Examples with Assertion com.sun.identity.saml2.assertion.Assertion used on opensource projects

Example 76 with Assertion

use of com.sun.identity.saml2.assertion.Assertion in project OpenAM by OpenRock.

the class DefaultLibraryIDPAttributeMapper method getAttributes.

/**
     * Returns list of SAML <code>Attribute</code> objects for the 
     * IDP framework to insert into the generated <code>Assertion</code>.
     * 
     * @param session Single sign-on session.
     * @param hostEntityID <code>EntityID</code> of the hosted entity.
     * @param remoteEntityID <code>EntityID</code> of the remote entity.
     * @param realm name of the realm.
     * @exception SAML2Exception if any failure.
     */
public List getAttributes(Object session, String hostEntityID, String remoteEntityID, String realm) throws SAML2Exception {
    if (hostEntityID == null) {
        throw new SAML2Exception(bundle.getString("nullHostEntityID"));
    }
    if (realm == null) {
        throw new SAML2Exception(bundle.getString("nullHostEntityID"));
    }
    if (session == null) {
        throw new SAML2Exception(bundle.getString("nullSSOToken"));
    }
    try {
        if (!SessionManager.getProvider().isValid(session)) {
            if (debug.warningEnabled()) {
                debug.warning("DefaultLibraryIDPAttributeMapper." + "getAttributes: Invalid session");
            }
            return null;
        }
        Map<String, String> configMap = getConfigAttributeMap(realm, remoteEntityID, SP);
        if (debug.messageEnabled()) {
            debug.message("DefaultLibraryIDPAttributeMapper." + "getAttributes: remote SP attribute map = " + configMap);
        }
        if (configMap == null || configMap.isEmpty()) {
            configMap = getConfigAttributeMap(realm, hostEntityID, IDP);
            if (configMap == null || configMap.isEmpty()) {
                if (debug.messageEnabled()) {
                    debug.message("DefaultLibraryIDPAttributeMapper." + "getAttributes: Configuration map is not defined.");
                }
                return null;
            }
            if (debug.messageEnabled()) {
                debug.message("DefaultLibraryIDPAttributeMapper." + "getAttributes: hosted IDP attribute map=" + configMap);
            }
        }
        List<Attribute> attributes = new ArrayList<Attribute>();
        Map<String, Set<String>> stringValueMap = null;
        Map<String, byte[][]> binaryValueMap = null;
        if (!isDynamicalOrIgnoredProfile(realm)) {
            try {
                // Resolve attributes to be read from the datastore.
                Set<String> stringAttributes = new HashSet<String>(configMap.size());
                Set<String> binaryAttributes = new HashSet<String>(configMap.size());
                for (String localAttribute : configMap.values()) {
                    if (isStaticAttributeValue(localAttribute)) {
                    // skip over, handled directly in next step
                    } else if (isBinaryAttributeValue(localAttribute)) {
                        // add it to the list of attributes to treat as being binary
                        binaryAttributes.add(removeBinaryFlag(localAttribute));
                    } else {
                        stringAttributes.add(localAttribute);
                    }
                }
                if (!stringAttributes.isEmpty()) {
                    stringValueMap = dsProvider.getAttributes(SessionManager.getProvider().getPrincipalName(session), stringAttributes);
                }
                if (!binaryAttributes.isEmpty()) {
                    binaryValueMap = dsProvider.getBinaryAttributes(SessionManager.getProvider().getPrincipalName(session), binaryAttributes);
                }
            } catch (DataStoreProviderException dse) {
                if (debug.warningEnabled()) {
                    debug.warning("DefaultLibraryIDPAttributeMapper." + "getAttributes:", dse);
                }
            //continue to check in ssotoken.
            }
        }
        for (Map.Entry<String, String> entry : configMap.entrySet()) {
            String samlAttribute = entry.getKey();
            String localAttribute = entry.getValue();
            String nameFormat = null;
            // check if samlAttribute has format nameFormat|samlAttribute
            StringTokenizer tokenizer = new StringTokenizer(samlAttribute, "|");
            if (tokenizer.countTokens() > 1) {
                nameFormat = tokenizer.nextToken();
                samlAttribute = tokenizer.nextToken();
            }
            Set<String> attributeValues = null;
            if (isStaticAttributeValue(localAttribute)) {
                localAttribute = removeStaticFlag(localAttribute);
                // Remove the static flag before using it as the static value
                attributeValues = CollectionUtils.asSet(localAttribute);
                if (debug.messageEnabled()) {
                    debug.message("DefaultLibraryIDPAttributeMapper." + "getAttribute: adding static " + "value " + localAttribute + " for attribute named " + samlAttribute);
                }
            } else {
                if (isBinaryAttributeValue(localAttribute)) {
                    // Remove the flag as not used for lookup
                    localAttribute = removeBinaryFlag(localAttribute);
                    attributeValues = getBinaryAttributeValues(samlAttribute, localAttribute, binaryValueMap);
                } else {
                    if (stringValueMap != null && !stringValueMap.isEmpty()) {
                        attributeValues = stringValueMap.get(localAttribute);
                    } else {
                        if (debug.messageEnabled()) {
                            debug.message("DefaultLibraryIDPAttributeMapper." + "getAttribute: " + localAttribute + " string value map was empty or null");
                        }
                    }
                }
                // If all else fails, try to get the value from the users ssoToken
                if (attributeValues == null || attributeValues.isEmpty()) {
                    if (debug.messageEnabled()) {
                        debug.message("DefaultLibraryIDPAttributeMapper." + "getAttribute: user profile does not have " + "value for " + localAttribute + ", checking SSOToken");
                    }
                    attributeValues = CollectionUtils.asSet(SessionManager.getProvider().getProperty(session, localAttribute));
                }
            }
            if (attributeValues == null || attributeValues.isEmpty()) {
                if (debug.messageEnabled()) {
                    debug.message("DefaultLibraryIDPAttributeMapper.getAttribute: " + "user profile does not have a value for " + localAttribute);
                }
            } else {
                attributes.add(getSAMLAttribute(samlAttribute, nameFormat, attributeValues, hostEntityID, remoteEntityID, realm));
            }
        }
        return attributes;
    } catch (SessionException se) {
        debug.error("DefaultLibraryIDPAttribute.getAttributes: ", se);
        throw new SAML2Exception(se);
    }
}

Example 77 with Assertion

use of com.sun.identity.saml2.assertion.Assertion in project OpenAM by OpenRock.

the class DefaultLibrarySPAccountMapper method getIdentity.

/**
     * Returns the user's distinguished name or the universal ID for the corresponding <code>SAML Assertion</code>. This
     * method will be invoked by the <code>SAML</code> framework while processing the <code>Assertion</code> and
     * retrieves the identity information.
     * The implementation of this method first checks if the NameID-Format is transient and returns the transient user.
     * Otherwise it checks for the user for the corresponding name identifier in the assertion.
     * If not found, then it will check if this is an auto federation case. 
     *
     * @param assertion <code>SAML Assertion</code> that needs to be mapped to the user.
     * @param hostEntityID <code>EntityID</code> of the hosted provider.
     * @param realm Realm or the organization name that may be used to find the user information.
     * @return User's distinguished name or the universal ID.
     * @throws SAML2Exception If there was any failure.
     */
@Override
public String getIdentity(Assertion assertion, String hostEntityID, String realm) throws SAML2Exception {
    if (assertion == null) {
        throw new SAML2Exception(bundle.getString("nullAssertion"));
    }
    if (hostEntityID == null) {
        throw new SAML2Exception(bundle.getString("nullHostEntityID"));
    }
    if (realm == null) {
        throw new SAML2Exception(bundle.getString("nullRealm"));
    }
    NameID nameID;
    EncryptedID encryptedID = assertion.getSubject().getEncryptedID();
    Set<PrivateKey> decryptionKeys = null;
    if (encryptedID != null) {
        decryptionKeys = KeyUtil.getDecryptionKeys(getSSOConfig(realm, hostEntityID));
        nameID = encryptedID.decrypt(decryptionKeys);
    } else {
        nameID = assertion.getSubject().getNameID();
    }
    String userID = null;
    String format = nameID.getFormat();
    boolean isTransient = SAML2Constants.NAMEID_TRANSIENT_FORMAT.equals(format);
    if (isTransient) {
        userID = getTransientUser(realm, hostEntityID);
    }
    if (StringUtils.isNotEmpty(userID)) {
        return userID;
    }
    // Check if this is an auto federation case.
    userID = getAutoFedUser(realm, hostEntityID, assertion, nameID.getValue(), decryptionKeys);
    if (StringUtils.isNotEmpty(userID)) {
        return userID;
    } else {
        if (useNameIDAsSPUserID(realm, hostEntityID) && !isAutoFedEnabled(realm, hostEntityID)) {
            if (debug.messageEnabled()) {
                debug.message("DefaultLibrarySPAccountMapper.getIdentity: use NameID value as userID: " + nameID.getValue());
            }
            return nameID.getValue();
        } else {
            return null;
        }
    }
}

Example 78 with Assertion

use of com.sun.identity.saml2.assertion.Assertion in project OpenAM by OpenRock.

the class SAML2IDPProxyFRImpl method selectIDPBasedOnLOA.

private String selectIDPBasedOnLOA(List<String> idpList, String realm, AuthnRequest authnRequest) {
    String classMethod = "selectIdPBasedOnLOA";
    EntityDescriptorElement idpDesc = null;
    Set authnRequestContextSet = null;
    String idps = "";
    try {
        RequestedAuthnContext requestedAuthnContext = authnRequest.getRequestedAuthnContext();
        if (requestedAuthnContext == null) {
            //In this case we just simply return all the IdPs as each one should support a default AuthnContext.
            return StringUtils.join(idpList, " ");
        }
        List listOfAuthnContexts = requestedAuthnContext.getAuthnContextClassRef();
        debugMessage(classMethod, "listofAuthnContexts: " + listOfAuthnContexts);
        try {
            authnRequestContextSet = new HashSet(listOfAuthnContexts);
        } catch (Exception ex1) {
            authnRequestContextSet = new HashSet();
        }
        if ((idpList != null) && (!idpList.isEmpty())) {
            Iterator idpI = idpList.iterator();
            while (idpI.hasNext()) {
                String idp = (String) idpI.next();
                debugMessage(classMethod, "IDP is: " + idp);
                idpDesc = SAML2Utils.getSAML2MetaManager().getEntityDescriptor(realm, idp);
                if (idpDesc != null) {
                    ExtensionsType et = idpDesc.getExtensions();
                    if (et != null) {
                        debugMessage(classMethod, "Extensions found for idp: " + idp);
                        List idpExtensions = et.getAny();
                        if (idpExtensions != null || !idpExtensions.isEmpty()) {
                            debugMessage(classMethod, "Extensions content found for idp: " + idp);
                            Iterator idpExtensionsI = idpExtensions.iterator();
                            while (idpExtensionsI.hasNext()) {
                                EntityAttributesElement eael = (EntityAttributesElement) idpExtensionsI.next();
                                if (eael != null) {
                                    debugMessage(classMethod, "Entity Attributes found for idp: " + idp);
                                    List attribL = eael.getAttributeOrAssertion();
                                    if (attribL != null || !attribL.isEmpty()) {
                                        Iterator attrI = attribL.iterator();
                                        while (attrI.hasNext()) {
                                            AttributeElement ae = (AttributeElement) attrI.next();
                                            // TODO: Verify what type of element this is (Attribute or assertion)
                                            // For validation purposes
                                            List av = ae.getAttributeValue();
                                            if (av != null || !av.isEmpty()) {
                                                debugMessage(classMethod, "Attribute Values found for idp: " + idp);
                                                Iterator avI = av.iterator();
                                                while (avI.hasNext()) {
                                                    AttributeValueElement ave = (AttributeValueElement) avI.next();
                                                    if (ave != null) {
                                                        List contentL = ave.getContent();
                                                        debugMessage(classMethod, "Attribute Value Elements found for idp: " + idp + "-->" + contentL);
                                                        if (contentL != null || !contentL.isEmpty()) {
                                                            Set idpContextSet = trimmedListToSet(contentL);
                                                            debugMessage(classMethod, "idpContextSet = " + idpContextSet);
                                                            idpContextSet.retainAll(authnRequestContextSet);
                                                            if (idpContextSet != null && !idpContextSet.isEmpty()) {
                                                                idps = idp + " " + idps;
                                                                debugMessage(classMethod, "Extension Values found for idp " + idp + ": " + idpContextSet);
                                                            }
                                                        }
                                                    }
                                                }
                                            }
                                        }
                                    }
                                }
                            }
                        }
                    } else {
                        debugMessage(classMethod, " No extensions found for IdP " + idp);
                    }
                } else {
                    debugMessage(classMethod, "Configuration for the idp " + idp + " was not found in this system");
                }
            }
        }
    } catch (SAML2MetaException me) {
        debugMessage(classMethod, "SOmething went wrong: " + me);
    }
    debugMessage(classMethod, " IDPList returns: " + idps);
    return idps.trim();
}

Example 79 with Assertion

use of com.sun.identity.saml2.assertion.Assertion in project OpenAM by OpenRock.

the class IDPSSOUtil method getACSurlFromMetaByBinding.

/**
     * Returns the assertion consumer service <code>URL</code> from
     * meta data by binding
     *
     * @param spEntityID      the entity id of the service provider
     * @param realm           the realm name of the identity provider
     * @param desiredBinding  the desired binding
     * @param returnedBinding the binding used to send back
     *                        <code>Response</code>
     * @return the assertion consumer service <code>URL</code>
     * @throws SAML2Exception if the operation is not successful
     */
public static String getACSurlFromMetaByBinding(String spEntityID, String realm, String desiredBinding, StringBuffer returnedBinding) throws SAML2Exception {
    String classMethod = "IDPSSOUtil.getACSurlFromMetaByBinding: ";
    SPSSODescriptorElement spSSODescriptorElement = getSPSSODescriptor(realm, spEntityID, classMethod);
    List acsList = spSSODescriptorElement.getAssertionConsumerService();
    String acsURL = null;
    String binding = null;
    String defaultAcsURL = null;
    String defaultBinding = null;
    String firstAcsURL = null;
    String firstBinding = null;
    AssertionConsumerServiceElement acs = null;
    for (int i = 0; i < acsList.size(); i++) {
        acs = (AssertionConsumerServiceElement) acsList.get(i);
        binding = acs.getBinding();
        if (binding.equals(desiredBinding)) {
            acsURL = acs.getLocation();
            break;
        }
        if (acs.isIsDefault()) {
            defaultAcsURL = acs.getLocation();
            defaultBinding = acs.getBinding();
        }
        if (i == 0) {
            firstAcsURL = acs.getLocation();
            firstBinding = acs.getBinding();
        }
    }
    if (acsURL == null || acsURL.length() == 0) {
        acsURL = defaultAcsURL;
        if (acsURL == null || acsURL.length() == 0) {
            acsURL = firstAcsURL;
            if (acsURL == null || acsURL.length() == 0) {
                acsURL = null;
                SAML2Utils.debug.error(classMethod + "Unable to get valid Assertion " + "Consumer Service URL");
                return null;
            }
            returnedBinding.append(firstBinding);
        } else {
            returnedBinding.append(defaultBinding);
        }
    } else {
        returnedBinding.append(binding);
    }
    return acsURL;
}

Example 80 with Assertion

use of com.sun.identity.saml2.assertion.Assertion in project OpenAM by OpenRock.

the class IDPSSOUtil method getDefaultACSurl.

/**
     * Returns the default assertion consumer service url and binding
     * from the metadata.
     *
     * @param spEntityID the entity id of the service provider
     * @param realm      the realm name of the identity provider
     * @return the assertion consumer service url with returned binding.
     * @throws SAML2Exception if the operation is not successful
     */
public static String getDefaultACSurl(String spEntityID, String realm, StringBuffer returnedBinding) throws SAML2Exception {
    String classMethod = "IDPSSOUtil.getDefaultACSurl: ";
    SPSSODescriptorElement spSSODescriptorElement = getSPSSODescriptor(realm, spEntityID, classMethod);
    List acsList = spSSODescriptorElement.getAssertionConsumerService();
    AssertionConsumerServiceElement acs = null;
    String acsURL = null;
    String binding = null;
    String firstAcsURL = null;
    String firstBinding = null;
    for (int i = 0; i < acsList.size(); i++) {
        acs = (AssertionConsumerServiceElement) acsList.get(i);
        if (acs.isIsDefault()) {
            acsURL = acs.getLocation();
            binding = acs.getBinding();
        }
        if (i == 0) {
            firstAcsURL = acs.getLocation();
            firstBinding = acs.getBinding();
        }
    }
    if (acsURL == null) {
        acsURL = firstAcsURL;
        binding = firstBinding;
    }
    if (binding != null) {
        returnedBinding.append(binding);
    }
    return acsURL;
}