Examples with SingleSignOnServiceElement com.sun.identity.saml2.jaxb.metadata.SingleSignOnServiceElement used on opensource projects

Example 1 with SingleSignOnServiceElement

use of com.sun.identity.saml2.jaxb.metadata.SingleSignOnServiceElement in project OpenAM by OpenRock.

the class SAMLv2ModelImpl method getStandardIdentityProviderAttributes.

/**
     * Returns a map with standard identity provider attributes and values.
     *
     * @param realm to which the entity belongs.
     * @param entityName is the entity id.
     * @return Map with standard attribute values of Identity Provider.
     * @throws AMConsoleException if unable to retrieve the Identity Provider
     *     attrubutes based on the realm and entityName passed.
     */
public Map getStandardIdentityProviderAttributes(String realm, String entityName) throws AMConsoleException {
    String[] params = { realm, entityName, "SAMLv2", "IDP-Standard" };
    logEvent("ATTEMPT_GET_ENTITY_DESCRIPTOR_ATTR_VALUES", params);
    Map map = new HashMap();
    IDPSSODescriptorElement idpssoDescriptor = null;
    try {
        SAML2MetaManager samlManager = getSAML2MetaManager();
        idpssoDescriptor = samlManager.getIDPSSODescriptor(realm, entityName);
        if (idpssoDescriptor != null) {
            // retrieve WantAuthnRequestsSigned
            map.put(WANT_AUTHN_REQ_SIGNED, returnEmptySetIfValueIsNull(idpssoDescriptor.isWantAuthnRequestsSigned()));
            //retrieve ArtifactResolutionService
            map.put(ART_RES_LOCATION, Collections.EMPTY_SET);
            map.put(ART_RES_INDEX, Collections.EMPTY_SET);
            map.put(ART_RES_ISDEFAULT, Collections.EMPTY_SET);
            List artList = idpssoDescriptor.getArtifactResolutionService();
            if (!artList.isEmpty()) {
                ArtifactResolutionServiceElement key = (ArtifactResolutionServiceElement) artList.get(0);
                map.put(ART_RES_LOCATION, returnEmptySetIfValueIsNull(key.getLocation()));
                map.put(ART_RES_INDEX, returnEmptySetIfValueIsNull(Integer.toString(key.getIndex())));
                map.put(ART_RES_ISDEFAULT, returnEmptySetIfValueIsNull(key.isIsDefault()));
            }
            //retrieve SingleLogoutService
            map.put(SINGLE_LOGOUT_HTTP_LOCATION, Collections.EMPTY_SET);
            map.put(SINGLE_LOGOUT_HTTP_RESP_LOCATION, Collections.EMPTY_SET);
            map.put(SLO_POST_LOC, Collections.EMPTY_SET);
            map.put(SLO_POST_RESPLOC, Collections.EMPTY_SET);
            map.put(SINGLE_LOGOUT_SOAP_LOCATION, Collections.EMPTY_SET);
            map.put(SINGLE_LOGOUT_DEFAULT, Collections.EMPTY_SET);
            List logoutList = idpssoDescriptor.getSingleLogoutService();
            for (int i = 0; i < logoutList.size(); i++) {
                SingleLogoutServiceElement spslsElem = (SingleLogoutServiceElement) logoutList.get(i);
                String tmp = spslsElem.getBinding();
                if (i == 0) {
                    map.put(SINGLE_LOGOUT_DEFAULT, returnEmptySetIfValueIsNull(tmp));
                }
                if (tmp.contains(httpRedirect)) {
                    map.put(SINGLE_LOGOUT_HTTP_LOCATION, returnEmptySetIfValueIsNull(spslsElem.getLocation()));
                    map.put(SINGLE_LOGOUT_HTTP_RESP_LOCATION, returnEmptySetIfValueIsNull(spslsElem.getResponseLocation()));
                } else if (tmp.contains(httpPost)) {
                    map.put(SLO_POST_LOC, returnEmptySetIfValueIsNull(spslsElem.getLocation()));
                    map.put(SLO_POST_RESPLOC, returnEmptySetIfValueIsNull(spslsElem.getResponseLocation()));
                } else if (tmp.contains(soap)) {
                    map.put(SINGLE_LOGOUT_SOAP_LOCATION, returnEmptySetIfValueIsNull(spslsElem.getLocation()));
                }
            }
            //retrieve ManageNameIDService
            map.put(MANAGE_NAMEID_HTTP_LOCATION, Collections.EMPTY_SET);
            map.put(MANAGE_NAMEID_HTTP_RESP_LOCATION, Collections.EMPTY_SET);
            map.put(MNI_POST_LOC, Collections.EMPTY_SET);
            map.put(MNI_POST_RESPLOC, Collections.EMPTY_SET);
            map.put(MANAGE_NAMEID_SOAP_LOCATION, Collections.EMPTY_SET);
            map.put(SINGLE_MANAGE_NAMEID_DEFAULT, Collections.EMPTY_SET);
            List manageNameIdList = idpssoDescriptor.getManageNameIDService();
            for (int i = 0; i < manageNameIdList.size(); i++) {
                ManageNameIDServiceElement mniElem = (ManageNameIDServiceElement) manageNameIdList.get(i);
                String tmp = mniElem.getBinding();
                if (i == 0) {
                    map.put(SINGLE_MANAGE_NAMEID_DEFAULT, returnEmptySetIfValueIsNull(tmp));
                }
                if (tmp.contains(httpRedirect)) {
                    map.put(MANAGE_NAMEID_HTTP_LOCATION, returnEmptySetIfValueIsNull(mniElem.getLocation()));
                    map.put(MANAGE_NAMEID_HTTP_RESP_LOCATION, returnEmptySetIfValueIsNull(mniElem.getResponseLocation()));
                } else if (tmp.contains(httpPost)) {
                    map.put(MNI_POST_LOC, returnEmptySetIfValueIsNull(mniElem.getLocation()));
                    map.put(MNI_POST_RESPLOC, returnEmptySetIfValueIsNull(mniElem.getResponseLocation()));
                } else if (tmp.contains(soap)) {
                    map.put(MANAGE_NAMEID_SOAP_LOCATION, returnEmptySetIfValueIsNull(mniElem.getLocation()));
                }
            }
            //retrieve nameid mapping service
            map.put(NAME_ID_MAPPPING, Collections.EMPTY_SET);
            List nameIDmappingList = idpssoDescriptor.getNameIDMappingService();
            if (!nameIDmappingList.isEmpty()) {
                NameIDMappingServiceElement namidElem1 = (NameIDMappingServiceElement) nameIDmappingList.get(0);
                map.put(NAME_ID_MAPPPING, returnEmptySetIfValueIsNull(namidElem1.getLocation()));
            }
            //retrieve nameid format
            map.put(NAMEID_FORMAT, (OrderedSet) convertListToSet(idpssoDescriptor.getNameIDFormat()));
            //retrieve single sign on service
            map.put(SINGLE_SIGNON_HTTP_LOCATION, Collections.EMPTY_SET);
            map.put(SINGLE_SIGNON_SOAP_LOCATION, Collections.EMPTY_SET);
            map.put(SSO_SOAPS_LOC, Collections.EMPTY_SET);
            List signonList = idpssoDescriptor.getSingleSignOnService();
            for (int i = 0; i < signonList.size(); i++) {
                SingleSignOnServiceElement signElem = (SingleSignOnServiceElement) signonList.get(i);
                String tmp = signElem.getBinding();
                if (tmp.contains(httpRedirect)) {
                    map.put(SINGLE_SIGNON_HTTP_LOCATION, returnEmptySetIfValueIsNull(signElem.getLocation()));
                } else if (tmp.contains(httpPost)) {
                    map.put(SINGLE_SIGNON_SOAP_LOCATION, returnEmptySetIfValueIsNull(signElem.getLocation()));
                } else if (tmp.contains(soap)) {
                    map.put(SSO_SOAPS_LOC, returnEmptySetIfValueIsNull(signElem.getLocation()));
                }
            }
            //retrieve key descriptor encryption details if present
            map.put(TF_KEY_NAME, Collections.EMPTY_SET);
            map.put(TF_ALGORITHM, Collections.EMPTY_SET);
            if (idpssoDescriptor.getKeyDescriptor() != null) {
                getKeyandAlgorithm(idpssoDescriptor, map);
            }
        }
        logEvent("SUCCEED_GET_ENTITY_DESCRIPTOR_ATTR_VALUES", params);
    } catch (SAML2MetaException e) {
        debug.warning("SAMLv2ModelImpl.getIdentityProviderAttributes:", e);
        String strError = getErrorString(e);
        String[] paramsEx = { realm, entityName, "SAMLv2", "IDP-Standard", strError };
        logEvent("FEDERATION_EXCEPTION_GET_ENTITY_DESCRIPTOR_ATTR_VALUES", paramsEx);
        throw new AMConsoleException(strError);
    }
    return map;
}

Example 2 with SingleSignOnServiceElement

use of com.sun.identity.saml2.jaxb.metadata.SingleSignOnServiceElement in project OpenAM by OpenRock.

the class TaskModelImpl method getConfigureGoogleAppsURLs.

public Map getConfigureGoogleAppsURLs(String realm, String entityId) throws AMConsoleException {
    Map map = new HashMap();
    IDPSSODescriptorElement idpssoDescriptor = null;
    try {
        SAML2MetaManager samlManager = new SAML2MetaManager();
        idpssoDescriptor = samlManager.getIDPSSODescriptor(realm, entityId);
        String signinPageURL = null;
        if (idpssoDescriptor != null) {
            List signonList = idpssoDescriptor.getSingleSignOnService();
            for (int i = 0; i < signonList.size(); i++) {
                SingleSignOnServiceElement signElem = (SingleSignOnServiceElement) signonList.get(i);
                String tmp = signElem.getBinding();
                if (tmp.contains("HTTP-Redirect")) {
                    signinPageURL = signElem.getLocation();
                    map.put("SigninPageURL", returnEmptySetIfValueIsNull(signinPageURL));
                }
            }
        }
        URL aURL = new URL(signinPageURL);
        String signoutPageURL = null;
        String protocol = aURL.getProtocol();
        String host = aURL.getHost();
        int port = aURL.getPort();
        if (port == -1) {
            port = (aURL.getProtocol().equals("https")) ? 443 : 80;
        }
        String deploymentURI = SystemPropertiesManager.get(Constants.AM_SERVICES_DEPLOYMENT_DESCRIPTOR);
        String url = protocol + "://" + host + ":" + port + deploymentURI;
        signoutPageURL = url + "/UI/Logout?goto=" + url;
        map.put("SignoutPageURL", returnEmptySetIfValueIsNull(signoutPageURL));
        map.put("ChangePasswordURL", returnEmptySetIfValueIsNull(url + "/idm/EndUser"));
        // get pubkey                 
        Map extValueMap = new HashMap();
        IDPSSOConfigElement idpssoConfig = samlManager.getIDPSSOConfig(realm, entityId);
        if (idpssoConfig != null) {
            BaseConfigType baseConfig = (BaseConfigType) idpssoConfig;
            extValueMap = SAML2MetaUtils.getAttributes(baseConfig);
        }
        List aList = (List) extValueMap.get("signingCertAlias");
        String signingCertAlias = null;
        if (aList != null) {
            signingCertAlias = (String) aList.get(0);
        }
        String publickey = SAML2MetaSecurityUtils.buildX509Certificate(signingCertAlias);
        String str = "-----BEGIN CERTIFICATE-----\n" + publickey + "-----END CERTIFICATE-----\n";
        map.put("PubKey", returnEmptySetIfValueIsNull(str));
    } catch (SAML2MetaException ex) {
        throw new AMConsoleException(ex.getMessage());
    } catch (MalformedURLException ex) {
        throw new AMConsoleException(ex.getMessage());
    }
    return map;
}

Example 3 with SingleSignOnServiceElement

use of com.sun.identity.saml2.jaxb.metadata.SingleSignOnServiceElement in project OpenAM by OpenRock.

the class IDPProxyUtil method getMatchingSSOEndpoint.

private static SingleSignOnServiceElement getMatchingSSOEndpoint(List<SingleSignOnServiceElement> endpoints, String preferredBinding) {
    SingleSignOnServiceElement preferredEndpoint = null;
    boolean isFirst = true;
    for (SingleSignOnServiceElement endpoint : endpoints) {
        if (isFirst) {
            //If there is no match, we should use the first endpoint in the list
            preferredEndpoint = endpoint;
            isFirst = false;
        }
        if (preferredBinding.equals(endpoint.getBinding())) {
            preferredEndpoint = endpoint;
            break;
        }
    }
    return preferredEndpoint;
}

Example 4 with SingleSignOnServiceElement

use of com.sun.identity.saml2.jaxb.metadata.SingleSignOnServiceElement in project OpenAM by OpenRock.

the class IDPProxyUtil method sendProxyAuthnRequest.

/**
     * Sends a new AuthnRequest to the authenticating provider. 
     * @param authnRequest original AuthnRequest sent by the service provider.
     * @param preferredIDP IDP to be proxied. 
     * @param spSSODescriptor SPSSO Descriptor Element
     * @param hostedEntityId hosted provider ID 
     * @param request HttpServletRequest 
     * @param response HttpServletResponse
     * @param realm Realm
     * @param relayState the Relay State 
     * @param originalBinding The binding used to send the original AuthnRequest.
     * @exception SAML2Exception for any SAML2 failure.
     * @exception IOException if there is a failure in redirection.
     */
public static void sendProxyAuthnRequest(AuthnRequest authnRequest, String preferredIDP, SPSSODescriptorElement spSSODescriptor, String hostedEntityId, HttpServletRequest request, HttpServletResponse response, String realm, String relayState, String originalBinding) throws SAML2Exception, IOException {
    String classMethod = "IDPProxyUtil.sendProxyAuthnRequest: ";
    String destination = null;
    SPSSODescriptorElement localDescriptor = null;
    SPSSOConfigElement localDescriptorConfig = null;
    IDPSSODescriptorElement idpDescriptor = null;
    String binding;
    try {
        idpDescriptor = IDPSSOUtil.metaManager.getIDPSSODescriptor(realm, preferredIDP);
        List<SingleSignOnServiceElement> ssoServiceList = idpDescriptor.getSingleSignOnService();
        SingleSignOnServiceElement endpoint = getMatchingSSOEndpoint(ssoServiceList, originalBinding);
        if (endpoint == null) {
            SAML2Utils.debug.error(classMethod + "Single Sign-on service is not found for the proxying IDP.");
            throw new SAML2Exception(SAML2Utils.bundle.getString("ssoServiceNotFoundIDPProxy"));
        }
        binding = endpoint.getBinding();
        destination = endpoint.getLocation();
        localDescriptor = IDPSSOUtil.metaManager.getSPSSODescriptor(realm, hostedEntityId);
        localDescriptorConfig = IDPSSOUtil.metaManager.getSPSSOConfig(realm, hostedEntityId);
    } catch (SAML2MetaException e) {
        SAML2Utils.debug.error(classMethod, e);
        throw new SAML2Exception(e.getMessage());
    }
    AuthnRequest newAuthnRequest = getNewAuthnRequest(hostedEntityId, destination, realm, authnRequest);
    // invoke SP Adapter class if registered
    SAML2ServiceProviderAdapter spAdapter = SAML2Utils.getSPAdapterClass(hostedEntityId, realm);
    if (spAdapter != null) {
        spAdapter.preSingleSignOnRequest(hostedEntityId, preferredIDP, realm, request, response, newAuthnRequest);
    }
    if (SAML2Utils.debug.messageEnabled()) {
        SAML2Utils.debug.message(classMethod + "New Authentication request:" + newAuthnRequest.toXMLString());
    }
    String requestID = newAuthnRequest.getID();
    // save the AuthnRequest in the IDPCache so that it can be
    // retrieved later when the user successfully authenticates
    IDPCache.authnRequestCache.put(requestID, newAuthnRequest);
    // save the original AuthnRequest
    IDPCache.proxySPAuthnReqCache.put(requestID, authnRequest);
    boolean signingNeeded = idpDescriptor.isWantAuthnRequestsSigned() || localDescriptor.isAuthnRequestsSigned();
    // check if relayState is present and get the unique
    // id which will be appended to the SSO URL before
    // redirecting
    String relayStateID = null;
    if (relayState != null && relayState.length() > 0) {
        relayStateID = SPSSOFederate.getRelayStateID(relayState, authnRequest.getID());
    }
    if (binding.equals(SAML2Constants.HTTP_POST)) {
        if (signingNeeded) {
            String certAlias = SPSSOFederate.getParameter(SAML2MetaUtils.getAttributes(localDescriptorConfig), SAML2Constants.SIGNING_CERT_ALIAS);
            SPSSOFederate.signAuthnRequest(certAlias, newAuthnRequest);
        }
        String authXMLString = newAuthnRequest.toXMLString(true, true);
        String encodedReqMsg = SAML2Utils.encodeForPOST(authXMLString);
        SAML2Utils.postToTarget(request, response, "SAMLRequest", encodedReqMsg, "RelayState", relayStateID, destination);
    } else {
        String authReqXMLString = newAuthnRequest.toXMLString(true, true);
        if (SAML2Utils.debug.messageEnabled()) {
            SAML2Utils.debug.message(classMethod + " AuthnRequest: " + authReqXMLString);
        }
        String encodedXML = SAML2Utils.encodeForRedirect(authReqXMLString);
        StringBuffer queryString = new StringBuffer().append(SAML2Constants.SAML_REQUEST).append(SAML2Constants.EQUAL).append(encodedXML);
        //TODO:  should it be newAuthnRequest??? 
        if (relayStateID != null && relayStateID.length() > 0) {
            queryString.append("&").append(SAML2Constants.RELAY_STATE).append("=").append(URLEncDec.encode(relayStateID));
        }
        StringBuffer redirectURL = new StringBuffer().append(destination).append(destination.contains("?") ? "&" : "?");
        if (signingNeeded) {
            String certAlias = SPSSOFederate.getParameter(SAML2MetaUtils.getAttributes(localDescriptorConfig), SAML2Constants.SIGNING_CERT_ALIAS);
            String signedQueryStr = SPSSOFederate.signQueryString(queryString.toString(), certAlias);
            redirectURL.append(signedQueryStr);
        } else {
            redirectURL.append(queryString);
        }
        response.sendRedirect(redirectURL.toString());
    }
    String[] data = { destination };
    LogUtil.access(Level.INFO, LogUtil.REDIRECT_TO_SP, data, null);
    AuthnRequestInfo reqInfo = new AuthnRequestInfo(request, response, realm, hostedEntityId, preferredIDP, newAuthnRequest, relayState, null);
    synchronized (SPCache.requestHash) {
        SPCache.requestHash.put(requestID, reqInfo);
    }
    if (SAML2FailoverUtils.isSAML2FailoverEnabled()) {
        try {
            // sessionExpireTime is counted in seconds
            long sessionExpireTime = System.currentTimeMillis() / 1000 + SPCache.interval;
            SAML2FailoverUtils.saveSAML2TokenWithoutSecondaryKey(requestID, new AuthnRequestInfoCopy(reqInfo), sessionExpireTime);
            if (SAML2Utils.debug.messageEnabled()) {
                SAML2Utils.debug.message(classMethod + " SAVE AuthnRequestInfoCopy for requestID " + requestID);
            }
        } catch (SAML2TokenRepositoryException se) {
            SAML2Utils.debug.error(classMethod + " SAVE AuthnRequestInfoCopy for requestID " + requestID + ", failed!", se);
        }
    }
}

Example 5 with SingleSignOnServiceElement

use of com.sun.identity.saml2.jaxb.metadata.SingleSignOnServiceElement in project OpenAM by OpenRock.

the class MetaDataParser method getSSOUrl.

/**
 *get SSO URL
 *
 */
private String getSSOUrl() {
    try {
        SAML2MetaManager manager = new SAML2MetaManager();
        IDPSSODescriptorElement idp = manager.getIDPSSODescriptor("/", getIDPEntityID());
        List ssoServiceList = idp.getSingleSignOnService();
        if ((ssoServiceList != null) && (!ssoServiceList.isEmpty())) {
            Iterator i = ssoServiceList.iterator();
            while (i.hasNext()) {
                SingleSignOnServiceElement sso = (SingleSignOnServiceElement) i.next();
                if ((sso != null) && (sso.getBinding() != null)) {
                    String ssoURL = sso.getLocation();
                    int loc = ssoURL.indexOf("/metaAlias/");
                    if (loc == -1) {
                        continue;
                    } else {
                        return ssoURL;
                    }
                }
            }
        }
        return null;
    } catch (SAML2MetaException ex) {
        Logger.getLogger(MetaDataParser.class.getName()).log(Level.SEVERE, null, ex);
    }
    return null;
}