Package swiss.trustbroker.federation.xmlconfig

Class ClaimsParty

java.lang.Object
swiss.trustbroker.federation.xmlconfig.CounterParty
swiss.trustbroker.federation.xmlconfig.ClaimsParty
All Implemented Interfaces:
Serializable, PathReference
public class ClaimsParty extends CounterParty
This class describes the configuration of a claims provider (CP).
Note on the name: The ClaimsProvider class is already taken for the HRD configuration, and we do not (yet) want to merge those two classes into one, because the want to reuse the ClaimsProviderDefinitions that also contain ClaimsProvider configurations but mainly for the UI display. So we name this class ClaimsParty, a mix of 'Asserting Party' (the counterpart of the 'RelyingParty') and the ClaimsProvider we would want to use ending up in the shortcut CP again.
See Also:

  • Constructor Details

    • ClaimsParty

      protected ClaimsParty(ClaimsParty.ClaimsPartyBuilder<?,?> b)

    • ClaimsParty

      public ClaimsParty()

    • ClaimsParty

      public ClaimsParty(String id, FeatureEnum enabled, Boolean disableACUrl, StatusPolicy statusPolicy, ProvisioningMode provision, String authLevel, String strongestPossibleAuthLevel, HomeName homeName, AccountSource accountSource, String originalIssuer, String authnRequestIssuerId, String responseIssuer, String ssoUrl, Certificates certificates, SecurityPolicies securityPolicies, Oidc oidc, Saml saml, WsTrust wsTrust, SubjectNameMappings subjectNameMappings, Qoa qoa, Provisioning provisioning, AttributesSelection attributesSelection, Scripts scripts, List<org.opensaml.security.credential.Credential> cpTrustCredential, List<org.opensaml.security.credential.Credential> cpDecryptionCredentials, org.opensaml.security.credential.Credential cpBackendClientCredential, List<org.opensaml.security.credential.Credential> cpBackendTrustCredentials)
      Creates a new ClaimsParty instance.
      Parameters:
      id - Issuer ID of the claims provider that need to match ClaimsProvider entries in ClaimsProviderDefinitions for HRD display and have to be returned by CPs in SAML responses.
      Notes:
      • CP IDs must be unique within the configuration of each environment (trustbroker-inventories/environment)
      • CP IDs may overlap with RP IDs.
      • For SAML this ID is also used by the actual CP.
      • For OIDC this just an internal ID.
      enabled - Flag to enable/disable this CP.
      Default is true.
      disableACUrl - This flag allows to disable setting the AssertionConsumerServiceURL in the AuthnRequest towards the CP as some CPs do fail when it is set (correctly or incorrectly).
      statusPolicy - This status policy determines the handling of users that are not found in the IDM: BLOCK_UNKNOWN_USER, ALLOW_UNKNOWN_USER.
      provision - Enable IDM provisioning based on CP response.
      Consider using the newer Provisioning.enabled instead.
      Default: FALSE
      authLevel - Configure what QoA the CP can deliver per default, e.g. weak, normal or strong. See XTB Single Sign On (SSO, SLO) on how QoA is handled in the context of XTB.
      strongestPossibleAuthLevel - This attribute allows to map a QoA of 
      StrongestPossible
      on the message level to a corresponding real QoA level to handle XTB Single Sign On (SSO, SLO) as this QoA value does not represent a real QoA.
      Fallback: authLevel
      homeName - The homeName is usually consumed from the home name attribute and identifies the CP attribute to consume the CP identity from instead of the subject name ID source.
      If not specified or not provided by CP the SAML Response Subject NameID is sued.
      accountSource - The Account Source consumed by the IdmProvisioningService
      originalIssuer - The original issuer is by default consumed as is and not changed in the CP handling of XTB.
      Fallback: id
      authnRequestIssuerId - Override of the global issuer for this CP.
      responseIssuer - Override ID as expected issuer of CP response.
      Can be set to decouple the CP response issuer from the ID. The ID of another CP is permitted here in which case the CP used for the request is picked.
      Fallback: id
      ssoUrl - SAML POST endpoint on the CP.
      certificates - You only need to declare SignerTruststore for SAML response verification. For signing the SignerKeystore declared on the RP side is (re-)used.
      securityPolicies - Global security policy overrides for this CP.
      oidc - OIDC client configuration to integrate CP/IDP
      saml - SAML protocol configuration for this CP.
      wsTrust - WS-Trust protocol configuration for this CP.
      subjectNameMappings - Subject Name ID mappings for this CP.
      qoa - QoA configurations for this CP.
      provisioning - Provisioning configurations for this CP.
      attributesSelection - The filtering is done when the SAML response is received from the CP. This element therefore declares, which original issuer attributes are acceptable for propagation to RPs.
      scripts - Script hooks. Only scripts related to this CP are executed.
      cpTrustCredential -
      cpDecryptionCredentials -
      cpBackendClientCredential -
      cpBackendTrustCredentials -
      Since:
      1.9.0, 1.12.0, 1.12.0, 1.9.0, 1.14.0, 1.8.0, 1.9.0, 1.12.0
      See Also:

  • Method Details

    • getCpTrustCredential

      public List<org.opensaml.security.credential.Credential> getCpTrustCredential()

    • getCpDecryptionCredentials

      public List<org.opensaml.security.credential.Credential> getCpDecryptionCredentials()

    • acUrlDisabled

      public boolean acUrlDisabled()

    • getOriginalIssuer

      public String getOriginalIssuer()

    • getResponseIssuer

      public String getResponseIssuer()

    • getStrongestPossibleAuthLevelWithFallback

      public String getStrongestPossibleAuthLevelWithFallback()

    • isDelegateOrigin

      public boolean isDelegateOrigin()

    • getAuthnRequestIssuerId

      public String getAuthnRequestIssuerId(String defaultIssuerId)

    • getShortType

      @Nonnull public String getShortType()
      Specified by:
      getShortType in class CounterParty
      Returns:
      type for logging etc. (RP/CP)

    • getProvision

      public ProvisioningMode getProvision()

    • getSingleOidcClient

      public OidcClient getSingleOidcClient()

    • builder

      public static ClaimsParty.ClaimsPartyBuilder<?,?> builder()

    • getId

      public String getId()
      Issuer ID of the claims provider that need to match ClaimsProvider entries in ClaimsProviderDefinitions for HRD display and have to be returned by CPs in SAML responses.
      Notes:
      • CP IDs must be unique within the configuration of each environment (trustbroker-inventories/environment)
      • CP IDs may overlap with RP IDs.
      • For SAML this ID is also used by the actual CP.
      • For OIDC this just an internal ID.
      Specified by:
      getId in class CounterParty
      Returns:
      ID of the counterparty

    • getEnabled

      public FeatureEnum getEnabled()
      Flag to enable/disable this CP.
      Default is true.
      Specified by:
      getEnabled in class CounterParty
      Returns:
      enabled flag from config or overridden due to validation errors

    • getDisableACUrl

      public Boolean getDisableACUrl()
      This flag allows to disable setting the AssertionConsumerServiceURL in the AuthnRequest towards the CP as some CPs do fail when it is set (correctly or incorrectly).

    • getStatusPolicy

      public StatusPolicy getStatusPolicy()
      This status policy determines the handling of users that are not found in the IDM: BLOCK_UNKNOWN_USER, ALLOW_UNKNOWN_USER.
      See Also:

    • getAuthLevel

      public String getAuthLevel()
      Configure what QoA the CP can deliver per default, e.g. weak, normal or strong. See XTB Single Sign On (SSO, SLO) on how QoA is handled in the context of XTB.

    • getStrongestPossibleAuthLevel

      public String getStrongestPossibleAuthLevel()
      This attribute allows to map a QoA of 
      StrongestPossible
      on the message level to a corresponding real QoA level to handle XTB Single Sign On (SSO, SLO) as this QoA value does not represent a real QoA.
      Fallback: authLevel

    • getHomeName

      public HomeName getHomeName()
      The homeName is usually consumed from the home name attribute and identifies the CP attribute to consume the CP identity from instead of the subject name ID source.
      If not specified or not provided by CP the SAML Response Subject NameID is sued.

    • getAccountSource

      public AccountSource getAccountSource()
      The Account Source consumed by the IdmProvisioningService
      Since:
      1.12.0

    • getAuthnRequestIssuerId

      public String getAuthnRequestIssuerId()
      Override of the global issuer for this CP.

    • getSsoUrl

      public String getSsoUrl()
      SAML POST endpoint on the CP.

    • getCertificates

      public Certificates getCertificates()
      You only need to declare SignerTruststore for SAML response verification. For signing the SignerKeystore declared on the RP side is (re-)used.
      Specified by:
      getCertificates in class CounterParty
      Returns:
      Certificate
      See Also:

    • getSecurityPolicies

      public SecurityPolicies getSecurityPolicies()
      Global security policy overrides for this CP.
      Specified by:
      getSecurityPolicies in class CounterParty
      Returns:
      Global security policy overrides for this party.

    • getOidc

      public Oidc getOidc()
      OIDC client configuration to integrate CP/IDP
      Specified by:
      getOidc in class CounterParty
      Returns:
      SAML configuration
      Since:
      1.9.0

    • getSaml

      public Saml getSaml()
      SAML protocol configuration for this CP.
      Specified by:
      getSaml in class CounterParty
      Returns:
      SAML configuration

    • getWsTrust

      public WsTrust getWsTrust()
      WS-Trust protocol configuration for this CP.
      Specified by:
      getWsTrust in class CounterParty
      Returns:
      WS-Trust configuration
      Since:
      1.14.0

    • getSubjectNameMappings

      public SubjectNameMappings getSubjectNameMappings()
      Subject Name ID mappings for this CP.
      Specified by:
      getSubjectNameMappings in class CounterParty
      Returns:
      Subject Name ID mappings for this party.
      Since:
      1.8.0

    • getQoa

      public Qoa getQoa()
      QoA configurations for this CP.
      Specified by:
      getQoa in class CounterParty
      Returns:
      Qoa configuration
      Since:
      1.9.0

    • getProvisioning

      public Provisioning getProvisioning()
      Provisioning configurations for this CP.
      Since:
      1.12.0

    • getAttributesSelection

      public AttributesSelection getAttributesSelection()
      The filtering is done when the SAML response is received from the CP. This element therefore declares, which original issuer attributes are acceptable for propagation to RPs.
      Specified by:
      getAttributesSelection in class CounterParty
      Returns:
      Selection of attributes.
      See Also:

    • getScripts

      public Scripts getScripts()
      Script hooks. Only scripts related to this CP are executed.
      Specified by:
      getScripts in class CounterParty
      Returns:
      Scripts

    • getCpBackendClientCredential

      public org.opensaml.security.credential.Credential getCpBackendClientCredential()

    • getCpBackendTrustCredentials

      public List<org.opensaml.security.credential.Credential> getCpBackendTrustCredentials()

    • setId

      public void setId(String id)
      Issuer ID of the claims provider that need to match ClaimsProvider entries in ClaimsProviderDefinitions for HRD display and have to be returned by CPs in SAML responses.
      Notes:
      • CP IDs must be unique within the configuration of each environment (trustbroker-inventories/environment)
      • CP IDs may overlap with RP IDs.
      • For SAML this ID is also used by the actual CP.
      • For OIDC this just an internal ID.

    • setEnabled

      public void setEnabled(FeatureEnum enabled)
      Flag to enable/disable this CP.
      Default is true.
      Specified by:
      setEnabled in class CounterParty
      Parameters:
      enabled - override enabled flag

    • setDisableACUrl

      public void setDisableACUrl(Boolean disableACUrl)
      This flag allows to disable setting the AssertionConsumerServiceURL in the AuthnRequest towards the CP as some CPs do fail when it is set (correctly or incorrectly).

    • setStatusPolicy

      public void setStatusPolicy(StatusPolicy statusPolicy)
      This status policy determines the handling of users that are not found in the IDM: BLOCK_UNKNOWN_USER, ALLOW_UNKNOWN_USER.
      See Also:

    • setProvision

      public void setProvision(ProvisioningMode provision)
      Enable IDM provisioning based on CP response.
      Consider using the newer Provisioning.enabled instead.
      Default: FALSE
      Since:
      1.9.0
      See Also:

    • setAuthLevel

      public void setAuthLevel(String authLevel)
      Configure what QoA the CP can deliver per default, e.g. weak, normal or strong. See XTB Single Sign On (SSO, SLO) on how QoA is handled in the context of XTB.

    • setStrongestPossibleAuthLevel

      public void setStrongestPossibleAuthLevel(String strongestPossibleAuthLevel)
      This attribute allows to map a QoA of 
      StrongestPossible
      on the message level to a corresponding real QoA level to handle XTB Single Sign On (SSO, SLO) as this QoA value does not represent a real QoA.
      Fallback: authLevel

    • setHomeName

      public void setHomeName(HomeName homeName)
      The homeName is usually consumed from the home name attribute and identifies the CP attribute to consume the CP identity from instead of the subject name ID source.
      If not specified or not provided by CP the SAML Response Subject NameID is sued.

    • setAccountSource

      public void setAccountSource(AccountSource accountSource)
      The Account Source consumed by the IdmProvisioningService
      Since:
      1.12.0

    • setOriginalIssuer

      public void setOriginalIssuer(String originalIssuer)
      The original issuer is by default consumed as is and not changed in the CP handling of XTB.
      Fallback: id

    • setAuthnRequestIssuerId

      public void setAuthnRequestIssuerId(String authnRequestIssuerId)
      Override of the global issuer for this CP.

    • setResponseIssuer

      public void setResponseIssuer(String responseIssuer)
      Override ID as expected issuer of CP response.
      Can be set to decouple the CP response issuer from the ID. The ID of another CP is permitted here in which case the CP used for the request is picked.
      Fallback: id
      Since:
      1.12.0

    • setSsoUrl

      public void setSsoUrl(String ssoUrl)
      SAML POST endpoint on the CP.

    • setCertificates

      public void setCertificates(Certificates certificates)
      You only need to declare SignerTruststore for SAML response verification. For signing the SignerKeystore declared on the RP side is (re-)used.
      See Also:

    • setSecurityPolicies

      public void setSecurityPolicies(SecurityPolicies securityPolicies)
      Global security policy overrides for this CP.

    • setOidc

      public void setOidc(Oidc oidc)
      OIDC client configuration to integrate CP/IDP
      Since:
      1.9.0

    • setSaml

      public void setSaml(Saml saml)
      SAML protocol configuration for this CP.

    • setWsTrust

      public void setWsTrust(WsTrust wsTrust)
      WS-Trust protocol configuration for this CP.
      Since:
      1.14.0

    • setSubjectNameMappings

      public void setSubjectNameMappings(SubjectNameMappings subjectNameMappings)
      Subject Name ID mappings for this CP.
      Since:
      1.8.0

    • setQoa

      public void setQoa(Qoa qoa)
      QoA configurations for this CP.
      Since:
      1.9.0

    • setProvisioning

      public void setProvisioning(Provisioning provisioning)
      Provisioning configurations for this CP.
      Since:
      1.12.0

    • setAttributesSelection

      public void setAttributesSelection(AttributesSelection attributesSelection)
      The filtering is done when the SAML response is received from the CP. This element therefore declares, which original issuer attributes are acceptable for propagation to RPs.
      See Also:

    • setScripts

      public void setScripts(Scripts scripts)
      Script hooks. Only scripts related to this CP are executed.

    • setCpTrustCredential

      public void setCpTrustCredential(List<org.opensaml.security.credential.Credential> cpTrustCredential)

    • setCpDecryptionCredentials

      public void setCpDecryptionCredentials(List<org.opensaml.security.credential.Credential> cpDecryptionCredentials)

    • setCpBackendClientCredential

      public void setCpBackendClientCredential(org.opensaml.security.credential.Credential cpBackendClientCredential)

    • setCpBackendTrustCredentials

      public void setCpBackendTrustCredentials(List<org.opensaml.security.credential.Credential> cpBackendTrustCredentials)

    • toString

      public String toString()
      Overrides:
      toString in class CounterParty

    • equals

      public boolean equals(Object o)
      Overrides:
      equals in class CounterParty

    • canEqual

      protected boolean canEqual(Object other)
      Overrides:
      canEqual in class CounterParty

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class CounterParty