org.jenkinsci.plugins.saml

Class SamlSecurityRealm

java.lang.Object

hudson.model.AbstractDescribableImpl<hudson.security.SecurityRealm>

hudson.security.SecurityRealm

org.jenkinsci.plugins.saml.SamlSecurityRealm

All Implemented Interfaces:

hudson.ExtensionPoint, hudson.model.Describable<hudson.security.SecurityRealm>

public class SamlSecurityRealm
extends hudson.security.SecurityRealm

Authenticates the user via SAML. This class is the main entry point to the plugin. Uses Stapler (stapler.kohsuke.org) to bind methods to URLs.

See Also:

SecurityRealm

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	SamlSecurityRealm.DescriptorImpl

Nested classes/interfaces inherited from class hudson.security.SecurityRealm

hudson.security.SecurityRealm.SecurityComponents

Nested classes/interfaces inherited from interface hudson.ExtensionPoint

hudson.ExtensionPoint.LegacyInstancesAreScopedToHudson

Field Summary

Fields

Modifier and Type	Field and Description
static String	CONSUMER_SERVICE_URL_PATH URL to process the SAML answers
static String	DEFAULT_DISPLAY_NAME_ATTRIBUTE_NAME
static String	DEFAULT_GROUPS_ATTRIBUTE_NAME
static int	DEFAULT_MAXIMUM_AUTHENTICATION_LIFETIME
static String	DEFAULT_USERNAME_CASE_CONVERSION
static String	ERROR_ALGORITHM_CANNOT_BE_FOUND
static String	ERROR_CERTIFICATES_COULD_NOT_BE_LOADED
static String	ERROR_IDP_METADATA_EMPTY
static String	ERROR_INSUFFICIENT_OR_INVALID_INFO
static String	ERROR_MALFORMED_URL
static String	ERROR_NO_PROVIDER_SUPPORTS_A_KS_SPI_IMPL
static String	ERROR_NOT_KEY_FOUND
static String	ERROR_NOT_POSSIBLE_TO_READ_KS_FILE
static String	ERROR_NOT_VALID_NUMBER
static String	ERROR_ONLY_SPACES_FIELD_VALUE form validation messages.
static String	ERROR_WRONG_INFO_OR_PASSWORD
static String	EXPIRATION_ATTRIBUTE
static String	IDP_METADATA_FILE
static String	SP_METADATA_FILE
static String	WARN_RECOMMENDED_TO_SET_THE_GROUPS_ATTRIBUTE
static String	WARN_RECOMMENDED_TO_SET_THE_USERNAME_ATTRIBUTE
static String	WARN_THERE_IS_NOT_KEY_STORE

Fields inherited from class hudson.security.SecurityRealm

AUTHENTICATED_AUTHORITY, LIST, NO_AUTHENTICATION

Constructor Summary

Constructors

Constructor and Description
SamlSecurityRealm(String idpMetadata, String displayNameAttributeName, String groupsAttributeName, Integer maximumAuthenticationLifetime, String usernameAttributeName, String emailAttributeName, String logoutUrl, SamlAdvancedConfiguration advancedConfiguration, SamlEncryptionData encryptionData)
SamlSecurityRealm(String idpMetadata, String displayNameAttributeName, String groupsAttributeName, Integer maximumAuthenticationLifetime, String usernameAttributeName, String emailAttributeName, String logoutUrl, SamlAdvancedConfiguration advancedConfiguration, SamlEncryptionData encryptionData, String usernameCaseConversion) Jenkins passes these parameters in when you update the settings.

Method Summary

Modifier and Type	Method and Description
boolean	allowsSignup()
hudson.security.SecurityRealm.SecurityComponents	createSecurityComponents()
org.kohsuke.stapler.HttpResponse	doCommenceLogin(org.kohsuke.stapler.StaplerRequest request, org.kohsuke.stapler.StaplerResponse response, String referer) /securityRealm/commenceLogin
org.kohsuke.stapler.HttpResponse	doFinishLogin(org.kohsuke.stapler.StaplerRequest request, org.kohsuke.stapler.StaplerResponse response) /securityRealm/finishLogin
void	doLogout(org.kohsuke.stapler.StaplerRequest req, org.kohsuke.stapler.StaplerResponse rsp)
org.kohsuke.stapler.HttpResponse	doMetadata(org.kohsuke.stapler.StaplerRequest request, org.kohsuke.stapler.StaplerResponse response) /securityRealm/metadata
SamlAdvancedConfiguration	getAdvancedConfiguration()
String	getAuthnContextClassRef()
String	getDisplayNameAttributeName()
String	getEmailAttributeName()
SamlEncryptionData	getEncryptionData()
Boolean	getForceAuthn()
String	getGroupsAttributeName()
String	getIdpMetadata()
String	getKeystorePassword()
String	getKeystorePath()
String	getLoginUrl()
String	getLogoutUrl()
Integer	getMaximumAuthenticationLifetime()
Integer	getMaximumSessionLifetime()
protected String	getPostLogOutUrl(org.kohsuke.stapler.StaplerRequest req, org.acegisecurity.Authentication auth)
String	getPrivateKeyAlias()
String	getPrivateKeyPassword()
SamlPluginConfig	getSamlPluginConfig()
String	getSpEntityId()
String	getUsernameAttributeName()
String	getUsernameCaseConversion()
hudson.security.GroupDetails	loadGroupByGroupname(String groupname)
hudson.security.GroupDetails	loadGroupByGroupname(String groupname, boolean fetchMembers)
String	toString()

Methods inherited from class hudson.security.SecurityRealm

all, canLogOut, commenceSignup, createCliAuthenticator, createFilter, doCaptcha, findBean, getAuthenticationGatewayUrl, getCaptchaSupport, getCaptchaSupportDescriptors, getDescriptor, getFrom, getGroupIdStrategy, getSecurityComponents, getUserIdStrategy, loadUserByUsername, setCaptchaSupport, validateCaptcha

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Detail

DEFAULT_DISPLAY_NAME_ATTRIBUTE_NAME

public static final String DEFAULT_DISPLAY_NAME_ATTRIBUTE_NAME

See Also:

Constant Field Values

DEFAULT_GROUPS_ATTRIBUTE_NAME

public static final String DEFAULT_GROUPS_ATTRIBUTE_NAME

See Also:

Constant Field Values

DEFAULT_MAXIMUM_AUTHENTICATION_LIFETIME

public static final int DEFAULT_MAXIMUM_AUTHENTICATION_LIFETIME

See Also:

Constant Field Values

DEFAULT_USERNAME_CASE_CONVERSION

public static final String DEFAULT_USERNAME_CASE_CONVERSION

See Also:

Constant Field Values

SP_METADATA_FILE

public static final String SP_METADATA_FILE

IDP_METADATA_FILE

public static final String IDP_METADATA_FILE

ERROR_ONLY_SPACES_FIELD_VALUE

public static final String ERROR_ONLY_SPACES_FIELD_VALUE

form validation messages.

See Also:

Constant Field Values

ERROR_NOT_VALID_NUMBER

public static final String ERROR_NOT_VALID_NUMBER

See Also:

Constant Field Values

ERROR_MALFORMED_URL

public static final String ERROR_MALFORMED_URL

See Also:

Constant Field Values

ERROR_IDP_METADATA_EMPTY

public static final String ERROR_IDP_METADATA_EMPTY

See Also:

Constant Field Values

WARN_RECOMMENDED_TO_SET_THE_GROUPS_ATTRIBUTE

public static final String WARN_RECOMMENDED_TO_SET_THE_GROUPS_ATTRIBUTE

See Also:

Constant Field Values

WARN_RECOMMENDED_TO_SET_THE_USERNAME_ATTRIBUTE

public static final String WARN_RECOMMENDED_TO_SET_THE_USERNAME_ATTRIBUTE

See Also:

Constant Field Values

ERROR_NOT_POSSIBLE_TO_READ_KS_FILE

public static final String ERROR_NOT_POSSIBLE_TO_READ_KS_FILE

See Also:

Constant Field Values

ERROR_CERTIFICATES_COULD_NOT_BE_LOADED

public static final String ERROR_CERTIFICATES_COULD_NOT_BE_LOADED

See Also:

Constant Field Values

ERROR_ALGORITHM_CANNOT_BE_FOUND

public static final String ERROR_ALGORITHM_CANNOT_BE_FOUND

See Also:

Constant Field Values

ERROR_NO_PROVIDER_SUPPORTS_A_KS_SPI_IMPL

public static final String ERROR_NO_PROVIDER_SUPPORTS_A_KS_SPI_IMPL

See Also:

Constant Field Values

ERROR_WRONG_INFO_OR_PASSWORD

public static final String ERROR_WRONG_INFO_OR_PASSWORD

See Also:

Constant Field Values

ERROR_INSUFFICIENT_OR_INVALID_INFO

public static final String ERROR_INSUFFICIENT_OR_INVALID_INFO

See Also:

Constant Field Values

CONSUMER_SERVICE_URL_PATH

public static final String CONSUMER_SERVICE_URL_PATH

URL to process the SAML answers

See Also:

Constant Field Values

EXPIRATION_ATTRIBUTE

public static final String EXPIRATION_ATTRIBUTE

WARN_THERE_IS_NOT_KEY_STORE

public static final String WARN_THERE_IS_NOT_KEY_STORE

See Also:

Constant Field Values

ERROR_NOT_KEY_FOUND

public static final String ERROR_NOT_KEY_FOUND

See Also:

Constant Field Values

Constructor Detail

SamlSecurityRealm

@DataBoundConstructor
public SamlSecurityRealm(String idpMetadata,
                                               String displayNameAttributeName,
                                               String groupsAttributeName,
                                               Integer maximumAuthenticationLifetime,
                                               String usernameAttributeName,
                                               String emailAttributeName,
                                               String logoutUrl,
                                               SamlAdvancedConfiguration advancedConfiguration,
                                               SamlEncryptionData encryptionData,
                                               String usernameCaseConversion)
                                        throws IOException

Jenkins passes these parameters in when you update the settings. It does this because of the @DataBoundConstructor

Parameters:

idpMetadata - Identity provider Metadata

displayNameAttributeName - attribute that has the displayname

groupsAttributeName - attribute that has the groups

maximumAuthenticationLifetime - maximum time that an identification it is valid

usernameAttributeName - attribute that has the username

emailAttributeName - attribute that has the email

logoutUrl - optional URL to redirect on logout

advancedConfiguration - advanced configuration settings

encryptionData - encryption configuration settings

usernameCaseConversion - username case sensitive settings

Throws:

IOException

SamlSecurityRealm

public SamlSecurityRealm(String idpMetadata,
                         String displayNameAttributeName,
                         String groupsAttributeName,
                         Integer maximumAuthenticationLifetime,
                         String usernameAttributeName,
                         String emailAttributeName,
                         String logoutUrl,
                         SamlAdvancedConfiguration advancedConfiguration,
                         SamlEncryptionData encryptionData)
                  throws IOException

Throws:

IOException

Method Detail

allowsSignup

public boolean allowsSignup()

Overrides:

allowsSignup in class hudson.security.SecurityRealm

createSecurityComponents

public hudson.security.SecurityRealm.SecurityComponents createSecurityComponents()

Specified by:

createSecurityComponents in class hudson.security.SecurityRealm

getLoginUrl

public String getLoginUrl()

Overrides:

getLoginUrl in class hudson.security.SecurityRealm

doCommenceLogin

public org.kohsuke.stapler.HttpResponse doCommenceLogin(org.kohsuke.stapler.StaplerRequest request,
                                                        org.kohsuke.stapler.StaplerResponse response,
                                                        @Header(value="Referer")
                                                        String referer)

/securityRealm/commenceLogin

Parameters:

request - http request.

response - http response.

referer - referer.

Returns:

the http response.

doFinishLogin

public org.kohsuke.stapler.HttpResponse doFinishLogin(org.kohsuke.stapler.StaplerRequest request,
                                                      org.kohsuke.stapler.StaplerResponse response)

/securityRealm/finishLogin

Parameters:

request - http request.

response - http response.

Returns:

the http response.

doMetadata

public org.kohsuke.stapler.HttpResponse doMetadata(org.kohsuke.stapler.StaplerRequest request,
                                                   org.kohsuke.stapler.StaplerResponse response)

/securityRealm/metadata

URL request service method to expose the SP metadata to the user so that they can configure their IdP.

Parameters:

request - http request.

response - http response.

Returns:

the http response.

getPostLogOutUrl

protected String getPostLogOutUrl(org.kohsuke.stapler.StaplerRequest req,
                                  @Nonnull
                                  org.acegisecurity.Authentication auth)

Overrides:

getPostLogOutUrl in class hudson.security.SecurityRealm

See Also:

Note: It does not call the logout service on SAML because the library does not implement it on this version, it will be done when we upgrade the library.

doLogout

public void doLogout(org.kohsuke.stapler.StaplerRequest req,
                     org.kohsuke.stapler.StaplerResponse rsp)
              throws IOException,
                     javax.servlet.ServletException

Overrides:

doLogout in class hudson.security.SecurityRealm

Throws:

IOException

javax.servlet.ServletException

loadGroupByGroupname

public hudson.security.GroupDetails loadGroupByGroupname(String groupname)
                                                  throws org.acegisecurity.userdetails.UsernameNotFoundException,
                                                         org.springframework.dao.DataAccessException

Overrides:

loadGroupByGroupname in class hudson.security.SecurityRealm

Throws:

org.acegisecurity.userdetails.UsernameNotFoundException

org.springframework.dao.DataAccessException

loadGroupByGroupname

public hudson.security.GroupDetails loadGroupByGroupname(String groupname,
                                                         boolean fetchMembers)
                                                  throws org.acegisecurity.userdetails.UsernameNotFoundException,
                                                         org.springframework.dao.DataAccessException

Overrides:

loadGroupByGroupname in class hudson.security.SecurityRealm

Throws:

org.acegisecurity.userdetails.UsernameNotFoundException

org.springframework.dao.DataAccessException

getSamlPluginConfig

public SamlPluginConfig getSamlPluginConfig()

Returns:

plugin configuration parameters.

getIdpMetadata

public String getIdpMetadata()

getUsernameAttributeName

public String getUsernameAttributeName()

getDisplayNameAttributeName

public String getDisplayNameAttributeName()

getGroupsAttributeName

public String getGroupsAttributeName()

getMaximumAuthenticationLifetime

public Integer getMaximumAuthenticationLifetime()

getAdvancedConfiguration

public SamlAdvancedConfiguration getAdvancedConfiguration()

getForceAuthn

public Boolean getForceAuthn()

getAuthnContextClassRef

public String getAuthnContextClassRef()

getSpEntityId

public String getSpEntityId()

getMaximumSessionLifetime

public Integer getMaximumSessionLifetime()

getEncryptionData

public SamlEncryptionData getEncryptionData()

getKeystorePath

public String getKeystorePath()

getKeystorePassword

public String getKeystorePassword()

getPrivateKeyPassword

public String getPrivateKeyPassword()

getPrivateKeyAlias

public String getPrivateKeyAlias()

getUsernameCaseConversion

public String getUsernameCaseConversion()

getEmailAttributeName

public String getEmailAttributeName()

getLogoutUrl

public String getLogoutUrl()

toString

public String toString()

Overrides:

toString in class Object