Package se.swedenconnect.spring.saml.idp.authnrequest

Class Saml2AuthnRequestAuthenticationProvider

java.lang.Object

se.swedenconnect.spring.saml.idp.authnrequest.Saml2AuthnRequestAuthenticationProvider

All Implemented Interfaces:

org.springframework.security.authentication.AuthenticationProvider

public class Saml2AuthnRequestAuthenticationProvider
extends Object
implements org.springframework.security.authentication.AuthenticationProvider

An AuthenticationProvider that processes a Saml2AuthnRequestAuthenticationToken and if the processing is succesful returns a Saml2UserAuthenticationInputToken.

The signature on the authentication request is verified, and the request is checked against the IdP configuration before proceeding with the actual user authentication.

Author:

Martin Lindström

Constructor Summary

Constructors

Constructor	Description
Saml2AuthnRequestAuthenticationProvider(Saml2IdpEventPublisher eventPublisher, AuthnRequestValidator signatureValidator, AuthnRequestValidator assertionConsumerServiceValidator, AuthnRequestValidator replayValidator, AuthnRequestValidator encryptCapabilitiesValidator, List<RequestedAttributeProcessor> requestedAttributesProcessors, NameIDGeneratorFactory nameIDGeneratorFactory, Saml2ServiceProviderFilter serviceProviderFilter)	Constructor.
Saml2AuthnRequestAuthenticationProvider(Saml2IdpEventPublisher eventPublisher, AuthnRequestValidator signatureValidator, AuthnRequestValidator assertionConsumerServiceValidator, AuthnRequestValidator replayValidator, AuthnRequestValidator encryptCapabilitiesValidator, List<RequestedAttributeProcessor> requestedAttributesProcessors, NameIDGeneratorFactory nameIDGeneratorFactory, Saml2ServiceProviderFilter serviceProviderFilter, SignatureMessageExtensionExtractor signatureMessageExtensionExtractor, PrincipalSelectionProcessor principalSelectionProcessor)	Constructor.

Method Summary

Modifier and Type	Method	Description
org.springframework.security.core.Authentication	authenticate(org.springframework.security.core.Authentication authentication)
protected AuthenticationRequirements	createAuthenticationRequirements(Saml2AuthnRequestAuthenticationToken token)	Creates an AuthenticationRequirements object.
protected Collection<RequestedAttribute>	extractRequestedAttributes(Saml2AuthnRequestAuthenticationToken authnRequestToken)	Extracts the requested attributes by invoking the configured RequestedAttributeProcessors.
void	setSignatureMessagePreprocessor(SignatureMessagePreprocessor signatureMessagePreprocessor)	Assigns a SignatureMessagePreprocessor for preparing the sign message for display.
void	setUserMessagePreprocessor(UserMessagePreprocessor userMessagePreprocessor)	Assigns a UserMessagePreprocessor for preparing the user messages for display.
boolean	supports(Class<?> authentication)	Supports Saml2AuthnRequestAuthenticationToken.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

Saml2AuthnRequestAuthenticationProvider

public Saml2AuthnRequestAuthenticationProvider(Saml2IdpEventPublisher eventPublisher,
 AuthnRequestValidator signatureValidator,
 AuthnRequestValidator assertionConsumerServiceValidator,
 AuthnRequestValidator replayValidator,
 AuthnRequestValidator encryptCapabilitiesValidator,
 List<RequestedAttributeProcessor> requestedAttributesProcessors,
 NameIDGeneratorFactory nameIDGeneratorFactory,
 Saml2ServiceProviderFilter serviceProviderFilter)

Constructor. See Saml2AuthnRequestAuthenticationProviderConfigurer for how to configuration and setup.

Parameters:

eventPublisher - the event publisher

signatureValidator - the signature validator to use

assertionConsumerServiceValidator - validator checking the AssertionConsumerService

replayValidator - for protecting against replay attacks

encryptCapabilitiesValidator - validator asserting that we can encrypt assertions

requestedAttributesProcessors - extracts the requested attributes

nameIDGeneratorFactory - the NameIDGeneratorFactory to use when creating a NameIDGenerator instance

serviceProviderFilter - filter for checking whether an SP is acceptable

Saml2AuthnRequestAuthenticationProvider

public Saml2AuthnRequestAuthenticationProvider(Saml2IdpEventPublisher eventPublisher,
 AuthnRequestValidator signatureValidator,
 AuthnRequestValidator assertionConsumerServiceValidator,
 AuthnRequestValidator replayValidator,
 AuthnRequestValidator encryptCapabilitiesValidator,
 List<RequestedAttributeProcessor> requestedAttributesProcessors,
 NameIDGeneratorFactory nameIDGeneratorFactory,
 Saml2ServiceProviderFilter serviceProviderFilter,
 SignatureMessageExtensionExtractor signatureMessageExtensionExtractor,
 PrincipalSelectionProcessor principalSelectionProcessor)

Constructor. See Saml2AuthnRequestAuthenticationProviderConfigurer for how to configuration and setup.

Parameters:

eventPublisher - the event publisher

signatureValidator - the signature validator to use

assertionConsumerServiceValidator - validator checking the AssertionConsumerService

replayValidator - for protecting against replay attacks

encryptCapabilitiesValidator - validator asserting that we can encrypt assertions

requestedAttributesProcessors - extracts the requested attributes

nameIDGeneratorFactory - the NameIDGeneratorFactory to use when creating a NameIDGenerator instance

serviceProviderFilter - filter for checking whether an SP is acceptable

signatureMessageExtensionExtractor - extracts the SignMessage extension (may be null)

principalSelectionProcessor - extracts the PrincipalSelection attribute values (may be null)

Method Details

authenticate

public org.springframework.security.core.Authentication authenticate(org.springframework.security.core.Authentication authentication)
                                                              throws org.springframework.security.core.AuthenticationException

Specified by:

authenticate in interface org.springframework.security.authentication.AuthenticationProvider

Throws:

org.springframework.security.core.AuthenticationException

supports

public boolean supports(Class<?> authentication)

Supports Saml2AuthnRequestAuthenticationToken.

Specified by:

supports in interface org.springframework.security.authentication.AuthenticationProvider

setSignatureMessagePreprocessor

public void setSignatureMessagePreprocessor(SignatureMessagePreprocessor signatureMessagePreprocessor)

Assigns a SignatureMessagePreprocessor for preparing the sign message for display.

Parameters:

signatureMessagePreprocessor - a SignatureMessagePreprocessor

setUserMessagePreprocessor

public void setUserMessagePreprocessor(UserMessagePreprocessor userMessagePreprocessor)

Assigns a UserMessagePreprocessor for preparing the user messages for display.

Parameters:

userMessagePreprocessor - a UserMessagePreprocessor

createAuthenticationRequirements

protected AuthenticationRequirements createAuthenticationRequirements(Saml2AuthnRequestAuthenticationToken token)
                                                               throws Saml2ErrorStatusException,
UnrecoverableSaml2IdpException

Creates an AuthenticationRequirements object.

Parameters:

token - the input token

Returns:

an AuthenticationRequirements object

Throws:

Saml2ErrorStatusException - for errors that should be reported back

UnrecoverableSaml2IdpException - for unrecoverable errors

extractRequestedAttributes

protected Collection<RequestedAttribute> extractRequestedAttributes(Saml2AuthnRequestAuthenticationToken authnRequestToken)

Extracts the requested attributes by invoking the configured RequestedAttributeProcessors.

Parameters:

authnRequestToken - the input token

Returns:

a Collection of RequestedAttributes