Examples with FSAccountManager com.sun.identity.federation.accountmgmt.FSAccountManager used on opensource projects

Example 1 with FSAccountManager

use of com.sun.identity.federation.accountmgmt.FSAccountManager in project OpenAM by OpenRock.

the class FSDefaultSPAdapter method postSSOFederationSuccess.

/**
     * Invokes this method after the successful Single Sign-On or Federation.
     * @param hostedEntityID provider ID for the hosted SP
     * @param request servlet request
     * @param response servlet response
     * @param ssoToken user's SSO token
     * @param authnRequest the original authentication request sent from SP 
     * @param authnResponse response from IDP if Browser POST or LECP profile
     *        is used for the request, value will be null if Browser Artifact
     *        profile is used. 
     * @param samlResponse response from IDP if Browser Artifact profile is used
     *        for the request, value will be null if Browser POST or LECP 
     *        profile is used.
     * @exception FederationException if user want to fail the process.
     * @return true if browser redirection happened, false otherwise.
     */
public boolean postSSOFederationSuccess(String hostedEntityID, HttpServletRequest request, HttpServletResponse response, Object ssoToken, FSAuthnRequest authnRequest, FSAuthnResponse authnResponse, FSResponse samlResponse) throws FederationException {
    if (FSUtils.debug.messageEnabled()) {
        FSUtils.debug.message("FSDefaultSPAdapter.postFedSuccess, " + "process " + hostedEntityID);
    }
    // find out if this is a federation request
    boolean isFederation = false;
    if (authnRequest == null) {
        FSUtils.debug.error("FSDefaultSPAdapter.postFedSuccess null");
    } else {
        String nameIDPolicy = authnRequest.getNameIDPolicy();
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("FSDefaultSPAdapter.postSuccess " + nameIDPolicy);
        }
        if (nameIDPolicy.equals(IFSConstants.NAME_ID_POLICY_FEDERATED)) {
            isFederation = true;
        }
    }
    SSOToken adminToken = (SSOToken) AccessController.doPrivileged(AdminTokenAction.getInstance());
    if (isFederation && adminToken != null) {
        try {
            // get name Identifier
            String nameId = null;
            List assertions = null;
            String idpEntityId = null;
            if (authnResponse != null) {
                // POST profile
                assertions = authnResponse.getAssertion();
                idpEntityId = authnResponse.getProviderId();
            } else {
                // Artifact profile
                assertions = samlResponse.getAssertion();
            }
            FSAssertion assertion = (FSAssertion) assertions.iterator().next();
            if (idpEntityId == null) {
                idpEntityId = assertion.getIssuer();
            }
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("FSAdapter.postSuccess: idp=" + idpEntityId);
            }
            Iterator stmtIter = assertion.getStatement().iterator();
            while (stmtIter.hasNext()) {
                Statement statement = (Statement) stmtIter.next();
                int stmtType = statement.getStatementType();
                if (stmtType == Statement.AUTHENTICATION_STATEMENT) {
                    FSAuthenticationStatement authStatement = (FSAuthenticationStatement) statement;
                    FSSubject subject = (FSSubject) authStatement.getSubject();
                    NameIdentifier ni = subject.getIDPProvidedNameIdentifier();
                    if (ni == null) {
                        ni = subject.getNameIdentifier();
                    }
                    if (ni != null) {
                        nameId = ni.getName();
                    }
                    if (FSUtils.debug.messageEnabled()) {
                        FSUtils.debug.message("FSAdapter.postSuccess: " + "found name id =" + nameId);
                    }
                    break;
                }
            }
            if (nameId == null) {
                FSUtils.debug.warning("FSAdapter.postSuc : null nameID");
                return false;
            }
            Map map = new HashMap();
            Set set = new HashSet();
            set.add("|" + hostedEntityID + "|" + nameId + "|");
            map.put("iplanet-am-user-federation-info-key", set);
            AMIdentityRepository idRepo = new AMIdentityRepository(adminToken, ((SSOToken) ssoToken).getProperty(ISAuthConstants.ORGANIZATION));
            IdSearchControl searchControl = new IdSearchControl();
            searchControl.setTimeOut(0);
            searchControl.setMaxResults(0);
            searchControl.setAllReturnAttributes(false);
            searchControl.setSearchModifiers(IdSearchOpModifier.AND, map);
            IdSearchResults searchResults = idRepo.searchIdentities(IdType.USER, "*", searchControl);
            Set amIdSet = searchResults.getSearchResults();
            if (amIdSet.size() > 1) {
                String univId = ((SSOToken) ssoToken).getProperty(Constants.UNIVERSAL_IDENTIFIER);
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("FSAdapter.postSuccess: found " + amIdSet.size() + " federation with same ID as " + univId);
                }
                String metaAlias = null;
                try {
                    IDFFMetaManager metaManager = new IDFFMetaManager(ssoToken);
                    if (metaManager != null) {
                        SPDescriptorConfigElement spConfig = metaManager.getSPDescriptorConfig(realm, hostedEntityID);
                        if (spConfig != null) {
                            metaAlias = spConfig.getMetaAlias();
                        }
                    }
                } catch (IDFFMetaException ie) {
                    if (FSUtils.debug.messageEnabled()) {
                        FSUtils.debug.message("FSAdapter.postSuccess: " + "couldn't find meta alias:", ie);
                    }
                }
                FSAccountManager accManager = FSAccountManager.getInstance(metaAlias);
                FSAccountFedInfoKey fedInfoKey = new FSAccountFedInfoKey(hostedEntityID, nameId);
                // previous federation exists with different users
                Iterator it = amIdSet.iterator();
                while (it.hasNext()) {
                    AMIdentity amId = (AMIdentity) it.next();
                    // compare with the SSO token
                    String tmpUnivId = IdUtils.getUniversalId(amId);
                    if (univId.equalsIgnoreCase(tmpUnivId)) {
                        continue;
                    }
                    // remove federation information for this user
                    if (FSUtils.debug.messageEnabled()) {
                        FSUtils.debug.message("FSAdapter.postSucces, " + "remove fed info for user " + tmpUnivId);
                    }
                    accManager.removeAccountFedInfo(tmpUnivId, fedInfoKey, idpEntityId);
                }
            }
        } catch (FSAccountMgmtException f) {
            FSUtils.debug.warning("FSDefaultSPAdapter.postSSOSuccess", f);
        } catch (IdRepoException i) {
            FSUtils.debug.warning("FSDefaultSPAdapter.postSSOSuccess", i);
        } catch (SSOException e) {
            FSUtils.debug.warning("FSDefaultSPAdapter.postSSOSuccess", e);
        }
    }
    return false;
}

Example 2 with FSAccountManager

use of com.sun.identity.federation.accountmgmt.FSAccountManager in project OpenAM by OpenRock.

the class FSSSOAndFedService method handleAuthnRequest.

private void handleAuthnRequest(HttpServletRequest request, HttpServletResponse response, FSAuthnRequest authnRequest, String realm, String hostEntityId, boolean bLECP, String authnContext) {
    // post authn process
    FSUtils.debug.message("FSSSOAndFedService.handleAuthnRequest: Called");
    IDPDescriptorType hostedDesc = null;
    BaseConfigType hostedConfig = null;
    String metaAlias = null;
    try {
        hostedDesc = metaManager.getIDPDescriptor(realm, hostEntityId);
        hostedConfig = metaManager.getIDPDescriptorConfig(realm, hostEntityId);
        if (hostedConfig != null) {
            metaAlias = hostedConfig.getMetaAlias();
        }
    } catch (Exception e) {
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("FSSSOAndFedService.handleAuthnRequest: " + "Couldn't obtain hosted meta:", e);
        }
    }
    /* Not really useful.
        String nameRegisDone = 
            request.getParameter(IFSConstants.NAMEREGIS_INDICATOR_PARAM);
        boolean doNameRegis = false;
        String doNameRegisStr = 
            IDFFMetaUtils.getFirstAttributeValueFromConfig(
                hostedConfig, IFSConstants.ENABLE_REGISTRATION_AFTER_SSO);
        if (doNameRegisStr != null && doNameRegisStr.equalsIgnoreCase("true")) {
            doNameRegis = true;
        }
        */
    Object ssoToken = null;
    String userID = null;
    try {
        SessionProvider sessionProvider = SessionManager.getProvider();
        ssoToken = sessionProvider.getSession(request);
        if (ssoToken == null) {
            FSUtils.debug.error("FSSSOAndFedService.handleAuthnRequest: " + "session token is null.");
            return;
        } else if (!sessionProvider.isValid(ssoToken)) {
            FSUtils.debug.error("FSSSOAndFedService.handleAuthnRequest: " + "session token is not valid.");
            return;
        } else {
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("FSSSOAndFedService.handleAuthnRequest: " + "session token is valid.");
            }
        }
        FSSessionManager sessionManager = FSSessionManager.getInstance(metaAlias);
        FSSession session = sessionManager.getSession(ssoToken);
        userID = sessionProvider.getPrincipalName(ssoToken);
        if (session == null) {
            session = new FSSession(sessionProvider.getSessionID(ssoToken));
            session.setAuthnContext(authnContext);
            sessionManager.addSession(userID, session);
        } else {
            session.setAuthnContext(authnContext);
        }
    } catch (SessionException se) {
        FSUtils.debug.error("FSSSOAndFedService.handleAuthnRequest: ", se);
        return;
    }
    try {
        if (userID == null) {
            LogUtil.error(Level.INFO, LogUtil.USER_NOT_FOUND, null, ssoToken);
            return;
        }
        String remoteEntityID = authnRequest.getProviderId();
        FSAccountManager acctMng = FSAccountManager.getInstance(metaAlias);
        acctMng.readAccountFedInfo(userID, remoteEntityID);
    /* Not useful at all.  Commented out for now.
            if (doNameRegis &&
                (nameRegisDone == null || 
                    !nameRegisDone.equals(IFSConstants.TRUE)) && 
                !authnRequest.getFederate()) 
            {
                // have to do nameregis now 
                Map queryMap = new HashMap();
                queryMap.put(IFSConstants.AUTH_REQUEST_ID,
                    authnRequest.getRequestID());
                queryMap.put(IFSConstants.PROVIDER_ID_KEY,hostEntityId);
                queryMap.put(IFSConstants.AUTHN_CONTEXT,authnContext);
                FSServiceManager instSManager = FSServiceManager.getInstance();
                if (instSManager != null) {
                    if (FSUtils.debug.messageEnabled()) {
                        FSUtils.debug.message(
                            "FSSSOAndFedService.handleAuthnRequest:" +
                            "FSServiceManager Instance not null");
                    }
                    try {
                        FSNameRegistrationHandler handlerObj = 
                            instSManager.getNameRegistrationHandler(
                                realm, remoteEntityID, IFSConstants.SP); 
                        SPDescriptorType remoteProviderDesc = 
                            metaManager.getSPDescriptor(realm,remoteEntityID);
                        if (handlerObj != null) {
                            handlerObj.setHostedDescriptor(hostedDesc);
                            handlerObj.setHostedDescriptorConfig(hostedConfig);
                            handlerObj.setMetaAlias(metaAlias);
                            handlerObj.setHostedEntityId(hostEntityId);
                            handlerObj.handleNameRegistration(
                                request,
                                response, 
                                ssoToken,
                                (HashMap)queryMap);
                            if (FSUtils.debug.messageEnabled()) {
                                FSUtils.debug.message(
                                    "FSSSOAndFedService.handleAuthnRequest:" +
                                    "Control returned from name registration");
                            }
                            if (!FSServiceUtils.isRegisProfileSOAP(userID,
                                            remoteEntityID,
                                            remoteProviderDesc,
                                            metaAlias,
                                            hostedDesc))
                            {
                                return;
                            }
                        }
                    } catch (Exception ex){
                        FSUtils.debug.error(
                            "FSSSOAndFedService.handleAuthnRequest:Error in " +
                            "invoking Name registration. returning.", ex);
                        return;
                    }
                }
            }
            */
    } catch (FSAccountMgmtException exp) {
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("FSSSOAndFedService:: handleAuthnRequest()" + " No account information avialable for user. " + "So no invocation " + " of name registration. ", exp);
        }
    }
    handleAuthnRequest(request, response, authnRequest, true, bLECP, realm, hostEntityId, metaAlias, hostedDesc, hostedConfig);
}

Example 3 with FSAccountManager

use of com.sun.identity.federation.accountmgmt.FSAccountManager in project OpenAM by OpenRock.

the class FSLogoutUtil method getUserFromRequest.

/**
     * Determines the user name from the logout request.
     * @param reqLogout the logout rerquest received
     * @param realm the realm under which the entity resides
     * @param hostedEntityId the hosted provider performing logout
     * @param hostedRole the role of the hosted provider
     * @param hostedConfig extended meta config for hosted provider
     * @param metaAlias hosted provider's meta alias
     * @return user id if the user is found; <code>null</code> otherwise.
     */
public static String getUserFromRequest(FSLogoutNotification reqLogout, String realm, String hostedEntityId, String hostedRole, BaseConfigType hostedConfig, String metaAlias) {
    FSAccountManager accountInst = null;
    try {
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("Realm : " + realm + ", entityID : " + hostedEntityId);
        }
        accountInst = FSAccountManager.getInstance(metaAlias);
    } catch (FSAccountMgmtException fe) {
        FSUtils.debug.message("In FSAccountManagementException :: cannot" + " get account manager:" + fe);
        return null;
    }
    try {
        // User Name needs to be figured from logout request
        String opaqueHandle = (reqLogout.getNameIdentifier()).getName().trim();
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("Name : " + opaqueHandle);
        }
        String associatedDomain = (reqLogout.getNameIdentifier().getNameQualifier()).trim();
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("Name Qualifier : " + associatedDomain);
        }
        if ((associatedDomain == null) || (associatedDomain.length() == 0) || associatedDomain.equals(reqLogout.getProviderId())) {
            associatedDomain = hostedEntityId;
        }
        // Get userDN
        FSAccountFedInfoKey acctkey = null;
        // remote domain(SP) first
        if (hostedRole.equalsIgnoreCase(IFSConstants.SP)) {
            acctkey = new FSAccountFedInfoKey(associatedDomain, opaqueHandle);
        } else {
            acctkey = new FSAccountFedInfoKey(reqLogout.getProviderId(), opaqueHandle);
        }
        Map env = new HashMap();
        env.put(IFSConstants.FS_USER_PROVIDER_ENV_LOGOUT_KEY, reqLogout);
        String userID = accountInst.getUserID(acctkey, realm, env);
        if (userID == null) {
            // for backward compitability
            if (hostedRole.equalsIgnoreCase(IFSConstants.SP)) {
                acctkey = new FSAccountFedInfoKey(reqLogout.getProviderId(), opaqueHandle);
            } else {
                acctkey = new FSAccountFedInfoKey(associatedDomain, opaqueHandle);
            }
            userID = accountInst.getUserID(acctkey, realm, env);
        }
        if (userID == null) {
            FSUtils.debug.message("UserID is null");
            return null;
        }
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("user id is " + userID);
        }
        return userID;
    } catch (FSAccountMgmtException e) {
        FSUtils.debug.message("In FSAccountMgmtException :: ", e);
        return null;
    }
}

Example 4 with FSAccountManager

use of com.sun.identity.federation.accountmgmt.FSAccountManager in project OpenAM by OpenRock.

the class FSLogoutUtil method getCurrentWorkingAccount.

/**
     * Returns the <code>FSAccountFedInfo</code> object for the given 
     * principal and provider Id.
     * @param userID principal whose working account we want to retrieve
     * @param entityID the provider Id to whom logout notification needs to 
     *  be sent
     * @param metaAlias hosted provider's meta alias
     * @return account object for the given user, provider
     */
protected static FSAccountFedInfo getCurrentWorkingAccount(String userID, String entityID, String metaAlias) {
    try {
        FSAccountManager accountInst = FSAccountManager.getInstance(metaAlias);
        if (metaManager != null) {
            try {
                String realm = IDFFMetaUtils.getRealmByMetaAlias(metaAlias);
                Set affiliates = metaManager.getAffiliateEntity(realm, entityID);
                if (affiliates != null && !affiliates.isEmpty()) {
                    Iterator iter = affiliates.iterator();
                    while (iter.hasNext()) {
                        AffiliationDescriptorType desc = (AffiliationDescriptorType) iter.next();
                        String affiliationID = desc.getAffiliationID();
                        FSAccountFedInfo accountInfo = accountInst.readAccountFedInfo(userID, affiliationID);
                        if ((accountInfo != null) && (accountInfo.isFedStatusActive())) {
                            return accountInfo;
                        }
                    }
                } else {
                    if (FSUtils.debug.messageEnabled()) {
                        FSUtils.debug.message("FSLogoutUtil.getCurrent" + "WorkingAccount: No affiliations");
                    }
                }
            } catch (Exception ex) {
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("FSLogoutUtil.getCurrentWorking" + "Account. No Affiliation for:" + entityID, ex);
                }
            }
            FSAccountFedInfo acctInfo = accountInst.readAccountFedInfo(userID, entityID);
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("FSLogoutUtil::" + "getCurrentWorkingAccount after readAccountFedInfo");
            }
            return acctInfo;
        } else {
            return null;
        }
    } catch (Exception e) {
        FSUtils.debug.error("FSLogoutUtil::getCurrentWorkingAccount" + " readAccountFedInfo failed", e);
    }
    return null;
}

Example 5 with FSAccountManager

use of com.sun.identity.federation.accountmgmt.FSAccountManager in project OpenAM by OpenRock.

the class FSServiceManager method getFedTerminationHandler.

/*
     * Returns federation termination handler. This method is invoked at the
     * end where the termination is initiated. The handler is responsible
     * for doing account defederation locally and then invoking termination at
     * remote provider end.
     * @param remoteEntityId provider with whom termination needs to be done
     * @param remoteProviderRole role of remote provider
     * @param userID user who is terminating federation with remote provider
     * @param realm the realm under which the entity resides
     * @param hostedEntityId hosted provider's entity id
     * @param metaAlias hosted provider's meta alias
     * @return <code>FSFedTerminationHandler</code> object
     */
public FSFedTerminationHandler getFedTerminationHandler(String remoteEntityId, String remoteProviderRole, String userID, String realm, String hostEntityId, String metaAlias) {
    try {
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("Entered FSServicemanager::" + " getFedTerminationHandler");
        }
        // check for null
        FSFedTerminationHandler handlerTermination = null;
        IDFFMetaManager metaManager = FSUtils.getIDFFMetaManager();
        FSAccountManager managerInst = FSAccountManager.getInstance(metaAlias);
        if (metaManager == null || managerInst == null) {
            FSUtils.debug.message("Error in retrieving meta, account manager");
            return null;
        }
        FSAccountFedInfo acctInfo = managerInst.readAccountFedInfo(userID, remoteEntityId);
        if (acctInfo == null) {
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("Account federation with provider " + remoteEntityId + " does not exist");
            }
            return null;
        }
        // Pass USERDN TO HANDLER to AVOID SEARCH AGAIN
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("FSServiceManager.getFedTermination" + "Handler: remoteEntityID = " + remoteEntityId + " remoteProviderRole = " + remoteProviderRole);
        }
        handlerTermination = new FSFedTerminationHandler();
        if (handlerTermination != null) {
            ProviderDescriptorType remoteDesc = null;
            if (remoteProviderRole.equalsIgnoreCase(IFSConstants.IDP)) {
                remoteDesc = metaManager.getIDPDescriptor(realm, remoteEntityId);
            } else {
                remoteDesc = metaManager.getSPDescriptor(realm, remoteEntityId);
            }
            handlerTermination.setRemoteDescriptor(remoteDesc);
            handlerTermination.setRemoteEntityId(remoteEntityId);
            handlerTermination.setUserID(userID);
            handlerTermination.setAccountInfo(acctInfo);
            return handlerTermination;
        } else {
            FSUtils.debug.message("Termination Handler is null");
            return null;
        }
    } catch (Exception e) {
        FSUtils.debug.error("FSServiceManager::getFedTerminationHandler " + "failed to get termination handler");
    }
    return null;
}