Package swiss.trustbroker.federation.xmlconfig

Class ClaimsParty.ClaimsPartyBuilder<C extends ClaimsParty,B extends ClaimsParty.ClaimsPartyBuilder<C,B>>

java.lang.Object
swiss.trustbroker.federation.xmlconfig.CounterParty.CounterPartyBuilder<C,B>
swiss.trustbroker.federation.xmlconfig.ClaimsParty.ClaimsPartyBuilder<C,B>
Enclosing class:
ClaimsParty
public abstract static class ClaimsParty.ClaimsPartyBuilder<C extends ClaimsParty,B extends ClaimsParty.ClaimsPartyBuilder<C,B>> extends CounterParty.CounterPartyBuilder<C,B>

  • Constructor Details

    • ClaimsPartyBuilder

      public ClaimsPartyBuilder()

  • Method Details

    • id

      public B id(String id)
      Issuer ID of the claims provider that need to match ClaimsProvider entries in ClaimsProviderDefinitions for HRD display and have to be returned by CPs in SAML responses.
      Notes:
      • CP IDs must be unique within the configuration of each environment (trustbroker-inventories/environment)
      • CP IDs may overlap with RP IDs.
      • For SAML this ID is also used by the actual CP.
      • For OIDC this just an internal ID.
      Returns:
      this.

    • enabled

      public B enabled(FeatureEnum enabled)
      Flag to enable/disable this CP.
      Default is true.
      Returns:
      this.

    • disableACUrl

      public B disableACUrl(Boolean disableACUrl)
      This flag allows to disable setting the AssertionConsumerServiceURL in the AuthnRequest towards the CP as some CPs do fail when it is set (correctly or incorrectly).
      Returns:
      this.

    • statusPolicy

      public B statusPolicy(StatusPolicy statusPolicy)
      This status policy determines the handling of users that are not found in the IDM: BLOCK_UNKNOWN_USER, ALLOW_UNKNOWN_USER.
      Returns:
      this.
      See Also:

    • provision

      public B provision(ProvisioningMode provision)
      Enable IDM provisioning based on CP response.
      Consider using the newer Provisioning.enabled instead.
      Default: FALSE
      Returns:
      this.
      Since:
      1.9.0
      See Also:

    • authLevel

      public B authLevel(String authLevel)
      Configure what QoA the CP can deliver per default, e.g. weak, normal or strong. See XTB Single Sign On (SSO, SLO) on how QoA is handled in the context of XTB.
      Returns:
      this.

    • strongestPossibleAuthLevel

      public B strongestPossibleAuthLevel(String strongestPossibleAuthLevel)
      This attribute allows to map a QoA of 
      StrongestPossible
      on the message level to a corresponding real QoA level to handle XTB Single Sign On (SSO, SLO) as this QoA value does not represent a real QoA.
      Fallback: authLevel
      Returns:
      this.

    • homeName

      public B homeName(HomeName homeName)
      The homeName is usually consumed from the home name attribute and identifies the CP attribute to consume the CP identity from instead of the subject name ID source.
      If not specified or not provided by CP the SAML Response Subject NameID is sued.
      Returns:
      this.

    • accountSource

      public B accountSource(AccountSource accountSource)
      The Account Source consumed by the IdmProvisioningService
      Returns:
      this.
      Since:
      1.12.0

    • originalIssuer

      public B originalIssuer(String originalIssuer)
      The original issuer is by default consumed as is and not changed in the CP handling of XTB.
      Fallback: id
      Returns:
      this.

    • authnRequestIssuerId

      public B authnRequestIssuerId(String authnRequestIssuerId)
      Override of the global issuer for this CP.
      Returns:
      this.

    • responseIssuer

      public B responseIssuer(String responseIssuer)
      Override ID as expected issuer of CP response.
      Can be set to decouple the CP response issuer from the ID. The ID of another CP is permitted here in which case the CP used for the request is picked.
      Fallback: id
      Returns:
      this.
      Since:
      1.12.0

    • ssoUrl

      public B ssoUrl(String ssoUrl)
      SAML POST endpoint on the CP.
      Returns:
      this.

    • certificates

      public B certificates(Certificates certificates)
      You only need to declare SignerTruststore for SAML response verification. For signing the SignerKeystore declared on the RP side is (re-)used.
      Returns:
      this.
      See Also:

    • securityPolicies

      public B securityPolicies(SecurityPolicies securityPolicies)
      Global security policy overrides for this CP.
      Returns:
      this.

    • oidc

      public B oidc(Oidc oidc)
      OIDC client configuration to integrate CP/IDP
      Returns:
      this.
      Since:
      1.9.0

    • saml

      public B saml(Saml saml)
      SAML protocol configuration for this CP.
      Returns:
      this.

    • wsTrust

      public B wsTrust(WsTrust wsTrust)
      WS-Trust protocol configuration for this CP.
      Returns:
      this.
      Since:
      1.14.0

    • subjectNameMappings

      public B subjectNameMappings(SubjectNameMappings subjectNameMappings)
      Subject Name ID mappings for this CP.
      Returns:
      this.
      Since:
      1.8.0

    • qoa

      public B qoa(Qoa qoa)
      QoA configurations for this CP.
      Returns:
      this.
      Since:
      1.9.0

    • provisioning

      public B provisioning(Provisioning provisioning)
      Provisioning configurations for this CP.
      Returns:
      this.
      Since:
      1.12.0

    • attributesSelection

      public B attributesSelection(AttributesSelection attributesSelection)
      The filtering is done when the SAML response is received from the CP. This element therefore declares, which original issuer attributes are acceptable for propagation to RPs.
      Returns:
      this.
      See Also:

    • scripts

      public B scripts(Scripts scripts)
      Script hooks. Only scripts related to this CP are executed.
      Returns:
      this.

    • cpTrustCredential

      public B cpTrustCredential(List<org.opensaml.security.credential.Credential> cpTrustCredential)
      Returns:
      this.

    • cpDecryptionCredentials

      public B cpDecryptionCredentials(List<org.opensaml.security.credential.Credential> cpDecryptionCredentials)
      Returns:
      this.

    • cpBackendClientCredential

      public B cpBackendClientCredential(org.opensaml.security.credential.Credential cpBackendClientCredential)
      Returns:
      this.

    • cpBackendTrustCredentials

      public B cpBackendTrustCredentials(List<org.opensaml.security.credential.Credential> cpBackendTrustCredentials)
      Returns:
      this.

    • self

      protected abstract B self()
      Specified by:
      self in class CounterParty.CounterPartyBuilder<C extends ClaimsParty,B extends ClaimsParty.ClaimsPartyBuilder<C,B>>

    • build

      public abstract C build()
      Specified by:
      build in class CounterParty.CounterPartyBuilder<C extends ClaimsParty,B extends ClaimsParty.ClaimsPartyBuilder<C,B>>

    • toString

      public String toString()
      Overrides:
      toString in class CounterParty.CounterPartyBuilder<C extends ClaimsParty,B extends ClaimsParty.ClaimsPartyBuilder<C,B>>