SAML APIs 9-25
Use the WebLogic Server Administration Console to configure the User Name Mapper class name to the fully-qualified class name of this mapper implementation, as
described in Section 9.4.8, Make the Custom SAML Credential Attribute Mapper
Class Available in the Console .
The attributes encapsulated in the collection of SAMLAttributeStatementInfo objects returned by the custom mapper implementation are included in the generated
assertions by the SAML 1.1 Credential Mapping provider.
9.4.7.2 Custom SAML 1.1 Identity Asserter Attribute Mapper
Example 9–9 shows an example implementation of
SAMLIdentityAssertionNameMapper and SAMLIdentityAssertionAttributeMapper.
Example 9–9 Custom SAML 1.1 Identity Asserter Attribute Mapper
public class CustomIdentityAssertionAttributeMapperImpl implements SAMLIdentityAssertionNameMapper, SAMLIdentityAssertionAttributeMapper {
public String mapNameInfoSAMLNameMapperInfo info, ContextHandler handler { Get the user name ...
String userName = info.getName; System.out
.printlnCustomIdentityAssertionAttributeMapperImpl:mapNameInfo: returning name:
+ userName; return userName;
}
: public void mapAttributeInfo
CollectionSAMLAttributeStatementInfo attrStmtInfos, ContextHandler contextHandler {
if attrStmtInfos == null || attrStmtInfos.size == 0 { System.out
.printlnCustomIAAttributeMapperImpl: attrStmtInfos has no elements; return;
} :
Object obj = contextHandler .getValueContextElementDictionary.SAML_ATTRIBUTE_ PRINCIPALS;
if obj == null || obj instanceof Collection { System.out.printlnCustomIAAttributeMapperImpl: cant get
+ ContextElementDictionary.SAML_ATTRIBUTE_PRINCIPALS + from context handler;
return; }
: CollectionPrincipal pals = CollectionPrincipal obj;
for SAMLAttributeStatementInfo stmtInfo : attrStmtInfos { CollectionSAMLAttributeInfo attrs = stmtInfo.getAttributeInfo;
if attrs == null || attrs.size == 0 { System.out
.printlnCustomIAAttributeMapperImpl: no attribute in statement: + stmtInfo.toString;
} else { for SAMLAttributeInfo attr : attrs {
CustomPrincipal pal = new CustomPrincipalattr.getAttributeName,
9-26 Programming Security for Oracle WebLogic Server
attr.getAttributeNamespace, attr.getAttributeValues; pals.addpal;
} }
} }
The SAML 1.1 IdentityAssertion provider makes the attributes from a SAML assertion available to consumers via the subject.
Use the WebLogic Server Administration Console to configure the User Name Mapper class name to the fully-qualified class name of this mapper implementation, as
described in Section 9.4.9, Make the Custom SAML Identity Asserter Class Available
in the Console .
If you are allowing virtual users to log in via SAML, you need to create and configure an instance of the SAML Authentication provider. For information, see Configuring
the SAML Authentication Provider.
If the virtual user is enabled and SAML Authenticator provider configured, the attributes returned by the custom attribute mapper are added into the subject.
The attributes returned by the mapper are stored as subject principals or private credentials, depending on the class type of the mapped attributes. Specifically, if the
mapper returns a collection of Principal objects, the mapped attributes are stored into the subject principal set. Otherwise, the subject private credential set is used to
carry the mapped attributes.
Your application code needs to know the class type of the object that the mapper uses to represent attributes added to the subject. Applications can retrieve the SAML
attributes from the subject private credential or principal set, given the class type that the customer attribute mapper uses to represent the attributes.
9.4.8 Make the Custom SAML Credential Attribute Mapper Class Available in the Console
