Examples with SamlIdPProperties org.apereo.cas.configuration.model.support.saml.idp.SamlIdPProperties used on opensource projects

Example 11 with SamlIdPProperties

use of org.apereo.cas.configuration.model.support.saml.idp.SamlIdPProperties in project cas by apereo.

the class TemplatedMetadataAndCertificatesGenerationService method buildMetadataGeneratorParameters.

/**
     * Build metadata generator parameters by passing the encryption,
     * signing and back-channel certs to the parameter generator.
     *
     * @throws Exception Thrown if cert files are missing, or metadata file inaccessible.
     */
protected void buildMetadataGeneratorParameters() throws Exception {
    final SamlIdPProperties idp = casProperties.getAuthn().getSamlIdp();
    final Resource template = this.resourceLoader.getResource("classpath:/template-idp-metadata.xml");
    String signingKey = FileUtils.readFileToString(idp.getMetadata().getSigningCertFile().getFile(), StandardCharsets.UTF_8);
    signingKey = StringUtils.remove(signingKey, BEGIN_CERTIFICATE);
    signingKey = StringUtils.remove(signingKey, END_CERTIFICATE).trim();
    String encryptionKey = FileUtils.readFileToString(idp.getMetadata().getEncryptionCertFile().getFile(), StandardCharsets.UTF_8);
    encryptionKey = StringUtils.remove(encryptionKey, BEGIN_CERTIFICATE);
    encryptionKey = StringUtils.remove(encryptionKey, END_CERTIFICATE).trim();
    try (StringWriter writer = new StringWriter()) {
        IOUtils.copy(template.getInputStream(), writer, StandardCharsets.UTF_8);
        final String metadata = writer.toString().replace("${entityId}", idp.getEntityId()).replace("${scope}", idp.getScope()).replace("${idpEndpointUrl}", getIdPEndpointUrl()).replace("${encryptionKey}", encryptionKey).replace("${signingKey}", signingKey);
        FileUtils.write(idp.getMetadata().getMetadataFile(), metadata, StandardCharsets.UTF_8);
    }
}

Example 12 with SamlIdPProperties

use of org.apereo.cas.configuration.model.support.saml.idp.SamlIdPProperties in project cas by apereo.

the class SamlIdPObjectSigner method getSignatureSigningConfiguration.

/**
 * Gets signature signing configuration.
 *
 * @param roleDescriptor the role descriptor
 * @param service        the service
 * @return the signature signing configuration
 * @throws Exception the exception
 */
protected SignatureSigningConfiguration getSignatureSigningConfiguration(final RoleDescriptor roleDescriptor, final SamlRegisteredService service) throws Exception {
    final BasicSignatureSigningConfiguration config = DefaultSecurityConfigurationBootstrap.buildDefaultSignatureSigningConfiguration();
    final SamlIdPProperties samlIdp = casProperties.getAuthn().getSamlIdp();
    if (this.overrideBlackListedSignatureAlgorithms != null && !samlIdp.getAlgs().getOverrideBlackListedSignatureSigningAlgorithms().isEmpty()) {
        config.setBlacklistedAlgorithms(this.overrideBlackListedSignatureAlgorithms);
    }
    if (this.overrideSignatureAlgorithms != null && !this.overrideSignatureAlgorithms.isEmpty()) {
        config.setSignatureAlgorithms(this.overrideSignatureAlgorithms);
    }
    if (this.overrideSignatureReferenceDigestMethods != null && !this.overrideSignatureReferenceDigestMethods.isEmpty()) {
        config.setSignatureReferenceDigestMethods(this.overrideSignatureReferenceDigestMethods);
    }
    if (this.overrideWhiteListedAlgorithms != null && !this.overrideWhiteListedAlgorithms.isEmpty()) {
        config.setWhitelistedAlgorithms(this.overrideWhiteListedAlgorithms);
    }
    if (StringUtils.isNotBlank(samlIdp.getAlgs().getOverrideSignatureCanonicalizationAlgorithm())) {
        config.setSignatureCanonicalizationAlgorithm(samlIdp.getAlgs().getOverrideSignatureCanonicalizationAlgorithm());
    }
    LOGGER.debug("Signature signing blacklisted algorithms: [{}]", config.getBlacklistedAlgorithms());
    LOGGER.debug("Signature signing signature algorithms: [{}]", config.getSignatureAlgorithms());
    LOGGER.debug("Signature signing signature canonicalization algorithm: [{}]", config.getSignatureCanonicalizationAlgorithm());
    LOGGER.debug("Signature signing whitelisted algorithms: [{}]", config.getWhitelistedAlgorithms());
    LOGGER.debug("Signature signing reference digest methods: [{}]", config.getSignatureReferenceDigestMethods());
    final PrivateKey privateKey = getSigningPrivateKey();
    final SamlIdPProperties idp = casProperties.getAuthn().getSamlIdp();
    final MetadataCredentialResolver kekCredentialResolver = new MetadataCredentialResolver();
    kekCredentialResolver.setRoleDescriptorResolver(SamlIdPUtils.getRoleDescriptorResolver(casSamlIdPMetadataResolver, idp.getMetadata().isRequireValidMetadata()));
    kekCredentialResolver.setKeyInfoCredentialResolver(DefaultSecurityConfigurationBootstrap.buildBasicInlineKeyInfoCredentialResolver());
    kekCredentialResolver.initialize();
    final CriteriaSet criteriaSet = new CriteriaSet();
    criteriaSet.add(new SignatureSigningConfigurationCriterion(config));
    criteriaSet.add(new UsageCriterion(UsageType.SIGNING));
    criteriaSet.add(new EntityIdCriterion(casProperties.getAuthn().getSamlIdp().getEntityId()));
    criteriaSet.add(new EntityRoleCriterion(IDPSSODescriptor.DEFAULT_ELEMENT_NAME));
    final Set<Credential> credentials = Sets.newLinkedHashSet(kekCredentialResolver.resolve(criteriaSet));
    final List<Credential> creds = new ArrayList<>();
    credentials.forEach(c -> {
        final AbstractCredential cred = getResolvedSigningCredential(c, privateKey, service);
        if (cred != null) {
            creds.add(cred);
        }
    });
    config.setSigningCredentials(creds);
    LOGGER.debug("Signature signing credentials configured with [{}] credentials", creds.size());
    return config;
}

Example 13 with SamlIdPProperties

use of org.apereo.cas.configuration.model.support.saml.idp.SamlIdPProperties in project cas by apereo.

the class SamlIdPObjectSigner method getSigningPrivateKey.

/**
 * Gets signing private key.
 *
 * @return the signing private key
 * @throws Exception the exception
 */
protected PrivateKey getSigningPrivateKey() throws Exception {
    final SamlIdPProperties samlIdp = casProperties.getAuthn().getSamlIdp();
    final Resource signingKey = samlIdPMetadataLocator.getSigningKey();
    final PrivateKeyFactoryBean privateKeyFactoryBean = new PrivateKeyFactoryBean();
    privateKeyFactoryBean.setLocation(new FileSystemResource(signingKey.getFile()));
    privateKeyFactoryBean.setAlgorithm(samlIdp.getMetadata().getPrivateKeyAlgName());
    privateKeyFactoryBean.setSingleton(false);
    LOGGER.debug("Locating signature signing key file from [{}]", signingKey);
    return privateKeyFactoryBean.getObject();
}

Example 14 with SamlIdPProperties

use of org.apereo.cas.configuration.model.support.saml.idp.SamlIdPProperties in project cas by apereo.

the class SamlObjectSignatureValidator method getSignatureValidationConfiguration.

/**
 * Gets signature validation configuration.
 *
 * @return the signature validation configuration
 */
protected SignatureValidationConfiguration getSignatureValidationConfiguration() {
    final BasicSignatureValidationConfiguration config = DefaultSecurityConfigurationBootstrap.buildDefaultSignatureValidationConfiguration();
    final SamlIdPProperties samlIdp = casProperties.getAuthn().getSamlIdp();
    if (this.overrideBlackListedSignatureAlgorithms != null && !samlIdp.getAlgs().getOverrideBlackListedSignatureSigningAlgorithms().isEmpty()) {
        config.setBlacklistedAlgorithms(this.overrideBlackListedSignatureAlgorithms);
        config.setWhitelistMerge(true);
    }
    if (this.overrideWhiteListedAlgorithms != null && !this.overrideWhiteListedAlgorithms.isEmpty()) {
        config.setWhitelistedAlgorithms(this.overrideWhiteListedAlgorithms);
        config.setBlacklistMerge(true);
    }
    LOGGER.debug("Signature validation blacklisted algorithms: [{}]", config.getBlacklistedAlgorithms());
    LOGGER.debug("Signature validation whitelisted algorithms: [{}]", config.getWhitelistedAlgorithms());
    return config;
}

Example 15 with SamlIdPProperties

use of org.apereo.cas.configuration.model.support.saml.idp.SamlIdPProperties in project cas by apereo.

the class SamlIdPMetadataConfiguration method casSamlIdPMetadataResolver.

@Lazy
@Bean(initMethod = "initialize", destroyMethod = "destroy")
@DependsOn("samlIdPMetadataGenerator")
@SneakyThrows
@Autowired
public MetadataResolver casSamlIdPMetadataResolver(@Qualifier("samlMetadataLocator") final SamlIdPMetadataLocator samlMetadataLocator) {
    final SamlIdPProperties idp = casProperties.getAuthn().getSamlIdp();
    final ResourceBackedMetadataResolver resolver = new ResourceBackedMetadataResolver(ResourceHelper.of(samlMetadataLocator.getMetadata()));
    resolver.setParserPool(this.openSamlConfigBean.getParserPool());
    resolver.setFailFastInitialization(idp.getMetadata().isFailFast());
    resolver.setRequireValidMetadata(idp.getMetadata().isRequireValidMetadata());
    resolver.setId(idp.getEntityId());
    return resolver;
}