Package org.springframework.security.saml2.provider.service.authentication

Class OpenSaml4AuthenticationRequestFactory

java.lang.Object

org.springframework.security.saml2.provider.service.authentication.OpenSaml4AuthenticationRequestFactory

All Implemented Interfaces:

Saml2AuthenticationRequestFactory

public final class OpenSaml4AuthenticationRequestFactory
extends java.lang.Object
implements Saml2AuthenticationRequestFactory

A Saml2AuthenticationRequestFactory that generates, signs, and serializes a SAML 2.0 AuthnRequest using OpenSAML 4

Since:

5.5

Constructor Summary

Constructors

Constructor	Description
OpenSaml4AuthenticationRequestFactory()	Creates an OpenSaml4AuthenticationRequestFactory

Method Summary

Modifier and Type	Method	Description
java.lang.String	createAuthenticationRequest(Saml2AuthenticationRequest request)	Deprecated.
Saml2PostAuthenticationRequest	createPostAuthenticationRequest(Saml2AuthenticationRequestContext context)	Creates all the necessary AuthNRequest parameters for a POST binding.
Saml2RedirectAuthenticationRequest	createRedirectAuthenticationRequest(Saml2AuthenticationRequestContext context)	Creates all the necessary AuthNRequest parameters for a REDIRECT binding.
void	setAuthenticationRequestContextConverter(org.springframework.core.convert.converter.Converter<Saml2AuthenticationRequestContext,org.opensaml.saml.saml2.core.AuthnRequest> authenticationRequestContextConverter)	Set the strategy for building an AuthnRequest from a given context
void	setClock(java.time.Clock clock)	Use this Clock with Instant.now() for generating timestamps

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

OpenSaml4AuthenticationRequestFactory

public OpenSaml4AuthenticationRequestFactory()

Creates an OpenSaml4AuthenticationRequestFactory

Method Detail

createAuthenticationRequest

@Deprecated
public java.lang.String createAuthenticationRequest(Saml2AuthenticationRequest request)

Deprecated.

Creates an authentication request from the Service Provider, sp, to the Identity Provider, idp. The authentication result is an XML string that may be signed, encrypted, both or neither. This method only returns the SAMLRequest string for the request, and for a complete set of data parameters please use Saml2AuthenticationRequestFactory.createRedirectAuthenticationRequest(Saml2AuthenticationRequestContext) or Saml2AuthenticationRequestFactory.createPostAuthenticationRequest(Saml2AuthenticationRequestContext)

Specified by:

createAuthenticationRequest in interface Saml2AuthenticationRequestFactory

Parameters:

request - information about the identity provider, the recipient of this authentication request and accompanying data

Returns:

XML data in the format of a String. This data may be signed, encrypted, both signed and encrypted with the signature embedded in the XML or neither signed and encrypted

createPostAuthenticationRequest

public Saml2PostAuthenticationRequest createPostAuthenticationRequest(Saml2AuthenticationRequestContext context)

Creates all the necessary AuthNRequest parameters for a POST binding. If the Saml2AuthenticationRequestContext doesn't contain any Saml2X509Credential.Saml2X509CredentialType.SIGNING credentials the result will not contain any signatures. The data set will be signed and encoded for POST binding and if applicable signed with XML signatures. will contain the following parameters to be sent as part of the form data: SAMLRequest, RelayState. The default implementation of this method returns the SAMLRequest message with an XML signature embedded, that should only be used for the Saml2MessageBinding.POST binding.

Specified by:

createPostAuthenticationRequest in interface Saml2AuthenticationRequestFactory

Parameters:

context - - information about the identity provider, the recipient of this authentication request and accompanying data

Returns:

a Saml2PostAuthenticationRequest object with applicable http parameters necessary to make the AuthNRequest over a POST binding. All parameters will be SAML encoded but not escaped for Form Data.

createRedirectAuthenticationRequest

public Saml2RedirectAuthenticationRequest createRedirectAuthenticationRequest(Saml2AuthenticationRequestContext context)

Creates all the necessary AuthNRequest parameters for a REDIRECT binding. If the Saml2AuthenticationRequestContext doesn't contain any Saml2X509Credential.Saml2X509CredentialType.SIGNING credentials the result will not contain any signatures. The data set will be signed and encoded for REDIRECT binding including the DEFLATE encoding. It will contain the following parameters to be sent as part of the query string: SAMLRequest, RelayState, SigAlg, Signature. The default implementation, for sake of backwards compatibility, of this method returns the SAMLRequest message with an XML signature embedded, that should only be used for theSaml2MessageBinding.POST binding, but works over Saml2MessageBinding.POST with most providers.

Specified by:

createRedirectAuthenticationRequest in interface Saml2AuthenticationRequestFactory

Parameters:

context - - information about the identity provider, the recipient of this authentication request and accompanying data

Returns:

a Saml2RedirectAuthenticationRequest object with applicable http parameters necessary to make the AuthNRequest over a POST or REDIRECT binding. All parameters will be SAML encoded/deflated, but escaped, ie URI encoded or encoded for Form Data.

setAuthenticationRequestContextConverter

public void setAuthenticationRequestContextConverter(org.springframework.core.convert.converter.Converter<Saml2AuthenticationRequestContext,org.opensaml.saml.saml2.core.AuthnRequest> authenticationRequestContextConverter)

Set the strategy for building an AuthnRequest from a given context

Parameters:

authenticationRequestContextConverter - the conversion strategy to use

setClock

public void setClock(java.time.Clock clock)

Use this Clock with Instant.now() for generating timestamps

Parameters:

clock - the Clock to use