public class ClientCertAuthRule extends BaseTrustEngineRule<org.opensaml.xml.security.x509.X509Credential>
This rule is only evaluated if the message context contains a peer X509Credential
as returned from the
inbound message context's inbound message transport Transport.getPeerCredential()
.
If the inbound message issuer has been previously set in the message context by another rule, then that issuer is
used to evaluate the request's X509Credential. If this trust evaluation is successful, the message context's inbound
transport authentication state will be set to true
and processing is terminated. If unsuccessful, a
SecurityPolicyException
is thrown.
If no context issuer was previously set, then rule evaluation will be attempted as described in
evaluateCertificateNameDerivedIssuers(X509Credential, MessageContext)
, based on the currently configured
certificate name evaluation options. If this method returns a non-null issuer entity ID, it will be set as the
inbound message issuer in the message context, the message context's inbound transport issuer authentication state
will be set to true
and rule processing is terminated. If the method returns null, the message context
issuer and transport authentication state will remain unmodified and rule processing continues.
Finally rule evaluation will proceed as described in evaluateDerivedIssuers(X509Credential, MessageContext)
.
This is primarily an extension point by which subclasses may implement specific custom logic. If this method returns
a non-null issuer entity ID, it will be set as the inbound message issuer in the message context, the message
context's inbound transport authentication state will be set to true
and rule processing is
terminated. If the method returns null, the message context issuer and transport authentication state will remain
unmodified.
Constructor and Description |
---|
ClientCertAuthRule(org.opensaml.xml.security.trust.TrustEngine<org.opensaml.xml.security.x509.X509Credential> engine,
CertificateNameOptions nameOptions)
Constructor.
|
Modifier and Type | Method and Description |
---|---|
protected org.opensaml.xml.security.CriteriaSet |
buildCriteriaSet(String entityID,
MessageContext messageContext)
Subclasses are required to implement this method to build a criteria set for the trust engine
according to trust engine and application-specific needs.
|
protected void |
doEvaluate(org.opensaml.xml.security.x509.X509Credential requestCredential,
MessageContext messageContext)
Evaluate the request credential.
|
void |
evaluate(MessageContext messageContext)
Evaluates the message context against the rule.
|
protected String |
evaluateCertificateNameDerivedIssuers(org.opensaml.xml.security.x509.X509Credential requestCredential,
MessageContext messageContext)
Evaluate candidate issuer entity ID's which may be derived from the request credential's entity certificate
according to the options supplied via
CertificateNameOptions . |
protected String |
evaluateDerivedIssuers(org.opensaml.xml.security.x509.X509Credential requestCredential,
MessageContext messageContext)
Evaluate any candidate issuer entity ID's which may be derived from the credential or other message context
information.
|
protected String |
evaluateSubjectAltNames(org.opensaml.xml.security.x509.X509Credential requestCredential,
MessageContext messageContext)
Evaluate the issuer entity ID as derived from the cert subject alternative names specified by types enumerated in
CertificateNameOptions.getSubjectAltNames() . |
protected String |
evaluateSubjectCommonName(org.opensaml.xml.security.x509.X509Credential requestCredential,
MessageContext messageContext)
Evaluate the issuer entity ID as derived from the cert subject common name (CN).
|
protected String |
evaluateSubjectDN(org.opensaml.xml.security.x509.X509Credential requestCredential,
MessageContext messageContext)
Evaluate the issuer entity ID as derived from the cert subject DN.
|
protected List<String> |
getAltNames(X509Certificate cert,
Integer altNameType)
Get the list of subject alt name values from the certificate which are of the specified alt name type.
|
protected CertificateNameOptions |
getCertificateNameOptions()
Get the currently configured certificate name options.
|
protected String |
getCommonName(X509Certificate cert)
Get the first common name (CN) value from the subject DN of the specified certificate.
|
protected String |
getSubjectName(X509Certificate cert)
Get subject name from a certificate, using the currently configured X500DNHandler and subject DN output format.
|
evaluate, evaluate, getTrustEngine
public ClientCertAuthRule(org.opensaml.xml.security.trust.TrustEngine<org.opensaml.xml.security.x509.X509Credential> engine, CertificateNameOptions nameOptions)
engine
- Trust engine used to verify the request X509CredentialnameOptions
- options for deriving issuer names from an X.509 certificatepublic void evaluate(MessageContext messageContext) throws SecurityPolicyException
messageContext
- the message context being evaluatedSecurityPolicyException
- thrown if the message context does not meet the requirements of the rule,
or if there is a non-recoverable error during evaluationprotected CertificateNameOptions getCertificateNameOptions()
protected void doEvaluate(org.opensaml.xml.security.x509.X509Credential requestCredential, MessageContext messageContext) throws SecurityPolicyException
requestCredential
- the X509Credential derived from the requestmessageContext
- the message context being evaluatedSecurityPolicyException
- thrown if a message context issuer is present and the client certificate token
can not be trusted on that basis, or if there is error during evaluation processingprotected org.opensaml.xml.security.CriteriaSet buildCriteriaSet(String entityID, MessageContext messageContext) throws SecurityPolicyException
buildCriteriaSet
in class BaseTrustEngineRule<org.opensaml.xml.security.x509.X509Credential>
entityID
- the candidate issuer entity ID which is being evaluatedmessageContext
- the message context which is being evaluatedSecurityPolicyException
- thrown if criteria set can not be constructedprotected String evaluateDerivedIssuers(org.opensaml.xml.security.x509.X509Credential requestCredential, MessageContext messageContext) throws SecurityPolicyException
This serves primarily as an extension point for subclasses to implement application-specific logic.
If multiple derived candidate entity ID's would satisfy the trust engine criteria, the choice of which one to return as the canonical issuer value is implementation-specific.
requestCredential
- the X509Credential derived from the requestmessageContext
- the message context being evaluatedSecurityPolicyException
- thrown if there is error during processingprotected String evaluateCertificateNameDerivedIssuers(org.opensaml.xml.security.x509.X509Credential requestCredential, MessageContext messageContext) throws SecurityPolicyException
CertificateNameOptions
.
Configured certificate name types are derived as candidate issuers and processed in the following order:
CertificateNameOptions.getX500DNHandler()
and using the output format indicated by
CertificateNameOptions.getX500SubjectDNFormat()
.CertificateNameOptions.getSubjectAltNames()
.
Note that this is a LinkedHashSet, so the order of evaluation is the order of insertion.
The first one of the above which is successfully evaluated by the trust engine using criteria built from
BaseTrustEngineRule.buildCriteriaSet(String, MessageContext)
will be returned.
requestCredential
- the X509Credential derived from the requestmessageContext
- the message context being evaluatedSecurityPolicyException
- thrown if there is error during processingprotected String evaluateSubjectCommonName(org.opensaml.xml.security.x509.X509Credential requestCredential, MessageContext messageContext) throws SecurityPolicyException
requestCredential
- the X509Credential derived from the requestmessageContext
- the message context being evaluatedSecurityPolicyException
- thrown if there is error during processingprotected String evaluateSubjectDN(org.opensaml.xml.security.x509.X509Credential requestCredential, MessageContext messageContext) throws SecurityPolicyException
requestCredential
- the X509Credential derived from the requestmessageContext
- the message context being evaluatedSecurityPolicyException
- thrown if there is error during processingprotected String evaluateSubjectAltNames(org.opensaml.xml.security.x509.X509Credential requestCredential, MessageContext messageContext) throws SecurityPolicyException
CertificateNameOptions.getSubjectAltNames()
.requestCredential
- the X509Credential derived from the requestmessageContext
- the message context being evaluatedSecurityPolicyException
- thrown if there is error during processingprotected String getCommonName(X509Certificate cert)
cert
- the certificate being processedprotected String getSubjectName(X509Certificate cert)
cert
- the certificate being processedprotected List<String> getAltNames(X509Certificate cert, Integer altNameType)
cert
- the certificate from which to extract alt namesaltNameType
- the type of alt name to extractCopyright © 2006-2013 Internet2. All Rights Reserved.