Examples with WSFederationException com.sun.identity.wsfederation.common.WSFederationException used on opensource projects

Example 11 with WSFederationException

use of com.sun.identity.wsfederation.common.WSFederationException in project OpenAM by OpenRock.

the class IPRPSignoutRequest method process.

/**
     * Processes the sign-out request, returning a response via the 
     * HttpServletResponse passed to the constructor.
     */
public void process() throws IOException, WSFederationException {
    String classMethod = "IPRPSignoutRequest.process: ";
    String metaAlias = WSFederationMetaUtils.getMetaAliasByUri(request.getRequestURI());
    if ((metaAlias == null) || (metaAlias.trim().length() == 0)) {
        debug.error(classMethod + "Unable to get meta alias from request");
        throw new WSFederationException(WSFederationUtils.bundle.getString("MetaAliasNotFound"));
    }
    String realm = WSFederationMetaUtils.getRealmByMetaAlias(metaAlias);
    if ((realm == null) || (realm.trim().length() == 0)) {
        debug.error(classMethod + "Unable to get realm from request");
        throw new WSFederationException(WSFederationUtils.bundle.getString("nullRealm"));
    }
    WSFederationMetaManager metaManager = WSFederationUtils.getMetaManager();
    // retrieve entity id from meta alias            
    String entityId = metaManager.getEntityByMetaAlias(metaAlias);
    if ((entityId == null) || (entityId.trim().length() == 0)) {
        debug.error(classMethod + "Unable to get Entity ID from metaAlias" + metaAlias);
        throw new WSFederationException(WSFederationUtils.bundle.getString("nullEntityID"));
    }
    Object session = null;
    try {
        session = WSFederationUtils.sessionProvider.getSession(request);
    } catch (SessionException se) {
        if (debug.messageEnabled()) {
            debug.message(classMethod + "Session exception" + se.getLocalizedMessage());
        }
    // Don't care too much about session exceptions here - usual cause
    // is trying to log out after the session has expired
    }
    try {
        // Strategy here is to do logouts in parallel via iframes, provide a
        // link to wreply, if any
        BaseConfigType config = metaManager.getBaseConfig(realm, entityId);
        String displayName = WSFederationMetaUtils.getAttribute(config, WSFederationConstants.DISPLAY_NAME);
        if (displayName == null || displayName.length() == 0) {
            displayName = entityId;
        }
        request.setAttribute(WSFederationConstants.LOGOUT_DISPLAY_NAME, displayName);
        request.setAttribute(WSFederationConstants.LOGOUT_WREPLY, wreply);
        request.setAttribute(WSFederationConstants.REALM_PARAM, realm);
        request.setAttribute(WSFederationConstants.ENTITYID_PARAM, entityId);
        LinkedHashMap<String, String> providerList = new LinkedHashMap<String, String>();
        if (session != null) {
            String[] idpList = WSFederationUtils.sessionProvider.getProperty(session, WSFederationConstants.SESSION_IDP);
            if (idpList != null && idpList.length > 0 && idpList[0] != null && idpList[0].length() > 0) {
                FederationElement fed = metaManager.getEntityDescriptor(realm, idpList[0]);
                String endpoint = metaManager.getTokenIssuerEndpoint(fed);
                String url = endpoint + "?wa=" + WSFederationConstants.WSIGNOUT10;
                config = metaManager.getBaseConfig(realm, idpList[0]);
                displayName = WSFederationMetaUtils.getAttribute(config, WSFederationConstants.DISPLAY_NAME);
                if (displayName == null) {
                    displayName = idpList[0];
                }
                if (debug.messageEnabled()) {
                    debug.message(classMethod + "sending signout to " + url);
                }
                providerList.put(url, displayName);
            }
            String[] spList = WSFederationUtils.sessionProvider.getProperty(session, WSFederationConstants.SESSION_SP_LIST);
            if (spList != null && spList.length > 0 && spList[0] != null && spList[0].length() > 0) {
                for (int i = 0; i < spList.length; i++) {
                    config = metaManager.getBaseConfig(realm, spList[i]);
                    displayName = WSFederationMetaUtils.getAttribute(config, WSFederationConstants.DISPLAY_NAME);
                    if (displayName == null) {
                        displayName = spList[i];
                    }
                    FederationElement fed = metaManager.getEntityDescriptor(realm, spList[i]);
                    String endpoint = metaManager.getTokenIssuerEndpoint(fed);
                    String url = endpoint + "?wa=" + WSFederationConstants.WSIGNOUT10;
                    if (debug.messageEnabled()) {
                        debug.message(classMethod + "sending signout to " + url);
                    }
                    providerList.put(url, displayName);
                }
                // Can't remove a session property, so just set it to 
                // an empty string
                String[] empty = { "" };
                WSFederationUtils.sessionProvider.setProperty(session, WSFederationConstants.SESSION_SP_LIST, empty);
            }
            if (debug.messageEnabled()) {
                debug.message(classMethod + "destroying session " + session);
            }
            MultiProtocolUtils.invalidateSession(session, request, response, SingleLogoutManager.WS_FED);
        }
        request.setAttribute(WSFederationConstants.LOGOUT_PROVIDER_LIST, providerList);
        request.getRequestDispatcher("/wsfederation/jsp/logout.jsp").forward(request, response);
    } catch (ServletException se) {
        if (debug.messageEnabled()) {
            debug.message(classMethod + "Servlet exception" + se.getLocalizedMessage());
        }
        throw new WSFederationException(se);
    } catch (SessionException se) {
        if (debug.messageEnabled()) {
            debug.message(classMethod + "Session exception" + se.getLocalizedMessage());
        }
        throw new WSFederationException(se);
    }
    // Can't pass session, since we just invalidated it!
    String[] data = { wreply };
    LogUtil.access(Level.INFO, LogUtil.SLO_SUCCESSFUL, data, null);
}

Example 12 with WSFederationException

use of com.sun.identity.wsfederation.common.WSFederationException in project OpenAM by OpenRock.

the class IPSigninRequest method sendResponse.

/**
     * Sends <code>RequestSecurityTokenResponse</code> containing an 
     * <code>Assertion</code> back to the requesting service provider
     */
private void sendResponse(Object session, String idpEntityId, String spEntityId, String idpMetaAlias, String realm) throws WSFederationException, IOException {
    String classMethod = "IDPSSOFederate.sendResponse: ";
    /*    
        String nameIDFormat = null;
        NameIDPolicy policy = authnReq.getNameIDPolicy();
        if (policy != null) {
            nameIDFormat = policy.getFormat();
        }
 */
    String acsURL = IDPSSOUtil.getACSurl(spEntityId, realm, wreply);
    if ((acsURL == null) || (acsURL.trim().length() == 0)) {
        debug.error(classMethod + "no ACS URL found.");
        String[] data = { realm, spEntityId, wreply };
        LogUtil.error(Level.INFO, LogUtil.NO_ACS_URL, data, null);
        throw new WSFederationException(WSFederationUtils.bundle.getString("unableTofindACSURL"));
    }
    WSFederationMetaManager metaManager = WSFederationUtils.getMetaManager();
    IDPSSOConfigElement idpConfig = metaManager.getIDPSSOConfig(realm, idpEntityId);
    if (idpConfig == null) {
        debug.error(classMethod + "cannot find configuration for IdP " + idpEntityId);
        throw new WSFederationException(WSFederationUtils.bundle.getString("unableToFindIDPConfiguration"));
    }
    SPSSOConfigElement spConfig = metaManager.getSPSSOConfig(realm, spEntityId);
    if (spConfig == null) {
        debug.error(classMethod + "cannot find configuration for SP " + spEntityId);
        throw new WSFederationException(WSFederationUtils.bundle.getString("unableToFindSPConfiguration"));
    }
    String authMethod = null;
    String authSSOInstant = null;
    String userid = null;
    try {
        authMethod = WSFederationUtils.sessionProvider.getProperty(session, SessionProvider.AUTH_METHOD)[0];
        authSSOInstant = WSFederationUtils.sessionProvider.getProperty(session, SessionProvider.AUTH_INSTANT)[0];
        userid = WSFederationUtils.sessionProvider.getProperty(session, "UserId")[// ISAuthConstants.USER_ID
        0];
    } catch (SessionException se) {
        throw new WSFederationException(se);
    }
    IDPAttributeMapper attrMapper = getIDPAttributeMapper(WSFederationMetaUtils.getAttributes(idpConfig));
    IDPAccountMapper accountMapper = getIDPAccountMapper(WSFederationMetaUtils.getAttributes(idpConfig));
    List attributes = attrMapper.getAttributes(session, idpEntityId, spEntityId, realm);
    Date authInstant = null;
    if (authSSOInstant == null || authSSOInstant.equals("")) {
        authInstant = new Date();
    } else {
        try {
            authInstant = DateUtils.stringToDate(authSSOInstant);
        } catch (ParseException pe) {
            throw new WSFederationException(pe);
        }
    }
    NameIdentifier ni = accountMapper.getNameID(session, realm, idpEntityId, spEntityId);
    int notBeforeSkew = SAML2Constants.NOTBEFORE_ASSERTION_SKEW_DEFAULT;
    String notBeforeSkewStr = WSFederationMetaUtils.getAttribute(idpConfig, SAML2Constants.ASSERTION_NOTBEFORE_SKEW_ATTRIBUTE);
    if (notBeforeSkewStr != null) {
        try {
            notBeforeSkew = Integer.parseInt(notBeforeSkewStr);
            if (debug.messageEnabled()) {
                debug.message(classMethod + "got not before skew from config:" + notBeforeSkew);
            }
        } catch (NumberFormatException nfe) {
            debug.error(classMethod + "Failed to get not before skew from IDP SSO config: ", nfe);
            throw new WSFederationException(nfe);
        }
    }
    int effectiveTime = SAML2Constants.ASSERTION_EFFECTIVE_TIME;
    String effectiveTimeStr = WSFederationMetaUtils.getAttribute(idpConfig, SAML2Constants.ASSERTION_EFFECTIVE_TIME_ATTRIBUTE);
    if (effectiveTimeStr != null) {
        try {
            effectiveTime = Integer.parseInt(effectiveTimeStr);
            if (debug.messageEnabled()) {
                debug.message(classMethod + "got effective time from config:" + effectiveTime);
            }
        } catch (NumberFormatException nfe) {
            debug.error(classMethod + "Failed to get assertion effective time from " + "IDP SSO config: ", nfe);
            throw new WSFederationException(nfe);
        }
    }
    String strWantAssertionSigned = WSFederationMetaUtils.getAttribute(spConfig, WSFederationConstants.WANT_ASSERTION_SIGNED);
    // By default, we want to sign assertions
    boolean wantAssertionSigned = (strWantAssertionSigned != null) ? Boolean.parseBoolean(strWantAssertionSigned) : true;
    String certAlias = WSFederationMetaUtils.getAttribute(idpConfig, SAML2Constants.SIGNING_CERT_ALIAS);
    if (wantAssertionSigned && certAlias == null) {
        // SP wants us to sign the assertion, but we don't have a signing 
        // cert
        debug.error(classMethod + "SP wants signed assertion, but no signing cert is " + "configured");
        throw new WSFederationException(WSFederationUtils.bundle.getString("noIdPCertAlias"));
    }
    if (!wantAssertionSigned) {
        // SP doesn't want us to sign the assertion, so pass null certAlias 
        // to indicate no assertion signature required
        certAlias = null;
    }
    // generate a response for the authn request
    RequestSecurityTokenResponse rstr = new RequestSecurityTokenResponse(new SAML11RequestedSecurityToken(realm, spEntityId, idpEntityId, notBeforeSkew, effectiveTime, certAlias, authMethod, authInstant, ni, attributes), wtrealm);
    if (rstr == null) {
        debug.error(classMethod + "response is null");
        String errorMsg = WSFederationUtils.bundle.getString("UnableToCreateAssertion");
        /*
            res = IDPSSOUtil.getErrorResponse(authnReq, 
                SAML2Constants.RESPONDER, errorMsg, idpEntityID);
             */
        return;
    } else {
        try {
            String[] values = { idpMetaAlias };
            // Add SP to SP list in session
            String[] spList = WSFederationUtils.sessionProvider.getProperty(session, WSFederationConstants.SESSION_SP_LIST);
            ArrayList<String> newSpList = (spList != null) ? new ArrayList<String>(Arrays.asList(spList)) : new ArrayList<String>();
            if (!newSpList.contains(spEntityId)) {
                newSpList.add(spEntityId);
                WSFederationUtils.sessionProvider.setProperty(session, WSFederationConstants.SESSION_SP_LIST, newSpList.toArray(new String[0]));
            }
        } catch (SessionException e) {
            debug.error(classMethod + "error setting idpMetaAlias into the session: ", e);
        }
        try {
            postToTarget(rstr, acsURL);
        } catch (ServletException se) {
            throw new WSFederationException(se);
        }
    }
}

Example 13 with WSFederationException

use of com.sun.identity.wsfederation.common.WSFederationException in project OpenAM by OpenRock.

the class IPSigninRequest method getIDPAttributeMapper.

private static IDPAttributeMapper getIDPAttributeMapper(Map<String, List<String>> attributes) throws WSFederationException {
    IDPAttributeMapper attrMapper = null;
    List attrMapperList = (List) attributes.get(SAML2Constants.IDP_ATTRIBUTE_MAPPER);
    if (attrMapperList != null) {
        try {
            attrMapper = (IDPAttributeMapper) (Class.forName((String) attrMapperList.get(0)).newInstance());
        } catch (ClassNotFoundException cfe) {
            throw new WSFederationException(cfe);
        } catch (InstantiationException ie) {
            throw new WSFederationException(ie);
        } catch (IllegalAccessException iae) {
            throw new WSFederationException(iae);
        }
    }
    if (attrMapper == null) {
        throw new WSFederationException(WSFederationUtils.bundle.getString("failedAttrMapper"));
    }
    return attrMapper;
}

Example 14 with WSFederationException

use of com.sun.identity.wsfederation.common.WSFederationException in project OpenAM by OpenRock.

the class DefaultAccountMapper method getSearchParameters.

/**
     * Returns the <code>NameIDInfoKey</code> key value pair that can
     * be used for searching the user.
     * @param nameID <code>NameID</code> object.
     * @param hostEntityID hosted <code>EntityID</code>.
     * @param remoteEntityID remote <code>EntityID</code>.
     * @exception <code>WSFederationException</code> if any failure.
     */
protected Map getSearchParameters(NameIdentifier nameID, String realm, String hostEntityID, String remoteEntityID) throws WSFederationException {
    if (nameID == null) {
        throw new WSFederationException(bundle.getString("nullNameID"));
    }
    NameIDInfoKey infoKey = null;
    try {
        infoKey = new NameIDInfoKey(nameID.getName(), hostEntityID, remoteEntityID);
    } catch (SAML2Exception se) {
        throw new WSFederationException(se);
    }
    HashSet set = new HashSet();
    set.add(infoKey.toValueString());
    Map keyMap = new HashMap();
    keyMap.put(AccountUtils.getNameIDInfoKeyAttribute(), set);
    if (debug.messageEnabled()) {
        debug.message("DefaultAccountMapper.getNameIDKeyMap: " + keyMap);
    }
    return keyMap;
}

Example 15 with WSFederationException

use of com.sun.identity.wsfederation.common.WSFederationException in project OpenAM by OpenRock.

the class DefaultAttributeMapper method getConfigAttributeMap.

/**
     * Returns the attribute map by parsing the configured map in hosted
     * provider configuration
     * @param realm realm name.
     * @param hostEntityID <code>EntityID</code> of the hosted provider.
     * @return a map of local attributes configuration map.
     *        This map will have a key as the SAML attribute name and the value
     *        is the local attribute. 
     * @exception <code>WSFederationException</code> if any failured.
     */
public Map getConfigAttributeMap(String realm, String hostEntityID) throws WSFederationException {
    if (realm == null) {
        throw new WSFederationException(bundle.getString("nullRealm"));
    }
    if (hostEntityID == null) {
        throw new WSFederationException(bundle.getString("nullHostEntityID"));
    }
    try {
        BaseConfigType config = null;
        if (role.equals(SP)) {
            config = WSFederationUtils.getMetaManager().getSPSSOConfig(realm, hostEntityID);
        } else {
            config = WSFederationUtils.getMetaManager().getIDPSSOConfig(realm, hostEntityID);
        }
        if (config == null) {
            if (debug.warningEnabled()) {
                debug.warning("DefaultAttributeMapper.getConfigAttribute" + "Map: configuration is not defined.");
            }
            return Collections.EMPTY_MAP;
        }
        Map attribConfig = WSFederationMetaUtils.getAttributes(config);
        List mappedAttributes = (List) attribConfig.get(SAML2Constants.ATTRIBUTE_MAP);
        if (mappedAttributes == null || mappedAttributes.size() == 0) {
            if (debug.messageEnabled()) {
                debug.message("DefaultAttributeMapper.getConfigAttributeMap:" + "Attribute map is not defined for entity: " + hostEntityID);
            }
            return Collections.EMPTY_MAP;
        }
        Map map = new HashMap();
        for (Iterator iter = mappedAttributes.iterator(); iter.hasNext(); ) {
            String entry = (String) iter.next();
            if (entry.indexOf("=") == -1) {
                if (debug.messageEnabled()) {
                    debug.message("DefaultAttributeMapper.getConfig" + "AttributeMap: Invalid entry." + entry);
                }
                continue;
            }
            StringTokenizer st = new StringTokenizer(entry, "=");
            map.put(st.nextToken(), st.nextToken());
        }
        return map;
    } catch (WSFederationMetaException sme) {
        debug.error("DefaultAttributeMapper.getConfigAttributeMap: " + "Meta Exception", sme);
        throw new WSFederationException(sme);
    }
}