Examples with SPSSODescriptorElement com.sun.identity.saml2.jaxb.metadata.SPSSODescriptorElement used on opensource projects

Example 11 with SPSSODescriptorElement

use of com.sun.identity.saml2.jaxb.metadata.SPSSODescriptorElement in project OpenAM by OpenRock.

the class IDPSSOUtil method getACSurlFromMetaByIndex.

/**
     * Returns the assertion consumer service <code>URL</code> from
     * meta data by binding
     *
     * @param spEntityID      the entity id of the service provider
     * @param realm           the realm name of the identity provider
     * @param acsIndex        the <code>ACS</code> index
     * @param returnedBinding the binding used to send back
     *                        <code>Response</code>
     * @return the assertion consumer service <code>URL</code>
     * @throws SAML2Exception if the operation is not successful
     */
public static String getACSurlFromMetaByIndex(String spEntityID, String realm, int acsIndex, StringBuffer returnedBinding) throws SAML2Exception {
    String classMethod = "IDPSSOUtil.getACSurlFromMetaByIndex: ";
    SPSSODescriptorElement spSSODescriptorElement = getSPSSODescriptor(realm, spEntityID, classMethod);
    List acsList = spSSODescriptorElement.getAssertionConsumerService();
    int index;
    String acsURL = null;
    String binding = null;
    String defaultAcsURL = null;
    String defaultBinding = null;
    String firstAcsURL = null;
    String firstBinding = null;
    AssertionConsumerServiceElement acs = null;
    for (int i = 0; i < acsList.size(); i++) {
        acs = (AssertionConsumerServiceElement) acsList.get(i);
        index = acs.getIndex();
        binding = acs.getBinding();
        if (index == acsIndex) {
            acsURL = acs.getLocation();
            binding = acs.getBinding();
            break;
        }
        if (acs.isIsDefault()) {
            defaultAcsURL = acs.getLocation();
            defaultBinding = acs.getBinding();
        }
        if (i == 0) {
            firstAcsURL = acs.getLocation();
            firstBinding = acs.getBinding();
        }
    }
    if (acsURL == null || acsURL.length() == 0) {
        acsURL = defaultAcsURL;
        if (acsURL == null || acsURL.length() == 0) {
            acsURL = firstAcsURL;
            if (acsURL == null || acsURL.length() == 0) {
                acsURL = null;
                SAML2Utils.debug.error(classMethod + "Unable to get valid Assertion " + "Consumer Service URL");
                return null;
            }
            returnedBinding.append(firstBinding);
        } else {
            returnedBinding.append(defaultBinding);
        }
    } else {
        returnedBinding.append(binding);
    }
    return acsURL;
}

Example 12 with SPSSODescriptorElement

use of com.sun.identity.saml2.jaxb.metadata.SPSSODescriptorElement in project OpenAM by OpenRock.

the class IDPSSOUtil method getBindingForAcsUrl.

/**
     * Returns the assertion consumer service url binding from
     * the metadata.
     *
     * @param spEntityID the entity id of the service provider
     * @param realm      the realm name of the identity provider
     * @return the assertion consumer service url binding
     * @throws SAML2Exception if the operation is not successful
     */
public static String getBindingForAcsUrl(String spEntityID, String realm, String acsURL) throws SAML2Exception {
    String classMethod = "IDPSSOUtil.getBindingForAcsUrl: ";
    SPSSODescriptorElement spSSODescriptorElement = getSPSSODescriptor(realm, spEntityID, classMethod);
    List acsList = spSSODescriptorElement.getAssertionConsumerService();
    AssertionConsumerServiceElement acs = null;
    String binding = null;
    for (int i = 0; i < acsList.size(); i++) {
        acs = (AssertionConsumerServiceElement) acsList.get(i);
        String location = acs.getLocation();
        if (location != null && location.equals(acsURL)) {
            return acs.getBinding();
        }
    }
    return null;
}

Example 13 with SPSSODescriptorElement

use of com.sun.identity.saml2.jaxb.metadata.SPSSODescriptorElement in project OpenAM by OpenRock.

the class IDPSSOUtil method isACSurlValidInMetadataSP.

/**
     * Validates if the Assertion Consumer Service URL acsURL exists in the
     * metadata of the Service Provider spEntityID
     *
     * @param acsURL     the assertion consumer service <code>URL</code>
     * @param spEntityID the entity id of the service provider
     * @param realm      the realm name of the identity provider
     * @return true if the assertion consumer service URL was found
     *         false otherwise
     */
private static boolean isACSurlValidInMetadataSP(String acsURL, String spEntityID, String realm) throws SAML2Exception {
    boolean isValidACSurl = false;
    String classMethod = "IDPSSOUtil.isACSurlValidInMetadataSP: ";
    SPSSODescriptorElement spSSODescriptorElement = getSPSSODescriptor(realm, spEntityID, classMethod);
    List acsList = spSSODescriptorElement.getAssertionConsumerService();
    AssertionConsumerServiceElement acs = null;
    for (int i = 0; i < acsList.size(); i++) {
        acs = (AssertionConsumerServiceElement) acsList.get(i);
        String acsInMeta = acs.getLocation();
        if (acsInMeta.equalsIgnoreCase(acsURL)) {
            isValidACSurl = true;
            SAML2Utils.debug.message(classMethod + " acsURL=" + acsURL + "Found in the metadata");
            break;
        }
    }
    return isValidACSurl;
}

Example 14 with SPSSODescriptorElement

use of com.sun.identity.saml2.jaxb.metadata.SPSSODescriptorElement in project OpenAM by OpenRock.

the class IDPSSOUtil method signAndEncryptResponseComponents.

/**
     * Signs and encrypts the components of a <code>SAML Response</code>
     * based on the service provider meta data. If the flag of
     * encrypting <code>Assertion</code> is on, then the embedded
     * <code>Assertion</code> object will be encrypted; if the flag
     * of encrypting <code>Assertion</code> is off and the flag of
     * encrypting <code>NameID</code> is on, then the <code>NameID</code>
     * embedded in the <code>Assertion</code> will be encrypted; if the
     * flag of encrypting <code>Assertion</code> is off and the flag of
     * encrypting <code>Attribute</code> is on, then the
     * <code>Attribute</code> embedded in the <code>Assertion</code>
     * will be encrypted. If the flag signAssertion is on, then the
     * <code>Assertion</code> will be signed. It will be signed before
     * it is encrypted and after its embedded <code>NameID</code> or
     * <code>Attribute</code> is encrypted.
     *
     * @param realm         the realm name of the identity provider
     * @param spEntityID    the entity id of the service provider
     * @param idpEntityID   the entity id of the identity provider
     * @param res           The <code>Response</code> whose components may be
     *                      encrypted based on the service provider meta data setting
     * @param signAssertion A flag to indicate if <code>Assertion</code>
     *                      signing is required
     */
static void signAndEncryptResponseComponents(String realm, String spEntityID, String idpEntityID, Response res, boolean signAssertion) throws SAML2Exception {
    String classMethod = "IDPSSOUtil.signAndEncryptResponseComponents: ";
    boolean toEncryptAssertion = false;
    boolean toEncryptNameID = false;
    boolean toEncryptAttribute = false;
    if (res == null) {
        return;
    }
    List assertions = res.getAssertion();
    if ((assertions == null) || (assertions.size() == 0)) {
        return;
    }
    Assertion assertion = (Assertion) assertions.get(0);
    // get the encryption related flags from the SP Entity Config
    String wantAssertionEncrypted = SAML2Utils.getAttributeValueFromSSOConfig(realm, spEntityID, SAML2Constants.SP_ROLE, SAML2Constants.WANT_ASSERTION_ENCRYPTED);
    toEncryptAssertion = (wantAssertionEncrypted != null) && (wantAssertionEncrypted.equals(SAML2Constants.TRUE));
    if (!toEncryptAssertion) {
        String wantNameIDEncrypted = SAML2Utils.getAttributeValueFromSSOConfig(realm, spEntityID, SAML2Constants.SP_ROLE, SAML2Constants.WANT_NAMEID_ENCRYPTED);
        toEncryptNameID = (wantNameIDEncrypted != null) && (wantNameIDEncrypted.equals(SAML2Constants.TRUE));
        String wantAttributeEncrypted = SAML2Utils.getAttributeValueFromSSOConfig(realm, spEntityID, SAML2Constants.SP_ROLE, SAML2Constants.WANT_ATTRIBUTE_ENCRYPTED);
        toEncryptAttribute = (wantAttributeEncrypted != null) && (wantAttributeEncrypted.equals(SAML2Constants.TRUE));
    }
    if ((!toEncryptAssertion) && (!toEncryptNameID) && (!toEncryptAttribute)) {
        // all encryption flags are off, no encryption needed
        if (signAssertion) {
            signAssertion(realm, idpEntityID, assertion);
            List assertionList = new ArrayList();
            assertionList.add(assertion);
            res.setAssertion(assertionList);
        }
        return;
    }
    SPSSODescriptorElement spSSODescriptorElement = getSPSSODescriptor(realm, spEntityID, classMethod);
    // get the encryption information
    EncInfo encInfo = KeyUtil.getEncInfo(spSSODescriptorElement, spEntityID, SAML2Constants.SP_ROLE);
    if (encInfo == null) {
        SAML2Utils.debug.error(classMethod + "failed to get service provider encryption key info.");
        throw new SAML2Exception(SAML2Utils.bundle.getString("UnableToFindEncryptKeyInfo"));
    }
    if (toEncryptAssertion) {
        // sign assertion first, then encrypt the assertion
        if (signAssertion) {
            signAssertion(realm, idpEntityID, assertion);
        }
        // we only encrypt the Assertion
        EncryptedAssertion encryptedAssertion = assertion.encrypt(encInfo.getWrappingKey(), encInfo.getDataEncAlgorithm(), encInfo.getDataEncStrength(), spEntityID);
        if (encryptedAssertion == null) {
            SAML2Utils.debug.error(classMethod + "failed to encrypt the assertion.");
            throw new SAML2Exception(SAML2Utils.bundle.getString("FailedToEncryptAssertion"));
        }
        List assertionList = new ArrayList();
        assertionList.add(encryptedAssertion);
        res.setEncryptedAssertion(assertionList);
        // reset assertion list
        res.setAssertion(new ArrayList());
        if (SAML2Utils.debug.messageEnabled()) {
            SAML2Utils.debug.message(classMethod + "Assertion encrypted.");
        }
    } else {
        // assertion if applicable
        if (toEncryptNameID) {
            // we need to encrypt the NameID            
            Subject subject = assertion.getSubject();
            if (subject == null) {
                return;
            }
            NameID nameID = subject.getNameID();
            if (nameID == null) {
                return;
            }
            EncryptedID encryptedNameID = nameID.encrypt(encInfo.getWrappingKey(), encInfo.getDataEncAlgorithm(), encInfo.getDataEncStrength(), spEntityID);
            if (encryptedNameID == null) {
                SAML2Utils.debug.error(classMethod + "failed to encrypt the NameID.");
                throw new SAML2Exception(SAML2Utils.bundle.getString("FailedToEncryptNameID"));
            }
            subject.setEncryptedID(encryptedNameID);
            // reset NameID
            subject.setNameID(null);
            assertion.setSubject(subject);
            if (SAML2Utils.debug.messageEnabled()) {
                SAML2Utils.debug.message(classMethod + "NameID encrypted.");
            }
        }
        if (toEncryptAttribute) {
            // we need to encrypt the Attribute
            List attributeStatements = assertion.getAttributeStatements();
            if ((attributeStatements != null) && (attributeStatements.size() > 0)) {
                int asSize = attributeStatements.size();
                // to hold all the AttributeStatements
                List stmts = new ArrayList();
                for (int i = 0; i < asSize; i++) {
                    AttributeStatement attributeStatement = (AttributeStatement) attributeStatements.get(i);
                    List attributes = attributeStatement.getAttribute();
                    if ((attributes == null) || (attributes.size() == 0)) {
                        continue;
                    }
                    int aSize = attributes.size();
                    // holds all the encrypted Attributes in this statement
                    List eaList = new ArrayList();
                    for (int j = 0; j < aSize; j++) {
                        Attribute attribute = (Attribute) attributes.get(j);
                        EncryptedAttribute encryptedAttribute = attribute.encrypt(encInfo.getWrappingKey(), encInfo.getDataEncAlgorithm(), encInfo.getDataEncStrength(), spEntityID);
                        if (encryptedAttribute == null) {
                            SAML2Utils.debug.error(classMethod + "failed to encrypt the Attribute.");
                            throw new SAML2Exception(SAML2Utils.bundle.getString("FailedToEncryptAttribute"));
                        }
                        eaList.add(encryptedAttribute);
                    }
                    attributeStatement.setEncryptedAttribute(eaList);
                    attributeStatement.setAttribute(new ArrayList());
                    stmts.add(attributeStatement);
                }
                assertion.setAttributeStatements(stmts);
                if (SAML2Utils.debug.messageEnabled()) {
                    SAML2Utils.debug.message(classMethod + "Attribute encrypted.");
                }
            }
        }
        if (signAssertion) {
            signAssertion(realm, idpEntityID, assertion);
        }
        List assertionList = new ArrayList();
        assertionList.add(assertion);
        res.setAssertion(assertionList);
    }
}

Example 15 with SPSSODescriptorElement

use of com.sun.identity.saml2.jaxb.metadata.SPSSODescriptorElement in project OpenAM by OpenRock.

the class IDPSSOUtil method wantAssertionsSigned.

/**
     * Returns the the value of the wantAssertionsSigned property
     * @param spEntityID ID of the SP entity to be retrieved.
     * @param realm The realm under which the entity resides.
     * @return boolean  value of the wantAssertionsSigned property.
     * @throws SAML2MetaException if unable to retrieve the service
     *         provider's SSO descriptor.
     */
private static boolean wantAssertionsSigned(String realm, String spEntityID) throws SAML2Exception {
    String method = "IPDSSOUtil:wantAssertionsSigned : ";
    if (SAML2Utils.debug.messageEnabled()) {
        SAML2Utils.debug.message(method + ": realm - " + realm + "/: spEntityID - " + spEntityID);
    }
    SPSSODescriptorElement spSSODescriptor = getSPSSODescriptor(spEntityID, realm, method);
    return spSSODescriptor.isWantAssertionsSigned();
}