Examples with IDFFMetaException com.sun.identity.federation.meta.IDFFMetaException used on opensource projects

Example 6 with IDFFMetaException

use of com.sun.identity.federation.meta.IDFFMetaException in project OpenAM by OpenRock.

the class LibertyManager method getAllSPList.

/**
     * Returns a list of all trusted Service Providers under the realm.
     *
     * @param realm The realm under which the entity resides.
     * @return an iterator to a list of strings, each containing the
     *  entity ID of a Service Provider.
     */
public static Iterator getAllSPList(String realm) {
    // returns list of sps... for default org.
    // since all the providers have their description under default org..
    // hence returning the List of all the active sps.
    Set spList = new HashSet();
    try {
        if (metaManager != null) {
            // TODO: check if the sp is active if we decide to support it
            spList.addAll(metaManager.getAllHostedServiceProviderEntities(realm));
            spList.addAll(metaManager.getAllRemoteServiceProviderEntities(realm));
        }
    } catch (IDFFMetaException ame) {
        debug.error("LibertyManager: getAllSPList: Error while getting " + " Active ProviderIds  ", ame);
    }
    return spList.iterator();
}

Example 7 with IDFFMetaException

use of com.sun.identity.federation.meta.IDFFMetaException in project OpenAM by OpenRock.

the class LibertyManager method getAllIDPList.

/**
     * Returns a list of all trusted Identity Providers under the realm.
     *
     * @param realm The realm under which the entity resides.
     * @return an iterator to a list of strings, each containing the
     *         entity ID of Identity Providers.
     */
public static Iterator getAllIDPList(String realm) {
    // returns list of idps... for default org.
    // since all the providers have their description under default org..
    // hence returning the List of all the active idps.
    Set idpList = new HashSet();
    try {
        if (metaManager != null) {
            // TODO: check if the idp is active if we decide to support it
            idpList.addAll(metaManager.getAllHostedIdentityProviderIDs(realm));
            idpList.addAll(metaManager.getAllRemoteIdentityProviderIDs(realm));
        }
    } catch (IDFFMetaException ame) {
        debug.error("LibertyManager: getAllIDPList: Error while getting " + " Active ProviderIds  ", ame);
    }
    return idpList.iterator();
}

Example 8 with IDFFMetaException

use of com.sun.identity.federation.meta.IDFFMetaException in project OpenAM by OpenRock.

the class FSDefaultSPAdapter method postSSOFederationSuccess.

/**
     * Invokes this method after the successful Single Sign-On or Federation.
     * @param hostedEntityID provider ID for the hosted SP
     * @param request servlet request
     * @param response servlet response
     * @param ssoToken user's SSO token
     * @param authnRequest the original authentication request sent from SP 
     * @param authnResponse response from IDP if Browser POST or LECP profile
     *        is used for the request, value will be null if Browser Artifact
     *        profile is used. 
     * @param samlResponse response from IDP if Browser Artifact profile is used
     *        for the request, value will be null if Browser POST or LECP 
     *        profile is used.
     * @exception FederationException if user want to fail the process.
     * @return true if browser redirection happened, false otherwise.
     */
public boolean postSSOFederationSuccess(String hostedEntityID, HttpServletRequest request, HttpServletResponse response, Object ssoToken, FSAuthnRequest authnRequest, FSAuthnResponse authnResponse, FSResponse samlResponse) throws FederationException {
    if (FSUtils.debug.messageEnabled()) {
        FSUtils.debug.message("FSDefaultSPAdapter.postFedSuccess, " + "process " + hostedEntityID);
    }
    // find out if this is a federation request
    boolean isFederation = false;
    if (authnRequest == null) {
        FSUtils.debug.error("FSDefaultSPAdapter.postFedSuccess null");
    } else {
        String nameIDPolicy = authnRequest.getNameIDPolicy();
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("FSDefaultSPAdapter.postSuccess " + nameIDPolicy);
        }
        if (nameIDPolicy.equals(IFSConstants.NAME_ID_POLICY_FEDERATED)) {
            isFederation = true;
        }
    }
    SSOToken adminToken = (SSOToken) AccessController.doPrivileged(AdminTokenAction.getInstance());
    if (isFederation && adminToken != null) {
        try {
            // get name Identifier
            String nameId = null;
            List assertions = null;
            String idpEntityId = null;
            if (authnResponse != null) {
                // POST profile
                assertions = authnResponse.getAssertion();
                idpEntityId = authnResponse.getProviderId();
            } else {
                // Artifact profile
                assertions = samlResponse.getAssertion();
            }
            FSAssertion assertion = (FSAssertion) assertions.iterator().next();
            if (idpEntityId == null) {
                idpEntityId = assertion.getIssuer();
            }
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("FSAdapter.postSuccess: idp=" + idpEntityId);
            }
            Iterator stmtIter = assertion.getStatement().iterator();
            while (stmtIter.hasNext()) {
                Statement statement = (Statement) stmtIter.next();
                int stmtType = statement.getStatementType();
                if (stmtType == Statement.AUTHENTICATION_STATEMENT) {
                    FSAuthenticationStatement authStatement = (FSAuthenticationStatement) statement;
                    FSSubject subject = (FSSubject) authStatement.getSubject();
                    NameIdentifier ni = subject.getIDPProvidedNameIdentifier();
                    if (ni == null) {
                        ni = subject.getNameIdentifier();
                    }
                    if (ni != null) {
                        nameId = ni.getName();
                    }
                    if (FSUtils.debug.messageEnabled()) {
                        FSUtils.debug.message("FSAdapter.postSuccess: " + "found name id =" + nameId);
                    }
                    break;
                }
            }
            if (nameId == null) {
                FSUtils.debug.warning("FSAdapter.postSuc : null nameID");
                return false;
            }
            Map map = new HashMap();
            Set set = new HashSet();
            set.add("|" + hostedEntityID + "|" + nameId + "|");
            map.put("iplanet-am-user-federation-info-key", set);
            AMIdentityRepository idRepo = new AMIdentityRepository(adminToken, ((SSOToken) ssoToken).getProperty(ISAuthConstants.ORGANIZATION));
            IdSearchControl searchControl = new IdSearchControl();
            searchControl.setTimeOut(0);
            searchControl.setMaxResults(0);
            searchControl.setAllReturnAttributes(false);
            searchControl.setSearchModifiers(IdSearchOpModifier.AND, map);
            IdSearchResults searchResults = idRepo.searchIdentities(IdType.USER, "*", searchControl);
            Set amIdSet = searchResults.getSearchResults();
            if (amIdSet.size() > 1) {
                String univId = ((SSOToken) ssoToken).getProperty(Constants.UNIVERSAL_IDENTIFIER);
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("FSAdapter.postSuccess: found " + amIdSet.size() + " federation with same ID as " + univId);
                }
                String metaAlias = null;
                try {
                    IDFFMetaManager metaManager = new IDFFMetaManager(ssoToken);
                    if (metaManager != null) {
                        SPDescriptorConfigElement spConfig = metaManager.getSPDescriptorConfig(realm, hostedEntityID);
                        if (spConfig != null) {
                            metaAlias = spConfig.getMetaAlias();
                        }
                    }
                } catch (IDFFMetaException ie) {
                    if (FSUtils.debug.messageEnabled()) {
                        FSUtils.debug.message("FSAdapter.postSuccess: " + "couldn't find meta alias:", ie);
                    }
                }
                FSAccountManager accManager = FSAccountManager.getInstance(metaAlias);
                FSAccountFedInfoKey fedInfoKey = new FSAccountFedInfoKey(hostedEntityID, nameId);
                // previous federation exists with different users
                Iterator it = amIdSet.iterator();
                while (it.hasNext()) {
                    AMIdentity amId = (AMIdentity) it.next();
                    // compare with the SSO token
                    String tmpUnivId = IdUtils.getUniversalId(amId);
                    if (univId.equalsIgnoreCase(tmpUnivId)) {
                        continue;
                    }
                    // remove federation information for this user
                    if (FSUtils.debug.messageEnabled()) {
                        FSUtils.debug.message("FSAdapter.postSucces, " + "remove fed info for user " + tmpUnivId);
                    }
                    accManager.removeAccountFedInfo(tmpUnivId, fedInfoKey, idpEntityId);
                }
            }
        } catch (FSAccountMgmtException f) {
            FSUtils.debug.warning("FSDefaultSPAdapter.postSSOSuccess", f);
        } catch (IdRepoException i) {
            FSUtils.debug.warning("FSDefaultSPAdapter.postSSOSuccess", i);
        } catch (SSOException e) {
            FSUtils.debug.warning("FSDefaultSPAdapter.postSSOSuccess", e);
        }
    }
    return false;
}

Example 9 with IDFFMetaException

use of com.sun.identity.federation.meta.IDFFMetaException in project OpenAM by OpenRock.

the class FSProcessLogoutServlet method doGetPost.

/**
     * Handles single logout request.
     * @param request an <code>HttpServletRequest</code> object that contains
     *  the request the client has made of the servlet.
     * @param response an <code>HttpServletResponse</code> object that contains
     *  the response the servlet sends to the client.
     * @exception ServletException if an input or output error is detected when
     *                             the servlet handles the request
     * @exception IOException if the request could not be handled
     */
private void doGetPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    FSUtils.debug.message("FSProcessLogoutServlet doGetPost...");
    // Alias processing
    String providerAlias = request.getParameter(IFSConstants.META_ALIAS);
    if (providerAlias == null || providerAlias.length() == 0) {
        providerAlias = FSServiceUtils.getMetaAlias(request);
    }
    if (providerAlias == null || providerAlias.length() < 1) {
        FSUtils.debug.error("Unable to retrieve alias, Hosted Provider. " + "Cannot process request");
        response.sendError(response.SC_INTERNAL_SERVER_ERROR, FSUtils.bundle.getString("aliasNotFound"));
        return;
    }
    if (metaManager == null) {
        FSUtils.debug.error("Cannot retrieve hosted descriptor. " + "Cannot process request");
        response.sendError(response.SC_INTERNAL_SERVER_ERROR, FSUtils.bundle.getString(IFSConstants.FAILED_HOSTED_DESCRIPTOR));
        return;
    }
    String realm = IDFFMetaUtils.getRealmByMetaAlias(providerAlias);
    ProviderDescriptorType hostedProviderDesc = null;
    BaseConfigType hostedConfig = null;
    String hostedRole = null;
    String hostedEntityId = null;
    try {
        hostedRole = metaManager.getProviderRoleByMetaAlias(providerAlias);
        hostedEntityId = metaManager.getEntityIDByMetaAlias(providerAlias);
        if (hostedRole != null) {
            if (hostedRole.equalsIgnoreCase(IFSConstants.IDP)) {
                hostedProviderDesc = metaManager.getIDPDescriptor(realm, hostedEntityId);
                hostedConfig = metaManager.getIDPDescriptorConfig(realm, hostedEntityId);
            } else if (hostedRole.equalsIgnoreCase(IFSConstants.SP)) {
                hostedProviderDesc = metaManager.getSPDescriptor(realm, hostedEntityId);
                hostedConfig = metaManager.getSPDescriptorConfig(realm, hostedEntityId);
            }
        }
        if (hostedProviderDesc == null) {
            throw new IDFFMetaException((String) null);
        }
    } catch (IDFFMetaException eam) {
        FSUtils.debug.error("Unable to find Hosted Provider. " + "not process request", eam);
        response.sendError(response.SC_INTERNAL_SERVER_ERROR, FSUtils.bundle.getString(IFSConstants.FAILED_HOSTED_DESCRIPTOR));
        return;
    }
    String logoutDoneURL = FSServiceUtils.getLogoutDonePageURL(request, hostedConfig, providerAlias);
    String commonErrorPage = FSServiceUtils.getErrorPageURL(request, hostedConfig, providerAlias);
    if (FSUtils.debug.messageEnabled()) {
        FSUtils.debug.message("logoutDoneURL : " + logoutDoneURL + "\ncommonErrorPage : " + commonErrorPage);
    }
    String sourceCheck = (String) request.getAttribute("logoutSource");
    if (sourceCheck == null) {
        sourceCheck = request.getParameter("logoutSource");
    }
    Object ssoToken = getValidToken(request);
    String userID = null;
    if (ssoToken == null) {
        if (sourceCheck != null) {
            if (sourceCheck.equalsIgnoreCase("local")) {
                // status=noSession
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("FSProcessLogoutServlet, " + "control where Source is local");
                }
                FSServiceUtils.returnLocallyAfterOperation(response, logoutDoneURL, false, IFSConstants.LOGOUT_SUCCESS, IFSConstants.LOGOUT_NO_SESSION);
                return;
            } else if (sourceCheck.equalsIgnoreCase("remote")) {
                // logout return
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("Control where Source is remote - not from app" + "link but from other provider");
                }
                FSServiceUtils.returnLocallyAfterOperation(response, logoutDoneURL, true, IFSConstants.LOGOUT_SUCCESS, IFSConstants.LOGOUT_FAILURE);
                return;
            } else if (sourceCheck.equalsIgnoreCase("logoutGet")) {
                // logout Get profile
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("Control where Source is Http Get action - " + "not from app link ");
                }
                FSServiceUtils.returnLocallyAfterOperation(response, logoutDoneURL, true, IFSConstants.LOGOUT_SUCCESS, IFSConstants.LOGOUT_FAILURE);
                return;
            }
        }
    } else {
        try {
            userID = SessionManager.getProvider().getPrincipalName(ssoToken);
        } catch (SessionException ssoExp) {
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("Couldn't get user object:", ssoExp);
            }
        }
        if (sourceCheck != null) {
            if (sourceCheck.equalsIgnoreCase("local")) {
                // initiate logout
                FSUtils.debug.message("Control where Source is local -  from applink");
                doLogoutInitiation(request, response, hostedProviderDesc, hostedConfig, realm, hostedEntityId, hostedRole, providerAlias, ssoToken, logoutDoneURL, sourceCheck);
                return;
            } else if (sourceCheck.equalsIgnoreCase("remote")) {
                // logout return
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("Control where Source is remote - not from app" + "link but from other provider. Token valid");
                }
                doLogoutInitiation(request, response, hostedProviderDesc, hostedConfig, realm, hostedEntityId, hostedRole, providerAlias, ssoToken, logoutDoneURL, sourceCheck);
                return;
            } else if (sourceCheck.equalsIgnoreCase("logoutGet")) {
                // logout Get profile
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("Control where Source is Http Get action - not from" + " applink. Initiation will take care in " + "preLogouthandler ");
                }
                doLogoutInitiation(request, response, hostedProviderDesc, hostedConfig, realm, hostedEntityId, hostedRole, providerAlias, ssoToken, logoutDoneURL, sourceCheck);
                return;
            }
        }
    }
    // received logout request from remote provider
    FSLogoutNotification logoutObj = null;
    try {
        logoutObj = FSLogoutNotification.parseURLEncodedRequest(request);
    } catch (FSMsgException e) {
        // FSMsgException would mean that the request does not have the
        // FSLogoutNotification message, so show error page
        FSUtils.debug.message("Bad Logout request. calling showErrorPage");
        FSServiceUtils.showErrorPage(response, commonErrorPage, IFSConstants.LOGOUT_REQUEST_IMPROPER, IFSConstants.LOGOUT_FAILED);
        return;
    }
    if (logoutObj == null) {
        FSUtils.debug.message("Bad Logout request. calling showErrorPage");
        FSServiceUtils.showErrorPage(response, commonErrorPage, IFSConstants.LOGOUT_REQUEST_IMPROPER, IFSConstants.LOGOUT_FAILED);
    } else {
        doRequestProcessing(request, response, hostedProviderDesc, hostedConfig, hostedRole, realm, hostedEntityId, providerAlias, logoutObj, commonErrorPage, userID, ssoToken);
    }
    return;
}

Example 10 with IDFFMetaException

use of com.sun.identity.federation.meta.IDFFMetaException in project OpenAM by OpenRock.

the class FSProcessLogoutServlet method doRequestProcessing.

/**
     * Initiates logout request processing. It is called when a logout request
     * is received from a remote provider.
     * @param request <code>HTTPServletRequest</code> object received via a
     *  HTTP Redirect
     * @param response <code>HTTPServletResponse</code> object to be sent back
     *  to user agent
     * @param hostedDescriptor the provider for whom request is received
     * @param hostedConfig hosted provider's extended meta config
     * @param hostedRole hosted provider's role
     * @param realm the realm in which the entity resides
     * @param hostedEntityId hosted provider's entity id
     * @param metaAlias hosted provider's meta alias
     * @param reqLogout the single logout request
     * @param commonErrorPage where to go if an error occurred
     * @param userID user id
     * @param ssoToken user session object
     */
private void doRequestProcessing(HttpServletRequest request, HttpServletResponse response, ProviderDescriptorType hostedDescriptor, BaseConfigType hostedConfig, String hostedRole, String realm, String hostedEntityId, String metaAlias, FSLogoutNotification reqLogout, String commonErrorPage, String userID, Object ssoToken) {
    FSUtils.debug.message("Entered FSProcessLogoutServlet::doRequestProcessing");
    int minorVersion = reqLogout.getMinorVersion();
    String remoteEntityId = reqLogout.getProviderId();
    ProviderDescriptorType remoteDesc = null;
    boolean isIDP = false;
    try {
        if (hostedRole != null) {
            if (hostedRole.equalsIgnoreCase(IFSConstants.IDP)) {
                remoteDesc = metaManager.getSPDescriptor(realm, remoteEntityId);
            } else if (hostedRole.equalsIgnoreCase(IFSConstants.SP)) {
                remoteDesc = metaManager.getIDPDescriptor(realm, remoteEntityId);
                isIDP = true;
            }
        }
        if (remoteDesc == null) {
            throw new IDFFMetaException((String) null);
        }
    } catch (IDFFMetaException e) {
        FSUtils.debug.error("Remote provider metadata not found.");
        String[] data = { remoteEntityId, realm };
        LogUtil.error(Level.INFO, LogUtil.INVALID_PROVIDER, data, ssoToken);
        FSLogoutUtil.returnToSource(response, remoteDesc, IFSConstants.SAML_RESPONDER, commonErrorPage, minorVersion, hostedConfig, hostedEntityId, userID);
        return;
    }
    boolean bVerify = true;
    if (FSServiceUtils.isSigningOn()) {
        try {
            FSUtils.debug.message("Calling verifyLogoutSignature");
            bVerify = verifyLogoutSignature(request, remoteDesc, remoteEntityId, isIDP);
        } catch (FSException e) {
            FSUtils.debug.error("FSProcessLogoutServlet::doRequestProcessing " + "Signature on Logout request is invalid" + "Cannot proceed federation Logout");
            String[] data = { userID };
            LogUtil.error(Level.INFO, LogUtil.INVALID_SIGNATURE, data, ssoToken);
            FSLogoutUtil.returnToSource(response, remoteDesc, IFSConstants.SAML_REQUESTER, commonErrorPage, minorVersion, hostedConfig, hostedEntityId, userID);
            return;
        } catch (SAMLException e) {
            FSUtils.debug.error("FSProcessLogoutServlet::doRequestProcessing(SAML) " + "Signature on Logout request is invalid" + "Cannot proceed federation Logout");
            String[] data = { userID };
            LogUtil.error(Level.INFO, LogUtil.INVALID_SIGNATURE, data, ssoToken);
            FSLogoutUtil.returnToSource(response, remoteDesc, IFSConstants.SAML_REQUESTER, commonErrorPage, minorVersion, hostedConfig, hostedEntityId, userID);
            return;
        }
    }
    String errorStatus = IFSConstants.SAML_RESPONDER;
    if (bVerify) {
        // Check if trusted provider
        if (metaManager.isTrustedProvider(realm, hostedEntityId, remoteEntityId)) {
            //Object ssoToken = getValidToken(request);
            if (ssoToken != null) {
                // session is valid, start single logout
                // Invoke Messaging APIs to get providerid from request
                FSServiceManager instSManager = FSServiceManager.getInstance();
                if (instSManager != null) {
                    FSUtils.debug.message("FSServiceManager Instance not null");
                    // Call SP Adapter preSingleLogoutProcess
                    // for IDP/HTTP case
                    callPreSingleLogoutProcess(request, response, hostedRole, hostedConfig, hostedEntityId, userID, reqLogout);
                    FSPreLogoutHandler handlerObj = instSManager.getPreLogoutHandler();
                    if (handlerObj != null) {
                        handlerObj.setLogoutRequest(reqLogout);
                        handlerObj.setHostedDescriptor(hostedDescriptor);
                        handlerObj.setHostedDescriptorConfig(hostedConfig);
                        handlerObj.setRealm(realm);
                        handlerObj.setHostedEntityId(hostedEntityId);
                        handlerObj.setHostedProviderRole(hostedRole);
                        handlerObj.setMetaAlias(metaAlias);
                        handlerObj.setRemoteEntityId(remoteEntityId);
                        handlerObj.setRemoteDescriptor(remoteDesc);
                        handlerObj.processHttpSingleLogoutRequest(request, response, ssoToken);
                        return;
                    }
                } else {
                    if (FSUtils.debug.messageEnabled()) {
                        FSUtils.debug.message("FSServiceManager Instance null. Cannot" + " continue logout");
                    }
                    String[] data = { userID };
                    LogUtil.error(Level.INFO, LogUtil.LOGOUT_FAILED, data, ssoToken);
                    FSLogoutUtil.returnToSource(response, remoteDesc, IFSConstants.SAML_RESPONDER, commonErrorPage, minorVersion, hostedConfig, hostedEntityId, userID);
                    return;
                }
            } else {
                // ssoToken is null
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("Invalid session in request processing. " + "Nothing to logout");
                }
                //Verify request,getUserDNcall destroyPrincipalSession
                userID = FSLogoutUtil.getUserFromRequest(reqLogout, realm, hostedEntityId, hostedRole, hostedConfig, metaAlias);
                if (userID != null) {
                    FSLogoutUtil.destroyPrincipalSession(userID, metaAlias, reqLogout.getSessionIndex(), request, response);
                    // Here we need to send back to source
                    // provider's return URL
                    FSLogoutUtil.returnToSource(response, remoteDesc, IFSConstants.SAML_RESPONDER, commonErrorPage, minorVersion, hostedConfig, hostedEntityId, userID);
                    return;
                }
            }
        } else {
            FSUtils.debug.error("Remote provider not in trusted list");
        }
    } else {
        FSUtils.debug.error("FSProcessLogoutServlet::doRequestProcesing " + "Signature on Logout request is invalid" + "Cannot proceed federation Logout");
        String[] data = { userID };
        LogUtil.error(Level.INFO, LogUtil.INVALID_SIGNATURE, data, ssoToken);
        errorStatus = IFSConstants.SAML_REQUESTER;
    }
    FSLogoutUtil.returnToSource(response, remoteDesc, errorStatus, commonErrorPage, minorVersion, hostedConfig, hostedEntityId, userID);
    return;
}