String metadataUrl = (String) buildDefaultUrlMethod.invoke(authenticator, "/sso/metadata");
            assertEquals("https://fess.example.com/sso/metadata", metadataUrl);

            // Test ACS endpoint
            String acsUrl = (String) buildDefaultUrlMethod.invoke(authenticator, "/sso/");
            assertEquals("https://fess.example.com/sso/", acsUrl);

            // Test SLO endpoint

        Exception cause = new IllegalArgumentException("Invalid SSO token");
        SsoLoginException exception = new SsoLoginException("SSO error", cause);

        Throwable retrievedCause = exception.getCause();
        assertNotNull(retrievedCause);
        assertSame(cause, retrievedCause);
        assertEquals("Invalid SSO token", retrievedCause.getMessage());
    }

    @Test

        Exception rootCause = new Exception("Network timeout");
        Exception middleCause = new Exception("SSO provider unreachable", rootCause);
        SsoProcessException topException = new SsoProcessException("SSO authentication failed", middleCause);

        assertEquals("SSO authentication failed", topException.getMessage());
        assertEquals(middleCause, topException.getCause());

import org.lastaflute.web.response.ActionResponse;

/**
 * Manager class for coordinating SSO (Single Sign-On) authentication operations.
 *
 * This class serves as the central coordinator for SSO authentication in Fess.
 * It manages registered SSO authenticators, determines when SSO is available,
 * and delegates authentication operations to the appropriate SSO provider based
 * on the current configuration.
 */
public class SsoManager {

 */
package org.codelibs.fess.exception;

/**
 * Exception thrown when SSO (Single Sign-On) login operations fail.
 *
 * This exception is used to indicate various SSO authentication failures
 * including configuration errors, authentication token validation failures,
 * communication issues with SSO providers, and other SSO-related problems.
 */
public class SsoLoginException extends FessSystemException {

 */
package org.codelibs.fess.exception;

/**
 * Exception thrown during SSO (Single Sign-On) processing operations.
 *
 * This exception is used to indicate errors that occur during the execution
 * of SSO authentication and authorization processes. It extends FessSystemException
 * to provide consistent error handling within the Fess system for SSO-related
 * processing failures such as token validation errors, communication failures

├── helper/                    # Cross-cutting utilities (~40+ helpers)
├── crawler/                   # Crawling engine (processor, transformer, service)
├── sso/                       # SSO implementations (oic, saml, spnego, entraid)
├── auth/                      # Authentication management
├── ldap/                      # LDAP integration
├── filter/                    # Servlet filters

        // IPv6 with port and path
        InetAddress ipv6 = InetAddress.getByName("::1");
        assertEquals("http://[::1]:8080/sso/metadata", IpAddressUtil.buildUrl("http", ipv6, 8080, "/sso/metadata"));

        // IPv6 with port, no path
        assertEquals("http://[::1]:9200", IpAddressUtil.buildUrl("http", ipv6, 9200, ""));

        // IPv6 without port

        // Use legacy "aad" SSO type
        currentSsoType = "aad";
        ssoManager = new SsoManager() {
            @Override
            protected String getSsoType() {
                return currentSsoType;
            }
        };

        // Verify that "aad" SSO type resolves to "entraidAuthenticator"

 * saml.sp.entityid=https://your-fess-server.example.com/sso/metadata
 *
 * # Assertion Consumer Service URL
 * saml.sp.assertion_consumer_service.url=https://your-fess-server.example.com/sso/
 *
 * # Single Logout Service URL
 * saml.sp.single_logout_service.url=https://your-fess-server.example.com/sso/logout
 * </pre>
 *
 * <h2>Complete Configuration Example (Okta)</h2>
 * <pre>
 * sso.type=saml
 *