Examples with Attribute com.sun.identity.saml2.assertion.Attribute used on opensource projects

Example 81 with Attribute

use of com.sun.identity.saml2.assertion.Attribute in project OpenAM by OpenRock.

the class AttributeQueryUtil method validateSAMLResponseForFedlet.

/**
     * Validates the SAML response obtained from Attribute Authortity
     *
     * @param samlResp saml response
     *
     * @exception SAML2Exception if the operation is not successful
     *
     * @supported.api
     */
private static boolean validateSAMLResponseForFedlet(Response samlResp, String spEntityID, boolean wantNameIDEncrypted) throws SAML2Exception {
    boolean resp = true;
    if (samlResp != null && samlResp.isSigned()) {
        List assertions = null;
        if (wantNameIDEncrypted) {
            assertions = samlResp.getEncryptedAssertion();
        } else {
            assertions = samlResp.getAssertion();
        }
        if (assertions == null) {
            return false;
        }
        for (Iterator asserIter = assertions.iterator(); asserIter.hasNext(); ) {
            Assertion assertion = null;
            if (wantNameIDEncrypted) {
                assertion = getDecryptedAssertion((EncryptedAssertion) asserIter.next(), spEntityID);
            } else {
                assertion = (Assertion) asserIter.next();
            }
            if (assertion != null) {
                Conditions conditions = assertion.getConditions();
                if (conditions != null) {
                    List audienceRes = conditions.getAudienceRestrictions();
                    if (audienceRes.size() > 1) {
                        resp = false;
                        break;
                    }
                }
                List statements = assertion.getAttributeStatements();
                if (statements.size() > 1) {
                    resp = false;
                    break;
                }
            }
        }
    } else {
        resp = false;
    }
    return resp;
}

Example 82 with Attribute

use of com.sun.identity.saml2.assertion.Attribute in project OpenAM by OpenRock.

the class AttributeQueryUtil method verifyDesiredAttributes.

private static List<Attribute> verifyDesiredAttributes(List<AttributeElement> supportedAttrs, List<Attribute> desiredAttrs) throws SAML2Exception {
    if (supportedAttrs == null || supportedAttrs.isEmpty()) {
        return desiredAttrs;
    }
    if (desiredAttrs == null || desiredAttrs.isEmpty()) {
        return convertAttributes(supportedAttrs);
    }
    for (Attribute desiredAttr : desiredAttrs) {
        boolean isAttrValid = false;
        Iterator<AttributeElement> supportedAttrIterator = supportedAttrs.iterator();
        while (supportedAttrIterator.hasNext()) {
            AttributeElement supportedAttr = supportedAttrIterator.next();
            if (isSameAttribute(desiredAttr, supportedAttr)) {
                if (isValueValid(desiredAttr, supportedAttr)) {
                    isAttrValid = true;
                    //By removing the attribute from the supported list we make sure that an AttributeQuery can
                    //not request the same Attribute more than once, see SAML core 3.3.2.3.
                    supportedAttrIterator.remove();
                    break;
                } else {
                    throw new SAML2Exception("Attribute value not supported");
                }
            }
        }
        if (!isAttrValid) {
            throw new SAML2Exception("Attribute name not supported");
        }
    }
    return desiredAttrs;
}

Example 83 with Attribute

use of com.sun.identity.saml2.assertion.Attribute in project OpenAM by OpenRock.

the class AttributeQueryUtil method getAttributesForFedlet.

/**
     * Sends the AttributeQuery to specified attribute authority,
     * validates the response and returns the attribute map
     * <code>Map&lt;String, Set&lt;String&gt;&gt;</code> to the Fedlet
     *
     * @param spEntityID SP entity ID
     * @param idpEntityID IDP entity ID
     * @param nameIDValue  NameID value 
     * @param attrsList The list of attributes whose values need to be
     *                  fetched from IDP
     * @param attrQueryProfileAlias  Attribute Query Profile Alias
     * @param subjectDN  Attribute name which contains X.509 subject DN
     *
     * @return the <code>Map</code> object
     * @exception SAML2Exception if the operation is not successful
     *
     * @supported.api
     */
public static Map<String, Set<String>> getAttributesForFedlet(String spEntityID, String idpEntityID, String nameIDValue, List<String> attrsList, String attrQueryProfileAlias, String subjectDN) throws SAML2Exception {
    final String classMethod = "AttributeQueryUtil.getAttributesForFedlet: ";
    AttributeQueryConfigElement attrQueryConfig = metaManager.getAttributeQueryConfig("/", spEntityID);
    if (attrQueryConfig == null) {
        if (SAML2Utils.debug.messageEnabled()) {
            SAML2Utils.debug.message(classMethod + "Attribute Query Config is null");
        }
        return null;
    }
    String attrqMetaAlias = attrQueryConfig.getMetaAlias();
    if (attrqMetaAlias == null) {
        if (SAML2Utils.debug.messageEnabled()) {
            SAML2Utils.debug.message(classMethod + "Attribute Query MetaAlias is null");
        }
        return null;
    }
    boolean wantNameIDEncrypted = SAML2Utils.getWantNameIDEncrypted("/", spEntityID, SAML2Constants.ATTR_QUERY_ROLE);
    AttributeQuery attrQuery = constructAttrQueryForFedlet(spEntityID, idpEntityID, nameIDValue, attrsList, attrqMetaAlias, attrQueryProfileAlias, subjectDN, wantNameIDEncrypted);
    String attrQueryProfile = null;
    if (attrQueryProfileAlias.equals(SAML2Constants.DEFAULT_ATTR_QUERY_PROFILE_ALIAS)) {
        attrQueryProfile = SAML2Constants.DEFAULT_ATTR_QUERY_PROFILE;
    } else if (attrQueryProfileAlias.equals(SAML2Constants.X509_SUBJECT_ATTR_QUERY_PROFILE_ALIAS)) {
        attrQueryProfile = SAML2Constants.X509_SUBJECT_ATTR_QUERY_PROFILE;
    }
    Response samlResp = sendAttributeQuery(attrQuery, idpEntityID, "/", attrQueryProfile, SAML2Constants.BASIC_ATTRIBUTE_PROFILE, SAML2Constants.SOAP);
    // Validate the response
    boolean validResp = validateSAMLResponseForFedlet(samlResp, spEntityID, wantNameIDEncrypted);
    Map<String, Set<String>> attrMap = new HashMap<String, Set<String>>();
    if (validResp) {
        // Return back the AttributeMap
        if (samlResp != null) {
            List<Object> assertions;
            if (wantNameIDEncrypted) {
                assertions = samlResp.getEncryptedAssertion();
            } else {
                assertions = samlResp.getAssertion();
            }
            for (Object currentAssertion : assertions) {
                Assertion assertion;
                if (wantNameIDEncrypted) {
                    assertion = getDecryptedAssertion((EncryptedAssertion) currentAssertion, spEntityID);
                } else {
                    assertion = (Assertion) currentAssertion;
                }
                if (assertion != null) {
                    List<AttributeStatement> statements = assertion.getAttributeStatements();
                    if (statements != null && statements.size() > 0) {
                        for (AttributeStatement statement : statements) {
                            List<Attribute> attributes = statement.getAttribute();
                            attrMap.putAll(mapAttributes("/", spEntityID, idpEntityID, nameIDValue, attributes));
                        }
                    } else {
                        if (SAML2Utils.debug.messageEnabled()) {
                            SAML2Utils.debug.message(classMethod + "Empty Statement present in SAML response");
                        }
                    }
                } else {
                    if (SAML2Utils.debug.messageEnabled()) {
                        SAML2Utils.debug.message(classMethod + "Empty Assertion present in SAML response");
                    }
                }
            }
            if (SAML2Utils.debug.messageEnabled()) {
                SAML2Utils.debug.message(classMethod + "attributes received from Attribute Query: " + attrMap);
            }
        }
    } else {
        if (SAML2Utils.debug.messageEnabled()) {
            SAML2Utils.debug.message(classMethod + "Invalid response obtained from Attribute Authority");
        }
    }
    // Return the attribute map and to the fedlet
    return attrMap;
}

Example 84 with Attribute

use of com.sun.identity.saml2.assertion.Attribute in project OpenAM by OpenRock.

the class AttributeQueryUtil method convertAttributes.

private static List convertAttributes(List jaxbAttrs) throws SAML2Exception {
    List resultAttrs = new ArrayList();
    for (Iterator iter = jaxbAttrs.iterator(); iter.hasNext(); ) {
        AttributeElement jaxbAttr = (AttributeElement) iter.next();
        Attribute attr = AssertionFactory.getInstance().createAttribute();
        attr.setName(jaxbAttr.getName());
        attr.setNameFormat(jaxbAttr.getNameFormat());
        attr.setFriendlyName(jaxbAttr.getFriendlyName());
        List jaxbValues = jaxbAttr.getAttributeValue();
        if ((jaxbValues != null) && (!jaxbValues.isEmpty())) {
            List newValues = new ArrayList();
            for (Iterator iterV = jaxbValues.iterator(); iterV.hasNext(); ) {
                AttributeValueElement jaxbValeu = (AttributeValueElement) iter.next();
                List content = jaxbValeu.getContent();
                if ((content != null) && (!content.isEmpty())) {
                    newValues.add(content.get(0));
                }
            }
            if (!newValues.isEmpty()) {
                attr.setAttributeValueString(newValues);
            }
        }
        resultAttrs.add(attr);
    }
    return resultAttrs;
}

Example 85 with Attribute

use of com.sun.identity.saml2.assertion.Attribute in project OpenAM by OpenRock.

the class AttributeQueryUtil method processAttributeQuery.

/**
     * Processes the <code>AttributeQuery</code> coming
     * from a requester.
     *
     * @param attrQuery the <code>AttributeQuery</code> object
     * @param request the <code>HttpServletRequest</code> object
     * @param response the <code>HttpServletResponse</code> object
     * @param attrAuthorityEntityID entity ID of attribute authority
     * @param realm the realm of hosted entity
     * @param attrQueryProfileAlias the attribute query profile alias
     *
     * @return the <code>Response</code> object
     * @exception SAML2Exception if the operation is not successful
     */
public static Response processAttributeQuery(AttributeQuery attrQuery, HttpServletRequest request, HttpServletResponse response, String attrAuthorityEntityID, String realm, String attrQueryProfileAlias) throws SAML2Exception {
    AttributeAuthorityMapper attrAuthorityMapper = getAttributeAuthorityMapper(realm, attrAuthorityEntityID, attrQueryProfileAlias);
    String attrQueryProfile = AttributeQueryUtil.getAttributeQueryProfile(attrQueryProfileAlias);
    try {
        attrAuthorityMapper.authenticateRequester(request, response, attrQuery, attrAuthorityEntityID, realm);
    } catch (SAML2Exception se) {
        if (SAML2Utils.debug.messageEnabled()) {
            SAML2Utils.debug.message("AttributeQueryUtil." + "processAttributeQuery: ", se);
        }
        return SAML2Utils.getErrorResponse(attrQuery, SAML2Constants.REQUESTER, null, se.getMessage(), null);
    }
    try {
        attrAuthorityMapper.validateAttributeQuery(request, response, attrQuery, attrAuthorityEntityID, realm);
    } catch (SAML2Exception se) {
        SAML2Utils.debug.error("AttributeQueryUtil.processAttributeQuery:", se);
        return SAML2Utils.getErrorResponse(attrQuery, SAML2Constants.REQUESTER, null, se.getMessage(), null);
    }
    Issuer issuer = attrQuery.getIssuer();
    String requesterEntityID = issuer.getValue();
    AttributeAuthorityDescriptorElement aad = null;
    try {
        aad = metaManager.getAttributeAuthorityDescriptor(realm, attrAuthorityEntityID);
    } catch (SAML2MetaException sme) {
        SAML2Utils.debug.error("AttributeQueryUtil.processAttributeQuery:", sme);
        return SAML2Utils.getErrorResponse(attrQuery, SAML2Constants.RESPONDER, null, SAML2Utils.bundle.getString("metaDataError"), null);
    }
    if (aad == null) {
        return SAML2Utils.getErrorResponse(attrQuery, SAML2Constants.REQUESTER, null, SAML2Utils.bundle.getString("attrAuthorityNotFound"), null);
    }
    Object identity = null;
    try {
        identity = attrAuthorityMapper.getIdentity(request, response, attrQuery, attrAuthorityEntityID, realm);
    } catch (SAML2Exception se) {
        if (SAML2Utils.debug.messageEnabled()) {
            SAML2Utils.debug.message("AttributeQueryUtil." + "processAttributeQuery: ", se);
        }
        return SAML2Utils.getErrorResponse(attrQuery, SAML2Constants.REQUESTER, SAML2Constants.UNKNOWN_PRINCIPAL, se.getMessage(), null);
    }
    if (identity == null) {
        if (SAML2Utils.debug.messageEnabled()) {
            SAML2Utils.debug.message("AttributeQueryUtil." + "processAttributeQuery: unable to find identity.");
        }
        return SAML2Utils.getErrorResponse(attrQuery, SAML2Constants.REQUESTER, SAML2Constants.UNKNOWN_PRINCIPAL, null, null);
    }
    // Addition to support changing of desired attributes list
    List desiredAttrs = (List) request.getAttribute("AttributeQueryUtil-desiredAttrs");
    if (desiredAttrs == null) {
        desiredAttrs = attrQuery.getAttributes();
    }
    try {
        desiredAttrs = verifyDesiredAttributes(aad.getAttribute(), desiredAttrs);
    } catch (SAML2Exception se) {
        return SAML2Utils.getErrorResponse(attrQuery, SAML2Constants.REQUESTER, SAML2Constants.INVALID_ATTR_NAME_OR_VALUE, null, null);
    }
    List attributes = attrAuthorityMapper.getAttributes(identity, attrQuery, attrAuthorityEntityID, realm);
    if (request.getAttribute("AttributeQueryUtil-storeAllAttributes") != null) {
        request.setAttribute("AttributeQueryUtil-allAttributes", attributes);
    }
    attributes = filterAttributes(attributes, desiredAttrs);
    ProtocolFactory protocolFactory = ProtocolFactory.getInstance();
    Response samlResp = protocolFactory.createResponse();
    List assertionList = new ArrayList();
    Assertion assertion = null;
    try {
        assertion = getAssertion(attrQuery, attrAuthorityEntityID, requesterEntityID, realm, attrQueryProfileAlias, attributes);
    } catch (SAML2Exception se) {
        if (SAML2Utils.debug.messageEnabled()) {
            SAML2Utils.debug.message("AttributeQueryUtil.processAttributeQuery:", se);
        }
        return SAML2Utils.getErrorResponse(attrQuery, SAML2Constants.RESPONDER, null, se.getMessage(), null);
    }
    EncryptedID encryptedID = attrQuery.getSubject().getEncryptedID();
    if (encryptedID != null) {
        EncryptedAssertion encryptedAssertion = null;
        try {
            signAssertion(assertion, realm, attrAuthorityEntityID, false);
            encryptedAssertion = encryptAssertion(assertion, encryptedID, attrAuthorityEntityID, requesterEntityID, realm, attrQueryProfileAlias);
        } catch (SAML2Exception se) {
            if (SAML2Utils.debug.messageEnabled()) {
                SAML2Utils.debug.message("AttributeQueryUtil.processAttributeQuery:", se);
            }
            return SAML2Utils.getErrorResponse(attrQuery, SAML2Constants.RESPONDER, null, se.getMessage(), null);
        }
        assertionList.add(encryptedAssertion);
        samlResp.setEncryptedAssertion(assertionList);
    } else {
        assertionList.add(assertion);
        samlResp.setAssertion(assertionList);
    }
    samlResp.setID(SAML2Utils.generateID());
    samlResp.setInResponseTo(attrQuery.getID());
    samlResp.setVersion(SAML2Constants.VERSION_2_0);
    samlResp.setIssueInstant(new Date());
    Status status = protocolFactory.createStatus();
    StatusCode statusCode = protocolFactory.createStatusCode();
    statusCode.setValue(SAML2Constants.SUCCESS);
    status.setStatusCode(statusCode);
    samlResp.setStatus(status);
    Issuer respIssuer = AssertionFactory.getInstance().createIssuer();
    respIssuer.setValue(attrAuthorityEntityID);
    samlResp.setIssuer(respIssuer);
    signResponse(samlResp, attrAuthorityEntityID, realm, false);
    return samlResp;
}