com.bea.security.saml2.providers
Interface SAML2CredentialMapperMBean

All Superinterfaces:

ApplicationVersionerMBean, CredentialMapperMBean, ExportMBean, ImportMBean, ListerMBean, NameListerMBean, ProviderMBean, SAML2PartnerRegistryMBean, SAML2SPPartnerRegistryMBean

public interface SAML2CredentialMapperMBean
extends CredentialMapperMBean, SAML2SPPartnerRegistryMBean, ImportMBean, ExportMBean, ApplicationVersionerMBean

This MBean represents configuration information for the SAML2 Credential Mapping provider.

Deprecation of MBeanHome and Type-Safe Interfaces

This is a type-safe interface for a WebLogic Server MBean, which you can import into your client classes and access through weblogic.management.MBeanHome. As of 9.0, the MBeanHome interface and all type-safe interfaces for WebLogic Server MBeans are deprecated. Instead, client classes that interact with WebLogic Server MBeans should use standard JMX design patterns in which clients use the javax.management.MBeanServerConnection interface to discover MBeans, attributes, and attribute types at runtime.

getProviderClassName

String getProviderClassName()

The Java class used to load the SAML2 Credential Mapping provider.

Default Value:

"com.bea.security.saml2.providers.SAML2CredentialMapperProviderImpl"

getDescription

String getDescription()

A short description of the SAML2 Credential Mapping provider.

Specified by:

getDescription in interface ProviderMBean

Default Value:

"SAML 2.0 Credential Mapping Provider. Supports Security Assertion Markup Language v2.0."

getVersion

String getVersion()

The version number of the SAML2 Credential Mapping provider.

Specified by:

getVersion in interface ProviderMBean

Default Value:

"1.0"

getSupportedImportFormats

String[] getSupportedImportFormats()

The format of the file to import. The list of supported import formats is determined by the Credential Mapper provider from which the security data were originally exported.

Specified by:

getSupportedImportFormats in interface ImportMBean

Default Value:

"SAML2"

getSupportedImportConstraints

String[] getSupportedImportConstraints()

The security data that you want to be imported into this Credential Mapping provider's data store. A SAML2 Credential Mapping Provider can import all partners(Partner=all), enabled partners(Partner=enabled) or only disabled partners(Partner=disabled).

Specified by:

getSupportedImportConstraints in interface ImportMBean

Default Value:

"Partner"

getSupportedExportFormats

String[] getSupportedExportFormats()

The format of the file to export. The list of supported export formats is determined by this Credential Mapper provider.

Specified by:

getSupportedExportFormats in interface ExportMBean

Default Value:

"SAML2"

getSupportedExportConstraints

String[] getSupportedExportConstraints()

The security data that you want to be exported from this Credential Mapping provider's data store. A SAML2 Credential Mapping provider can export all partners(Partner=all), enabled partners(Partner=enabled) or only disabled partners(Partner=disabled). The password inlined in the exported file can be encrypted or plain text(Passwords=cleartext).

Specified by:

getSupportedExportConstraints in interface ExportMBean

Default Value:

"Partner","Passwords"

getIssuerURI

String getIssuerURI()

The Issuer URI (name) of this SAML2 Identity Provider.

Changes take effect after you redeploy the module or restart the server.

Default Value:

""

setIssuerURI

void setIssuerURI(String newValue)
                  throws InvalidAttributeValueException

The Issuer URI (name) of this SAML2 Identity Provider.

Parameters:

newValue - - new value for attribute IssuerURI

Throws:

InvalidAttributeValueException

Changes take effect after you redeploy the module or restart the server.

Default Value:

""

getNameQualifier

String getNameQualifier()

The Name Qualifier value used by the Name Mapper.

The value of the Name Qualifier is the security or administrative domain that qualifies the name of the subject. This provides a means to federate names from disparate user stores while avoiding the possibility of subject name collision.

Changes take effect after you redeploy the module or restart the server.

Default Value:

""

setNameQualifier

void setNameQualifier(String newValue)
                      throws InvalidAttributeValueException

The Name Qualifier value used by the Name Mapper.

The value of the Name Qualifier is the security or administrative domain that qualifies the name of the subject. This provides a means to federate names from disparate user stores while avoiding the possibility of subject name collision.

Parameters:

newValue - - new value for attribute NameQualifier

Throws:

InvalidAttributeValueException

Changes take effect after you redeploy the module or restart the server.

Default Value:

""

getSigningKeyAlias

String getSigningKeyAlias()

The alias used to retrieve from the keystore the key that is used to sign assertions.

Changes take effect after you redeploy the module or restart the server.

Default Value:

""

setSigningKeyAlias

void setSigningKeyAlias(String newValue)
                        throws InvalidAttributeValueException

The alias used to retrieve from the keystore the key that is used to sign assertions.

Parameters:

newValue - - new value for attribute SigningKeyAlias

Throws:

InvalidAttributeValueException

Changes take effect after you redeploy the module or restart the server.

Default Value:

""

getSigningKeyPassPhrase

String getSigningKeyPassPhrase()

The credential (password) used to retrieve from the keystore the keys used to sign assertions.

Changes take effect after you redeploy the module or restart the server.

Default Value:

""

setSigningKeyPassPhrase

void setSigningKeyPassPhrase(String newValue)
                             throws InvalidAttributeValueException

The credential (password) used to retrieve from the keystore the keys used to sign assertions.

Parameters:

newValue - - new value for attribute SigningKeyPassPhrase

Throws:

InvalidAttributeValueException

Changes take effect after you redeploy the module or restart the server.

Default Value:

""

getDefaultTimeToLive

int getDefaultTimeToLive()

Time in seconds that, by default, an assertion should remain valid. Default value is 120 seconds (2 minutes).

If the value is zero, then assertions have an infinite lifetime. Using assertions with an infinite lifetime is not recommended, however.

Changes take effect after you redeploy the module or restart the server.

Default Value:

120

Minimum Value:

0

setDefaultTimeToLive

void setDefaultTimeToLive(int newValue)
                          throws InvalidAttributeValueException

Time in seconds that, by default, an assertion should remain valid. Default value is 120 seconds (2 minutes).

If the value is zero, then assertions have an infinite lifetime. Using assertions with an infinite lifetime is not recommended, however.

Parameters:

newValue - - new value for attribute DefaultTimeToLive

Throws:

InvalidAttributeValueException

Changes take effect after you redeploy the module or restart the server.

Default Value:

120

Minimum Value:

0

getDefaultTimeToLiveOffset

int getDefaultTimeToLiveOffset()

A time factor you can use to allow the Credential Mapper to compensate for clock differences between the Identity Provider and Service Provider sites. The value is a positive or negative integer representing seconds. Default value is -5.

Normally, an assertion is valid from the NotBefore time, which defaults to (roughly) the time the assertion was generated, until the NotOnOrAfter time, which is calculated as (NotBefore + TimeToLive). This value is a positive or negative integer indicating how many seconds before or after "now" the assertions NotBefore should be set to. If you set a value for DefaultTimeToLiveOffset, then the assertion lifetime is still calculated as (NotBefore + TimeToLive), but the NotBefore value is set to (now + TimeToLiveOffset). So, an assertion might have a two minute (120 second) lifetime that starts thirty seconds ago, or starts one minute from now.

Changes take effect after you redeploy the module or restart the server.

Default Value:

-5

setDefaultTimeToLiveOffset

void setDefaultTimeToLiveOffset(int newValue)
                                throws InvalidAttributeValueException

A time factor you can use to allow the Credential Mapper to compensate for clock differences between the Identity Provider and Service Provider sites. The value is a positive or negative integer representing seconds. Default value is -5.

Normally, an assertion is valid from the NotBefore time, which defaults to (roughly) the time the assertion was generated, until the NotOnOrAfter time, which is calculated as (NotBefore + TimeToLive). This value is a positive or negative integer indicating how many seconds before or after "now" the assertions NotBefore should be set to. If you set a value for DefaultTimeToLiveOffset, then the assertion lifetime is still calculated as (NotBefore + TimeToLive), but the NotBefore value is set to (now + TimeToLiveOffset). So, an assertion might have a two minute (120 second) lifetime that starts thirty seconds ago, or starts one minute from now.

Parameters:

newValue - - new value for attribute DefaultTimeToLiveOffset

Throws:

InvalidAttributeValueException

Changes take effect after you redeploy the module or restart the server.

Default Value:

-5

getGenerateAttributes

boolean getGenerateAttributes()

No description provided.

Changes take effect after you redeploy the module or restart the server.

Default Value:

true

setGenerateAttributes

void setGenerateAttributes(boolean newValue)
                           throws InvalidAttributeValueException

No description provided.

Parameters:

newValue - - new value for attribute GenerateAttributes

Throws:

InvalidAttributeValueException

Changes take effect after you redeploy the module or restart the server.

Default Value:

true

getNameMapperClassName

String getNameMapperClassName()

The qualified name of the Java class that maps Subjects to SAML Assertion name information. When no mapper is specified, the default mapper implementation is used.

Changes take effect after you redeploy the module or restart the server.

Default Value:

""

setNameMapperClassName

void setNameMapperClassName(String newValue)
                            throws InvalidAttributeValueException

The qualified name of the Java class that maps Subjects to SAML Assertion name information. When no mapper is specified, the default mapper implementation is used.

Parameters:

newValue - - new value for attribute NameMapperClassName

Throws:

InvalidAttributeValueException

Changes take effect after you redeploy the module or restart the server.

Default Value:

""

getCredCacheSize

int getCredCacheSize()

The size of the cache used to store assertion credentials. If the value is not specified or not a positive number, the cache will have unlimited size. Default value is 0.

The cache stores assertion credentials so that requests for the same assertion may return a result from cache, rather than generate a new assertion. This can improve performance in cases where an application may make multiple requests for the same assertion, for the same user, within a short period of time.

Changes take effect after you redeploy the module or restart the server.

Default Value:

0

Minimum Value:

0

setCredCacheSize

void setCredCacheSize(int newValue)
                      throws InvalidAttributeValueException

The size of the cache used to store assertion credentials. If the value is not specified or not a positive number, the cache will have unlimited size. Default value is 0.

The cache stores assertion credentials so that requests for the same assertion may return a result from cache, rather than generate a new assertion. This can improve performance in cases where an application may make multiple requests for the same assertion, for the same user, within a short period of time.

Parameters:

newValue - - new value for attribute CredCacheSize

Throws:

InvalidAttributeValueException

Changes take effect after you redeploy the module or restart the server.

Default Value:

0

Minimum Value:

0

getCredCacheMinViableTTL

int getCredCacheMinViableTTL()

Minimum time, in seconds, that assertion credentials must be viable before it is eligible to be cached. If an entry in the cache has less time to live than this value, the corresponding assertion will not be used. Instead, a new assertion will be generated. Default value is 20.

This attribute avoids the situation where an assertion is returned from the cache but expires before it can be evaluated at its destination. If the cached assertion's remaining time-to-live is too short, it will not be used.

Changes take effect after you redeploy the module or restart the server.

Default Value:

20

Minimum Value:

0

setCredCacheMinViableTTL

void setCredCacheMinViableTTL(int newValue)
                              throws InvalidAttributeValueException

Minimum time, in seconds, that assertion credentials must be viable before it is eligible to be cached. If an entry in the cache has less time to live than this value, the corresponding assertion will not be used. Instead, a new assertion will be generated. Default value is 20.

This attribute avoids the situation where an assertion is returned from the cache but expires before it can be evaluated at its destination. If the cached assertion's remaining time-to-live is too short, it will not be used.

Parameters:

newValue - - new value for attribute CredCacheMinViableTTL

Throws:

InvalidAttributeValueException

Changes take effect after you redeploy the module or restart the server.

Default Value:

20

Minimum Value:

0

getName

String getName()

Description copied from interface: ProviderMBean

The name of this configuration. WebLogic Server uses an MBean to implement and persist the configuration.

Specified by:

getName in interface ProviderMBean

Specified by:

getName in interface SAML2PartnerRegistryMBean

Specified by:

getName in interface SAML2SPPartnerRegistryMBean

Default Value:

"SAML2CredentialMapper"

setSigningKeyPassPhraseEncrypted

void setSigningKeyPassPhraseEncrypted(byte[] _bytes)

Changes take effect after you redeploy the module or restart the server.

getSigningKeyPassPhraseEncrypted

byte[] getSigningKeyPassPhraseEncrypted()

Changes take effect after you redeploy the module or restart the server.