Examples with SAML2Exception com.sun.identity.saml2.common.SAML2Exception used on opensource projects

Example 51 with SAML2Exception

use of com.sun.identity.saml2.common.SAML2Exception in project OpenAM by OpenRock.

the class AuthnQueryUtil method verifyResponse.

private static void verifyResponse(Response response, AuthnQuery authnQuery, String authnAuthorityEntityID, String realm, AuthnAuthorityDescriptorElement aad) throws SAML2Exception {
    String authnQueryID = authnQuery.getID();
    if ((authnQueryID != null) && (!authnQueryID.equals(response.getInResponseTo()))) {
        throw new SAML2Exception(SAML2Utils.bundle.getString("invalidInResponseToAuthnQuery"));
    }
    Issuer respIssuer = response.getIssuer();
    if (respIssuer == null) {
        return;
    }
    if (!authnAuthorityEntityID.equals(respIssuer.getValue())) {
        throw new SAML2Exception(SAML2Utils.bundle.getString("responseIssuerMismatch"));
    }
    if (!response.isSigned()) {
        throw new SAML2Exception(SAML2Utils.bundle.getString("responseNotSigned"));
    }
    Set<X509Certificate> signingCerts = KeyUtil.getVerificationCerts(aad, authnAuthorityEntityID, SAML2Constants.AUTHN_AUTH_ROLE);
    if (signingCerts.isEmpty()) {
        throw new SAML2Exception(SAML2Utils.bundle.getString("missingSigningCertAlias"));
    }
    boolean valid = response.isSignatureValid(signingCerts);
    if (SAML2Utils.debug.messageEnabled()) {
        SAML2Utils.debug.message("AuthnQueryUtil.verifyResponse: " + "Signature validity is : " + valid);
    }
    if (!valid) {
        throw new SAML2Exception(SAML2Utils.bundle.getString("invalidSignatureOnResponse"));
    }
    String spEntityID = authnQuery.getIssuer().getValue();
    List<Assertion> assertions = response.getAssertion();
    if (assertions == null) {
        List<EncryptedAssertion> encAssertions = response.getEncryptedAssertion();
        if (encAssertions != null && !encAssertions.isEmpty()) {
            Set<PrivateKey> privateKeys = KeyUtil.getDecryptionKeys(realm, spEntityID, SAML2Constants.SP_ROLE);
            for (EncryptedAssertion eAssertion : encAssertions) {
                Assertion assertion = eAssertion.decrypt(privateKeys);
                if (assertions == null) {
                    assertions = new ArrayList<>();
                }
                assertions.add(assertion);
            }
        }
    }
    if ((assertions == null) || (assertions.isEmpty())) {
        return;
    }
    signingCerts = KeyUtil.getVerificationCerts(aad, authnAuthorityEntityID, SAML2Constants.IDP_ROLE);
    for (Iterator iter = assertions.iterator(); iter.hasNext(); ) {
        Assertion assertion = (Assertion) iter.next();
        if (assertion.isSigned()) {
            if (signingCerts.isEmpty()) {
                throw new SAML2Exception(SAML2Utils.bundle.getString("missingSigningCertAlias"));
            }
            valid = assertion.isSignatureValid(signingCerts);
            if (SAML2Utils.debug.messageEnabled()) {
                SAML2Utils.debug.message("AuthnQueryUtil.verifyResponse: " + "Signature validity is : " + valid);
            }
            if (!valid) {
                throw new SAML2Exception(SAML2Utils.bundle.getString("invalidSignatureOnAssertion"));
            }
        }
    }
}

Example 52 with SAML2Exception

use of com.sun.identity.saml2.common.SAML2Exception in project OpenAM by OpenRock.

the class AuthnQueryUtil method sendAuthnQuerySOAP.

private static Response sendAuthnQuerySOAP(AuthnQuery authnQuery, String authnServiceURL, String authnAuthorityEntityID, String realm, AuthnAuthorityDescriptorElement aad) throws SAML2Exception {
    String authnQueryXMLString = authnQuery.toXMLString(true, true);
    if (SAML2Utils.debug.messageEnabled()) {
        SAML2Utils.debug.message("AuthnQueryUtil.sendAuthnQuerySOAP: " + "authnQueryXMLString = " + authnQueryXMLString);
        SAML2Utils.debug.message("AuthnQueryUtil.sendAuthnQuerySOAP: " + "authnServiceURL= " + authnServiceURL);
    }
    AuthnAuthorityConfigElement config = metaManager.getAuthnAuthorityConfig(realm, authnAuthorityEntityID);
    authnServiceURL = SAML2Utils.fillInBasicAuthInfo(config, authnServiceURL);
    SOAPMessage resMsg = null;
    try {
        resMsg = SOAPCommunicator.getInstance().sendSOAPMessage(authnQueryXMLString, authnServiceURL, true);
    } catch (SOAPException se) {
        SAML2Utils.debug.error("AuthnQueryUtil.sendAuthnQuerySOAP: ", se);
        throw new SAML2Exception(SAML2Utils.bundle.getString("errorSendingAuthnQuery"));
    }
    Element respElem = SOAPCommunicator.getInstance().getSamlpElement(resMsg, "Response");
    Response response = ProtocolFactory.getInstance().createResponse(respElem);
    if (SAML2Utils.debug.messageEnabled()) {
        SAML2Utils.debug.message("AuthnQueryUtil.sendAuthnQuerySOAP: " + "response = " + response.toXMLString(true, true));
    }
    verifyResponse(response, authnQuery, authnAuthorityEntityID, realm, aad);
    return response;
}

Example 53 with SAML2Exception

use of com.sun.identity.saml2.common.SAML2Exception in project OpenAM by OpenRock.

the class AuthnQueryUtil method sendAuthnQuery.

/**
     * This method sends the <code>AuthnQuery</code> to specifiied
     * authentication authority and returns <code>Response</code> coming
     * from the authentication authority.
     *
     * @param authnQuery the <code>AuthnQuery</code> object
     * @param authnAuthorityEntityID entity ID of authentication authority
     * @param realm the realm of hosted entity
     * @param binding the binding
     *
     * @return the <code>Response</code> object
     * @exception SAML2Exception if the operation is not successful
     *
     * @supported.api
     */
public static Response sendAuthnQuery(AuthnQuery authnQuery, String authnAuthorityEntityID, String realm, String binding) throws SAML2Exception {
    SAML2MetaManager metaManager = SAML2Utils.getSAML2MetaManager();
    AuthnAuthorityDescriptorElement aad = null;
    try {
        aad = metaManager.getAuthnAuthorityDescriptor(realm, authnAuthorityEntityID);
    } catch (SAML2MetaException sme) {
        SAML2Utils.debug.error("AttributeService.sendAuthnQuery:", sme);
        throw new SAML2Exception(SAML2Utils.bundle.getString("metaDataError"));
    }
    if (aad == null) {
        throw new SAML2Exception(SAML2Utils.bundle.getString("authnAuthorityNotFound"));
    }
    if (binding == null) {
        throw new SAML2Exception(SAML2Utils.bundle.getString("unsupportedBinding"));
    }
    String location = null;
    List authnService = aad.getAuthnQueryService();
    for (Iterator iter = authnService.iterator(); iter.hasNext(); ) {
        AuthnQueryServiceElement authnService1 = (AuthnQueryServiceElement) iter.next();
        if (binding.equalsIgnoreCase(authnService1.getBinding())) {
            location = authnService1.getLocation();
            break;
        }
    }
    if (location == null) {
        throw new SAML2Exception(SAML2Utils.bundle.getString("unsupportedBinding"));
    }
    if (binding.equalsIgnoreCase(SAML2Constants.SOAP)) {
        signAuthnQuery(authnQuery, realm, false);
        return sendAuthnQuerySOAP(authnQuery, location, authnAuthorityEntityID, realm, aad);
    } else {
        throw new SAML2Exception(SAML2Utils.bundle.getString("unsupportedBinding"));
    }
}

Example 54 with SAML2Exception

use of com.sun.identity.saml2.common.SAML2Exception in project OpenAM by OpenRock.

the class AuthnQueryUtil method signAuthnQuery.

private static void signAuthnQuery(AuthnQuery authnQuery, String realm, boolean includeCert) throws SAML2Exception {
    String spEntityID = authnQuery.getIssuer().getValue();
    String alias = SAML2Utils.getSigningCertAlias(realm, spEntityID, SAML2Constants.SP_ROLE);
    PrivateKey signingKey = keyProvider.getPrivateKey(alias);
    if (signingKey == null) {
        throw new SAML2Exception(SAML2Utils.bundle.getString("missingSigningCertAlias"));
    }
    X509Certificate signingCert = null;
    if (includeCert) {
        signingCert = keyProvider.getX509Certificate(alias);
    }
    if (signingKey != null) {
        authnQuery.sign(signingKey, signingCert);
    }
}

Example 55 with SAML2Exception

use of com.sun.identity.saml2.common.SAML2Exception in project OpenAM by OpenRock.

the class DefaultLibraryIDPAttributeMapper method getSAMLAttribute.

/**
     * Returns the SAML <code>Attribute</code> object.
     *
     * @param name attribute name.
     * @param nameFormat Name format of the attribute
     * @param values attribute values.
     * @param hostEntityID Entity ID for hosted provider.
     * @param remoteEntityID Entity ID for remote provider.
     * @param realm the providers are in.
     * @return SAML <code>Attribute</code> element.
     * @exception SAML2Exception if any failure.
     */
protected Attribute getSAMLAttribute(String name, String nameFormat, Set<String> values, String hostEntityID, String remoteEntityID, String realm) throws SAML2Exception {
    if (name == null) {
        throw new SAML2Exception(bundle.getString("nullInput"));
    }
    AssertionFactory factory = AssertionFactory.getInstance();
    Attribute attribute = factory.createAttribute();
    attribute.setName(name);
    if (nameFormat != null) {
        attribute.setNameFormat(nameFormat);
    }
    if (values != null && !values.isEmpty()) {
        boolean toEscape = needToEscapeXMLSpecialCharacters(hostEntityID, remoteEntityID, realm);
        List<String> list = new ArrayList<String>();
        for (String value : values) {
            if (toEscape) {
                list.add(XMLUtils.escapeSpecialCharacters(value));
            } else {
                list.add(value);
            }
        }
        attribute.setAttributeValueString(list);
    }
    return attribute;
}