Package org.apache.juneau.rest.server.auth.saml

Class SamlAssertionValidator.Builder

java.lang.Object
org.apache.juneau.rest.server.auth.saml.SamlAssertionValidator.Builder
Enclosing class:
SamlAssertionValidator
public static class SamlAssertionValidator.Builder extends Object
Builder for SamlAssertionValidator.

  • Constructor Details

    • Builder

      protected Builder()
      Constructor.

  • Method Details

    • metadataResolver

      public SamlAssertionValidator.Builder metadataResolver(org.opensaml.saml.metadata.resolver.MetadataResolver value)
      Sets the MetadataResolver used to resolve the IdP's signing credential at validation time.

      Mutually exclusive with signingCredential(Credential).

      Parameters:
      value - The metadata resolver. Must not be null.
      Returns:
      This object.

    • signingCredential

      public SamlAssertionValidator.Builder signingCredential(org.opensaml.security.credential.Credential value)
      Sets a static IdP signing credential. Useful when metadata is not available.

      Mutually exclusive with metadataResolver(MetadataResolver).

      Parameters:
      value - The IdP signing credential. Must not be null.
      Returns:
      This object.

    • decryptionCredential

      public SamlAssertionValidator.Builder decryptionCredential(org.opensaml.security.credential.Credential value)
      Sets the credential used to decrypt <EncryptedAssertion> elements.

      If the response contains encrypted assertions and no decryption credential is configured, validation fails with AuthenticationException.

      Parameters:
      value - The SP decryption credential. Must not be null.
      Returns:
      This object.

    • spEntityId

      public SamlAssertionValidator.Builder spEntityId(String value)
      Sets the Service Provider entity ID used to validate <AudienceRestriction>.
      Parameters:
      value - The SP entity ID. Must not be null or blank.
      Returns:
      This object.

    • expectedIssuer

      public SamlAssertionValidator.Builder expectedIssuer(String value)
      Sets the expected IdP issuer (the <Issuer> element). Required.
      Parameters:
      value - The expected IdP entity ID. Must not be null or blank.
      Returns:
      This object.

    • algorithms

      public SamlAssertionValidator.Builder algorithms(String... values)
      Replaces the default signature-algorithm allowlist with the supplied URIs.

      SHA-1 algorithms are silently filtered out (permanent rejection).

      Parameters:
      values - The XML-DSig algorithm URIs to allow. Must contain at least one non-SHA-1 entry.
      Returns:
      This object.

    • digestAlgorithms

      public SamlAssertionValidator.Builder digestAlgorithms(String... values)
      Replaces the default reference-digest allowlist with the supplied URIs.

      The reference DigestMethod of the enveloped signature must appear in this set. SHA-1 algorithms are silently filtered out (permanent rejection), mirroring algorithms(String...).

      Parameters:
      values - The XML-DSig digest algorithm URIs to allow. Must contain at least one non-SHA-1 entry.
      Returns:
      This object.

    • recipient

      public SamlAssertionValidator.Builder recipient(String value)
      Sets the expected Recipient (this SP's Assertion Consumer Service URL) and, by doing so, enables bearer <SubjectConfirmation> validation.

      When set, every validated assertion must carry a bearer <SubjectConfirmation> whose <SubjectConfirmationData> names this exact Recipient, is within its NotBefore/NotOnOrAfter window, and satisfies the expectedInResponseTo(String) / subjectAddress(String) expectations. When left unset (the default), subject-confirmation validation is skipped for calls to SamlAssertionValidator.validate(String) — safe only for assertion-only / non-browser callers. A validator reached through SamlAuthFilter enforces bearer confirmation regardless of this setting, since the filter derives the recipient from the request and calls SamlAssertionValidator.validate(String, String).

      Parameters:
      value - The expected ACS URL. Must not be null or blank.
      Returns:
      This object.

    • expectedInResponseTo

      public SamlAssertionValidator.Builder expectedInResponseTo(String value)
      Sets the request ID a bearer <SubjectConfirmationData> must echo in its InResponseTo attribute.

      Only consulted when recipient(String) is configured. When set, the confirmation's InResponseTo must equal this value (a solicited, SP-initiated flow). When left unset (the default), the confirmation must not carry an InResponseTo at all (an unsolicited, IdP-initiated flow) — a captured solicited assertion cannot be injected into the unsolicited path.

      Parameters:
      value - The expected request ID. Must not be null or blank.
      Returns:
      This object.

    • subjectAddress

      public SamlAssertionValidator.Builder subjectAddress(String value)
      Sets the client address a bearer <SubjectConfirmationData> must name in its Address attribute.

      Only consulted when recipient(String) is configured. When set, the confirmation's Address must equal this value; when unset (the default) the Address attribute is not checked.

      Parameters:
      value - The expected client address. Must not be null or blank.
      Returns:
      This object.

    • replayCache

      public SamlAssertionValidator.Builder replayCache(ReplayCache value)
      Overrides the ReplayCache used to enforce one-time use of each assertion ID.

      Defaults to a per-process InMemoryReplayCache, which enforces single-use within one JVM. Multi-node deployments should inject a ReplayCache backed by a store shared across every node so an assertion consumed against one node cannot be replayed against another. The check is always fail-closed: a cache that cannot answer causes the assertion to be rejected.

      Parameters:
      value - The replay cache. Must not be null.
      Returns:
      This object.

    • clockSkew

      public SamlAssertionValidator.Builder clockSkew(Duration value)
      Sets the clock-skew tolerance for NotBefore / NotOnOrAfter validation.
      Parameters:
      value - The tolerance. Must be non-negative and not exceed 5 minutes.
      Returns:
      This object.

    • clock

      public SamlAssertionValidator.Builder clock(Clock value)
      Overrides the Clock used for timestamp validation. Useful in tests.
      Parameters:
      value - The clock. Must not be null.
      Returns:
      This object.

    • build

      public SamlAssertionValidator build()
      Builds the validator.
      Returns:
      A new SamlAssertionValidator.