* This class is an example of an IdP authentication adapter that uses the client's (or last proxy that sent the * request) IPv4 address to identify the user. If authenticated, the user will be assigned a guest role by default. In * order to be have a corporate role, this adapter needs to be chained to another adapter via a Composite Adapter. *
** For simplicity sake, if the client has a non-loopback IPv6 address the authentication will fail. *
* This adapter is simply a sample, and in production (at a minimum) would likely be chained with another adapter to * further identify and authenticate the end user. ** This example also demonstrates how an adapter or selector that does not require user interaction can be made * API-capable. Such a plugin can operate within an Authentication API request without redirecting back to PingFederate. * It can also be invoked within a front-channel request without redirecting to a custom authentication application. *
*/ public class SampleSubnetAdapter implements IdpAuthenticationAdapterV2, AuthnApiPlugin { /** * A validator used in the adapter's configuration GUI to validate the IP addresses */ private class IPv4FieldValidator implements FieldValidator { private static final long serialVersionUID = 1L; private static final String ERROR_MESSAGE = "Not a valid IP address"; @Override public void validate(Field field) throws ValidationException { String ip = field.getValue(); try { getIpAddress(ip); } catch (Exception e) { throw new ValidationException(ERROR_MESSAGE); } } } private static final String ATTR_IP_ADDR = "ip_address"; // use the IP address to get to identify the user private static final String ATTR_ROLE = "role"; // identify the role of the user, i.e. guest, corp_user private static final String CHAINED_ATTR_USERNAME = "username"; private static final String ROLE_GUEST = "GUEST"; private static final String ROLE_CORP_USER = "CORP_USER"; private static final String CONFIG_BASE_ADDR = "Network Base Address"; private static final String CONFIG_SUBNET_MASK = "Subnet Mask"; private final IdpAuthnAdapterDescriptor descriptor; private byte[] baseAddress = null; private byte[] subnetMask = null; /** * Constructor for the Sample Subnet Adapter. Initializes the authentication adapter descriptor so PingFederate can * generate the proper configuration GUI */ public SampleSubnetAdapter() { // Create text field to represent the base network address TextFieldDescriptor baseNetworkAddressField = new TextFieldDescriptor(CONFIG_BASE_ADDR, "Enter the base IPv4 address to identify the authenticated subnet"); baseNetworkAddressField.addValidator(new IPv4FieldValidator()); baseNetworkAddressField.setDefaultValue("0.0.0.0"); // Create text field to represent the subnet mask TextFieldDescriptor subnetMaskField = new TextFieldDescriptor(CONFIG_SUBNET_MASK, "Enter the IPv4 subnet mask to identify the authenticated subnet"); subnetMaskField.addValidator(new IPv4FieldValidator()); subnetMaskField.setDefaultValue("255.255.255.0"); // Create a GUI descriptor AdapterConfigurationGuiDescriptor guiDescriptor = new AdapterConfigurationGuiDescriptor( "Set the details of the subnet to identify your SSO clients"); guiDescriptor.addField(baseNetworkAddressField); guiDescriptor.addField(subnetMaskField); // Create the Idp authentication adapter descriptor Set
* If your implementation of this method needs to operate asynchronously, it just needs to write to the
* HttpServletResponse as appropriate and commit it. Right after invoking this method the PingFederate server checks
* to see if the response has been committed. If the response has been committed, PingFederate saves the state it
* needs and discontinues processing for the current transaction. Processing of the transaction is continued when
* the user agent returns to the resumePath at the PingFederate server at which point the server
* invokes this method again. This series of events will be repeated until this method returns without committing
* the response. When that happens (which could be the first invocation) PingFederate will complete the protocol
* transaction processing with the return result of this method.
*
* Note that if the response is committed, then PingFederate ignores the return value. Only the return value of an * invocation that does not commit the response will be used. Accessing the HttpSession from the request is not * recommended and doing so is deprecated. Use {@link org.sourceid.saml20.adapter.state.SessionStateSupport} as an * alternative. *
** * Note on SOAP logout: If this logout is being invoked as the result of a back channel protocol request, the * request, response and resumePath parameters will all be null as they have no meaning in such a context where the * user agent is inaccessible. *
** In this example, no extra action is needed to logout so simply return true. *
* * @param authnIdentifiers * the map of authentication identifiers originally returned to the PingFederate server by the * {@link #lookupAuthN} method. This enables the adapter to associate a security context or session * returned by lookupAuthN with the invocation of this logout method. * @param req * the HttpServletRequest can be used to read cookies, parameters, headers, etc. It can also be used to * find out more about the request like the full URL the request was made to. * @param resp * the HttpServletResponse. The response can be used to facilitate an asynchronous interaction. Sending a * client side redirect or writing (and flushing) custom content to the response are two ways that an * invocation of this method allows for the adapter to take control of the user agent. Note that if * control of the user agent is taken in this way, then the agent must eventually be returned to the *resumePath endpoint at the PingFederate server to complete the protocol transaction.
* @param resumePath
* the relative URL that the user agent needs to return to, if the implementation of this method
* invocation needs to operate asynchronously. If this method operates synchronously, this parameter can
* be ignored. The resumePath is the full path portion of the URL - everything after hostname and port.
* If the hostname, port, or protocol are needed, they can be derived using the HttpServletRequest.
* @return a boolean indicating if the logout was successful.
* @throws AuthnAdapterException
* for any unexpected runtime problem that the implementation cannot handle.
* @throws IOException
* for any problem with I/O (typically any operation that writes to the HttpServletResponse will throw
* an IOException.
*
* @see IdpAuthenticationAdapter#logoutAuthN(Map, HttpServletRequest, HttpServletResponse, String)
*/
@SuppressWarnings("rawtypes")
public boolean logoutAuthN(Map authnIdentifiers, HttpServletRequest req, HttpServletResponse resp, String resumePath)
throws AuthnAdapterException, IOException
{
return true;
}
/**
* This method is called by the PingFederate server to push configuration values entered by the administrator via
* the dynamically rendered GUI configuration screen in the PingFederate administration console. Your implementation
* should use the {@link Configuration} parameter to configure its own internal state as needed. The tables and
* fields available in the Configuration object will correspond to the tables and fields defined on the
* {@link org.sourceid.saml20.adapter.gui.AdapterConfigurationGuiDescriptor} on the AuthnAdapterDescriptor returned
* by the {@link #getAdapterDescriptor()} method of this class. * In this example the method not used, return null *
* * @return a map */ public Map
* If your implementation of this method needs to operate asynchronously, it just needs to write to the
* HttpServletResponse as appropriate and commit it. Right after invoking this method the PingFederate server checks
* to see if the response has been committed. If the response has been committed, PingFederate saves the state it
* needs and discontinues processing for the current transaction. Processing of the transaction is continued when
* the user agent returns to the resumePath at the PingFederate server at which point the server
* invokes this method again. This series of events will be repeated until this method returns without committing
* the response. When that happens (which could be the first invocation) PingFederate will complete the protocol
* transaction processing with the return result of this method.
*
* Note that if the response is committed, then PingFederate ignores the return value. Only the return value of an * invocation that does not commit the response will be used. *
*
* If this adapter is implemented asynchronously, it's recommended that the user agent always returns to the
* resumePath in order to be compatible with Composite Adapter's "Sufficent" adapter chaining policy. The
* Composite Adapter allows an Administrator to "chain" a selection of available adapter instances for a connection.
* At runtime, adapter chaining means that SSO requests are passed sequentially through each adapter instance
* specified until one or more authentication results are found for the user. If the user agent does not return
* control to PingFederate for failed authentication scenarios, then the authentication chain will break and should
* not be used with Composite Adapter's "Sufficient" chaining policy.
*
* In this example, we determine if the client (or the last proxy) is on the configured subnet. If the client has an * IPv6 address that's not ::1, fail immediately. If the user was previously authenticated by another adapter assign * it a corporate role, otherwise use the guest role. *
* * @param req * the HttpServletRequest can be used to read cookies, parameters, headers, etc. It can also be used to * find out more about the request like the full URL the request was made to. Accessing the HttpSession * from the request is not recommended and doing so is deprecated. Use * {@link org.sourceid.saml20.adapter.state.SessionStateSupport} as an alternative. * @param resp * the HttpServletResponse. The response can be used to facilitate an asynchronous interaction. Sending a * client side redirect or writing (and flushing) custom content to the response are two ways that an * invocation of this method allows for the adapter to take control of the user agent. Note that if * control of the user agent is taken in this way, then the agent must eventually be returned to the *resumePath endpoint at the PingFederate server to complete the protocol transaction.
* @param inParameters
* A map that contains a set of input parameters. The input parameters provided are detailed in
* {@link IdpAuthenticationAdapterV2}, prefixed with IN_PARAMETER_NAME_* i.e.
* {@link IdpAuthenticationAdapterV2#IN_PARAMETER_NAME_RESUME_PATH}.
* @return {@link AuthnAdapterResponse} The return value should not be null.
* @throws AuthnAdapterException
* for any unexpected runtime problem that the implementation cannot handle.
* @throws IOException
* for any problem with I/O (typically any operation that writes to the HttpServletResponse).
*/
@SuppressWarnings("unchecked")
public AuthnAdapterResponse lookupAuthN(HttpServletRequest req, HttpServletResponse resp,
Map