Examples with SubjectConfirmationDataType org.keycloak.dom.saml.v2.assertion.SubjectConfirmationDataType used on opensource projects

Example 1 with SubjectConfirmationDataType

use of org.keycloak.dom.saml.v2.assertion.SubjectConfirmationDataType in project keycloak by keycloak.

the class SAMLSubjectConfirmationDataParser method instantiateElement.

@Override
protected SubjectConfirmationDataType instantiateElement(XMLEventReader xmlEventReader, StartElement element) throws ParsingException {
    final SubjectConfirmationDataType subjectConfirmationData = new SubjectConfirmationDataType();
    subjectConfirmationData.setInResponseTo(StaxParserUtil.getAttributeValue(element, SAMLAssertionQNames.ATTR_IN_RESPONSE_TO));
    subjectConfirmationData.setNotBefore(StaxParserUtil.getXmlTimeAttributeValue(element, SAMLAssertionQNames.ATTR_NOT_BEFORE));
    subjectConfirmationData.setNotOnOrAfter(StaxParserUtil.getXmlTimeAttributeValue(element, SAMLAssertionQNames.ATTR_NOT_ON_OR_AFTER));
    subjectConfirmationData.setRecipient(StaxParserUtil.getAttributeValue(element, SAMLAssertionQNames.ATTR_RECIPIENT));
    subjectConfirmationData.setAddress(StaxParserUtil.getAttributeValue(element, SAMLAssertionQNames.ATTR_ADDRESS));
    return subjectConfirmationData;
}

Example 2 with SubjectConfirmationDataType

use of org.keycloak.dom.saml.v2.assertion.SubjectConfirmationDataType in project keycloak by keycloak.

the class BaseWriter method write.

private void write(SubjectConfirmationDataType subjectConfirmationData) throws ProcessingException {
    StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.SUBJECT_CONFIRMATION_DATA.get(), ASSERTION_NSURI.get());
    // Let us look at attributes
    String inResponseTo = subjectConfirmationData.getInResponseTo();
    if (StringUtil.isNotNull(inResponseTo)) {
        StaxUtil.writeAttribute(writer, JBossSAMLConstants.IN_RESPONSE_TO.get(), inResponseTo);
    }
    XMLGregorianCalendar notBefore = subjectConfirmationData.getNotBefore();
    if (notBefore != null) {
        StaxUtil.writeAttribute(writer, JBossSAMLConstants.NOT_BEFORE.get(), notBefore.toString());
    }
    XMLGregorianCalendar notOnOrAfter = subjectConfirmationData.getNotOnOrAfter();
    if (notOnOrAfter != null) {
        StaxUtil.writeAttribute(writer, JBossSAMLConstants.NOT_ON_OR_AFTER.get(), notOnOrAfter.toString());
    }
    String recipient = subjectConfirmationData.getRecipient();
    if (StringUtil.isNotNull(recipient)) {
        StaxUtil.writeAttribute(writer, JBossSAMLConstants.RECIPIENT.get(), recipient);
    }
    String address = subjectConfirmationData.getAddress();
    if (StringUtil.isNotNull(address)) {
        StaxUtil.writeAttribute(writer, JBossSAMLConstants.ADDRESS.get(), address);
    }
    if (subjectConfirmationData instanceof KeyInfoConfirmationDataType) {
        KeyInfoConfirmationDataType kicd = (KeyInfoConfirmationDataType) subjectConfirmationData;
        KeyInfoType keyInfo = (KeyInfoType) kicd.getAnyType();
        StaxWriterUtil.writeKeyInfo(writer, keyInfo);
    /*
             * if (keyInfo.getContent() == null || keyInfo.getContent().size() == 0) throw new
             * ProcessingException(ErrorCodes.WRITER_INVALID_KEYINFO_NULL_CONTENT); StaxUtil.writeStartElement(this.writer,
             * WSTrustConstants.XMLDSig.DSIG_PREFIX, WSTrustConstants.XMLDSig.KEYINFO, WSTrustConstants.XMLDSig.DSIG_NS);
             * StaxUtil.writeNameSpace(this.writer, WSTrustConstants.XMLDSig.DSIG_PREFIX, WSTrustConstants.XMLDSig.DSIG_NS); //
             * write the keyInfo content. Object content = keyInfo.getContent().get(0); if (content instanceof Element) {
             * Element element = (Element) keyInfo.getContent().get(0); StaxUtil.writeDOMNode(this.writer, element); } else if
             * (content instanceof X509DataType) { X509DataType type = (X509DataType) content; if (type.getDataObjects().size()
             * == 0) throw new ProcessingException(ErrorCodes.WRITER_NULL_VALUE + "X509Data");
             * StaxUtil.writeStartElement(this.writer, WSTrustConstants.XMLDSig.DSIG_PREFIX, WSTrustConstants.XMLDSig.X509DATA,
             * WSTrustConstants.XMLDSig.DSIG_NS); Object obj = type.getDataObjects().get(0); if (obj instanceof Element) {
             * Element element = (Element) obj; StaxUtil.writeDOMElement(this.writer, element); } else if (obj instanceof
             * X509CertificateType) { X509CertificateType cert = (X509CertificateType) obj;
             * StaxUtil.writeStartElement(this.writer, WSTrustConstants.XMLDSig.DSIG_PREFIX, WSTrustConstants.XMLDSig.X509CERT,
             * WSTrustConstants.XMLDSig.DSIG_NS); StaxUtil.writeCharacters(this.writer, new
             * String(cert.getEncodedCertificate())); StaxUtil.writeEndElement(this.writer); }
             * StaxUtil.writeEndElement(this.writer); } StaxUtil.writeEndElement(this.writer);
             */
    }
    StaxUtil.writeEndElement(writer);
    StaxUtil.flush(writer);
}

Example 3 with SubjectConfirmationDataType

use of org.keycloak.dom.saml.v2.assertion.SubjectConfirmationDataType in project keycloak by keycloak.

the class SAML11ParserUtil method parseSubjectConfirmationData.

/**
 * Parse the {@link SubjectConfirmationDataType}
 *
 * @param xmlEventReader
 *
 * @return
 *
 * @throws ParsingException
 */
public static SubjectConfirmationDataType parseSubjectConfirmationData(XMLEventReader xmlEventReader) throws ParsingException {
    StartElement startElement = StaxParserUtil.getNextStartElement(xmlEventReader);
    StaxParserUtil.validate(startElement, JBossSAMLConstants.SUBJECT_CONFIRMATION_DATA.get());
    SubjectConfirmationDataType subjectConfirmationData = new SubjectConfirmationDataType();
    Attribute inResponseTo = startElement.getAttributeByName(new QName(JBossSAMLConstants.IN_RESPONSE_TO.get()));
    if (inResponseTo != null) {
        subjectConfirmationData.setInResponseTo(StaxParserUtil.getAttributeValue(inResponseTo));
    }
    Attribute notBefore = startElement.getAttributeByName(new QName(JBossSAMLConstants.NOT_BEFORE.get()));
    if (notBefore != null) {
        subjectConfirmationData.setNotBefore(XMLTimeUtil.parse(StaxParserUtil.getAttributeValue(notBefore)));
    }
    Attribute notOnOrAfter = startElement.getAttributeByName(new QName(JBossSAMLConstants.NOT_ON_OR_AFTER.get()));
    if (notOnOrAfter != null) {
        subjectConfirmationData.setNotOnOrAfter(XMLTimeUtil.parse(StaxParserUtil.getAttributeValue(notOnOrAfter)));
    }
    Attribute recipient = startElement.getAttributeByName(new QName(JBossSAMLConstants.RECIPIENT.get()));
    if (recipient != null) {
        subjectConfirmationData.setRecipient(StaxParserUtil.getAttributeValue(recipient));
    }
    Attribute address = startElement.getAttributeByName(new QName(JBossSAMLConstants.ADDRESS.get()));
    if (address != null) {
        subjectConfirmationData.setAddress(StaxParserUtil.getAttributeValue(address));
    }
    XMLEvent xmlEvent = StaxParserUtil.peek(xmlEventReader);
    if (!(xmlEvent instanceof EndElement)) {
        startElement = StaxParserUtil.peekNextStartElement(xmlEventReader);
        String tag = StaxParserUtil.getElementName(startElement);
        if (tag.equals(WSTrustConstants.XMLDSig.KEYINFO)) {
            KeyInfoType keyInfo = parseKeyInfo(xmlEventReader);
            subjectConfirmationData.setAnyType(keyInfo);
        } else if (tag.equals(WSTrustConstants.XMLEnc.ENCRYPTED_KEY)) {
            subjectConfirmationData.setAnyType(StaxParserUtil.getDOMElement(xmlEventReader));
        } else
            throw logger.parserUnknownTag(tag, startElement.getLocation());
    }
    // Get the end tag
    EndElement endElement = (EndElement) StaxParserUtil.getNextEvent(xmlEventReader);
    StaxParserUtil.matches(endElement, JBossSAMLConstants.SUBJECT_CONFIRMATION_DATA.get());
    return subjectConfirmationData;
}

Example 4 with SubjectConfirmationDataType

use of org.keycloak.dom.saml.v2.assertion.SubjectConfirmationDataType in project keycloak by keycloak.

the class SAML11ParserUtil method parseSAML11SubjectConfirmation.

/**
 * Parse the {@link org.keycloak.dom.saml.v1.assertion.SAML11SubjectConfirmationType}
 *
 * @param xmlEventReader
 *
 * @return
 *
 * @throws ParsingException
 */
public static SAML11SubjectConfirmationType parseSAML11SubjectConfirmation(XMLEventReader xmlEventReader) throws ParsingException {
    SAML11SubjectConfirmationType subjectConfirmationType = new SAML11SubjectConfirmationType();
    StartElement startElement = StaxParserUtil.getNextStartElement(xmlEventReader);
    // There may be additional things under subject confirmation
    while (xmlEventReader.hasNext()) {
        XMLEvent xmlEvent = StaxParserUtil.peek(xmlEventReader);
        if (xmlEvent instanceof EndElement) {
            EndElement endElement = StaxParserUtil.getNextEndElement(xmlEventReader);
            StaxParserUtil.validate(endElement, JBossSAMLConstants.SUBJECT_CONFIRMATION.get());
            break;
        }
        if (xmlEvent instanceof StartElement) {
            startElement = (StartElement) xmlEvent;
            String startTag = StaxParserUtil.getElementName(startElement);
            if (startTag.equals(SAML11Constants.CONFIRMATION_METHOD)) {
                startElement = StaxParserUtil.getNextStartElement(xmlEventReader);
                String method = StaxParserUtil.getElementText(xmlEventReader);
                subjectConfirmationType.addConfirmationMethod(URI.create(method));
            } else if (startTag.equals(JBossSAMLConstants.SUBJECT_CONFIRMATION_DATA.get())) {
                startElement = StaxParserUtil.getNextStartElement(xmlEventReader);
                SubjectConfirmationDataType subjectConfirmationData = parseSubjectConfirmationData(xmlEventReader);
                subjectConfirmationType.setSubjectConfirmationData(subjectConfirmationData);
            } else if (startTag.equals(JBossSAMLConstants.KEY_INFO.get())) {
                Element keyInfo = StaxParserUtil.getDOMElement(xmlEventReader);
                subjectConfirmationType.setKeyInfo(keyInfo);
            } else
                throw logger.parserUnknownTag(startTag, startElement.getLocation());
        }
    }
    return subjectConfirmationType;
}

Example 5 with SubjectConfirmationDataType

use of org.keycloak.dom.saml.v2.assertion.SubjectConfirmationDataType in project keycloak by keycloak.

the class SAMLEndpoint method validateInResponseToAttribute.

private boolean validateInResponseToAttribute(ResponseType responseType, String expectedRequestId) {
    // If we are not expecting a request ID, don't bother
    if (expectedRequestId == null || expectedRequestId.isEmpty())
        return true;
    // We are expecting a request ID so we are in SP-initiated login, attribute InResponseTo must be present
    if (responseType.getInResponseTo() == null) {
        logger.error("Response Validation Error: InResponseTo attribute was expected but not present in received response");
        return false;
    }
    // Attribute is present, proceed with validation
    // 1) Attribute Response > InResponseTo must not be empty
    String responseInResponseToValue = responseType.getInResponseTo();
    if (responseInResponseToValue.isEmpty()) {
        logger.error("Response Validation Error: InResponseTo attribute was expected but it is empty in received response");
        return false;
    }
    // 2) Attribute Response > InResponseTo must match request ID
    if (!responseInResponseToValue.equals(expectedRequestId)) {
        logger.error("Response Validation Error: received InResponseTo attribute does not match the expected request ID");
        return false;
    }
    // If present, Assertion > Subject > Confirmation > SubjectConfirmationData > InResponseTo must also be validated
    if (responseType.getAssertions().isEmpty())
        return true;
    SubjectType subjectElement = responseType.getAssertions().get(0).getAssertion().getSubject();
    if (subjectElement != null) {
        if (subjectElement.getConfirmation() != null && !subjectElement.getConfirmation().isEmpty()) {
            SubjectConfirmationType subjectConfirmationElement = subjectElement.getConfirmation().get(0);
            if (subjectConfirmationElement != null) {
                SubjectConfirmationDataType subjectConfirmationDataElement = subjectConfirmationElement.getSubjectConfirmationData();
                if (subjectConfirmationDataElement != null) {
                    if (subjectConfirmationDataElement.getInResponseTo() != null) {
                        // 3) Assertion > Subject > Confirmation > SubjectConfirmationData > InResponseTo is empty
                        String subjectConfirmationDataInResponseToValue = subjectConfirmationDataElement.getInResponseTo();
                        if (subjectConfirmationDataInResponseToValue.isEmpty()) {
                            logger.error("Response Validation Error: SubjectConfirmationData InResponseTo attribute was expected but it is empty in received response");
                            return false;
                        }
                        // 4) Assertion > Subject > Confirmation > SubjectConfirmationData > InResponseTo does not match request ID
                        if (!subjectConfirmationDataInResponseToValue.equals(expectedRequestId)) {
                            logger.error("Response Validation Error: received SubjectConfirmationData InResponseTo attribute does not match the expected request ID");
                            return false;
                        }
                    }
                }
            }
        }
    }
    return true;
}