Package swiss.trustbroker.federation.xmlconfig

Class AuthorizedApplication

java.lang.Object
swiss.trustbroker.federation.xmlconfig.AuthorizedApplication
All Implemented Interfaces:
Serializable
public class AuthorizedApplication extends Object implements Serializable
This class describes the configuration of an application to be authorized by AccessRequest.
See Also:

  • Constructor Details

    • AuthorizedApplication

      public AuthorizedApplication()

    • AuthorizedApplication

      public AuthorizedApplication(String name, String clientId, String url, String applUrl, Integer minQoa, String mode, Boolean enableTrigger, String triggerRole, String serviceUrl, String recipient, String issuerId, String centralCICD, String endpointReferenceAddress, Boolean validateAssertion, String redirectUrl)
      Creates a new AuthorizedApplication instance.
      Parameters:
      name - Required application name (usually corresponding to IDM).
      clientId - If an RP contains multiple OIDC clients and AccessRequest configurations and the OIDC client_id or the applicationName (provided viy AuthnRequest.ProviderName) does not match the 'name', this attribute can be used to establish the relation.
      url - The application can be selected via HTTP Referer matching by configuring the Origin URL in this attribute.
      applUrl - If configured the value is sent as appUrl instead of sending app=name in the INTERACTIVE AccessRequest.
      minQoa - Matched against minimum QOA from SAML AuthnContextClassRef. When an RP has multiple applications, and they cannot be differentiated via HTTP Referer, the minimum AuthnContextClassRef in the AuthnRequest can be used to select the application.
      Optional, not recommended.
      mode - Mode to be used for the AccessRequest, depending on the implementation.
      enableTrigger - AccessRequest can be triggered by calling application.
      triggerRole - When the given role is missing after the IDM lookup phase (and before the profile selection phase) the access-request handling is initiated.
      serviceUrl - Service URL to be called by AccessRequest.
      recipient - Overrides the global AccessRequest recipientId. Fallback to serviceUrl.
      issuerId - Overrides the global issuer.
      centralCICD - Optional request parameter added to URLs.
      endpointReferenceAddress - Overrides the RP ID in requests sent by the AccessRequest.
      validateAssertion - Validate assertions in responses to requests sent by the AccessRequest.
      Default: false
      redirectUrl - URL to be redirected to after AccessRequest.
      Since:
      1.12.0

  • Method Details

    • matchUrlAndQoa

      public boolean matchUrlAndQoa(String referrer, Optional<Integer> requestMinQoa)
      Returns:
      true if referrer and QOA are present and matching if they need to, false if none is required (default application)

    • matchName

      public boolean matchName(String applicationName)

    • matchClientId

      public boolean matchClientId(String clientId)

    • isDefaultApplication

      public boolean isDefaultApplication()

    • noCheckOrEmpty

      public boolean noCheckOrEmpty(String referrer, Optional<Integer> requestMinQoa, String clientId, String applicationName)
      Returns:
      true if referrer, QOA, and oidClientId are either missing or do not need to match (if clientId is not set it is a valid default application, even though name could match the input clientId)

    • validateAssertion

      public boolean validateAssertion()

    • builder

      public static AuthorizedApplication.AuthorizedApplicationBuilder builder()

    • getName

      public String getName()
      Required application name (usually corresponding to IDM).

    • getClientId

      public String getClientId()
      If an RP contains multiple OIDC clients and AccessRequest configurations and the OIDC client_id or the applicationName (provided viy AuthnRequest.ProviderName) does not match the 'name', this attribute can be used to establish the relation.

    • getUrl

      public String getUrl()
      The application can be selected via HTTP Referer matching by configuring the Origin URL in this attribute.

    • getApplUrl

      public String getApplUrl()
      If configured the value is sent as appUrl instead of sending app=name in the INTERACTIVE AccessRequest.
      Since:
      1.12.0

    • getMinQoa

      public Integer getMinQoa()
      Matched against minimum QOA from SAML AuthnContextClassRef. When an RP has multiple applications, and they cannot be differentiated via HTTP Referer, the minimum AuthnContextClassRef in the AuthnRequest can be used to select the application.
      Optional, not recommended.

    • getMode

      public String getMode()
      Mode to be used for the AccessRequest, depending on the implementation.

    • getEnableTrigger

      public Boolean getEnableTrigger()
      AccessRequest can be triggered by calling application.

    • getTriggerRole

      public String getTriggerRole()
      When the given role is missing after the IDM lookup phase (and before the profile selection phase) the access-request handling is initiated.

    • getServiceUrl

      public String getServiceUrl()
      Service URL to be called by AccessRequest.

    • getRecipient

      public String getRecipient()
      Overrides the global AccessRequest recipientId. Fallback to serviceUrl.

    • getIssuerId

      public String getIssuerId()
      Overrides the global issuer.

    • getCentralCICD

      public String getCentralCICD()
      Optional request parameter added to URLs.

    • getEndpointReferenceAddress

      public String getEndpointReferenceAddress()
      Overrides the RP ID in requests sent by the AccessRequest.

    • getValidateAssertion

      public Boolean getValidateAssertion()
      Validate assertions in responses to requests sent by the AccessRequest.
      Default: false

    • getRedirectUrl

      public String getRedirectUrl()
      URL to be redirected to after AccessRequest.

    • setName

      public void setName(String name)
      Required application name (usually corresponding to IDM).

    • setClientId

      public void setClientId(String clientId)
      If an RP contains multiple OIDC clients and AccessRequest configurations and the OIDC client_id or the applicationName (provided viy AuthnRequest.ProviderName) does not match the 'name', this attribute can be used to establish the relation.

    • setUrl

      public void setUrl(String url)
      The application can be selected via HTTP Referer matching by configuring the Origin URL in this attribute.

    • setApplUrl

      public void setApplUrl(String applUrl)
      If configured the value is sent as appUrl instead of sending app=name in the INTERACTIVE AccessRequest.
      Since:
      1.12.0

    • setMinQoa

      public void setMinQoa(Integer minQoa)
      Matched against minimum QOA from SAML AuthnContextClassRef. When an RP has multiple applications, and they cannot be differentiated via HTTP Referer, the minimum AuthnContextClassRef in the AuthnRequest can be used to select the application.
      Optional, not recommended.

    • setMode

      public void setMode(String mode)
      Mode to be used for the AccessRequest, depending on the implementation.

    • setEnableTrigger

      public void setEnableTrigger(Boolean enableTrigger)
      AccessRequest can be triggered by calling application.

    • setTriggerRole

      public void setTriggerRole(String triggerRole)
      When the given role is missing after the IDM lookup phase (and before the profile selection phase) the access-request handling is initiated.

    • setServiceUrl

      public void setServiceUrl(String serviceUrl)
      Service URL to be called by AccessRequest.

    • setRecipient

      public void setRecipient(String recipient)
      Overrides the global AccessRequest recipientId. Fallback to serviceUrl.

    • setIssuerId

      public void setIssuerId(String issuerId)
      Overrides the global issuer.

    • setCentralCICD

      public void setCentralCICD(String centralCICD)
      Optional request parameter added to URLs.

    • setEndpointReferenceAddress

      public void setEndpointReferenceAddress(String endpointReferenceAddress)
      Overrides the RP ID in requests sent by the AccessRequest.

    • setValidateAssertion

      public void setValidateAssertion(Boolean validateAssertion)
      Validate assertions in responses to requests sent by the AccessRequest.
      Default: false

    • setRedirectUrl

      public void setRedirectUrl(String redirectUrl)
      URL to be redirected to after AccessRequest.

    • equals

      public boolean equals(Object o)
      Overrides:
      equals in class Object

    • canEqual

      protected boolean canEqual(Object other)

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object