FunctionAuthnConfiguration
- Scott Cantor
Current File(s): conf/authn/authn.properties
Format: Native Spring, Properties
Overview
The authn/Function login flow is an extension point that allows authentication to be handled by a deployer-supplied Function object, which can be written in Java, a scripting language, etc. It simplifies authoring certain kinds of custom login flows (essentially it provides the "flow" part) and potentially simplifies some MultiFactorAuthnConfiguration scenarios by moving some of the logic into a separate component.
General Configuration
Dome generic settings applicable to all login flows are in authn/authn.properties.
Note for Upgraded Systems
The old file conf/authn/function-authn-config.xml is now supported only for compatibility and generally not installed or needed going forward.
The core of the flow’s configuration is a required bean named shibboleth.authn.Function.ResultLookupStrategy, of type Function<ProfileRequestContext,Object>, which you may define in global.xml.
If the Function returns a null, then authentication fails (this is how to signal a controlled failure). Otherwise, the Function can return a String (the username), a Principal, or a Subject, and the system will construct an appropriate AuthenticationResult around whatever is returned. You may also raise an exception if desired.
A simple scripted example that is more or less an emulation of the RemoteUser flow:
<bean id="shibboleth.authn.Function.ResultLookupStrategy"
parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
customObject-ref="shibboleth.HttpServletRequestSupplier">
<constructor-arg>
<value>
<![CDATA[
custom.get().getRemoteUser();
]]>
</value>
</constructor-arg>
</bean>Use of Cookies
Since a common use case is to be able to read and write cookies, note that there's already a component that handles this called a CookieManager. There are built-in objects of this type that will reuse standard properties controlling cookie domain, path, flags, etc. and that's usually the best way to do things. Simply inject an instance of shibboleth.CookieManager or shibboleth.PersistentCookieManager into a Java-based Function implementation, or as a customObject-ref property of a bean inheriting from shibboleth.ContextFunctions.Scripted or shibboleth.ContextFunctions.Expression, to use it to read and write cookies for you.