Examples with AttributeBean org.apache.wss4j.common.saml.bean.AttributeBean used on opensource projects

Example 21 with AttributeBean

use of org.apache.wss4j.common.saml.bean.AttributeBean in project cxf by apache.

the class SAMLClaimsTest method testSAML2MultipleClaims.

@org.junit.Test
public void testSAML2MultipleClaims() throws Exception {
    AttributeBean attributeBean = new AttributeBean();
    attributeBean.setQualifiedName(SAMLClaim.SAML_ROLE_ATTRIBUTENAME_DEFAULT);
    attributeBean.setNameFormat(SAML2Constants.ATTRNAME_FORMAT_UNSPECIFIED);
    attributeBean.addAttributeValue("employee");
    AttributeBean attributeBean2 = new AttributeBean();
    attributeBean2.setQualifiedName("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname");
    attributeBean2.setNameFormat(SAML2Constants.ATTRNAME_FORMAT_UNSPECIFIED);
    attributeBean2.addAttributeValue("smith");
    SamlCallbackHandler samlCallbackHandler = new SamlCallbackHandler();
    List<AttributeBean> attributes = new ArrayList<>();
    attributes.add(attributeBean);
    attributes.add(attributeBean2);
    samlCallbackHandler.setAttributes(attributes);
    // Create the SAML Assertion via the CallbackHandler
    SAMLCallback samlCallback = new SAMLCallback();
    SAMLUtil.doSAMLCallback(samlCallbackHandler, samlCallback);
    SamlAssertionWrapper samlAssertion = new SamlAssertionWrapper(samlCallback);
    Document doc = DOMUtils.newDocument();
    samlAssertion.toDOM(doc);
    ClaimCollection claims = SAMLUtils.getClaims(samlAssertion);
    assertEquals(claims.getDialect().toString(), "http://schemas.xmlsoap.org/ws/2005/05/identity");
    assertEquals(2, claims.size());
    // Check roles
    Set<Principal> roles = SAMLUtils.parseRolesFromClaims(claims, SAMLClaim.SAML_ROLE_ATTRIBUTENAME_DEFAULT, SAML2Constants.ATTRNAME_FORMAT_UNSPECIFIED);
    assertEquals(1, roles.size());
    Principal p = roles.iterator().next();
    assertEquals("employee", p.getName());
}

Example 22 with AttributeBean

use of org.apache.wss4j.common.saml.bean.AttributeBean in project cxf by apache.

the class SAMLClaimsTest method testSAML2MultipleRoles.

@org.junit.Test
public void testSAML2MultipleRoles() throws Exception {
    AttributeBean attributeBean = new AttributeBean();
    attributeBean.setQualifiedName(SAMLClaim.SAML_ROLE_ATTRIBUTENAME_DEFAULT);
    attributeBean.setNameFormat(SAML2Constants.ATTRNAME_FORMAT_UNSPECIFIED);
    attributeBean.addAttributeValue("employee");
    attributeBean.addAttributeValue("boss");
    SamlCallbackHandler samlCallbackHandler = new SamlCallbackHandler();
    samlCallbackHandler.setAttributes(Collections.singletonList(attributeBean));
    // Create the SAML Assertion via the CallbackHandler
    SAMLCallback samlCallback = new SAMLCallback();
    SAMLUtil.doSAMLCallback(samlCallbackHandler, samlCallback);
    SamlAssertionWrapper samlAssertion = new SamlAssertionWrapper(samlCallback);
    Document doc = DOMUtils.newDocument();
    samlAssertion.toDOM(doc);
    ClaimCollection claims = SAMLUtils.getClaims(samlAssertion);
    assertEquals(claims.getDialect().toString(), "http://schemas.xmlsoap.org/ws/2005/05/identity");
    assertEquals(1, claims.size());
    // Check Claim values
    Claim claim = claims.get(0);
    assertEquals(claim.getClaimType(), URI.create(SAMLClaim.SAML_ROLE_ATTRIBUTENAME_DEFAULT));
    assertEquals(2, claim.getValues().size());
    assertTrue(claim.getValues().contains("employee"));
    assertTrue(claim.getValues().contains("boss"));
    // Check SAMLClaim values
    assertTrue(claim instanceof SAMLClaim);
    assertEquals(SAMLClaim.SAML_ROLE_ATTRIBUTENAME_DEFAULT, ((SAMLClaim) claim).getName());
    assertEquals(SAML2Constants.ATTRNAME_FORMAT_UNSPECIFIED, ((SAMLClaim) claim).getNameFormat());
    // Check roles
    Set<Principal> roles = SAMLUtils.parseRolesFromClaims(claims, SAMLClaim.SAML_ROLE_ATTRIBUTENAME_DEFAULT, SAML2Constants.ATTRNAME_FORMAT_UNSPECIFIED);
    assertEquals(2, roles.size());
}

Example 23 with AttributeBean

use of org.apache.wss4j.common.saml.bean.AttributeBean in project cxf by apache.

the class AbstractSAMLCallbackHandler method createAndSetStatement.

/**
 * Note that the SubjectBean parameter should be null for SAML2.0
 */
protected void createAndSetStatement(SubjectBean subjectBean, SAMLCallback callback) {
    if (statement == Statement.AUTHN) {
        AuthenticationStatementBean authBean = new AuthenticationStatementBean();
        if (subjectBean != null) {
            authBean.setSubject(subjectBean);
        }
        if (subjectLocalityIpAddress != null || subjectLocalityDnsAddress != null) {
            SubjectLocalityBean subjectLocality = new SubjectLocalityBean();
            subjectLocality.setIpAddress(subjectLocalityIpAddress);
            subjectLocality.setDnsAddress(subjectLocalityDnsAddress);
            authBean.setSubjectLocality(subjectLocality);
        }
        authBean.setAuthenticationInstant(authnInstant);
        authBean.setSessionNotOnOrAfter(sessionNotOnOrAfter);
        authBean.setAuthenticationMethod("Password");
        callback.setAuthenticationStatementData(Collections.singletonList(authBean));
    } else if (statement == Statement.ATTR) {
        AttributeStatementBean attrBean = new AttributeStatementBean();
        AttributeBean attributeBean = new AttributeBean();
        if (subjectBean != null) {
            attrBean.setSubject(subjectBean);
            attributeBean.setSimpleName("role");
            attributeBean.setQualifiedName("http://custom-ns");
        } else {
            attributeBean.setQualifiedName("role");
        }
        if (customAttributeValues != null) {
            attributeBean.setAttributeValues(customAttributeValues);
        } else {
            attributeBean.addAttributeValue("user");
        }
        attrBean.setSamlAttributes(Collections.singletonList(attributeBean));
        callback.setAttributeStatementData(Collections.singletonList(attrBean));
    } else {
        AuthDecisionStatementBean authzBean = new AuthDecisionStatementBean();
        if (subjectBean != null) {
            authzBean.setSubject(subjectBean);
        }
        ActionBean actionBean = new ActionBean();
        actionBean.setContents("Read");
        authzBean.setActions(Collections.singletonList(actionBean));
        authzBean.setResource("endpoint");
        authzBean.setDecision(AuthDecisionStatementBean.Decision.PERMIT);
        authzBean.setResource(resource);
        callback.setAuthDecisionStatementData(Collections.singletonList(authzBean));
    }
}

Example 24 with AttributeBean

use of org.apache.wss4j.common.saml.bean.AttributeBean in project cxf by apache.

the class SamlCallbackHandler method handle.

public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
    Message m = PhaseInterceptorChain.getCurrentMessage();
    for (int i = 0; i < callbacks.length; i++) {
        if (callbacks[i] instanceof SAMLCallback) {
            SAMLCallback callback = (SAMLCallback) callbacks[i];
            if (saml2) {
                callback.setSamlVersion(Version.SAML_20);
            } else {
                callback.setSamlVersion(Version.SAML_11);
            }
            callback.setIssuer("https://idp.example.org/SAML2");
            String subjectName = null;
            if (m != null) {
                subjectName = (String) m.getContextualProperty("saml.subject.name");
            }
            if (subjectName == null) {
                subjectName = "uid=sts-client,o=mock-sts.com";
            }
            String subjectQualifier = "www.mock-sts.com";
            if (!saml2 && SAML2Constants.CONF_SENDER_VOUCHES.equals(confirmationMethod)) {
                confirmationMethod = SAML1Constants.CONF_SENDER_VOUCHES;
            }
            SubjectBean subjectBean = new SubjectBean(subjectName, subjectQualifier, confirmationMethod);
            if (SAML2Constants.CONF_HOLDER_KEY.equals(confirmationMethod)) {
                try {
                    CryptoLoader loader = new CryptoLoader();
                    Crypto crypto = loader.getCrypto(m, SecurityConstants.SIGNATURE_CRYPTO, SecurityConstants.SIGNATURE_PROPERTIES);
                    X509Certificate cert = RSSecurityUtils.getCertificates(crypto, RSSecurityUtils.getUserName(m, crypto, SecurityConstants.SIGNATURE_USERNAME))[0];
                    KeyInfoBean keyInfo = new KeyInfoBean();
                    keyInfo.setCertificate(cert);
                    subjectBean.setKeyInfo(keyInfo);
                } catch (Exception ex) {
                    throw new RuntimeException(ex);
                }
            }
            callback.setSubject(subjectBean);
            ConditionsBean conditions = new ConditionsBean();
            AudienceRestrictionBean audienceRestriction = new AudienceRestrictionBean();
            audienceRestriction.setAudienceURIs(Collections.singletonList("https://sp.example.com/SAML2"));
            conditions.setAudienceRestrictions(Collections.singletonList(audienceRestriction));
            callback.setConditions(conditions);
            AuthDecisionStatementBean authDecBean = new AuthDecisionStatementBean();
            authDecBean.setDecision(Decision.INDETERMINATE);
            authDecBean.setResource("https://sp.example.com/SAML2");
            ActionBean actionBean = new ActionBean();
            actionBean.setContents("Read");
            authDecBean.setActions(Collections.singletonList(actionBean));
            callback.setAuthDecisionStatementData(Collections.singletonList(authDecBean));
            AuthenticationStatementBean authBean = new AuthenticationStatementBean();
            authBean.setSubject(subjectBean);
            authBean.setAuthenticationInstant(new DateTime());
            authBean.setSessionIndex("123456");
            // AuthnContextClassRef is not set
            authBean.setAuthenticationMethod("urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport");
            callback.setAuthenticationStatementData(Collections.singletonList(authBean));
            AttributeStatementBean attrBean = new AttributeStatementBean();
            attrBean.setSubject(subjectBean);
            List<String> roles = null;
            if (m != null) {
                roles = CastUtils.cast((List<?>) m.getContextualProperty("saml.roles"));
            }
            if (roles == null) {
                roles = Collections.singletonList("user");
            }
            List<AttributeBean> claims = new ArrayList<>();
            AttributeBean roleClaim = new AttributeBean();
            roleClaim.setSimpleName("subject-role");
            roleClaim.setQualifiedName(SAMLClaim.SAML_ROLE_ATTRIBUTENAME_DEFAULT);
            roleClaim.setNameFormat(SAML2Constants.ATTRNAME_FORMAT_UNSPECIFIED);
            roleClaim.setAttributeValues(new ArrayList<>(roles));
            claims.add(roleClaim);
            List<String> authMethods = null;
            if (m != null) {
                authMethods = CastUtils.cast((List<?>) m.getContextualProperty("saml.auth"));
            }
            if (authMethods == null) {
                authMethods = Collections.singletonList("password");
            }
            AttributeBean authClaim = new AttributeBean();
            authClaim.setSimpleName("http://claims/authentication");
            authClaim.setQualifiedName("http://claims/authentication");
            authClaim.setNameFormat("http://claims/authentication-format");
            authClaim.setAttributeValues(new ArrayList<>(authMethods));
            claims.add(authClaim);
            attrBean.setSamlAttributes(claims);
            callback.setAttributeStatementData(Collections.singletonList(attrBean));
            callback.setSignatureAlgorithm(signatureAlgorithm);
            callback.setSignatureDigestAlgorithm(digestAlgorithm);
            callback.setSignAssertion(signAssertion);
        }
    }
}