Examples with ASTChoiceType org.keycloak.dom.saml.v2.assertion.AttributeStatementType.ASTChoiceType used on opensource projects

Example 6 with ASTChoiceType

use of org.keycloak.dom.saml.v2.assertion.AttributeStatementType.ASTChoiceType in project keycloak by keycloak.

the class AssertionUtil method getRoles.

/**
 * Given an assertion, return the list of roles it may have
 *
 * @param assertion The {@link AssertionType}
 * @param roleKeys a list of string values representing the role keys. The list can be null.
 *
 * @return
 */
public static List<String> getRoles(AssertionType assertion, List<String> roleKeys) {
    List<String> roles = new ArrayList<>();
    Set<StatementAbstractType> statements = assertion.getStatements();
    for (StatementAbstractType statement : statements) {
        if (statement instanceof AttributeStatementType) {
            AttributeStatementType attributeStatement = (AttributeStatementType) statement;
            List<ASTChoiceType> attList = attributeStatement.getAttributes();
            for (ASTChoiceType obj : attList) {
                AttributeType attr = obj.getAttribute();
                if (roleKeys != null && roleKeys.size() > 0) {
                    if (!roleKeys.contains(attr.getName()))
                        continue;
                }
                List<Object> attributeValues = attr.getAttributeValue();
                if (attributeValues != null) {
                    for (Object attrValue : attributeValues) {
                        if (attrValue instanceof String) {
                            roles.add((String) attrValue);
                        } else if (attrValue instanceof Node) {
                            Node roleNode = (Node) attrValue;
                            roles.add(roleNode.getFirstChild().getNodeValue());
                        } else
                            throw logger.unknownObjectType(attrValue);
                    }
                }
            }
        }
    }
    return roles;
}

Example 7 with ASTChoiceType

use of org.keycloak.dom.saml.v2.assertion.AttributeStatementType.ASTChoiceType in project keycloak by keycloak.

the class StatementUtil method createAttributeStatement.

/**
 * Create an attribute statement with all the attributes
 *
 * @param attributes a map with keys from {@link AttributeConstants}
 *
 * @return
 */
public static AttributeStatementType createAttributeStatement(Map<String, Object> attributes) {
    AttributeStatementType attrStatement = null;
    int i = 0;
    Set<String> keys = attributes.keySet();
    for (String key : keys) {
        if (i == 0) {
            // Deal with the X500 Profile of SAML2
            attrStatement = new AttributeStatementType();
            i++;
        }
        // if the attribute contains roles, add each role as an attribute.
        if (AttributeConstants.ROLES.equalsIgnoreCase(key)) {
            Object value = attributes.get(key);
            if (value instanceof Collection<?>) {
                Collection<?> roles = (Collection<?>) value;
                attrStatement = createAttributeStatement(new ArrayList(roles));
            }
        } else {
            AttributeType att;
            Object value = attributes.get(key);
            String uri = X500SAMLProfileConstants.getOID(key);
            if (StringUtil.isNotNull(uri)) {
                att = getX500Attribute(uri);
                att.setFriendlyName(key);
            } else {
                att = new AttributeType(key);
                att.setFriendlyName(key);
                att.setNameFormat(JBossSAMLURIConstants.ATTRIBUTE_FORMAT_URI.get());
            }
            if (Collection.class.isInstance(value)) {
                Collection collection = (Collection) value;
                Iterator iterator = collection.iterator();
                while (iterator.hasNext()) {
                    att.addAttributeValue(iterator.next());
                }
            } else if (String.class.isInstance(value)) {
                att.addAttributeValue(value);
            } else {
                throw new RuntimeException("Unsupported attribute value [" + value + "]. Values must be a string, even if using a Collection.");
            }
            attrStatement.addAttribute(new ASTChoiceType(att));
        }
    }
    return attrStatement;
}

Example 8 with ASTChoiceType

use of org.keycloak.dom.saml.v2.assertion.AttributeStatementType.ASTChoiceType in project keycloak by keycloak.

the class StatementUtil method asMap.

public static Map<String, Object> asMap(Set<AttributeStatementType> attributeStatementTypes) {
    Map<String, Object> attrMap = new HashMap<>();
    if (attributeStatementTypes != null && !attributeStatementTypes.isEmpty()) {
        attrMap = new HashMap<>();
        for (StatementAbstractType statement : attributeStatementTypes) {
            if (statement instanceof AttributeStatementType) {
                AttributeStatementType attrStat = (AttributeStatementType) statement;
                List<ASTChoiceType> attrs = attrStat.getAttributes();
                for (ASTChoiceType attrChoice : attrs) {
                    AttributeType attr = attrChoice.getAttribute();
                    String attributeName = attr.getFriendlyName();
                    if (attributeName == null) {
                        attributeName = attr.getName();
                    }
                    List<Object> values = attr.getAttributeValue();
                    if (values != null) {
                        if (values.size() == 1) {
                            attrMap.put(attributeName, values.get(0));
                        } else {
                            attrMap.put(attributeName, values);
                        }
                    }
                }
            }
        }
    }
    return attrMap;
}

Example 9 with ASTChoiceType

use of org.keycloak.dom.saml.v2.assertion.AttributeStatementType.ASTChoiceType in project keycloak by keycloak.

the class SAMLParserTest method testEmptyAttributeValue.

@Test
public void testEmptyAttributeValue() throws Exception {
    ResponseType resp = assertParsed("KEYCLOAK-4790-Empty-attribute-value.xml", ResponseType.class);
    assertThat(resp.getAssertions(), hasSize(1));
    final AssertionType a = resp.getAssertions().get(0).getAssertion();
    assertThat(a, notNullValue());
    assertThat(a.getAttributeStatements(), hasSize(1));
    final List<ASTChoiceType> attributes = a.getAttributeStatements().iterator().next().getAttributes();
    assertThat(attributes, hasSize(3));
    assertThat(attributes, everyItem(notNullValue(ASTChoiceType.class)));
    final AttributeType attr0 = attributes.get(0).getAttribute();
    final AttributeType attr1 = attributes.get(1).getAttribute();
    final AttributeType attr2 = attributes.get(2).getAttribute();
    assertThat(attr0.getName(), is("urn:oid:0.9.2342.19200300.100.1.2"));
    assertThat(attr0.getAttributeValue(), hasSize(1));
    assertThat(attr0.getAttributeValue().get(0), instanceOf(String.class));
    assertThat((String) attr0.getAttributeValue().get(0), is(""));
    assertThat(attr1.getName(), is("urn:oid:0.9.2342.19200300.100.1.3"));
    assertThat(attr1.getAttributeValue(), hasSize(1));
    assertThat(attr1.getAttributeValue().get(0), instanceOf(String.class));
    assertThat((String) attr1.getAttributeValue().get(0), is("aa"));
    assertThat(attr2.getName(), is("urn:oid:0.9.2342.19200300.100.1.4"));
    assertThat(attr2.getAttributeValue(), hasSize(1));
    assertThat(attr2.getAttributeValue().get(0), instanceOf(String.class));
    assertThat((String) attr2.getAttributeValue().get(0), is(""));
}

Example 10 with ASTChoiceType

use of org.keycloak.dom.saml.v2.assertion.AttributeStatementType.ASTChoiceType in project keycloak by keycloak.

the class BrokerTest method testNoNameIDAndPrincipalFromAttribute.

@Test
public void testNoNameIDAndPrincipalFromAttribute() throws IOException {
    final String userName = "newUser-" + UUID.randomUUID();
    final RealmResource realm = adminClient.realm(REALM_NAME);
    final IdentityProviderRepresentation rep = addIdentityProvider("https://saml.idp/");
    rep.getConfig().put(SAMLIdentityProviderConfig.NAME_ID_POLICY_FORMAT, "undefined");
    rep.getConfig().put(SAMLIdentityProviderConfig.PRINCIPAL_TYPE, SamlPrincipalType.ATTRIBUTE.toString());
    rep.getConfig().put(SAMLIdentityProviderConfig.PRINCIPAL_ATTRIBUTE, "user");
    try (IdentityProviderCreator idp = new IdentityProviderCreator(realm, rep)) {
        new SamlClientBuilder().authnRequest(getAuthServerSamlEndpoint(REALM_NAME), SAML_CLIENT_ID_SALES_POST, SAML_ASSERTION_CONSUMER_URL_SALES_POST, POST).build().login().idp(SAML_BROKER_ALIAS).build().processSamlResponse(REDIRECT).transformObject(this::createAuthnResponse).transformObject(resp -> {
            final ResponseType rt = (ResponseType) resp;
            final AssertionType assertion = rt.getAssertions().get(0).getAssertion();
            // Remove NameID from subject
            assertion.getSubject().setSubType(null);
            // Add attribute to get principal from
            AttributeStatementType attrStatement = new AttributeStatementType();
            AttributeType attribute = new AttributeType("user");
            attribute.addAttributeValue(userName);
            attrStatement.addAttribute(new ASTChoiceType(attribute));
            rt.getAssertions().get(0).getAssertion().addStatement(attrStatement);
            return rt;
        }).targetAttributeSamlResponse().targetUri(getSamlBrokerUrl(REALM_NAME)).build().followOneRedirect().updateProfile().username(userName).firstName("someFirstName").lastName("someLastName").email("some@email.com").build().followOneRedirect().assertResponse(org.keycloak.testsuite.util.Matchers.statusCodeIsHC(200)).execute();
    }
    final UserRepresentation userRepresentation = realm.users().search(userName).stream().findFirst().get();
    final List<UserSessionRepresentation> userSessions = realm.users().get(userRepresentation.getId()).getUserSessions();
    assertThat(userSessions, hasSize(1));
}