Package swiss.trustbroker.config.dto

Class SecurityChecks.SecurityChecksBuilder

java.lang.Object
swiss.trustbroker.config.dto.SecurityChecks.SecurityChecksBuilder
Enclosing class:
SecurityChecks
public static class SecurityChecks.SecurityChecksBuilder extends Object

  • Method Details

    • requireSignedAuthnRequest

      public SecurityChecks.SecurityChecksBuilder requireSignedAuthnRequest(boolean requireSignedAuthnRequest)
      Reject unsigned AuthnRequest?
      Default: true
      Returns:
      this.

    • redirectBindingSignatureWarning

      @Deprecated public SecurityChecks.SecurityChecksBuilder redirectBindingSignatureWarning(boolean redirectBindingSignatureWarning)
      Deprecated.
      Allow to just issue a warning for failing signature check for redirect binding.
      Backwards compatibility flag for transition, to be removed in an upcoming release.
      Default: false
      Returns:
      this.
      Since:
      1.12.0

    • requireSignedArtifactResolve

      public SecurityChecks.SecurityChecksBuilder requireSignedArtifactResolve(boolean requireSignedArtifactResolve)
      Reject unsigned ArtifactResolve?
      Default: true
      Returns:
      this.

    • requireSignedArtifactResponse

      public SecurityChecks.SecurityChecksBuilder requireSignedArtifactResponse(boolean requireSignedArtifactResponse)
      Reject unsigned ArtifactResponse?
      Default: true
      Returns:
      this.

    • requireSignedResponse

      public SecurityChecks.SecurityChecksBuilder requireSignedResponse(boolean requireSignedResponse)
      Reject unsigned Response?
      Default: true
      Returns:
      this.

    • requireSignedAssertion

      public SecurityChecks.SecurityChecksBuilder requireSignedAssertion(boolean requireSignedAssertion)
      Reject unsigned Assertions?
      Default: true
      Returns:
      this.

    • validateAuthnRequest

      public SecurityChecks.SecurityChecksBuilder validateAuthnRequest(boolean validateAuthnRequest)
      Check incoming AuthnRequest at all.
      Default: true
      Returns:
      this.

    • enforceQoaIfMissing

      public SecurityChecks.SecurityChecksBuilder enforceQoaIfMissing(boolean enforceQoaIfMissing)
      Reject request without getAuthnContextClassRef or Qoa configuration
      Default: false
      Returns:
      this.
      Since:
      1.11.0

    • validateSecurityTokenRequest

      public SecurityChecks.SecurityChecksBuilder validateSecurityTokenRequest(boolean validateSecurityTokenRequest)
      Check incoming WSTrust SecurityTokenRequest on WSS4J level.
      Default: false
      Returns:
      this.

    • validateSecurityTokenRequestAssertion

      public SecurityChecks.SecurityChecksBuilder validateSecurityTokenRequestAssertion(boolean validateSecurityTokenRequestAssertion)
      Check incoming WSTrust SecurityTokenRequest on XTB validator level.
      Default: true
      Returns:
      this.

    • wss4jChecks

      public SecurityChecks.SecurityChecksBuilder wss4jChecks(String wss4jChecks)
      WSS4J checks according to WSS4J actions.
      Default: Timestamp. Signature, SAMLTokenSigned
      Returns:
      this.
      See Also:

    • validateXmlSchema

      public SecurityChecks.SecurityChecksBuilder validateXmlSchema(boolean validateXmlSchema)
      Check XML schema.
      Default: true
      Returns:
      this.

    • validateHttpHeaders

      public SecurityChecks.SecurityChecksBuilder validateHttpHeaders(boolean validateHttpHeaders)
      Validate HTTP request headers. Currently referer and origin can be validated against the AcWhitelist of an RP.
      Default: true
      Returns:
      this.
      Since:
      1.12.0

    • validateAcs

      public SecurityChecks.SecurityChecksBuilder validateAcs(boolean validateAcs)
      Check assertion consumer URL or HTTP Referer against configured whitelist.
      Default: true
      Returns:
      this.

    • validateRelayState

      public SecurityChecks.SecurityChecksBuilder validateRelayState(boolean validateRelayState)
      Relay must exist otherwise the SAML processing is stopped, if false response matching is done via SAML message.
      Default: true
      Returns:
      this.

    • validateAudience

      public SecurityChecks.SecurityChecksBuilder validateAudience(boolean validateAudience)
      Check audience restriction against issuer.
      Default: true
      Returns:
      this.

    • requireAudienceRestrictionForBearerSubjectConfirmation

      public SecurityChecks.SecurityChecksBuilder requireAudienceRestrictionForBearerSubjectConfirmation(boolean requireAudienceRestrictionForBearerSubjectConfirmation)
      Enforce presence and validation of audience restriction for bearer subject confirmations.
      Default: true
      Returns:
      this.
      Since:
      1.15.0

    • requireAudienceRestriction

      public SecurityChecks.SecurityChecksBuilder requireAudienceRestriction(boolean requireAudienceRestriction)
      Enforce presence and validation of audience restriction for other subject confirmations (e.g. holder of key).
      Default: false
      Returns:
      this.

    • validateResponseIssuer

      public SecurityChecks.SecurityChecksBuilder validateResponseIssuer(boolean validateResponseIssuer)
      Check issuer in the CP response to match what the user has selected as a homeRealm in HRD.
      Default: true
      Returns:
      this.

    • validateInResponseTo

      public SecurityChecks.SecurityChecksBuilder validateInResponseTo(boolean validateInResponseTo)
      Check response inResponseTo.
      Default: true
      Returns:
      this.
      Since:
      1.13.0

    • requireSubjectConfirmation

      public SecurityChecks.SecurityChecksBuilder requireSubjectConfirmation(boolean requireSubjectConfirmation)
      In WS-Trust RST case we per default require a valid subject confirmation.
      Default: true
      Returns:
      this.

    • validateSubjectConfirmationTimestamp

      public SecurityChecks.SecurityChecksBuilder validateSubjectConfirmationTimestamp(boolean validateSubjectConfirmationTimestamp)
      Check subject confirmation timestamp.
      Default: true
      Returns:
      this.

    • validateSubjectConfirmationInResponseTo

      public SecurityChecks.SecurityChecksBuilder validateSubjectConfirmationInResponseTo(boolean validateSubjectConfirmationInResponseTo)
      Check subject confirmation inResponseTo.
      Default: true
      Returns:
      this.

    • validateSubjectConfirmationRecipient

      public SecurityChecks.SecurityChecksBuilder validateSubjectConfirmationRecipient(boolean validateSubjectConfirmationRecipient)
      Check subject confirmation recipient.
      Default: true
      Returns:
      this.
      Since:
      1.11.0

    • validateLogoutRequest

      public SecurityChecks.SecurityChecksBuilder validateLogoutRequest(boolean validateLogoutRequest)
      Validate OID Logout request.
      Default: false
      Returns:
      this.

    • notBeforeToleranceSec

      public SecurityChecks.SecurityChecksBuilder notBeforeToleranceSec(long notBeforeToleranceSec)
      Any timestamp tolerance NTP drift tolerance.
      Default: -5
      Returns:
      this.

    • notOnOrAfterToleranceSec

      public SecurityChecks.SecurityChecksBuilder notOnOrAfterToleranceSec(long notOnOrAfterToleranceSec)
      Any timestamp clock/transfer tolerance.
      Default: 5
      Note: Reduced from 480 with 1.15.0 - aligned with default in application.yml
      Returns:
      this.

    • renewNotOnOrAfterToleranceRenewSec

      public SecurityChecks.SecurityChecksBuilder renewNotOnOrAfterToleranceRenewSec(long renewNotOnOrAfterToleranceRenewSec)
      Duration after expiration of an assertion for which WS-Trust RENEW request is accepted.
      Default: 2h
      Returns:
      this.
      Since:
      1.11.0

    • messageLifetimeSec

      public SecurityChecks.SecurityChecksBuilder messageLifetimeSec(long messageLifetimeSec)
      IssueInstant timestamp check should accept Assertion.Condition.NotValidOnOrAfter over WS-Trust.
      Default: 480
      Returns:
      this.

    • tokenLifetimeSec

      public SecurityChecks.SecurityChecksBuilder tokenLifetimeSec(long tokenLifetimeSec)
      Used for Condition.notOnOrAfterSeconds and SubjectConfirmationData.notOnOrAfterSeconds. Override per RP using SecurityPolicies.notOnOrAfterSeconds.
      Default: 3600
      Returns:
      this.

    • acceptSubjectConfirmationMethods

      public SecurityChecks.SecurityChecksBuilder acceptSubjectConfirmationMethods(String acceptSubjectConfirmationMethods)
      Acceptable subject confirmation methods. Comma separated list.
      Default: urn:oasis:names:tc:SAML:2.0:cm:holder-of-key,urn:oasis:names:tc:SAML:2.0:cm:bearer
      Returns:
      this.

    • saveStateOnValidationFailure

      public SecurityChecks.SecurityChecksBuilder saveStateOnValidationFailure(boolean saveStateOnValidationFailure)
      Register state in DB even when validation fails. (Was used for discontinued stealth mode processing only.)
      Default: false
      Returns:
      this.

    • doSignAssertions

      public SecurityChecks.SecurityChecksBuilder doSignAssertions(boolean doSignAssertions)
      Sign Assertion in outgoing messages.
      Default: true
      Returns:
      this.

    • doSignSuccessResponse

      public SecurityChecks.SecurityChecksBuilder doSignSuccessResponse(boolean doSignSuccessResponse)
      Sign outgoing Response messages with success state.
      Default: true
      Returns:
      this.

    • doSignFailureResponse

      public SecurityChecks.SecurityChecksBuilder doSignFailureResponse(boolean doSignFailureResponse)
      Sign outgoing Response messages with failure state.
      Default: true
      Returns:
      this.

    • doSignArtifactResolve

      public SecurityChecks.SecurityChecksBuilder doSignArtifactResolve(boolean doSignArtifactResolve)
      Sign outgoing ArtifactResolve messages.
      Default: true
      Returns:
      this.

    • doSignArtifactResponse

      public SecurityChecks.SecurityChecksBuilder doSignArtifactResponse(boolean doSignArtifactResponse)
      Sign outgoing ArtifactResponse messages.
      Default: true
      Returns:
      this.

    • forceCpAuthentication

      public SecurityChecks.SecurityChecksBuilder forceCpAuthentication(boolean forceCpAuthentication)
      Enforce CP authentication via corresponding OIDC/SAML flags.
      Default: true (since 1.10.0 the hard coded default was true, before it was false)
      Returns:
      this.
      Since:
      1.11.0

    • validateRequestIssueInstant

      public SecurityChecks.SecurityChecksBuilder validateRequestIssueInstant(boolean validateRequestIssueInstant)
      Check IssueInstant attribute in AuthnRequest
      Default: true
      Returns:
      this.

    • validateRequestCondition

      public SecurityChecks.SecurityChecksBuilder validateRequestCondition(boolean validateRequestCondition)
      Check Condition attribute in AuthnRequest
      Default: true
      Returns:
      this.

    • validateResponseIssueInstant

      public SecurityChecks.SecurityChecksBuilder validateResponseIssueInstant(boolean validateResponseIssueInstant)
      Check IssueInstant attribute in Response
      Default: true
      Returns:
      this.

    • validateAssertionIssueInstant

      public SecurityChecks.SecurityChecksBuilder validateAssertionIssueInstant(boolean validateAssertionIssueInstant)
      Check IssueInstant attribute in Assertion
      Default: true
      Returns:
      this.

    • validateAuthnStatementIssueInstant

      public SecurityChecks.SecurityChecksBuilder validateAuthnStatementIssueInstant(boolean validateAuthnStatementIssueInstant)
      Check IssueInstant attribute in AuthnStatement
      Default: true
      Returns:
      this.

    • allowedSignatureAlgorithms

      public SecurityChecks.SecurityChecksBuilder allowedSignatureAlgorithms(List<String> allowedSignatureAlgorithms)
      List of allowed message signature algorithms. (Empty list means no restriction.)
      Default: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
      Returns:
      this.
      Since:
      1.15.0

    • enforceRequestSignatureAlgorithms

      public SecurityChecks.SecurityChecksBuilder enforceRequestSignatureAlgorithms(boolean enforceRequestSignatureAlgorithms)
      Enforce allowed message signature algorithms for AuthnRequests.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      Returns:
      this.
      Since:
      1.15.0

    • enforceResponseSignatureAlgorithms

      public SecurityChecks.SecurityChecksBuilder enforceResponseSignatureAlgorithms(boolean enforceResponseSignatureAlgorithms)
      Enforce allowed message signature algorithms for Responses.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      Returns:
      this.
      Since:
      1.15.0

    • enforceAssertionSignatureAlgorithms

      public SecurityChecks.SecurityChecksBuilder enforceAssertionSignatureAlgorithms(boolean enforceAssertionSignatureAlgorithms)
      Enforce allowed message signature algorithms for Assertions.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      Returns:
      this.
      Since:
      1.15.0

    • enforceArtifactSignatureAlgorithms

      public SecurityChecks.SecurityChecksBuilder enforceArtifactSignatureAlgorithms(boolean enforceArtifactSignatureAlgorithms)
      Enforce allowed message signature algorithms for Artifact Resolution.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      Returns:
      this.
      Since:
      1.15.0

    • build

      public SecurityChecks build()

    • toString

      public String toString()
      Overrides:
      toString in class Object