,Object> chainConfigOptions

saveRestoreRequest

protected boolean saveRestoreRequest

chainLock

protected Lock chainLock

A Lock for Handler operations in the chain

canonicalizationMethod

protected String canonicalizationMethod

configProvider

protected SAMLConfigurationProvider configProvider

The user can inject a fully qualified name of a SAMLConfigurationProvider

timerInterval

protected int timerInterval

timer

protected Timer timer

idpAddress

protected String idpAddress

Constructor Detail

BaseFormAuthenticator

public BaseFormAuthenticator()

Method Detail

setIdpAddress

public void setIdpAddress(String idpAddress)

If the request.getRemoteAddr is not exactly the IDP address that you have keyed in your deployment descriptor for keystore alias, you can set it here explicitly

getConfigFile

public String getConfigFile()

Get the name of the configuration file

Returns:

setConfigFile

public void setConfigFile(String configFile)

Set the name of the configuration file

Parameters:

configFile -

setSamlHandlerChainClass

public void setSamlHandlerChainClass(String samlHandlerChainClass)

Set the SAML Handler Chain Class fqn

Parameters:

samlHandlerChainClass -

setServiceURL

public void setServiceURL(String serviceURL)

Set the service URL

Parameters:

serviceURL -

setSaveRestoreRequest

public void setSaveRestoreRequest(boolean saveRestoreRequest)

Set whether the authenticator saves/restores the request during form authentication

Parameters:

saveRestoreRequest -

setConfigProvider

public void setConfigProvider(String cp)

Set the SAMLConfigurationProvider fqn

Parameters:

cp - fqn of a SAMLConfigurationProvider

setConfigProvider

public void setConfigProvider(SAMLConfigurationProvider configProvider)

Set an instance of the SAMLConfigurationProvider

Parameters:

configProvider -

getConfiguration

public SPType getConfiguration()

Get the SPType

Returns:

setIssuerID

public void setIssuerID(String issuerID)

Set a separate issuer id

Parameters:

issuerID -

setLogOutPage

public void setLogOutPage(String logOutPage)

Set the logout page

Parameters:

logOutPage -

setTimerInterval

public void setTimerInterval(String value)

Set the Timer Value to reload the configuration

Parameters:

value - an integer value that represents timer value (in miliseconds)

validate

protected boolean validate(Request request)

Perform validation os the request object

Parameters:

request -

Returns:

Throws:

IOException

GeneralSecurityException

getIdentityURL

public String getIdentityURL()

Get the Identity URL

Returns:

getIdpCertificate

public X509Certificate getIdpCertificate()

Get the X509Certificate of the IDP if provided via the IDP metadata file

Returns:

X509Certificate or null

register

protected void register(Request request,
                        Response response,
                        Principal principal,
                        String arg3,
                        String arg4,
                        String arg5)

This method is a hack!!! Tomcat on account of Servlet3 changed their authenticator method signatures We utilize Java Reflection to identify the super register method on the first call and save it. Subsquent invocations utilize the saved Method

See Also:

org.apache.catalina.authenticator.AuthenticatorBase#register(org.apache.catalina.connector.Request, org.apache.catalina.connector.Response, java.security.Principal, java.lang.String, java.lang.String, java.lang.String)

localAuthentication

protected boolean localAuthentication(Request request,
                                      Response response,
                                      LoginConfig loginConfig)
                               throws IOException

Fall back on local authentication at the service provider side

Parameters:

request -

response -

loginConfig -

Returns:

Throws:

IOException

getBinding

protected abstract String getBinding()

Return the SAML Binding that this authenticator supports

Returns:

See Also:

JBossSAMLURIConstants#SAML_HTTP_POST_BINDING}, JBossSAMLURIConstants#SAML_HTTP_REDIRECT_BINDING}

processIDPMetadataFile

protected void processIDPMetadataFile(String idpMetadataFile)

Attempt to process a metadata file available locally

processConfiguration

protected void processConfiguration()

Process the configuration from the configuration file

handleMetadata

protected IDPSSODescriptorType handleMetadata(EntitiesDescriptorType entities)

handleMetadata

protected IDPSSODescriptorType handleMetadata(EntityDescriptorType entityDescriptor)

getIDPSSODescriptor

protected IDPSSODescriptorType getIDPSSODescriptor(EntitiesDescriptorType entities)

initializeHandlerChain

protected void initializeHandlerChain()
                               throws ConfigurationException,
                                      ProcessingException

Throws:

ConfigurationException

ProcessingException

populateChainConfig

protected void populateChainConfig()
                            throws ConfigurationException,
                                   ProcessingException

Throws:

ConfigurationException

ProcessingException

sendToLogoutPage

protected void sendToLogoutPage(Request request,
                                Response response,
                                Session session)
                         throws IOException,
                                ServletException

Throws:

IOException

ServletException

testStart

public void testStart()
               throws LifecycleException

Throws:

LifecycleException

startPicketLink

protected void startPicketLink()
                        throws LifecycleException

Throws:

LifecycleException

doSupportSignature

protected boolean doSupportSignature()

Indicates if digital signatures/validation of SAML assertions are enabled. Subclasses that supports signature should override this method.

Returns:

initKeyProvider

protected abstract void initKeyProvider(Context context)
                                 throws LifecycleException

Throws:

LifecycleException

setAuditHelper

public void setAuditHelper(PicketLinkAuditHelper auditHelper)