Package swiss.trustbroker.sso.service

Class SsoService

java.lang.Object

swiss.trustbroker.sso.service.SsoService

@Service
public class SsoService
extends Object

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	SsoService.SloState
static class	SsoService.SsoCookieNameParams
static enum	SsoService.SsoSessionOperation
static class	SsoService.StateWithCookies

Constructor Summary

Constructors

Constructor	Description
SsoService(RelyingPartyDefinitions relyingPartyDefinitions, RelyingPartySetupService relyingPartySetupService, AuditService auditService, QoaMappingService qoaMappingService, StateCacheService stateCacheService, TrustBrokerProperties trustBrokerProperties, Clock clock)

Method Summary

Modifier and Type	Method	Description
void	auditLogoutRequestFromRp(jakarta.servlet.http.HttpServletRequest httpServletRequest, org.opensaml.saml.saml2.core.LogoutRequest logoutRequest, StateData stateData, RelyingParty relyingParty, OidcAuditData oidcAuditData)
SloResponseParameters	buildSloResponseParameters(RelyingParty relyingParty, String referer, Set<SsoSessionParticipant> sloNotifications, org.opensaml.saml.saml2.core.NameID nameId, String oidcSessionId, String oidcRedirectUrl)
void	completeDeviceInfoPreservingStateForSso(StateData ssoStateData, StateData stateDataByAuthnReq, RelyingParty relyingParty)
String	computeOidcSingleLogoutUrl(String oidcRedirectUrl, String requestReferrer, RelyingParty relyingParty)
String	computeSamlSingleLogoutUrl(String requestReferrer, RelyingParty relyingParty)
void	establishImplicitSso(RelyingParty relyingParty, ClaimsParty claimsParty, StateData stateData)
void	establishSso(RelyingParty relyingParty, ClaimsParty claimsParty, StateData stateData, SsoGroup ssoGroup)
Optional<StateData>	findValidSsoSessionForSessionIndexes(List<String> sessionIndexes)
Optional<SsoService.StateWithCookies>	findValidStateAndCookiesToExpire(SsoService.SsoCookieNameParams nameParams, jakarta.servlet.http.Cookie[] cookies, RelyingParty relyingParty)
Optional<StateData>	findValidStateFromCookies(RelyingParty relyingParty, ClaimsParty claimsParty, jakarta.servlet.http.Cookie[] cookies)
Optional<StateData>	findValidStateFromCookies(RelyingParty relyingParty, ClaimsParty claimsParty, String subjectNameId, jakarta.servlet.http.Cookie[] cookies)
Optional<StateData>	findValidStateFromCookiesAndRelyingParty(RelyingParty relyingParty, jakarta.servlet.http.Cookie[] cookies)
Collection<StateData>	findValidStatesFromCookies(RelyingParty relyingParty, jakarta.servlet.http.Cookie[] cookies)
jakarta.servlet.http.Cookie	generateCookie(StateData stateData)
jakarta.servlet.http.Cookie	generateExpiredCookie(StateData stateData)
List<SsoParticipants>	getAllSsoParticipants(jakarta.servlet.http.Cookie[] cookies, String deviceId)
List<RelyingParty>	getRelyingPartiesForSamlSlo(String issuer, String referrer)
String	getSloIssuerWithFallback(String rpSloIssuer)
SsoParticipants	getSsoParticipants(SsoService.SsoCookieNameParams ssoCookieNameParams, jakarta.servlet.http.Cookie[] cookies, String deviceId)
static String	getSsoSubject(StateData stateData, ClaimsParty claimsParty)
void	handleLogoutResponse(org.opensaml.saml.saml2.core.LogoutResponse response, String relayState, jakarta.servlet.http.HttpServletRequest httpRequest)
boolean	isOidcPrincipalAllowedToJoinSsoSession(StateData ssoStateData, String userPrincipal, String oidcClientId, String oidcSessionId)
boolean	isRelyingPartyOkForSso(RelyingParty relyingParty, StateData stateData)
Optional<StateData>	logoutRelyingParty(String logoutIssuer, List<String> sessionIndexes, RelyingParty relyingParty, jakarta.servlet.http.Cookie[] cookies, SsoService.SloState logoutState)	Produce logout notifications for RP.
List<jakarta.servlet.http.Cookie>	logoutSsoParticipantById(SsoService.SsoCookieNameParams ssoCookieNameParams, jakarta.servlet.http.Cookie[] cookies, String deviceId, String participantId)
SsoService.SsoSessionOperation	prepareRedirectForDeviceInfoAfterHrd(jakarta.servlet.http.Cookie[] cookies, StateData stateDataByAuthnReq, String claimsPartyId)
SsoService.SsoSessionOperation	skipCpAuthentication(ClaimsParty claimsParty, RelyingParty relyingParty, StateData stateDataByAuthnReq, StateData ssoStateData)
boolean	ssoStateValidForDeviceInfo(ClaimsParty claimsParty, RelyingParty relyingParty, StateData ssoStateData, StateData stateDataByAuthnReq, String deviceId, String cpIssuerId)
boolean	ssoStateValidForJoin(ClaimsParty claimsParty, RelyingParty relyingParty, StateData ssoStateData, StateData stateDataByAuthnReq, String deviceId, String cpIssuerId)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SsoService

public SsoService(RelyingPartyDefinitions relyingPartyDefinitions,
 RelyingPartySetupService relyingPartySetupService,
 AuditService auditService,
 QoaMappingService qoaMappingService,
 StateCacheService stateCacheService,
 TrustBrokerProperties trustBrokerProperties,
 Clock clock)

Method Details

generateCookie

public jakarta.servlet.http.Cookie generateCookie(StateData stateData)

getSsoSubject

public static String getSsoSubject(StateData stateData,
 ClaimsParty claimsParty)

findValidStateFromCookies

public Optional<StateData> findValidStateFromCookies(RelyingParty relyingParty,
 ClaimsParty claimsParty,
 jakarta.servlet.http.Cookie[] cookies)

findValidStateFromCookiesAndRelyingParty

public Optional<StateData> findValidStateFromCookiesAndRelyingParty(RelyingParty relyingParty,
 jakarta.servlet.http.Cookie[] cookies)

findValidStateFromCookies

public Optional<StateData> findValidStateFromCookies(RelyingParty relyingParty,
 ClaimsParty claimsParty,
 String subjectNameId,
 jakarta.servlet.http.Cookie[] cookies)

findValidStatesFromCookies

public Collection<StateData> findValidStatesFromCookies(RelyingParty relyingParty,
 jakarta.servlet.http.Cookie[] cookies)

findValidStateAndCookiesToExpire

public Optional<SsoService.StateWithCookies> findValidStateAndCookiesToExpire(SsoService.SsoCookieNameParams nameParams,
 jakarta.servlet.http.Cookie[] cookies,
 RelyingParty relyingParty)

isRelyingPartyOkForSso

public boolean isRelyingPartyOkForSso(RelyingParty relyingParty,
 StateData stateData)

skipCpAuthentication

public SsoService.SsoSessionOperation skipCpAuthentication(ClaimsParty claimsParty,
 RelyingParty relyingParty,
 StateData stateDataByAuthnReq,
 StateData ssoStateData)

ssoStateValidForJoin

public boolean ssoStateValidForJoin(ClaimsParty claimsParty,
 RelyingParty relyingParty,
 StateData ssoStateData,
 StateData stateDataByAuthnReq,
 String deviceId,
 String cpIssuerId)

ssoStateValidForDeviceInfo

public boolean ssoStateValidForDeviceInfo(ClaimsParty claimsParty,
 RelyingParty relyingParty,
 StateData ssoStateData,
 StateData stateDataByAuthnReq,
 String deviceId,
 String cpIssuerId)

logoutSsoParticipantById

public List<jakarta.servlet.http.Cookie> logoutSsoParticipantById(SsoService.SsoCookieNameParams ssoCookieNameParams,
 jakarta.servlet.http.Cookie[] cookies,
 String deviceId,
 String participantId)

generateExpiredCookie

public jakarta.servlet.http.Cookie generateExpiredCookie(StateData stateData)

getSsoParticipants

public SsoParticipants getSsoParticipants(SsoService.SsoCookieNameParams ssoCookieNameParams,
 jakarta.servlet.http.Cookie[] cookies,
 String deviceId)

getAllSsoParticipants

public List<SsoParticipants> getAllSsoParticipants(jakarta.servlet.http.Cookie[] cookies,
 String deviceId)

establishImplicitSso

public void establishImplicitSso(RelyingParty relyingParty,
 ClaimsParty claimsParty,
 StateData stateData)

establishSso

public void establishSso(RelyingParty relyingParty,
 ClaimsParty claimsParty,
 StateData stateData,
 SsoGroup ssoGroup)

isOidcPrincipalAllowedToJoinSsoSession

public boolean isOidcPrincipalAllowedToJoinSsoSession(StateData ssoStateData,
 String userPrincipal,
 String oidcClientId,
 String oidcSessionId)

completeDeviceInfoPreservingStateForSso

public void completeDeviceInfoPreservingStateForSso(StateData ssoStateData,
 StateData stateDataByAuthnReq,
 RelyingParty relyingParty)

prepareRedirectForDeviceInfoAfterHrd

public SsoService.SsoSessionOperation prepareRedirectForDeviceInfoAfterHrd(jakarta.servlet.http.Cookie[] cookies,
 StateData stateDataByAuthnReq,
 String claimsPartyId)

getRelyingPartiesForSamlSlo

public List<RelyingParty> getRelyingPartiesForSamlSlo(String issuer,
 String referrer)

logoutRelyingParty

public Optional<StateData> logoutRelyingParty(String logoutIssuer,
 List<String> sessionIndexes,
 RelyingParty relyingParty,
 jakarta.servlet.http.Cookie[] cookies,
 SsoService.SloState logoutState)

Produce logout notifications for RP. The logoutState is updated accordingly.

computeSamlSingleLogoutUrl

public String computeSamlSingleLogoutUrl(String requestReferrer,
 RelyingParty relyingParty)

computeOidcSingleLogoutUrl

public String computeOidcSingleLogoutUrl(String oidcRedirectUrl,
 String requestReferrer,
 RelyingParty relyingParty)

getSloIssuerWithFallback

public String getSloIssuerWithFallback(String rpSloIssuer)

handleLogoutResponse

public void handleLogoutResponse(org.opensaml.saml.saml2.core.LogoutResponse response,
 String relayState,
 jakarta.servlet.http.HttpServletRequest httpRequest)

auditLogoutRequestFromRp

public void auditLogoutRequestFromRp(jakarta.servlet.http.HttpServletRequest httpServletRequest,
 org.opensaml.saml.saml2.core.LogoutRequest logoutRequest,
 StateData stateData,
 RelyingParty relyingParty,
 OidcAuditData oidcAuditData)

buildSloResponseParameters

public SloResponseParameters buildSloResponseParameters(RelyingParty relyingParty,
 String referer,
 Set<SsoSessionParticipant> sloNotifications,
 org.opensaml.saml.saml2.core.NameID nameId,
 String oidcSessionId,
 String oidcRedirectUrl)

Parameters:

relyingParty - configuration

referer - optional

sloNotifications - optional (else use empty set), from SSO session

nameId - optional, from CpResponse

oidcSessionId - optional, from OIDC session, null for logout initiated via SAML

oidcRedirectUrl - optional, null for logout initiated via SAML

Returns:

parameters for rendering SLO velocity template.

findValidSsoSessionForSessionIndexes

public Optional<StateData> findValidSsoSessionForSessionIndexes(List<String> sessionIndexes)