Package io.jmix.saml.mapper.user

Class SynchronizingSamlUserMapper<T extends JmixSamlUserDetails>

java.lang.Object
io.jmix.saml.mapper.user.BaseSamlUserMapper<T>
io.jmix.saml.mapper.user.SynchronizingSamlUserMapper<T>
Type Parameters:
T - class of Jmix user
All Implemented Interfaces:
SamlUserMapper<T>
@NullMarked public abstract class SynchronizingSamlUserMapper<T extends JmixSamlUserDetails> extends BaseSamlUserMapper<T>
Implementation of the SamlUserMapper that maps the external user object to the persistent user and also stores the user and optionally their role assignment to the database.

If role assignment synchronization is enabled (see setSynchronizeRoleAssignments(boolean)), the identity provider owns all role assignments of the synchronized user: on every login the stored assignments are replaced with the roles derived from the SAML assertion. Role assignments granted manually (e.g. by an administrator in the UI) are removed by the next login and therefore must not be combined with the synchronization mode.

  • Field Details

  • Constructor Details

    • SynchronizingSamlUserMapper

      public SynchronizingSamlUserMapper()

  • Method Details

    • getApplicationUserClass

      protected abstract Class<T> getApplicationUserClass()
      Returns a class of the user used by the application. This user is set to the security context.

    • initJmixUser

      protected T initJmixUser(org.opensaml.saml.saml2.core.Assertion assertion)
      Description copied from class: BaseSamlUserMapper
      Returns an instance of Jmix user, which may be either a new instance or an instance loaded from the user repository. Attributes and authorities will lately be filled in other methods. The responsibility of the current method is just to create or load an existing instance.
      Specified by:
      initJmixUser in class BaseSamlUserMapper<T extends JmixSamlUserDetails>
      Parameters:
      assertion - SAML assertion
      Returns:
      new Jmix user instance or Jmix user loaded from user repository

    • checkUsernameIsNotReserved

      protected void checkUsernameIsNotReserved(String username)
      Throws an exception if the given username belongs to the built-in system or anonymous user. Otherwise, an identity provider asserting such a username would map the external user onto a built-in one and persist it.

    • setUsernameToNewUser

      protected void setUsernameToNewUser(T jmixUser, String username)
      Sets the username to a newly created user instance. The default implementation writes the username entity attribute. Override this method if the application user class stores the login differently.

    • populateUserAuthorities

      protected void populateUserAuthorities(org.opensaml.saml.saml2.core.Assertion assertion, T jmixUser)
      Description copied from class: BaseSamlUserMapper
      Fills authorities of jmixUser based on information from the assertion
      Specified by:
      populateUserAuthorities in class BaseSamlUserMapper<T extends JmixSamlUserDetails>
      Parameters:
      assertion - SAML assertion
      jmixUser - Jmix user instance

    • performAdditionalModifications

      protected void performAdditionalModifications(org.opensaml.saml.saml2.core.Assertion assertion, org.springframework.security.saml2.provider.service.authentication.OpenSaml5AuthenticationProvider.ResponseToken responseToken, T jmixUser)
      Description copied from class: BaseSamlUserMapper
      Performs additional modifications of Jmix user instance. Override this method in case you want to do some additional attribute values computations or if you want to do some operations with Jmix user instance, e.g., to store it in the database, like it is done in the SynchronizingSamlUserMapper
      Overrides:
      performAdditionalModifications in class BaseSamlUserMapper<T extends JmixSamlUserDetails>
      Parameters:
      assertion - SAML assertion
      responseToken - the object that stores information about the authentication response from SAML provider
      jmixUser - Jmix user instance

    • saveJmixUserAndRoleAssignments

      protected void saveJmixUserAndRoleAssignments(org.opensaml.saml.saml2.core.Assertion assertion, T jmixUser)
      Saves Jmix user and synchronizes role assignments

    • updateRoleAssignmentsSaveContext

      protected void updateRoleAssignmentsSaveContext(List<RoleAssignmentEntity> existingAssignments, List<RoleAssignmentEntity> actualAssignments, SaveContext saveContext)
      Fills save context with role assignment operations.
      Parameters:
      existingAssignments - Current role assignments in database
      actualAssignments - New role assignments from SAML assertion
      saveContext - SaveContext to add remove/save operations

    • buildRoleAssignmentEntities

      protected List<RoleAssignmentEntity> buildRoleAssignmentEntities(String username, Collection<? extends org.springframework.security.core.GrantedAuthority> grantedAuthorities)

    • isSynchronizeRoleAssignments

      public boolean isSynchronizeRoleAssignments()
      Whether role assignment synchronization is enabled.

    • setSynchronizeRoleAssignments

      public void setSynchronizeRoleAssignments(boolean synchronizeRoleAssignments)
      Enables role assignment synchronization. If true then role assignment entities will be stored to the database.

      When enabled, the identity provider becomes the single source of truth for all role assignments of the user: on every login the assignments stored in the database are replaced with the roles derived from the SAML assertion. Any assignment granted through other means (e.g. manually by an administrator) is removed, because the SEC_ROLE_ASSIGNMENT table has no marker distinguishing the origin of an assignment. Do not assign roles manually to users synchronized with this mode.