Serialized Form

Package swiss.trustbroker.config.dto

Class swiss.trustbroker.config.dto.Banner

class Banner extends Object implements Serializable

Serialized Fields

collapseParagraphs

Boolean collapseParagraphs

Display banner paragraphs collapsed on a small screen.
Default: true, disable if all information is required on small screens as well.

Since:

v1.10.0 Previously named collapseParagraphsOnSmallScreen with default false.

global

Boolean global

Banner is globally enabled, regardless tiles on the screen.

mainImage

String mainImage

Optional main image.

name

String name

Name of the banner used for referencing resources (texts, css class).

order

Integer order

Banner display order for global banners or if no order is defined for the CP.
Influences which banners are shown if their number is limited.

secondaryImages

List<String> secondaryImages

Optional list of secondary images.

Class swiss.trustbroker.config.dto.SamlNamespace

class SamlNamespace extends Object implements Serializable

Serialized Fields

namespace

String namespace

SAML namespace. Removed when matching.

prefix

String prefix

Optional prefix added if the namespace is removed.

Package swiss.trustbroker.federation.xmlconfig

Class swiss.trustbroker.federation.xmlconfig.AccessRequest

class AccessRequest extends Object implements Serializable

Serialized Fields

authorizedApplications

AuthorizedApplications authorizedApplications

Authorized applications for the AccessRequest.

enabled

Boolean enabled

Enable this configuration.

Class swiss.trustbroker.federation.xmlconfig.AcClass

class AcClass extends Object implements Serializable

Serialized Fields

contextClass

String contextClass

ACClass name

downgradeToMaximumRequested

Boolean downgradeToMaximumRequested

If this Qoa is returned by the CP, but was not requested by the RP, downgrade it to the maximum Qoa requested by the RP.
Default: false

mapInbound

Boolean mapInbound

Enable mapping of inbound QoA.
Default: true, set to false in order to disambiguate mappings.

mapOutbound

Boolean mapOutbound

Enable mapping of outbound QoA.
Default: true, set to false in order to disambiguate mappings.

order

Integer order

ACClass QoA order.

replaceInbound

Boolean replaceInbound

Replace inbound Qoa from RP request. Only works with Qoa.replaceInbound together
Default: true

Since:

1.10.0

Class swiss.trustbroker.federation.xmlconfig.AccountSource

class AccountSource extends Object implements Serializable

Serialized Fields

value

String value

Class swiss.trustbroker.federation.xmlconfig.AcWhitelist

class AcWhitelist extends Object implements Serializable

Serialized Fields

acNetUrls

List<URI> acNetUrls

acUrls

List<String> acUrls

List of allowed URLs.

frameAncestors

List<String> frameAncestors

Allowed frame ancestors for iframes.
Overrides origins derived from ACUrl if set (even if configured as an empty list).

See Also:

• CSP frame-ancestors

origins

List<String> origins

originSet

Set<String> originSet

redirectUrls

List<String> redirectUrls

useDefault

Boolean useDefault

Use the first entry as default if the RP does not send an ACS URL.
So far only supported for SAML.
Default: false

Since:

1.11.0

Class swiss.trustbroker.federation.xmlconfig.AnnouncementRpConfig

class AnnouncementRpConfig extends Object implements Serializable

Serialized Fields

announcementUrls

List<String> announcementUrls

URLs for the announcement.

enabled

Boolean enabled

Enable this configuration.

Class swiss.trustbroker.federation.xmlconfig.ArtifactBinding

class ArtifactBinding extends Object implements Serializable

Serialized Fields

inboundMode

ArtifactBindingMode inboundMode

Mode for inbound Artifact binding.

outboundMode

ArtifactBindingMode outboundMode

Mode for outbound Artifact binding.

sourceId

String sourceId

Default expected sourceId is

Hex(Sha1(ClaimsParty.id))

. Allow overriding this with

Hex(Sha1(sourceId))

.

sourceIdEncoded

String sourceIdEncoded

Overriding sourceId with encoded value directly in case it is not calculated in the expected way.

Class swiss.trustbroker.federation.xmlconfig.AttributesSelection

class AttributesSelection extends Object implements Serializable

Serialized Fields

definitions

List<Definition> definitions

List of attribute definitions.

multiSourcePolicy

MultiResultPolicy multiSourcePolicy

Policy for merging attributes from multiple sources.

Since:

1.9.0

Class swiss.trustbroker.federation.xmlconfig.Audiences

class Audiences extends Object implements Serializable

Serialized Fields

audiencesList

Set<String> audiencesList

List of audiences.
Note that the list of possible values is not final, hence the list using plain strings.

Class swiss.trustbroker.federation.xmlconfig.AuthorizationGrantTypes

class AuthorizationGrantTypes extends Object implements Serializable

Serialized Fields

grantTypes

List<AuthorizationGrantType> grantTypes

List of authorization grant types.

Class swiss.trustbroker.federation.xmlconfig.AuthorizedApplication

class AuthorizedApplication extends Object implements Serializable

Serialized Fields

applUrl

String applUrl

If configured the value is sent as appUrl instead of sending app=name in the INTERACTIVE AccessRequest.

Since:

1.12.0

centralCICD

String centralCICD

Optional request parameter added to URLs.

clientId

String clientId

If an RP contains multiple OIDC clients and AccessRequest configurations and the OIDC client_id or the applicationName (provided viy AuthnRequest.ProviderName) does not match the 'name', this attribute can be used to establish the relation.

enableTrigger

Boolean enableTrigger

AccessRequest can be triggered by calling application.

endpointReferenceAddress

String endpointReferenceAddress

Overrides the RP ID in requests sent by the AccessRequest.

issuerId

String issuerId

Overrides the global issuer.

minQoa

Integer minQoa

Matched against minimum QOA from SAML AuthnContextClassRef. When an RP has multiple applications, and they cannot be differentiated via HTTP Referer, the minimum AuthnContextClassRef in the AuthnRequest can be used to select the application.
Optional, not recommended.

mode

String mode

Mode to be used for the AccessRequest, depending on the implementation.

name

String name

Required application name (usually corresponding to IDM).

recipient

String recipient

Overrides the global AccessRequest recipientId. Fallback to serviceUrl.

redirectUrl

String redirectUrl

URL to be redirected to after AccessRequest.

serviceUrl

String serviceUrl

Service URL to be called by AccessRequest.

triggerRole

String triggerRole

When the given role is missing after the IDM lookup phase (and before the profile selection phase) the access-request handling is initiated.

url

String url

The application can be selected via HTTP Referer matching by configuring the Origin URL in this attribute.

validateAssertion

Boolean validateAssertion

Validate assertions in responses to requests sent by the AccessRequest.
Default: false

Class swiss.trustbroker.federation.xmlconfig.AuthorizedApplications

class AuthorizedApplications extends Object implements Serializable

Serialized Fields

authorizedApplicationList

List<AuthorizedApplication> authorizedApplicationList

List of Authorized Applications.

Class swiss.trustbroker.federation.xmlconfig.Certificates

class Certificates extends Object implements Serializable

Serialized Fields

artifactResolutionKeystore

SignerKeystore artifactResolutionKeystore

Deprecated, for removal: This API element is subject to removal in a future version.

Use backendKeystore

artifactResolutionTruststore

SignerTruststore artifactResolutionTruststore

Deprecated, for removal: This API element is subject to removal in a future version.

Use backendTruststore

backendKeystore

SignerKeystore backendKeystore

Keystore for backend connections (via SAML the artifact resolution or OIDC metadata protocol).

Since:

1.9.0

backendTruststore

SignerTruststore backendTruststore

Truststore for backend connections (via SAML the artifact resolution or OIDC metadata protocol).

Since:

1.9.0

encryptionKeystore

SignerKeystore encryptionKeystore

Keystore for encryption.

encryptionTruststore

SignerTruststore encryptionTruststore

Truststore for encryption verification.

signerKeystore

SignerKeystore signerKeystore

Keystore for signing.

signerTruststore

SignerTruststore signerTruststore

Truststore for signature verification.

Class swiss.trustbroker.federation.xmlconfig.ClaimsParty

class ClaimsParty extends CounterParty implements Serializable

Serialized Fields

accountSource

AccountSource accountSource

The Account Source consumed by the IdmProvisioningService

Since:

1.12.0

attributesSelection

AttributesSelection attributesSelection

The filtering is done when the SAML response is received from the CP. This element therefore declares, which original issuer attributes are acceptable for propagation to RPs.

See Also:

• RelyingParty.getAttributesSelection()

authLevel

String authLevel

Configure what QoA the CP can deliver per default, e.g. weak, normal or strong. See XTB Single Sign On (SSO, SLO) on how QoA is handled in the context of XTB.

authnRequestIssuerId

String authnRequestIssuerId

Override of the global issuer for this CP.

certificates

Certificates certificates

You only need to declare SignerTruststore for SAML response verification. For signing the SignerKeystore declared on the RP side is (re-)used.

See Also:

• RelyingParty.getCertificates()

disableACUrl

Boolean disableACUrl

This flag allows to disable setting the AssertionConsumerServiceURL in the AuthnRequest towards the CP as some CPs do fail when it is set (correctly or incorrectly).

enabled

FeatureEnum enabled

Flag to enable/disable this CP.
Default is true.

homeName

HomeName homeName

The homeName is usually consumed from the home name attribute and identifies the CP attribute to consume the CP identity from instead of the subject name ID source.
If not specified or not provided by CP the SAML Response Subject NameID is sued.

id

String id

Issuer ID of the claims provider that need to match ClaimsProvider entries in ClaimsProviderDefinitions for HRD display and have to be returned by CPs in SAML responses.
Notes:

• CP IDs must be unique within the configuration of each environment (trustbroker-inventories/environment)
• CP IDs may overlap with RP IDs.
• For SAML this ID is also used by the actual CP.
• For OIDC this just an internal ID.

oidc

Oidc oidc

OIDC client configuration to integrate CP/IDP

Since:

1.9.0

originalIssuer

String originalIssuer

The original issuer is by default consumed as is and not changed in the CP handling of XTB.
Fallback: id

provision

ProvisioningMode provision

Enable IDM provisioning based on CP response.
Consider using the newer Provisioning.enabled instead.
Default: FALSE

Since:

1.9.0

See Also:

• Provisioning

provisioning

Provisioning provisioning

Provisioning configurations for this CP.

Since:

1.12.0

qoa

Qoa qoa

QoA configurations for this CP.

Since:

1.9.0

responseIssuer

String responseIssuer

Override ID as expected issuer of CP response.
Can be set to decouple the CP response issuer from the ID. The ID of another CP is permitted here in which case the CP used for the request is picked.
Fallback: id

Since:

1.12.0

saml

Saml saml

SAML protocol configuration for this CP.

scripts

Scripts scripts

Script hooks. Only scripts related to this CP are executed.

securityPolicies

SecurityPolicies securityPolicies

Global security policy overrides for this CP.

ssoUrl

String ssoUrl

SAML POST endpoint on the CP.

statusPolicy

StatusPolicy statusPolicy

This status policy determines the handling of users that are not found in the IDM: BLOCK_UNKNOWN_USER, ALLOW_UNKNOWN_USER.

See Also:

• StatusPolicy.BLOCK_UNKNOWN_USER
• StatusPolicy.ALLOW_UNKNOWN_USER

strongestPossibleAuthLevel

String strongestPossibleAuthLevel

This attribute allows to map a QoA of

StrongestPossible

on the message level to a corresponding real QoA level to handle XTB Single Sign On (SSO, SLO) as this QoA value does not represent a real QoA.
Fallback: authLevel

subjectNameMappings

SubjectNameMappings subjectNameMappings

Subject Name ID mappings for this CP.

Since:

1.8.0

wsTrust

WsTrust wsTrust

WS-Trust protocol configuration for this CP.

Since:

1.14.0

Class swiss.trustbroker.federation.xmlconfig.ClaimsProvider

class ClaimsProvider extends Object implements Serializable

Serialized Fields

banner

String banner

Show this banner above the HRD selection area if tile is enabled.

Since:

1.9.0

button

String button

Deprecated, for removal: This API element is subject to removal in a future version.

remove

Image displayed in the small view. This feature was removed and replaced by shortcut/color rendering. The small view was dropped in v1.5.

clientNetworks

String clientNetworks

A comma separated list of network identifiers. When computing the HRD screen the incoming loadbalancer HTTP Header Client_Network (is considered to filter out CPs that are not defined on the incoming network, mainly:

• INTRANET (intranet)
• INTERNET (external networks)

color

String color

HTML color code identifying the CP on small screens.

description

String description

Text displayed in the CP tile.
The fallback order (if not defined) is: description > name > ID

enabled

Boolean enabled

Allow pre-configuration of ClaimsProviderMappings with enabled or disabled ClaimsParty in profiles and only pick them per relying party in setup. Default: Unset value signals an enabled claims party and ignoring entries with the same id in the profile.

Since:

1.9.0

hrdHintAlias

String hrdHintAlias

The HRD hint parameter sent by the RP is matched against the following attributes of the ClaimsProvider element.
This allows decoupling the RP configuration from the internal CP ID. If configured, only the alias is checked against the HRD hint to avoid accidental dependency on the CP ID.
The HRD hint is matched against the following ClaimsProvider fields in the given order:

1. hrdHintAlias
2. name
3. id

Name and/or ID might be URNs, in which case the hrdHintAlias can also help avoiding URL parameter encoding issues.

Since:

1.10.0

See Also:

• TrustBrokerProperties.getHrdHintParameter()

id

String id

References the issuer ID of the CP.

img

String img

Image displayed in the HRD large view.

name

String name

Name displayed to the user directly. The XTB SPA frontend uses it to translate the name into a text with the translation service. The skinny frontend uses the items directly.

noticeClaimsProviders

List<String> noticeClaimsProviders

The list of ClaimsProviders name

Since:

1.14.0

noticeEnabled

Boolean noticeEnabled

Notice enabled

Since:

1.14.0

noticeMaxAgeSec

Integer noticeMaxAgeSec

Notice max age

Since:

1.14.0

order

Integer order

Indicates the order of display in the UI. Special values:

1. less or equal 0 - do not show in UI
2. 1xx - first priority CPs (displayed larger, ordered numerically)
3. 2xx - second priority CPs (displayed larger, ordered numerically)
4. 3xx - third priority CPs (displayed smalled, ordered numerically)

Default: ordered of definition in the XML

Since:

1.9.0

relyingPartyAlias

String relyingPartyAlias

By providing a relying party ID on the HRD declaration, it's not necessary anymore to copy and paste entire RP definition files just to be able to automatically selecting an RP without showing a HRD selection screen. The relyingPartyAlias can refer to these three inputs:

• SAML AuthnRequest.Issuer ID
• SAML AuthnRequest.ProviderName
• OIDC client_id

The HRD entries with a relyingPartyAlias attribute are not shown on the HRD screen but are used to directly dispatch towards the CP when an RP with this issuer ID comes along.
If no alias matches through and no HRD entries without an alias remain, all the tiles are displayed through.

shortcut

String shortcut

A usually two-character code identifying the CP on small screens.

title

String title

Title for the CP tile and help item.
The fallback order (if not defined) is: title > name > ID

Class swiss.trustbroker.federation.xmlconfig.ClaimsProviderDefinitions

class ClaimsProviderDefinitions extends Object implements Serializable

Serialized Fields

claimsProviders

List<ClaimsProvider> claimsProviders

List of CPs

Class swiss.trustbroker.federation.xmlconfig.ClaimsProviderMappings

class ClaimsProviderMappings extends Object implements Serializable

Serialized Fields

claimsProviderList

List<ClaimsProvider> claimsProviderList

List of CP mappings.

definition

String definition

Define a CLaimsProviderMappings.xml definition/profile

Since:

1.10.0

enabled

Boolean enabled

Allow pre-configuration of ClaimsProviderMappings in profiles without considering the RP setup

Since:

1.9.0

Class swiss.trustbroker.federation.xmlconfig.ClaimsProviderSetup

class ClaimsProviderSetup extends Object implements Serializable

Serialized Fields

claimsParties

List<ClaimsParty> claimsParties

List of CPs.

Class swiss.trustbroker.federation.xmlconfig.ClientAuthenticationMethods

class ClientAuthenticationMethods extends Object implements Serializable

Serialized Fields

methods

List<ClientAuthenticationMethod> methods

List of authentication methods.

Class swiss.trustbroker.federation.xmlconfig.ConstAttributes

class ConstAttributes extends Object implements Serializable

Serialized Fields

attributeDefinitions

List<Definition> attributeDefinitions

List of attributes.

Class swiss.trustbroker.federation.xmlconfig.CounterParty

class CounterParty extends Object implements Serializable

Class swiss.trustbroker.federation.xmlconfig.Definition

class Definition extends Object implements Serializable

Serialized Fields

altName

String altName

Known external attributes we just document here - used when we cannot use namespaceUri due to semantics.

cid

Boolean cid

Indicates whether this field is considered CID (client identifying data).
Default: null - global default is used

Since:

1.8.0

mappers

String mappers

Comma-separated list of mappers to be used for the value.

Since:

1.9.0

multiValued

Multivalued multiValued

Multi value handling.
Default: ORIGINAL

name

String name

Short name used in auditing and for IDM attribute addressing. Compound primary key member in attribute maps using Definition(De)Serializer.

namespaceUri

String namespaceUri

The long name is used in the generated SAML assertion towards the RP. Compound primary key member in attribute maps using Definition(De)Serializer.

oidcMapper

ClaimsMapper oidcMapper

Deprecated, for removal: This API element is subject to removal in a future version.

use mappers

Mapper to be used for the value.

oidcNames

String oidcNames

The claim names used when emitting an attribute to an OIDC client (comma-separated - as an attribute, it cannot be a List).

See Also:

• Definition.oidcNamesToList(String)
• Definition.oidcNameListToString(List)

provision

String provision

Provision this attribute to IDM.
The value or list of comma-separated values indicate into what type(s) of IDM object provisioning services should provision this data.
The actual fields to provision would usually be selected based on name/namespace URI.
Generic values: true (a provisioning service selects an appropriate target), false (not provisioned - single value only).
Default: false

Since:

1.9.0

See Also:

• IdmProvisioningService

provisioningId

Boolean provisioningId

ID attribute for provisioning.

Since:

1.9.0

See Also:

• IdmProvisioningService

required

Boolean required

Indicates whether this attribute is mandatory.
For an AuthnResponse, this attribute must always be included

Since:

1.14.0

scope

String scope

To restrict emitting an attribute, the scope can be set as follows:

• saml: Use only in SAML assertions
• oidc: Use only in OIDC tokens (oidcName must be set)

If not set, the attribute is emitted on all protocols and any requested OIDC scope.

source

String source

Source of the definition Compound primary key member in attribute maps using Definition(De)Serializer.

value

String value

Single value from constant configuration (we currently only use single valued in XML via ConstAttributes).

Class swiss.trustbroker.federation.xmlconfig.Encryption

class Encryption extends Object implements Serializable

Serialized Fields

dataEncryptionAlgorithm

String dataEncryptionAlgorithm

Data encryption algorithm.
Default: http://www.w3.org/2001/04/xmlenc#aes256-cbc

keyEncryptionAlgorithm

String keyEncryptionAlgorithm

Key encryption algorithm.
Default: http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p

keyInfo

EncryptionKeyInfo keyInfo

Value emitted in Key Info (CERTIFICATE, SKI).
Default: CERTIFICATE

Since:

1.10.0

keyPlacement

EncryptionKeyPlacement keyPlacement

Key placement (PEER, INLINE).
Default: PEER

Class swiss.trustbroker.federation.xmlconfig.Flow

class Flow extends Object implements Serializable

Serialized Fields

appContinue

Boolean appContinue

Show error page including continue to application button (send SAML error on to application).

appRedirectUrl

String appRedirectUrl

Redirect to (application-specific) URL instead of showing an error page.

Since:

1.8.0

appUrl

String appUrl

Show a link to further information on the error page (general error information on the application or specific to this error code).

id

String id

SAML error code with or without namespace, adding

trustbroker.config.saml.flowNamespaces

if needed.
E.g. UserCancel, PwResetSuccessful, PwResetFailed, PwResetTmpBlocked, urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal

link

Boolean link

Show error page including a link to appUrl.

Since:

1.10.0

namespacePrefix

String namespacePrefix

Prefix if there are multiple

trustbroker.config.saml.flowNamespaces

.

reLogin

Boolean reLogin

Show error page including re-login button (triggers another login).

supportEmail

String supportEmail

Show (application specific) support e-mail address on the error page.

supportInfo

Boolean supportInfo

Show error page including a support info section.

supportPhone

String supportPhone

Show (application specific) support phone number on the error page.

Class swiss.trustbroker.federation.xmlconfig.FlowPolicies

class FlowPolicies extends Object implements Serializable

Serialized Fields

enabled

Boolean enabled

Enable this configuration.

flows

List<Flow> flows

List of flow configurations.

Class swiss.trustbroker.federation.xmlconfig.HomeName

class HomeName extends Object implements Serializable

Serialized Fields

attrValue

String attrValue

Overridden by value.

See Also:

• HomeName.getValue()

migrationAlias

String migrationAlias

Used for provisioning during migration from a CP to another.

Since:

1.9.0

See Also:

• IdmProvisioningRequest.getHomeNameMigrationAlias()

reference

String reference

The homeName is usually consumed from the home name attribute and identifies the CP attribute to consume the CP identity from. If not specified or not provided by CP the SAML Response Subject NameID is used.

value

String value

The configuration is optional and provides a static value, when the e-id based CPs are not sending the attribute in the CP Attributes already or the value is computed from the CP SAML Response mainly for compatibility reasons, see GeneralDeriveHomeName.groovy for the special handling of this attribute.

Class swiss.trustbroker.federation.xmlconfig.IdmLookup

class IdmLookup extends Object implements Serializable

Serialized Fields

multiQueryPolicy

MultiResultPolicy multiQueryPolicy

Handling of same attributes across queries.
Default: OVERWRITE is used if none is defined.
Potentially breaking changes:

• With 1.8.0 changed from String to MultiQueryResultPolicy.

queries

List<IdmQuery> queries

List of queries to be executed.

store

String store

Used to select an IdmService implementation

Class swiss.trustbroker.federation.xmlconfig.IdmQuery

class IdmQuery extends Object implements Serializable

Serialized Fields

appFilter

String appFilter

Application as filtering parameter for the IDM.

clientExtId

String clientExtId

Client External ID (tenant) as filtering parameter for the IDM.

id

String id

A query needs an ID when its name is not unique and its execution needs to be controlled via a custom script based on CP input usually.

issuerNameId

String issuerNameId

SAML federation filter to be applied to the user query.

issuerNameIdNS

String issuerNameIdNS

Instead of an issuerNameId the SAML federation can also be identified via its fully qualified homeName attribute as an input.

name

String name

Name of the query, depending on the IdmService implementation.

order

Integer order

The order of the execution of the query.

Since:

1.15.0

sortByName

boolean sortByName

statusPolicy

StatusPolicy statusPolicy

Handling of the user status in IDM.

store

String store

Used to select an IdmService implementation

Since:

1.10.0

subjectNameId

String subjectNameId

Subject Name ID as filtering parameter for the IDM.

subResource

String subResource

Sub resource parameter for the IDM (baseDN in case of LDAP).

Since:

1.13.0

userDetailsSelection

AttributesSelection userDetailsSelection

User details selection identifies the IDM attributes passed through to the RP side.

Class swiss.trustbroker.federation.xmlconfig.Oidc

class Oidc extends Object implements Serializable

Serialized Fields

clients

List<OidcClient> clients

List of OIDC clients handled via the same configuration.

enabled

Boolean enabled

SAML protocol enabled.
Default: true (for backwards compatibility)

Since:

1.14.0

Class swiss.trustbroker.federation.xmlconfig.OidcClaimsSources

class OidcClaimsSources extends Object implements Serializable

Serialized Fields

allowClaimsOverride

Boolean allowClaimsOverride

Allow overriding claims by sources in the given order.
Default: The sources' default.

Since:

1.14.0

allowSubjectOverride

Boolean allowSubjectOverride

Allow overriding subject by sources in the given order.
Default: The sources' default.

Since:

1.14.0

claimsSourceList

List<OidcClaimsSource> claimsSourceList

List of claims sources.
Claims from sources are combined in the given order.

See Also:

• OidcClaimsSource

Class swiss.trustbroker.federation.xmlconfig.OidcClient

class OidcClient extends Object implements Serializable

Serialized Fields

audiences

Audiences audiences

OIDC allowed audience in TokenExchange.

Since:

1.13.0

authorizationGrantTypes

AuthorizationGrantTypes authorizationGrantTypes

Authorization grant types to be allowed.
Default: authorization_code, refresh_token

certificates

Certificates certificates

Required for JWT encryption

claimsSelection

AttributesSelection claimsSelection

Attribute selection applied to the claims.

claimsSources

OidcClaimsSources claimsSources

Sources of claims for OIDC CPs.
Default: id_token

Since:

1.10.0

clientAuthenticationMethods

ClientAuthenticationMethods clientAuthenticationMethods

Client authentication methods to be allowed.
Default: none, client_secret_basic, client_secret_post

clientSecret

String clientSecret

You can encode the secret with one of the supported encoders. See the provided example EncodePassword.groovy for how to encode a password using Argon2.

See Also:

• OidcSecurityConfiguration.passwordEncoder()

federationId

String federationId

Federation ID override.
Fallback to RP ID.

id

String id

Client ID.
Notes:

• OIDC client IDs must be unique for all RPs within the configuration of each environment (trustbroker-inventories/environment).
• OIDC client IDs used for CPs may overlap both across CPs and with those of RPs.

issuerId

String issuerId

CP issuer ID override for iss claim validation.
Fallback to CP ID.

Since:

1.10.0

oidcSecurityPolicies

OidcSecurityPolicies oidcSecurityPolicies

Override security policies.

protocolEndpoints

ProtocolEndpoints protocolEndpoints

OpenID endpoints a single CP side OIDC client uses for federated login.

Since:

1.9.0

qoa

Qoa qoa

QoAs to use.

realm

String realm

Optional support to be able to map back /oauth2/authorize

redirectUris

AcWhitelist redirectUris

Permitted redirect URLs for this client.

registeredClient

org.springframework.security.oauth2.server.authorization.client.RegisteredClient registeredClient

resources

Resources resources

OIDC allowed resources in TokenExchange.

Since:

1.13.0

responseMode

ResponseMode responseMode

Response mode to be requested from CP.
Default: form_post

Since:

1.10.0

scopes

Scopes scopes

OIDC scopes to be used.
Default: openid, profile, email, address, phone

usePepQoa

String usePepQoa

Legacy Policy Enforcement Point (PEP) QOA mapping policy.
Fallback: Global defaultUsePepQoaPolicy

Class swiss.trustbroker.federation.xmlconfig.OidcSecurityPolicies

class OidcSecurityPolicies extends Object implements Serializable

Serialized Fields

accessTokenTimeToLiveMin

Integer accessTokenTimeToLiveMin

Overrides tokenTimeToLiveMin for the access token.

allowFormBearerToken

Boolean allowFormBearerToken

Allow access_token in form body
Default: false

Since:

1.14.0

allowPublicClientTokenExchange

Boolean allowPublicClientTokenExchange

Allow Token Exchange with Public Client
Default: false

Since:

1.14.0

authorizationCodeTimeToLiveMin

Integer authorizationCodeTimeToLiveMin

Overrides tokenTimeToLiveMin for the authorization code.

clientAssertionExpirationLifeTimeSec

Integer clientAssertionExpirationLifeTimeSec

Restrict client_assertion expiration maxLifeTime
Default: 3600 (1h)

Since:

1.14.0

clientAssertionMaxAgeSec

Integer clientAssertionMaxAgeSec

Restrict client_assertion age
Default: 60

Since:

1.14.0

clientAssertionNotBeforeToleranceSec

Integer clientAssertionNotBeforeToleranceSec

client_assertion tolerance NTP drift tolerance.

Since:

1.14.0

clientAssertionNotOnOrAfterToleranceSec

Integer clientAssertionNotOnOrAfterToleranceSec

client_assertion timestamp clock/transfer tolerance.

Since:

1.14.0

encryptionAlgorithm

String encryptionAlgorithm

Encryption algorithm
Default: RSA-OAEP-256

Since:

1.11.0

encryptionKid

String encryptionKid

Encryption keyID

Since:

1.11.0

encryptionMethod

String encryptionMethod

Encryption method
Default: A256GCM

Since:

1.11.0

idTokenSignature

String idTokenSignature

ID token signature algorithm (many adapters only support RS256)

idTokenTimeToLiveMin

Integer idTokenTimeToLiveMin

Overrides tokenTimeToLiveMin for the ID token.

refreshTokenTimeToLiveMin

Integer refreshTokenTimeToLiveMin

Overrides tokenTimeToLiveMin for the refresh token.

requireAuthorizationConsent

Boolean requireAuthorizationConsent

Require authorization consent (currently unsupported).
Default: false

requireIdTokenEncryption

Boolean requireIdTokenEncryption

Allow to enable Encrypted IdToken JWT Singing for Rp.
Default: false

Since:

1.11.0

requireOpaqueAccessToken

Boolean requireOpaqueAccessToken

Allow to enable Opaque AccessToken for Rp.
Default: false

Since:

1.11.0

requireOpaqueRefreshToken

Boolean requireOpaqueRefreshToken

Allow to enable Opaque RefreshToken for Rp.
Default: false

Since:

1.11.0

requireProofKey

Boolean requireProofKey

Require Proof Key for Code Exchange (PKCE).
Default: true

requireUserInfoResponseEncryption

Boolean requireUserInfoResponseEncryption

Allow to enable Encrypted UserInfo response
Default: false

Since:

1.11.0

reuseRefreshTokens

Boolean reuseRefreshTokens

Reuse refresh tokens.
Default: false

sessionCookieSameSite

String sessionCookieSameSite

Controls the OIDC session cookies sameSite flag None, Strict, Dynamic. Dynamic: Choose None or Strict based on whether the involved URLs are same site or not. (A value of Lax while valid has no benefits over Strict and is too restrictive for cross-domain use.)
Default: Dynamic

sessionTimeToLiveMin

Integer sessionTimeToLiveMin

Allow to invalidate OIDC sessions before token TTL, keep for 1 minute to allow login sequence termination.
Default: 1

subjectTokenMaxAgeSec

Integer subjectTokenMaxAgeSec

Restrict Token Exchange subject_token age
Default: 60

Since:

1.14.0

subjectTokenMaxUseCount

Integer subjectTokenMaxUseCount

Maximum number a subject_token can be used
Default: 1

Since:

1.14.0

subjectTokenNotBeforeToleranceSec

Integer subjectTokenNotBeforeToleranceSec

subject_token tolerance NTP drift tolerance.

Since:

1.14.0

subjectTokenNotOnOrAfterToleranceSec

Integer subjectTokenNotOnOrAfterToleranceSec

subject_token timestamp clock/transfer tolerance.

Since:

1.14.0

tokenTimeToLiveMin

Integer tokenTimeToLiveMin

Token validity in minutes.

Class swiss.trustbroker.federation.xmlconfig.ProfileSelection

class ProfileSelection extends Object implements Serializable

Serialized Fields

customizeProperties

Boolean customizeProperties

Apply name/value transformation for CustomProperties (if true regardless of n2k).
Set to false if for n2k=true to leave custom profile props alone.

customizeUnits

Boolean customizeUnits

Apply name/value transformation for UnitProperties if n2k=true.
Default: false

displayClaims

List<String> displayClaims

Additional information to be displayed for profile selection.

Since:

1.13.0

displayName

String displayName

Attribute used as displayName for profile selection UI.

Since:

1.13.0

enabled

Boolean enabled

Enable this feature

filter

String filter

Apply filtering on roles.
Default: true Alternatives: false to disable, regexp for picking custom role list.

Since:

1.12.0

filterOutbound

Boolean filterOutbound

Apply filtering on roles to claims output as well reducing data to what has been selected by the user in INTERACTIVE mode.
Default: false

Since:

1.12.0

filterUnits

Boolean filterUnits

Filter unit properties by selected/default profile ID if n2k=true.
Default: false

mode

ProfileSelectionMode mode

Mode for profile selection.

needToKnow

Boolean needToKnow

Apply name/value transformation.
Default: false

oidcOnly

Boolean oidcOnly

Apply name/value transformation for n2k only for Oidc.
Default: true, disable if SAML should also be done

organizationSelector

String organizationSelector

Attribute used as selector (kind of unique Secondary Key) for organization selection.

Since:

1.14.0

profileSelector

String profileSelector

Attribute used as selector (kind of unique Primary Key) for profile selection.

Since:

1.13.0

sort

Boolean sort

Apply sorting on profiles and roles.
Default: true (sort ascending) Alternatives: false to disable sorting

Since:

1.12.0

translationAttributes

List<String> translationAttributes

Names of attributes that should be translated.

Since:

1.14.0

Class swiss.trustbroker.federation.xmlconfig.ProtocolEndpoints

class ProtocolEndpoints extends Object implements Serializable

Serialized Fields

artifactResolutionIndex

Integer artifactResolutionIndex

SAML Artifact Resolution Protocol index.

artifactResolutionProxyUrl

String artifactResolutionProxyUrl

Deprecated, for removal: This API element is subject to removal in a future version.

Use proxyUrl.

artifactResolutionUrl

String artifactResolutionUrl

SAML Artifact Resolution Protocol URL.

jwkSetUrl

String jwkSetUrl

Jwk endpoint url

Since:

1.14.0

metadataUrl

String metadataUrl

SAML/OIDC metadata URL.

proxyUrl

String proxyUrl

Proxy URL for these endpoints that overrides global default.
Set to empty string to override global default to use no proxy.

Since:

1.9.0

Class swiss.trustbroker.federation.xmlconfig.Provisioning

class Provisioning extends Object implements Serializable

Serialized Fields

enabled

ProvisioningMode enabled

Enable IDM provisioning based on CP response.
Default: FALSE

modes

List<String> modes

Provisioning mode flags passed to the implementations.

Class swiss.trustbroker.federation.xmlconfig.Qoa

class Qoa extends Object implements Serializable

Serialized Fields

claim

String claim

Qoa Claim name

Since:

1.10.0

classes

List<AcClass> classes

List of SAML AuthnContextClassRef entries.
If the RP does not send and AuthnRequest class references, the configured context classes are added to the CP-side AuthnRequest to let the CP deal with the QoA requirements of the RP.

comparison

QoaComparison comparison

Comparison type.

Since:

1.9.0

defaultQoa

String defaultQoa

Default Qoa if there is none in the response

Since:

1.10.0

dropUnmappable

Boolean dropUnmappable

Drop unmapped Qoa from the request
Default: false

Since:

1.10.0

enforce

Boolean enforce

Enable QoA enforcement.
Default: false

Since:

1.9.0

mapOutbound

Boolean mapOutbound

Enable mapping of outbound QoA.
Default: true

Since:

1.9.0

replaceInbound

Boolean replaceInbound

Replace incoming Qoa from the request Only applied on RP side
Default: false

Since:

1.10.0

singleQoaResponse

Boolean singleQoaResponse

Send single QoA in response (to RP).
Relevant for comparison EXACT - send maximum matching value instead.
Default: true

Since:

1.9.0

Class swiss.trustbroker.federation.xmlconfig.RelyingParty

class RelyingParty extends CounterParty implements Serializable

Serialized Fields

accessRequest

AccessRequest accessRequest

AccessRequest configuration for this RP.

acWhitelist

AcWhitelist acWhitelist

Assertion consumer service URL authorized to access XTB federation services for this RP.

announcement

AnnouncementRpConfig announcement

Announcement configuration for this RP.

applicationName

String applicationName

If the SAML ProviderName or OIDC client_id are wrong or missing, a relying party can be configured with a global ApplicationName used for AccessRequest ProfileSelection or AnnouncementService to select the matching data items.

Since:

1.12.0

attributesSelection

AttributesSelection attributesSelection

RP side attribute selection.

See Also:

• ClaimsParty.getAttributesSelection()

base

String base

Base profile.
The full file name of the ProfileRP_name.xml.

billingId

String billingId

We introduce the billing field, so we can start make some trials adding it to the config. We might need to move it to the access request application section later if RP-ID is not 1:1 related to billingId. The value is currently only used in the XTB auditing.

certificates

Certificates certificates

For verification and signing. For signing the SignerKeystore declared on is (re-)used on the CP side.

See Also:

• ClaimsParty.getCertificates()

claimsProviderMappings

ClaimsProviderMappings claimsProviderMappings

List of CPs mapped to this RP.

claimsSelection

AttributesSelection claimsSelection

RP side claims selection.

Since:

1.9.0

clientExtId

String clientExtId

Primary key of the IDM client identifying an access tenant.

clientName

String clientName

ClientName is the access tenant identifier (somewhat a short form of the relying party ID) applied to all

%clientname%

placeholders in the configuration, specifically the attributes as listed above.

constAttributes

ConstAttributes constAttributes

Deprecated, for removal: This API element is subject to removal in a future version.

replaced with ClaimsSelection

Constant attributes to be added for this RP.

enabled

FeatureEnum enabled

Flag to enable/disable this RP.
Default is true.

flowPolicies

FlowPolicies flowPolicies

Error flow policies for this RP.

id

String id

RP ID.
Notes:

• RP IDs must be unique within the configuration of each environment (trustbroker-inventories/environment)
• RP IDs may overlap with CP IDs.
• For SAML this ID is also used by the actual RP.
• For OIDC this just an internal ID.

idmLookup

IdmLookup idmLookup

IDM lookup configuration for this RP.

oidc

Oidc oidc

OIDC client configuration for this RP.

profileSelection

ProfileSelection profileSelection

Profile selection configuration for this RP.

propertiesSelection

AttributesSelection propertiesSelection

Properties selection identifies the computed/derived attributes passed through to the RP.

qoa

Qoa qoa

QoA configurations for this RP.

saml

Saml saml

SAML protocol configuration for this RP.

scripts

Scripts scripts

Script hooks. Only scripts related to this RP are executed.

securityPolicies

SecurityPolicies securityPolicies

Global security policy overrides for this RP.

sso

Sso sso

SSO configuration for this RP.

subjectNameMappings

SubjectNameMappings subjectNameMappings

Subject Name ID mappings for this RP.

unaliasedId

String unaliasedId

wsTrust

WsTrust wsTrust

WS-Trust protocol configuration for this RP.

Since:

1.14.0

Class swiss.trustbroker.federation.xmlconfig.RelyingPartySetup

class RelyingPartySetup extends Object implements Serializable

Serialized Fields

relyingParties

List<RelyingParty> relyingParties

List of RPs.

Class swiss.trustbroker.federation.xmlconfig.Resources

class Resources extends Object implements Serializable

Serialized Fields

resourceList

Set<String> resourceList

List of resources.
Note that the list of possible values is not final, hence the list using plain strings.

Class swiss.trustbroker.federation.xmlconfig.Saml

class Saml extends Object implements Serializable

Serialized Fields

artifactBinding

ArtifactBinding artifactBinding

SAML Artifact Binding configuration

enabled

Boolean enabled

SAML protocol enabled.
Default: true (for backwards compatibility)
Note: At the moment, SAML needs to be enabled for OIDC as well due to the internal SAML hop done for OIDC.

Since:

1.14.0

encryption

Encryption encryption

SAML encryption configuration.

forwardRpProtocolBinding

Boolean forwardRpProtocolBinding

Forward ProtocolBinding from RP tp CP.
Default: true

Since:

1.12.0

protocolEndpoints

ProtocolEndpoints protocolEndpoints

SAML protocol endpoint configuration.

signature

Signature signature

SAML signature configuration.

supportedBindings

List<swiss.trustbroker.common.saml.dto.SamlBinding> supportedBindings

List of supported inbound SAML bindings.
Default: Bindings enabled in global configuration (since 1.14.0, before all bindings were allowed)

Since:

1.12.0

See Also:

• SamlProperties.getBindings()

Class swiss.trustbroker.federation.xmlconfig.Scopes

class Scopes extends Object implements Serializable

Serialized Fields

scopeList

List<String> scopeList

List of scopes.
Note that the list of possible values is not final, hence the list using plain strings.

See Also:

• Scope

Class swiss.trustbroker.federation.xmlconfig.Script

class Script extends Object implements Serializable

Serialized Fields

name

String name

The value identifies the script stored in the trustbroker-inventories definition/scripts directory.

type

String type

Script types as listed above.

Class swiss.trustbroker.federation.xmlconfig.Scripts

class Scripts extends Object implements Serializable

Serialized Fields

scripts

List<Script> scripts

List of scripts.

Class swiss.trustbroker.federation.xmlconfig.SecurityPolicies

class SecurityPolicies extends Object implements Serializable

Serialized Fields

allowedSignatureAlgorithms

List<String> allowedSignatureAlgorithms

List of allowed message signature algorithms. (Empty list means no restriction.)
Default: Global default

Since:

1.15.0

audienceNotOnOrAfterSeconds

Integer audienceNotOnOrAfterSeconds

Overrides the global notOnOrAfterSeconds for conditions notOnOrAfter if greater than zero.

delegateOrigin

Boolean delegateOrigin

Control CP AuthnRequest scopes and RP Attribute OriginalIssuer. Defaults to null as RP and CP side default behavior differs

doSignArtifactResolve

Boolean doSignArtifactResolve

Flag allows to sign outbound SAML artifact resolve messages for maximum security.
Overrides global SecurityChecks

Since:

1.10.0

forceAuthn

Boolean forceAuthn

Always enforce re-authentication on this CP/on all CPs configured for this RP.
Overrides the global forceCpAuthentication.
Default: false (only enforced if RP requests it)

Since:

1.10.0

notOnOrAfterSeconds

Integer notOnOrAfterSeconds

Overrides the global tokenLifetimeSec for CP response AuthnInstant checks.
Default: 2600 This is quite long time to transfer a SAML token from the issuer to its consumer to establish a relation between a user and the consuming RP. Tje problem is that some components cache the token and transfer it later.

requireAudienceRestriction

Boolean requireAudienceRestriction

Overrides global SecurityChecks

requireAudienceRestrictionForBearerSubjectConfirmation

Boolean requireAudienceRestrictionForBearerSubjectConfirmation

Overrides global SecurityChecks

Since:

1.15.0

requireEncryptedAssertion

Boolean requireEncryptedAssertion

Allow to disable required encrypted Assertion when the EncryptionKeystore is configured.
Default: true

Since:

1.10.0

requireSignedArtifactResponse

Boolean requireSignedArtifactResponse

Flag allows to enforce signed SAML artifact responses from CP required for maximum security to assert integrity of the incoming artifact response message.
Overrides global SecurityChecks

Since:

1.10.0

requireSignedAuthnRequest

Boolean requireSignedAuthnRequest

Allow to disable signature check for incoming SAML AuthnRequests.
Default: true

requireSignedAuthnRequestForSsoJoin

Boolean requireSignedAuthnRequestForSsoJoin

Require signed SAML AuthnRequests to join an SSO session. If not set, falls back to requireSignedAuthnRequest.

Since:

1.11.0

requireSignedLogoutNotificationRequest

Boolean requireSignedLogoutNotificationRequest

Allow to disable signature check for outgoing SLO notification LogoutRequests.
Default: true

Since:

1.10.0

See Also:

• SloResponse

requireSignedLogoutRequest

Boolean requireSignedLogoutRequest

Allow to disable signature check for incoming LogoutRequests. If not set, falls back to requireSignedAuthnRequest.

requireSignedResponse

Boolean requireSignedResponse

Flag allows to enforce signed SAML responses from CP required for maximum security to assert integrity of the incoming message and assertion. There is no requireSignedAssertion yet as this data structure is the actual data to trust. The check can therefore not be disabled for security reasons.
Overrides global SecurityChecks

ssoMinQoaLevel

Integer ssoMinQoaLevel

If CP returns AuthnContext of value less than that, no SSO session is created.

validateHttpHeaders

Boolean validateHttpHeaders

Validate HTTP request headers. Currently referer and origin can be validated against the AcWhitelist of an RP.

Since:

1.12.0

validateXmlSchema

Boolean validateXmlSchema

Some claims providers are not sending well-formed valid XML and therefore are blocked by XTB. The schema check can be disabled lowering the security barrier and let OpenSAML deal with the data directly.
Default: true

wsTrustIssueNotBeforeToleranceSec

Long wsTrustIssueNotBeforeToleranceSec

WS-Trust ISSUE timestamp not before tolerance override.

Since:

1.15.0

wsTrustIssueNotOnOrAfterToleranceSec

Long wsTrustIssueNotOnOrAfterToleranceSec

WS-Trust ISSUE timestamp not on or after tolerance override.

Since:

1.15.0

wsTrustIssueRequireSignedAssertion

Boolean wsTrustIssueRequireSignedAssertion

Deprecated, for removal: This API element is subject to removal in a future version.

Transition feature

Require signed assertion in WS-Trust ISSUE.
Default: fallback to default (global default is true)

Since:

1.13.0

wsTrustIssueRequireSignedRequest

Boolean wsTrustIssueRequireSignedRequest

Require signed request in WS-Trust ISSUE.
Default: fallback to default

Since:

1.13.0

wsTrustIssueRequireTimestamp

Boolean wsTrustIssueRequireTimestamp

WS-Trust ISSUE requires timestamp.
Default: true

Since:

1.15.0

Class swiss.trustbroker.federation.xmlconfig.Signature

class Signature extends Object implements Serializable

Serialized Fields

canonicalizationAlgorithm

String canonicalizationAlgorithm

Canonicalization algorithm.

digestMethod

String digestMethod

Digest algorithm.

signatureMethodAlgorithm

String signatureMethodAlgorithm

Signature algorithm.

Class swiss.trustbroker.federation.xmlconfig.SignerKeystore

class SignerKeystore extends SignerStore implements Serializable

Serialized Fields

alias

String alias

If the store contains multiple objects and a specific one shall be used.

certPath

String certPath

Path of the certificate.

certType

String certType

If the store format cannot be derived from the file extension.

keyPath

String keyPath

Path of the key.

password

String password

Password for the store.

Class swiss.trustbroker.federation.xmlconfig.SignerStore

class SignerStore extends Object implements Serializable

Class swiss.trustbroker.federation.xmlconfig.SignerTruststore

class SignerTruststore extends SignerStore implements Serializable

Serialized Fields

alias

String alias

If the store contains multiple objects and a specific one shall be used.

certPath

String certPath

Path of the certificate.

certType

String certType

If the store format cannot be derived from the file extension.

keyPath

String keyPath

Path of the key.

password

String password

Password for the store.

Class swiss.trustbroker.federation.xmlconfig.SloResponse

class SloResponse extends Object implements Serializable

Serialized Fields

binding

swiss.trustbroker.common.saml.dto.SamlBinding binding

The protocol binding for which this entry applies.
Default: POST (ignored for OIDC)

Since:

1.10.0

crossProtocol

Boolean crossProtocol

Use notification cross-protocol (i.e. use protocol=OIDC even if RP is a SAML SSO session participant and vice versa).
Note: protocol HTTP is always used crossProtocol.
Default: false

issuer

String issuer

Issuer for SAML LogoutResponse.
Overrides the globally configured issuer.

matchAcUrl

Boolean matchAcUrl

Perform ACUrl matching for absolute url, prefix with ACUrl scheme/host/port for relative URL.
Defaults to false: use this URL regardless of what ACUrls were used for the RP in the current SSO session.

mode

SloMode mode

The mode of this entry.
Default: RESPONSE

protocol

SloProtocol protocol

The protocol for which this entry applies.
Default: SAML2

sessionRequired

Boolean sessionRequired

Enables OIDC

frontchannel_logout_session_required

.
Default: false

See Also:

• OpenID Connect Front-Channel Logout

signerKeystore

SignerKeystore signerKeystore

Override RPs signer for SAML2 LogoutRequest notifications(the LogoutResponse is always signed with RPs signer).

url

String url

Valid settings are:

• An absolute URL (used as is)
• A relative URL (path) that is appended to the HTTP referrer or ACUrl URL

Class swiss.trustbroker.federation.xmlconfig.Sso

class Sso extends Object implements Serializable

Serialized Fields

enabled

boolean enabled

Enable this configuration.

fingerprintCheck

FingerprintCheck fingerprintCheck

Device fingerprint check mode.

forceIdmRefresh

Boolean forceIdmRefresh

Refresh IDM data for SSO - enable e.g. if an Access Request might be performed outside XTB.

groupName

String groupName

Configure a reference to an existing SSOGroup name. The groupName is required when SSO is enabled only.

See Also:

• SsoGroup.getName()

logoutNotifications

Boolean logoutNotifications

Notify other SSO participants about the ongoing logout. The participants need to have their notification endpoints configured using SloResponse elements.
Potentially breaking changes:

• Since 1.12.0 the default was changed from false to true if there SloResponse notifications are configured.

serializeNotifications

Boolean serializeNotifications

Serialize logout notifications in the order of the SloResponse elements.
By default, they are fired in parallel.

Since:

1.14.0

skipHrdWithSsoSession

Boolean skipHrdWithSsoSession

If an RP already is logged in with the first CP, the HRD screen can be skipped leading to the second participant automatically joining the detected SSO session for that CP.

sloResponse

List<SloResponse> sloResponse

sloUrl

String sloUrl

Shortcut for

SloResponse

with this URL and defaults otherwise. Absolute or relative URL as for

SloResponse

See Also:

• SloResponse

Class swiss.trustbroker.federation.xmlconfig.SubjectName

class SubjectName extends Object implements Serializable

Serialized Fields

claim

String claim

Subject Name ID claim name.

Since:

1.9.0

format

String format

Subject Name ID format.

scope

SubjectNameScope scope

Scope of the SubjectName

Since:

1.13.0

source

String source

Matched against the CP/CP:issuer/IDM/IDM:IDMQuery.name/PROPS

Class swiss.trustbroker.federation.xmlconfig.SubjectNameMappings

class SubjectNameMappings extends Object implements Serializable

Serialized Fields

preserve

Boolean preserve

If true, do not overwrite nameId if differing from originalNameId (i.e. preserve changes done by scripts).
Default: false

Since:

1.7.0

subjects

List<SubjectName> subjects

List of mapping

Class swiss.trustbroker.federation.xmlconfig.WsTrust

class WsTrust extends Object implements Serializable

Serialized Fields

counterPartyDefault

Boolean counterPartyDefault

For CPs use this WsTrust setting as default for all RPs used in combination with this CP. And vice versa for RPs.
Default: false

enabled

Boolean enabled

WS-Trust protocol enabled.
Default: true

supportedBindings

List<WsTrustBinding> supportedBindings

List of supported inbound WS-Trust bindings.
Default: Bindings enabled in global configuration (since 1.14.0, before all bindings were allowed)

See Also:

• WsTrustConfig.getBindings()

Package swiss.trustbroker.homerealmdiscovery.dto

Class swiss.trustbroker.homerealmdiscovery.dto.SessionRequest

class SessionRequest extends Object implements Serializable

Serialized Fields

sid

String sid

Class swiss.trustbroker.homerealmdiscovery.dto.SupportInfo

class SupportInfo extends Object implements Serializable

Serialized Fields

appUrl

String appUrl

emailAddress

String emailAddress

phoneNumber

String phoneNumber

Package swiss.trustbroker.oidc.jackson

Class swiss.trustbroker.oidc.jackson.AuthorizationPrincipalModule

class AuthorizationPrincipalModule extends org.springframework.security.oauth2.server.authorization.jackson2.OAuth2AuthorizationServerJackson2Module implements Serializable

Package swiss.trustbroker.oidc.pkce

Class swiss.trustbroker.oidc.pkce.PublicClientAuthenticationToken

class PublicClientAuthenticationToken extends org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientAuthenticationToken implements Serializable

Package swiss.trustbroker.oidc.session

Class swiss.trustbroker.oidc.session.SessionPrincipal

class SessionPrincipal extends Object implements Serializable

Serialized Fields

name

String name

Class swiss.trustbroker.oidc.session.TomcatSession

class TomcatSession extends org.apache.catalina.session.StandardSession implements Serializable

Package swiss.trustbroker.saml.dto

Class swiss.trustbroker.saml.dto.CpResponse

class CpResponse extends ResponseStatus implements Serializable

Serialized Fields

applicationName

String applicationName

RP/OIDC context sending 'SAML clientId' in ProviderName.

attributes

Map<Definition,List<String>> attributes

The attributes map contains these attributes:

• CP SAML Response attributes extracted from the message
• Derived attributes computed in ScriptService BeforeIdm hooks

The names in this map are usually fully qualified as represented in the SAML response from the CP. This map is logged by the AuditService when SAML response comes in from CP.

authLevel

String authLevel

Declared QoA CP side.

authStateInstant

String authStateInstant

Issuing instant of authentication statement.

clientExtId

String clientExtId

Retrieved IDM primary reference for internal reference.

clientName

String clientName

RelyingParty ClientName as used in the IDM credential SAML federation Issuer NameID.

contextClasses

List<String> contextClasses

Authentication context classes.

customIssuer

String customIssuer

Override RP response issuer.

destination

String destination

AuthnRequest.AssertionConsumerUrl from our AuthnRequest.

homeName

String homeName

HomeName used by IdmService to query IDM.

idmLookup

IdmLookup idmLookup

Contains the IdmLookup for the corresponding RP. The query list can originate from Groovy scripts.

inResponseTo

String inResponseTo

ID of the authentication request that lead to this CP response.

issuer

String issuer

CP Response issuer also referred to as HomeRealm.

mappedNameId

String mappedNameId

CP Response incoming subject name ID after CP side subject name mapping.

Since:

1.10.0

See Also:

• SubjectNameMappings

nameId

String nameId

Subject name ID.

nameIdFormat

String nameIdFormat

Format of the subject name ID.

oidcClientId

String oidcClientId

Incoming OIDC client_id.

oidcScopes

Set<String> oidcScopes

Incoming OIDC scopes.

originalAttributes

Map<Definition,List<String>> originalAttributes

Copy of Attributes before filtering. Necessary for SSO

originalNameId

String originalNameId

CP Response incoming subject name ID used for internal processing.

originalPropertiesCount

int originalPropertiesCount

originalUserDetailsCount

int originalUserDetailsCount

properties

Map<Definition,List<String>> properties

Properties contain computed values that can be sent as RP attributes based on incoming CP attributes and userdetails. They are selected by the PropertiesSelection configuration.

queriedStores

Set<String> queriedStores

Contains the stores of IDM lookups actually executed by the available IdmQueryService implementations - including those that did not find a result.

Since:

1.12.0

See Also:

• ()
• IdmProvisioningRequest.getQueriedStores()

results

Map<Definition,List<String>> results

The results map contains these SAML attributes:

• CP SAML Response attributes extracted from the message (PassThrough Claims from CP)
• Derived attributes computed in ScriptService BeforeIdm hooks (Computed CP claims)
• IDM attributes retrieved from the IDMService
• Derived attributes computed in ScriptService AfterIdm hooks (Computed IDM claims)

The names in this map are usually fully qualified as represented in the SAML response from the CP. This map is logged by the AuditService when SAML response is sent to RP. Type system in SAML: Strings and List>String> only. Results are used for auditing only at the time being.

rpContext

Map<String,String> rpContext

The HttpServletRequest params, some specific ones: username, Client_Network

rpContextClasses

List<String> rpContextClasses

Incoming context class requirements on RP side.

rpDestination

String rpDestination

Override SAML Response.Destination on RP side.

rpIssuer

String rpIssuer

Incoming issuer on RP side.

rpRecipient

String rpRecipient

Override SAML SubjectConfirmationData.Recipient on RP side.

rpReferer

String rpReferer

Incoming HTTP referrer on RP side.

subjectConfirmationMethod

String subjectConfirmationMethod

Subject confirmation method.

userDetails

Map<Definition,List<String>> userDetails

IDM user data returned from IDM backends, filtered by RP setup.

Class swiss.trustbroker.saml.dto.ResponseStatus

class ResponseStatus extends Object implements Serializable

Serialized Fields

featureConditions

Map<String,String> featureConditions

Set by scripts to toggle features, to be consumed by the respective implementations.
Potentially breaking changes:

• With 1.11.0 This changed from Set to Map. Scripts that access the getter/setter directly have to be adapted (use featureConditionSet, featureConditions).

Since:

1.9.0

flowPolicy

Flow flowPolicy

Optional flow policy to control the abort flow.

statusCode

String statusCode

Usually urn:oasis:names:tc:SAML:2.0:status:Responder

statusMessage

String statusMessage

E.g. SAML Federation not completed due to ....

statusNestedCode

String statusNestedCode

E.g. urn:oasis:names:tc:SAML:2.0:status:UnknownAttrProfile

Class swiss.trustbroker.saml.dto.RpRequest

class RpRequest extends ResponseStatus implements Serializable

Serialized Fields

applicationName

String applicationName

Application name e.g. from AuthnRequest.ProviderName.

claimsProviders

List<ClaimsProvider> claimsProviders

ClaimsProvider mappings for RelyingParty.

comparisonType

QoaComparison comparisonType

AuthnRequest RequestedAuthnContext.comparisonType.

Since:

1.9.0

context

Map<String,String> context

Map to store internal processing attributes required during federation.

contextClasses

List<String> contextClasses

AuthnRequest RequestedAuthnContext.ContextClassRefs.

referer

String referer

Referer header from the incoming HTTP request.

requestId

String requestId

ID of the incoming message (e.g. AuthnRequest).

rpIssuer

String rpIssuer

Issuer of the incoming SAML request

uiObjects

UiObjects uiObjects

UI objects for the HRD screen.

useSkinnyHrdScreen

boolean useSkinnyHrdScreen

Allow to use a non-angular version of the HRD screen
Default: false

Class swiss.trustbroker.saml.dto.SsoParticipant

class SsoParticipant extends Object implements Serializable

Serialized Fields

color

String color

cpId

String cpId

image

String image

rpId

String rpId

shortcut

String shortcut

Class swiss.trustbroker.saml.dto.SsoParticipants

class SsoParticipants extends Object implements Serializable

Serialized Fields

expirationTime

Timestamp expirationTime

participants

Set<SsoParticipant> participants

ssoEstablishedTime

Timestamp ssoEstablishedTime

ssoGroupName

String ssoGroupName

ssoSubject

String ssoSubject

Class swiss.trustbroker.saml.dto.UiBanner

class UiBanner extends Object implements Serializable

Serialized Fields

collapseParagraphs

boolean collapseParagraphs

True if paragraphs of banner are shown collapsed on a small screen.

mainImage

String mainImage

Main image of banner.

name

String name

Name of the banner referencing configuration.

order

Integer order

Order of the banner.

secondaryImages

List<String> secondaryImages

Secondary images of banner.

Class swiss.trustbroker.saml.dto.UiObject

class UiObject extends Object implements Serializable

Serialized Fields

color

String color

HTML color code identifying the CP on small screens.

description

String description

Text displayed in the CP tile.
The fallback order (if not defined) is: description > name > ID

disabled

UiDisableReason disabled

disabled signals to the frontend to inactivate the tile.

image

String image

Image displayed in the HRD large view.

name

String name

name is displayed on the tile given it's not used as a key into the translation service or overridden by tileTitle.

noticeClaimsProviders

List<String> noticeClaimsProviders

The list of ClaimsProviders name

noticeMaxAgeSec

Integer noticeMaxAgeSec

Notice max age

order

Integer order

order allows to compose multiple tiles in a flexible manner.

shortcut

String shortcut

A usually two-character code identifying the CP on small screens.

title

String title

Title for the CP tile and help item.
The fallback order (if not defined) is: title > name > ID

urn

String urn

id uniquely identifies a tile.

Class swiss.trustbroker.saml.dto.UiObjects

class UiObjects extends Object implements Serializable

Serialized Fields

banners

List<UiBanner> banners

Banners.

tiles

List<UiObject> tiles

Tiles for CPs.

Package swiss.trustbroker.sessioncache.dto

Class swiss.trustbroker.sessioncache.dto.AccessRequestSessionState

class AccessRequestSessionState extends Object implements Serializable

Serialized Fields

completedTime

Timestamp completedTime

initTime

Timestamp initTime

mode

String mode

responseId

String responseId

returnUrl

String returnUrl

rpIssuerId

String rpIssuerId

sentTime

Timestamp sentTime

state

AccessRequestState state

Class swiss.trustbroker.sessioncache.dto.JwkCacheEntity

class JwkCacheEntity extends Object implements Serializable

Serialized Fields

deleteTimestamp

Timestamp deleteTimestamp

expirationTimestamp

Timestamp expirationTimestamp

id

String id

jwk

String jwk

Class swiss.trustbroker.sessioncache.dto.Lifecycle

class Lifecycle extends Object implements Serializable

Serialized Fields

accessCount

long accessCount

expirationTime

Timestamp expirationTime

expiredTime

Timestamp expiredTime

initTime

Timestamp initTime

lifecycleState

@NonNull LifecycleState lifecycleState

reauthTime

Timestamp reauthTime

ssoEstablishedTime

Timestamp ssoEstablishedTime

Class swiss.trustbroker.sessioncache.dto.SsoSessionParticipant

class SsoSessionParticipant extends Object implements Serializable

Serialized Fields

assertionConsumerServiceUrl

String assertionConsumerServiceUrl

cpIssuerId

String cpIssuerId

oidcClientId

String oidcClientId

oidcSessionId

String oidcSessionId

rpIssuerId

String rpIssuerId

Class swiss.trustbroker.sessioncache.dto.SsoState

class SsoState extends Object implements Serializable

Serialized Fields

implicitSsoGroup

boolean implicitSsoGroup

maxCachingTimeSecs

int maxCachingTimeSecs

maxIdleTimeSecs

int maxIdleTimeSecs

maxSessionTimeSecs

int maxSessionTimeSecs

ssoGroupName

String ssoGroupName

ssoParticipants

@NonNull Set<SsoSessionParticipant> ssoParticipants

ssoQoa

String ssoQoa

subject

String subject

Class swiss.trustbroker.sessioncache.dto.StateData

class StateData extends Object implements Serializable

Serialized Fields

accessRequest

AccessRequestSessionState accessRequest

applicationName

String applicationName

assertionConsumerServiceUrl

String assertionConsumerServiceUrl

comparisonType

QoaComparison comparisonType

completedAuthnRequests

List<String> completedAuthnRequests

contextClasses

List<String> contextClasses

cpResponse

CpResponse cpResponse

deviceId

String deviceId

expirationTimestamp

Timestamp expirationTimestamp

forceAuthn

Boolean forceAuthn

hrdHint

String hrdHint

id

@NonNull String id

issueInstant

String issueInstant

issuer

String issuer

lastConversationId

String lastConversationId

lifecycle

@NonNull Lifecycle lifecycle

oidcClientId

String oidcClientId

oidcNonce

String oidcNonce

oidcRefreshToken

String oidcRefreshToken

oidcSessionData

String oidcSessionData

oidcSessionId

String oidcSessionId

oidcTokenCount

int oidcTokenCount

oidcTokenData

String oidcTokenData

referer

String referer

relayState

String relayState

requestBinding

swiss.trustbroker.common.saml.dto.SamlBinding requestBinding

requestedResponseBinding

swiss.trustbroker.common.saml.dto.SamlBinding requestedResponseBinding

rpContext

Map<String,String> rpContext

selectableCpIssuerIds

List<String> selectableCpIssuerIds

selectedProfileExtId

String selectedProfileExtId

sessionIndex

String sessionIndex

signedAuthnRequest

Boolean signedAuthnRequest

spStateData

StateData spStateData

ssoSessionId

String ssoSessionId

ssoState

SsoState ssoState

subjectNameId

String subjectNameId

Class swiss.trustbroker.sessioncache.dto.StateEntity

class StateEntity extends Object implements Serializable

Serialized Fields

expirationTimestamp

Timestamp expirationTimestamp

The scheduled reaper uses this field to clean up the database. The state 'valid' attribute to discard invalidated entries shall not be used in the reaper (yet).

id

String id

jsonData

String jsonData

oidcSessionId

String oidcSessionId

spSessionId

String spSessionId

ssoSessionId

String ssoSessionId