Package org.elasticsearch.xpack.security.authc.saml

Class SamlRealm

java.lang.Object

org.elasticsearch.xpack.core.security.authc.Realm

org.elasticsearch.xpack.security.authc.saml.SamlRealm

All Implemented Interfaces:

Closeable, AutoCloseable, Comparable<org.elasticsearch.xpack.core.security.authc.Realm>, org.elasticsearch.core.Releasable

public final class SamlRealm
extends org.elasticsearch.xpack.core.security.authc.Realm
implements org.elasticsearch.core.Releasable

This class is Releasable because it uses a library that thinks timers and timer tasks are still cool and no chance to opt out

Nested Class Summary

Nested classes/interfaces inherited from class org.elasticsearch.xpack.core.security.authc.Realm

org.elasticsearch.xpack.core.security.authc.Realm.Factory

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CONTEXT_TOKEN_DATA
static final String	TOKEN_METADATA_NAMEID_FORMAT
static final String	TOKEN_METADATA_NAMEID_QUALIFIER
static final String	TOKEN_METADATA_NAMEID_SP_PROVIDED_ID
static final String	TOKEN_METADATA_NAMEID_SP_QUALIFIER
static final String	TOKEN_METADATA_NAMEID_VALUE
static final String	TOKEN_METADATA_REALM
static final String	TOKEN_METADATA_SESSION
static final String	USER_METADATA_NAMEID_FORMAT
static final String	USER_METADATA_NAMEID_VALUE

Fields inherited from class org.elasticsearch.xpack.core.security.authc.Realm

config

Method Summary

Modifier and Type	Method	Description
String	assertionConsumerServiceURL()
void	authenticate(org.elasticsearch.xpack.core.security.authc.AuthenticationToken authenticationToken, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.AuthenticationResult<org.elasticsearch.xpack.core.security.user.User>> listener)
org.opensaml.saml.saml2.core.AuthnRequest	buildAuthenticationRequest()
org.opensaml.saml.saml2.core.LogoutRequest	buildLogoutRequest(org.opensaml.saml.saml2.core.NameID nameId, String session)	Creates a SAML Single LogOut request for the provided session, if the realm and IdP configuration support SLO.
org.opensaml.saml.saml2.core.LogoutResponse	buildLogoutResponse(String inResponseTo)	Creates a SAML LogoutResponse to the provided requestID
void	close()
static SamlRealm	create(org.elasticsearch.xpack.core.security.authc.RealmConfig config, org.elasticsearch.xpack.core.ssl.SSLService sslService, org.elasticsearch.watcher.ResourceWatcherService watcherService, org.elasticsearch.xpack.core.security.authc.support.UserRoleMapper roleMapper)	Factory for SAML realm.
Map<String,Object>	createTokenMetadata(SamlNameId nameId, String session)
static List<SamlRealm>	findSamlRealms(Realms realms, String realmName, String acsUrl)
SamlLogoutRequestHandler	getLogoutHandler()
SamlLogoutResponseHandler	getLogoutResponseHandler()
SpConfiguration	getServiceProvider()
SigningConfiguration	getSigningConfiguration()
void	initialize(Iterable<org.elasticsearch.xpack.core.security.authc.Realm> realms, org.elasticsearch.license.XPackLicenseState licenseState)
void	lookupUser(String username, org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.user.User> listener)
String	serviceProviderEntityId()
boolean	supports(org.elasticsearch.xpack.core.security.authc.AuthenticationToken token)
org.elasticsearch.xpack.core.security.authc.AuthenticationToken	token(org.elasticsearch.common.util.concurrent.ThreadContext threadContext)	Always returns null as there is no support for reading a SAML token out of a request

Methods inherited from class org.elasticsearch.xpack.core.security.authc.Realm

compareTo, domain, getAuthenticationFailureHeaders, name, order, toString, type, usageStats

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Details

USER_METADATA_NAMEID_VALUE

public static final String USER_METADATA_NAMEID_VALUE

See Also:

• Constant Field Values

USER_METADATA_NAMEID_FORMAT

public static final String USER_METADATA_NAMEID_FORMAT

See Also:

• Constant Field Values

CONTEXT_TOKEN_DATA

public static final String CONTEXT_TOKEN_DATA

See Also:

• Constant Field Values

TOKEN_METADATA_NAMEID_VALUE

public static final String TOKEN_METADATA_NAMEID_VALUE

See Also:

• Constant Field Values

TOKEN_METADATA_NAMEID_FORMAT

public static final String TOKEN_METADATA_NAMEID_FORMAT

See Also:

• Constant Field Values

TOKEN_METADATA_NAMEID_QUALIFIER

public static final String TOKEN_METADATA_NAMEID_QUALIFIER

See Also:

• Constant Field Values

TOKEN_METADATA_NAMEID_SP_QUALIFIER

public static final String TOKEN_METADATA_NAMEID_SP_QUALIFIER

See Also:

• Constant Field Values

TOKEN_METADATA_NAMEID_SP_PROVIDED_ID

public static final String TOKEN_METADATA_NAMEID_SP_PROVIDED_ID

See Also:

• Constant Field Values

TOKEN_METADATA_SESSION

public static final String TOKEN_METADATA_SESSION

See Also:

• Constant Field Values

TOKEN_METADATA_REALM

public static final String TOKEN_METADATA_REALM

See Also:

• Constant Field Values

Method Details

create

public static SamlRealm create(org.elasticsearch.xpack.core.security.authc.RealmConfig config,
 org.elasticsearch.xpack.core.ssl.SSLService sslService,
 org.elasticsearch.watcher.ResourceWatcherService watcherService,
 org.elasticsearch.xpack.core.security.authc.support.UserRoleMapper roleMapper)
                        throws Exception

Factory for SAML realm. This is not a constructor as it needs to initialise a number of components before delegating to SamlRealm(org.elasticsearch.xpack.core.security.authc.RealmConfig, org.elasticsearch.xpack.core.security.authc.support.UserRoleMapper, org.elasticsearch.xpack.security.authc.saml.SamlAuthenticator, org.elasticsearch.xpack.security.authc.saml.SamlLogoutRequestHandler, org.elasticsearch.xpack.security.authc.saml.SamlLogoutResponseHandler, java.util.function.Supplier<org.opensaml.saml.saml2.metadata.EntityDescriptor>, org.elasticsearch.xpack.security.authc.saml.SpConfiguration)

Throws:

Exception

getServiceProvider

public SpConfiguration getServiceProvider()

initialize

public void initialize(Iterable<org.elasticsearch.xpack.core.security.authc.Realm> realms,
 org.elasticsearch.license.XPackLicenseState licenseState)

Overrides:

initialize in class org.elasticsearch.xpack.core.security.authc.Realm

findSamlRealms

public static List<SamlRealm> findSamlRealms(Realms realms,
 String realmName,
 String acsUrl)

supports

public boolean supports(org.elasticsearch.xpack.core.security.authc.AuthenticationToken token)

Specified by:

supports in class org.elasticsearch.xpack.core.security.authc.Realm

token

public org.elasticsearch.xpack.core.security.authc.AuthenticationToken token(org.elasticsearch.common.util.concurrent.ThreadContext threadContext)

Always returns null as there is no support for reading a SAML token out of a request

Specified by:

token in class org.elasticsearch.xpack.core.security.authc.Realm

See Also:

• TransportSamlAuthenticateAction

authenticate

public void authenticate(org.elasticsearch.xpack.core.security.authc.AuthenticationToken authenticationToken,
 org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.authc.AuthenticationResult<org.elasticsearch.xpack.core.security.user.User>> listener)

Specified by:

authenticate in class org.elasticsearch.xpack.core.security.authc.Realm

createTokenMetadata

public Map<String,Object> createTokenMetadata(SamlNameId nameId,
 String session)

lookupUser

public void lookupUser(String username,
 org.elasticsearch.action.ActionListener<org.elasticsearch.xpack.core.security.user.User> listener)

Specified by:

lookupUser in class org.elasticsearch.xpack.core.security.authc.Realm

close

public void close()

Specified by:

close in interface AutoCloseable

Specified by:

close in interface Closeable

Specified by:

close in interface org.elasticsearch.core.Releasable

serviceProviderEntityId

public String serviceProviderEntityId()

assertionConsumerServiceURL

public String assertionConsumerServiceURL()

buildAuthenticationRequest

public org.opensaml.saml.saml2.core.AuthnRequest buildAuthenticationRequest()

buildLogoutRequest

public org.opensaml.saml.saml2.core.LogoutRequest buildLogoutRequest(org.opensaml.saml.saml2.core.NameID nameId,
 String session)

Creates a SAML Single LogOut request for the provided session, if the realm and IdP configuration support SLO. Otherwise returns null

See Also:

• SamlRealmSettings.IDP_SINGLE_LOGOUT

buildLogoutResponse

public org.opensaml.saml.saml2.core.LogoutResponse buildLogoutResponse(String inResponseTo)

Creates a SAML LogoutResponse to the provided requestID

getSigningConfiguration

public SigningConfiguration getSigningConfiguration()

getLogoutHandler

public SamlLogoutRequestHandler getLogoutHandler()

getLogoutResponseHandler

public SamlLogoutResponseHandler getLogoutResponseHandler()