Package swiss.trustbroker.federation.xmlconfig

Class SecurityPolicies.SecurityPoliciesBuilder

java.lang.Object
swiss.trustbroker.federation.xmlconfig.SecurityPolicies.SecurityPoliciesBuilder
Enclosing class:
SecurityPolicies
public static class SecurityPolicies.SecurityPoliciesBuilder extends Object

  • Method Details

    • requireSignedAuthnRequest

      public SecurityPolicies.SecurityPoliciesBuilder requireSignedAuthnRequest(Boolean requireSignedAuthnRequest)
      Allow to disable signature check for incoming SAML AuthnRequests.
      Default: true
      Returns:
      this.

    • requireSignedLogoutRequest

      public SecurityPolicies.SecurityPoliciesBuilder requireSignedLogoutRequest(Boolean requireSignedLogoutRequest)
      Allow to disable signature check for incoming LogoutRequests. If not set, falls back to requireSignedAuthnRequest.
      Returns:
      this.

    • requireSignedLogoutNotificationRequest

      public SecurityPolicies.SecurityPoliciesBuilder requireSignedLogoutNotificationRequest(Boolean requireSignedLogoutNotificationRequest)
      Allow to disable signature check for outgoing SLO notification LogoutRequests.
      Default: true
      Returns:
      this.
      Since:
      1.10.0
      See Also:

    • requireSignedResponse

      public SecurityPolicies.SecurityPoliciesBuilder requireSignedResponse(Boolean requireSignedResponse)
      Flag allows to enforce signed SAML responses from CP required for maximum security to assert integrity of the incoming message and assertion. There is no requireSignedAssertion yet as this data structure is the actual data to trust. The check can therefore not be disabled for security reasons.
      Overrides global SecurityChecks
      Returns:
      this.

    • requireEncryptedAssertion

      public SecurityPolicies.SecurityPoliciesBuilder requireEncryptedAssertion(Boolean requireEncryptedAssertion)
      Allow to disable required encrypted Assertion when the EncryptionKeystore is configured.
      Default: true
      Returns:
      this.
      Since:
      1.10.0

    • requireSignedArtifactResponse

      public SecurityPolicies.SecurityPoliciesBuilder requireSignedArtifactResponse(Boolean requireSignedArtifactResponse)
      Flag allows to enforce signed SAML artifact responses from CP required for maximum security to assert integrity of the incoming artifact response message.
      Overrides global SecurityChecks
      Returns:
      this.
      Since:
      1.10.0

    • doSignArtifactResolve

      public SecurityPolicies.SecurityPoliciesBuilder doSignArtifactResolve(Boolean doSignArtifactResolve)
      Flag allows to sign outbound SAML artifact resolve messages for maximum security.
      Overrides global SecurityChecks
      Returns:
      this.
      Since:
      1.10.0

    • requireAudienceRestriction

      public SecurityPolicies.SecurityPoliciesBuilder requireAudienceRestriction(Boolean requireAudienceRestriction)
      Overrides global SecurityChecks
      Returns:
      this.

    • requireAudienceRestrictionForBearerSubjectConfirmation

      public SecurityPolicies.SecurityPoliciesBuilder requireAudienceRestrictionForBearerSubjectConfirmation(Boolean requireAudienceRestrictionForBearerSubjectConfirmation)
      Overrides global SecurityChecks
      Returns:
      this.
      Since:
      1.15.0

    • requireSignedAuthnRequestForSsoJoin

      public SecurityPolicies.SecurityPoliciesBuilder requireSignedAuthnRequestForSsoJoin(Boolean requireSignedAuthnRequestForSsoJoin)
      Require signed SAML AuthnRequests to join an SSO session. If not set, falls back to requireSignedAuthnRequest.
      Returns:
      this.
      Since:
      1.11.0

    • notOnOrAfterSeconds

      public SecurityPolicies.SecurityPoliciesBuilder notOnOrAfterSeconds(Integer notOnOrAfterSeconds)
      Overrides the global tokenLifetimeSec for CP response AuthnInstant checks.
      Default: 2600 This is quite long time to transfer a SAML token from the issuer to its consumer to establish a relation between a user and the consuming RP. Tje problem is that some components cache the token and transfer it later.
      Returns:
      this.

    • audienceNotOnOrAfterSeconds

      public SecurityPolicies.SecurityPoliciesBuilder audienceNotOnOrAfterSeconds(Integer audienceNotOnOrAfterSeconds)
      Overrides the global notOnOrAfterSeconds for conditions notOnOrAfter if greater than zero.
      Returns:
      this.

    • ssoMinQoaLevel

      public SecurityPolicies.SecurityPoliciesBuilder ssoMinQoaLevel(Integer ssoMinQoaLevel)
      If CP returns AuthnContext of value less than that, no SSO session is created.
      Returns:
      this.

    • validateXmlSchema

      public SecurityPolicies.SecurityPoliciesBuilder validateXmlSchema(Boolean validateXmlSchema)
      Some claims providers are not sending well-formed valid XML and therefore are blocked by XTB. The schema check can be disabled lowering the security barrier and let OpenSAML deal with the data directly.
      Default: true
      Returns:
      this.

    • validateHttpHeaders

      public SecurityPolicies.SecurityPoliciesBuilder validateHttpHeaders(Boolean validateHttpHeaders)
      Validate HTTP request headers. Currently referer and origin can be validated against the AcWhitelist of an RP.
      Returns:
      this.
      Since:
      1.12.0

    • delegateOrigin

      public SecurityPolicies.SecurityPoliciesBuilder delegateOrigin(Boolean delegateOrigin)
      Control CP AuthnRequest scopes and RP Attribute OriginalIssuer. Defaults to null as RP and CP side default behavior differs
      Returns:
      this.

    • forceAuthn

      public SecurityPolicies.SecurityPoliciesBuilder forceAuthn(Boolean forceAuthn)
      Always enforce re-authentication on this CP/on all CPs configured for this RP.
      Overrides the global forceCpAuthentication.
      Default: false (only enforced if RP requests it)
      Returns:
      this.
      Since:
      1.10.0

    • wsTrustIssueRequireSignedAssertion

      @Deprecated public SecurityPolicies.SecurityPoliciesBuilder wsTrustIssueRequireSignedAssertion(Boolean wsTrustIssueRequireSignedAssertion)
      Deprecated.
      Transition feature
      Require signed assertion in WS-Trust ISSUE.
      Default: fallback to default (global default is true)
      Returns:
      this.
      Since:
      1.13.0

    • wsTrustIssueRequireSignedRequest

      public SecurityPolicies.SecurityPoliciesBuilder wsTrustIssueRequireSignedRequest(Boolean wsTrustIssueRequireSignedRequest)
      Require signed request in WS-Trust ISSUE.
      Default: fallback to default
      Returns:
      this.
      Since:
      1.13.0

    • wsTrustIssueRequireTimestamp

      public SecurityPolicies.SecurityPoliciesBuilder wsTrustIssueRequireTimestamp(Boolean wsTrustIssueRequireTimestamp)
      WS-Trust ISSUE requires timestamp.
      Default: true
      Returns:
      this.
      Since:
      1.15.0

    • wsTrustIssueNotBeforeToleranceSec

      public SecurityPolicies.SecurityPoliciesBuilder wsTrustIssueNotBeforeToleranceSec(Long wsTrustIssueNotBeforeToleranceSec)
      WS-Trust ISSUE timestamp not before tolerance override.
      Returns:
      this.
      Since:
      1.15.0

    • wsTrustIssueNotOnOrAfterToleranceSec

      public SecurityPolicies.SecurityPoliciesBuilder wsTrustIssueNotOnOrAfterToleranceSec(Long wsTrustIssueNotOnOrAfterToleranceSec)
      WS-Trust ISSUE timestamp not on or after tolerance override.
      Returns:
      this.
      Since:
      1.15.0

    • allowedSignatureAlgorithms

      public SecurityPolicies.SecurityPoliciesBuilder allowedSignatureAlgorithms(List<String> allowedSignatureAlgorithms)
      List of allowed message signature algorithms. (Empty list means no restriction.)
      Default: Global default
      Returns:
      this.
      Since:
      1.15.0

    • build

      public SecurityPolicies build()

    • toString

      public String toString()
      Overrides:
      toString in class Object