Package swiss.trustbroker.federation.xmlconfig

Class SloResponse

java.lang.Object
swiss.trustbroker.federation.xmlconfig.SloResponse
All Implemented Interfaces:
Serializable
public class SloResponse extends Object implements Serializable
Single logout (SLO) configurations for an RP.
See Also:

  • Constructor Details

    • SloResponse

      public SloResponse()

    • SloResponse

      public SloResponse(SloMode mode, SloProtocol protocol, swiss.trustbroker.common.saml.dto.SamlBinding binding, String issuer, Boolean sessionRequired, Boolean crossProtocol, String url, Boolean matchAcUrl, SignerKeystore signerKeystore, org.opensaml.security.credential.Credential sloSigner)
      Creates a new SloResponse instance.
      Parameters:
      mode - The mode of this entry.
      Default: RESPONSE
      protocol - The protocol for which this entry applies.
      Default: SAML2
      binding - The protocol binding for which this entry applies.
      Default: POST (ignored for OIDC)
      issuer - Issuer for SAML LogoutResponse.
      Overrides the globally configured issuer.
      sessionRequired - Enables OIDC 
      frontchannel_logout_session_required
      .
      Default: false
      crossProtocol - Use notification cross-protocol (i.e. use protocol=OIDC even if RP is a SAML SSO session participant and vice versa).
      Note: protocol HTTP is always used crossProtocol.
      Default: false
      url - Valid settings are:
      • An absolute URL (used as is)
      • A relative URL (path) that is appended to the HTTP referrer or ACUrl URL
      matchAcUrl - Perform ACUrl matching for absolute url, prefix with ACUrl scheme/host/port for relative URL.
      Defaults to false: use this URL regardless of what ACUrls were used for the RP in the current SSO session.
      signerKeystore - Override RPs signer for SAML2 LogoutRequest notifications(the LogoutResponse is always signed with RPs signer).
      sloSigner -
      Since:
      1.10.0
      See Also:

  • Method Details

    • getSloSigner

      public org.opensaml.security.credential.Credential getSloSigner()

    • hasSloUrlForResponse

      public boolean hasSloUrlForResponse(SloProtocol protocol)

    • hasIssuerForResponse

      public boolean hasIssuerForResponse(SloProtocol protocol)

    • isResponse

      public boolean isResponse(SloProtocol protocol)

    • isNotification

      public boolean isNotification(SloProtocol protocol)

    • matchAcUrl

      public boolean matchAcUrl()

    • isOidcSessionRequired

      public boolean isOidcSessionRequired()

    • isSameExceptMode

      public boolean isSameExceptMode(SloResponse response)

    • builder

      public static SloResponse.SloResponseBuilder builder()

    • getMode

      public SloMode getMode()
      The mode of this entry.
      Default: RESPONSE

    • getProtocol

      public SloProtocol getProtocol()
      The protocol for which this entry applies.
      Default: SAML2

    • getBinding

      public swiss.trustbroker.common.saml.dto.SamlBinding getBinding()
      The protocol binding for which this entry applies.
      Default: POST (ignored for OIDC)
      Since:
      1.10.0

    • getIssuer

      public String getIssuer()
      Issuer for SAML LogoutResponse.
      Overrides the globally configured issuer.

    • getSessionRequired

      public Boolean getSessionRequired()
      Enables OIDC 
      frontchannel_logout_session_required
      .
      Default: false
      See Also:

    • getCrossProtocol

      public Boolean getCrossProtocol()
      Use notification cross-protocol (i.e. use protocol=OIDC even if RP is a SAML SSO session participant and vice versa).
      Note: protocol HTTP is always used crossProtocol.
      Default: false

    • getUrl

      public String getUrl()
      Valid settings are:
      • An absolute URL (used as is)
      • A relative URL (path) that is appended to the HTTP referrer or ACUrl URL

    • getMatchAcUrl

      public Boolean getMatchAcUrl()
      Perform ACUrl matching for absolute url, prefix with ACUrl scheme/host/port for relative URL.
      Defaults to false: use this URL regardless of what ACUrls were used for the RP in the current SSO session.

    • getSignerKeystore

      public SignerKeystore getSignerKeystore()
      Override RPs signer for SAML2 LogoutRequest notifications(the LogoutResponse is always signed with RPs signer).

    • setMode

      public void setMode(SloMode mode)
      The mode of this entry.
      Default: RESPONSE

    • setProtocol

      public void setProtocol(SloProtocol protocol)
      The protocol for which this entry applies.
      Default: SAML2

    • setBinding

      public void setBinding(swiss.trustbroker.common.saml.dto.SamlBinding binding)
      The protocol binding for which this entry applies.
      Default: POST (ignored for OIDC)
      Since:
      1.10.0

    • setIssuer

      public void setIssuer(String issuer)
      Issuer for SAML LogoutResponse.
      Overrides the globally configured issuer.

    • setSessionRequired

      public void setSessionRequired(Boolean sessionRequired)
      Enables OIDC 
      frontchannel_logout_session_required
      .
      Default: false
      See Also:

    • setCrossProtocol

      public void setCrossProtocol(Boolean crossProtocol)
      Use notification cross-protocol (i.e. use protocol=OIDC even if RP is a SAML SSO session participant and vice versa).
      Note: protocol HTTP is always used crossProtocol.
      Default: false

    • setUrl

      public void setUrl(String url)
      Valid settings are:
      • An absolute URL (used as is)
      • A relative URL (path) that is appended to the HTTP referrer or ACUrl URL

    • setMatchAcUrl

      public void setMatchAcUrl(Boolean matchAcUrl)
      Perform ACUrl matching for absolute url, prefix with ACUrl scheme/host/port for relative URL.
      Defaults to false: use this URL regardless of what ACUrls were used for the RP in the current SSO session.

    • setSignerKeystore

      public void setSignerKeystore(SignerKeystore signerKeystore)
      Override RPs signer for SAML2 LogoutRequest notifications(the LogoutResponse is always signed with RPs signer).

    • setSloSigner

      public void setSloSigner(org.opensaml.security.credential.Credential sloSigner)

    • equals

      public boolean equals(Object o)
      Overrides:
      equals in class Object

    • canEqual

      protected boolean canEqual(Object other)

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object