Package org.nuxeo.ecm.platform.auth.saml

Class SAMLAuthenticationProvider

java.lang.Object

org.nuxeo.ecm.platform.auth.saml.SAMLAuthenticationProvider

All Implemented Interfaces:

NuxeoAuthenticationPlugin, NuxeoAuthenticationPluginLogoutExtension, LoginProviderLinkComputer

public class SAMLAuthenticationProvider
extends Object
implements NuxeoAuthenticationPlugin, LoginProviderLinkComputer, NuxeoAuthenticationPluginLogoutExtension

A SAML2 authentication provider.

Since:

6.0

Field Summary

Fields

Modifier and Type	Field	Description
protected SAMLConfiguration	configuration
static final String	ERROR_AUTH
static final String	ERROR_PAGE
static final String	ERROR_USER
protected SAMLProcessorFactory	processorFactory
protected UserResolver	userResolver

Constructor Summary

Constructors

Constructor	Description
SAMLAuthenticationProvider()

Method Summary

Modifier and Type	Method	Description
String	computeUrl(jakarta.servlet.http.HttpServletRequest request, String requestedUrl)	Compute Url that should be used to login via this login provider.
protected Optional<String>	findOrCreateNuxeoUser(UserResolver userResolver, SAMLCredential credential)
SAMLConfiguration	getConfiguration()
protected String	getSLOUrl(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)	Returns a Logout URL to use with HTTP Redirect
List<String>	getUnAuthenticatedURLPrefix()	Returns the list of prefix for unauthenticated URLs, typically the URLs associated to login prompt.
Boolean	handleLoginPrompt(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, String baseURL)	Handles the Login Prompt.
Boolean	handleLogout(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)	Handles logout operation.
UserIdentificationInfo	handleRetrieveIdentity(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)	Retrieves user identification information from the request.
protected static void	initOpenSAML()
void	initPlugin(Map<String,String> parameters)	Initializes the Plugin from parameters set in the XML descriptor.
Boolean	needLoginPrompt(jakarta.servlet.http.HttpServletRequest httpRequest)	Defines if the authentication plugin needs to do a login prompt.
protected void	removeCookie(jakarta.servlet.http.HttpServletResponse httpResponse, jakarta.servlet.http.Cookie cookie)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

ERROR_PAGE

public static final String ERROR_PAGE

See Also:

• Constant Field Values

ERROR_AUTH

public static final String ERROR_AUTH

See Also:

• Constant Field Values

ERROR_USER

public static final String ERROR_USER

See Also:

• Constant Field Values

configuration

protected SAMLConfiguration configuration

userResolver

protected UserResolver userResolver

processorFactory

protected SAMLProcessorFactory processorFactory

Since:

2023.0

Constructor Details

SAMLAuthenticationProvider

public SAMLAuthenticationProvider()

Method Details

initPlugin

public void initPlugin(Map<String,String> parameters)

Description copied from interface: NuxeoAuthenticationPlugin

Initializes the Plugin from parameters set in the XML descriptor.

Specified by:

initPlugin in interface NuxeoAuthenticationPlugin

initOpenSAML

protected static void initOpenSAML()

computeUrl

public String computeUrl(jakarta.servlet.http.HttpServletRequest request,
 String requestedUrl)

Description copied from interface: LoginProviderLinkComputer

Compute Url that should be used to login via this login provider. Because the url can depend onb the context, it is computed by this method rather than using a static property

Specified by:

computeUrl in interface LoginProviderLinkComputer

handleLoginPrompt

public Boolean handleLoginPrompt(jakarta.servlet.http.HttpServletRequest request,
 jakarta.servlet.http.HttpServletResponse response,
 String baseURL)

Description copied from interface: NuxeoAuthenticationPlugin

Handles the Login Prompt.

Specified by:

handleLoginPrompt in interface NuxeoAuthenticationPlugin

Parameters:

request - the request

response - the response

Returns:

true if AuthFilter must stop execution (ie: login prompt generated a redirect), false otherwise

handleRetrieveIdentity

public UserIdentificationInfo handleRetrieveIdentity(jakarta.servlet.http.HttpServletRequest request,
 jakarta.servlet.http.HttpServletResponse response)

Description copied from interface: NuxeoAuthenticationPlugin

Retrieves user identification information from the request.

Specified by:

handleRetrieveIdentity in interface NuxeoAuthenticationPlugin

Parameters:

request - the request

response - the response

needLoginPrompt

public Boolean needLoginPrompt(jakarta.servlet.http.HttpServletRequest httpRequest)

Description copied from interface: NuxeoAuthenticationPlugin

Defines if the authentication plugin needs to do a login prompt.

Specified by:

needLoginPrompt in interface NuxeoAuthenticationPlugin

Returns:

true if LoginPrompt is used

getUnAuthenticatedURLPrefix

public List<String> getUnAuthenticatedURLPrefix()

Description copied from interface: NuxeoAuthenticationPlugin

Returns the list of prefix for unauthenticated URLs, typically the URLs associated to login prompt.

Specified by:

getUnAuthenticatedURLPrefix in interface NuxeoAuthenticationPlugin

getSLOUrl

protected String getSLOUrl(jakarta.servlet.http.HttpServletRequest request,
 jakarta.servlet.http.HttpServletResponse response)

Returns a Logout URL to use with HTTP Redirect

handleLogout

public Boolean handleLogout(jakarta.servlet.http.HttpServletRequest request,
 jakarta.servlet.http.HttpServletResponse response)

Description copied from interface: NuxeoAuthenticationPluginLogoutExtension

Handles logout operation.

Generic logout (killing session and Seam objects) is done by LogoutActionBean This interface must be implemented by auth plugin when the target auth system needs a specific logout procedure.

Specified by:

handleLogout in interface NuxeoAuthenticationPluginLogoutExtension

Returns:

true if caller must stop execution (ie: logout generated a redirect), false otherwise

removeCookie

protected void removeCookie(jakarta.servlet.http.HttpServletResponse httpResponse,
 jakarta.servlet.http.Cookie cookie)

findOrCreateNuxeoUser

protected Optional<String> findOrCreateNuxeoUser(UserResolver userResolver,
 SAMLCredential credential)

getConfiguration

public SAMLConfiguration getConfiguration()

Since:

2025.7