Package swiss.trustbroker.config.dto

Class SecurityChecks

java.lang.Object
swiss.trustbroker.config.dto.SecurityChecks
public class SecurityChecks extends Object
Class controls various security checks on a global level. Global checks enabled per default. During development or integration it might be necessary to have a temporary bail-out. Some of the security checks should be done per RP or CP in which case they need to be configured in the corresponding XML.

  • Field Details

  • Constructor Details

    • SecurityChecks

      public SecurityChecks()

    • SecurityChecks

      public SecurityChecks(boolean requireSignedAuthnRequest, boolean redirectBindingSignatureWarning, boolean requireSignedArtifactResolve, boolean requireSignedArtifactResponse, boolean requireSignedResponse, boolean requireSignedAssertion, boolean validateAuthnRequest, boolean enforceQoaIfMissing, boolean validateSecurityTokenRequest, boolean validateSecurityTokenRequestAssertion, String wss4jChecks, boolean validateXmlSchema, boolean validateHttpHeaders, boolean validateAcs, boolean validateRelayState, boolean validateAudience, boolean requireAudienceRestrictionForBearerSubjectConfirmation, boolean requireAudienceRestriction, boolean validateResponseIssuer, boolean validateInResponseTo, boolean requireSubjectConfirmation, boolean validateSubjectConfirmationTimestamp, boolean validateSubjectConfirmationInResponseTo, boolean validateSubjectConfirmationRecipient, boolean validateLogoutRequest, long notBeforeToleranceSec, long notOnOrAfterToleranceSec, long renewNotOnOrAfterToleranceRenewSec, long messageLifetimeSec, long tokenLifetimeSec, String acceptSubjectConfirmationMethods, boolean saveStateOnValidationFailure, boolean doSignAssertions, boolean doSignSuccessResponse, boolean doSignFailureResponse, boolean doSignArtifactResolve, boolean doSignArtifactResponse, boolean forceCpAuthentication, boolean validateRequestIssueInstant, boolean validateRequestCondition, boolean validateResponseIssueInstant, boolean validateAssertionIssueInstant, boolean validateAuthnStatementIssueInstant, List<String> allowedSignatureAlgorithms, boolean enforceRequestSignatureAlgorithms, boolean enforceResponseSignatureAlgorithms, boolean enforceAssertionSignatureAlgorithms, boolean enforceArtifactSignatureAlgorithms)
      Deprecated.
      Creates a new SecurityChecks instance.
      Parameters:
      requireSignedAuthnRequest - Reject unsigned AuthnRequest?
      Default: true
      redirectBindingSignatureWarning - Allow to just issue a warning for failing signature check for redirect binding.
      Backwards compatibility flag for transition, to be removed in an upcoming release.
      Default: false
      requireSignedArtifactResolve - Reject unsigned ArtifactResolve?
      Default: true
      requireSignedArtifactResponse - Reject unsigned ArtifactResponse?
      Default: true
      requireSignedResponse - Reject unsigned Response?
      Default: true
      requireSignedAssertion - Reject unsigned Assertions?
      Default: true
      validateAuthnRequest - Check incoming AuthnRequest at all.
      Default: true
      enforceQoaIfMissing - Reject request without getAuthnContextClassRef or Qoa configuration
      Default: false
      validateSecurityTokenRequest - Check incoming WSTrust SecurityTokenRequest on WSS4J level.
      Default: false
      validateSecurityTokenRequestAssertion - Check incoming WSTrust SecurityTokenRequest on XTB validator level.
      Default: true
      wss4jChecks - WSS4J checks according to WSS4J actions.
      Default: Timestamp. Signature, SAMLTokenSigned
      validateXmlSchema - Check XML schema.
      Default: true
      validateHttpHeaders - Validate HTTP request headers. Currently referer and origin can be validated against the AcWhitelist of an RP.
      Default: true
      validateAcs - Check assertion consumer URL or HTTP Referer against configured whitelist.
      Default: true
      validateRelayState - Relay must exist otherwise the SAML processing is stopped, if false response matching is done via SAML message.
      Default: true
      validateAudience - Check audience restriction against issuer.
      Default: true
      requireAudienceRestrictionForBearerSubjectConfirmation - Enforce presence and validation of audience restriction for bearer subject confirmations.
      Default: true
      requireAudienceRestriction - Enforce presence and validation of audience restriction for other subject confirmations (e.g. holder of key).
      Default: false
      validateResponseIssuer - Check issuer in the CP response to match what the user has selected as a homeRealm in HRD.
      Default: true
      validateInResponseTo - Check response inResponseTo.
      Default: true
      requireSubjectConfirmation - In WS-Trust RST case we per default require a valid subject confirmation.
      Default: true
      validateSubjectConfirmationTimestamp - Check subject confirmation timestamp.
      Default: true
      validateSubjectConfirmationInResponseTo - Check subject confirmation inResponseTo.
      Default: true
      validateSubjectConfirmationRecipient - Check subject confirmation recipient.
      Default: true
      validateLogoutRequest - Validate OID Logout request.
      Default: false
      notBeforeToleranceSec - Any timestamp tolerance NTP drift tolerance.
      Default: -5
      notOnOrAfterToleranceSec - Any timestamp clock/transfer tolerance.
      Default: 5
      Note: Reduced from 480 with 1.15.0 - aligned with default in application.yml
      renewNotOnOrAfterToleranceRenewSec - Duration after expiration of an assertion for which WS-Trust RENEW request is accepted.
      Default: 2h
      messageLifetimeSec - IssueInstant timestamp check should accept Assertion.Condition.NotValidOnOrAfter over WS-Trust.
      Default: 480
      tokenLifetimeSec - Used for Condition.notOnOrAfterSeconds and SubjectConfirmationData.notOnOrAfterSeconds. Override per RP using SecurityPolicies.notOnOrAfterSeconds.
      Default: 3600
      acceptSubjectConfirmationMethods - Acceptable subject confirmation methods. Comma separated list.
      Default: urn:oasis:names:tc:SAML:2.0:cm:holder-of-key,urn:oasis:names:tc:SAML:2.0:cm:bearer
      saveStateOnValidationFailure - Register state in DB even when validation fails. (Was used for discontinued stealth mode processing only.)
      Default: false
      doSignAssertions - Sign Assertion in outgoing messages.
      Default: true
      doSignSuccessResponse - Sign outgoing Response messages with success state.
      Default: true
      doSignFailureResponse - Sign outgoing Response messages with failure state.
      Default: true
      doSignArtifactResolve - Sign outgoing ArtifactResolve messages.
      Default: true
      doSignArtifactResponse - Sign outgoing ArtifactResponse messages.
      Default: true
      forceCpAuthentication - Enforce CP authentication via corresponding OIDC/SAML flags.
      Default: true (since 1.10.0 the hard coded default was true, before it was false)
      validateRequestIssueInstant - Check IssueInstant attribute in AuthnRequest
      Default: true
      validateRequestCondition - Check Condition attribute in AuthnRequest
      Default: true
      validateResponseIssueInstant - Check IssueInstant attribute in Response
      Default: true
      validateAssertionIssueInstant - Check IssueInstant attribute in Assertion
      Default: true
      validateAuthnStatementIssueInstant - Check IssueInstant attribute in AuthnStatement
      Default: true
      allowedSignatureAlgorithms - List of allowed message signature algorithms. (Empty list means no restriction.)
      Default: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
      enforceRequestSignatureAlgorithms - Enforce allowed message signature algorithms for AuthnRequests.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      enforceResponseSignatureAlgorithms - Enforce allowed message signature algorithms for Responses.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      enforceAssertionSignatureAlgorithms - Enforce allowed message signature algorithms for Assertions.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      enforceArtifactSignatureAlgorithms - Enforce allowed message signature algorithms for Artifact Resolution.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      Since:
      1.12.0, 1.11.0, 1.12.0, 1.15.0, 1.13.0, 1.11.0, 1.11.0, 1.11.0, 1.15.0, 1.15.0, 1.15.0, 1.15.0, 1.15.0
      See Also:

  • Method Details

    • builder

      public static SecurityChecks.SecurityChecksBuilder builder()

    • isRequireSignedAuthnRequest

      public boolean isRequireSignedAuthnRequest()
      Reject unsigned AuthnRequest?
      Default: true

    • isRedirectBindingSignatureWarning

      @Deprecated public boolean isRedirectBindingSignatureWarning()
      Deprecated.
      Allow to just issue a warning for failing signature check for redirect binding.
      Backwards compatibility flag for transition, to be removed in an upcoming release.
      Default: false
      Since:
      1.12.0

    • isRequireSignedArtifactResolve

      public boolean isRequireSignedArtifactResolve()
      Reject unsigned ArtifactResolve?
      Default: true

    • isRequireSignedArtifactResponse

      public boolean isRequireSignedArtifactResponse()
      Reject unsigned ArtifactResponse?
      Default: true

    • isRequireSignedResponse

      public boolean isRequireSignedResponse()
      Reject unsigned Response?
      Default: true

    • isRequireSignedAssertion

      public boolean isRequireSignedAssertion()
      Reject unsigned Assertions?
      Default: true

    • isValidateAuthnRequest

      public boolean isValidateAuthnRequest()
      Check incoming AuthnRequest at all.
      Default: true

    • isEnforceQoaIfMissing

      public boolean isEnforceQoaIfMissing()
      Reject request without getAuthnContextClassRef or Qoa configuration
      Default: false
      Since:
      1.11.0

    • isValidateSecurityTokenRequest

      public boolean isValidateSecurityTokenRequest()
      Check incoming WSTrust SecurityTokenRequest on WSS4J level.
      Default: false

    • isValidateSecurityTokenRequestAssertion

      public boolean isValidateSecurityTokenRequestAssertion()
      Check incoming WSTrust SecurityTokenRequest on XTB validator level.
      Default: true

    • getWss4jChecks

      public String getWss4jChecks()
      WSS4J checks according to WSS4J actions.
      Default: Timestamp. Signature, SAMLTokenSigned
      See Also:

    • isValidateXmlSchema

      public boolean isValidateXmlSchema()
      Check XML schema.
      Default: true

    • isValidateHttpHeaders

      public boolean isValidateHttpHeaders()
      Validate HTTP request headers. Currently referer and origin can be validated against the AcWhitelist of an RP.
      Default: true
      Since:
      1.12.0

    • isValidateAcs

      public boolean isValidateAcs()
      Check assertion consumer URL or HTTP Referer against configured whitelist.
      Default: true

    • isValidateRelayState

      public boolean isValidateRelayState()
      Relay must exist otherwise the SAML processing is stopped, if false response matching is done via SAML message.
      Default: true

    • isValidateAudience

      public boolean isValidateAudience()
      Check audience restriction against issuer.
      Default: true

    • isRequireAudienceRestrictionForBearerSubjectConfirmation

      public boolean isRequireAudienceRestrictionForBearerSubjectConfirmation()
      Enforce presence and validation of audience restriction for bearer subject confirmations.
      Default: true
      Since:
      1.15.0

    • isRequireAudienceRestriction

      public boolean isRequireAudienceRestriction()
      Enforce presence and validation of audience restriction for other subject confirmations (e.g. holder of key).
      Default: false

    • isValidateResponseIssuer

      public boolean isValidateResponseIssuer()
      Check issuer in the CP response to match what the user has selected as a homeRealm in HRD.
      Default: true

    • isValidateInResponseTo

      public boolean isValidateInResponseTo()
      Check response inResponseTo.
      Default: true
      Since:
      1.13.0

    • isRequireSubjectConfirmation

      public boolean isRequireSubjectConfirmation()
      In WS-Trust RST case we per default require a valid subject confirmation.
      Default: true

    • isValidateSubjectConfirmationTimestamp

      public boolean isValidateSubjectConfirmationTimestamp()
      Check subject confirmation timestamp.
      Default: true

    • isValidateSubjectConfirmationInResponseTo

      public boolean isValidateSubjectConfirmationInResponseTo()
      Check subject confirmation inResponseTo.
      Default: true

    • isValidateSubjectConfirmationRecipient

      public boolean isValidateSubjectConfirmationRecipient()
      Check subject confirmation recipient.
      Default: true
      Since:
      1.11.0

    • isValidateLogoutRequest

      public boolean isValidateLogoutRequest()
      Validate OID Logout request.
      Default: false

    • getNotBeforeToleranceSec

      public long getNotBeforeToleranceSec()
      Any timestamp tolerance NTP drift tolerance.
      Default: -5

    • getNotOnOrAfterToleranceSec

      public long getNotOnOrAfterToleranceSec()
      Any timestamp clock/transfer tolerance.
      Default: 5
      Note: Reduced from 480 with 1.15.0 - aligned with default in application.yml

    • getRenewNotOnOrAfterToleranceRenewSec

      public long getRenewNotOnOrAfterToleranceRenewSec()
      Duration after expiration of an assertion for which WS-Trust RENEW request is accepted.
      Default: 2h
      Since:
      1.11.0

    • getMessageLifetimeSec

      public long getMessageLifetimeSec()
      IssueInstant timestamp check should accept Assertion.Condition.NotValidOnOrAfter over WS-Trust.
      Default: 480

    • getTokenLifetimeSec

      public long getTokenLifetimeSec()
      Used for Condition.notOnOrAfterSeconds and SubjectConfirmationData.notOnOrAfterSeconds. Override per RP using SecurityPolicies.notOnOrAfterSeconds.
      Default: 3600

    • getAcceptSubjectConfirmationMethods

      public String getAcceptSubjectConfirmationMethods()
      Acceptable subject confirmation methods. Comma separated list.
      Default: urn:oasis:names:tc:SAML:2.0:cm:holder-of-key,urn:oasis:names:tc:SAML:2.0:cm:bearer

    • isSaveStateOnValidationFailure

      public boolean isSaveStateOnValidationFailure()
      Register state in DB even when validation fails. (Was used for discontinued stealth mode processing only.)
      Default: false

    • isDoSignAssertions

      public boolean isDoSignAssertions()
      Sign Assertion in outgoing messages.
      Default: true

    • isDoSignSuccessResponse

      public boolean isDoSignSuccessResponse()
      Sign outgoing Response messages with success state.
      Default: true

    • isDoSignFailureResponse

      public boolean isDoSignFailureResponse()
      Sign outgoing Response messages with failure state.
      Default: true

    • isDoSignArtifactResolve

      public boolean isDoSignArtifactResolve()
      Sign outgoing ArtifactResolve messages.
      Default: true

    • isDoSignArtifactResponse

      public boolean isDoSignArtifactResponse()
      Sign outgoing ArtifactResponse messages.
      Default: true

    • isForceCpAuthentication

      public boolean isForceCpAuthentication()
      Enforce CP authentication via corresponding OIDC/SAML flags.
      Default: true (since 1.10.0 the hard coded default was true, before it was false)
      Since:
      1.11.0

    • isValidateRequestIssueInstant

      public boolean isValidateRequestIssueInstant()
      Check IssueInstant attribute in AuthnRequest
      Default: true

    • isValidateRequestCondition

      public boolean isValidateRequestCondition()
      Check Condition attribute in AuthnRequest
      Default: true

    • isValidateResponseIssueInstant

      public boolean isValidateResponseIssueInstant()
      Check IssueInstant attribute in Response
      Default: true

    • isValidateAssertionIssueInstant

      public boolean isValidateAssertionIssueInstant()
      Check IssueInstant attribute in Assertion
      Default: true

    • isValidateAuthnStatementIssueInstant

      public boolean isValidateAuthnStatementIssueInstant()
      Check IssueInstant attribute in AuthnStatement
      Default: true

    • getAllowedSignatureAlgorithms

      public List<String> getAllowedSignatureAlgorithms()
      List of allowed message signature algorithms. (Empty list means no restriction.)
      Default: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
      Since:
      1.15.0

    • isEnforceRequestSignatureAlgorithms

      public boolean isEnforceRequestSignatureAlgorithms()
      Enforce allowed message signature algorithms for AuthnRequests.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      Since:
      1.15.0

    • isEnforceResponseSignatureAlgorithms

      public boolean isEnforceResponseSignatureAlgorithms()
      Enforce allowed message signature algorithms for Responses.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      Since:
      1.15.0

    • isEnforceAssertionSignatureAlgorithms

      public boolean isEnforceAssertionSignatureAlgorithms()
      Enforce allowed message signature algorithms for Assertions.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      Since:
      1.15.0

    • isEnforceArtifactSignatureAlgorithms

      public boolean isEnforceArtifactSignatureAlgorithms()
      Enforce allowed message signature algorithms for Artifact Resolution.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      Since:
      1.15.0

    • setRequireSignedAuthnRequest

      public void setRequireSignedAuthnRequest(boolean requireSignedAuthnRequest)
      Reject unsigned AuthnRequest?
      Default: true

    • setRedirectBindingSignatureWarning

      @Deprecated public void setRedirectBindingSignatureWarning(boolean redirectBindingSignatureWarning)
      Deprecated.
      Allow to just issue a warning for failing signature check for redirect binding.
      Backwards compatibility flag for transition, to be removed in an upcoming release.
      Default: false
      Since:
      1.12.0

    • setRequireSignedArtifactResolve

      public void setRequireSignedArtifactResolve(boolean requireSignedArtifactResolve)
      Reject unsigned ArtifactResolve?
      Default: true

    • setRequireSignedArtifactResponse

      public void setRequireSignedArtifactResponse(boolean requireSignedArtifactResponse)
      Reject unsigned ArtifactResponse?
      Default: true

    • setRequireSignedResponse

      public void setRequireSignedResponse(boolean requireSignedResponse)
      Reject unsigned Response?
      Default: true

    • setRequireSignedAssertion

      public void setRequireSignedAssertion(boolean requireSignedAssertion)
      Reject unsigned Assertions?
      Default: true

    • setValidateAuthnRequest

      public void setValidateAuthnRequest(boolean validateAuthnRequest)
      Check incoming AuthnRequest at all.
      Default: true

    • setEnforceQoaIfMissing

      public void setEnforceQoaIfMissing(boolean enforceQoaIfMissing)
      Reject request without getAuthnContextClassRef or Qoa configuration
      Default: false
      Since:
      1.11.0

    • setValidateSecurityTokenRequest

      public void setValidateSecurityTokenRequest(boolean validateSecurityTokenRequest)
      Check incoming WSTrust SecurityTokenRequest on WSS4J level.
      Default: false

    • setValidateSecurityTokenRequestAssertion

      public void setValidateSecurityTokenRequestAssertion(boolean validateSecurityTokenRequestAssertion)
      Check incoming WSTrust SecurityTokenRequest on XTB validator level.
      Default: true

    • setWss4jChecks

      public void setWss4jChecks(String wss4jChecks)
      WSS4J checks according to WSS4J actions.
      Default: Timestamp. Signature, SAMLTokenSigned
      See Also:

    • setValidateXmlSchema

      public void setValidateXmlSchema(boolean validateXmlSchema)
      Check XML schema.
      Default: true

    • setValidateHttpHeaders

      public void setValidateHttpHeaders(boolean validateHttpHeaders)
      Validate HTTP request headers. Currently referer and origin can be validated against the AcWhitelist of an RP.
      Default: true
      Since:
      1.12.0

    • setValidateAcs

      public void setValidateAcs(boolean validateAcs)
      Check assertion consumer URL or HTTP Referer against configured whitelist.
      Default: true

    • setValidateRelayState

      public void setValidateRelayState(boolean validateRelayState)
      Relay must exist otherwise the SAML processing is stopped, if false response matching is done via SAML message.
      Default: true

    • setValidateAudience

      public void setValidateAudience(boolean validateAudience)
      Check audience restriction against issuer.
      Default: true

    • setRequireAudienceRestrictionForBearerSubjectConfirmation

      public void setRequireAudienceRestrictionForBearerSubjectConfirmation(boolean requireAudienceRestrictionForBearerSubjectConfirmation)
      Enforce presence and validation of audience restriction for bearer subject confirmations.
      Default: true
      Since:
      1.15.0

    • setRequireAudienceRestriction

      public void setRequireAudienceRestriction(boolean requireAudienceRestriction)
      Enforce presence and validation of audience restriction for other subject confirmations (e.g. holder of key).
      Default: false

    • setValidateResponseIssuer

      public void setValidateResponseIssuer(boolean validateResponseIssuer)
      Check issuer in the CP response to match what the user has selected as a homeRealm in HRD.
      Default: true

    • setValidateInResponseTo

      public void setValidateInResponseTo(boolean validateInResponseTo)
      Check response inResponseTo.
      Default: true
      Since:
      1.13.0

    • setRequireSubjectConfirmation

      public void setRequireSubjectConfirmation(boolean requireSubjectConfirmation)
      In WS-Trust RST case we per default require a valid subject confirmation.
      Default: true

    • setValidateSubjectConfirmationTimestamp

      public void setValidateSubjectConfirmationTimestamp(boolean validateSubjectConfirmationTimestamp)
      Check subject confirmation timestamp.
      Default: true

    • setValidateSubjectConfirmationInResponseTo

      public void setValidateSubjectConfirmationInResponseTo(boolean validateSubjectConfirmationInResponseTo)
      Check subject confirmation inResponseTo.
      Default: true

    • setValidateSubjectConfirmationRecipient

      public void setValidateSubjectConfirmationRecipient(boolean validateSubjectConfirmationRecipient)
      Check subject confirmation recipient.
      Default: true
      Since:
      1.11.0

    • setValidateLogoutRequest

      public void setValidateLogoutRequest(boolean validateLogoutRequest)
      Validate OID Logout request.
      Default: false

    • setNotBeforeToleranceSec

      public void setNotBeforeToleranceSec(long notBeforeToleranceSec)
      Any timestamp tolerance NTP drift tolerance.
      Default: -5

    • setNotOnOrAfterToleranceSec

      public void setNotOnOrAfterToleranceSec(long notOnOrAfterToleranceSec)
      Any timestamp clock/transfer tolerance.
      Default: 5
      Note: Reduced from 480 with 1.15.0 - aligned with default in application.yml

    • setRenewNotOnOrAfterToleranceRenewSec

      public void setRenewNotOnOrAfterToleranceRenewSec(long renewNotOnOrAfterToleranceRenewSec)
      Duration after expiration of an assertion for which WS-Trust RENEW request is accepted.
      Default: 2h
      Since:
      1.11.0

    • setMessageLifetimeSec

      public void setMessageLifetimeSec(long messageLifetimeSec)
      IssueInstant timestamp check should accept Assertion.Condition.NotValidOnOrAfter over WS-Trust.
      Default: 480

    • setTokenLifetimeSec

      public void setTokenLifetimeSec(long tokenLifetimeSec)
      Used for Condition.notOnOrAfterSeconds and SubjectConfirmationData.notOnOrAfterSeconds. Override per RP using SecurityPolicies.notOnOrAfterSeconds.
      Default: 3600

    • setAcceptSubjectConfirmationMethods

      public void setAcceptSubjectConfirmationMethods(String acceptSubjectConfirmationMethods)
      Acceptable subject confirmation methods. Comma separated list.
      Default: urn:oasis:names:tc:SAML:2.0:cm:holder-of-key,urn:oasis:names:tc:SAML:2.0:cm:bearer

    • setSaveStateOnValidationFailure

      public void setSaveStateOnValidationFailure(boolean saveStateOnValidationFailure)
      Register state in DB even when validation fails. (Was used for discontinued stealth mode processing only.)
      Default: false

    • setDoSignAssertions

      public void setDoSignAssertions(boolean doSignAssertions)
      Sign Assertion in outgoing messages.
      Default: true

    • setDoSignSuccessResponse

      public void setDoSignSuccessResponse(boolean doSignSuccessResponse)
      Sign outgoing Response messages with success state.
      Default: true

    • setDoSignFailureResponse

      public void setDoSignFailureResponse(boolean doSignFailureResponse)
      Sign outgoing Response messages with failure state.
      Default: true

    • setDoSignArtifactResolve

      public void setDoSignArtifactResolve(boolean doSignArtifactResolve)
      Sign outgoing ArtifactResolve messages.
      Default: true

    • setDoSignArtifactResponse

      public void setDoSignArtifactResponse(boolean doSignArtifactResponse)
      Sign outgoing ArtifactResponse messages.
      Default: true

    • setForceCpAuthentication

      public void setForceCpAuthentication(boolean forceCpAuthentication)
      Enforce CP authentication via corresponding OIDC/SAML flags.
      Default: true (since 1.10.0 the hard coded default was true, before it was false)
      Since:
      1.11.0

    • setValidateRequestIssueInstant

      public void setValidateRequestIssueInstant(boolean validateRequestIssueInstant)
      Check IssueInstant attribute in AuthnRequest
      Default: true

    • setValidateRequestCondition

      public void setValidateRequestCondition(boolean validateRequestCondition)
      Check Condition attribute in AuthnRequest
      Default: true

    • setValidateResponseIssueInstant

      public void setValidateResponseIssueInstant(boolean validateResponseIssueInstant)
      Check IssueInstant attribute in Response
      Default: true

    • setValidateAssertionIssueInstant

      public void setValidateAssertionIssueInstant(boolean validateAssertionIssueInstant)
      Check IssueInstant attribute in Assertion
      Default: true

    • setValidateAuthnStatementIssueInstant

      public void setValidateAuthnStatementIssueInstant(boolean validateAuthnStatementIssueInstant)
      Check IssueInstant attribute in AuthnStatement
      Default: true

    • setAllowedSignatureAlgorithms

      public void setAllowedSignatureAlgorithms(List<String> allowedSignatureAlgorithms)
      List of allowed message signature algorithms. (Empty list means no restriction.)
      Default: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
      Since:
      1.15.0

    • setEnforceRequestSignatureAlgorithms

      public void setEnforceRequestSignatureAlgorithms(boolean enforceRequestSignatureAlgorithms)
      Enforce allowed message signature algorithms for AuthnRequests.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      Since:
      1.15.0

    • setEnforceResponseSignatureAlgorithms

      public void setEnforceResponseSignatureAlgorithms(boolean enforceResponseSignatureAlgorithms)
      Enforce allowed message signature algorithms for Responses.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      Since:
      1.15.0

    • setEnforceAssertionSignatureAlgorithms

      public void setEnforceAssertionSignatureAlgorithms(boolean enforceAssertionSignatureAlgorithms)
      Enforce allowed message signature algorithms for Assertions.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      Since:
      1.15.0

    • setEnforceArtifactSignatureAlgorithms

      public void setEnforceArtifactSignatureAlgorithms(boolean enforceArtifactSignatureAlgorithms)
      Enforce allowed message signature algorithms for Artifact Resolution.
      If false, the allowedSignatureAlgorithms list is just used for logging.
      Default: true
      Since:
      1.15.0

    • equals

      public boolean equals(Object o)
      Overrides:
      equals in class Object

    • canEqual

      protected boolean canEqual(Object other)

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object