org.apereo.cas.authentication

Class PolicyBasedAuthenticationManager

java.lang.Object

org.apereo.cas.authentication.AbstractAuthenticationManager

org.apereo.cas.authentication.PolicyBasedAuthenticationManager

All Implemented Interfaces:

org.apereo.cas.authentication.AuthenticationManager

public class PolicyBasedAuthenticationManager
extends AbstractAuthenticationManager

Provides an authentication manager that is inherently aware of multiple credentials and supports pluggable security policy via the AuthenticationPolicy component. The authentication process is as follows:

• For each given credential do the following:
  • Iterate over all configured authentication handlers.
  • Attempt to authenticate a credential if a handler supports it.
  • On success attempt to resolve a principal by doing the following:
    • Check whether a resolver is configured for the handler that authenticated the credential.
    • If a suitable resolver is found, attempt to resolve the principal.
    • If a suitable resolver is not found, use the principal resolved by the authentication handler.
  • Check whether the security policy (e.g. any, all) is satisfied.
    • If security policy is met return immediately.
    • Continue if security policy is not met.
• After all credentials have been attempted check security policy again. Note there is an implicit security policy that requires at least one credential to be authenticated. Then the security policy given by the AuthenticationPolicy is applied. In all cases AuthenticationException is raised if security policy is not met.

It is an error condition to fail to resolve a principal.

Since:

4.0.0

Field Summary

Fields

Modifier and Type	Field and Description
protected java.util.Collection<org.apereo.cas.authentication.AuthenticationPolicy>	authenticationPolicies Authentication security policy.

Fields inherited from class org.apereo.cas.authentication.AbstractAuthenticationManager

authenticationEventExecutionPlan, authenticationHandlerResolver, principalResolutionFailureFatal

Fields inherited from interface org.apereo.cas.authentication.AuthenticationManager

AUTHENTICATION_METHOD_ATTRIBUTE

Constructor Summary

Constructors

Constructor and Description
PolicyBasedAuthenticationManager(org.apereo.cas.authentication.AuthenticationEventExecutionPlan authenticationEventExecutionPlan, org.apereo.cas.authentication.AuthenticationHandlerResolver authenticationHandlerResolver, java.util.Collection<org.apereo.cas.authentication.AuthenticationPolicy> authenticationPolicies, boolean principalResolutionFatal) Instantiates a new Policy based authentication manager.
PolicyBasedAuthenticationManager(org.apereo.cas.authentication.AuthenticationEventExecutionPlan authenticationEventExecutionPlan, org.apereo.cas.services.ServicesManager servicesManager) Instantiates a new Policy based authentication manager.
PolicyBasedAuthenticationManager(org.apereo.cas.authentication.AuthenticationEventExecutionPlan authenticationEventExecutionPlan, org.apereo.cas.services.ServicesManager servicesManager, org.apereo.cas.authentication.AuthenticationPolicy authenticationPolicy)
PolicyBasedAuthenticationManager(org.apereo.cas.authentication.AuthenticationEventExecutionPlan authenticationEventExecutionPlan, org.apereo.cas.services.ServicesManager servicesManager, java.util.Collection<org.apereo.cas.authentication.AuthenticationPolicy> authenticationPolicy) Instantiates a new Policy based authentication manager.

Method Summary

Modifier and Type	Method and Description
protected org.apereo.cas.authentication.AuthenticationBuilder	authenticateInternal(org.apereo.cas.authentication.AuthenticationTransaction transaction) Follows the same contract as AuthenticationManager.authenticate(AuthenticationTransaction).
protected void	evaluateProducedAuthenticationContext(org.apereo.cas.authentication.AuthenticationBuilder builder, org.apereo.cas.authentication.AuthenticationTransaction transaction) Evaluate produced authentication context.

Methods inherited from class org.apereo.cas.authentication.AbstractAuthenticationManager

addAuthenticationMethodAttribute, authenticate, authenticateAndResolvePrincipal, getAuthenticationHandlersForThisTransaction, getAuthenticationMetadataPopulatorsForTransaction, getPrincipalResolverLinkedToHandlerIfAny, populateAuthenticationMetadataAttributes, publishEvent, resolvePrincipal

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

authenticationPolicies

protected final java.util.Collection<org.apereo.cas.authentication.AuthenticationPolicy> authenticationPolicies

Authentication security policy.

Constructor Detail

PolicyBasedAuthenticationManager

public PolicyBasedAuthenticationManager(org.apereo.cas.authentication.AuthenticationEventExecutionPlan authenticationEventExecutionPlan,
                                        org.apereo.cas.authentication.AuthenticationHandlerResolver authenticationHandlerResolver,
                                        java.util.Collection<org.apereo.cas.authentication.AuthenticationPolicy> authenticationPolicies,
                                        boolean principalResolutionFatal)

Instantiates a new Policy based authentication manager.

Parameters:

authenticationEventExecutionPlan - the execution plan

authenticationHandlerResolver - the authentication handler resolver

authenticationPolicies - the authentication policy

principalResolutionFatal - the principal resolution fatal

PolicyBasedAuthenticationManager

public PolicyBasedAuthenticationManager(org.apereo.cas.authentication.AuthenticationEventExecutionPlan authenticationEventExecutionPlan,
                                        org.apereo.cas.services.ServicesManager servicesManager)

Instantiates a new Policy based authentication manager.

Parameters:

authenticationEventExecutionPlan - the authentication event execution plan

servicesManager - the services manager

PolicyBasedAuthenticationManager

public PolicyBasedAuthenticationManager(org.apereo.cas.authentication.AuthenticationEventExecutionPlan authenticationEventExecutionPlan,
                                        org.apereo.cas.services.ServicesManager servicesManager,
                                        java.util.Collection<org.apereo.cas.authentication.AuthenticationPolicy> authenticationPolicy)

Instantiates a new Policy based authentication manager.

Parameters:

authenticationEventExecutionPlan - the authentication event execution plan

servicesManager - the services manager

authenticationPolicy - the authentication policy

PolicyBasedAuthenticationManager

public PolicyBasedAuthenticationManager(org.apereo.cas.authentication.AuthenticationEventExecutionPlan authenticationEventExecutionPlan,
                                        org.apereo.cas.services.ServicesManager servicesManager,
                                        org.apereo.cas.authentication.AuthenticationPolicy authenticationPolicy)

Method Detail

authenticateInternal

protected org.apereo.cas.authentication.AuthenticationBuilder authenticateInternal(org.apereo.cas.authentication.AuthenticationTransaction transaction)
                                                                            throws org.apereo.cas.authentication.AuthenticationException

Description copied from class: AbstractAuthenticationManager

Follows the same contract as AuthenticationManager.authenticate(AuthenticationTransaction).

Specified by:

authenticateInternal in class AbstractAuthenticationManager

Parameters:

transaction - the authentication transaction

Returns:

An authentication containing a resolved principal and metadata about successful and failed authentications. There SHOULD be a record of each attempted authentication, whether success or failure.

Throws:

AuthenticationException - When one or more credentials failed authentication such that security policy was not satisfied.

evaluateProducedAuthenticationContext

protected void evaluateProducedAuthenticationContext(org.apereo.cas.authentication.AuthenticationBuilder builder,
                                                     org.apereo.cas.authentication.AuthenticationTransaction transaction)
                                              throws org.apereo.cas.authentication.AuthenticationException

Evaluate produced authentication context. We apply an implicit security policy of at least one successful authentication. Then, we apply the configured security policy.

Parameters:

builder - the builder

transaction - the transaction

Throws:

AuthenticationException - the authentication exception