Examples with SamlResponse com.coveo.saml.SamlResponse used on opensource projects

Example 1 with SamlResponse

use of com.coveo.saml.SamlResponse in project cloud-pipeline by epam.

the class CustomSamlClient method decodeSamlResponse.

/**
 * Decode SAMLResponse with no validation
 * @param encodedResponse the encoded response returned by the identity provider.
 * @return An {@link Response} object containing information decoded from the SAML response.
 * @throws SAMLException
 */
public static Response decodeSamlResponse(String encodedResponse) throws SAMLException {
    String decodedResponse;
    try {
        decodedResponse = new String(Base64.decode(encodedResponse), "UTF-8");
    } catch (UnsupportedEncodingException ex) {
        throw new SAMLException("Cannot decode base64 encoded response", ex);
    }
    logger.trace("Validating SAML response: " + decodedResponse);
    try {
        DOMParser parser = createDOMParser();
        parser.parse(new InputSource(new StringReader(decodedResponse)));
        return (Response) Configuration.getUnmarshallerFactory().getUnmarshaller(parser.getDocument().getDocumentElement()).unmarshall(parser.getDocument().getDocumentElement());
    } catch (IOException | SAXException | UnmarshallingException ex) {
        throw new SAMLException("Cannot decode xml encoded response", ex);
    }
}

Example 2 with SamlResponse

use of com.coveo.saml.SamlResponse in project cloud-pipeline by epam.

the class SAMLProxyFilter method authenticate.

private void authenticate(String samlResponse, Response decoded, String endpointId, ExternalServiceEndpoint endpoint) throws IOException, SAMLException {
    try (FileReader metadataReader = new FileReader(new File(endpoint.getMetadataPath()))) {
        CustomSamlClient client = CustomSamlClient.fromMetadata(endpointId, metadataReader, RESPONSE_SKEW);
        client.setMaxAuthenticationAge(MAX_AUTHENTICATION_AGE);
        SamlResponse parsedResponse = client.validate(decoded);
        String userName = parsedResponse.getNameID().toUpperCase();
        PipelineUser loadedUser = userManager.loadUserByName(userName);
        if (loadedUser == null) {
            throw new UsernameNotFoundException(messageHelper.getMessage(MessageConstants.ERROR_USER_NAME_NOT_FOUND, userName));
        }
        LOGGER.debug("Found user by name {}", userName);
        UserContext userContext = new UserContext(loadedUser);
        userContext.setExternal(endpoint.isExternal());
        SecurityContextHolder.getContext().setAuthentication(new SAMLProxyAuthentication(samlResponse, parsedResponse, userContext));
    }
}

Example 3 with SamlResponse

use of com.coveo.saml.SamlResponse in project cloud-pipeline by epam.

the class CustomSamlClient method validate.

/**
 * Validates SAML response
 * @param response a response to validate
 * @return An {@link SamlResponse} object containing information decoded from the SAML response.
 * @throws SamlException if the signature is invalid, or if any other error occurs.
 */
public SamlResponse validate(Response response) throws SAMLException {
    validateResponse(response);
    validateSignature(response);
    validateIssueTime(response);
    validateAssertion(response);
    validateDestination(response);
    Assertion assertion = response.getAssertions().get(0);
    return new SamlResponse(assertion);
}

Example 4 with SamlResponse

use of com.coveo.saml.SamlResponse in project cloud-pipeline by epam.

the class SAMLProxyFilter method doFilterInternal.

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    if (!urlMatches(request)) {
        filterChain.doFilter(request, response);
        return;
    }
    List<ExternalServiceEndpoint> externalServices = preferenceManager.getPreference(SYSTEM_EXTERNAL_SERVICES_ENDPOINTS);
    if (CollectionUtils.isEmpty(externalServices)) {
        LOGGER.warn(messageHelper.getMessage(MessageConstants.ERROR_PROXY_SECURITY_CONFIG_MISSING));
    } else {
        String samlResponse = request.getParameter("SAMLResponse");
        if (StringUtils.isNotBlank(samlResponse)) {
            try {
                Response decoded = CustomSamlClient.decodeSamlResponse(samlResponse);
                String audience = ListUtils.emptyIfNull(decoded.getAssertions()).stream().findFirst().map(Assertion::getConditions).map(conditions -> ListUtils.emptyIfNull(conditions.getAudienceRestrictions()).stream().findFirst()).flatMap(Function.identity()).map(audienceRestriction -> ListUtils.emptyIfNull(audienceRestriction.getAudiences()).stream().findFirst()).flatMap(Function.identity()).map(Audience::getAudienceURI).orElse(StringUtils.EMPTY);
                LOGGER.debug("Received SAMLResponse for audience: {}", audience);
                Optional<ExternalServiceEndpoint> endpointOpt = externalServices.stream().filter(e -> !StringUtils.EMPTY.equals(audience) && e.getEndpointId().equals(audience)).findFirst();
                if (endpointOpt.isPresent()) {
                    authenticate(samlResponse, decoded, audience, endpointOpt.get());
                }
            } catch (SAMLException e) {
                LOGGER.warn(e.getMessage(), e);
            }
        }
    }
    filterChain.doFilter(request, response);
}