LoginHandler (Shibboleth Identity Provider 2.4.2 API)

All Known Implementing Classes:

AbstractLoginHandler, ExternalAuthnSystemLoginHandler, IPAddressLoginHandler, PreviousSessionLoginHandler, RemoteUserLoginHandler, UsernamePasswordLoginHandler
```
public interface LoginHandler
```
Authentication handlers authenticate a user in an implementation specific manner. Some examples of this might be by collecting a user name and password and validating it against an LDAP directory, validating a client certificate, or validating one-time password. When a login handler is invoked the user's Session is bound to the HttpSession under the attribute with the name Session.HTTP_SESSION_BINDING_ATTRIBUTE. After a successful authentication has been completed the handler MUST either:
- Bind a Subject to the attribute identified by SUBJECT_KEY if one was created during the authentication process. The principals, public, and private credentials from this subject will be merged with those in the Subject within the Session.
- Bind a Principal for the user to the request attribute identified by PRINCIPAL_KEY . Such a Principal MUST implement Serializable. This principal will be added to the Subject within the Session.
- Bind a principal name string to the request attribute identified by PRINCIPAL_NAME_KEY. In this case the AuthenticationEngine will create a Principal object of type UsernamePrincipal and add that to the Subject within the Session.
The handler SHOULD also:
- Bind a URI string, representing the authentication method actually used, to a request attribute identified by AUTHENTICATION_METHOD_KEY. Failure to do so may lead to a situation where one authentication method is started but a user switches to a weaker one in mid-process. Without the login handler explicitly setting the method, the first method that is started is what will be reported to the relying party.
The handler MAY also:
- Bind an error message, if an error occurred during authentication to the request attribute identified by AUTHENTICATION_ERROR_KEY.
- Bind a AuthenticationException, if an exception occurred during authentication to the request attribute identified by AUTHENTICATION_EXCEPTION_KEY.
Finally, the handler must return control to the authentication engine by invoking AuthenticationEngine.returnToAuthenticationEngine(HttpServletRequest, HttpServletResponse). After which the authentication handler must immediately return. Handlers MUST NOT change or add any data to the user's HttpSession that persists past the process of authenticating the user, that is no additional session data may be added and no existing session data may be changed when the handler returns control to the authentication engine.

Field Summary

Fields
Modifier and Type	Field and Description
`static String`	`AUTHENTICATION_ERROR_KEY` Request attribute to which an error message may be bound.
`static String`	`AUTHENTICATION_EXCEPTION_KEY` Request attribute to which an `AuthenticationException` may be bound.
`static String`	`AUTHENTICATION_INSTANT_KEY` Request attribute to which an authentication timestamp may be bound.
`static String`	`AUTHENTICATION_METHOD_KEY` Request attribute to which an authentication method URI may be bound.
`static String`	`PRINCIPAL_KEY` Request attribute to which user's principal should be bound.
`static String`	`PRINCIPAL_NAME_KEY` Request attribute to which user's principal name should be bound.
`static String`	`SUBJECT_KEY` Request attribute to which user's subject should be bound.

Method Summary

Methods
Modifier and Type	Method and Description
`long`	`getAuthenticationDuration()` Gets the length of time, in milliseconds, after which a user authenticated by this handler should be re-authenticated.
`List<String>`	`getSupportedAuthenticationMethods()` Gets the list of authentication methods this handler supports.
`void`	`login(javax.servlet.http.HttpServletRequest httpRequest, javax.servlet.http.HttpServletResponse httpResponse)` Authenticate the user making the request.
`boolean`	`supportsForceAuthentication()` Returns if this handler supports the ability to force a user to (re-)authenticate.
`boolean`	`supportsPassive()` Gets whether this handler supports passive authentication.

- Field Detail
  - PRINCIPAL_KEY
```
static final String PRINCIPAL_KEY
```
    Request attribute to which user's principal should be bound.
    
    See Also:
    Constant Field Values
  - PRINCIPAL_NAME_KEY
```
static final String PRINCIPAL_NAME_KEY
```
    Request attribute to which user's principal name should be bound.
    
    See Also:
    Constant Field Values
  - SUBJECT_KEY
```
static final String SUBJECT_KEY
```
    Request attribute to which user's subject should be bound.
    
    See Also:
    Constant Field Values
  - AUTHENTICATION_METHOD_KEY
```
static final String AUTHENTICATION_METHOD_KEY
```
    Request attribute to which an authentication method URI may be bound.
    
    See Also:
    Constant Field Values
  - AUTHENTICATION_INSTANT_KEY
```
static final String AUTHENTICATION_INSTANT_KEY
```
    Request attribute to which an authentication timestamp may be bound.
    
    See Also:
    Constant Field Values
  - AUTHENTICATION_ERROR_KEY
```
static final String AUTHENTICATION_ERROR_KEY
```
    Request attribute to which an error message may be bound.
    
    See Also:
    Constant Field Values
  - AUTHENTICATION_EXCEPTION_KEY
```
static final String AUTHENTICATION_EXCEPTION_KEY
```
    Request attribute to which an AuthenticationException may be bound.
    
    See Also:
    Constant Field Values
- Method Detail
  - getSupportedAuthenticationMethods
```
List<String> getSupportedAuthenticationMethods()
```
    Gets the list of authentication methods this handler supports.
    
    Returns:
    authentication methods this handler supports
  - getAuthenticationDuration
```
long getAuthenticationDuration()
```
    Gets the length of time, in milliseconds, after which a user authenticated by this handler should be re-authenticated.
    
    Returns:
    length of time, in milliseconds, after which a user should be re-authenticated
  - supportsPassive
```
boolean supportsPassive()
```
    Gets whether this handler supports passive authentication.
    
    Returns:
    whether this handler supports passive authentication
  - supportsForceAuthentication
```
boolean supportsForceAuthentication()
```
    Returns if this handler supports the ability to force a user to (re-)authenticate.
    
    Returns:
    if this handler can force a user to (re-)authenticate.
  - login
```
void login(javax.servlet.http.HttpServletRequest httpRequest,
         javax.servlet.http.HttpServletResponse httpResponse)
```
    Authenticate the user making the request.
    
    Parameters:
    httpRequest - user request
    httpResponse - response to user

Interface LoginHandler

Field Summary

Method Summary

Field Detail

PRINCIPAL_KEY

PRINCIPAL_NAME_KEY

SUBJECT_KEY

AUTHENTICATION_METHOD_KEY

AUTHENTICATION_INSTANT_KEY

AUTHENTICATION_ERROR_KEY

AUTHENTICATION_EXCEPTION_KEY

Method Detail

getSupportedAuthenticationMethods

getAuthenticationDuration

supportsPassive

supportsForceAuthentication

login