Examples with SAML2IdP org.apache.syncope.core.persistence.api.entity.SAML2IdP used on opensource projects

Example 1 with SAML2IdP

use of org.apache.syncope.core.persistence.api.entity.SAML2IdP in project syncope by apache.

the class SAML2SPLogic method getIdP.

private SAML2IdPEntity getIdP(final String entityID) {
    SAML2IdPEntity idp = null;
    SAML2IdP saml2IdP = saml2IdPDAO.findByEntityID(entityID);
    if (saml2IdP != null) {
        try {
            idp = cache.put(saml2IdP);
        } catch (Exception e) {
            LOG.error("Could not build SAML 2.0 IdP with key ", entityID, e);
            SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.Unknown);
            sce.getElements().add(e.getMessage());
            throw sce;
        }
    }
    if (idp == null) {
        throw new NotFoundException("SAML 2.0 IdP '" + entityID + "'");
    }
    return idp;
}

Example 2 with SAML2IdP

use of org.apache.syncope.core.persistence.api.entity.SAML2IdP in project syncope by apache.

the class SAML2SPLogic method createLoginRequest.

@PreAuthorize("hasRole('" + StandardEntitlement.ANONYMOUS + "')")
public SAML2RequestTO createLoginRequest(final String spEntityID, final String idpEntityID) {
    check();
    // 1. look for IdP
    SAML2IdPEntity idp = StringUtils.isBlank(idpEntityID) ? cache.getFirst() : cache.get(idpEntityID);
    if (idp == null) {
        if (StringUtils.isBlank(idpEntityID)) {
            List<SAML2IdP> all = saml2IdPDAO.findAll();
            if (!all.isEmpty()) {
                idp = getIdP(all.get(0).getKey());
            }
        } else {
            idp = getIdP(idpEntityID);
        }
    }
    if (idp == null) {
        throw new NotFoundException(StringUtils.isBlank(idpEntityID) ? "Any SAML 2.0 IdP" : "SAML 2.0 IdP '" + idpEntityID + "'");
    }
    if (idp.getSSOLocation(idp.getBindingType()) == null) {
        throw new IllegalArgumentException("No SingleSignOnService available for " + idp.getId());
    }
    // 2. create AuthnRequest
    Issuer issuer = new IssuerBuilder().buildObject();
    issuer.setValue(spEntityID);
    NameIDPolicy nameIDPolicy = new NameIDPolicyBuilder().buildObject();
    if (idp.supportsNameIDFormat(NameIDType.TRANSIENT)) {
        nameIDPolicy.setFormat(NameIDType.TRANSIENT);
    } else if (idp.supportsNameIDFormat(NameIDType.PERSISTENT)) {
        nameIDPolicy.setFormat(NameIDType.PERSISTENT);
    } else {
        throw new IllegalArgumentException("Could not find supported NameIDFormat for IdP " + idpEntityID);
    }
    nameIDPolicy.setAllowCreate(true);
    nameIDPolicy.setSPNameQualifier(spEntityID);
    AuthnContextClassRef authnContextClassRef = new AuthnContextClassRefBuilder().buildObject();
    authnContextClassRef.setAuthnContextClassRef(AuthnContext.PPT_AUTHN_CTX);
    RequestedAuthnContext requestedAuthnContext = new RequestedAuthnContextBuilder().buildObject();
    requestedAuthnContext.setComparison(AuthnContextComparisonTypeEnumeration.EXACT);
    requestedAuthnContext.getAuthnContextClassRefs().add(authnContextClassRef);
    AuthnRequest authnRequest = new AuthnRequestBuilder().buildObject();
    authnRequest.setID("_" + UUID_GENERATOR.generate().toString());
    authnRequest.setForceAuthn(false);
    authnRequest.setIsPassive(false);
    authnRequest.setVersion(SAMLVersion.VERSION_20);
    authnRequest.setProtocolBinding(idp.getBindingType().getUri());
    authnRequest.setIssueInstant(new DateTime());
    authnRequest.setIssuer(issuer);
    authnRequest.setNameIDPolicy(nameIDPolicy);
    authnRequest.setRequestedAuthnContext(requestedAuthnContext);
    authnRequest.setDestination(idp.getSSOLocation(idp.getBindingType()).getLocation());
    SAML2RequestTO requestTO = new SAML2RequestTO();
    requestTO.setIdpServiceAddress(authnRequest.getDestination());
    requestTO.setBindingType(idp.getBindingType());
    try {
        // 3. generate relay state as JWT
        Map<String, Object> claims = new HashMap<>();
        claims.put(JWT_CLAIM_IDP_DEFLATE, idp.isUseDeflateEncoding());
        Triple<String, String, Date> relayState = accessTokenDataBinder.generateJWT(authnRequest.getID(), JWT_RELAY_STATE_DURATION, claims);
        // 4. sign and encode AuthnRequest
        switch(idp.getBindingType()) {
            case REDIRECT:
                requestTO.setRelayState(URLEncoder.encode(relayState.getMiddle(), StandardCharsets.UTF_8.name()));
                requestTO.setContent(URLEncoder.encode(saml2rw.encode(authnRequest, true), StandardCharsets.UTF_8.name()));
                requestTO.setSignAlg(URLEncoder.encode(saml2rw.getSigAlgo(), StandardCharsets.UTF_8.name()));
                requestTO.setSignature(URLEncoder.encode(saml2rw.sign(requestTO.getContent(), requestTO.getRelayState()), StandardCharsets.UTF_8.name()));
                break;
            case POST:
            default:
                requestTO.setRelayState(relayState.getMiddle());
                saml2rw.sign(authnRequest);
                requestTO.setContent(saml2rw.encode(authnRequest, idp.isUseDeflateEncoding()));
        }
    } catch (Exception e) {
        LOG.error("While generating AuthnRequest", e);
        SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.Unknown);
        sce.getElements().add(e.getMessage());
        throw sce;
    }
    return requestTO;
}

Example 3 with SAML2IdP

use of org.apache.syncope.core.persistence.api.entity.SAML2IdP in project syncope by apache.

the class SAML2IdPLogic method read.

@PreAuthorize("hasRole('" + SAML2SPEntitlement.IDP_READ + "')")
@Transactional(readOnly = true)
public SAML2IdPTO read(final String key) {
    check();
    SAML2IdP idp = idpDAO.find(key);
    if (idp == null) {
        throw new NotFoundException("SAML 2.0 IdP '" + key + "'");
    }
    return complete(idp, binder.getIdPTO(idp));
}

Example 4 with SAML2IdP

use of org.apache.syncope.core.persistence.api.entity.SAML2IdP in project syncope by apache.

the class SAML2IdPLogic method delete.

@PreAuthorize("hasRole('" + SAML2SPEntitlement.IDP_DELETE + "')")
public void delete(final String key) {
    check();
    SAML2IdP idp = idpDAO.find(key);
    if (idp == null) {
        throw new NotFoundException("SAML 2.0 IdP '" + key + "'");
    }
    idpDAO.delete(key);
    cache.remove(idp.getEntityID());
}

Example 5 with SAML2IdP

use of org.apache.syncope.core.persistence.api.entity.SAML2IdP in project syncope by apache.

the class SAML2IdPLogic method importFromMetadata.

@PreAuthorize("hasRole('" + SAML2SPEntitlement.IDP_IMPORT + "')")
public List<String> importFromMetadata(final InputStream input) {
    check();
    List<String> imported = new ArrayList<>();
    try {
        for (SAML2IdPTO idpTO : importIdPs(input)) {
            SAML2IdP idp = idpDAO.save(binder.create(idpTO));
            imported.add(idp.getKey());
        }
    } catch (SyncopeClientException e) {
        throw e;
    } catch (Exception e) {
        LOG.error("Unexpected error while importing IdP metadata", e);
        SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidEntity);
        sce.getElements().add(e.getMessage());
        throw sce;
    }
    return imported;
}