Examples with NameIDandSPpair com.sun.identity.saml2.profile.NameIDandSPpair used on opensource projects

Example 6 with NameIDandSPpair

use of com.sun.identity.saml2.profile.NameIDandSPpair in project OpenAM by OpenRock.

the class DoManageNameID method checkMNIResponse.

private static boolean checkMNIResponse(ManageNameIDResponse mniResponse, String realm, String hostEntityID, String hostRole, StringBuffer mniUserId) throws SAML2Exception, SessionException {
    boolean success = false;
    String remoteEntityID = mniResponse.getIssuer().getValue();
    String requestID = mniResponse.getInResponseTo();
    ManageNameIDRequestInfo reqInfo = getMNIRequestInfo(requestID, hostRole);
    if (reqInfo == null) {
        logError("invalidInResponseToInResponse", LogUtil.INVALID_MNI_RESPONSE, null);
        throw new SAML2Exception(SAML2Utils.bundle.getString("invalidInResponseToInResponse"));
    }
    String retCode = mniResponse.getStatus().getStatusCode().getValue();
    if (retCode.equalsIgnoreCase(SAML2Constants.SUCCESS)) {
        Object session = reqInfo.getSession();
        if (session == null) {
            logError("nullSSOToken", LogUtil.INVALID_SSOTOKEN, null);
            throw new SAML2Exception(SAML2Utils.bundle.getString("nullSSOToken"));
        }
        String userID = sessionProvider.getPrincipalName(session);
        mniUserId.append(userID);
        ManageNameIDRequest origMniReq = reqInfo.getManageNameIDRequest();
        NameID oldNameID = origMniReq.getNameID();
        List spFedSessions = null;
        NameIDInfo oldNameIDInfo = getNameIDInfo(userID, hostEntityID, remoteEntityID, hostRole, realm, oldNameID.getSPNameQualifier(), true);
        if (oldNameIDInfo == null) {
            debug.error("DoManageNameID.checkMNIResponse: NameIDInfo " + "not found.");
            return false;
        }
        // Terminate
        if (hostRole.equalsIgnoreCase(SAML2Constants.SP_ROLE)) {
            String infoKeyStr = oldNameIDInfo.getNameIDInfoKey().toValueString();
            spFedSessions = (List) SPCache.fedSessionListsByNameIDInfoKey.remove(infoKeyStr);
            removeInfoKeyFromSession(session, infoKeyStr);
            if ((agent != null) && agent.isRunning() && (saml2Svc != null)) {
                saml2Svc.setFedSessionCount((long) SPCache.fedSessionListsByNameIDInfoKey.size());
            }
        } else {
            removeIDPFedSession(remoteEntityID, oldNameID.getValue());
        }
        if (!AccountUtils.removeAccountFederation(oldNameIDInfo, userID)) {
            // log termination failure
            logError("unableToTerminate", LogUtil.UNABLE_TO_TERMINATE, userID);
            return false;
        }
        if (origMniReq.getTerminate()) {
            // log termination success
            logAccess("requestSuccess", LogUtil.SUCCESS_FED_TERMINATION, userID);
            return true;
        }
        // newID case
        String newIDValue = origMniReq.getNewID().getValue();
        boolean isAffiliation = oldNameIDInfo.isAffiliation();
        String spNameQualifier = oldNameID.getSPNameQualifier();
        if (hostRole.equalsIgnoreCase(SAML2Constants.SP_ROLE)) {
            NameID newNameID = AssertionFactory.getInstance().createNameID();
            newNameID.setValue(oldNameID.getValue());
            newNameID.setFormat(oldNameID.getFormat());
            newNameID.setSPProvidedID(newIDValue);
            newNameID.setSPNameQualifier(spNameQualifier);
            newNameID.setNameQualifier(oldNameID.getNameQualifier());
            NameIDInfo newNameIDInfo = new NameIDInfo((isAffiliation ? spNameQualifier : hostEntityID), remoteEntityID, newNameID, hostRole, isAffiliation);
            String newInfoKeyStr = newNameIDInfo.getNameIDInfoKey().toValueString();
            if (spFedSessions != null) {
                SPCache.fedSessionListsByNameIDInfoKey.put(newInfoKeyStr, spFedSessions);
                if ((agent != null) && agent.isRunning() && (saml2Svc != null)) {
                    saml2Svc.setFedSessionCount((long) SPCache.fedSessionListsByNameIDInfoKey.size());
                }
            }
            AccountUtils.setAccountFederation(newNameIDInfo, userID);
            try {
                String infoKeyAttribute = AccountUtils.getNameIDInfoKeyAttribute();
                String[] fromToken = sessionProvider.getProperty(session, infoKeyAttribute);
                if ((fromToken == null) || (fromToken.length == 0) || (fromToken[0] == null) || (fromToken[0].length() == 0)) {
                    String[] values = { newInfoKeyStr };
                    sessionProvider.setProperty(session, infoKeyAttribute, values);
                } else {
                    if (fromToken[0].indexOf(newInfoKeyStr) == -1) {
                        String[] values = { fromToken[0] + SAML2Constants.SECOND_DELIM + newInfoKeyStr };
                        sessionProvider.setProperty(session, infoKeyAttribute, values);
                    }
                }
            } catch (Exception e) {
                debug.message("DoManageNameID.checkMNIResponse:", e);
            }
        } else if (hostRole.equalsIgnoreCase(SAML2Constants.IDP_ROLE)) {
            NameID newNameID = AssertionFactory.getInstance().createNameID();
            newNameID.setValue(newIDValue);
            newNameID.setFormat(oldNameID.getFormat());
            newNameID.setSPProvidedID(oldNameID.getSPProvidedID());
            newNameID.setSPNameQualifier(spNameQualifier);
            newNameID.setNameQualifier(hostEntityID);
            NameIDInfo newNameIDInfo = new NameIDInfo(hostEntityID, (isAffiliation ? spNameQualifier : remoteEntityID), newNameID, SAML2Constants.IDP_ROLE, isAffiliation);
            AccountUtils.setAccountFederation(newNameIDInfo, userID);
            NameIDandSPpair pair = new NameIDandSPpair(newNameID, remoteEntityID);
            IDPSession idpSession = (IDPSession) IDPCache.idpSessionsBySessionID.get(sessionProvider.getSessionID(session));
            if (idpSession != null) {
                synchronized (IDPCache.idpSessionsByIndices) {
                    List list = (List) idpSession.getNameIDandSPpairs();
                    list.add(pair);
                }
            }
        }
        // log manage name id success
        logAccess("newNameIDSuccess", LogUtil.SUCCESS_NEW_NAMEID, userID);
        success = true;
    } else {
        logError("mniFailed", LogUtil.INVALID_MNI_RESPONSE, null);
        throw new SAML2Exception(SAML2Utils.bundle.getString("mniFailed"));
    }
    return success;
}

Example 7 with NameIDandSPpair

use of com.sun.identity.saml2.profile.NameIDandSPpair in project OpenAM by OpenRock.

the class SAML2SingleLogoutHandler method handleSOAPInitiatedSingleLogout.

private int handleSOAPInitiatedSingleLogout(Set userSession, String userID, HttpServletRequest request, HttpServletResponse response, String realm, String idpMetaAlias, String idpEntityId, String relayState, SAML2MetaManager saml2Manager) throws SAML2Exception, SessionException {
    debug.message("SAML2SingleLogoutHanlder: handleSOAPInitiatedSLO");
    // TODO : verify this works under LB        
    Object session = null;
    SessionProvider provider = SessionManager.getProvider();
    if ((userSession != null) && !userSession.isEmpty()) {
        // TODO : handle multiple SSO token case
        session = (Object) userSession.iterator().next();
        if (!provider.isValid(session)) {
            return SingleLogoutManager.LOGOUT_NO_ACTION_STATUS;
        }
    } else {
        return SingleLogoutManager.LOGOUT_NO_ACTION_STATUS;
    }
    if (debug.messageEnabled()) {
        debug.message("SAML2SLOHandler.handleSOAPSLO: " + "handler session " + session + " for user " + userID);
    }
    // get IDP session index from session
    String[] sessIndex = provider.getProperty(session, SAML2Constants.IDP_SESSION_INDEX);
    if (debug.messageEnabled()) {
        debug.message("SAML2SLOHandler.handleSOAPSLO: " + "session index = " + sessIndex);
    }
    if ((sessIndex == null) || (sessIndex.length == 0)) {
        if (debug.warningEnabled()) {
            debug.warning("SAML2SLOHandler.handleSOAPSLO: " + "Null session index for " + session);
        }
        return SingleLogoutManager.LOGOUT_NO_ACTION_STATUS;
    }
    IDPSession idpSession = (IDPSession) IDPCache.idpSessionsByIndices.get(sessIndex[0]);
    if (idpSession == null) {
        debug.error("SAML2SLOHanlder.handleSOAPSLO: " + "IDP no longer has this session index " + sessIndex[0]);
        return SingleLogoutManager.LOGOUT_FAILED_STATUS;
    }
    List list = (List) idpSession.getNameIDandSPpairs();
    int n = list.size();
    if (debug.messageEnabled()) {
        debug.message("SAML2SLOHanlder.handleSOAPSLO: " + "NameIDandSPpair for " + sessIndex[0] + " is " + list + ", size=" + n);
    }
    NameIDandSPpair pair = null;
    int soapFailCount = 0;
    for (int i = 0; i < n; i++) {
        pair = (NameIDandSPpair) list.get(i);
        String spEntityID = pair.getSPEntityID();
        if (debug.messageEnabled()) {
            debug.message("SAML2SLOHanlder.handleSOAPSLO: " + "SP for " + sessIndex[0] + " is " + spEntityID);
        }
        SPSSODescriptorElement sp = null;
        sp = SAML2Utils.getSAML2MetaManager().getSPSSODescriptor(realm, spEntityID);
        List slosList = sp.getSingleLogoutService();
        // get IDP entity config for basic auth info
        SPSSOConfigElement spConfig = SAML2Utils.getSAML2MetaManager().getSPSSOConfig(realm, spEntityID);
        HashMap paramsMap = new HashMap();
        paramsMap.put(SAML2Constants.ROLE, SAML2Constants.IDP_ROLE);
        try {
            LogoutUtil.doLogout(idpMetaAlias, spEntityID, slosList, null, SAML2Constants.SOAP, relayState, sessIndex[0], pair.getNameID(), request, response, paramsMap, spConfig);
        } catch (SAML2Exception ex) {
            debug.error("SAML2SLOHandler:handleSOAPSLO.doLogout", ex);
            soapFailCount++;
            continue;
        }
    }
    int retStatus = SingleLogoutManager.LOGOUT_SUCCEEDED_STATUS;
    if (soapFailCount == n) {
        retStatus = SingleLogoutManager.LOGOUT_FAILED_STATUS;
    } else if (soapFailCount > 0) {
        retStatus = SingleLogoutManager.LOGOUT_PARTIAL_STATUS;
    }
    //  invaidate session
    MultiProtocolUtils.invalidateSession(session, request, response, SingleLogoutManager.SAML2);
    IDPCache.idpSessionsByIndices.remove(sessIndex[0]);
    IDPCache.authnContextCache.remove(sessIndex[0]);
    if (debug.messageEnabled()) {
        debug.message("SAML2SLOHandler.doSOAPSLO: return status for " + session + " is " + retStatus);
    }
    return retStatus;
}

Example 8 with NameIDandSPpair

use of com.sun.identity.saml2.profile.NameIDandSPpair in project OpenAM by OpenRock.

the class IDPSingleLogout method processLogoutResponse.

static boolean processLogoutResponse(HttpServletRequest request, HttpServletResponse response, LogoutResponse logoutRes, String relayState, String metaAlias, String idpEntityID, String spEntityID, String realm, String binding) throws SAML2Exception, SessionException {
    // use the cache to figure out which session index is in question
    // and then use the cache to see if any more SPs to send logout request
    // if yes, send one
    // if no, do local logout and send response back to original requesting
    // SP (this SP name should be remembered in cache)
    Object session = sessionProvider.getSession(request);
    String tokenID = sessionProvider.getSessionID(session);
    String idpSessionIndex = IDPSSOUtil.getSessionIndex(session);
    if (idpSessionIndex == null) {
        if (debug.messageEnabled()) {
            debug.message("No SP session participant(s)");
        }
        MultiProtocolUtils.invalidateSession(session, request, response, SingleLogoutManager.SAML2);
        return false;
    }
    IDPSession idpSession = IDPCache.idpSessionsByIndices.get(idpSessionIndex);
    if (idpSession == null) {
        if (debug.messageEnabled()) {
            debug.message("IDPSLO.processLogoutResponse : " + "IDP Session with session index " + idpSessionIndex + " already removed.");
        }
        try {
            if (SAML2FailoverUtils.isSAML2FailoverEnabled()) {
                SAML2FailoverUtils.deleteSAML2Token(idpSessionIndex);
            }
        } catch (SAML2TokenRepositoryException se) {
            debug.error("IDPSingleLogout.processLogoutRequest: Error while deleting token from " + "SAML2 Token Repository for idpSessionIndex:" + idpSessionIndex, se);
        }
        IDPCache.authnContextCache.remove(idpSessionIndex);
        MultiProtocolUtils.invalidateSession(session, request, response, SingleLogoutManager.SAML2);
        return false;
    }
    if (debug.messageEnabled()) {
        debug.message("idpSessionIndex=" + idpSessionIndex);
    }
    List<NameIDandSPpair> list = idpSession.getNameIDandSPpairs();
    debug.message("idpSession.getNameIDandSPpairs()=" + list);
    if (list.isEmpty()) {
        return sendLastResponse(idpSession, logoutRes, request, response, idpSessionIndex, session, realm, idpEntityID, relayState);
    } else {
        // send Next Requests
        Iterator<NameIDandSPpair> it = list.iterator();
        while (it.hasNext()) {
            NameIDandSPpair pair = it.next();
            it.remove();
            spEntityID = pair.getSPEntityID();
            removeTransientNameIDFromCache(pair.getNameID());
            Map paramsMap = new HashMap(request.getParameterMap());
            paramsMap.put(SAML2Constants.ROLE, SAML2Constants.IDP_ROLE);
            List<SingleLogoutServiceElement> slosList = getSPSLOServiceEndpoints(realm, spEntityID);
            List extensionsList = LogoutUtil.getExtensionsList(request.getParameterMap());
            SPSSOConfigElement spConfig = sm.getSPSSOConfig(realm, spEntityID);
            //When processing a logout response we must ensure that we try to use the original logout request
            //binding to make sure asynchronous bindings have precedence over synchronous bindings.
            SingleLogoutServiceElement logoutEndpoint = LogoutUtil.getMostAppropriateSLOServiceLocation(slosList, idpSession.getOriginatingLogoutRequestBinding());
            if (logoutEndpoint == null) {
                continue;
            }
            StringBuffer requestID = LogoutUtil.doLogout(metaAlias, spEntityID, extensionsList, logoutEndpoint, relayState, idpSessionIndex, pair.getNameID(), request, response, paramsMap, spConfig);
            String bindingUsed = logoutEndpoint.getBinding();
            if (bindingUsed.equals(SAML2Constants.HTTP_REDIRECT) || bindingUsed.equals(SAML2Constants.HTTP_POST)) {
                String requestIDStr = requestID.toString();
                if (debug.messageEnabled()) {
                    debug.message("IDPSingleLogout.processLogoutRequest: requestIDStr = " + requestIDStr + "\nbinding = " + bindingUsed);
                }
                if (requestIDStr != null && requestIDStr.length() != 0) {
                    idpSession.setPendingLogoutRequestID(requestIDStr);
                }
                return true;
            }
        }
        //response.
        return sendLastResponse(idpSession, logoutRes, request, response, idpSessionIndex, session, realm, idpEntityID, relayState);
    }
}

Example 9 with NameIDandSPpair

use of com.sun.identity.saml2.profile.NameIDandSPpair in project OpenAM by OpenRock.

the class IDPSessionListener method sessionInvalidated.

/**
     *  Callback for SessionListener.
     *  It is used for cleaning up the IDP session cache.
     *  
     *  @param session The session object
     */
public void sessionInvalidated(Object session) {
    String classMethod = "IDPSessionListener.sessionInvalidated: ";
    HashMap paramsMap = new HashMap();
    if (SAML2Utils.debug.messageEnabled()) {
        SAML2Utils.debug.message(classMethod + "Entering ...");
    }
    if (session == null) {
        if (SAML2Utils.debug.messageEnabled()) {
            SAML2Utils.debug.message(classMethod + "Session is null.");
        }
        return;
    }
    try {
        SessionProvider sessionProvider = SessionManager.getProvider();
        String[] values = sessionProvider.getProperty(session, SAML2Constants.IDP_SESSION_INDEX);
        if (values == null || values.length == 0) {
            if (SAML2Utils.debug.messageEnabled()) {
                SAML2Utils.debug.message(classMethod + "No sessionIndex stored in session.");
            }
            return;
        }
        String sessionIndex = values[0];
        if (sessionIndex == null || sessionIndex.length() == 0) {
            if (SAML2Utils.debug.messageEnabled()) {
                SAML2Utils.debug.message(classMethod + "No sessionIndex stored in session.");
            }
            return;
        }
        IDPSession idpSession = (IDPSession) IDPCache.idpSessionsByIndices.get(sessionIndex);
        if (idpSession != null) {
            paramsMap.put(SAML2Constants.ROLE, SAML2Constants.IDP_ROLE);
            String metaAlias = idpSession.getMetaAlias();
            String realm = SAML2Utils.getRealm(SAML2MetaUtils.getRealmByMetaAlias(metaAlias));
            String idpEntityID = sm.getEntityByMetaAlias(metaAlias);
            try {
                List list = (List) idpSession.getNameIDandSPpairs();
                for (Iterator iter = list.iterator(); iter.hasNext(); ) {
                    NameIDandSPpair pair = (NameIDandSPpair) iter.next();
                    String spEntityID = pair.getSPEntityID();
                    NameID nameID = pair.getNameID();
                    BaseConfigType idpConfig = sm.getIDPSSOConfig(realm, idpEntityID);
                    if (idpConfig != null) {
                        List idpSessionSyncList = (List) SAML2MetaUtils.getAttributes(idpConfig).get(SAML2Constants.IDP_SESSION_SYNC_ENABLED);
                        if ((idpEntityID != null && spEntityID != null && idpSessionSyncList != null && idpSessionSyncList.size() != 0)) {
                            boolean idpSessionSyncEnabled = ((String) idpSessionSyncList.get(0)).equals(SAML2Constants.TRUE) ? true : false;
                            // Sync flag is enabled
                            if (idpSessionSyncEnabled) {
                                if (SAML2Utils.debug.messageEnabled()) {
                                    SAML2Utils.debug.message(classMethod + "IDP Session Synchronization flag " + "is enabled, initiating SLO to SP");
                                }
                                initiateIDPSingleLogout(sessionIndex, metaAlias, realm, SAML2Constants.SOAP, nameID, spEntityID, paramsMap);
                            }
                        }
                    } else {
                        if (SAML2Utils.debug.messageEnabled()) {
                            SAML2Utils.debug.message(classMethod + "Unable to retrieve the IDP " + "config data, idpConfig is null");
                        }
                    }
                }
            } catch (SAML2MetaException sme) {
                SAML2Utils.debug.error("IDPSessionListener.sessionInvalidated:", sme);
            } catch (SAML2Exception se) {
                SAML2Utils.debug.error("IDPSessionListener.sessionInvalidated:", se);
            } catch (SessionException s) {
                SAML2Utils.debug.error("IDPSessionListener.sessionInvalidated:", s);
            }
            synchronized (IDPCache.idpSessionsByIndices) {
                List list = (List) idpSession.getNameIDandSPpairs();
                for (Iterator iter = list.iterator(); iter.hasNext(); ) {
                    NameIDandSPpair pair = (NameIDandSPpair) iter.next();
                    NameID nameID = pair.getNameID();
                    if (SAML2Constants.NAMEID_TRANSIENT_FORMAT.equals(nameID.getFormat())) {
                        IDPCache.userIDByTransientNameIDValue.remove(nameID.getValue());
                    }
                }
            }
        } else {
            if (SAML2Utils.debug.messageEnabled()) {
                SAML2Utils.debug.message(classMethod + "IDP Session with session index " + sessionIndex + " already removed.");
            }
        }
        IDPCache.idpSessionsByIndices.remove(sessionIndex);
        IDPCache.authnContextCache.remove(sessionIndex);
        String sessID = sessionProvider.getSessionID(session);
        if (IDPCache.idpSessionsBySessionID.get(sessID) != null) {
            IDPCache.idpSessionsBySessionID.remove(sessID);
            if ((agent != null) && agent.isRunning() && (saml2Svc != null)) {
                saml2Svc.setIdpSessionCount((long) IDPCache.idpSessionsBySessionID.size());
            }
        }
        if (IDPCache.spSessionPartnerBySessionID.get(sessID) != null) {
            IDPCache.spSessionPartnerBySessionID.remove(sessID);
        }
        // This failing should not cause the whole process to fail
        try {
            if (SAML2FailoverUtils.isSAML2FailoverEnabled()) {
                SAML2FailoverUtils.deleteSAML2Token(sessionIndex);
            }
        } catch (SAML2TokenRepositoryException se) {
            SAML2Utils.debug.error(classMethod + "SAML2 Token Repository error, sessionIndex:" + sessionIndex, se);
        }
        if (SAML2Utils.debug.messageEnabled()) {
            SAML2Utils.debug.message(classMethod + "cleaned up the IDP session cache for a session expiring or being destroyed: sessionIndex=" + sessionIndex);
        }
    } catch (SessionException e) {
        if (SAML2Utils.debug.warningEnabled()) {
            SAML2Utils.debug.warning(classMethod + "invalid or expired session.", e);
        }
    } catch (SAML2MetaException samlme) {
        if (SAML2Utils.debug.warningEnabled()) {
            SAML2Utils.debug.warning(classMethod + "unable to retrieve idp entity id.", samlme);
        }
    }
}