Examples with CriteriaSet net.shibboleth.utilities.java.support.resolver.CriteriaSet used on opensource projects

Example 16 with CriteriaSet

use of net.shibboleth.utilities.java.support.resolver.CriteriaSet in project cas by apereo.

the class CasSamlServiceProvidersConfiguration method coreSamlServiceProvidersInitializingBean.

@Bean
public InitializingBean coreSamlServiceProvidersInitializingBean(@Qualifier(ServicesManager.BEAN_NAME) final ServicesManager servicesManager, final CasConfigurationProperties casProperties, @Qualifier(SamlRegisteredServiceCachingMetadataResolver.DEFAULT_BEAN_NAME) final SamlRegisteredServiceCachingMetadataResolver samlRegisteredServiceCachingMetadataResolver) {
    return () -> {
        val preloadMetadata = (Function<SamlRegisteredService, Void>) service -> {
            LOGGER.info("Launching background thread to load the metadata. This might take a while...");
            new Thread(() -> {
                LOGGER.debug("Loading metadata at [{}]...", service.getMetadataLocation());
                samlRegisteredServiceCachingMetadataResolver.resolve(service, new CriteriaSet());
            }, getClass().getSimpleName()).start();
            return null;
        };
        val samlSp = casProperties.getSamlSp();
        processSamlServiceProvider(samlSp.getAcademicHealthPlans(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getAcademicWorks(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getAdobeCloud(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getAmazon(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getAppDynamics(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getArcGIS(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getArmsSoftware(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getAsana(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getBenefitFocus(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getBlackBaud(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getBox(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getBynder(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getCccco(), servicesManager, samlRegisteredServiceCachingMetadataResolver, preloadMetadata);
        processSamlServiceProvider(samlSp.getCherWell(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getConcurSolutions(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getConfluence(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getCraniumCafe(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getCrashPlan(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getDocuSign(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getDropbox(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getEasyIep(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getEgnyte(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getEmma(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getEverBridge(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getEvernote(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getFamis(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getGartner(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getGitlab(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getGiveCampus(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getInCommon(), servicesManager, samlRegisteredServiceCachingMetadataResolver, preloadMetadata);
        processSamlServiceProvider(samlSp.getInfiniteCampus(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getJira(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getNeoGov(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getNetPartner(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getNewRelic(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getOffice365(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getOpenAthens(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getPagerDuty(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getPollEverywhere(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getQualtrics(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getRocketChat(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getSafariOnline(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getSalesforce(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getSaManage(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getSansSth(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getServiceNow(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getSlack(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getTopHat(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getSserca(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getSymplicity(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getTableau(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getWarpWire(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getWebAdvisor(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getWebex(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getWorkday(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getYuja(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getZendesk(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getZimbra(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
        processSamlServiceProvider(samlSp.getZoom(), servicesManager, samlRegisteredServiceCachingMetadataResolver);
    };
}

Example 17 with CriteriaSet

use of net.shibboleth.utilities.java.support.resolver.CriteriaSet in project cas by apereo.

the class SamlSPUtils method determineEntityIdList.

private static List<String> determineEntityIdList(final AbstractSamlSPProperties sp, final SamlRegisteredServiceCachingMetadataResolver resolver, final SamlRegisteredService service) {
    val entityIDList = sp.getEntityIds();
    if (entityIDList.isEmpty()) {
        val criteriaSet = new CriteriaSet();
        criteriaSet.add(new EntityRoleCriterion(SPSSODescriptor.DEFAULT_ELEMENT_NAME));
        criteriaSet.add(new SatisfyAnyCriterion());
        val metadataResolver = resolver.resolve(service, criteriaSet);
        val resolvers = new ArrayList<MetadataResolver>();
        if (metadataResolver instanceof ChainingMetadataResolver) {
            resolvers.addAll(((ChainingMetadataResolver) metadataResolver).getResolvers());
        } else {
            resolvers.add(metadataResolver);
        }
        resolvers.forEach(r -> {
            if (r instanceof AbstractBatchMetadataResolver) {
                val it = ((AbstractBatchMetadataResolver) r).iterator();
                val descriptor = StreamSupport.stream(Spliterators.spliteratorUnknownSize(it, Spliterator.ORDERED), false).filter(e -> e.getSPSSODescriptor(SAMLConstants.SAML20P_NS) != null).findFirst();
                if (descriptor.isPresent()) {
                    entityIDList.add(descriptor.get().getEntityID());
                } else {
                    LOGGER.warn("Skipped registration of [{}] since no entity id could be found", sp.getName());
                }
            }
        });
    }
    return entityIDList;
}

Example 18 with CriteriaSet

use of net.shibboleth.utilities.java.support.resolver.CriteriaSet in project cas by apereo.

the class DefaultSamlIdPObjectSigner method getSignatureSigningConfiguration.

/**
 * Gets signature signing configuration.
 * The resolved used is {@link SamlIdPMetadataCredentialResolver} that
 * allows the entire criteria set to be passed to the role descriptor resolver.
 * This behavior allows the passing of {@link SamlIdPSamlRegisteredServiceCriterion}
 * so signing configuration, etc can be fetched for a specific service as an override,
 * if on is in fact defined for the service.
 *
 * @param service the service
 * @return the signature signing configuration
 * @throws Exception the exception
 */
protected SignatureSigningConfiguration getSignatureSigningConfiguration(final SamlRegisteredService service) throws Exception {
    val config = configureSignatureSigningSecurityConfiguration(service);
    val samlIdp = casProperties.getAuthn().getSamlIdp();
    val privateKey = getSigningPrivateKey(service);
    val mdCredentialResolver = new SamlIdPMetadataCredentialResolver();
    val roleDescriptorResolver = SamlIdPUtils.getRoleDescriptorResolver(samlIdPMetadataResolver, samlIdp.getMetadata().getCore().isRequireValidMetadata());
    mdCredentialResolver.setRoleDescriptorResolver(roleDescriptorResolver);
    mdCredentialResolver.setKeyInfoCredentialResolver(DefaultSecurityConfigurationBootstrap.buildBasicInlineKeyInfoCredentialResolver());
    mdCredentialResolver.initialize();
    val criteriaSet = new CriteriaSet();
    criteriaSet.add(new SignatureSigningConfigurationCriterion(config));
    criteriaSet.add(new UsageCriterion(UsageType.SIGNING));
    val entityIdCriteriaSet = new CriteriaSet(new EvaluableEntityRoleEntityDescriptorCriterion(IDPSSODescriptor.DEFAULT_ELEMENT_NAME), new SamlIdPSamlRegisteredServiceCriterion(service));
    LOGGER.trace("Resolving entity id from SAML2 IdP metadata for signature signing configuration is [{}]", service.getName());
    val entityId = Objects.requireNonNull(samlIdPMetadataResolver.resolveSingle(entityIdCriteriaSet)).getEntityID();
    LOGGER.trace("Resolved entity id from SAML2 IdP metadata is [{}]", entityId);
    criteriaSet.add(new EntityIdCriterion(entityId));
    criteriaSet.add(new EntityRoleCriterion(IDPSSODescriptor.DEFAULT_ELEMENT_NAME));
    criteriaSet.add(new SamlIdPSamlRegisteredServiceCriterion(service));
    LOGGER.trace("Resolved signing credentials based on criteria [{}]", criteriaSet);
    val credentials = Sets.newLinkedHashSet(mdCredentialResolver.resolve(criteriaSet));
    LOGGER.trace("Resolved [{}] signing credentials", credentials.size());
    val finalCredentials = new ArrayList<Credential>();
    credentials.stream().map(c -> getResolvedSigningCredential(c, privateKey, service)).filter(Objects::nonNull).filter(c -> doesCredentialFingerprintMatch(c, service)).forEach(finalCredentials::add);
    if (finalCredentials.isEmpty()) {
        LOGGER.error("Unable to locate any signing credentials for service [{}]", service.getName());
        throw new IllegalArgumentException("Unable to locate signing credentials");
    }
    config.setSigningCredentials(finalCredentials);
    LOGGER.trace("Signature signing credentials configured with [{}] credentials", finalCredentials.size());
    return config;
}

Example 19 with CriteriaSet

use of net.shibboleth.utilities.java.support.resolver.CriteriaSet in project cas by apereo.

the class SamlProfileSamlAssertionBuilder method build.

@Override
public Assertion build(final SamlProfileBuilderContext context) throws Exception {
    val statements = new ArrayList<Statement>();
    val authnStatement = this.samlProfileSamlAuthNStatementBuilder.build(context);
    statements.add(authnStatement);
    val attrStatement = this.samlProfileSamlAttributeStatementBuilder.build(context);
    if (!attrStatement.getAttributes().isEmpty() || !attrStatement.getEncryptedAttributes().isEmpty()) {
        statements.add(attrStatement);
    }
    val issuerId = FunctionUtils.doIf(StringUtils.isNotBlank(context.getRegisteredService().getIssuerEntityId()), context.getRegisteredService()::getIssuerEntityId, Unchecked.supplier(() -> {
        val criteriaSet = new CriteriaSet(new EvaluableEntityRoleEntityDescriptorCriterion(IDPSSODescriptor.DEFAULT_ELEMENT_NAME), new SamlIdPSamlRegisteredServiceCriterion(context.getRegisteredService()));
        LOGGER.trace("Resolving entity id from SAML2 IdP metadata to determine issuer for [{}]", context.getRegisteredService().getName());
        val entityDescriptor = Objects.requireNonNull(samlIdPMetadataResolver.resolveSingle(criteriaSet));
        return entityDescriptor.getEntityID();
    })).get();
    val id = '_' + String.valueOf(RandomUtils.nextLong());
    val assertion = newAssertion(statements, issuerId, ZonedDateTime.now(ZoneOffset.UTC), id);
    assertion.setSubject(this.samlProfileSamlSubjectBuilder.build(context));
    assertion.setConditions(this.samlProfileSamlConditionsBuilder.build(context));
    signAssertion(assertion, context);
    return assertion;
}

Example 20 with CriteriaSet

use of net.shibboleth.utilities.java.support.resolver.CriteriaSet in project cas by apereo.

the class SamlRegisteredServiceCacheKeyTests method verifyCacheKeyNoEntityIdCriteria.

@Test
public void verifyCacheKeyNoEntityIdCriteria() {
    val criteriaSet = new CriteriaSet();
    criteriaSet.add(new EntityRoleCriterion(SPSSODescriptor.DEFAULT_ELEMENT_NAME));
    val service = new SamlRegisteredService();
    service.setName("Example");
    service.setId(1000);
    service.setServiceId(".+");
    service.setMetadataLocation("https://mdq.something.net/entities/{0}");
    val results = new SamlRegisteredServiceCacheKey(service, criteriaSet);
    assertNotNull(results.getId());
    assertEquals(service.getServiceId(), results.getCacheKey());
}