@ThreadSafe public class OneTimeUseConditionValidator extends Object implements ConditionValidator
ConditionValidator
used for OneTimeUse
conditions.
Supports the following ValidationContext
static parameters:
SAML2AssertionValidationParameters.COND_ONE_TIME_USE_EXPIRES
:
Optional. If not supplied, defaults to the validator-wide value supplied at construction, or
the default value, as retrieved via getReplayCacheExpires()
.
Supports the following ValidationContext
dynamic parameters:
Modifier and Type | Field and Description |
---|---|
static String |
CACHE_CONTEXT
Cache context name.
|
static Long |
DEFAULT_CACHE_EXPIRES
Default cache expiration time: 8 hours.
|
private org.slf4j.Logger |
log
Logger.
|
private ReplayCache |
replayCache
Replay cache used to track which assertions have been used.
|
private Long |
replayCacheExpires
Time (in milliseconds since beginning of epoch) for disposal of value from cache.
|
Constructor and Description |
---|
OneTimeUseConditionValidator(ReplayCache replay,
Long expires)
Constructor.
|
Modifier and Type | Method and Description |
---|---|
protected String |
getCacheValue(Assertion assertion)
Get the string value which will be tracked in the cache for purposes of one-time use detection.
|
protected long |
getExpires(Assertion assertion,
ValidationContext context)
Get the one-time use expiration time for the assertion being evaluated.
|
protected Long |
getReplayCacheExpires()
Get the configured validator cache expiration interval, in milliseconds.
|
QName |
getServicedCondition() |
ValidationResult |
validate(Condition condition,
Assertion assertion,
ValidationContext context) |
public static final String CACHE_CONTEXT
public static final Long DEFAULT_CACHE_EXPIRES
private org.slf4j.Logger log
private ReplayCache replayCache
private Long replayCacheExpires
public OneTimeUseConditionValidator(@Nonnull ReplayCache replay, @Nullable Long expires)
replay
- reply cache used to track which assertions have been usedexpires
- time (in milliseconds since beginning of epoch) for disposal of tracked
assertion from the replay cache. May be null, then defaults to
DEFAULT_CACHE_EXPIRES
.@Nonnull public QName getServicedCondition()
getServicedCondition
in interface ConditionValidator
@Nonnull public ValidationResult validate(@Nonnull Condition condition, @Nonnull Assertion assertion, @Nonnull ValidationContext context) throws AssertionValidationException
validate
in interface ConditionValidator
AssertionValidationException
@Nonnull protected Long getReplayCacheExpires()
protected long getExpires(Assertion assertion, ValidationContext context)
Defaults to System.currentTimeMillis() + getReplayCacheExpires()
.
A subclass might override this to base expiration on data from the assertion or the validation context.
assertion
- the SAML 2 Assertion being evaluatedcontext
- the current validation context@Nonnull protected String getCacheValue(@Nonnull Assertion assertion) throws AssertionValidationException
assertion
- the SAML 2 Assertion to evaluateAssertionValidationException
- thrown if there is a problem calculating the cached valueCopyright © 1999–2020 Shibboleth Consortium. All rights reserved.