|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
public interface IdpAuthenticationAdapter
This interface defines the methods that the PingFederate server calls when performing the web single sign-on and single logout profiles of SAML 2. This is the integration point the PingFederate server uses to lookup and terminate authenticated user sessions at the external web application or authentication provider service.
See ConfigurableAuthnAdapter
for methods that need to be implemented to facilitate communication of
configuration information with the PingFederate server.
AuthnContextClassRef
Field Summary | |
---|---|
static java.lang.String |
AUTHN_CTX_ATTRIBUTE_NAME
Use this as a key in the map returned by lookupAuthN(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, java.lang.String, org.sourceid.saml20.adapter.idp.authn.AuthnPolicy, java.lang.String) to set the value of the AuthnContextClassRef
element in the assertion. |
static java.lang.String |
AUTHN_INSTANT_ATTRIBUTE_NAME
Use this as a key in the map returned by lookupAuthN(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, java.lang.String, org.sourceid.saml20.adapter.idp.authn.AuthnPolicy, java.lang.String) to set the value of the authentication instant
in the assertion. |
Method Summary | |
---|---|
IdpAuthnAdapterDescriptor |
getAdapterDescriptor()
The PingFederate server will invoke this method on your adapter implementation to discover metadata about the implementation. |
boolean |
logoutAuthN(java.util.Map authnIdentifiers,
javax.servlet.http.HttpServletRequest req,
javax.servlet.http.HttpServletResponse resp,
java.lang.String resumePath)
This is the method that the PingFederate server will invoke during processing of a SAML 2 single logout to terminate a security context for a user at the external application or authentication provider service. |
java.util.Map |
lookupAuthN(javax.servlet.http.HttpServletRequest req,
javax.servlet.http.HttpServletResponse resp,
java.lang.String partnerSpEntityId,
AuthnPolicy authnPolicy,
java.lang.String resumePath)
This is the method that the PingFederate server will invoke during processing of a SAML 2 single sign-on transaction to lookup information about an authenticated security context or session for a user at the external application or authentication provider service. |
Methods inherited from interface org.sourceid.saml20.adapter.ConfigurableAuthnAdapter |
---|
configure |
Field Detail |
---|
static final java.lang.String AUTHN_CTX_ATTRIBUTE_NAME
lookupAuthN(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, java.lang.String, org.sourceid.saml20.adapter.idp.authn.AuthnPolicy, java.lang.String)
to set the value of the AuthnContextClassRef
element in the assertion. If no value is provided with this key, the system will look to see if
IdpAuthnAdapterDescriptor.allowConfigurableAuthnCtx()
is true and if it is, it will use the
UI configured value. If all of the above fails to find a value, unspecified will be used.
static final java.lang.String AUTHN_INSTANT_ATTRIBUTE_NAME
lookupAuthN(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, java.lang.String, org.sourceid.saml20.adapter.idp.authn.AuthnPolicy, java.lang.String)
to set the value of the authentication instant
in the assertion.
The value representing the authentication instant can be of type java.util.Date, java.util.Calendar,
or java.lang.Long.
If no value is provided with this key, the system will use the current time.
Method Detail |
---|
IdpAuthnAdapterDescriptor getAdapterDescriptor()
getAdapterDescriptor
in interface ConfigurableAuthnAdapter
java.util.Map lookupAuthN(javax.servlet.http.HttpServletRequest req, javax.servlet.http.HttpServletResponse resp, java.lang.String partnerSpEntityId, AuthnPolicy authnPolicy, java.lang.String resumePath) throws AuthnAdapterException, java.io.IOException
If your implementation of this method needs to operate asynchronously, it just needs to write to the
HttpServletResponse as appropriate and commit it. Right after invoking this method the PingFederate server
checks to see if the response has been committed. If the response has been committed, PingFederate saves
the state it needs and discontinues processing for the current transaction. Processing of the transaction is
continued when the user agent returns to the resumePath
at the PingFederate server at which
point the server invokes this method again. This series of events will be repeated until this method
returns without committing the response. When that happens (which could be the first invocation) PingFederate
will complete the protocol transaction processing with the return result of this method.
Note that if the response is committed, then PingFederate ignores the return value. Only the return value of an invocation that does not commit the response will be used.
req
- the HttpServletRequest can be used to read cookies, parameters, headers, etc. It can also be used
to find out more about the request like the full URL the request was made to. Note that access to the
HttpSession is also available via the request and adapters can utilize it if needed. However, PingFederate also
uses the HttpSession, so attribute names should be appropriately qualified to avoid collisions and
the HttpSession should never be invalidated.resp
- the HttpServletResponse. The response can be used to facilitate an asynchronous interaction.
Sending a client side redirect or writing (and flushing) custom content to the response are two ways that
an invocation of this method allows for the adapter to take control of the user agent. Note that if
control of the user agent is taken in this way, then the agent must eventually be returned to the
resumePath
endpoint at the PingFederate server to complete the protocol transaction.partnerSpEntityId
- the entity id of the SP to whom the single sign-on will be sent.authnPolicy
- an object with values that restricts what kind of user interaction is allowed or
required during the authentication.resumePath
- the relative URL that the user agent needs to return to, if the implementation of this method
invocation needs to operate asynchronously. If this method operates synchronously, this parameter can
be ignored. The resumePath is the full path portion of the URL - everything after hostname and port. If
the hostname, port, or protocol are needed, they can be derived using the HttpServletRequest.
getAdapterDescriptor()
). This map will also be passed back
to the adapter implementation on logout as the first parameter of the logoutAuthN(java.util.Map, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, java.lang.String)
method. This
enables the adapter to identify what session or security context to terminate during logout.
AuthnAdapterException
- for any unexpected runtime problem that the implementation cannot handle.
java.io.IOException
- for any problem with I/O (typically any operation that writes to the HttpServletResponse).boolean logoutAuthN(java.util.Map authnIdentifiers, javax.servlet.http.HttpServletRequest req, javax.servlet.http.HttpServletResponse resp, java.lang.String resumePath) throws AuthnAdapterException, java.io.IOException
If your implementation of this method needs to operate asynchronously, it just needs to write to the
HttpServletResponse as appropriate and commit it. Right after invoking this method the PingFederate server
checks to see if the response has been committed. If the response has been committed, PingFederate saves
the state it needs and discontinues processing for the current transaction. Processing of the transaction is
continued when the user agent returns to the resumePath
at the PingFederate server at which
point the server invokes this method again. This series of events will be repeated until this method
returns without committing the response. When that happens (which could be the first invocation) PingFederate
will complete the protocol transaction processing with the return result of this method.
Note that if the response is committed, then PingFederate ignores the return value. Only the return value of an invocation that does not commit the response will be used. Note that access to the HttpSession is also available via the request and adapters can utilize it if needed. However, PingFederate also uses the HttpSession, so attribute names should be appropriately qualified to avoid collisions and the HttpSession should never be invalidated.
Note on SOAP logout: If this logout is being invoked as the result of a back channel protocol request, the request, response and resumePath parameters will all be null as they have no meaning in such a context where the user agent is inaccessible.
authnIdentifiers
- the map of authentication identifiers originally returned to the PingFederate server
by the lookupAuthN(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, java.lang.String, org.sourceid.saml20.adapter.idp.authn.AuthnPolicy, java.lang.String)
method. This enables the adapter to associate a security context or session
returned by lookupAuthN with the invocation of this logout method.req
- the HttpServletRequest can be used to read cookies, parameters, headers, etc. It can also be used
to find out more about the request like the full URL the request was made to.resp
- the HttpServletResponse. The response can be used to facilitate an asynchronous interaction.
Sending a client side redirect or writing (and flushing) custom content to the response are two ways that
an invocation of this method allows for the adapter to take control of the user agent. Note that if
control of the user agent is taken in this way, then the agent must eventually be returned to the
resumePath
endpoint at the PingFederate server to complete the protocol transaction.resumePath
- the relative URL that the user agent needs to return to, if the implementation of this method
invocation needs to operate asynchronously. If this method operates synchronously, this parameter can
be ignored. The resumePath is the full path portion of the URL - everything after hostname and port. If
the hostname, port, or protocol are needed, they can be derived using the HttpServletRequest.
AuthnAdapterException
- for any unexpected runtime problem that the implementation cannot handle.
java.io.IOException
- for any problem with I/O (typically any operation that writes to the HttpServletResponse
will throw an IOException.
|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |