Examples with CriteriaSet net.shibboleth.utilities.java.support.resolver.CriteriaSet used on opensource projects

Example 41 with CriteriaSet

use of net.shibboleth.utilities.java.support.resolver.CriteriaSet in project cas by apereo.

the class SamlIdPObjectEncrypter method resolveEncryptionParameters.

/**
 * Resolve encryption parameters.
 *
 * @param service                 the service
 * @param encryptionConfiguration the encryption configuration
 * @return the encryption parameters
 * @throws ResolverException the exception
 */
protected EncryptionParameters resolveEncryptionParameters(final SamlRegisteredService service, final BasicEncryptionConfiguration encryptionConfiguration) throws ResolverException {
    val criteria = new CriteriaSet();
    criteria.add(new EncryptionConfigurationCriterion(encryptionConfiguration));
    criteria.add(new EncryptionOptionalCriterion(service.isEncryptionOptional()));
    return new BasicEncryptionParametersResolver().resolveSingle(criteria);
}

Example 42 with CriteriaSet

use of net.shibboleth.utilities.java.support.resolver.CriteriaSet in project cas by apereo.

the class SamlObjectSignatureValidator method validateSignatureOnAuthenticationRequest.

private void validateSignatureOnAuthenticationRequest(final RequestAbstractType profileRequest, final HttpServletRequest request, final MessageContext context, final RoleDescriptorResolver roleDescriptorResolver) throws Exception {
    val peer = context.getSubcontext(SAMLPeerEntityContext.class, true);
    peer.setEntityId(SamlIdPUtils.getIssuerFromSamlObject(profileRequest));
    val peerEntityId = Objects.requireNonNull(peer.getEntityId());
    LOGGER.debug("Validating request signature for [{}]...", peerEntityId);
    val roleDescriptor = roleDescriptorResolver.resolveSingle(new CriteriaSet(new EntityIdCriterion(peerEntityId), new EntityRoleCriterion(SPSSODescriptor.DEFAULT_ELEMENT_NAME)));
    peer.setRole(roleDescriptor.getElementQName());
    val protocol = context.getSubcontext(SAMLProtocolContext.class, true);
    protocol.setProtocol(SAMLConstants.SAML20P_NS);
    LOGGER.debug("Building security parameters context for signature validation of [{}]", peerEntityId);
    val secCtx = context.getSubcontext(SecurityParametersContext.class, true);
    val validationParams = new SignatureValidationParameters();
    if (overrideBlockedSignatureAlgorithms != null && !overrideBlockedSignatureAlgorithms.isEmpty()) {
        validationParams.setExcludedAlgorithms(this.overrideBlockedSignatureAlgorithms);
        LOGGER.debug("Validation override blocked algorithms are [{}]", this.overrideAllowedAlgorithms);
    }
    if (overrideAllowedAlgorithms != null && !overrideAllowedAlgorithms.isEmpty()) {
        validationParams.setIncludedAlgorithms(this.overrideAllowedAlgorithms);
        LOGGER.debug("Validation override allowed algorithms are [{}]", this.overrideAllowedAlgorithms);
    }
    LOGGER.debug("Resolving signing credentials for [{}]", peerEntityId);
    val credentials = getSigningCredential(roleDescriptorResolver, profileRequest);
    if (credentials.isEmpty()) {
        throw new SamlException("Signing credentials for validation could not be resolved");
    }
    var foundValidCredential = false;
    val it = credentials.iterator();
    while (!foundValidCredential && it.hasNext()) {
        val handler = new SAML2HTTPRedirectDeflateSignatureSecurityHandler();
        try {
            val credential = it.next();
            val resolver = new StaticCredentialResolver(credential);
            val keyResolver = new StaticKeyInfoCredentialResolver(credential);
            val trustEngine = new ExplicitKeySignatureTrustEngine(resolver, keyResolver);
            validationParams.setSignatureTrustEngine(trustEngine);
            secCtx.setSignatureValidationParameters(validationParams);
            handler.setHttpServletRequest(request);
            LOGGER.debug("Initializing [{}] to execute signature validation for [{}]", handler.getClass().getSimpleName(), peerEntityId);
            handler.initialize();
            LOGGER.debug("Invoking [{}] to handle signature validation for [{}]", handler.getClass().getSimpleName(), peerEntityId);
            handler.invoke(context);
            LOGGER.debug("Successfully validated request signature for [{}].", profileRequest.getIssuer());
            foundValidCredential = true;
        } catch (final Exception e) {
            LOGGER.debug(e.getMessage(), e);
        } finally {
            handler.destroy();
        }
    }
    if (!foundValidCredential) {
        LOGGER.error("No valid credentials could be found to verify the signature for [{}]", profileRequest.getIssuer());
        throw new SamlException("No valid signing credentials for validation could not be resolved");
    }
}

Example 43 with CriteriaSet

use of net.shibboleth.utilities.java.support.resolver.CriteriaSet in project cas by apereo.

the class SamlObjectSignatureValidator method getSigningCredential.

@SneakyThrows
private Set<Credential> getSigningCredential(final RoleDescriptorResolver resolver, final RequestAbstractType profileRequest) {
    val kekCredentialResolver = new MetadataCredentialResolver();
    val config = getSignatureValidationConfiguration();
    kekCredentialResolver.setRoleDescriptorResolver(resolver);
    kekCredentialResolver.setKeyInfoCredentialResolver(DefaultSecurityConfigurationBootstrap.buildBasicInlineKeyInfoCredentialResolver());
    kekCredentialResolver.initialize();
    val criteriaSet = new CriteriaSet();
    criteriaSet.add(new SignatureValidationConfigurationCriterion(config));
    criteriaSet.add(new UsageCriterion(UsageType.SIGNING));
    buildEntityCriteriaForSigningCredential(profileRequest, criteriaSet);
    return Sets.newLinkedHashSet(kekCredentialResolver.resolve(criteriaSet));
}

Example 44 with CriteriaSet

use of net.shibboleth.utilities.java.support.resolver.CriteriaSet in project cas by apereo.

the class DefaultSamlIdPObjectSigner method buildSignatureSigningParameters.

/**
 * Build signature signing parameters signature signing parameters.
 *
 * @param descriptor the descriptor
 * @param service    the service
 * @return the signature signing parameters
 */
@SneakyThrows
protected SignatureSigningParameters buildSignatureSigningParameters(final RoleDescriptor descriptor, final SamlRegisteredService service) {
    val criteria = new CriteriaSet();
    val signatureSigningConfiguration = getSignatureSigningConfiguration(service);
    criteria.add(new SignatureSigningConfigurationCriterion(signatureSigningConfiguration));
    criteria.add(new RoleDescriptorCriterion(descriptor));
    val resolver = new SAMLMetadataSignatureSigningParametersResolver();
    LOGGER.trace("Resolving signature signing parameters for [{}]", descriptor.getElementQName().getLocalPart());
    val params = resolver.resolveSingle(criteria);
    if (params != null) {
        LOGGER.trace("Created signature signing parameters." + "\nSignature algorithm: [{}]" + "\nSignature canonicalization algorithm: [{}]" + "\nSignature reference digest methods: [{}]" + "\nSignature reference canonicalization algorithm: [{}]", params.getSignatureAlgorithm(), params.getSignatureCanonicalizationAlgorithm(), params.getSignatureReferenceDigestMethod(), params.getSignatureReferenceCanonicalizationAlgorithm());
    } else {
        LOGGER.warn("Unable to resolve SignatureSigningParameters, response signing will fail." + " Make sure domain names in IDP metadata URLs and certificates match CAS domain name");
    }
    return params;
}

Example 45 with CriteriaSet

use of net.shibboleth.utilities.java.support.resolver.CriteriaSet in project cas by apereo.

the class SamlIdPMetadataResolverTests method verifyOperation.

@RepeatedTest(2)
public void verifyOperation() throws Exception {
    val criteria = new CriteriaSet(new EntityIdCriterion(casProperties.getAuthn().getSamlIdp().getCore().getEntityId()));
    val result1 = casSamlIdPMetadataResolver.resolve(criteria);
    assertFalse(Iterables.isEmpty(result1));
    val result2 = casSamlIdPMetadataResolver.resolve(criteria);
    assertFalse(Iterables.isEmpty(result2));
    assertEquals(Iterables.size(result1), Iterables.size(result2));
}