Package org.nuxeo.ecm.platform.auth.saml

Class SAMLAuthenticationProvider

java.lang.Object

org.nuxeo.ecm.platform.auth.saml.SAMLAuthenticationProvider

All Implemented Interfaces:

NuxeoAuthenticationPlugin, NuxeoAuthenticationPluginLogoutExtension, LoginProviderLinkComputer

public class SAMLAuthenticationProvider
extends Object
implements NuxeoAuthenticationPlugin, LoginProviderLinkComputer, NuxeoAuthenticationPluginLogoutExtension

A SAML2 authentication provider.

Since:

6.0

Field Summary

Fields

Modifier and Type	Field	Description
protected static List<SAMLBinding>	bindings
protected org.opensaml.saml2.encryption.Decrypter	decrypter
protected static Class<? extends UserResolver>	DEFAULT_USER_RESOLVER_CLASS
protected static String	DIGEST_ALGORITHM
protected static org.opensaml.xml.encryption.ChainingEncryptedKeyResolver	encryptedKeyResolver
static String	ERROR_AUTH
static String	ERROR_PAGE
static String	ERROR_USER
protected KeyManager	keyManager
protected org.opensaml.saml2.metadata.provider.MetadataProvider	metadataProvider
protected Map<String,AbstractSAMLProfile>	profiles
static String	SAML_SESSION_KEY
protected static String	SIGNATURE_ALGORITHM
protected org.opensaml.xml.signature.SignatureTrustEngine	trustEngine
protected static Class<? extends UserResolver>	USERMAPPER_USER_RESOLVER_CLASS
protected UserResolver	userResolver

Constructor Summary

Constructors

Constructor	Description
SAMLAuthenticationProvider()

Method Summary

Modifier and Type	Method	Description
protected void	addProfile(AbstractSAMLProfile profile)
String	computeUrl(javax.servlet.http.HttpServletRequest request, String requestedUrl)	Compute Url that should be used to login via this login provider.
protected Optional<String>	findOrCreateNuxeoUser(UserResolver userResolver, SAMLCredential credential)
protected SAMLBinding	getBinding(String bindingURI)
protected SAMLBinding	getBinding(org.opensaml.ws.transport.InTransport transport)
protected javax.servlet.http.Cookie	getCookie(javax.servlet.http.HttpServletRequest httpRequest, String cookieName)
protected org.opensaml.saml2.metadata.EntityDescriptor	getIdPDescriptor()
protected KeyManager	getKeyManager()
protected AbstractSAMLProfile	getProcessor(org.opensaml.common.binding.SAMLMessageContext context)
protected String	getRequestedUrl(javax.servlet.http.HttpServletRequest request)
protected SAMLCredential	getSamlCredential(javax.servlet.http.HttpServletRequest request)
protected String	getSLOUrl(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)	Returns a Logout URL to use with HTTP Redirect
protected String	getSSOUrl(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)	Returns a Login URL to use with HTTP Redirect
List<String>	getUnAuthenticatedURLPrefix()	Returns the list of prefix for unauthenticated URLs, typically the URLs associated to login prompt.
Boolean	handleLoginPrompt(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, String baseURL)	Handles the Login Prompt.
Boolean	handleLogout(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)	Handles logout operation.
UserIdentificationInfo	handleRetrieveIdentity(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)	Retrieves user identification information from the request.
protected void	initializeMetadataProvider(Map<String,String> parameters)
protected void	initializeSecurity(Map<String,String> parameters)
void	initPlugin(Map<String,String> parameters)	Initializes the Plugin from parameters set in the XML descriptor.
Boolean	needLoginPrompt(javax.servlet.http.HttpServletRequest httpRequest)	Defines if the authentication plugin needs to do a login prompt.
protected void	populateLocalContext(org.opensaml.common.binding.SAMLMessageContext context, javax.servlet.http.HttpServletRequest request)
protected void	removeCookie(javax.servlet.http.HttpServletResponse httpResponse, javax.servlet.http.Cookie cookie)
protected void	sendError(javax.servlet.http.HttpServletRequest req, String key)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

ERROR_PAGE

public static final String ERROR_PAGE

See Also:

Constant Field Values

ERROR_AUTH

public static final String ERROR_AUTH

See Also:

Constant Field Values

ERROR_USER

public static final String ERROR_USER

See Also:

Constant Field Values

DEFAULT_USER_RESOLVER_CLASS

protected static final Class<? extends UserResolver> DEFAULT_USER_RESOLVER_CLASS

USERMAPPER_USER_RESOLVER_CLASS

protected static final Class<? extends UserResolver> USERMAPPER_USER_RESOLVER_CLASS

SAML_SESSION_KEY

public static final String SAML_SESSION_KEY

See Also:

Constant Field Values

bindings

protected static List<SAMLBinding> bindings

encryptedKeyResolver

protected static org.opensaml.xml.encryption.ChainingEncryptedKeyResolver encryptedKeyResolver

profiles

protected Map<String,AbstractSAMLProfile> profiles

userResolver

protected UserResolver userResolver

keyManager

protected KeyManager keyManager

trustEngine

protected org.opensaml.xml.signature.SignatureTrustEngine trustEngine

decrypter

protected org.opensaml.saml2.encryption.Decrypter decrypter

metadataProvider

protected org.opensaml.saml2.metadata.provider.MetadataProvider metadataProvider

SIGNATURE_ALGORITHM

protected static final String SIGNATURE_ALGORITHM

See Also:

Constant Field Values

DIGEST_ALGORITHM

protected static final String DIGEST_ALGORITHM

See Also:

Constant Field Values

Constructor Detail

SAMLAuthenticationProvider

public SAMLAuthenticationProvider()

Method Detail

initPlugin

public void initPlugin(Map<String,String> parameters)

Description copied from interface: NuxeoAuthenticationPlugin

Initializes the Plugin from parameters set in the XML descriptor.

Specified by:

initPlugin in interface NuxeoAuthenticationPlugin

addProfile

protected void addProfile(AbstractSAMLProfile profile)

initializeSecurity

protected void initializeSecurity(Map<String,String> parameters)

initializeMetadataProvider

protected void initializeMetadataProvider(Map<String,String> parameters)
                                   throws org.opensaml.saml2.metadata.provider.MetadataProviderException

Throws:

org.opensaml.saml2.metadata.provider.MetadataProviderException

getIdPDescriptor

protected org.opensaml.saml2.metadata.EntityDescriptor getIdPDescriptor()
                                                                 throws org.opensaml.saml2.metadata.provider.MetadataProviderException

Throws:

org.opensaml.saml2.metadata.provider.MetadataProviderException

getSSOUrl

protected String getSSOUrl(javax.servlet.http.HttpServletRequest request,
                           javax.servlet.http.HttpServletResponse response)

Returns a Login URL to use with HTTP Redirect

getRequestedUrl

protected String getRequestedUrl(javax.servlet.http.HttpServletRequest request)

computeUrl

public String computeUrl(javax.servlet.http.HttpServletRequest request,
                         String requestedUrl)

Description copied from interface: LoginProviderLinkComputer

Compute Url that should be used to login via this login provider. Because the url can depend onb the context, it is computed by this method rather than using a static property

Specified by:

computeUrl in interface LoginProviderLinkComputer

handleLoginPrompt

public Boolean handleLoginPrompt(javax.servlet.http.HttpServletRequest request,
                                 javax.servlet.http.HttpServletResponse response,
                                 String baseURL)

Description copied from interface: NuxeoAuthenticationPlugin

Handles the Login Prompt.

Specified by:

handleLoginPrompt in interface NuxeoAuthenticationPlugin

Parameters:

request - the request

response - the response

Returns:

true if AuthFilter must stop execution (ie: login prompt generated a redirect), false otherwise

handleRetrieveIdentity

public UserIdentificationInfo handleRetrieveIdentity(javax.servlet.http.HttpServletRequest request,
                                                     javax.servlet.http.HttpServletResponse response)

Description copied from interface: NuxeoAuthenticationPlugin

Retrieves user identification information from the request.

Specified by:

handleRetrieveIdentity in interface NuxeoAuthenticationPlugin

Parameters:

request - the request

response - the response

getProcessor

protected AbstractSAMLProfile getProcessor(org.opensaml.common.binding.SAMLMessageContext context)

getBinding

protected SAMLBinding getBinding(String bindingURI)

getBinding

protected SAMLBinding getBinding(org.opensaml.ws.transport.InTransport transport)

populateLocalContext

protected void populateLocalContext(org.opensaml.common.binding.SAMLMessageContext context,
                                    javax.servlet.http.HttpServletRequest request)

needLoginPrompt

public Boolean needLoginPrompt(javax.servlet.http.HttpServletRequest httpRequest)

Description copied from interface: NuxeoAuthenticationPlugin

Defines if the authentication plugin needs to do a login prompt.

Specified by:

needLoginPrompt in interface NuxeoAuthenticationPlugin

Returns:

true if LoginPrompt is used

getUnAuthenticatedURLPrefix

public List<String> getUnAuthenticatedURLPrefix()

Description copied from interface: NuxeoAuthenticationPlugin

Returns the list of prefix for unauthenticated URLs, typically the URLs associated to login prompt.

Specified by:

getUnAuthenticatedURLPrefix in interface NuxeoAuthenticationPlugin

getSLOUrl

protected String getSLOUrl(javax.servlet.http.HttpServletRequest request,
                           javax.servlet.http.HttpServletResponse response)

Returns a Logout URL to use with HTTP Redirect

getSamlCredential

protected SAMLCredential getSamlCredential(javax.servlet.http.HttpServletRequest request)

handleLogout

public Boolean handleLogout(javax.servlet.http.HttpServletRequest request,
                            javax.servlet.http.HttpServletResponse response)

Description copied from interface: NuxeoAuthenticationPluginLogoutExtension

Handles logout operation.

Generic logout (killing session and Seam objects) is done by LogoutActionBean This interface must be implemented by auth plugin when the target auth system needs a specific logout procedure.

Specified by:

handleLogout in interface NuxeoAuthenticationPluginLogoutExtension

Returns:

true if caller must stop execution (ie: logout generated a redirect), false otherwise

sendError

protected void sendError(javax.servlet.http.HttpServletRequest req,
                         String key)

getKeyManager

protected KeyManager getKeyManager()

getCookie

protected javax.servlet.http.Cookie getCookie(javax.servlet.http.HttpServletRequest httpRequest,
                                              String cookieName)

removeCookie

protected void removeCookie(javax.servlet.http.HttpServletResponse httpResponse,
                            javax.servlet.http.Cookie cookie)

findOrCreateNuxeoUser

protected Optional<String> findOrCreateNuxeoUser(UserResolver userResolver,
                                                 SAMLCredential credential)