Package swiss.trustbroker.federation.xmlconfig

Class SecurityPolicies

java.lang.Object
swiss.trustbroker.federation.xmlconfig.SecurityPolicies
All Implemented Interfaces:
Serializable
public class SecurityPolicies extends Object implements Serializable
This class allows configuring policies per CP/RP as opposed to SecurityChecks on a global level.
Breaking changes:
  • Specification alignment: With 1.10.0 requireSignedLogoutRequest is applied to incoming LogoutRequests as specified (instead of requireSignedAuthnRequest used in previous releases).
    The new requireSignedLogoutNotificationRequest now controls outbound LogoutRequests sent as SLO notifications (instead of requireSignedLogoutRequest used in previous releases).
See Also:

  • Constructor Details

    • SecurityPolicies

      public SecurityPolicies()

    • SecurityPolicies

      public SecurityPolicies(Boolean requireSignedAuthnRequest, Boolean requireSignedLogoutRequest, Boolean requireSignedLogoutNotificationRequest, Boolean requireSignedResponse, Boolean requireEncryptedAssertion, Boolean requireSignedArtifactResponse, Boolean doSignArtifactResolve, Boolean requireAudienceRestriction, Boolean requireAudienceRestrictionForBearerSubjectConfirmation, Boolean requireSignedAuthnRequestForSsoJoin, Integer notOnOrAfterSeconds, Integer audienceNotOnOrAfterSeconds, Integer ssoMinQoaLevel, Boolean validateXmlSchema, Boolean validateHttpHeaders, Boolean delegateOrigin, Boolean forceAuthn, Boolean wsTrustIssueRequireSignedAssertion, Boolean wsTrustIssueRequireSignedRequest, Boolean wsTrustIssueRequireTimestamp, Long wsTrustIssueNotBeforeToleranceSec, Long wsTrustIssueNotOnOrAfterToleranceSec, List<String> allowedSignatureAlgorithms)
      Deprecated.
      Transition feature
      Creates a new SecurityPolicies instance.
      Parameters:
      requireSignedAuthnRequest - Allow to disable signature check for incoming SAML AuthnRequests.
      Default: true
      requireSignedLogoutRequest - Allow to disable signature check for incoming LogoutRequests. If not set, falls back to requireSignedAuthnRequest.
      requireSignedLogoutNotificationRequest - Allow to disable signature check for outgoing SLO notification LogoutRequests.
      Default: true
      requireSignedResponse - Flag allows to enforce signed SAML responses from CP required for maximum security to assert integrity of the incoming message and assertion. There is no requireSignedAssertion yet as this data structure is the actual data to trust. The check can therefore not be disabled for security reasons.
      Overrides global SecurityChecks
      requireEncryptedAssertion - Allow to disable required encrypted Assertion when the EncryptionKeystore is configured.
      Default: true
      requireSignedArtifactResponse - Flag allows to enforce signed SAML artifact responses from CP required for maximum security to assert integrity of the incoming artifact response message.
      Overrides global SecurityChecks
      doSignArtifactResolve - Flag allows to sign outbound SAML artifact resolve messages for maximum security.
      Overrides global SecurityChecks
      requireAudienceRestriction - Overrides global SecurityChecks
      requireAudienceRestrictionForBearerSubjectConfirmation - Overrides global SecurityChecks
      requireSignedAuthnRequestForSsoJoin - Require signed SAML AuthnRequests to join an SSO session. If not set, falls back to requireSignedAuthnRequest.
      notOnOrAfterSeconds - Overrides the global tokenLifetimeSec for CP response AuthnInstant checks.
      Default: 2600 This is quite long time to transfer a SAML token from the issuer to its consumer to establish a relation between a user and the consuming RP. Tje problem is that some components cache the token and transfer it later.
      audienceNotOnOrAfterSeconds - Overrides the global notOnOrAfterSeconds for conditions notOnOrAfter if greater than zero.
      ssoMinQoaLevel - If CP returns AuthnContext of value less than that, no SSO session is created.
      validateXmlSchema - Some claims providers are not sending well-formed valid XML and therefore are blocked by XTB. The schema check can be disabled lowering the security barrier and let OpenSAML deal with the data directly.
      Default: true
      validateHttpHeaders - Validate HTTP request headers. Currently referer and origin can be validated against the AcWhitelist of an RP.
      delegateOrigin - Control CP AuthnRequest scopes and RP Attribute OriginalIssuer. Defaults to null as RP and CP side default behavior differs
      forceAuthn - Always enforce re-authentication on this CP/on all CPs configured for this RP.
      Overrides the global forceCpAuthentication.
      Default: false (only enforced if RP requests it)
      wsTrustIssueRequireSignedAssertion - Require signed assertion in WS-Trust ISSUE.
      Default: fallback to default (global default is true)
      wsTrustIssueRequireSignedRequest - Require signed request in WS-Trust ISSUE.
      Default: fallback to default
      wsTrustIssueRequireTimestamp - WS-Trust ISSUE requires timestamp.
      Default: true
      wsTrustIssueNotBeforeToleranceSec - WS-Trust ISSUE timestamp not before tolerance override.
      wsTrustIssueNotOnOrAfterToleranceSec - WS-Trust ISSUE timestamp not on or after tolerance override.
      allowedSignatureAlgorithms - List of allowed message signature algorithms. (Empty list means no restriction.)
      Default: Global default
      Since:
      1.10.0, 1.10.0, 1.10.0, 1.10.0, 1.15.0, 1.11.0, 1.12.0, 1.10.0, 1.13.0, 1.13.0, 1.15.0, 1.15.0, 1.15.0, 1.15.0
      See Also:

  • Method Details

    • builder

      public static SecurityPolicies.SecurityPoliciesBuilder builder()

    • getRequireSignedAuthnRequest

      public Boolean getRequireSignedAuthnRequest()
      Allow to disable signature check for incoming SAML AuthnRequests.
      Default: true

    • getRequireSignedLogoutRequest

      public Boolean getRequireSignedLogoutRequest()
      Allow to disable signature check for incoming LogoutRequests. If not set, falls back to requireSignedAuthnRequest.

    • getRequireSignedLogoutNotificationRequest

      public Boolean getRequireSignedLogoutNotificationRequest()
      Allow to disable signature check for outgoing SLO notification LogoutRequests.
      Default: true
      Since:
      1.10.0
      See Also:

    • getRequireSignedResponse

      public Boolean getRequireSignedResponse()
      Flag allows to enforce signed SAML responses from CP required for maximum security to assert integrity of the incoming message and assertion. There is no requireSignedAssertion yet as this data structure is the actual data to trust. The check can therefore not be disabled for security reasons.
      Overrides global SecurityChecks

    • getRequireEncryptedAssertion

      public Boolean getRequireEncryptedAssertion()
      Allow to disable required encrypted Assertion when the EncryptionKeystore is configured.
      Default: true
      Since:
      1.10.0

    • getRequireSignedArtifactResponse

      public Boolean getRequireSignedArtifactResponse()
      Flag allows to enforce signed SAML artifact responses from CP required for maximum security to assert integrity of the incoming artifact response message.
      Overrides global SecurityChecks
      Since:
      1.10.0

    • getDoSignArtifactResolve

      public Boolean getDoSignArtifactResolve()
      Flag allows to sign outbound SAML artifact resolve messages for maximum security.
      Overrides global SecurityChecks
      Since:
      1.10.0

    • getRequireAudienceRestriction

      public Boolean getRequireAudienceRestriction()
      Overrides global SecurityChecks

    • getRequireAudienceRestrictionForBearerSubjectConfirmation

      public Boolean getRequireAudienceRestrictionForBearerSubjectConfirmation()
      Overrides global SecurityChecks
      Since:
      1.15.0

    • getRequireSignedAuthnRequestForSsoJoin

      public Boolean getRequireSignedAuthnRequestForSsoJoin()
      Require signed SAML AuthnRequests to join an SSO session. If not set, falls back to requireSignedAuthnRequest.
      Since:
      1.11.0

    • getNotOnOrAfterSeconds

      public Integer getNotOnOrAfterSeconds()
      Overrides the global tokenLifetimeSec for CP response AuthnInstant checks.
      Default: 2600 This is quite long time to transfer a SAML token from the issuer to its consumer to establish a relation between a user and the consuming RP. Tje problem is that some components cache the token and transfer it later.

    • getAudienceNotOnOrAfterSeconds

      public Integer getAudienceNotOnOrAfterSeconds()
      Overrides the global notOnOrAfterSeconds for conditions notOnOrAfter if greater than zero.

    • getSsoMinQoaLevel

      public Integer getSsoMinQoaLevel()
      If CP returns AuthnContext of value less than that, no SSO session is created.

    • getValidateXmlSchema

      public Boolean getValidateXmlSchema()
      Some claims providers are not sending well-formed valid XML and therefore are blocked by XTB. The schema check can be disabled lowering the security barrier and let OpenSAML deal with the data directly.
      Default: true

    • getValidateHttpHeaders

      public Boolean getValidateHttpHeaders()
      Validate HTTP request headers. Currently referer and origin can be validated against the AcWhitelist of an RP.
      Since:
      1.12.0

    • getDelegateOrigin

      public Boolean getDelegateOrigin()
      Control CP AuthnRequest scopes and RP Attribute OriginalIssuer. Defaults to null as RP and CP side default behavior differs

    • getForceAuthn

      public Boolean getForceAuthn()
      Always enforce re-authentication on this CP/on all CPs configured for this RP.
      Overrides the global forceCpAuthentication.
      Default: false (only enforced if RP requests it)
      Since:
      1.10.0

    • getWsTrustIssueRequireSignedAssertion

      @Deprecated public Boolean getWsTrustIssueRequireSignedAssertion()
      Deprecated.
      Transition feature
      Require signed assertion in WS-Trust ISSUE.
      Default: fallback to default (global default is true)
      Since:
      1.13.0

    • getWsTrustIssueRequireSignedRequest

      public Boolean getWsTrustIssueRequireSignedRequest()
      Require signed request in WS-Trust ISSUE.
      Default: fallback to default
      Since:
      1.13.0

    • getWsTrustIssueRequireTimestamp

      public Boolean getWsTrustIssueRequireTimestamp()
      WS-Trust ISSUE requires timestamp.
      Default: true
      Since:
      1.15.0

    • getWsTrustIssueNotBeforeToleranceSec

      public Long getWsTrustIssueNotBeforeToleranceSec()
      WS-Trust ISSUE timestamp not before tolerance override.
      Since:
      1.15.0

    • getWsTrustIssueNotOnOrAfterToleranceSec

      public Long getWsTrustIssueNotOnOrAfterToleranceSec()
      WS-Trust ISSUE timestamp not on or after tolerance override.
      Since:
      1.15.0

    • getAllowedSignatureAlgorithms

      public List<String> getAllowedSignatureAlgorithms()
      List of allowed message signature algorithms. (Empty list means no restriction.)
      Default: Global default
      Since:
      1.15.0

    • setRequireSignedAuthnRequest

      public void setRequireSignedAuthnRequest(Boolean requireSignedAuthnRequest)
      Allow to disable signature check for incoming SAML AuthnRequests.
      Default: true

    • setRequireSignedLogoutRequest

      public void setRequireSignedLogoutRequest(Boolean requireSignedLogoutRequest)
      Allow to disable signature check for incoming LogoutRequests. If not set, falls back to requireSignedAuthnRequest.

    • setRequireSignedLogoutNotificationRequest

      public void setRequireSignedLogoutNotificationRequest(Boolean requireSignedLogoutNotificationRequest)
      Allow to disable signature check for outgoing SLO notification LogoutRequests.
      Default: true
      Since:
      1.10.0
      See Also:

    • setRequireSignedResponse

      public void setRequireSignedResponse(Boolean requireSignedResponse)
      Flag allows to enforce signed SAML responses from CP required for maximum security to assert integrity of the incoming message and assertion. There is no requireSignedAssertion yet as this data structure is the actual data to trust. The check can therefore not be disabled for security reasons.
      Overrides global SecurityChecks

    • setRequireEncryptedAssertion

      public void setRequireEncryptedAssertion(Boolean requireEncryptedAssertion)
      Allow to disable required encrypted Assertion when the EncryptionKeystore is configured.
      Default: true
      Since:
      1.10.0

    • setRequireSignedArtifactResponse

      public void setRequireSignedArtifactResponse(Boolean requireSignedArtifactResponse)
      Flag allows to enforce signed SAML artifact responses from CP required for maximum security to assert integrity of the incoming artifact response message.
      Overrides global SecurityChecks
      Since:
      1.10.0

    • setDoSignArtifactResolve

      public void setDoSignArtifactResolve(Boolean doSignArtifactResolve)
      Flag allows to sign outbound SAML artifact resolve messages for maximum security.
      Overrides global SecurityChecks
      Since:
      1.10.0

    • setRequireAudienceRestriction

      public void setRequireAudienceRestriction(Boolean requireAudienceRestriction)
      Overrides global SecurityChecks

    • setRequireAudienceRestrictionForBearerSubjectConfirmation

      public void setRequireAudienceRestrictionForBearerSubjectConfirmation(Boolean requireAudienceRestrictionForBearerSubjectConfirmation)
      Overrides global SecurityChecks
      Since:
      1.15.0

    • setRequireSignedAuthnRequestForSsoJoin

      public void setRequireSignedAuthnRequestForSsoJoin(Boolean requireSignedAuthnRequestForSsoJoin)
      Require signed SAML AuthnRequests to join an SSO session. If not set, falls back to requireSignedAuthnRequest.
      Since:
      1.11.0

    • setNotOnOrAfterSeconds

      public void setNotOnOrAfterSeconds(Integer notOnOrAfterSeconds)
      Overrides the global tokenLifetimeSec for CP response AuthnInstant checks.
      Default: 2600 This is quite long time to transfer a SAML token from the issuer to its consumer to establish a relation between a user and the consuming RP. Tje problem is that some components cache the token and transfer it later.

    • setAudienceNotOnOrAfterSeconds

      public void setAudienceNotOnOrAfterSeconds(Integer audienceNotOnOrAfterSeconds)
      Overrides the global notOnOrAfterSeconds for conditions notOnOrAfter if greater than zero.

    • setSsoMinQoaLevel

      public void setSsoMinQoaLevel(Integer ssoMinQoaLevel)
      If CP returns AuthnContext of value less than that, no SSO session is created.

    • setValidateXmlSchema

      public void setValidateXmlSchema(Boolean validateXmlSchema)
      Some claims providers are not sending well-formed valid XML and therefore are blocked by XTB. The schema check can be disabled lowering the security barrier and let OpenSAML deal with the data directly.
      Default: true

    • setValidateHttpHeaders

      public void setValidateHttpHeaders(Boolean validateHttpHeaders)
      Validate HTTP request headers. Currently referer and origin can be validated against the AcWhitelist of an RP.
      Since:
      1.12.0

    • setDelegateOrigin

      public void setDelegateOrigin(Boolean delegateOrigin)
      Control CP AuthnRequest scopes and RP Attribute OriginalIssuer. Defaults to null as RP and CP side default behavior differs

    • setForceAuthn

      public void setForceAuthn(Boolean forceAuthn)
      Always enforce re-authentication on this CP/on all CPs configured for this RP.
      Overrides the global forceCpAuthentication.
      Default: false (only enforced if RP requests it)
      Since:
      1.10.0

    • setWsTrustIssueRequireSignedAssertion

      @Deprecated public void setWsTrustIssueRequireSignedAssertion(Boolean wsTrustIssueRequireSignedAssertion)
      Deprecated.
      Transition feature
      Require signed assertion in WS-Trust ISSUE.
      Default: fallback to default (global default is true)
      Since:
      1.13.0

    • setWsTrustIssueRequireSignedRequest

      public void setWsTrustIssueRequireSignedRequest(Boolean wsTrustIssueRequireSignedRequest)
      Require signed request in WS-Trust ISSUE.
      Default: fallback to default
      Since:
      1.13.0

    • setWsTrustIssueRequireTimestamp

      public void setWsTrustIssueRequireTimestamp(Boolean wsTrustIssueRequireTimestamp)
      WS-Trust ISSUE requires timestamp.
      Default: true
      Since:
      1.15.0

    • setWsTrustIssueNotBeforeToleranceSec

      public void setWsTrustIssueNotBeforeToleranceSec(Long wsTrustIssueNotBeforeToleranceSec)
      WS-Trust ISSUE timestamp not before tolerance override.
      Since:
      1.15.0

    • setWsTrustIssueNotOnOrAfterToleranceSec

      public void setWsTrustIssueNotOnOrAfterToleranceSec(Long wsTrustIssueNotOnOrAfterToleranceSec)
      WS-Trust ISSUE timestamp not on or after tolerance override.
      Since:
      1.15.0

    • setAllowedSignatureAlgorithms

      public void setAllowedSignatureAlgorithms(List<String> allowedSignatureAlgorithms)
      List of allowed message signature algorithms. (Empty list means no restriction.)
      Default: Global default
      Since:
      1.15.0

    • equals

      public boolean equals(Object o)
      Overrides:
      equals in class Object

    • canEqual

      protected boolean canEqual(Object other)

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object