Package swiss.trustbroker.federation.xmlconfig

Class RelyingParty

java.lang.Object
swiss.trustbroker.federation.xmlconfig.CounterParty
swiss.trustbroker.federation.xmlconfig.RelyingParty
All Implemented Interfaces:
Serializable, swiss.trustbroker.api.relyingparty.dto.RelyingPartyConfig, PathReference
public class RelyingParty extends CounterParty implements swiss.trustbroker.api.relyingparty.dto.RelyingPartyConfig
This class describes the configuration of a relying party (RP).
The following sources of attributes to be passed to the RP exist:
  • Attributes definitions (from CP)
  • UserDetails definitions (from IDM)
  • Properties definitions (computed by XTB or in Scripts)

RP profiles are configuration templates for RP setups that reflect a common pattern used by multiple RPs.
Potentially breaking changes: see FeatureEnum
See Also:

  • Constructor Details

    • RelyingParty

      protected RelyingParty(RelyingParty.RelyingPartyBuilder<?,?> b)

    • RelyingParty

      public RelyingParty()

    • RelyingParty

      public RelyingParty(String id, String unaliasedId, FeatureEnum enabled, String base, String clientName, String applicationName, String billingId, String clientExtId, AcWhitelist acWhitelist, Certificates certificates, SecurityPolicies securityPolicies, Oidc oidc, Saml saml, WsTrust wsTrust, AnnouncementRpConfig announcement, Sso sso, ClaimsProviderMappings claimsProviderMappings, SubjectNameMappings subjectNameMappings, Qoa qoa, FlowPolicies flowPolicies, AccessRequest accessRequest, AttributesSelection attributesSelection, ConstAttributes constAttributes, IdmLookup idmLookup, AttributesSelection propertiesSelection, AttributesSelection claimsSelection, ProfileSelection profileSelection, Scripts scripts, List<org.opensaml.security.credential.Credential> rpTrustCredentials, org.opensaml.security.credential.Credential rpSigner, org.opensaml.security.credential.Credential rpEncryptionTrustCredential, List<org.opensaml.security.credential.Credential> rpDecryptionCredentials)
      Deprecated.
      replaced with ClaimsSelection
      Creates a new RelyingParty instance.
      Parameters:
      id - RP ID.
      Notes:
      • RP IDs must be unique within the configuration of each environment (trustbroker-inventories/environment)
      • RP IDs may overlap with CP IDs.
      • For SAML this ID is also used by the actual RP.
      • For OIDC this just an internal ID.
      unaliasedId -
      enabled - Flag to enable/disable this RP.
      Default is true.
      base - Base profile.
      The full file name of the ProfileRP_name.xml.
      clientName - ClientName is the access tenant identifier (somewhat a short form of the relying party ID) applied to all 
      %clientname%
      placeholders in the configuration, specifically the attributes as listed above.
      applicationName - If the SAML ProviderName or OIDC client_id are wrong or missing, a relying party can be configured with a global ApplicationName used for AccessRequest ProfileSelection or AnnouncementService to select the matching data items.
      billingId - We introduce the billing field, so we can start make some trials adding it to the config. We might need to move it to the access request application section later if RP-ID is not 1:1 related to billingId. The value is currently only used in the XTB auditing.
      clientExtId - Primary key of the IDM client identifying an access tenant.
      acWhitelist - Assertion consumer service URL authorized to access XTB federation services for this RP.
      certificates - For verification and signing. For signing the SignerKeystore declared on is (re-)used on the CP side.
      securityPolicies - Global security policy overrides for this RP.
      oidc - OIDC client configuration for this RP.
      saml - SAML protocol configuration for this RP.
      wsTrust - WS-Trust protocol configuration for this RP.
      announcement - Announcement configuration for this RP.
      sso - SSO configuration for this RP.
      claimsProviderMappings - List of CPs mapped to this RP.
      subjectNameMappings - Subject Name ID mappings for this RP.
      qoa - QoA configurations for this RP.
      flowPolicies - Error flow policies for this RP.
      accessRequest - AccessRequest configuration for this RP.
      attributesSelection - RP side attribute selection.
      constAttributes - Constant attributes to be added for this RP.
      idmLookup - IDM lookup configuration for this RP.
      propertiesSelection - Properties selection identifies the computed/derived attributes passed through to the RP.
      claimsSelection - RP side claims selection.
      profileSelection - Profile selection configuration for this RP.
      scripts - Script hooks. Only scripts related to this RP are executed.
      rpTrustCredentials -
      rpSigner -
      rpEncryptionTrustCredential -
      rpDecryptionCredentials -
      Since:
      1.12.0, 1.14.0, 1.9.0
      See Also:

  • Method Details

    • getId

      public String getId()
      Specified by:
      getId in interface swiss.trustbroker.api.relyingparty.dto.RelyingPartyConfig
      Specified by:
      getId in class CounterParty
      Returns:
      ID of the counterparty

    • getEnabled

      public FeatureEnum getEnabled()
      Specified by:
      getEnabled in class CounterParty
      Returns:
      enabled flag from config or overridden due to validation errors

    • setEnabled

      public void setEnabled(FeatureEnum enabled)
      Specified by:
      setEnabled in class CounterParty
      Parameters:
      enabled - override enabled flag

    • getSubjectNameMappings

      public SubjectNameMappings getSubjectNameMappings()
      Specified by:
      getSubjectNameMappings in class CounterParty
      Returns:
      Subject Name ID mappings for this party.

    • getSecurityPolicies

      public SecurityPolicies getSecurityPolicies()
      Specified by:
      getSecurityPolicies in class CounterParty
      Returns:
      Global security policy overrides for this party.

    • getSaml

      public Saml getSaml()
      Specified by:
      getSaml in class CounterParty
      Returns:
      SAML configuration

    • getOidc

      public Oidc getOidc()
      Specified by:
      getOidc in class CounterParty
      Returns:
      SAML configuration

    • getWsTrust

      public WsTrust getWsTrust()
      Specified by:
      getWsTrust in class CounterParty
      Returns:
      WS-Trust configuration

    • getAttributesSelection

      public AttributesSelection getAttributesSelection()
      Specified by:
      getAttributesSelection in class CounterParty
      Returns:
      Selection of attributes.

    • getScripts

      public Scripts getScripts()
      Specified by:
      getScripts in class CounterParty
      Returns:
      Scripts

    • getQoa

      public Qoa getQoa()
      Specified by:
      getQoa in class CounterParty
      Returns:
      Qoa configuration

    • getCertificates

      public Certificates getCertificates()
      Specified by:
      getCertificates in class CounterParty
      Returns:
      Certificate

    • getSingleOidcClient

      public OidcClient getSingleOidcClient()

    • getRpTrustCredentials

      public List<org.opensaml.security.credential.Credential> getRpTrustCredentials()

    • getRpSigner

      public org.opensaml.security.credential.Credential getRpSigner()

    • getRpEncryptionTrustCredential

      public org.opensaml.security.credential.Credential getRpEncryptionTrustCredential()

    • isSsoEnabled

      public boolean isSsoEnabled(boolean ssoGloballyEnabled)

    • hasAccessRequest

      public boolean hasAccessRequest()

    • getSloUrl

      public Optional<String> getSloUrl(SloProtocol protocol)

    • getSloIssuer

      public Optional<String> getSloIssuer(SloProtocol protocol)

    • initializedSaml

      public Saml initializedSaml()

    • getSignatureParametersBuilder

      public swiss.trustbroker.common.saml.dto.SignatureParameters.SignatureParametersBuilder getSignatureParametersBuilder()
      Overrides:
      getSignatureParametersBuilder in class CounterParty

    • isDelegateOrigin

      public boolean isDelegateOrigin()

    • getFlows

      public List<Flow> getFlows()

    • sameHrd

      public boolean sameHrd(RelyingParty relyingParty)

    • getCpMappingForAlias

      public Optional<ClaimsProvider> getCpMappingForAlias(String rpAliasId)

    • getAllDefinitions

      public List<Definition> getAllDefinitions()

    • getShortType

      @Nonnull public String getShortType()
      Specified by:
      getShortType in class CounterParty
      Returns:
      type for logging etc. (RP/CP)

    • initializedAcWhitelist

      public static AcWhitelist initializedAcWhitelist(RelyingParty relyingParty)

    • builder

      public static RelyingParty.RelyingPartyBuilder<?,?> builder()

    • getUnaliasedId

      public String getUnaliasedId()

    • getBase

      public String getBase()
      Base profile.
      The full file name of the ProfileRP_name.xml.

    • getClientName

      public String getClientName()
      ClientName is the access tenant identifier (somewhat a short form of the relying party ID) applied to all 
      %clientname%
      placeholders in the configuration, specifically the attributes as listed above.

    • getApplicationName

      public String getApplicationName()
      If the SAML ProviderName or OIDC client_id are wrong or missing, a relying party can be configured with a global ApplicationName used for AccessRequest ProfileSelection or AnnouncementService to select the matching data items.
      Since:
      1.12.0

    • getBillingId

      public String getBillingId()
      We introduce the billing field, so we can start make some trials adding it to the config. We might need to move it to the access request application section later if RP-ID is not 1:1 related to billingId. The value is currently only used in the XTB auditing.

    • getClientExtId

      public String getClientExtId()
      Primary key of the IDM client identifying an access tenant.

    • getAcWhitelist

      public AcWhitelist getAcWhitelist()
      Assertion consumer service URL authorized to access XTB federation services for this RP.

    • getAnnouncement

      public AnnouncementRpConfig getAnnouncement()
      Announcement configuration for this RP.

    • getSso

      public Sso getSso()
      SSO configuration for this RP.

    • getClaimsProviderMappings

      public ClaimsProviderMappings getClaimsProviderMappings()
      List of CPs mapped to this RP.

    • getFlowPolicies

      public FlowPolicies getFlowPolicies()
      Error flow policies for this RP.

    • getAccessRequest

      public AccessRequest getAccessRequest()
      AccessRequest configuration for this RP.

    • getConstAttributes

      @Deprecated public ConstAttributes getConstAttributes()
      Deprecated.
      replaced with ClaimsSelection
      Constant attributes to be added for this RP.

    • getIdmLookup

      public IdmLookup getIdmLookup()
      IDM lookup configuration for this RP.

    • getPropertiesSelection

      public AttributesSelection getPropertiesSelection()
      Properties selection identifies the computed/derived attributes passed through to the RP.

    • getClaimsSelection

      public AttributesSelection getClaimsSelection()
      RP side claims selection.
      Since:
      1.9.0

    • getProfileSelection

      public ProfileSelection getProfileSelection()
      Profile selection configuration for this RP.

    • getRpDecryptionCredentials

      public List<org.opensaml.security.credential.Credential> getRpDecryptionCredentials()

    • setId

      public void setId(String id)
      RP ID.
      Notes:
      • RP IDs must be unique within the configuration of each environment (trustbroker-inventories/environment)
      • RP IDs may overlap with CP IDs.
      • For SAML this ID is also used by the actual RP.
      • For OIDC this just an internal ID.

    • setUnaliasedId

      public void setUnaliasedId(String unaliasedId)

    • setBase

      public void setBase(String base)
      Base profile.
      The full file name of the ProfileRP_name.xml.

    • setClientName

      public void setClientName(String clientName)
      ClientName is the access tenant identifier (somewhat a short form of the relying party ID) applied to all 
      %clientname%
      placeholders in the configuration, specifically the attributes as listed above.

    • setApplicationName

      public void setApplicationName(String applicationName)
      If the SAML ProviderName or OIDC client_id are wrong or missing, a relying party can be configured with a global ApplicationName used for AccessRequest ProfileSelection or AnnouncementService to select the matching data items.
      Since:
      1.12.0

    • setBillingId

      public void setBillingId(String billingId)
      We introduce the billing field, so we can start make some trials adding it to the config. We might need to move it to the access request application section later if RP-ID is not 1:1 related to billingId. The value is currently only used in the XTB auditing.

    • setClientExtId

      public void setClientExtId(String clientExtId)
      Primary key of the IDM client identifying an access tenant.

    • setAcWhitelist

      public void setAcWhitelist(AcWhitelist acWhitelist)
      Assertion consumer service URL authorized to access XTB federation services for this RP.

    • setCertificates

      public void setCertificates(Certificates certificates)
      For verification and signing. For signing the SignerKeystore declared on is (re-)used on the CP side.
      See Also:

    • setSecurityPolicies

      public void setSecurityPolicies(SecurityPolicies securityPolicies)
      Global security policy overrides for this RP.

    • setOidc

      public void setOidc(Oidc oidc)
      OIDC client configuration for this RP.

    • setSaml

      public void setSaml(Saml saml)
      SAML protocol configuration for this RP.

    • setWsTrust

      public void setWsTrust(WsTrust wsTrust)
      WS-Trust protocol configuration for this RP.
      Since:
      1.14.0

    • setAnnouncement

      public void setAnnouncement(AnnouncementRpConfig announcement)
      Announcement configuration for this RP.

    • setSso

      public void setSso(Sso sso)
      SSO configuration for this RP.

    • setClaimsProviderMappings

      public void setClaimsProviderMappings(ClaimsProviderMappings claimsProviderMappings)
      List of CPs mapped to this RP.

    • setSubjectNameMappings

      public void setSubjectNameMappings(SubjectNameMappings subjectNameMappings)
      Subject Name ID mappings for this RP.

    • setQoa

      public void setQoa(Qoa qoa)
      QoA configurations for this RP.

    • setFlowPolicies

      public void setFlowPolicies(FlowPolicies flowPolicies)
      Error flow policies for this RP.

    • setAccessRequest

      public void setAccessRequest(AccessRequest accessRequest)
      AccessRequest configuration for this RP.

    • setAttributesSelection

      public void setAttributesSelection(AttributesSelection attributesSelection)
      RP side attribute selection.
      See Also:

    • setConstAttributes

      @Deprecated public void setConstAttributes(ConstAttributes constAttributes)
      Deprecated.
      replaced with ClaimsSelection
      Constant attributes to be added for this RP.

    • setIdmLookup

      public void setIdmLookup(IdmLookup idmLookup)
      IDM lookup configuration for this RP.

    • setPropertiesSelection

      public void setPropertiesSelection(AttributesSelection propertiesSelection)
      Properties selection identifies the computed/derived attributes passed through to the RP.

    • setClaimsSelection

      public void setClaimsSelection(AttributesSelection claimsSelection)
      RP side claims selection.
      Since:
      1.9.0

    • setProfileSelection

      public void setProfileSelection(ProfileSelection profileSelection)
      Profile selection configuration for this RP.

    • setScripts

      public void setScripts(Scripts scripts)
      Script hooks. Only scripts related to this RP are executed.

    • setRpTrustCredentials

      public void setRpTrustCredentials(List<org.opensaml.security.credential.Credential> rpTrustCredentials)

    • setRpSigner

      public void setRpSigner(org.opensaml.security.credential.Credential rpSigner)

    • setRpEncryptionTrustCredential

      public void setRpEncryptionTrustCredential(org.opensaml.security.credential.Credential rpEncryptionTrustCredential)

    • setRpDecryptionCredentials

      public void setRpDecryptionCredentials(List<org.opensaml.security.credential.Credential> rpDecryptionCredentials)

    • toString

      public String toString()
      Overrides:
      toString in class CounterParty

    • equals

      public boolean equals(Object o)
      Overrides:
      equals in class CounterParty

    • canEqual

      protected boolean canEqual(Object other)
      Overrides:
      canEqual in class CounterParty

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class CounterParty