Module org.elasticsearch.security

Package org.elasticsearch.xpack.security.authc.saml

Class SamlRealm

java.lang.Object

org.elasticsearch.xpack.core.security.authc.Realm

org.elasticsearch.xpack.security.authc.saml.SamlRealm

All Implemented Interfaces:

Closeable, AutoCloseable, Comparable<Realm>, Releasable

public final class SamlRealm
extends Realm
implements Releasable

This class is Releasable because it uses a library that thinks timers and timer tasks are still cool and no chance to opt out

Nested Class Summary

Nested classes/interfaces inherited from class org.elasticsearch.xpack.core.security.authc.Realm

Realm.Factory

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CONTEXT_TOKEN_DATA
static final String	PRIVATE_ATTRIBUTES_METADATA
static final String	TOKEN_METADATA_IN_RESPONSE_TO
static final String	TOKEN_METADATA_NAMEID_FORMAT
static final String	TOKEN_METADATA_NAMEID_QUALIFIER
static final String	TOKEN_METADATA_NAMEID_SP_PROVIDED_ID
static final String	TOKEN_METADATA_NAMEID_SP_QUALIFIER
static final String	TOKEN_METADATA_NAMEID_VALUE
static final String	TOKEN_METADATA_REALM
static final String	TOKEN_METADATA_SESSION
static final String	USER_METADATA_NAMEID_FORMAT
static final String	USER_METADATA_NAMEID_VALUE

Fields inherited from class org.elasticsearch.xpack.core.security.authc.Realm

config

Method Summary

Modifier and Type	Method	Description
String	assertionConsumerServiceURL()
void	authenticate(AuthenticationToken authenticationToken, ActionListener<AuthenticationResult<User>> listener)
org.opensaml.saml.saml2.core.AuthnRequest	buildAuthenticationRequest()
static List<org.opensaml.security.x509.X509Credential>	buildEncryptionCredential(RealmConfig config)
org.opensaml.saml.saml2.core.LogoutRequest	buildLogoutRequest(org.opensaml.saml.saml2.core.NameID nameId, String session)	Creates a SAML Single LogOut request for the provided session, if the realm and IdP configuration support SLO.
org.opensaml.saml.saml2.core.LogoutResponse	buildLogoutResponse(String inResponseTo)	Creates a SAML LogoutResponse to the provided requestID
static SigningConfiguration	buildSigningConfiguration(RealmConfig config)
void	close()
static SamlRealm	create(RealmConfig config, ThreadPool threadPool, SSLService sslService, ResourceWatcherService watcherService, UserRoleMapper roleMapper, SpConfiguration serviceProvider)	Factory for SAML realm.
Map<String,Object>	createTokenMetadata(SamlNameId nameId, String session, String inResponseTo)
static List<SamlRealm>	findSamlRealms(Realms realms, String realmName, String acsUrl)
SamlLogoutRequestHandler	getLogoutHandler()
SamlLogoutResponseHandler	getLogoutResponseHandler()
SpConfiguration	getServiceProvider()
SigningConfiguration	getSigningConfiguration()
void	initialize(Iterable<Realm> realms, XPackLicenseState licenseState)
void	lookupUser(String username, ActionListener<User> listener)
String	serviceProviderEntityId()
boolean	supports(AuthenticationToken token)
AuthenticationToken	token(ThreadContext threadContext)	Always returns null as there is no support for reading a SAML token out of a request

Methods inherited from class org.elasticsearch.xpack.core.security.authc.Realm

compareTo, getAuthenticationFailureHeaders, name, order, realmRef, setRealmRef, toString, type, usageStats

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Details

USER_METADATA_NAMEID_VALUE

public static final String USER_METADATA_NAMEID_VALUE

See Also:

• Constant Field Values

USER_METADATA_NAMEID_FORMAT

public static final String USER_METADATA_NAMEID_FORMAT

See Also:

• Constant Field Values

CONTEXT_TOKEN_DATA

public static final String CONTEXT_TOKEN_DATA

See Also:

• Constant Field Values

TOKEN_METADATA_NAMEID_VALUE

public static final String TOKEN_METADATA_NAMEID_VALUE

See Also:

• Constant Field Values

TOKEN_METADATA_NAMEID_FORMAT

public static final String TOKEN_METADATA_NAMEID_FORMAT

See Also:

• Constant Field Values

TOKEN_METADATA_NAMEID_QUALIFIER

public static final String TOKEN_METADATA_NAMEID_QUALIFIER

See Also:

• Constant Field Values

TOKEN_METADATA_NAMEID_SP_QUALIFIER

public static final String TOKEN_METADATA_NAMEID_SP_QUALIFIER

See Also:

• Constant Field Values

TOKEN_METADATA_NAMEID_SP_PROVIDED_ID

public static final String TOKEN_METADATA_NAMEID_SP_PROVIDED_ID

See Also:

• Constant Field Values

TOKEN_METADATA_SESSION

public static final String TOKEN_METADATA_SESSION

See Also:

• Constant Field Values

TOKEN_METADATA_IN_RESPONSE_TO

public static final String TOKEN_METADATA_IN_RESPONSE_TO

See Also:

• Constant Field Values

TOKEN_METADATA_REALM

public static final String TOKEN_METADATA_REALM

See Also:

• Constant Field Values

PRIVATE_ATTRIBUTES_METADATA

public static final String PRIVATE_ATTRIBUTES_METADATA

See Also:

• Constant Field Values

Method Details

create

public static SamlRealm create(RealmConfig config,
 ThreadPool threadPool,
 SSLService sslService,
 ResourceWatcherService watcherService,
 UserRoleMapper roleMapper,
 SpConfiguration serviceProvider)
                        throws Exception

Factory for SAML realm. This is not a constructor as it needs to initialise a number of components before delegating to SamlRealm(org.elasticsearch.xpack.core.security.authc.RealmConfig, org.elasticsearch.xpack.core.security.authc.support.UserRoleMapper, org.elasticsearch.xpack.security.authc.saml.SamlAuthenticator, org.elasticsearch.xpack.security.authc.saml.SamlLogoutRequestHandler, org.elasticsearch.xpack.security.authc.saml.SamlLogoutResponseHandler, java.util.function.Supplier<org.opensaml.saml.saml2.metadata.EntityDescriptor>, org.elasticsearch.xpack.security.authc.saml.SpConfiguration, org.elasticsearch.xpack.core.security.authc.saml.SamlRealmSettings.UserAttributeNameConfiguration)

Throws:

Exception

getServiceProvider

public SpConfiguration getServiceProvider()

initialize

public void initialize(Iterable<Realm> realms,
 XPackLicenseState licenseState)

Overrides:

initialize in class Realm

buildEncryptionCredential

public static List<org.opensaml.security.x509.X509Credential> buildEncryptionCredential(RealmConfig config)
                                                                                 throws IOException,
GeneralSecurityException

Throws:

IOException

GeneralSecurityException

buildSigningConfiguration

public static SigningConfiguration buildSigningConfiguration(RealmConfig config)
                                                      throws IOException,
GeneralSecurityException

Throws:

IOException

GeneralSecurityException

findSamlRealms

public static List<SamlRealm> findSamlRealms(Realms realms,
 String realmName,
 String acsUrl)

supports

public boolean supports(AuthenticationToken token)

Specified by:

supports in class Realm

token

public AuthenticationToken token(ThreadContext threadContext)

Always returns null as there is no support for reading a SAML token out of a request

Specified by:

token in class Realm

See Also:

• TransportSamlAuthenticateAction

authenticate

public void authenticate(AuthenticationToken authenticationToken,
 ActionListener<AuthenticationResult<User>> listener)

Specified by:

authenticate in class Realm

createTokenMetadata

public Map<String,Object> createTokenMetadata(@Nullable
 SamlNameId nameId,
 String session,
 @Nullable
 String inResponseTo)

lookupUser

public void lookupUser(String username,
 ActionListener<User> listener)

Specified by:

lookupUser in class Realm

close

public void close()

Specified by:

close in interface AutoCloseable

Specified by:

close in interface Closeable

Specified by:

close in interface Releasable

serviceProviderEntityId

public String serviceProviderEntityId()

assertionConsumerServiceURL

public String assertionConsumerServiceURL()

buildAuthenticationRequest

public org.opensaml.saml.saml2.core.AuthnRequest buildAuthenticationRequest()

buildLogoutRequest

public org.opensaml.saml.saml2.core.LogoutRequest buildLogoutRequest(org.opensaml.saml.saml2.core.NameID nameId,
 String session)

Creates a SAML Single LogOut request for the provided session, if the realm and IdP configuration support SLO. Otherwise returns null

See Also:

• SamlRealmSettings.IDP_SINGLE_LOGOUT

buildLogoutResponse

public org.opensaml.saml.saml2.core.LogoutResponse buildLogoutResponse(String inResponseTo)

Creates a SAML LogoutResponse to the provided requestID

getSigningConfiguration

public SigningConfiguration getSigningConfiguration()

getLogoutHandler

public SamlLogoutRequestHandler getLogoutHandler()

getLogoutResponseHandler

public SamlLogoutResponseHandler getLogoutResponseHandler()