Package io.deephaven.enterprise.samlauth

Class SAMLAuthModule

java.lang.Object
io.deephaven.enterprise.samlauth.SAMLAuthModule
All Implemented Interfaces:
AuthModule
public class SAMLAuthModule extends Object implements AuthModule
A server-side authentication module which permits external SAML-based authentication to grant access to the system

  • Constructor Details

    • SAMLAuthModule

      public SAMLAuthModule(com.fishlib.io.logger.Logger log, LocalAuthenticationServer localAuthenticationServer) throws Exception
      Create an instance of this class, including the embedded jetty instance
      Parameters:
      log - the logger to use.
      localAuthenticationServer - the local authentication server, if any
      Throws:
      Exception - if any error preventing startup

  • Method Details

    • getSamlOnLogonUrl

      public static String getSamlOnLogonUrl(jakarta.servlet.http.HttpServletRequest request)

    • getSamlDoLoginPath

      public static String getSamlDoLoginPath()

    • getSamlOnLoginPath

      public static String getSamlOnLoginPath()

    • getExpiration

      public static long getExpiration()

    • getSessionTimeout

      public static int getSessionTimeout()

    • getIdPrefix

      public static String getIdPrefix()

    • getForceAuthn

      public static boolean getForceAuthn()

    • getIsPassive

      public static boolean getIsPassive()

    • getSetNameIdPolicy

      public static boolean getSetNameIdPolicy()

    • main

      public static void main(String[] args) throws Exception
      Testing utility - run a standalone SAMLAuthModule and print out registered (success and fail) AuthEntry objects
      Parameters:
      args - Ignored
      Throws:
      Exception - if any error during run

    • stopServer

      public void stopServer()
      Stop the embedded jetty server

    • getSaml2Settings

      public com.onelogin.saml2.settings.Saml2Settings getSaml2Settings()
      Returns a number of pre-defined Properties used to determine the behavior of our onelogin-toolkit instances
      Returns:
      a valid onelogin Saml2Settings object used to identify saml properties

    • mayRedirectTo

      public boolean mayRedirectTo(String redirectUrl) throws URISyntaxException
      Used to ensure that a client-requested redirect-URL is permitted by configuration
      Parameters:
      redirectUrl - URL to which the client has requested redirection upon completion of the authentication cycle
      Returns:
      true if the client-requested redirectUrl is permitted by configuration, else false
      Throws:
      URISyntaxException - if there is any error parsing the input string

    • addKnownRequest

      public void addKnownRequest(@NotNull @NotNull String requestId, @NotNull @NotNull String nonce)
      Keep a map of nonce->requestId for the life of this process. It is highly unlikely that a duplicated nonce is legitimately created by the client-side process, so we use this to identify and prevent replay-attack attempts

      In the unlikely scenario that a nonce is legitimately duplicated, the client-login attempt will fail, at which point they may try again (with a new nonce)

      Parameters:
      requestId - the request-id associated with nonce; we will only accept a response from the IdP for this specific ID to match the given nonce
      nonce - a one-time-use key that we will register. Any attempt to register this key again will result in an exception

    • checkKnownRequest

      public void checkKnownRequest(@NotNull @NotNull String requestId, @NotNull @NotNull String nonce)
      Upon IdP response, we use this method to verify that the nonce->requestId map has been declared in advance. This should mitigate replay-attack attempts, and ensure that the front-end request is tied to a single saml request
      Parameters:
      requestId - the request-id associated with nonce
      nonce - the one-time-use key which we will use to verify against the requestId for sanity

    • addNewKey

      public void addNewKey(long expireTime, String userName, @NotNull @NotNull String nonce)
      Add the user-provided nonce to the authEntries map as a successful entry. This will permit the client's authentication-request to be successful
      Parameters:
      expireTime - the time, in milliseconds, when this key becomes invalid
      userName - the authenticated user-name
      nonce - the user-supplied key which will tie the eventual authentication-request to the saml-request

    • failNewKey

      public void failNewKey(@NotNull @NotNull String nonce)
      Add the user-provided nonce to the authEntries map as a failed entry. This allows the server to respond back to the front-end with a rejection instead of waiting for the natural timeout
      Parameters:
      nonce - the user-supplied key which will tie the eventual authentication-request to the saml-request

    • getNameFromExternal

      public String getNameFromExternal(String nonce)
      This method is called by the auth-server when the front-end authentication-request is received. In the case that the saml-request is completed successfully, this method will return the IdP-provided iris-name back to the main server for further authentication (userExists)
      Specified by:
      getNameFromExternal in interface AuthModule
      Parameters:
      nonce - the user-supplied key in the authentication-request
      Returns:
      the IdP-provided iris-name on success, else null

    • userExists

      public boolean userExists(String username)
      Only used by this module when group synchronization is enabled. Otherwise, this module returns false and user existence is determined by the rest of the logic in AuthenticationServerBase.userExists(java.lang.String) (i.e., everything that method does except calling SAMLAuthModule#userExists -- such as calling userExists() from other auth modules.
      Specified by:
      userExists in interface AuthModule
      Parameters:
      username - The username whose existence should be verified.
      Returns:
      false if groupProvider is null (i.e., if group synchronization is disabled). Otherwise, returns true if the groups list for username includes a group named username itself. (In other words, it makes sure that the user is a member of "their own group".

    • isUserPassValid

      public boolean isUserPassValid(String username, String password)
      Not used by this module; return false
      Specified by:
      isUserPassValid in interface AuthModule
      Parameters:
      username - not used
      password - not used
      Returns:
      always false