Package org.springframework.security.saml2.provider.service.authentication

Class OpenSaml5AuthenticationProvider.AssertionValidator.Builder

java.lang.Object

org.springframework.security.saml2.provider.service.authentication.OpenSaml5AuthenticationProvider.AssertionValidator.Builder

Enclosing class:

OpenSaml5AuthenticationProvider.AssertionValidator

public static final class OpenSaml5AuthenticationProvider.AssertionValidator.Builder
extends Object

Method Summary

Modifier and Type	Method	Description
OpenSaml5AuthenticationProvider.AssertionValidator	build()	Build the OpenSaml5AuthenticationProvider.AssertionValidator
OpenSaml5AuthenticationProvider.AssertionValidator.Builder	clockSkew(Duration duration)	Use this clock skew for validating assertion timestamps.
OpenSaml5AuthenticationProvider.AssertionValidator.Builder	conditionValidators(Consumer<List<org.opensaml.saml.saml2.assertion.ConditionValidator>> conditions)	Mutate the list of ConditionValidators.
OpenSaml5AuthenticationProvider.AssertionValidator.Builder	subjectValidators(Consumer<List<org.opensaml.saml.saml2.assertion.SubjectConfirmationValidator>> subjects)	Mutate the list of ConditionValidators.
OpenSaml5AuthenticationProvider.AssertionValidator.Builder	validationContextParameters(Consumer<Map<String,Object>> parameters)	Mutate the map of ValidationContext static parameters.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

clockSkew

public OpenSaml5AuthenticationProvider.AssertionValidator.Builder clockSkew(Duration duration)

Use this clock skew for validating assertion timestamps. The default is 5 minutes.

Parameters:

duration - the duration to use

Returns:

the OpenSaml5AuthenticationProvider.AssertionValidator.Builder for further configuration

validationContextParameters

public OpenSaml5AuthenticationProvider.AssertionValidator.Builder validationContextParameters(Consumer<Map<String,Object>> parameters)

Mutate the map of ValidationContext static parameters. By default, these include:

• SAML2AssertionValidationParameters.SC_VALID_IN_RESPONSE_TO
>
• SAML2AssertionValidationParameters.COND_VALID_AUDIENCES
>
• SAML2AssertionValidationParameters.SC_VALID_RECIPIENTS
>
• SAML2AssertionValidationParameters.VALID_ISSUERS
>
• SAML2AssertionValidationParameters.SC_CHECK_ADDRESS
>
• SAML2AssertionValidationParameters.CLOCK_SKEW
>

Note that several of these are required by various validation steps, for example COND_VALID_AUDIENCES is needed by BearerSubjectConfirmationValidator. If you do not want these, the best way to remove them is to remove the conditionValidators(java.util.function.Consumer<java.util.List<org.opensaml.saml.saml2.assertion.ConditionValidator>>) or subjectValidators(java.util.function.Consumer<java.util.List<org.opensaml.saml.saml2.assertion.SubjectConfirmationValidator>>) themselves

Parameters:

parameters - the mutator to change the set of parameters

Returns:

conditionValidators

public OpenSaml5AuthenticationProvider.AssertionValidator.Builder conditionValidators(Consumer<List<org.opensaml.saml.saml2.assertion.ConditionValidator>> conditions)

Mutate the list of ConditionValidators. By default, these include:

• AudienceRestrictionConditionValidator
• DelegationRestrictionConditionValidator
• ProxyRestrictionConditionValidator

Note that it also adds a validator that skips the saml2:OneTimeUse element since this validator does not have caching facilities. However, you can construct your own instance of OneTimeUseConditionValidator and supply it here.

Parameters:

conditions - the mutator for changing the list of conditions to use

Returns:

the OpenSaml5AuthenticationProvider.AssertionValidator.Builder for further configuration

subjectValidators

public OpenSaml5AuthenticationProvider.AssertionValidator.Builder subjectValidators(Consumer<List<org.opensaml.saml.saml2.assertion.SubjectConfirmationValidator>> subjects)

Mutate the list of ConditionValidators.

By default it only has BearerSubjectConfirmationValidator for which address validation is skipped. To turn address validation on, use validationContextParameters(Consumer) to set the SAML2AssertionValidationParameters.SC_CHECK_ADDRESS value.

Parameters:

subjects - the mutator for changing the list of conditions to use

Returns:

the OpenSaml5AuthenticationProvider.AssertionValidator.Builder for further configuration

build

public OpenSaml5AuthenticationProvider.AssertionValidator build()

Build the OpenSaml5AuthenticationProvider.AssertionValidator

Returns:

the OpenSaml5AuthenticationProvider.AssertionValidator