Examples with FSLogoutNotification com.sun.identity.federation.message.FSLogoutNotification used on opensource projects

Example 1 with FSLogoutNotification

use of com.sun.identity.federation.message.FSLogoutNotification in project OpenAM by OpenRock.

the class FSSOAPReceiver method onMessage.

/**
     * Process the request.
     * @param request http request object
     * @param response http response object
     * @param message received soap message
     */
public void onMessage(HttpServletRequest request, HttpServletResponse response, SOAPMessage message) {
    FSUtils.debug.message("FSSOAPReceiver.onMessage: Called");
    try {
        Element elt = soapService.parseSOAPMessage(message);
        if (elt == null) {
            FSUtils.debug.error("FSSOAPReceiver.onMessage: " + "Error in processing saml:Request. Invalid SOAPMessage");
            response.setStatus(response.SC_INTERNAL_SERVER_ERROR);
            returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
            return;
        }
        String eltTagName = (elt.getTagName().trim());
        String ns = elt.getNamespaceURI().trim();
        String nodeName = elt.getLocalName().trim();
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("FSSOAPReceiver.onMessage: " + "tagName: " + eltTagName + " namespaceUri: " + ns + " localName: " + nodeName);
        }
        //check for saml:Request
        if (nodeName.equalsIgnoreCase("Request") && ns.equalsIgnoreCase(IFSConstants.PROTOCOL_NAMESPACE_URI)) {
            SOAPMessage retMessage = null;
            try {
                FSSAMLRequest samlRequest = new FSSAMLRequest(elt);
                IDFFMetaManager metaManager = FSUtils.getIDFFMetaManager();
                if (metaManager == null) {
                    FSUtils.debug.error("FSSOAPReceiver.onMessage: " + "could not create meta instance");
                    response.setStatus(response.SC_INTERNAL_SERVER_ERROR);
                    returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
                    return;
                }
                String metaAlias = FSServiceUtils.getMetaAlias(request);
                String realm = IDFFMetaUtils.getRealmByMetaAlias(metaAlias);
                String hostedEntityId = metaManager.getEntityIDByMetaAlias(metaAlias);
                IDPDescriptorType hostedDesc = metaManager.getIDPDescriptor(realm, hostedEntityId);
                BaseConfigType hostedConfig = metaManager.getIDPDescriptorConfig(realm, hostedEntityId);
                FSServiceManager sm = FSServiceManager.getInstance();
                FSSSOBrowserArtifactProfileHandler handler = (FSSSOBrowserArtifactProfileHandler) sm.getBrowserArtifactSSOAndFedHandler(request, response, samlRequest);
                handler.setSOAPMessage(message);
                handler.setSAMLRequestElement(elt);
                handler.setHostedEntityId(hostedEntityId);
                handler.setHostedDescriptor(hostedDesc);
                handler.setHostedDescriptorConfig(hostedConfig);
                handler.setMetaAlias(metaAlias);
                handler.setRealm(realm);
                FSResponse samlResponse = handler.processSAMLRequest(samlRequest);
                if (samlResponse != null) {
                    if (FSUtils.debug.messageEnabled()) {
                        FSUtils.debug.message("FSSOAPReceiver.onMessage: " + "SAML Response created: " + samlResponse.toXMLString());
                    }
                } else {
                    FSUtils.debug.error("FSSOAPReceiver.onMessage: " + "SAML Response is null");
                    response.setStatus(response.SC_INTERNAL_SERVER_ERROR);
                    returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
                    return;
                }
                // introduce id attribute for Assertion bind in 
                // SOAPEnvelope and sign
                retMessage = soapService.bind(((FSResponse) samlResponse).toXMLString(true, true));
                if (FSServiceUtils.isSigningOn()) {
                    List assList = samlResponse.getAssertion();
                    Iterator iter = assList.iterator();
                    while (iter.hasNext()) {
                        FSAssertion assertion = (FSAssertion) iter.next();
                        String id = assertion.getID();
                        Document doc = (Document) FSServiceUtils.createSOAPDOM(retMessage);
                        String certAlias = IDFFMetaUtils.getFirstAttributeValueFromConfig(hostedConfig, IFSConstants.SIGNING_CERT_ALIAS);
                        if (certAlias == null) {
                            if (FSUtils.debug.messageEnabled()) {
                                FSUtils.debug.message("SOAPReceiver.onMessage: couldn't " + "obtain this site's cert alias.");
                            }
                            throw new SAMLResponderException(FSUtils.bundle.getString("cannotFindCertAlias"));
                        }
                        XMLSignatureManager manager = XMLSignatureManager.getInstance();
                        int minorVersion = assertion.getMinorVersion();
                        if (minorVersion == IFSConstants.FF_11_ASSERTION_MINOR_VERSION) {
                            manager.signXML(doc, certAlias, SystemConfigurationUtil.getProperty(SAMLConstants.XMLSIG_ALGORITHM), IFSConstants.ID, id, false);
                        } else if (minorVersion == IFSConstants.FF_12_POST_ASSERTION_MINOR_VERSION || minorVersion == IFSConstants.FF_12_ART_ASSERTION_MINOR_VERSION) {
                            manager.signXML(doc, certAlias, SystemConfigurationUtil.getProperty(SAMLConstants.XMLSIG_ALGORITHM), IFSConstants.ASSERTION_ID, assertion.getAssertionID(), false);
                        } else {
                            FSUtils.debug.error("invalid minor version.");
                        }
                        retMessage = FSServiceUtils.convertDOMToSOAP(doc);
                    }
                }
                if (retMessage == null) {
                    FSUtils.debug.error("FSSOAPReceiver.onMessage: " + "Error in processing saml:Request");
                    response.setStatus(response.SC_INTERNAL_SERVER_ERROR);
                    returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
                    return;
                }
            } catch (SAMLException se) {
                FSUtils.debug.error("FSSOAPReceiver.onMessage: " + "Error in processing saml:Request:", se);
                response.setStatus(response.SC_INTERNAL_SERVER_ERROR);
                returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
                return;
            } catch (IDFFMetaException me) {
                FSUtils.debug.error("FSSOAPReceiver.onMessage: " + "Error in processing saml:Request:", me);
                response.setStatus(response.SC_INTERNAL_SERVER_ERROR);
                returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
                return;
            }
            returnSOAPMessage(retMessage, response);
            return;
        }
        if (nodeName.equalsIgnoreCase("AuthnRequest") && (ns.equalsIgnoreCase(IFSConstants.libertyMessageNamespaceURI) || ns.equalsIgnoreCase(IFSConstants.FF_12_XML_NS))) {
            SOAPMessage retMessage = null;
            try {
                FSAuthnRequest authnRequest = new FSAuthnRequest(elt);
                handleLECPRequest(request, response, authnRequest);
                retMessage = null;
            } catch (FSException e) {
                FSUtils.debug.error("FSSOAPReceiver.onMessage: " + "Error in processing lecp AuthnRequest:", e);
                response.setStatus(response.SC_INTERNAL_SERVER_ERROR);
                returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
                return;
            }
            returnSOAPMessage(retMessage, response);
            return;
        } else if (nodeName.equalsIgnoreCase("RegisterNameIdentifierRequest") && (ns.equalsIgnoreCase(IFSConstants.libertyMessageNamespaceURI) || ns.equalsIgnoreCase(IFSConstants.FF_12_XML_NS))) {
            SOAPMessage retMessage = null;
            boolean isError = false;
            String providerAlias = null;
            ProviderDescriptorType hostedProviderDesc = null;
            BaseConfigType hostedConfig = null;
            String realm = null;
            String hostedEntityId = null;
            String hostedRole = null;
            try {
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("FSSOAPReceiver.onMessage: " + "Handling NameRegistrationRequest");
                }
                IDFFMetaManager metaManager = FSUtils.getIDFFMetaManager();
                if (metaManager == null) {
                    FSUtils.debug.message("Unable to get meta manager");
                    isError = true;
                } else {
                    providerAlias = FSServiceUtils.getMetaAlias(request);
                    if (providerAlias == null || providerAlias.length() < 1) {
                        if (FSUtils.debug.messageEnabled()) {
                            FSUtils.debug.message("Unable to retrieve alias" + "Hosted Provider. Cannot process request");
                        }
                        isError = true;
                    }
                    realm = IDFFMetaUtils.getRealmByMetaAlias(providerAlias);
                    try {
                        hostedRole = metaManager.getProviderRoleByMetaAlias(providerAlias);
                        hostedEntityId = metaManager.getEntityIDByMetaAlias(providerAlias);
                        if (hostedRole != null && hostedRole.equals(IFSConstants.IDP)) {
                            hostedProviderDesc = metaManager.getIDPDescriptor(realm, hostedEntityId);
                            hostedConfig = metaManager.getIDPDescriptorConfig(realm, hostedEntityId);
                        } else if (hostedRole != null && hostedRole.equals(IFSConstants.SP)) {
                            hostedProviderDesc = metaManager.getSPDescriptor(realm, hostedEntityId);
                            hostedConfig = metaManager.getSPDescriptorConfig(realm, hostedEntityId);
                        }
                        if (hostedProviderDesc == null) {
                            throw new IDFFMetaException((String) null);
                        }
                    } catch (IDFFMetaException eam) {
                        FSUtils.debug.error("Unable to find Hosted Provider. " + "Cannot process request");
                        isError = true;
                    }
                }
                if (isError || hostedProviderDesc == null) {
                    returnSOAPMessage(retMessage, response);
                    return;
                } else {
                    FSNameRegistrationResponse regisResponse = handleRegistrationRequest(elt, message, hostedProviderDesc, hostedConfig, hostedRole, realm, hostedEntityId, providerAlias, request, response);
                    if (regisResponse == null) {
                        FSUtils.debug.error("Error in creating NameRegistration Response");
                        response.setStatus(response.SC_INTERNAL_SERVER_ERROR);
                        retMessage = soapService.formSOAPError("Server", "cannotProcessRequest", null);
                    } else {
                        if (FSUtils.debug.messageEnabled()) {
                            FSUtils.debug.message("FSSOAPReceiver.onMessage: " + "Completed creating response");
                        }
                        retMessage = soapService.bind(regisResponse.toXMLString(true, true));
                        FSUtils.debug.message("Completed bind message");
                        if (retMessage == null) {
                            FSUtils.debug.error("Error in processing NameRegistration " + "Response");
                            response.setStatus(response.SC_INTERNAL_SERVER_ERROR);
                            retMessage = soapService.formSOAPError("Server", "cannotProcessRequest", null);
                        } else {
                            if (FSServiceUtils.isSigningOn()) {
                                try {
                                    int minorVersion = regisResponse.getMinorVersion();
                                    if (minorVersion == IFSConstants.FF_11_PROTOCOL_MINOR_VERSION) {
                                        retMessage = signResponse(retMessage, IFSConstants.ID, regisResponse.getID(), hostedConfig);
                                    } else if (minorVersion == IFSConstants.FF_12_PROTOCOL_MINOR_VERSION) {
                                        retMessage = signResponse(retMessage, IFSConstants.RESPONSE_ID, regisResponse.getResponseID(), hostedConfig);
                                    } else {
                                        if (FSUtils.debug.messageEnabled()) {
                                            FSUtils.debug.message("invalid minor version.");
                                        }
                                    }
                                } catch (SAMLException e) {
                                    FSUtils.debug.error("FSNameRegistrationHandler:" + "sign soap Response failed", e);
                                    returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
                                    return;
                                } catch (FSMsgException e) {
                                    FSUtils.debug.error("FSNameRegistrationHandler::" + "signRegistrationResponse failed", e);
                                    returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
                                    return;
                                }
                            }
                        }
                    }
                }
                if (FSUtils.debug.messageEnabled()) {
                    ByteArrayOutputStream bop = null;
                    String xmlString = null;
                    bop = new ByteArrayOutputStream();
                    retMessage.writeTo(bop);
                    xmlString = bop.toString(IFSConstants.DEFAULT_ENCODING);
                    if (FSUtils.debug.messageEnabled()) {
                        FSUtils.debug.message("return SOAP message:" + xmlString);
                    }
                }
                returnSOAPMessage(retMessage, response);
                return;
            } catch (Exception se) {
                FSUtils.debug.error("Error in processing Name Registration request" + se.getMessage());
                response.setStatus(response.SC_INTERNAL_SERVER_ERROR);
                retMessage = soapService.formSOAPError("Server", "cannotProcessRequest", null);
                returnSOAPMessage(retMessage, response);
            }
        } else if (nodeName.equalsIgnoreCase("NameIdentifierMappingRequest") && (ns.equalsIgnoreCase(IFSConstants.libertyMessageNamespaceURI) || ns.equalsIgnoreCase(IFSConstants.FF_12_XML_NS))) {
            FSUtils.debug.message("FSSOAPReceiver:handling Name Identifier Mapping Request");
            IDFFMetaManager metaManager = FSUtils.getIDFFMetaManager();
            String metaAlias = FSServiceUtils.getMetaAlias(request);
            String realm = IDFFMetaUtils.getRealmByMetaAlias(metaAlias);
            String hostedEntityId = metaManager.getEntityIDByMetaAlias(metaAlias);
            ProviderDescriptorType hostedDesc = metaManager.getIDPDescriptor(realm, hostedEntityId);
            BaseConfigType hostedConfig = metaManager.getIDPDescriptorConfig(realm, hostedEntityId);
            FSNameIdentifierMappingRequest mappingRequest = new FSNameIdentifierMappingRequest(elt);
            if (FSServiceUtils.isSigningOn()) {
                String remoteEntityId = mappingRequest.getProviderID();
                ProviderDescriptorType remoteDesc = getRemoteProviderDescriptor(// it has to be idp
                IFSConstants.IDP, remoteEntityId, realm);
                if (remoteDesc == null) {
                    return;
                }
                if (verifyRequestSignature(elt, message, KeyUtil.getVerificationCert(remoteDesc, remoteEntityId, true))) {
                    if (FSUtils.debug.messageEnabled()) {
                        FSUtils.debug.message("FSSOAPReceiver: Success in verifying " + "Name Identifier Mapping Request");
                    }
                } else {
                    FSUtils.debug.error("Failed verifying Name Identifier Mapping Request");
                    returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
                    return;
                }
            }
            String targetNamespace = mappingRequest.getTargetNamespace();
            String inResponseTo = mappingRequest.getRequestID();
            Status status = new Status(new StatusCode("samlp:Success"));
            FSNameMappingHandler idpHandler = new FSNameMappingHandler(hostedEntityId, hostedDesc, hostedConfig, metaAlias);
            NameIdentifier nameIdentifier = idpHandler.getNameIdentifier(mappingRequest, targetNamespace, false);
            String enableEncryption = IDFFMetaUtils.getFirstAttributeValueFromConfig(hostedConfig, IFSConstants.ENABLE_NAMEID_ENCRYPTION);
            if (enableEncryption != null && enableEncryption.equalsIgnoreCase("true")) {
                nameIdentifier = EncryptedNameIdentifier.getEncryptedNameIdentifier(nameIdentifier, realm, targetNamespace);
            }
            FSNameIdentifierMappingResponse mappingResponse = new FSNameIdentifierMappingResponse(hostedEntityId, inResponseTo, status, nameIdentifier);
            if (FSServiceUtils.isSigningOn()) {
                String certAlias = IDFFMetaUtils.getFirstAttributeValueFromConfig(hostedConfig, IFSConstants.SIGNING_CERT_ALIAS);
                mappingResponse.signXML(certAlias);
            }
            SOAPMessage retMessage = soapService.bind(mappingResponse.toXMLString(true, true));
            returnSOAPMessage(retMessage, response);
            return;
        } else if (nodeName.equalsIgnoreCase("FederationTerminationNotification") && (ns.equalsIgnoreCase(IFSConstants.libertyMessageNamespaceURI) || ns.equalsIgnoreCase(IFSConstants.FF_12_XML_NS))) {
            try {
                FSUtils.debug.message("calling FSSOAPReceiver::handleTerminationRequest");
                boolean bHandleStatus = handleTerminationRequest(elt, message, request, response);
                if (bHandleStatus) {
                    FSUtils.debug.message("Completed processing terminationRequest");
                    returnTerminationStatus(response);
                    return;
                } else {
                    FSUtils.debug.message("Failed processing terminationRequest");
                    returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
                    return;
                }
            } catch (Exception se) {
                FSUtils.debug.error("Error in processing Federation Termination Request", se);
                String[] data = { IFSConstants.TERMINATION_REQUEST_PROCESSING_FAILED };
                LogUtil.error(Level.INFO, LogUtil.TERMINATION_REQUEST_PROCESSING_FAILED, data);
                returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
                return;
            }
        } else if (nodeName.equalsIgnoreCase("LogoutRequest") && (ns.equalsIgnoreCase(IFSConstants.libertyMessageNamespaceURI) || ns.equalsIgnoreCase(IFSConstants.FF_12_XML_NS))) {
            try {
                FSUtils.debug.message("calling FSSOAPReceiver::handleLogoutRequest");
                ProviderDescriptorType hostedProviderDesc = null;
                BaseConfigType hostedConfig = null;
                String providerAlias = null;
                String realm = null;
                String hostedEntityId = null;
                String hostedRole = null;
                try {
                    providerAlias = FSServiceUtils.getMetaAlias(request);
                    realm = IDFFMetaUtils.getRealmByMetaAlias(providerAlias);
                    IDFFMetaManager metaManager = FSUtils.getIDFFMetaManager();
                    hostedRole = metaManager.getProviderRoleByMetaAlias(providerAlias);
                    hostedEntityId = metaManager.getEntityIDByMetaAlias(providerAlias);
                    if (hostedRole != null) {
                        if (hostedRole.equalsIgnoreCase(IFSConstants.IDP)) {
                            hostedProviderDesc = metaManager.getIDPDescriptor(realm, hostedEntityId);
                            hostedConfig = metaManager.getIDPDescriptorConfig(realm, hostedEntityId);
                        } else if (hostedRole.equalsIgnoreCase(IFSConstants.SP)) {
                            hostedProviderDesc = metaManager.getSPDescriptor(realm, hostedEntityId);
                            hostedConfig = metaManager.getSPDescriptorConfig(realm, hostedEntityId);
                        }
                    }
                } catch (Exception e) {
                    FSUtils.debug.error("FSSOAPReceiver, provider", e);
                }
                FSLogoutNotification logoutRequest = new FSLogoutNotification(elt);
                Map map = handleLogoutRequest(elt, logoutRequest, message, request, response, hostedProviderDesc, hostedConfig, providerAlias, realm, hostedEntityId, hostedRole);
                String responseID = SAMLUtils.generateID();
                String inResponseTo = logoutRequest.getRequestID();
                String relayState = logoutRequest.getRelayState();
                FSLogoutResponse resp = null;
                boolean statusSuccess = false;
                SOAPMessage retSoapMessage = null;
                if (map == null) {
                    StatusCode statusCode = new StatusCode(IFSConstants.SAML_RESPONDER);
                    Status status = new Status(statusCode);
                    resp = new FSLogoutResponse(responseID, inResponseTo, status, hostedEntityId, relayState);
                } else {
                    retSoapMessage = (SOAPMessage) map.get(MESSAGE);
                    SOAPPart sp = retSoapMessage.getSOAPPart();
                    SOAPEnvelope se = sp.getEnvelope();
                    SOAPBody sb = se.getBody();
                    if (sb.hasFault()) {
                        StatusCode secondLevelstatusCode = new StatusCode(IFSConstants.SAML_UNSUPPORTED);
                        StatusCode statusCode = new StatusCode(IFSConstants.SAML_RESPONDER, secondLevelstatusCode);
                        Status status = new Status(statusCode);
                        resp = new FSLogoutResponse(responseID, inResponseTo, status, hostedEntityId, relayState);
                    } else {
                        StatusCode statusCode = new StatusCode(IFSConstants.SAML_SUCCESS);
                        Status status = new Status(statusCode);
                        resp = new FSLogoutResponse(responseID, inResponseTo, status, hostedEntityId, relayState);
                        statusSuccess = true;
                    }
                }
                resp.setID(IFSConstants.LOGOUTID);
                resp.setMinorVersion(logoutRequest.getMinorVersion());
                retSoapMessage = soapService.bind(resp.toXMLString(true, true));
                // Call SP Adapter postSingleLogoutSuccess for IDP/SOAP
                if (hostedRole != null && hostedRole.equalsIgnoreCase(IFSConstants.SP) && statusSuccess) {
                    FederationSPAdapter spAdapter = FSServiceUtils.getSPAdapter(hostedEntityId, hostedConfig);
                    if (spAdapter != null) {
                        if (FSUtils.debug.messageEnabled()) {
                            FSUtils.debug.message("FSSOAPReceiver, " + "call postSingleLogoutSuccess, IDP/SOAP");
                        }
                        try {
                            spAdapter.postSingleLogoutSuccess(hostedEntityId, request, response, (String) map.get(USERID), logoutRequest, resp, IFSConstants.LOGOUT_IDP_SOAP_PROFILE);
                        } catch (Exception e) {
                            // ignore adapter exception
                            FSUtils.debug.error("postSingleLogoutSuccess." + "IDP/SOAP", e);
                        }
                    }
                }
                if (FSServiceUtils.isSigningOn()) {
                    try {
                        int minorVersion = resp.getMinorVersion();
                        if (minorVersion == IFSConstants.FF_11_PROTOCOL_MINOR_VERSION) {
                            retSoapMessage = signResponse(retSoapMessage, IFSConstants.ID, resp.getID(), hostedConfig);
                        } else if (minorVersion == IFSConstants.FF_12_PROTOCOL_MINOR_VERSION) {
                            retSoapMessage = signResponse(retSoapMessage, IFSConstants.RESPONSE_ID, resp.getResponseID(), hostedConfig);
                        } else {
                            FSUtils.debug.error("invalid minor version.");
                        }
                    } catch (SAMLException e) {
                        if (FSUtils.debug.messageEnabled()) {
                            FSUtils.debug.message("LogoutResponse failed", e);
                        }
                        returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
                        return;
                    } catch (FSMsgException e) {
                        if (FSUtils.debug.messageEnabled()) {
                            FSUtils.debug.message("LogoutResponse failed", e);
                        }
                        returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
                        return;
                    } catch (Exception e) {
                        if (FSUtils.debug.messageEnabled()) {
                            FSUtils.debug.message("Logout exception:", e);
                        }
                    }
                }
                returnSOAPMessage(retSoapMessage, response);
                return;
            } catch (Exception se) {
                FSUtils.debug.error("Error in processing logout Request", se);
                String[] data = { FSUtils.bundle.getString(IFSConstants.LOGOUT_REQUEST_PROCESSING_FAILED) };
                LogUtil.error(Level.INFO, LogUtil.LOGOUT_REQUEST_PROCESSING_FAILED, data);
                returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
                return;
            }
        }
    //check for other Liberty msgs should go here
    } catch (Exception e) {
        FSUtils.debug.error("FSSOAPReceiver.onMessage: " + "Error in processing Request: Exception occured: ", e);
        response.setStatus(response.SC_INTERNAL_SERVER_ERROR);
        java.io.ByteArrayOutputStream strm = new java.io.ByteArrayOutputStream();
        e.printStackTrace(new java.io.PrintStream(strm));
        FSUtils.debug.error(strm.toString());
        returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
        return;
    }
    returnSOAPMessage(soapService.formSOAPError("Server", "cannotProcessRequest", null), response);
    return;
}

Example 2 with FSLogoutNotification

use of com.sun.identity.federation.message.FSLogoutNotification in project OpenAM by OpenRock.

the class FSSingleLogoutHandler method createSingleLogoutRequest.

/**
     * Creates the logoutNotification message for a provider.
     * @param acctInfo the curerent user-provider information
     * @param sessionIndex to be sent as part of lgout request
     * @return the logout request
     */
private FSLogoutNotification createSingleLogoutRequest(FSAccountFedInfo acctInfo, String sessionIndex) {
    FSUtils.debug.message("Entered FSSingleLogoutHandler::createSingleLogoutRequest");
    FSLogoutNotification reqName = new FSLogoutNotification();
    if (reqName != null) {
        NameIdentifier nameIdentifier = acctInfo.getRemoteNameIdentifier();
        if (nameIdentifier == null) {
            nameIdentifier = acctInfo.getLocalNameIdentifier();
        }
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("Hosted Provider Id : " + hostedEntityId);
        }
        reqName.setProviderId(hostedEntityId);
        reqName.setNameIdentifier(nameIdentifier);
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("Session index is " + sessionIndex);
        }
        if (sessionIndex != null) {
            reqName.setSessionIndex(sessionIndex);
        }
        return reqName;
    }
    return null;
}

Example 3 with FSLogoutNotification

use of com.sun.identity.federation.message.FSLogoutNotification in project OpenAM by OpenRock.

the class FSProcessLogoutServlet method doGetPost.

/**
     * Handles single logout request.
     * @param request an <code>HttpServletRequest</code> object that contains
     *  the request the client has made of the servlet.
     * @param response an <code>HttpServletResponse</code> object that contains
     *  the response the servlet sends to the client.
     * @exception ServletException if an input or output error is detected when
     *                             the servlet handles the request
     * @exception IOException if the request could not be handled
     */
private void doGetPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    FSUtils.debug.message("FSProcessLogoutServlet doGetPost...");
    // Alias processing
    String providerAlias = request.getParameter(IFSConstants.META_ALIAS);
    if (providerAlias == null || providerAlias.length() == 0) {
        providerAlias = FSServiceUtils.getMetaAlias(request);
    }
    if (providerAlias == null || providerAlias.length() < 1) {
        FSUtils.debug.error("Unable to retrieve alias, Hosted Provider. " + "Cannot process request");
        response.sendError(response.SC_INTERNAL_SERVER_ERROR, FSUtils.bundle.getString("aliasNotFound"));
        return;
    }
    if (metaManager == null) {
        FSUtils.debug.error("Cannot retrieve hosted descriptor. " + "Cannot process request");
        response.sendError(response.SC_INTERNAL_SERVER_ERROR, FSUtils.bundle.getString(IFSConstants.FAILED_HOSTED_DESCRIPTOR));
        return;
    }
    String realm = IDFFMetaUtils.getRealmByMetaAlias(providerAlias);
    ProviderDescriptorType hostedProviderDesc = null;
    BaseConfigType hostedConfig = null;
    String hostedRole = null;
    String hostedEntityId = null;
    try {
        hostedRole = metaManager.getProviderRoleByMetaAlias(providerAlias);
        hostedEntityId = metaManager.getEntityIDByMetaAlias(providerAlias);
        if (hostedRole != null) {
            if (hostedRole.equalsIgnoreCase(IFSConstants.IDP)) {
                hostedProviderDesc = metaManager.getIDPDescriptor(realm, hostedEntityId);
                hostedConfig = metaManager.getIDPDescriptorConfig(realm, hostedEntityId);
            } else if (hostedRole.equalsIgnoreCase(IFSConstants.SP)) {
                hostedProviderDesc = metaManager.getSPDescriptor(realm, hostedEntityId);
                hostedConfig = metaManager.getSPDescriptorConfig(realm, hostedEntityId);
            }
        }
        if (hostedProviderDesc == null) {
            throw new IDFFMetaException((String) null);
        }
    } catch (IDFFMetaException eam) {
        FSUtils.debug.error("Unable to find Hosted Provider. " + "not process request", eam);
        response.sendError(response.SC_INTERNAL_SERVER_ERROR, FSUtils.bundle.getString(IFSConstants.FAILED_HOSTED_DESCRIPTOR));
        return;
    }
    String logoutDoneURL = FSServiceUtils.getLogoutDonePageURL(request, hostedConfig, providerAlias);
    String commonErrorPage = FSServiceUtils.getErrorPageURL(request, hostedConfig, providerAlias);
    if (FSUtils.debug.messageEnabled()) {
        FSUtils.debug.message("logoutDoneURL : " + logoutDoneURL + "\ncommonErrorPage : " + commonErrorPage);
    }
    String sourceCheck = (String) request.getAttribute("logoutSource");
    if (sourceCheck == null) {
        sourceCheck = request.getParameter("logoutSource");
    }
    Object ssoToken = getValidToken(request);
    String userID = null;
    if (ssoToken == null) {
        if (sourceCheck != null) {
            if (sourceCheck.equalsIgnoreCase("local")) {
                // status=noSession
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("FSProcessLogoutServlet, " + "control where Source is local");
                }
                FSServiceUtils.returnLocallyAfterOperation(response, logoutDoneURL, false, IFSConstants.LOGOUT_SUCCESS, IFSConstants.LOGOUT_NO_SESSION);
                return;
            } else if (sourceCheck.equalsIgnoreCase("remote")) {
                // logout return
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("Control where Source is remote - not from app" + "link but from other provider");
                }
                FSServiceUtils.returnLocallyAfterOperation(response, logoutDoneURL, true, IFSConstants.LOGOUT_SUCCESS, IFSConstants.LOGOUT_FAILURE);
                return;
            } else if (sourceCheck.equalsIgnoreCase("logoutGet")) {
                // logout Get profile
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("Control where Source is Http Get action - " + "not from app link ");
                }
                FSServiceUtils.returnLocallyAfterOperation(response, logoutDoneURL, true, IFSConstants.LOGOUT_SUCCESS, IFSConstants.LOGOUT_FAILURE);
                return;
            }
        }
    } else {
        try {
            userID = SessionManager.getProvider().getPrincipalName(ssoToken);
        } catch (SessionException ssoExp) {
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("Couldn't get user object:", ssoExp);
            }
        }
        if (sourceCheck != null) {
            if (sourceCheck.equalsIgnoreCase("local")) {
                // initiate logout
                FSUtils.debug.message("Control where Source is local -  from applink");
                doLogoutInitiation(request, response, hostedProviderDesc, hostedConfig, realm, hostedEntityId, hostedRole, providerAlias, ssoToken, logoutDoneURL, sourceCheck);
                return;
            } else if (sourceCheck.equalsIgnoreCase("remote")) {
                // logout return
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("Control where Source is remote - not from app" + "link but from other provider. Token valid");
                }
                doLogoutInitiation(request, response, hostedProviderDesc, hostedConfig, realm, hostedEntityId, hostedRole, providerAlias, ssoToken, logoutDoneURL, sourceCheck);
                return;
            } else if (sourceCheck.equalsIgnoreCase("logoutGet")) {
                // logout Get profile
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("Control where Source is Http Get action - not from" + " applink. Initiation will take care in " + "preLogouthandler ");
                }
                doLogoutInitiation(request, response, hostedProviderDesc, hostedConfig, realm, hostedEntityId, hostedRole, providerAlias, ssoToken, logoutDoneURL, sourceCheck);
                return;
            }
        }
    }
    // received logout request from remote provider
    FSLogoutNotification logoutObj = null;
    try {
        logoutObj = FSLogoutNotification.parseURLEncodedRequest(request);
    } catch (FSMsgException e) {
        // FSMsgException would mean that the request does not have the
        // FSLogoutNotification message, so show error page
        FSUtils.debug.message("Bad Logout request. calling showErrorPage");
        FSServiceUtils.showErrorPage(response, commonErrorPage, IFSConstants.LOGOUT_REQUEST_IMPROPER, IFSConstants.LOGOUT_FAILED);
        return;
    }
    if (logoutObj == null) {
        FSUtils.debug.message("Bad Logout request. calling showErrorPage");
        FSServiceUtils.showErrorPage(response, commonErrorPage, IFSConstants.LOGOUT_REQUEST_IMPROPER, IFSConstants.LOGOUT_FAILED);
    } else {
        doRequestProcessing(request, response, hostedProviderDesc, hostedConfig, hostedRole, realm, hostedEntityId, providerAlias, logoutObj, commonErrorPage, userID, ssoToken);
    }
    return;
}

Example 4 with FSLogoutNotification

use of com.sun.identity.federation.message.FSLogoutNotification in project OpenAM by OpenRock.

the class FSSingleLogoutHandler method doSoapProfile.

/**
     * Initiates SOAP proifle logout.
     * @param providerId the first provider with SOAP as logout profile
     */
private FSLogoutStatus doSoapProfile(String providerId) {
    FSUtils.debug.message("Entered IDP's doSoapProfile");
    try {
        FSSessionManager sMgr = FSSessionManager.getInstance(metaAlias);
        FSSession session = sMgr.getSession(ssoToken);
        FSAccountFedInfo currentAccount = null;
        if (session != null) {
            currentAccount = session.getAccountFedInfo();
        }
        if (currentAccount == null && !session.getOneTime()) {
            currentAccount = FSLogoutUtil.getCurrentWorkingAccount(userID, providerId, metaAlias);
        }
        if (currentAccount == null) {
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("FSSingleLogoutHandler. User's " + "account may have been terminated.");
            }
            return new FSLogoutStatus(IFSConstants.SAML_SUCCESS);
        }
        FSLogoutNotification reqLogout = createSingleLogoutRequest(currentAccount, sessionIndex);
        reqLogout.setMinorVersion(getMinorVersion(remoteDescriptor));
        if (reqLogout != null) {
            FSSOAPService instSOAP = FSSOAPService.getInstance();
            if (instSOAP != null) {
                FSUtils.debug.message("Signing suceeded. To call bindLogoutRequest");
                reqLogout.setID(IFSConstants.LOGOUTID);
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("logout request before sign: " + reqLogout.toXMLString(true, true));
                }
                SOAPMessage msgLogout = instSOAP.bind(reqLogout.toXMLString(true, true));
                if (msgLogout != null) {
                    SOAPMessage retSOAPMessage = null;
                    try {
                        if (FSServiceUtils.isSigningOn()) {
                            int minorVersion = reqLogout.getMinorVersion();
                            switch(minorVersion) {
                                case IFSConstants.FF_11_PROTOCOL_MINOR_VERSION:
                                    msgLogout = signLogoutRequest(msgLogout, IFSConstants.ID, reqLogout.getID());
                                    break;
                                case IFSConstants.FF_12_PROTOCOL_MINOR_VERSION:
                                    msgLogout = signLogoutRequest(msgLogout, IFSConstants.REQUEST_ID, reqLogout.getRequestID());
                                    break;
                                default:
                                    FSUtils.debug.message("invalid minor version.");
                                    break;
                            }
                        }
                        retSOAPMessage = instSOAP.sendMessage(msgLogout, remoteDescriptor.getSoapEndpoint());
                    } catch (Exception e) {
                        FSUtils.debug.error("FSSOAPException in doSOAPProfile" + " Cannot send request", e);
                        return new FSLogoutStatus(IFSConstants.SAML_RESPONDER);
                    }
                    if (retSOAPMessage != null) {
                        Element elt = instSOAP.parseSOAPMessage(retSOAPMessage);
                        if (FSServiceUtils.isSigningOn()) {
                            if (!verifyResponseSignature(retSOAPMessage)) {
                                if (FSUtils.debug.messageEnabled()) {
                                    FSUtils.debug.message("Response " + "signature verification failed");
                                }
                                FSServiceUtils.returnLocallyAfterOperation(response, LOGOUT_DONE_URL, false, IFSConstants.LOGOUT_SUCCESS, IFSConstants.LOGOUT_FAILURE);
                                return new FSLogoutStatus(IFSConstants.SAML_REQUESTER);
                            }
                        }
                        this.requestLogout = reqLogout;
                        respObj = new FSLogoutResponse(elt);
                        // Call SP Adapter preSingleLogout for SP/SOAP
                        if (hostedRole != null && hostedRole.equalsIgnoreCase(IFSConstants.SP)) {
                            FederationSPAdapter spAdapter = FSServiceUtils.getSPAdapter(hostedEntityId, hostedConfig);
                            if (spAdapter != null) {
                                if (FSUtils.debug.messageEnabled()) {
                                    FSUtils.debug.message("FSSLOHandler." + "preSingleLogoutProcess, SP/SOAP");
                                }
                                try {
                                    spAdapter.preSingleLogoutProcess(hostedEntityId, request, response, userID, reqLogout, respObj, IFSConstants.LOGOUT_SP_SOAP_PROFILE);
                                } catch (Exception e) {
                                    // ignore adapter error
                                    FSUtils.debug.error("spAdapter." + "preSingleLogoutProcess, SP/SOAP:", e);
                                }
                            }
                        }
                        Status status = respObj.getStatus();
                        StatusCode statusCode = status.getStatusCode();
                        StatusCode secondLevelStatus = statusCode.getStatusCode();
                        String statusString = statusCode.getValue();
                        if (statusString.equalsIgnoreCase(IFSConstants.SAML_SUCCESS)) {
                            if (FSUtils.debug.messageEnabled()) {
                                FSUtils.debug.message("FSSingleLogoutHandler: " + " doSoapProfile returning success");
                            }
                            return new FSLogoutStatus(IFSConstants.SAML_SUCCESS);
                        } else {
                            if (FSUtils.debug.messageEnabled()) {
                                FSUtils.debug.message("FSSingleLogoutHandler: " + "SOAP Profile failure " + statusString);
                            }
                            return new FSLogoutStatus(statusString);
                        }
                    }
                }
            }
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("Unable to bindLogoutRequest." + "Current Provider cannot be processed");
            }
        } else {
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("Unable to create logout request" + " Current Provider cannot be processed");
            }
        }
    } catch (Exception e) {
        FSUtils.debug.error("In IOException of doSOAPProfile : ", e);
    }
    return new FSLogoutStatus(IFSConstants.SAML_RESPONDER);
}

Example 5 with FSLogoutNotification

use of com.sun.identity.federation.message.FSLogoutNotification in project OpenAM by OpenRock.

the class FSSingleLogoutHandler method getMultiLogoutRequest.

/**
     * Prepares the IMG tags that correspond to Single logout requests that
     * will all be shown in a single page when HTTP GET profile is used.
     * @param providerMap contains information about all the providers
     *  for whom GET is the logout profile
     * @return String that has the IMG tags for each provider to be notified
     */
private String getMultiLogoutRequest(HashMap providerMap) {
    try {
        Vector providerList = (Vector) providerMap.get(IFSConstants.PROVIDER);
        HashMap sessionList = (HashMap) providerMap.get(IFSConstants.SESSION_INDEX);
        StringBuffer imgString = new StringBuffer();
        if (providerList != null) {
            for (int i = 0; i < providerList.size(); i++) {
                String providerId = (String) providerList.elementAt(i);
                FSAccountFedInfo currentAccount = FSLogoutUtil.getCurrentWorkingAccount(userID, providerId, metaAlias);
                FSLogoutNotification reqLogout = createSingleLogoutRequest(currentAccount, (String) sessionList.get(providerId));
                ProviderDescriptorType descriptor = metaManager.getSPDescriptor(realm, providerId);
                reqLogout.setMinorVersion(getMinorVersion(descriptor));
                String urlEncodedRequest = reqLogout.toURLEncodedQueryString();
                // Sign the request querystring
                String certAlias = IDFFMetaUtils.getFirstAttributeValueFromConfig(hostedConfig, IFSConstants.SIGNING_CERT_ALIAS);
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("certalias  : " + certAlias);
                }
                if (certAlias == null || certAlias.length() == 0) {
                    if (FSUtils.debug.messageEnabled()) {
                        FSUtils.debug.message("FSSingleLogoutHandler" + " getMultiLogoutRequest: couldn't obtain " + "this site's cert alias.");
                    }
                    continue;
                }
                urlEncodedRequest = FSSignatureUtil.signAndReturnQueryString(urlEncodedRequest, certAlias);
                StringBuffer redirectURL = new StringBuffer();
                String retURL = descriptor.getSingleLogoutServiceURL();
                redirectURL.append(retURL);
                if (retURL.indexOf(QUESTION_MARK) == -1) {
                    redirectURL.append(QUESTION_MARK);
                } else {
                    redirectURL.append(AMPERSAND);
                }
                redirectURL.append(urlEncodedRequest);
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("FSSingleLogoutHandler::" + "doHttpRedirect URL is " + redirectURL.toString());
                }
                imgString.append("<IMG SRC=\"").append(redirectURL.toString()).append("\" />");
            }
            return imgString.toString();
        }
    } catch (FSMsgException e) {
        FSUtils.debug.error("FSSingleLogoutHandler::getMultiLogoutRequest" + " FSMsgException", e);
    } catch (IDFFMetaException e) {
        FSUtils.debug.error("FSSingleLogoutHandler::getMultiLogoutRequest" + "  IDFFMetaException", e);
    }
    FSUtils.debug.error("Returning null from getMultiLogoutRequest");
    return null;
}