public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineSecurityHandler<X509Credential>
This rule is only evaluated if the supplied HttpServletRequest
contains a peer X509Credential
as returned via ServletRequestX509CredentialAdapter
.
The entity ID used to perform trust evaluation of the X509 credential is first retrieved via
getCertificatePresenterEntityID(MessageContext)
. If this value is non-null, then trust evaluation
proceeds on that basis. If trust evaluation using this entity ID is successful, the message context's
authentication state will be set to true
via setAuthenticatedState(MessageContext, boolean)
and processing is terminated. If unsuccessful, a MessageHandlerException
is thrown.
If no value was available from getCertificatePresenterEntityID(MessageContext)
, then rule evaluation
will be attempted as described in evaluateCertificateNameDerivedPresenters(X509Credential, MessageContext)
,
based on the currently configured certificate name evaluation options. If this method returns a non-null certificate
presenter entity ID, it will be set on the message context by calling
setAuthenticatedCertificatePresenterEntityID(MessageContext, String)
. The message context's
authentication state will be set to true
via setAuthenticatedState(MessageContext, boolean)
.
Rule processing is then terminated. If the method returns null, the client certificate presenter entity ID
and message context authentication state will remain unmodified and rule processing continues.
Finally rule evaluation will proceed as described in
evaluateDerivedPresenters(X509Credential, MessageContext)
. This is primarily an extension point by which
subclasses may implement specific custom logic. If this method returns a non-null client certificate presenter entity
ID, it will be set via setAuthenticatedCertificatePresenterEntityID(MessageContext, String)
, the message
context's authentication state will be set to true
via
setAuthenticatedState(MessageContext, boolean)
and rule processing is terminated.
If the method returns null, the client certificate presenter entity ID and transport authentication state will remain
unmodified.
Constructor and Description |
---|
BaseClientCertAuthSecurityHandler() |
Modifier and Type | Method and Description |
---|---|
protected net.shibboleth.utilities.java.support.resolver.CriteriaSet |
buildCriteriaSet(String entityID,
MessageContext messageContext)
Subclasses are required to implement this method to build a criteria set for the trust engine
according to trust engine and application-specific needs.
|
protected void |
doEvaluate(X509Credential requestCredential,
MessageContext messageContext)
Evaluate the request credential.
|
protected void |
doInitialize() |
protected void |
doInvoke(MessageContext messageContext)
Performs the handler logic.
|
protected boolean |
doPreInvoke(MessageContext messageContext)
Called prior to execution, handlers may override this method to perform pre-processing for a request.
|
protected String |
evaluateCertificateNameDerivedPresenters(X509Credential requestCredential,
MessageContext messageContext)
Evaluate candidate presenter entity ID's which may be derived from the request credential's entity certificate
according to the options supplied via
CertificateNameOptions . |
protected String |
evaluateDerivedPresenters(X509Credential requestCredential,
MessageContext messageContext)
Evaluate any candidate presenter entity ID's which may be derived from the credential or other message context
information.
|
protected String |
evaluateSubjectAltNames(X509Credential requestCredential,
MessageContext messageContext)
Evaluate the presenter entity ID as derived from the cert subject alternative names specified by types enumerated
in
CertificateNameOptions.getSubjectAltNames() . |
protected String |
evaluateSubjectCommonName(X509Credential requestCredential,
MessageContext messageContext)
Evaluate the presenter entity ID as derived from the cert subject common name (CN).
|
protected String |
evaluateSubjectDN(X509Credential requestCredential,
MessageContext messageContext)
Evaluate the presenter entity ID as derived from the cert subject DN.
|
protected List<String> |
getAltNames(X509Certificate cert,
Integer altNameType)
Get the list of subject alt name values from the certificate which are of the specified alt name type.
|
protected CertificateNameOptions |
getCertificateNameOptions()
Get the certificate name options in use.
|
protected abstract String |
getCertificatePresenterEntityID(MessageContext messageContext)
Get the entity ID of the presenter of the client TLS certificate, as will be used for trust evaluation purposes.
|
protected String |
getCommonName(X509Certificate cert)
Get the first common name (CN) value from the subject DN of the specified certificate.
|
javax.servlet.http.HttpServletRequest |
getHttpServletRequest()
Get the HTTP servlet request being processed.
|
protected String |
getSubjectName(X509Certificate cert)
Get subject name from a certificate, using the currently configured X500DNHandler and subject DN output format.
|
protected TrustEngine<? super X509Credential> |
resolveTrustEngine(MessageContext messageContext)
Resolve a TrustEngine instance of the appropriate type from the message context.
|
protected abstract void |
setAuthenticatedCertificatePresenterEntityID(MessageContext messageContext,
String entityID)
Store the successfully authenticated derived entity ID of the certificate presenter in the message context.
|
protected abstract void |
setAuthenticatedState(MessageContext messageContext,
boolean authenticated)
Store the indicated message authentication state in the message context.
|
void |
setHttpServletRequest(javax.servlet.http.HttpServletRequest request)
Set the HTTP servlet request being processed.
|
evaluate, evaluate, getTrustEngine
doPostInvoke, doPostInvoke, getLogPrefix, invoke
destroy, doDestroy, initialize, isDestroyed, isInitialized
@NonnullAfterInit public javax.servlet.http.HttpServletRequest getHttpServletRequest()
public void setHttpServletRequest(@Nonnull javax.servlet.http.HttpServletRequest request)
request
- The to set.@Nullable protected CertificateNameOptions getCertificateNameOptions()
protected void doInitialize() throws net.shibboleth.utilities.java.support.component.ComponentInitializationException
doInitialize
in class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent
net.shibboleth.utilities.java.support.component.ComponentInitializationException
@Nullable protected TrustEngine<? super X509Credential> resolveTrustEngine(@Nonnull MessageContext messageContext)
resolveTrustEngine
in class BaseTrustEngineSecurityHandler<X509Credential>
messageContext
- the message context which is being evaluatedprotected boolean doPreInvoke(@Nonnull MessageContext messageContext) throws MessageHandlerException
If false is returned, execution will not proceed.
If returning successfully, the last step should be to return the result of the superclass version of this method.
doPreInvoke
in class BaseTrustEngineSecurityHandler<X509Credential>
messageContext
- the message context on which to invoke the handlerMessageHandlerException
- if there is a problem executing the handler pre-routineprotected void doInvoke(@Nonnull MessageContext messageContext) throws MessageHandlerException
doInvoke
in class AbstractMessageHandler
messageContext
- the message context on which to invoke the handlerMessageHandlerException
- if there is an error invoking the handler on the message contextprotected void doEvaluate(@Nonnull X509Credential requestCredential, @Nonnull MessageContext messageContext) throws MessageHandlerException
requestCredential
- the X509Credential derived from the requestmessageContext
- the message context being evaluatedMessageHandlerException
- thrown if a certificate presenter entity ID available from the message context
and the client certificate token can not be establishd as trusted on that basis, or if there is error
during evaluation processing@Nullable protected abstract String getCertificatePresenterEntityID(@Nonnull MessageContext messageContext)
This tends to be performed in a protcol-specific manner, so it is therefore abstract and must be implemented in a concrete subclass.
messageContext
- the current message contextprotected abstract void setAuthenticatedCertificatePresenterEntityID(@Nonnull MessageContext messageContext, @Nullable String entityID)
This tends to be performed in a protocol-specific manner, so it is therefore abstract and must be implemented in a concrete subclass.
messageContext
- the current message contextentityID
- the successfully authenticated derived entity ID of the client TLS certificate presenterprotected abstract void setAuthenticatedState(@Nonnull MessageContext messageContext, boolean authenticated)
This tends to be performed in a protocol-specific manner, so it is therefore abstract and must be implemented in a concrete subclass.
messageContext
- the current message contextauthenticated
- flag indicating what authentication state to store@Nullable protected net.shibboleth.utilities.java.support.resolver.CriteriaSet buildCriteriaSet(@Nullable String entityID, @Nonnull MessageContext messageContext) throws MessageHandlerException
buildCriteriaSet
in class BaseTrustEngineSecurityHandler<X509Credential>
entityID
- the candidate issuer entity ID which is being evaluatedmessageContext
- the message context which is being evaluatedMessageHandlerException
- thrown if criteria set can not be constructed@Nullable protected String evaluateDerivedPresenters(@Nonnull X509Credential requestCredential, @Nonnull MessageContext messageContext) throws MessageHandlerException
This serves primarily as an extension point for subclasses to implement application-specific logic.
If multiple derived candidate entity ID's would satisfy the trust engine criteria, the choice of which one to return as the canonical presenter entity ID value is implementation-specific.
requestCredential
- the X509Credential derived from the requestmessageContext
- the message context being evaluatedMessageHandlerException
- thrown if there is error during processing@Nullable protected String evaluateCertificateNameDerivedPresenters(@Nullable X509Credential requestCredential, @Nonnull MessageContext messageContext) throws MessageHandlerException
CertificateNameOptions
.
Configured certificate name types are derived as candidate presenter entity ID's and processed in the following order:
CertificateNameOptions.getX500DNHandler()
and using the output format indicated by
CertificateNameOptions.getX500SubjectDNFormat()
.CertificateNameOptions.getSubjectAltNames()
.
Note that this is a LinkedHashSet, so the order of evaluation is the order of insertion.
The first one of the above which is successfully evaluated by the trust engine using criteria built from
BaseTrustEngineSecurityHandler.buildCriteriaSet(String, MessageContext)
will be returned.
requestCredential
- the X509Credential derived from the requestmessageContext
- the message context being evaluatedMessageHandlerException
- thrown if there is error during processing@Nullable protected String evaluateSubjectCommonName(@Nonnull X509Credential requestCredential, @Nonnull MessageContext messageContext) throws MessageHandlerException
requestCredential
- the X509Credential derived from the requestmessageContext
- the message context being evaluatedMessageHandlerException
- thrown if there is error during processing@Nullable protected String evaluateSubjectDN(@Nonnull X509Credential requestCredential, @Nonnull MessageContext messageContext) throws MessageHandlerException
requestCredential
- the X509Credential derived from the requestmessageContext
- the message context being evaluatedMessageHandlerException
- thrown if there is error during processing@Nullable protected String evaluateSubjectAltNames(@Nonnull X509Credential requestCredential, @Nonnull MessageContext messageContext) throws MessageHandlerException
CertificateNameOptions.getSubjectAltNames()
.requestCredential
- the X509Credential derived from the requestmessageContext
- the message context being evaluatedMessageHandlerException
- thrown if there is error during processing@Nullable protected String getCommonName(@Nonnull X509Certificate cert)
cert
- the certificate being processed@Nullable protected String getSubjectName(@Nonnull X509Certificate cert)
cert
- the certificate being processed@Nonnull @NonnullElements protected List<String> getAltNames(@Nonnull X509Certificate cert, @Nonnull Integer altNameType)
cert
- the certificate from which to extract alt namesaltNameType
- the type of alt name to extractCopyright © 2017. All rights reserved.