LoginHandler (Shibboleth Identity Provider 2.3.0 API)

既知の実装クラスのリスト:

AbstractLoginHandler, ExternalAuthnSystemLoginHandler, IPAddressLoginHandler, PreviousSessionLoginHandler, RemoteUserLoginHandler, UsernamePasswordLoginHandler
```
public interface LoginHandler
```
Authentication handlers authenticate a user in an implementation specific manner. Some examples of this might be by collecting a user name and password and validating it against an LDAP directory, validating a client certificate, or validating one-time password. When a login handler is invoked the user's Session is bound to the HttpSession under the attribute with the name Session.HTTP_SESSION_BINDING_ATTRIBUTE. After a successful authentication has been completed the handler MUST either:
- Bind a Subject to the attribute identified by SUBJECT_KEY if one was created during the authentication process. The principals, public, and private credentials from this subject will be merged with those in the Subject within the Session.
- Bind a Principal for the user to the request attribute identified by PRINCIPAL_KEY . Such a Principal MUST implement Serializable. This principal will be added to the Subject within the Session.
- Bind a principal name string to the request attribute identified by PRINCIPAL_NAME_KEY. In this case the AuthenticationEngine will create a Principal object of type UsernamePrincipal and add that to the Subject within the Session.
The handler SHOULD also:
- Bind a URI string, representing the authentication method actually used, to a request attribute identified by AUTHENTICATION_METHOD_KEY. Failure to do so may lead to a situation where one authentication method is started but a user switches to a weaker one in mid-process. Without the login handler explicitly setting the method, the first method that is started is what will be reported to the relying party.
The handler MAY also:
- Bind an error message, if an error occurred during authentication to the request attribute identified by AUTHENTICATION_ERROR_KEY.
- Bind a AuthenticationException, if an exception occurred during authentication to the request attribute identified by AUTHENTICATION_EXCEPTION_KEY.
Finally, the handler must return control to the authentication engine by invoking AuthenticationEngine.returnToAuthenticationEngine(HttpServletRequest, HttpServletResponse). After which the authentication handler must immediately return. Handlers MUST NOT change or add any data to the user's HttpSession that persists past the process of authenticating the user, that is no additional session data may be added and no existing session data may be changed when the handler returns control to the authentication engine.

フィールドの概要

フィールド
修飾子とタイプ	フィールドと説明
`static String`	`AUTHENTICATION_ERROR_KEY` Request attribute to which an error message may be bound.
`static String`	`AUTHENTICATION_EXCEPTION_KEY` Request attribute to which an `AuthenticationException` may be bound.
`static String`	`AUTHENTICATION_INSTANT_KEY` Request attribute to which an authentication timestamp may be bound.
`static String`	`AUTHENTICATION_METHOD_KEY` Request attribute to which an authentication method URI may be bound.
`static String`	`PRINCIPAL_KEY` Request attribute to which user's principal should be bound.
`static String`	`PRINCIPAL_NAME_KEY` Request attribute to which user's principal name should be bound.
`static String`	`SUBJECT_KEY` Request attribute to which user's subject should be bound.

メソッドの概要

メソッド
修飾子とタイプ	メソッドと説明
`long`	`getAuthenticationDuration()` Gets the length of time, in milliseconds, after which a user authenticated by this handler should be re-authenticated.
`List<String>`	`getSupportedAuthenticationMethods()` Gets the list of authentication methods this handler supports.
`void`	`login(javax.servlet.http.HttpServletRequest httpRequest, javax.servlet.http.HttpServletResponse httpResponse)` Authenticate the user making the request.
`boolean`	`supportsForceAuthentication()` Returns if this handler supports the ability to force a user to (re-)authenticate.
`boolean`	`supportsPassive()` Gets whether this handler supports passive authentication.

- フィールドの詳細
  - PRINCIPAL_KEY
```
static final String PRINCIPAL_KEY
```
    Request attribute to which user's principal should be bound.
    
    関連項目:
    定数フィールド値
  - PRINCIPAL_NAME_KEY
```
static final String PRINCIPAL_NAME_KEY
```
    Request attribute to which user's principal name should be bound.
    
    関連項目:
    定数フィールド値
  - SUBJECT_KEY
```
static final String SUBJECT_KEY
```
    Request attribute to which user's subject should be bound.
    
    関連項目:
    定数フィールド値
  - AUTHENTICATION_METHOD_KEY
```
static final String AUTHENTICATION_METHOD_KEY
```
    Request attribute to which an authentication method URI may be bound.
    
    関連項目:
    定数フィールド値
  - AUTHENTICATION_INSTANT_KEY
```
static final String AUTHENTICATION_INSTANT_KEY
```
    Request attribute to which an authentication timestamp may be bound.
    
    関連項目:
    定数フィールド値
  - AUTHENTICATION_ERROR_KEY
```
static final String AUTHENTICATION_ERROR_KEY
```
    Request attribute to which an error message may be bound.
    
    関連項目:
    定数フィールド値
  - AUTHENTICATION_EXCEPTION_KEY
```
static final String AUTHENTICATION_EXCEPTION_KEY
```
    Request attribute to which an AuthenticationException may be bound.
    
    関連項目:
    定数フィールド値
- メソッドの詳細
  - getSupportedAuthenticationMethods
```
List<String> getSupportedAuthenticationMethods()
```
    Gets the list of authentication methods this handler supports.
    
    戻り値:
    authentication methods this handler supports
  - getAuthenticationDuration
```
long getAuthenticationDuration()
```
    Gets the length of time, in milliseconds, after which a user authenticated by this handler should be re-authenticated.
    
    戻り値:
    length of time, in milliseconds, after which a user should be re-authenticated
  - supportsPassive
```
boolean supportsPassive()
```
    Gets whether this handler supports passive authentication.
    
    戻り値:
    whether this handler supports passive authentication
  - supportsForceAuthentication
```
boolean supportsForceAuthentication()
```
    Returns if this handler supports the ability to force a user to (re-)authenticate.
    
    戻り値:
    if this handler can force a user to (re-)authenticate.
  - login
```
void login(javax.servlet.http.HttpServletRequest httpRequest,
         javax.servlet.http.HttpServletResponse httpResponse)
```
    Authenticate the user making the request.
    
    パラメータ:
    httpRequest - user request
    httpResponse - response to user

インタフェース LoginHandler

フィールドの概要

メソッドの概要

フィールドの詳細

PRINCIPAL_KEY

PRINCIPAL_NAME_KEY

SUBJECT_KEY

AUTHENTICATION_METHOD_KEY

AUTHENTICATION_INSTANT_KEY

AUTHENTICATION_ERROR_KEY

AUTHENTICATION_EXCEPTION_KEY

メソッドの詳細

getSupportedAuthenticationMethods

getAuthenticationDuration

supportsPassive

supportsForceAuthentication

login