Examples with NameIdentifier com.sun.identity.saml.assertion.NameIdentifier used on opensource projects

Example 21 with NameIdentifier

use of com.sun.identity.saml.assertion.NameIdentifier in project OpenAM by OpenRock.

the class DefaultPartnerAccountMapper method getUser.

protected void getUser(Subject subject, String sourceID, Map<String, String> map) {
    // No need to check SSO in SubjectConfirmation here
    // since AssertionManager will handle it without calling account mapper
    NameIdentifier nameIdentifier = subject.getNameIdentifier();
    if (nameIdentifier != null) {
        String name = nameIdentifier.getName();
        String org = nameIdentifier.getNameQualifier();
        String rootSuffix = SMSEntry.getRootSuffix();
        if (name != null && (name.length() != 0)) {
            if (org != null && (org.length() != 0)) {
                DN dn1 = DN.valueOf(name);
                DN dn2 = DN.valueOf(org);
                if (dn1.isInScopeOf(dn2, SearchScope.SUBORDINATES)) {
                    StringBuilder sb = new StringBuilder(50);
                    for (RDN rdn : dn1) {
                        sb.append(rdn.toString()).append(",");
                    }
                    sb.append(rootSuffix);
                    if (SAMLUtils.debug.messageEnabled()) {
                        SAMLUtils.debug.message("DefaultPAccountMapper: " + "name = " + sb.toString());
                    }
                    map.put(NAME, sb.toString());
                } else {
                    SAMLUtils.debug.warning("DefaultPAMapper:to anonymous");
                    // map to anonymous user
                    map.put(NAME, ANONYMOUS_USER);
                }
            } else {
                SAMLUtils.debug.warning("DefaultAccountMapper: Org null.");
                // map to anonymous user
                map.put(NAME, ANONYMOUS_USER);
            }
        } else {
            SAMLUtils.debug.warning("DefaultAccountMapper: Name is null");
            // map to anonymous user
            map.put(NAME, ANONYMOUS_USER);
        }
        map.put(ORG, "/");
    }
}

Example 22 with NameIdentifier

use of com.sun.identity.saml.assertion.NameIdentifier in project OpenAM by OpenRock.

the class NameIDPartnerAccountMapper method getUser.

protected void getUser(Subject subject, String sourceID, Map map) {
    // Get name id 
    NameIdentifier nameIdentifier = subject.getNameIdentifier();
    if (nameIdentifier != null) {
        String name = nameIdentifier.getName();
        if (name != null && (!name.equals(""))) {
            if (SAMLUtils.debug.messageEnabled()) {
                SAMLUtils.debug.message("NameIDPartnerAccountMapper: name=" + name);
            }
            map.put(NAME, getUserName(name));
        } else {
            SAMLUtils.debug.warning("NameIDPAccountMapper: Name is null");
            map.put(NAME, ANONYMOUS_USER);
        }
        String rootSuffix = SMSEntry.getRootSuffix();
        map.put(ORG, "/");
    }
}

Example 23 with NameIdentifier

use of com.sun.identity.saml.assertion.NameIdentifier in project OpenAM by OpenRock.

the class FSAssertionArtifactHandler method processAuthnResponse.

/**
     * Processes <code>FSAuthnResponse</code>.
     * @param authnResponse <code>FSAuthnResponse</code> objec to be processed
     */
public void processAuthnResponse(FSAuthnResponse authnResponse) {
    FSUtils.debug.message("FSAssertionArtifactHandler.ProcessAuthnResponse: Called");
    this.authnResponse = authnResponse;
    // Call SP adapter SPI
    FederationSPAdapter spAdapter = FSServiceUtils.getSPAdapter(hostEntityId, hostConfig);
    if (spAdapter != null) {
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("FSAssertionArtifactHandler, POST" + " Invokde spAdapter.preSSOFederationProcess");
        }
        try {
            spAdapter.preSSOFederationProcess(hostEntityId, request, response, authnRequest, authnResponse, null);
        } catch (Exception e) {
            // log run time exception in Adapter
            // implementation, continue
            FSUtils.debug.error("FSAssertionArtifactHandler" + " SPAdapter.preSSOFederationSuccess", e);
        }
    }
    String baseURL = FSServiceUtils.getBaseURL(request);
    String framedLoginPageURL = FSServiceUtils.getCommonLoginPageURL(hostMetaAlias, authnRequest.getRelayState(), null, request, baseURL);
    this.relayState = authnRequest.getRelayState();
    if ((this.relayState == null) || (this.relayState.trim().length() == 0)) {
        this.relayState = IDFFMetaUtils.getFirstAttributeValueFromConfig(hostConfig, IFSConstants.PROVIDER_HOME_PAGE_URL);
        if ((this.relayState == null) || (this.relayState.trim().length() == 0)) {
            this.relayState = baseURL + IFSConstants.SP_DEFAULT_RELAY_STATE;
        }
    }
    try {
        if (authnResponse == null) {
            String[] data = { FSUtils.bundle.getString("missingAuthnResponse") };
            LogUtil.error(Level.INFO, LogUtil.MISSING_AUTHN_RESPONSE, data, ssoToken);
            FSUtils.debug.error("FSAssertionArtifactHandler." + "processAuthnResponse: " + FSUtils.bundle.getString("missingAuthnResponse") + " AuthnRequest Processing Failed at the IDP " + "Redirecting to the Framed Login Page");
            response.sendRedirect(framedLoginPageURL);
            return;
        }
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("FSAssertionArtifactHandler.doPost:Received " + authnResponse.toXMLString());
        }
        boolean valid = verifyResponseStatus(authnResponse);
        if (!valid) {
            FSSessionManager sessionManager = FSSessionManager.getInstance(hostMetaAlias);
            // clean request map
            String inResponseTo = authnResponse.getInResponseTo();
            sessionManager.removeAuthnRequest(inResponseTo);
            String[] data = { authnResponse.toXMLString() };
            LogUtil.error(Level.INFO, LogUtil.INVALID_AUTHN_RESPONSE, data, ssoToken);
            FSUtils.debug.warning("FSAssertionArtifactHandler." + " processAuthnResponse: " + FSUtils.bundle.getString("invalidResponse") + " AuthnRequest Processing Failed at the IDP" + " Redirecting to the Framed Login Page");
            if ((spAdapter == null) || !(spAdapter.postSSOFederationFailure(hostEntityId, request, response, authnRequest, authnResponse, null, FederationSPAdapter.INVALID_AUTHN_RESPONSE))) {
                response.sendRedirect(framedLoginPageURL);
            }
            return;
        }
        // check Assertion
        List assertions = authnResponse.getAssertion();
        FSSubject validSubject = (FSSubject) validateAssertions(assertions);
        if (validSubject == null) {
            String[] data = { FSUtils.bundle.getString("invalidAssertion") };
            LogUtil.error(Level.INFO, LogUtil.INVALID_ASSERTION, data, ssoToken);
            FSUtils.debug.error("FSAssertionArtifactHandler." + "processAuthnResponse: " + FSUtils.bundle.getString("InvalidResponse") + " AuthnRequest Processing Failed at the IDP" + " Redirecting to the Framed Login Page");
            response.sendRedirect(framedLoginPageURL);
            return;
        }
        FSSessionManager sessionManager = FSSessionManager.getInstance(hostMetaAlias);
        if (doFederate) {
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("FSAssertionArtifactHandler." + "processAuthnResponse: Initiate Account Federation");
            }
            NameIdentifier ni = validSubject.getIDPProvidedNameIdentifier();
            if (ni == null) {
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("FSAssertionArtifactHandler.processAuthnResponse:" + " IDPProvided NameIdentifier is null");
                }
                ni = validSubject.getNameIdentifier();
            }
            if (ni != null) {
                int returnCode = doAccountFederation(ni);
                if (returnCode == FederationSPAdapter.SUCCESS) {
                    if (FSUtils.debug.messageEnabled()) {
                        FSUtils.debug.message("FSAssertionArtifactHandler." + "processAuthnResponse: Account federation" + " successful");
                    }
                    String inResponseTo = authnResponse.getInResponseTo();
                    sessionManager.removeAuthnRequest(inResponseTo);
                    sessionManager.removeLocalSessionToken(inResponseTo);
                    return;
                } else {
                    String[] data = { FSUtils.bundle.getString("AccountFederationFailed") };
                    LogUtil.error(Level.INFO, LogUtil.ACCOUNT_FEDERATION_FAILED, data, ssoToken);
                    FSUtils.debug.error("FSAssertionArtifactHandler." + "processAuthnResponse: " + FSUtils.bundle.getString("AccountFederationFailed") + " AuthnRequest Processing Failed at the IDP" + " Redirecting to the Framed Login Page");
                    if (spAdapter == null || !spAdapter.postSSOFederationFailure(hostEntityId, request, response, authnRequest, authnResponse, (FSResponse) samlResponse, returnCode)) {
                        response.sendRedirect(framedLoginPageURL);
                    }
                }
            } else {
                throw new FSException("missingNIofSubject", null);
            }
        } else {
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("FSAssertionArtifactHandler." + "processAuthnResponse: Initiate SingleSign-On");
            }
            //check for SPProvidedNameIdentifier
            NameIdentifier niIdp = validSubject.getIDPProvidedNameIdentifier();
            NameIdentifier ni = validSubject.getNameIdentifier();
            if (niIdp == null) {
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("FSAssertionArtifactHandler.processAuthnResponse:" + " IDPProvided NameIdentifier is null");
                }
                niIdp = ni;
            }
            if ((niIdp == null) || (ni == null)) {
                String[] data = { FSUtils.bundle.getString("invalidResponse") };
                LogUtil.error(Level.INFO, LogUtil.INVALID_AUTHN_RESPONSE, data, ssoToken);
                FSUtils.debug.error("FSAssertionArtifactHandler." + " processAuthnResponse: " + FSUtils.bundle.getString("invalidResponse") + " AuthnRequest Processing Failed at the IDP" + " Redirecting to the Framed Login Page");
                response.sendRedirect(framedLoginPageURL);
                return;
            }
            String idpHandle = niIdp.getName();
            String spHandle = ni.getName();
            int handleType;
            if ((idpHandle == null) || (spHandle == null)) {
                String[] data = { FSUtils.bundle.getString("invalidResponse") };
                LogUtil.error(Level.INFO, LogUtil.INVALID_AUTHN_RESPONSE, data, ssoToken);
                FSUtils.debug.error("FSAssertionArtifactHandler." + "processAuthnResponse: " + FSUtils.bundle.getString("invalidResponse") + " AuthnRequest Processing Failed at the IDP" + " Redirecting to the Framed Login Page");
                response.sendRedirect(framedLoginPageURL);
                return;
            }
            if (idpHandle.equals(spHandle)) {
                ni = niIdp;
                handleType = IFSConstants.REMOTE_OPAQUE_HANDLE;
            } else {
                handleType = IFSConstants.LOCAL_OPAQUE_HANDLE;
            }
            Map env = new HashMap();
            env.put(IFSConstants.FS_USER_PROVIDER_ENV_AUTHNRESPONSE_KEY, authnResponse);
            int returnCode = doSingleSignOn(ni, handleType, niIdp, env);
            if (returnCode == FederationSPAdapter.SUCCESS) {
                if (FSUtils.debug.messageEnabled()) {
                    FSUtils.debug.message("FSAssertionArtifactHandler." + "processAuthnResponse: Accountfederation successful");
                }
                String requestID = authnResponse.getInResponseTo();
                sessionManager.removeAuthnRequest(requestID);
                if (isIDPProxyEnabled(requestID)) {
                    sendProxyResponse(requestID);
                    return;
                }
                String[] data = { this.relayState };
                LogUtil.access(Level.INFO, LogUtil.ACCESS_GRANTED_REDIRECT_TO, data, ssoToken);
                FSUtils.debug.message("ArtifactHandler.notfederated, postSSO");
                if (spAdapter != null) {
                    if (FSUtils.debug.messageEnabled()) {
                        FSUtils.debug.message("FSAssertionArtifactHandler," + " Invoke spAdapter.postSSOFederationSuccess");
                    }
                    try {
                        if (spAdapter.postSSOFederationSuccess(hostEntityId, request, response, ssoToken, authnRequest, authnResponse, null)) {
                            // return if the SP spi redirection happened
                            return;
                        }
                    } catch (Exception e) {
                        // log run time exception in Adapter
                        // implementation, continue
                        FSUtils.debug.error("FSAssertionArtifadctHandler" + " SPAdapter.postSSOFederationSuccess:", e);
                    }
                }
                redirectToResource(this.relayState);
                return;
            } else {
                String[] data = { FSUtils.bundle.getString("SSOfailed") };
                LogUtil.error(Level.INFO, LogUtil.SINGLE_SIGNON_FAILED, data, ssoToken);
                FSUtils.debug.error("FSAssertionArtifactHandler." + "processAuthnResponse: " + FSUtils.bundle.getString("invalidResponse") + " AuthnRequest Processing Failed at the IDP" + " Redirecting to the Framed Login Page");
                if (spAdapter == null || !spAdapter.postSSOFederationFailure(hostEntityId, request, response, authnRequest, authnResponse, null, returnCode)) {
                    response.sendRedirect(framedLoginPageURL);
                }
                return;
            }
        }
    } catch (Exception e) {
        FSUtils.debug.error("FSAssertionArtifactHandler." + "processAuthnResponse: Exception Occured: ", e);
        try {
            FSUtils.debug.error("FSAssertionArtifactHandler." + "processAuthnResponse: " + FSUtils.bundle.getString("invalidResponse") + " AuthnRequest Processing Failed at the IDP" + " Redirecting to the Framed Login Page");
            response.sendRedirect(framedLoginPageURL);
        } catch (IOException ioe) {
            FSUtils.debug.error("FSAssertionArtifactHandler." + "processAuthnResponse: IOException Occured: ", ioe);
            return;
        }
        return;
    }
}

Example 24 with NameIdentifier

use of com.sun.identity.saml.assertion.NameIdentifier in project OpenAM by OpenRock.

the class FSSSOAndFedHandler method doAccountFederation.

protected FSAccountFedInfo doAccountFederation(Object ssoToken, FSAuthnRequest authnRequest, FSSession session) {
    FSUtils.debug.message("FSSSOAndFedHandler.doAccountFederation: Called");
    String nameIDPolicy = authnRequest.getNameIDPolicy();
    String affiliationID = authnRequest.getAffiliationID();
    boolean isAffiliationFed = false;
    if (affiliationID != null) {
        try {
            isAffiliationFed = metaManager.isAffiliateMember(realm, hostedEntityId, affiliationID);
        } catch (Exception e) {
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("FSSSOAndFedHandler.doAccount" + "Federation:Error in checking for the affiliation:", e);
            }
        }
    }
    try {
        SessionProvider sessionProvider = SessionManager.getProvider();
        String userID = sessionProvider.getPrincipalName(ssoToken);
        FSAccountFedInfo existActInfo = null;
        if (isAffiliationFed) {
            existActInfo = accountManager.readAccountFedInfo(userID, affiliationID);
            if (existActInfo != null && existActInfo.isFedStatusActive()) {
                return existActInfo;
            }
        }
        // Check if there is an existing fed info
        String nameQualifier = authnRequest.getProviderId();
        existActInfo = accountManager.readAccountFedInfo(userID, nameQualifier);
        if (existActInfo != null && existActInfo.isFedStatusActive()) {
            return existActInfo;
        }
        FSNameIdentifierHelper nameHelper = new FSNameIdentifierHelper(hostedConfig);
        String opaqueHandle = nameHelper.createNameIdentifier();
        if (opaqueHandle == null) {
            FSUtils.debug.error("FSSSOAndFedHandler.doAccountFederation: " + "Could not generate handle");
            return null;
        }
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("FSSSOAndFedHandler.doAccountFederation: " + "Generated handle: " + opaqueHandle);
        }
        if (isAffiliationFed) {
            nameQualifier = affiliationID;
        }
        NameIdentifier ni = new NameIdentifier(opaqueHandle, nameQualifier);
        if (authnRequest.getMinorVersion() == IFSConstants.FF_12_PROTOCOL_MINOR_VERSION) {
            if (nameIDPolicy == null || !nameIDPolicy.equals(IFSConstants.NAME_ID_POLICY_ONETIME)) {
                ni.setFormat(IFSConstants.NI_FEDERATED_FORMAT_URI);
            } else {
                ni.setFormat(IFSConstants.NI_ONETIME_FORMAT_URI);
            }
        }
        FSAccountFedInfo accountInfo = new FSAccountFedInfo(authnRequest.getProviderId(), ni, null, false);
        FSAccountFedInfoKey fedKey = null;
        if (isAffiliationFed) {
            fedKey = new FSAccountFedInfoKey(affiliationID, opaqueHandle);
            accountInfo.setAffiliation(true);
        } else {
            fedKey = new FSAccountFedInfoKey(authnRequest.getProviderId(), opaqueHandle);
        }
        if (nameIDPolicy == null || !nameIDPolicy.equals("onetime")) {
            accountManager.writeAccountFedInfo(userID, fedKey, accountInfo);
        } else {
            session.setOneTime(true);
            session.setAccountFedInfo(accountInfo);
            session.setUserID(userID);
        }
        return accountInfo;
    } catch (Exception ex) {
        FSUtils.debug.error("FSSSOAndFedHandler.doAccountFederation: " + "Exception when doing account federation", ex);
        return null;
    }
}

Example 25 with NameIdentifier

use of com.sun.identity.saml.assertion.NameIdentifier in project OpenAM by OpenRock.

the class FSSSOAndFedHandler method processPostAuthnSSO.

/**
     * Handles authentication request after local login.
     * @param authnRequest <code>FSAuthnRequest</code> object
     * @return <code>true</code> if the request is handled successfully;
     *  <code>false</code> otherwise.
     */
public boolean processPostAuthnSSO(FSAuthnRequest authnRequest) {
    FSUtils.debug.message("FSSSOAndFedHandler.processPostAuthnSSO: Called");
    SessionProvider sessionProvider = null;
    try {
        sessionProvider = SessionManager.getProvider();
        if (ssoToken == null) {
            ssoToken = sessionProvider.getSession(request);
        }
        if ((ssoToken == null) || (!sessionProvider.isValid(ssoToken))) {
            FSUtils.debug.error("FSSSOAndFedHandler.processPostAuthnSSO: " + "session is not valid.");
            return false;
        } else {
            if (FSUtils.debug.messageEnabled()) {
                FSUtils.debug.message("FSSSOAndFedHandler.processPostAuthnSSO: " + "session is valid.");
            }
        }
    } catch (SessionException se) {
        FSUtils.debug.error("FSSSOAndFedHandler.processPostAuthnSSO: ", se);
        return false;
    }
    //save session
    String userID = null;
    String sessionID = null;
    try {
        userID = sessionProvider.getPrincipalName(ssoToken);
        sessionID = sessionProvider.getSessionID(ssoToken);
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("FSSSOAndFedHandler.processPostAuthnSSO: " + "UserID of the principal in the session: " + userID + "sessionID of the session: " + sessionID);
        }
    } catch (SessionException ex) {
        FSUtils.debug.error("FSSSOAndFedHandler.processPostAuthnSSO: " + "SessionException occured. " + "Principal information not found in the session: ", ex);
        return false;
    }
    FSSessionManager sessionManager = FSSessionManager.getInstance(metaAlias);
    FSSession session = sessionManager.getSession(userID, sessionID);
    if (session != null) {
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("FSSSOAndFedHandler.processPostAuthnSSO: " + "An existing SSO session found with ID:" + session.getSessionID());
        }
        session.addSessionPartner(new FSSessionPartner(spEntityId, false));
        sessionManager.addSession(userID, session);
    } else {
        if (FSUtils.debug.messageEnabled()) {
            FSUtils.debug.message("FSSSOAndFedHandler.processPostAuthnSSO: " + "No existing SSO session found. " + "Entering a new session to the session manager with ID: " + sessionID);
        }
        session = new FSSession(sessionID);
        String sessionIndex = SAMLUtils.generateID();
        session.setSessionIndex(sessionIndex);
        session.addSessionPartner(new FSSessionPartner(spEntityId, false));
        sessionManager.addSession(userID, session);
    }
    // check for federation
    String autoFedStr = IDFFMetaUtils.getFirstAttributeValueFromConfig(hostedConfig, IFSConstants.ENABLE_AUTO_FEDERATION);
    if (authnRequest.getFederate() || (autoFedStr != null && autoFedStr.equalsIgnoreCase("true"))) {
        FSAccountFedInfo fedInfo = doAccountFederation(ssoToken, authnRequest, session);
        NameIdentifier spNI = null;
        NameIdentifier idpNI = null;
        if (fedInfo == null) {
            FSUtils.debug.error("FSSSOAndFedHandler.processPostAuthnSSO: " + "Accountfederation failed");
            return false;
        } else {
            spNI = fedInfo.getRemoteNameIdentifier();
            idpNI = fedInfo.getLocalNameIdentifier();
            if (idpNI == null) {
                idpNI = fedInfo.getRemoteNameIdentifier();
                if (idpNI == null) {
                    FSUtils.debug.error("FSSSOAndFedHandler.processPost" + "AuthnSSO: Opaque handle not found");
                    return false;
                }
            }
            if (spNI == null) {
                spNI = idpNI;
            }
        }
        return doSingleSignOn(ssoToken, authnRequest.getRequestID(), spNI, idpNI);
    } else {
        return doSingleSignOn(ssoToken, authnRequest.getRequestID());
    }
}