org.apereo.cas

Class DefaultCentralAuthenticationService

java.lang.Object

org.apereo.cas.AbstractCentralAuthenticationService

org.apereo.cas.DefaultCentralAuthenticationService

All Implemented Interfaces:

java.io.Serializable, CentralAuthenticationService, org.springframework.beans.factory.Aware, org.springframework.context.ApplicationEventPublisherAware

@Transactional(transactionManager="ticketTransactionManager")
public class DefaultCentralAuthenticationService
extends AbstractCentralAuthenticationService

Concrete implementation of a CentralAuthenticationService, and also the central, organizing component of CAS' internal implementation. This class is threadsafe.

Since:

3.0.0

See Also:

Serialized Form

Field Summary

Fields inherited from class org.apereo.cas.AbstractCentralAuthenticationService

applicationEventPublisher, authenticationRequestServiceSelectionStrategies, cipherExecutor, logoutManager, principalFactory, serviceContextAuthenticationPolicyFactory, servicesManager, ticketFactory, ticketRegistry

Constructor Summary

Constructors

Constructor and Description

DefaultCentralAuthenticationService(TicketRegistry ticketRegistry, TicketFactory ticketFactory, ServicesManager servicesManager, LogoutManager logoutManager, AuthenticationServiceSelectionPlan selectionStrategies, ContextualAuthenticationPolicyFactory<ServiceContext> authenticationPolicyFactory, PrincipalFactory principalFactory, CipherExecutor<java.lang.String,java.lang.String> cipherExecutor) Build the central authentication service implementation.

Method Summary

Modifier and Type	Method and Description
ProxyGrantingTicket	createProxyGrantingTicket(java.lang.String serviceTicketId, AuthenticationResult authenticationResult) Delegate a TicketGrantingTicket to a Service for proxying authentication to other Services.
TicketGrantingTicket	createTicketGrantingTicket(AuthenticationResult authenticationResult) Create a TicketGrantingTicket by authenticating credentials.
java.util.List<LogoutRequest>	destroyTicketGrantingTicket(java.lang.String ticketGrantingTicketId) Destroy a TicketGrantingTicket and perform back channel logout.
ProxyTicket	grantProxyTicket(java.lang.String proxyGrantingTicket, Service service) Grant a ProxyTicket that may be used to access the given service by authenticating the given credentials.
ServiceTicket	grantServiceTicket(java.lang.String ticketGrantingTicketId, Service service, AuthenticationResult authenticationResult) Grant a ServiceTicket that may be used to access the given service by authenticating the given credentials.
Assertion	validateServiceTicket(java.lang.String serviceTicketId, Service service) Validate a ServiceTicket for a particular Service.

Methods inherited from class org.apereo.cas.AbstractCentralAuthenticationService

deleteTicket, doPublishEvent, evaluateProxiedServiceIfNeeded, getAuthenticationSatisfiedByPolicy, getTicket, getTicket, getTickets, isTicketAuthenticityVerified, resolveServiceFromAuthenticationRequest, setApplicationEventPublisher, updateTicket, verifyTicketState

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

DefaultCentralAuthenticationService

public DefaultCentralAuthenticationService(TicketRegistry ticketRegistry,
                                           TicketFactory ticketFactory,
                                           ServicesManager servicesManager,
                                           LogoutManager logoutManager,
                                           AuthenticationServiceSelectionPlan selectionStrategies,
                                           ContextualAuthenticationPolicyFactory<ServiceContext> authenticationPolicyFactory,
                                           PrincipalFactory principalFactory,
                                           CipherExecutor<java.lang.String,java.lang.String> cipherExecutor)

Build the central authentication service implementation.

Parameters:

ticketRegistry - the tickets registry.

ticketFactory - the ticket factory

servicesManager - the services manager.

logoutManager - the logout manager.

selectionStrategies - The service selection strategy during validation events.

authenticationPolicyFactory - Authentication policy that uses a service context to produce stateful security policies to apply when authenticating credentials.

principalFactory - principal factory to create principal objects

cipherExecutor - Cipher executor to handle ticket validation.

Method Detail

destroyTicketGrantingTicket

@Timed(name="DESTROY_TICKET_GRANTING_TICKET_TIMER")
 @Metered(name="DESTROY_TICKET_GRANTING_TICKET_METER")
 @Counted(name="DESTROY_TICKET_GRANTING_TICKET_COUNTER",
         monotonic=true)
public java.util.List<LogoutRequest> destroyTicketGrantingTicket(java.lang.String ticketGrantingTicketId)

Description copied from interface: CentralAuthenticationService

Destroy a TicketGrantingTicket and perform back channel logout. This has the effect of invalidating any Ticket that was derived from the TicketGrantingTicket being destroyed. May throw an IllegalArgumentException if the TicketGrantingTicket ID is null.

Parameters:

ticketGrantingTicketId - the id of the ticket we want to destroy

Returns:

the logout requests.

grantServiceTicket

@Timed(name="GRANT_SERVICE_TICKET_TIMER")
 @Metered(name="GRANT_SERVICE_TICKET_METER")
 @Counted(name="GRANT_SERVICE_TICKET_COUNTER",
         monotonic=true)
public ServiceTicket grantServiceTicket(java.lang.String ticketGrantingTicketId,
                                                                                                                                                                                                           Service service,
                                                                                                                                                                                                           AuthenticationResult authenticationResult)
                                                                                                                                                                                                    throws AuthenticationException,
                                                                                                                                                                                                           AbstractTicketException

Description copied from interface: CentralAuthenticationService

Grant a ServiceTicket that may be used to access the given service by authenticating the given credentials. The details of the security policy around credential authentication and the definition of authentication success are dependent on the implementation, but it SHOULD be safe to assume that at least one credential MUST be authenticated for ticket creation to succeed.

The principal that is resolved from the authenticated credentials MUST be the same as that to which the given ticket-granting ticket was issued.

Parameters:

ticketGrantingTicketId - Proof of prior authentication.

service - The target service of the ServiceTicket.

authenticationResult - The authentication context established if credentials provided

Returns:

Non -null service ticket identifier.

Throws:

AuthenticationException - on errors authenticating the credentials

AbstractTicketException - if the ticket could not be created.

grantProxyTicket

@Timed(name="GRANT_PROXY_TICKET_TIMER")
 @Metered(name="GRANT_PROXY_TICKET_METER")
 @Counted(name="GRANT_PROXY_TICKET_COUNTER",
         monotonic=true)
public ProxyTicket grantProxyTicket(java.lang.String proxyGrantingTicket,
                                                                                                                                                                                                 Service service)
                                                                                                                                                                                          throws AbstractTicketException

Description copied from interface: CentralAuthenticationService

Grant a ProxyTicket that may be used to access the given service by authenticating the given credentials. The details of the security policy around credential authentication and the definition of authentication success are dependent on the implementation, but it SHOULD be safe to assume that at least one credential MUST be authenticated for ticket creation to succeed.

The principal that is resolved from the authenticated credentials MUST be the same as that to which the given ticket-granting ticket was issued.

Parameters:

proxyGrantingTicket - Proof of prior authentication.

service - The target service of the ServiceTicket.

Returns:

Non -null service ticket identifier.

Throws:

AbstractTicketException - if the ticket could not be created.

createProxyGrantingTicket

@Timed(name="CREATE_PROXY_GRANTING_TICKET_TIMER")
 @Metered(name="CREATE_PROXY_GRANTING_TICKET_METER")
 @Counted(name="CREATE_PROXY_GRANTING_TICKET_COUNTER",
         monotonic=true)
public ProxyGrantingTicket createProxyGrantingTicket(java.lang.String serviceTicketId,
                                                                                                                                                                                                                                                AuthenticationResult authenticationResult)
                                                                                                                                                                                                                                         throws AuthenticationException,
                                                                                                                                                                                                                                                AbstractTicketException

Description copied from interface: CentralAuthenticationService

Delegate a TicketGrantingTicket to a Service for proxying authentication to other Services.

Parameters:

serviceTicketId - The service ticket identifier that will delegate to a TicketGrantingTicket.

authenticationResult - The current authentication context before this ticket can be granted.

Returns:

Non -null ticket-granting ticket identifier that can grant ServiceTicket that proxy authentication.

Throws:

AuthenticationException - on errors authenticating the credentials

AbstractTicketException - if there was an error creating the ticket

validateServiceTicket

@Timed(name="VALIDATE_SERVICE_TICKET_TIMER")
 @Metered(name="VALIDATE_SERVICE_TICKET_METER")
 @Counted(name="VALIDATE_SERVICE_TICKET_COUNTER",
         monotonic=true)
public Assertion validateServiceTicket(java.lang.String serviceTicketId,
                                                                                                                                                                                                                   Service service)
                                                                                                                                                                                                            throws AbstractTicketException

Description copied from interface: CentralAuthenticationService

Validate a ServiceTicket for a particular Service.

Parameters:

serviceTicketId - Proof of prior authentication.

service - Service wishing to validate a prior authentication.

Returns:

Non -null ticket validation assertion.

Throws:

AbstractTicketException - if there was an error validating the ticket.

createTicketGrantingTicket

@Timed(name="CREATE_TICKET_GRANTING_TICKET_TIMER")
 @Metered(name="CREATE_TICKET_GRANTING_TICKET_METER")
 @Counted(name="CREATE_TICKET_GRANTING_TICKET_COUNTER",
         monotonic=true)
public TicketGrantingTicket createTicketGrantingTicket(AuthenticationResult authenticationResult)
                                                                                                                                                                                                                                              throws AuthenticationException,
                                                                                                                                                                                                                                                     AbstractTicketException

Description copied from interface: CentralAuthenticationService

Create a TicketGrantingTicket by authenticating credentials. The details of the security policy around credential authentication and the definition of authentication success are dependent on the implementation, but it SHOULD be safe to assume that at least one credential MUST be authenticated for ticket creation to succeed.

Parameters:

authenticationResult - the current authentication result in order to create the ticket.

Returns:

Non -null ticket-granting ticket identifier.

Throws:

AuthenticationException - on errors authenticating the credentials

AbstractTicketException - if ticket cannot be created