public final class CentralAuthenticationServiceImpl extends Object implements CentralAuthenticationService
This class is threadsafe.
This class has the following properties that must be set:
ticketRegistry - The Ticket Registry to maintain the list
of available tickets.serviceTicketRegistry - Provides an alternative to configure separate registries for
TGTs and ST in order to store them in different locations (i.e. long term memory or short-term)authenticationManager - The service that will handle
authentication.ticketGrantingTicketUniqueTicketIdGenerator - Plug in to
generate unique secure ids for TicketGrantingTickets.serviceTicketUniqueTicketIdGenerator - Plug in to
generate unique secure ids for ServiceTickets.ticketGrantingTicketExpirationPolicy - The expiration
policy for TicketGrantingTickets.serviceTicketExpirationPolicy - The expiration policy for
ServiceTickets.| Constructor and Description |
|---|
CentralAuthenticationServiceImpl(TicketRegistry ticketRegistry,
TicketRegistry serviceTicketRegistry,
AuthenticationManager authenticationManager,
UniqueTicketIdGenerator ticketGrantingTicketUniqueTicketIdGenerator,
Map<String,UniqueTicketIdGenerator> uniqueTicketIdGeneratorsForService,
ExpirationPolicy ticketGrantingTicketExpirationPolicy,
ExpirationPolicy serviceTicketExpirationPolicy,
ServicesManager servicesManager,
LogoutManager logoutManager)
Build the central authentication service implementation.
|
| Modifier and Type | Method and Description |
|---|---|
String |
createTicketGrantingTicket(Credential... credentials)
Create a
TicketGrantingTicket by authenticating credentials. |
String |
delegateTicketGrantingTicket(String serviceTicketId,
Credential... credentials)
Delegate a TicketGrantingTicket to a Service for proxying authentication
to other Services.
|
List<LogoutRequest> |
destroyTicketGrantingTicket(String ticketGrantingTicketId)
Destroy a TicketGrantingTicket and perform back channel logout.
|
String |
grantServiceTicket(String ticketGrantingTicketId,
Service service)
Grants a
ServiceTicket that may be used to access the given service. |
String |
grantServiceTicket(String ticketGrantingTicketId,
Service service,
Credential... credentials)
Grant a
ServiceTicket that may be used to access the given service
by authenticating the given credentials. |
void |
setPersistentIdGenerator(PersistentIdGenerator persistentIdGenerator) |
void |
setServiceContextAuthenticationPolicyFactory(ContextualAuthenticationPolicyFactory<ServiceContext> policy) |
void |
setServiceTicketExpirationPolicy(ExpirationPolicy serviceTicketExpirationPolicy) |
void |
setTicketGrantingTicketExpirationPolicy(ExpirationPolicy ticketGrantingTicketExpirationPolicy) |
Assertion |
validateServiceTicket(String serviceTicketId,
Service service)
Validate a ServiceTicket for a particular Service.
|
public CentralAuthenticationServiceImpl(TicketRegistry ticketRegistry, TicketRegistry serviceTicketRegistry, AuthenticationManager authenticationManager, UniqueTicketIdGenerator ticketGrantingTicketUniqueTicketIdGenerator, Map<String,UniqueTicketIdGenerator> uniqueTicketIdGeneratorsForService, ExpirationPolicy ticketGrantingTicketExpirationPolicy, ExpirationPolicy serviceTicketExpirationPolicy, ServicesManager servicesManager, LogoutManager logoutManager)
ticketRegistry - the tickets registry.serviceTicketRegistry - the service tickets registry.authenticationManager - the authentication manager.ticketGrantingTicketUniqueTicketIdGenerator - the TGT id generator.uniqueTicketIdGeneratorsForService - the map with service and ticket id generators.ticketGrantingTicketExpirationPolicy - the TGT expiration policy.serviceTicketExpirationPolicy - the service ticket expiration policy.servicesManager - the services manager.logoutManager - the logout manager.@Transactional(readOnly=false) public List<LogoutRequest> destroyTicketGrantingTicket(String ticketGrantingTicketId)
IllegalArgumentException if the TicketGrantingTicket ID is null.
Destroy a TicketGrantingTicket and perform back channel logout. This has the effect of invalidating any
Ticket that was derived from the TicketGrantingTicket being destroyed. May throw an
IllegalArgumentException if the TicketGrantingTicket ID is null.destroyTicketGrantingTicket in interface CentralAuthenticationServiceticketGrantingTicketId - the id of the ticket we want to destroy@Transactional(readOnly=false) public String grantServiceTicket(String ticketGrantingTicketId, Service service, Credential... credentials) throws AuthenticationException, TicketException
CentralAuthenticationServiceServiceTicket that may be used to access the given service
by authenticating the given credentials.
The details of the security policy around credential authentication and the definition
of authentication success are dependent on the implementation, but it SHOULD be safe to assume
that at least one credential MUST be authenticated for ticket creation to succeed.
The principal that is resolved from the authenticated credentials MUST be the same as that to which the given ticket-granting ticket was issued.
grantServiceTicket in interface CentralAuthenticationServiceticketGrantingTicketId - Proof of prior authentication.service - The target service of the ServiceTicket.credentials - One or more credentials to authenticate prior to granting the service ticket.IllegalArgumentException - if ticketGrantingTicketId or service are null.AuthenticationException - on errors authenticating the credentialsTicketException - if the ticket could not be created.@Transactional(readOnly=false) public String grantServiceTicket(String ticketGrantingTicketId, Service service) throws TicketException
CentralAuthenticationServiceServiceTicket that may be used to access the given service.grantServiceTicket in interface CentralAuthenticationServiceticketGrantingTicketId - Proof of prior authentication.service - The target service of the ServiceTicket.TicketException - if the ticket could not be created.@Transactional(readOnly=false) public String delegateTicketGrantingTicket(String serviceTicketId, Credential... credentials) throws AuthenticationException, TicketException
CentralAuthenticationServicedelegateTicketGrantingTicket in interface CentralAuthenticationServiceserviceTicketId - The service ticket identifier that will delegate to a
TicketGrantingTicket.credentials - One or more credentials to authenticate prior to delegating the ticket.ServiceTicket
that proxy authentication.IllegalArgumentException - if the ServiceTicketId or the
Credential are null.AuthenticationException - on errors authenticating the credentialsTicketException - if there was an error creating the ticket@Transactional(readOnly=false) public Assertion validateServiceTicket(String serviceTicketId, Service service) throws TicketException
CentralAuthenticationServicevalidateServiceTicket in interface CentralAuthenticationServiceserviceTicketId - Proof of prior authentication.service - Service wishing to validate a prior authentication.IllegalArgumentException - if the ServiceTicketId or the Service
are null.TicketException - if there was an error validating the ticket.@Transactional(readOnly=false) public String createTicketGrantingTicket(Credential... credentials) throws AuthenticationException, TicketException
CentralAuthenticationServiceTicketGrantingTicket by authenticating credentials.
The details of the security policy around credential authentication and the definition
of authentication success are dependent on the implementation, but it SHOULD be safe to assume
that at least one credential MUST be authenticated for ticket creation to succeed.createTicketGrantingTicket in interface CentralAuthenticationServicecredentials - One or more credentials that may be authenticated in order to create the ticket.IllegalArgumentException - if the credentials are null.AuthenticationException - on errors authenticating the credentialsTicketException - if ticket cannot be createdpublic void setPersistentIdGenerator(PersistentIdGenerator persistentIdGenerator)
public void setServiceContextAuthenticationPolicyFactory(ContextualAuthenticationPolicyFactory<ServiceContext> policy)
public void setTicketGrantingTicketExpirationPolicy(ExpirationPolicy ticketGrantingTicketExpirationPolicy)
ticketGrantingTicketExpirationPolicy - a TGT expiration policy.public void setServiceTicketExpirationPolicy(ExpirationPolicy serviceTicketExpirationPolicy)
serviceTicketExpirationPolicy - a ST expiration policy.Copyright © 2004-2015 Apereo. All Rights Reserved.