Package org.opensaml.security.messaging.impl

Class BaseClientCertAuthSecurityHandler

    • Field Detail

      • log

        @Nonnull
private final org.slf4j.Logger log
        Logger.

      • certNameOptions

        @Nullable
private CertificateNameOptions certNameOptions
        Options for deriving client cert presenter entity ID's from an X.509 certificate.

      • httpServletRequest

        @NonnullAfterInit
private javax.servlet.http.HttpServletRequest httpServletRequest
        The HttpServletRequest being processed.

    • Constructor Detail

      • BaseClientCertAuthSecurityHandler

        public BaseClientCertAuthSecurityHandler()

    • Method Detail

      • getHttpServletRequest

        @NonnullAfterInit
public javax.servlet.http.HttpServletRequest getHttpServletRequest()
        Get the HTTP servlet request being processed.
        Returns:
        Returns the request.

      • setHttpServletRequest

        public void setHttpServletRequest​(@Nonnull
                                  javax.servlet.http.HttpServletRequest request)
        Set the HTTP servlet request being processed.
        Parameters:
        request - The to set.

      • getCertificateNameOptions

        @Nullable
protected CertificateNameOptions getCertificateNameOptions()
        Get the certificate name options in use.
        Returns:
        Returns the certNameOptions.

      • doEvaluate

        protected void doEvaluate​(@Nonnull
                          X509Credential requestCredential,
                          @Nonnull
                          MessageContext messageContext)
                   throws MessageHandlerException
        Evaluate the request credential.
        Parameters:
        requestCredential - the X509Credential derived from the request
        messageContext - the message context being evaluated
        Throws:
        MessageHandlerException - thrown if a certificate presenter entity ID available from the message context and the client certificate token can not be establishd as trusted on that basis, or if there is error during evaluation processing

      • getCertificatePresenterEntityID

        @Nullable
protected abstract String getCertificatePresenterEntityID​(@Nonnull
                                                          MessageContext messageContext)
        Get the entity ID of the presenter of the client TLS certificate, as will be used for trust evaluation purposes.

        This tends to be performed in a protcol-specific manner, so it is therefore abstract and must be implemented in a concrete subclass.

        Parameters:
        messageContext - the current message context
        Returns:
        the entity ID of the client TLS certificate presenter

      • setAuthenticatedCertificatePresenterEntityID

        protected abstract void setAuthenticatedCertificatePresenterEntityID​(@Nonnull
                                                                     MessageContext messageContext,
                                                                     @Nullable
                                                                     String entityID)
        Store the successfully authenticated derived entity ID of the certificate presenter in the message context.

        This tends to be performed in a protocol-specific manner, so it is therefore abstract and must be implemented in a concrete subclass.

        Parameters:
        messageContext - the current message context
        entityID - the successfully authenticated derived entity ID of the client TLS certificate presenter

      • setAuthenticatedState

        protected abstract void setAuthenticatedState​(@Nonnull
                                              MessageContext messageContext,
                                              boolean authenticated)
        Store the indicated message authentication state in the message context.

        This tends to be performed in a protocol-specific manner, so it is therefore abstract and must be implemented in a concrete subclass.

        Parameters:
        messageContext - the current message context
        authenticated - flag indicating what authentication state to store

      • buildCriteriaSet

        @Nullable
protected CriteriaSet buildCriteriaSet​(@Nullable
                                       String entityID,
                                       @Nonnull
                                       MessageContext messageContext)
                                throws MessageHandlerException
        Subclasses are required to implement this method to build a criteria set for the trust engine according to trust engine and application-specific needs.
        Specified by:
        buildCriteriaSet in class BaseTrustEngineSecurityHandler<X509Credential>
        Parameters:
        entityID - the candidate issuer entity ID which is being evaluated
        messageContext - the message context which is being evaluated
        Returns:
        a newly constructly set of criteria suitable for the configured trust engine
        Throws:
        MessageHandlerException - thrown if criteria set can not be constructed

      • evaluateDerivedPresenters

        @Nullable
protected String evaluateDerivedPresenters​(@Nonnull
                                           X509Credential requestCredential,
                                           @Nonnull
                                           MessageContext messageContext)
                                    throws MessageHandlerException
        Evaluate any candidate presenter entity ID's which may be derived from the credential or other message context information.

        This serves primarily as an extension point for subclasses to implement application-specific logic.

        If multiple derived candidate entity ID's would satisfy the trust engine criteria, the choice of which one to return as the canonical presenter entity ID value is implementation-specific.

        Parameters:
        requestCredential - the X509Credential derived from the request
        messageContext - the message context being evaluated
        Returns:
        a presenter entity ID which was successfully evaluated by the trust engine
        Throws:
        MessageHandlerException - thrown if there is error during processing

      • evaluateSubjectCommonName

        @Nullable
protected String evaluateSubjectCommonName​(@Nonnull
                                           X509Credential requestCredential,
                                           @Nonnull
                                           MessageContext messageContext)
                                    throws MessageHandlerException
        Evaluate the presenter entity ID as derived from the cert subject common name (CN). Only the first CN value from the subject DN is evaluated.
        Parameters:
        requestCredential - the X509Credential derived from the request
        messageContext - the message context being evaluated
        Returns:
        a presenter entity ID which was successfully evaluated by the trust engine
        Throws:
        MessageHandlerException - thrown if there is error during processing

      • evaluateSubjectDN

        @Nullable
protected String evaluateSubjectDN​(@Nonnull
                                   X509Credential requestCredential,
                                   @Nonnull
                                   MessageContext messageContext)
                            throws MessageHandlerException
        Evaluate the presenter entity ID as derived from the cert subject DN.
        Parameters:
        requestCredential - the X509Credential derived from the request
        messageContext - the message context being evaluated
        Returns:
        a presenter entity ID which was successfully evaluated by the trust engine
        Throws:
        MessageHandlerException - thrown if there is error during processing

      • evaluateSubjectAltNames

        @Nullable
protected String evaluateSubjectAltNames​(@Nonnull
                                         X509Credential requestCredential,
                                         @Nonnull
                                         MessageContext messageContext)
                                  throws MessageHandlerException
        Evaluate the presenter entity ID as derived from the cert subject alternative names specified by types enumerated in CertificateNameOptions.getSubjectAltNames().
        Parameters:
        requestCredential - the X509Credential derived from the request
        messageContext - the message context being evaluated
        Returns:
        a presenter entity ID which was successfully evaluated by the trust engine
        Throws:
        MessageHandlerException - thrown if there is error during processing

      • getCommonName

        @Nullable
protected String getCommonName​(@Nonnull
                               X509Certificate cert)
        Get the first common name (CN) value from the subject DN of the specified certificate.
        Parameters:
        cert - the certificate being processed
        Returns:
        the first CN value, or null if there are none

      • getSubjectName

        @Nullable
protected String getSubjectName​(@Nonnull
                                X509Certificate cert)
        Get subject name from a certificate, using the currently configured X500DNHandler and subject DN output format.
        Parameters:
        cert - the certificate being processed
        Returns:
        the subject name

      • getAltNames

        @Nonnull
@NonnullElements
protected List<String> getAltNames​(@Nonnull
                                   X509Certificate cert,
                                   @Nonnull
                                   Integer altNameType)
        Get the list of subject alt name values from the certificate which are of the specified alt name type.
        Parameters:
        cert - the certificate from which to extract alt names
        altNameType - the type of alt name to extract
        Returns:
        the list of certificate subject alt names