...
On first access to the external resource, the request attributes below will be set.
Name | Type | Function |
|---|---|---|
opensamlProfileRequestContext | Access to full request context tree | |
forceAuthn | Boolean | Whether the requester asked for re-authentication |
isPassive | Boolean | Whether the requested asked for passive authentication |
relyingParty | String | Name of the relying party requesting authentication |
Outputs
Name | Type | Function |
|---|---|---|
principalName | String | Name of authenticated subject to use as the login result |
principal | Java Principal object to use as the login result | |
subject | Java Subject object to use as the login result | |
authnError | String | Error message to return in place of a successful login |
authnException | Exception | Explicit exception object to return in place of a successful login |
authnInstant | Exact time of authentication to report back | |
authnAuthorities | Collection<String> | Ordered collection of URIs identifying upstream/proxied authenticating "authorities" used to authenticate the subject |
attributes | Collection<IdPAttribute> | Collection of IdPAttribute objects to associate with the authenticated subject |
doNotCache | Boolean | If true, prevents the result from being saved for future use for SSO |
previousResult | Boolean | If true, the "new" AuthenticationResult is created with the "previousResult" flag set to true (mainly impacts auditing) |
Only one "result" or error attribute should be set by the external code. Setting more than one has unspecified behavior. In most cases, a simple principalName should be returned on success, but you can return the more complex objects to pass back additional information such as public or private credentials or custom principal data.
...
For example, your External flow's supportedPrincipals property might be defined to include both password and multi-factor authentication Principals (meaning it supports both methods), but you can return the specific method used at runtime in the Subject. For SAML 2.0, this is typically done (programmatically) by using the net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal class with the appropriate value from the standard or a deployment. Other classes in that package address SAML 1.1 and unusual SAML 2.0 use cases. For the built-in constants defined by the standard, there are Java constants available via org.opensaml.saml.saml2.core.AuthnContext.
Advanced Topics
Custom Events
TBD, for now refer to the same material in the Password login flow documentation.
Reference
| Expand | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||
Beans that may be defined in global.xml follow:
|
...