Examples with IDFFMetaException com.sun.identity.federation.meta.IDFFMetaException used on opensource projects

Example 86 with IDFFMetaException

use of com.sun.identity.federation.meta.IDFFMetaException in project OpenAM by OpenRock.

the class FSSingleLogoutHandler method returnAfterCompletion.

/**
     * Invoked to either send back control to remote provider if logout message
     * was received from one or
     * to show the local logout status page to the user.
     */
protected void returnAfterCompletion() {
    if (FSUtils.debug.messageEnabled()) {
        FSUtils.debug.message("Entered FSSingleLogoutHandler::returnAC: " + "PROTOCOL=" + this.singleLogoutProtocol + ", relayState=" + this.relayState);
    }
    try {
        String returnProviderId = "";
        String relayState = "";
        String logoutStatusString = "";
        String inResponseTo = "";
        FSReturnSessionManager mngInst = FSReturnSessionManager.getInstance(metaAlias);
        HashMap providerMap = new HashMap();
        if (mngInst != null) {
            providerMap = mngInst.getUserProviderInfo(userID);
        }
        if (providerMap != null) {
            returnProviderId = (String) providerMap.get(IFSConstants.PROVIDER);
            relayState = (String) providerMap.get(IFSConstants.LOGOUT_RELAY_STATE);
            logoutStatusString = (String) providerMap.get(IFSConstants.LOGOUT_STATUS);
            if (logoutStatusString == null || logoutStatusString.length() == 0) {
                logoutStatusString = IFSConstants.SAML_SUCCESS;
            }
            inResponseTo = (String) providerMap.get(IFSConstants.RESPONSE_TO);
            mngInst.removeUserProviderInfo(userID);
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("Deleted " + returnProviderId + " from return list");
            }
            ProviderDescriptorType descriptor = null;
            if (hostedRole.equalsIgnoreCase(IFSConstants.IDP)) {
                descriptor = metaManager.getSPDescriptor(realm, returnProviderId);
            } else {
                descriptor = metaManager.getIDPDescriptor(realm, returnProviderId);
            }
            String retURL = descriptor.getSingleLogoutServiceReturnURL();
            if (retURL != null) {
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("Getting provider " + returnProviderId + " IDP Return URL = " + retURL);
                }
                FSLogoutResponse responseLogout = new FSLogoutResponse();
                responseLogout.setResponseTo(inResponseTo);
                responseLogout.setRelayState(relayState);
                responseLogout.setProviderId(hostedEntityId);
                responseLogout.setStatus(logoutStatusString);
                responseLogout.setID(IFSConstants.LOGOUTID);
                responseLogout.setMinorVersion(getMinorVersion(descriptor));
                responseLogout.setResponseID(FSUtils.generateID());
                // Call SP Adapter postSingleLogoutSuccess for SP/HTTP
                callPostSingleLogoutSuccess(responseLogout, IFSConstants.LOGOUT_IDP_REDIRECT_PROFILE);
                // call multi-federation protocol processing
                if (MultiProtocolUtils.isMultipleProtocolSession(request, SingleLogoutManager.IDFF) && hostedRole.equalsIgnoreCase(IFSConstants.IDP) && !MultiProtocolUtils.isMultiProtocolRelayState(relayState)) {
                    int retStatus = handleMultiProtocolLogout(false, responseLogout.toXMLString(true, true), returnProviderId);
                    if (retStatus == SingleLogoutManager.LOGOUT_REDIRECTED_STATUS) {
                        return;
                    } else {
                        if ((retStatus == SingleLogoutManager.LOGOUT_FAILED_STATUS) || (retStatus == SingleLogoutManager.LOGOUT_PARTIAL_STATUS)) {
                            responseLogout.setStatus(IFSConstants.SAML_RESPONDER);
                        }
                    }
                }
                String urlEncodedResponse = responseLogout.toURLEncodedQueryString();
                // Sign the request querystring
                if (FSServiceUtils.isSigningOn()) {
                    String certAlias = IDFFMetaUtils.getFirstAttributeValueFromConfig(hostedConfig, IFSConstants.SIGNING_CERT_ALIAS);
                    if (certAlias == null || certAlias.length() == 0) {
                        if (FSUtils.debug.messageEnabled()) {
                            FSUtils.debug.message("FSBrowserArtifactConsumerHandler:: " + "signSAMLRequest:" + "couldn't obtain this site's cert alias.");
                        }
                        throw new SAMLResponderException(FSUtils.bundle.getString(IFSConstants.NO_CERT_ALIAS));
                    }
                    urlEncodedResponse = FSSignatureUtil.signAndReturnQueryString(urlEncodedResponse, certAlias);
                }
                StringBuffer redirectURL = new StringBuffer();
                redirectURL.append(retURL);
                if (retURL.indexOf(IFSConstants.QUESTION_MARK) == -1) {
                    redirectURL.append(IFSConstants.QUESTION_MARK);
                } else {
                    redirectURL.append(IFSConstants.AMPERSAND);
                }
                redirectURL.append(urlEncodedResponse);
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("Response to be sent : " + redirectURL.toString());
                }
                String[] data = { userID };
                LogUtil.access(Level.INFO, LogUtil.LOGOUT_SUCCESS, data);
                response.sendRedirect(redirectURL.toString());
                return;
            }
        } else {
            FSUtils.debug.message("no source provider. return to local status page");
            // Multiple protocol single logout handler
            if ((this.singleLogoutProtocol != null) && this.singleLogoutProtocol.equals(IFSConstants.LOGOUT_IDP_SOAP_PROFILE) && (this.relayState != null) && MultiProtocolUtils.isMultiProtocolRelayState(this.relayState)) {
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("FSSingleLogoutHandler::returnAC:" + " this is multiProto for IDP initiated SOAP");
                }
                return;
            }
            // call multi-federation protocol processing
            if (MultiProtocolUtils.isMultipleProtocolSession(request, SingleLogoutManager.IDFF) && hostedRole.equalsIgnoreCase(IFSConstants.IDP) && !MultiProtocolUtils.isMultiProtocolRelayState(relayState)) {
                boolean isSOAPInitiated = false;
                if ((singleLogoutProtocol.equals(IFSConstants.LOGOUT_IDP_SOAP_PROFILE)) || (singleLogoutProtocol.equals(IFSConstants.LOGOUT_SP_SOAP_PROFILE))) {
                    isSOAPInitiated = true;
                }
                int retStatus = handleMultiProtocolLogout(isSOAPInitiated, null, remoteEntityId);
                if (retStatus == SingleLogoutManager.LOGOUT_REDIRECTED_STATUS) {
                    return;
                } else {
                    if ((retStatus == SingleLogoutManager.LOGOUT_FAILED_STATUS) || (retStatus == SingleLogoutManager.LOGOUT_PARTIAL_STATUS)) {
                        logoutStatus = false;
                    }
                }
            }
            if (logoutStatus) {
                FSServiceUtils.returnLocallyAfterOperation(response, LOGOUT_DONE_URL, true, IFSConstants.LOGOUT_SUCCESS, IFSConstants.LOGOUT_FAILURE);
            }
            return;
        }
    } catch (IDFFMetaException e) {
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("Unable to get LRURL. " + "No location to redirect. processing completed");
        }
        String[] data = { FSUtils.bundle.getString(IFSConstants.LOGOUT_REDIRECT_FAILED) };
        LogUtil.error(Level.INFO, LogUtil.LOGOUT_REDIRECT_FAILED, data, ssoToken);
    } catch (Exception ex) {
        String[] data = { FSUtils.bundle.getString(IFSConstants.LOGOUT_REDIRECT_FAILED) };
        LogUtil.error(Level.INFO, LogUtil.LOGOUT_REDIRECT_FAILED, data, ssoToken);
    }
}

Example 87 with IDFFMetaException

use of com.sun.identity.federation.meta.IDFFMetaException in project OpenAM by OpenRock.

the class FSLogoutUtil method sendErrorPage.

/**
     * Returns the hosted provider's failure page to the user.
     * @param request the <code>HttpServletRequest</code> object
     * @param response the <code>HttpServletResponse</code> object
     * @param providerAlias the provider alias corresponding to the hosted
     *  provider
     */
protected static void sendErrorPage(HttpServletRequest request, HttpServletResponse response, String providerAlias) {
    try {
        String retURL = "";
        String realm = IDFFMetaUtils.getRealmByMetaAlias(providerAlias);
        if (metaManager != null) {
            String hostedRole = metaManager.getProviderRoleByMetaAlias(providerAlias);
            String hostedEntityId = metaManager.getEntityIDByMetaAlias(providerAlias);
            BaseConfigType hostedConfig = null;
            if (hostedEntityId != null && IFSConstants.IDP.equalsIgnoreCase(hostedRole)) {
                hostedConfig = metaManager.getIDPDescriptorConfig(realm, hostedEntityId);
            } else if (hostedEntityId != null && IFSConstants.SP.equalsIgnoreCase(hostedRole)) {
                hostedConfig = metaManager.getSPDescriptorConfig(realm, hostedEntityId);
            }
            retURL = FSServiceUtils.getLogoutDonePageURL(request, hostedConfig, providerAlias);
            if (retURL == null || retURL.length() < 1) {
                FSServiceUtils.showErrorPage(response, FSServiceUtils.getErrorPageURL(request, hostedConfig, providerAlias), IFSConstants.LOGOUT_FAILED, IFSConstants.METADATA_ERROR);
            } else {
                StringBuffer finalReturnURL = new StringBuffer();
                finalReturnURL.append(retURL);
                char delimiter;
                if (retURL.indexOf(IFSConstants.QUESTION_MARK) < 0) {
                    delimiter = IFSConstants.QUESTION_MARK;
                } else {
                    delimiter = IFSConstants.AMPERSAND;
                }
                finalReturnURL.append(delimiter).append(IFSConstants.LOGOUT_STATUS).append(IFSConstants.EQUAL_TO).append(IFSConstants.LOGOUT_FAILURE);
                response.sendRedirect(finalReturnURL.toString());
            }
            return;
        } else {
            FSUtils.debug.error("Meta manager instance is null");
            response.sendError(response.SC_INTERNAL_SERVER_ERROR, FSUtils.bundle.getString("failedToReadDataStore"));
            return;
        }
    } catch (IOException ex) {
        FSUtils.debug.error("FSSingleLogoutServlet: IOException caught:", ex);
        return;
    } catch (IDFFMetaException e) {
        FSUtils.debug.error("FSSingleLogoutServlet:IDFFMetaException:", e);
        return;
    }
}

Example 88 with IDFFMetaException

use of com.sun.identity.federation.meta.IDFFMetaException in project OpenAM by OpenRock.

the class FSPreLogoutHandler method returnToPostLogout.

/**
     * Determines the return location and redirects based on
     * logout Return URL of the provider that initially sent the logout request.
     * If request was not sent by remote provider then the local logout-done
     * page is thrown back to the user
     */
private void returnToPostLogout(String logoutStatus) {
    FSUtils.debug.message("Entered FSPreLogoutHandler::returnToPostLogout");
    boolean error = false;
    boolean logoutSuccess = true;
    if (!logoutStatus.equals(IFSConstants.SAML_SUCCESS)) {
        logoutSuccess = false;
    }
    boolean multiProtocolInvoked = false;
    boolean toInvokeMultiProtocol = false;
    if (MultiProtocolUtils.isMultipleProtocolSession(request, SingleLogoutManager.IDFF) && hostedRole.equalsIgnoreCase(IFSConstants.IDP) && !MultiProtocolUtils.isMultiProtocolRelayState(relayState)) {
        toInvokeMultiProtocol = true;
    }
    try {
        String returnProviderId = "";
        String relayState = "";
        String gLogoutStatus = "";
        String inResponseTo = "";
        String retURL = null;
        FSLogoutResponse responseLogout = new FSLogoutResponse();
        FSReturnSessionManager mngInst = FSReturnSessionManager.getInstance(metaAlias);
        HashMap providerMap = new HashMap();
        if (mngInst != null) {
            providerMap = mngInst.getUserProviderInfo(userID);
        }
        if (providerMap == null) {
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("Return URL based on local postlogout URL" + "\nNo Source in ReturnMAP : rs=" + this.relayState);
            }
            if (toInvokeMultiProtocol) {
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("FSPreLogHandler.retToPostLogout:" + " call MP HTTP, status=" + logoutStatus);
                }
                multiProtocolInvoked = true;
                int retStatus = handleMultiProtocolLogout(logoutStatus, null);
                if (retStatus == SingleLogoutManager.LOGOUT_REDIRECTED_STATUS) {
                    return;
                } else {
                    if ((retStatus == SingleLogoutManager.LOGOUT_FAILED_STATUS) || (retStatus == SingleLogoutManager.LOGOUT_PARTIAL_STATUS)) {
                        logoutSuccess = false;
                    }
                }
            }
            if ((this.relayState == null) || (this.relayState.length() == 0)) {
                FSServiceUtils.returnLocallyAfterOperation(response, LOGOUT_DONE_URL, logoutSuccess, IFSConstants.LOGOUT_SUCCESS, IFSConstants.LOGOUT_FAILURE);
            } else {
                FSServiceUtils.returnLocallyAfterOperation(response, this.relayState, logoutSuccess, IFSConstants.LOGOUT_SUCCESS, IFSConstants.LOGOUT_FAILURE);
            }
            return;
        }
        returnProviderId = (String) providerMap.get(IFSConstants.PROVIDER);
        ProviderDescriptorType descriptor = null;
        if (hostedRole.equalsIgnoreCase(IFSConstants.IDP)) {
            descriptor = metaManager.getSPDescriptor(realm, returnProviderId);
        } else {
            descriptor = metaManager.getIDPDescriptor(realm, returnProviderId);
        }
        retURL = descriptor.getSingleLogoutServiceReturnURL();
        relayState = (String) providerMap.get(IFSConstants.LOGOUT_RELAY_STATE);
        gLogoutStatus = (String) providerMap.get(IFSConstants.LOGOUT_STATUS);
        inResponseTo = (String) providerMap.get(IFSConstants.RESPONSE_TO);
        mngInst.removeUserProviderInfo(userID);
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("Deleted " + userID + " from return list");
        }
        responseLogout.setResponseTo(inResponseTo);
        responseLogout.setRelayState(relayState);
        responseLogout.setProviderId(hostedEntityId);
        if (gLogoutStatus != null) {
            responseLogout.setStatus(logoutStatus);
        }
        responseLogout.setID(IFSConstants.LOGOUTID);
        responseLogout.setMinorVersion(FSServiceUtils.getMinorVersion(descriptor.getProtocolSupportEnumeration()));
        // call multi-federation protocol processing
        if (toInvokeMultiProtocol) {
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("FSPreLogHandler.retToPostLogout:" + " call MP HTTP, response=" + responseLogout.toXMLString());
            }
            multiProtocolInvoked = true;
            int retStatus = handleMultiProtocolLogout(logoutStatus, responseLogout.toXMLString(true, true));
            if (retStatus == SingleLogoutManager.LOGOUT_REDIRECTED_STATUS) {
                return;
            } else {
                if ((retStatus == SingleLogoutManager.LOGOUT_FAILED_STATUS) || (retStatus == SingleLogoutManager.LOGOUT_PARTIAL_STATUS)) {
                    logoutSuccess = false;
                    responseLogout.setStatus(IFSConstants.SAML_RESPONDER);
                }
            }
        }
        String urlEncodedResponse = responseLogout.toURLEncodedQueryString();
        // Sign the request querystring
        if (FSServiceUtils.isSigningOn()) {
            String certAlias = IDFFMetaUtils.getFirstAttributeValueFromConfig(hostedConfig, IFSConstants.SIGNING_CERT_ALIAS);
            if (certAlias == null || certAlias.length() == 0) {
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("FSBrowserArtifactConsumerHandler:: " + "signSAMLRequest:" + "couldn't obtain this site's cert alias.");
                }
                throw new SAMLResponderException(FSUtils.bundle.getString(IFSConstants.NO_CERT_ALIAS));
            }
            urlEncodedResponse = FSSignatureUtil.signAndReturnQueryString(urlEncodedResponse, certAlias);
        }
        StringBuffer redirectURL = new StringBuffer();
        redirectURL.append(retURL);
        if (retURL.indexOf(IFSConstants.QUESTION_MARK) == -1) {
            redirectURL.append(IFSConstants.QUESTION_MARK);
        } else {
            redirectURL.append(IFSConstants.AMPERSAND);
        }
        redirectURL.append(urlEncodedResponse);
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("Response to be sent (3) : " + redirectURL.toString());
        }
        response.sendRedirect(redirectURL.toString());
        return;
    } catch (IOException e) {
        FSUtils.debug.error("Unable to get LRURL. No location to redirect." + "processing completed:", e);
        error = true;
    } catch (IDFFMetaException e) {
        FSUtils.debug.error("Unable to get LRURL. No location to redirect" + " processing completed:", e);
        error = true;
    } catch (Exception e) {
        FSUtils.debug.error("FSPreLogoutHandler::General exception thrown :", e);
        error = true;
    }
    if (error) {
        String[] data = { FSUtils.bundle.getString(IFSConstants.LOGOUT_REDIRECT_FAILED) };
        LogUtil.error(Level.INFO, LogUtil.LOGOUT_REDIRECT_FAILED, data, ssoToken);
        logoutSuccess = false;
    }
    // call multi-federation protocol processing
    if (toInvokeMultiProtocol && !multiProtocolInvoked) {
        // invoke multiple federation protocol in exception case
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("FSPreLogHandler.retToPostLogout:" + " call MP HTTP, error=" + error);
        }
        multiProtocolInvoked = true;
        int retStatus = handleMultiProtocolLogout(logoutStatus, null);
        if (retStatus == SingleLogoutManager.LOGOUT_REDIRECTED_STATUS) {
            return;
        } else {
            if ((retStatus == SingleLogoutManager.LOGOUT_FAILED_STATUS) || (retStatus == SingleLogoutManager.LOGOUT_PARTIAL_STATUS)) {
                logoutSuccess = false;
            }
        }
    }
    FSServiceUtils.returnLocallyAfterOperation(response, LOGOUT_DONE_URL, logoutSuccess, IFSConstants.LOGOUT_SUCCESS, IFSConstants.LOGOUT_FAILURE);
    return;
}

Example 89 with IDFFMetaException

use of com.sun.identity.federation.meta.IDFFMetaException in project OpenAM by OpenRock.

the class IDFFNameIdentifierMapper method getNameIdentifier.

/**
     * Returns mapped <code>NameIdentifier</code> for specified user.   
     * This is used by Discovery Service to generate correct 
     * <code>NameIdentifier</code> when creating credentials for remote
     * service provider. A <code>NameIdentifier</code> in encrypted format
     * will be returned if the mapped <code>NameIdentifier</code> is
     * different from the original <code>NameIdentifier</code>, this
     * is to prevent the <code>NameIdentifier</code> to be revealed
     * to a proxy service provider. 
     * @param spProviderID Provider ID of the service provider to which
     *     the <code>NameIdentifier</code> needs to be mapped. 
     * @param idpProviderID Provider ID of the identifier provider.
     * @param nameId The <code>NameIdentifier</code> needs to be mapped. 
     * @param userID The user whose mapped <code>NameIdentifier</code> will 
     *     be returned. The value is the universal identifier of the user.
     * @return the mapped <code>NameIdentifier</code> for specified user, 
     *     return null if unable to map the <code>NameIdentifier</code>,
     *     return original name identifier if no need to mapp the
     *     <code>NameIdentifier</code>.
     */
public NameIdentifier getNameIdentifier(String spProviderID, String idpProviderID, NameIdentifier nameId, String userID) {
    try {
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("IDFFNameIdentifierMapper, enter " + "spProviderID=" + spProviderID + ", idpProviderID=" + idpProviderID + ", userID=" + userID);
            if (nameId != null) {
                FSUtils.debug.message("IDFFNameIdentifierMapper, enter " + "name identifier=" + nameId.toString());
            }
        }
        if ((spProviderID == null) || (idpProviderID == null) || (userID == null)) {
            return null;
        }
        if (spProviderID.equals(idpProviderID)) {
            // same entity, this is for the case of discovery service as IDP
            return nameId;
        }
        if (nameId != null) {
            String nameQualifier = nameId.getNameQualifier();
            if ((nameQualifier != null) && nameQualifier.equals(spProviderID)) {
                // current name id is intended for the spProviderID 
                return nameId;
            }
        }
        IDFFMetaManager metaManager = FSUtils.getIDFFMetaManager();
        String metaAlias = metaManager.getIDPDescriptorConfig("/", idpProviderID).getMetaAlias();
        FSAccountManager fsaccountmgr = FSAccountManager.getInstance(metaAlias);
        FSAccountFedInfo accountinfo = fsaccountmgr.readAccountFedInfo(userID, spProviderID);
        if (accountinfo != null) {
            NameIdentifier ni = accountinfo.getLocalNameIdentifier();
            FSUtils.debug.message("IDFFNameIdentifierMapper : new Ni");
            ProviderManager pm = ProviderUtil.getProviderManager();
            if (pm != null) {
                Key encKey = pm.getEncryptionKey(spProviderID);
                if (encKey != null) {
                    // passed down through a proxy WSC
                    return EncryptedNameIdentifier.getEncryptedNameIdentifier(ni, spProviderID, encKey, pm.getEncryptionKeyAlgorithm(spProviderID), pm.getEncryptionKeyStrength(spProviderID));
                } else {
                    return ni;
                }
            } else {
                return ni;
            }
        } else {
            return nameId;
        }
    } catch (FSAccountMgmtException e) {
        // the federation info might not be there, just ignore
        FSUtils.debug.message("IDFFNameIdentifierMapper, account error", e);
    } catch (FSException e) {
        // the federation info might not be there, just ignore
        FSUtils.debug.message("IDFFNameIdentifierMapper, encrypt error", e);
    } catch (IDFFMetaException e) {
        // the provider might not be a IDFF provider, just ignore
        FSUtils.debug.message("IDFFNameIdentifierMapper, meta error", e);
    }
    return null;
}