Examples with ValidationException ddf.security.samlp.impl.ValidationException used on opensource projects

Example 1 with ValidationException

use of ddf.security.samlp.impl.ValidationException in project ddf by codice.

the class LogoutRequestService method soapLogoutRequest.

@POST
@Consumes({ "text/xml", "application/soap+xml" })
public Response soapLogoutRequest(InputStream body, @Context HttpServletRequest request) {
    XMLObject xmlObject;
    try {
        String bodyString = IOUtils.toString(body, StandardCharsets.UTF_8);
        SOAPPart soapMessage = SamlProtocol.parseSoapMessage(bodyString);
        xmlObject = SamlProtocol.getXmlObjectFromNode(soapMessage.getEnvelope().getBody().getFirstChild());
        if (!(xmlObject instanceof LogoutRequest)) {
            LOGGER.info(UNABLE_TO_PARSE_LOGOUT_REQUEST);
            if (LOGGER.isDebugEnabled()) {
                LOGGER.debug("Type of object is {}", xmlObject == null ? "null" : xmlObject.getSchemaType());
            }
            return Response.serverError().build();
        }
    } catch (SOAPException | XMLStreamException | IOException | WSSecurityException e) {
        LOGGER.debug("Error parsing input", e);
        return Response.serverError().build();
    }
    LogoutRequest logoutRequest = (LogoutRequest) xmlObject;
    if (logoutMessage == null) {
        LOGGER.info("Logout message not available yet");
        return Response.serverError().build();
    }
    // Pre-build response with success status
    LogoutWrapper<LogoutResponse> logoutResponse = logoutMessage.buildLogoutResponse(logoutRequest.getIssuer().getValue(), StatusCode.SUCCESS, logoutRequest.getID());
    try {
        if (!validateSignature(logoutRequest)) {
            return getSamlpSoapLogoutResponse(logoutResponse, StatusCode.AUTHN_FAILED, null);
        }
        new SamlValidator.Builder(simpleSign).buildAndValidate(this.request.getRequestURL().toString(), SamlProtocol.Binding.HTTP_POST, logoutRequest);
        httpSessionInvalidator.invalidateSession(logoutRequest.getNameID().getValue(), this::extractSubject);
        securityLogger.audit("Subject logged out by backchannel request: {}", logoutRequest.getNameID().getValue());
        return getSamlpSoapLogoutResponse(logoutResponse);
    } catch (ValidationException e) {
        LOGGER.info(UNABLE_TO_VALIDATE_LOGOUT_REQUEST, e);
        return getSamlpSoapLogoutResponse(logoutResponse, StatusCode.RESPONDER, e.getMessage());
    }
}

Example 2 with ValidationException

use of ddf.security.samlp.impl.ValidationException in project ddf by codice.

the class AuthnResponseValidator method validate.

public void validate(XMLObject xmlObject) throws ValidationException {
    if (!(xmlObject instanceof Response)) {
        throw new ValidationException("Invalid AuthN response XML.");
    }
    Response authnResponse = (Response) xmlObject;
    String status = authnResponse.getStatus().getStatusCode().getValue();
    if (!StatusCode.SUCCESS.equals(status)) {
        throw new ValidationException("AuthN request was unsuccessful.  Received status: " + status);
    }
    if (authnResponse.getAssertions().size() < 1) {
        throw new ValidationException("Assertion missing in AuthN response.");
    }
    if (authnResponse.getAssertions().size() > 1) {
        LOGGER.info("Received multiple assertions in AuthN response.  Only using the first assertion.");
    }
    if (wasRedirectSigned) {
        if (authnResponse.getDestination() == null) {
            throw new ValidationException("Invalid Destination attribute, must be not null for signed responses.");
        } else if (!authnResponse.getDestination().equals(getSpAssertionConsumerServiceUrl(getSpIssuerId()))) {
            throw new ValidationException("Invalid Destination attribute, does not match requested destination.");
        }
    }
    if (authnResponse.getSignature() != null) {
        try {
            simpleSign.validateSignature(authnResponse.getSignature(), authnResponse.getDOM().getOwnerDocument());
        } catch (SignatureException e) {
            throw new ValidationException("Invalid or untrusted signature.");
        }
    }
}