Examples with NameIDType org.keycloak.dom.saml.v2.assertion.NameIDType used on opensource projects

Example 51 with NameIDType

use of org.keycloak.dom.saml.v2.assertion.NameIDType in project keycloak by keycloak.

the class ClientTokenExchangeSAML2Test method testExchangeToSAML2UnsignedAndUnencryptedAssertion.

@Test
@UncaughtServerErrorExpected
public void testExchangeToSAML2UnsignedAndUnencryptedAssertion() throws Exception {
    testingClient.server().run(ClientTokenExchangeSAML2Test::setupRealm);
    oauth.realm(TEST);
    oauth.clientId("client-exchanger");
    OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("secret", "user", "password");
    String accessToken = response.getAccessToken();
    TokenVerifier<AccessToken> accessTokenVerifier = TokenVerifier.create(accessToken, AccessToken.class);
    AccessToken token = accessTokenVerifier.parse().getToken();
    Assert.assertEquals(token.getPreferredUsername(), "user");
    Assert.assertTrue(token.getRealmAccess() == null || !token.getRealmAccess().isUserInRole("example"));
    Map<String, String> params = new HashMap<>();
    params.put(OAuth2Constants.REQUESTED_TOKEN_TYPE, OAuth2Constants.SAML2_TOKEN_TYPE);
    {
        response = oauth.doTokenExchange(TEST, accessToken, SAML_UNSIGNED_AND_UNENCRYPTED_TARGET, "client-exchanger", "secret", params);
        String exchangedTokenString = response.getAccessToken();
        String assertionXML = new String(Base64Url.decode(exchangedTokenString), "UTF-8");
        // Verify issued_token_type
        Assert.assertEquals(OAuth2Constants.SAML2_TOKEN_TYPE, response.getIssuedTokenType());
        // Verify assertion
        Document assertionDoc = DocumentUtil.getDocument(assertionXML);
        Assert.assertFalse(AssertionUtil.isSignedElement(assertionDoc.getDocumentElement()));
        AssertionType assertion = (AssertionType) SAMLParser.getInstance().parse(assertionDoc);
        // Audience
        AudienceRestrictionType aud = (AudienceRestrictionType) assertion.getConditions().getConditions().get(0);
        Assert.assertEquals(SAML_UNSIGNED_AND_UNENCRYPTED_TARGET, aud.getAudience().get(0).toString());
        // NameID
        Assert.assertEquals("user", ((NameIDType) assertion.getSubject().getSubType().getBaseID()).getValue());
        // Role mapping
        List<String> roles = AssertionUtil.getRoles(assertion, null);
        Assert.assertTrue(roles.contains("example"));
    }
}

Example 52 with NameIDType

use of org.keycloak.dom.saml.v2.assertion.NameIDType in project keycloak by keycloak.

the class NameIdMapperTest method testExpectedNameId.

private void testExpectedNameId(String expectedNameId) {
    ResponseType rt = getSamlResponseObject();
    NameIDType nameId = (NameIDType) rt.getAssertions().get(0).getAssertion().getSubject().getSubType().getBaseID();
    assertEquals(expectedNameId, nameId.getValue());
    assertEquals(JBossSAMLURIConstants.STATUS_SUCCESS.get(), rt.getStatus().getStatusCode().getValue().toString());
}

Example 53 with NameIDType

use of org.keycloak.dom.saml.v2.assertion.NameIDType in project keycloak by keycloak.

the class SamlProtocolUtils method buildArtifactResponse.

/**
 * Takes a saml object (an object that will be part of resulting ArtifactResponse), and inserts it as the body of
 * an ArtifactResponse. The ArtifactResponse is returned as ArtifactResponseType
 *
 * @param samlObject a Saml object
 * @param issuer issuer of the resulting ArtifactResponse, should be the same as issuer of the samlObject
 * @param statusCode status code of the resulting response
 * @return An ArtifactResponse containing the saml object.
 */
public static ArtifactResponseType buildArtifactResponse(SAML2Object samlObject, NameIDType issuer, URI statusCode) throws ConfigurationException, ProcessingException {
    ArtifactResponseType artifactResponse = new ArtifactResponseType(IDGenerator.create("ID_"), XMLTimeUtil.getIssueInstant());
    // Status
    StatusType statusType = new StatusType();
    StatusCodeType statusCodeType = new StatusCodeType();
    statusCodeType.setValue(statusCode);
    statusType.setStatusCode(statusCodeType);
    artifactResponse.setStatus(statusType);
    artifactResponse.setIssuer(issuer);
    artifactResponse.setAny(samlObject);
    return artifactResponse;
}

Example 54 with NameIDType

use of org.keycloak.dom.saml.v2.assertion.NameIDType in project keycloak by keycloak.

the class AssertionUtilTest method testSaml20DecryptId.

@Test
public void testSaml20DecryptId() throws Exception {
    try (InputStream st = getEncryptedIdTestFileInputStream()) {
        ResponseType responseType = (ResponseType) SAMLParser.getInstance().parse(st);
        STSubType subType = responseType.getAssertions().get(0).getAssertion().getSubject().getSubType();
        assertNotNull(subType.getEncryptedID());
        assertNull(subType.getBaseID());
        AssertionUtil.decryptId(responseType, extractPrivateKey());
        assertNull(subType.getEncryptedID());
        assertNotNull(subType.getBaseID());
        assertTrue(subType.getBaseID() instanceof NameIDType);
        assertEquals("myTestId", ((NameIDType) subType.getBaseID()).getValue());
    }
}

Example 55 with NameIDType

use of org.keycloak.dom.saml.v2.assertion.NameIDType in project keycloak by keycloak.

the class BaseWriter method write.

private void write(SubjectConfirmationType subjectConfirmationType) throws ProcessingException {
    StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.SUBJECT_CONFIRMATION.get(), ASSERTION_NSURI.get());
    StaxUtil.writeAttribute(writer, JBossSAMLConstants.METHOD.get(), subjectConfirmationType.getMethod());
    BaseIDAbstractType baseID = subjectConfirmationType.getBaseID();
    if (baseID != null) {
        write(baseID);
    }
    NameIDType nameIDType = subjectConfirmationType.getNameID();
    if (nameIDType != null) {
        write(nameIDType, new QName(ASSERTION_NSURI.get(), JBossSAMLConstants.NAMEID.get(), ASSERTION_PREFIX));
    }
    SubjectConfirmationDataType subjectConfirmationData = subjectConfirmationType.getSubjectConfirmationData();
    if (subjectConfirmationData != null) {
        write(subjectConfirmationData);
    }
    StaxUtil.writeEndElement(writer);
}