...
Name | Type | Function |
|---|---|---|
principalName | String | Name of authenticated subject to use as the login result |
principal | Java Principal object to use as the login result | |
subject | Java Subject object to use as the login result | |
authnError | String | Error message to return in place of a successful login |
authnException | Exception | Explicit exception object to return in place of a successful login |
authnInstant | Exact time of authentication to report back | |
authnAuthorities | Collection<String> | Ordered collection of URIs identifying upstream/proxied authenticating "authorities" used to authenticate the subject |
attributes | Collection<IdPAttribute> | Collection of IdPAttribute objects to associate with the authenticated subject |
doNotCache | Boolean | If true, prevents the result from being saved for future use for SSO |
previousResult | Boolean | If true, the "new" AuthenticationResult is created with the "previousResult" flag set to true (mainly impacts auditing) |
Only one "result" or error attribute should be set by the external code. Setting more than one has unspecified behavior. In most cases, a simple principalName should be returned on success, but you can return the more complex objects to pass back additional information such as public or private credentials or custom principal data.
Any IdPAttribute objects supplied will be processed by the AttributeFilter service as "inbound" data. If at least one value in the "authnAuthorities" attribute is supplied, it is set as the "issuer" of the attributes for the purposes of the filter evaluation.
Note that returning a Subject is often paired with setting the idp.authn.External.addDefaultPrincipals property to false, to dynamically establish Principal(s) representing the authentication method used without having them overwritten.
For example, your External flow's supportedPrincipals property might be defined to include both password and multi-factor authentication Principals (meaning it supports both methods), but you can return the specific method used at runtime in the Subject. For SAML 2.0, this is typically done (programmatically) by using the net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal class with the appropriate value from the standard or a deployment. Other classes in that package address SAML 1.1 and unusual SAML 2.0 use cases. For the built-in constants defined by the standard, there are Java constants available via org.opensaml.saml.saml2.core.AuthnContext.
...
| Expand | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||
Beans that may be defined in global.xml follow:
|
...