Examples with AttributeConsumingServiceType org.keycloak.dom.saml.v2.metadata.AttributeConsumingServiceType used on opensource projects

Example 1 with AttributeConsumingServiceType

use of org.keycloak.dom.saml.v2.metadata.AttributeConsumingServiceType in project keycloak by keycloak.

the class SAMLParserTest method testSaml20MetadataEntityDescriptorSP.

@Test
public void testSaml20MetadataEntityDescriptorSP() throws Exception {
    EntityDescriptorType entityDescriptor = assertParsed("saml20-entity-descriptor-sp.xml", EntityDescriptorType.class);
    assertThat(entityDescriptor.getEntityID(), is("https://ServiceProvider.com/SAML"));
    assertThat(entityDescriptor.getValidUntil(), is(nullValue()));
    assertThat(entityDescriptor.getCacheDuration(), is(nullValue()));
    assertThat(entityDescriptor.getID(), is(nullValue()));
    assertThat(entityDescriptor.getExtensions(), is(nullValue()));
    List<EntityDescriptorType.EDTChoiceType> descriptors = entityDescriptor.getChoiceType();
    assertThat(descriptors, hasSize(1));
    // SP Descriptor
    SPSSODescriptorType spDescriptor = descriptors.get(0).getDescriptors().get(0).getSpDescriptor();
    assertThat(spDescriptor, is(notNullValue()));
    assertThat(spDescriptor.isAuthnRequestsSigned(), is(true));
    assertThat(spDescriptor.isWantAssertionsSigned(), is(false));
    assertThat(spDescriptor.getProtocolSupportEnumeration(), contains("urn:oasis:names:tc:SAML:2.0:protocol"));
    // Key descriptor
    List<KeyDescriptorType> keyDescriptors = spDescriptor.getKeyDescriptor();
    assertThat(keyDescriptors, hasSize(2));
    KeyDescriptorType signingKey = keyDescriptors.get(0);
    assertThat(signingKey.getUse(), is(KeyTypes.SIGNING));
    assertThat(signingKey.getEncryptionMethod(), is(emptyCollectionOf(EncryptionMethodType.class)));
    assertThat(signingKey.getKeyInfo().getElementsByTagName("ds:KeyName").item(0).getTextContent(), is("ServiceProvider.com SSO Key"));
    KeyDescriptorType encryptionKey = keyDescriptors.get(1);
    assertThat(encryptionKey.getUse(), is(KeyTypes.ENCRYPTION));
    assertThat(encryptionKey.getKeyInfo().getElementsByTagName("ds:KeyName").item(0).getTextContent(), is("ServiceProvider.com Encrypt Key"));
    List<EncryptionMethodType> encryptionMethods = encryptionKey.getEncryptionMethod();
    assertThat(encryptionMethods, Matchers.<EncryptionMethodType>hasSize(1));
    assertThat(encryptionMethods.get(0).getAlgorithm(), is("http://www.w3.org/2001/04/xmlenc#rsa-1_5"));
    assertThat(encryptionMethods.get(0).getEncryptionMethod(), is(nullValue()));
    // Single logout services
    assertThat(spDescriptor.getSingleLogoutService(), hasSize(2));
    EndpointType singleLS1 = spDescriptor.getSingleLogoutService().get(0);
    assertThat(singleLS1.getBinding(), is(URI.create("urn:oasis:names:tc:SAML:2.0:bindings:SOAP")));
    assertThat(singleLS1.getLocation(), is(URI.create("https://ServiceProvider.com/SAML/SLO/SOAP")));
    assertThat(singleLS1.getResponseLocation(), is(nullValue()));
    assertThat(singleLS1.getAny(), is(emptyCollectionOf(Object.class)));
    assertThat(singleLS1.getOtherAttributes(), is(Collections.<QName, String>emptyMap()));
    EndpointType singleLS2 = spDescriptor.getSingleLogoutService().get(1);
    assertThat(singleLS2.getBinding(), is(URI.create("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect")));
    assertThat(singleLS2.getLocation(), is(URI.create("https://ServiceProvider.com/SAML/SLO/Browser")));
    assertThat(singleLS2.getResponseLocation(), is(URI.create("https://ServiceProvider.com/SAML/SLO/Response")));
    assertThat(singleLS2.getAny(), is(emptyCollectionOf(Object.class)));
    assertThat(singleLS2.getOtherAttributes(), is(Collections.<QName, String>emptyMap()));
    // NameID
    assertThat(spDescriptor.getNameIDFormat(), contains("urn:oasis:names:tc:SAML:2.0:nameid-format:transient"));
    // Assertion consumer services
    List<IndexedEndpointType> assertionConsumerServices = spDescriptor.getAssertionConsumerService();
    assertThat(assertionConsumerServices, hasSize(2));
    IndexedEndpointType assertionCS1 = assertionConsumerServices.get(0);
    assertThat(assertionCS1.getIndex(), is(0));
    assertThat(assertionCS1.isIsDefault(), is(true));
    assertThat(assertionCS1.getBinding(), is(URI.create("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact")));
    assertThat(assertionCS1.getLocation(), is(URI.create("https://ServiceProvider.com/SAML/SSO/Artifact")));
    assertThat(assertionCS1.getResponseLocation(), is(nullValue()));
    assertThat(assertionCS1.getOtherAttributes(), is(Collections.<QName, String>emptyMap()));
    IndexedEndpointType assertionCS2 = assertionConsumerServices.get(1);
    assertThat(assertionCS2.getIndex(), is(1));
    assertThat(assertionCS2.isIsDefault(), is(nullValue()));
    assertThat(assertionCS2.getBinding(), is(URI.create("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST")));
    assertThat(assertionCS2.getLocation(), is(URI.create("https://ServiceProvider.com/SAML/SSO/POST")));
    assertThat(assertionCS2.getResponseLocation(), is(nullValue()));
    assertThat(assertionCS2.getOtherAttributes(), is(Collections.<QName, String>emptyMap()));
    // Attribute consuming services
    List<AttributeConsumingServiceType> attributeConsumingServices = spDescriptor.getAttributeConsumingService();
    assertThat(attributeConsumingServices, hasSize(1));
    AttributeConsumingServiceType attributeConsumingService = attributeConsumingServices.get(0);
    assertThat(attributeConsumingService.getIndex(), is(0));
    assertThat(attributeConsumingService.getServiceName(), hasSize(1));
    LocalizedNameType servName = attributeConsumingService.getServiceName().get(0);
    assertThat(servName.getLang(), is("en"));
    assertThat(servName.getValue(), is("Academic Journals R US"));
    assertThat(attributeConsumingService.getServiceDescription(), is(emptyCollectionOf(LocalizedNameType.class)));
    List<RequestedAttributeType> requestedAttributes = attributeConsumingService.getRequestedAttribute();
    assertThat(requestedAttributes, hasSize(1));
    // Requested attribute
    RequestedAttributeType requestedAttribute = requestedAttributes.get(0);
    assertThat(requestedAttribute.getNameFormat(), is("urn:oasis:names:tc:SAML:2.0:attrname-format:uri"));
    assertThat(requestedAttribute.getName(), is("urn:oid:1.3.6.1.4.1.5923.1.1.1.7"));
    assertThat(requestedAttribute.getFriendlyName(), is("eduPersonEntitlement"));
    assertThat(requestedAttribute.getAttributeValue(), hasSize(1));
    assertThat((String) requestedAttribute.getAttributeValue().get(0), is("https://ServiceProvider.com/entitlements/123456789"));
    assertThat(requestedAttribute.getOtherAttributes(), is(Collections.<QName, String>emptyMap()));
    // Organization
    assertThat(entityDescriptor.getOrganization().getOrganizationName(), hasSize(1));
    LocalizedNameType orgName = entityDescriptor.getOrganization().getOrganizationName().get(0);
    assertThat(orgName.getLang(), is("en"));
    assertThat(orgName.getValue(), is("Academic Journals R\n            US"));
    assertThat(entityDescriptor.getOrganization().getOrganizationDisplayName(), hasSize(1));
    LocalizedNameType orgDispName = entityDescriptor.getOrganization().getOrganizationDisplayName().get(0);
    assertThat(orgDispName.getLang(), is("en"));
    assertThat(orgDispName.getValue(), is("Academic Journals R US, a Division of Dirk Corp."));
    assertThat(entityDescriptor.getOrganization().getOrganizationURL(), hasSize(1));
    LocalizedURIType orgURL = entityDescriptor.getOrganization().getOrganizationURL().get(0);
    assertThat(orgURL.getLang(), is("en"));
    assertThat(orgURL.getValue(), is(URI.create("https://ServiceProvider.com")));
}

Example 2 with AttributeConsumingServiceType

use of org.keycloak.dom.saml.v2.metadata.AttributeConsumingServiceType in project keycloak by keycloak.

the class UserAttributeMapper method updateMetadata.

// SamlMetadataDescriptorUpdater interface
@Override
public void updateMetadata(IdentityProviderMapperModel mapperModel, EntityDescriptorType entityDescriptor) {
    String attributeName = mapperModel.getConfig().get(UserAttributeMapper.ATTRIBUTE_NAME);
    String attributeFriendlyName = mapperModel.getConfig().get(UserAttributeMapper.ATTRIBUTE_FRIENDLY_NAME);
    RequestedAttributeType requestedAttribute = new RequestedAttributeType(attributeName);
    requestedAttribute.setIsRequired(null);
    requestedAttribute.setNameFormat(ATTRIBUTE_FORMAT_BASIC.get());
    if (attributeFriendlyName != null && attributeFriendlyName.length() > 0)
        requestedAttribute.setFriendlyName(attributeFriendlyName);
    // Add the requestedAttribute item to any AttributeConsumingServices
    for (EntityDescriptorType.EDTChoiceType choiceType : entityDescriptor.getChoiceType()) {
        List<EntityDescriptorType.EDTDescriptorChoiceType> descriptors = choiceType.getDescriptors();
        for (EntityDescriptorType.EDTDescriptorChoiceType descriptor : descriptors) {
            for (AttributeConsumingServiceType attributeConsumingService : descriptor.getSpDescriptor().getAttributeConsumingService()) {
                boolean alreadyPresent = attributeConsumingService.getRequestedAttribute().stream().anyMatch(t -> (attributeName == null || attributeName.equalsIgnoreCase(t.getName())) && (attributeFriendlyName == null || attributeFriendlyName.equalsIgnoreCase(t.getFriendlyName())));
                if (!alreadyPresent)
                    attributeConsumingService.addRequestedAttribute(requestedAttribute);
            }
        }
    }
}

Example 3 with AttributeConsumingServiceType

use of org.keycloak.dom.saml.v2.metadata.AttributeConsumingServiceType in project keycloak by keycloak.

the class AttributeToRoleMapper method updateMetadata.

// SamlMetadataDescriptorUpdater interface
@Override
public void updateMetadata(IdentityProviderMapperModel mapperModel, EntityDescriptorType entityDescriptor) {
    String attributeName = mapperModel.getConfig().get(UserAttributeMapper.ATTRIBUTE_NAME);
    String attributeFriendlyName = mapperModel.getConfig().get(AttributeToRoleMapper.ATTRIBUTE_FRIENDLY_NAME);
    RequestedAttributeType requestedAttribute = new RequestedAttributeType(mapperModel.getConfig().get(AttributeToRoleMapper.ATTRIBUTE_NAME));
    requestedAttribute.setIsRequired(null);
    requestedAttribute.setNameFormat(ATTRIBUTE_FORMAT_BASIC.get());
    if (attributeFriendlyName != null && attributeFriendlyName.length() > 0)
        requestedAttribute.setFriendlyName(attributeFriendlyName);
    // Add the requestedAttribute item to any AttributeConsumingServices
    for (EntityDescriptorType.EDTChoiceType choiceType : entityDescriptor.getChoiceType()) {
        List<EntityDescriptorType.EDTDescriptorChoiceType> descriptors = choiceType.getDescriptors();
        for (EntityDescriptorType.EDTDescriptorChoiceType descriptor : descriptors) {
            for (AttributeConsumingServiceType attributeConsumingService : descriptor.getSpDescriptor().getAttributeConsumingService()) {
                boolean alreadyPresent = attributeConsumingService.getRequestedAttribute().stream().anyMatch(t -> (attributeName == null || attributeName.equalsIgnoreCase(t.getName())) && (attributeFriendlyName == null || attributeFriendlyName.equalsIgnoreCase(t.getFriendlyName())));
                if (!alreadyPresent)
                    attributeConsumingService.addRequestedAttribute(requestedAttribute);
            }
        }
    }
}

Example 4 with AttributeConsumingServiceType

use of org.keycloak.dom.saml.v2.metadata.AttributeConsumingServiceType in project keycloak by keycloak.

the class SAMLIdentityProvider method export.

@Override
public Response export(UriInfo uriInfo, RealmModel realm, String format) {
    try {
        URI authnBinding = JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.getUri();
        if (getConfig().isPostBindingAuthnRequest()) {
            authnBinding = JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.getUri();
        }
        URI endpoint = uriInfo.getBaseUriBuilder().path("realms").path(realm.getName()).path("broker").path(getConfig().getAlias()).path("endpoint").build();
        boolean wantAuthnRequestsSigned = getConfig().isWantAuthnRequestsSigned();
        boolean wantAssertionsSigned = getConfig().isWantAssertionsSigned();
        boolean wantAssertionsEncrypted = getConfig().isWantAssertionsEncrypted();
        String entityId = getEntityId(uriInfo, realm);
        String nameIDPolicyFormat = getConfig().getNameIDPolicyFormat();
        List<Element> signingKeys = new LinkedList<>();
        List<Element> encryptionKeys = new LinkedList<>();
        session.keys().getKeysStream(realm, KeyUse.SIG, Algorithm.RS256).filter(Objects::nonNull).filter(key -> key.getCertificate() != null).sorted(SamlService::compareKeys).forEach(key -> {
            try {
                Element element = SPMetadataDescriptor.buildKeyInfoElement(key.getKid(), PemUtils.encodeCertificate(key.getCertificate()));
                signingKeys.add(element);
                if (key.getStatus() == KeyStatus.ACTIVE) {
                    encryptionKeys.add(element);
                }
            } catch (ParserConfigurationException e) {
                logger.warn("Failed to export SAML SP Metadata!", e);
                throw new RuntimeException(e);
            }
        });
        // Prepare the metadata descriptor model
        StringWriter sw = new StringWriter();
        XMLStreamWriter writer = StaxUtil.getXMLStreamWriter(sw);
        SAMLMetadataWriter metadataWriter = new SAMLMetadataWriter(writer);
        EntityDescriptorType entityDescriptor = SPMetadataDescriptor.buildSPdescriptor(authnBinding, authnBinding, endpoint, endpoint, wantAuthnRequestsSigned, wantAssertionsSigned, wantAssertionsEncrypted, entityId, nameIDPolicyFormat, signingKeys, encryptionKeys);
        // Create the AttributeConsumingService if at least one attribute importer mapper exists
        List<Entry<IdentityProviderMapperModel, SamlMetadataDescriptorUpdater>> metadataAttrProviders = new ArrayList<>();
        realm.getIdentityProviderMappersByAliasStream(getConfig().getAlias()).forEach(mapper -> {
            IdentityProviderMapper target = (IdentityProviderMapper) session.getKeycloakSessionFactory().getProviderFactory(IdentityProviderMapper.class, mapper.getIdentityProviderMapper());
            if (target instanceof SamlMetadataDescriptorUpdater)
                metadataAttrProviders.add(new java.util.AbstractMap.SimpleEntry<>(mapper, (SamlMetadataDescriptorUpdater) target));
        });
        if (!metadataAttrProviders.isEmpty()) {
            int attributeConsumingServiceIndex = getConfig().getAttributeConsumingServiceIndex() != null ? getConfig().getAttributeConsumingServiceIndex() : 1;
            String attributeConsumingServiceName = getConfig().getAttributeConsumingServiceName();
            // default value for attributeConsumingServiceName
            if (attributeConsumingServiceName == null)
                attributeConsumingServiceName = realm.getDisplayName() != null ? realm.getDisplayName() : realm.getName();
            AttributeConsumingServiceType attributeConsumingService = new AttributeConsumingServiceType(attributeConsumingServiceIndex);
            attributeConsumingService.setIsDefault(true);
            String currentLocale = realm.getDefaultLocale() == null ? "en" : realm.getDefaultLocale();
            LocalizedNameType attributeConsumingServiceNameElement = new LocalizedNameType(currentLocale);
            attributeConsumingServiceNameElement.setValue(attributeConsumingServiceName);
            attributeConsumingService.addServiceName(attributeConsumingServiceNameElement);
            // Look for the SP descriptor and add the attribute consuming service
            for (EntityDescriptorType.EDTChoiceType choiceType : entityDescriptor.getChoiceType()) {
                List<EntityDescriptorType.EDTDescriptorChoiceType> descriptors = choiceType.getDescriptors();
                for (EntityDescriptorType.EDTDescriptorChoiceType descriptor : descriptors) {
                    descriptor.getSpDescriptor().addAttributeConsumerService(attributeConsumingService);
                }
            }
            // Add the attribute mappers
            metadataAttrProviders.forEach(mapper -> {
                SamlMetadataDescriptorUpdater metadataAttrProvider = mapper.getValue();
                metadataAttrProvider.updateMetadata(mapper.getKey(), entityDescriptor);
            });
        }
        // Write the metadata and export it to a string
        metadataWriter.writeEntityDescriptor(entityDescriptor);
        String descriptor = sw.toString();
        // Metadata signing
        if (getConfig().isSignSpMetadata()) {
            KeyManager.ActiveRsaKey activeKey = session.keys().getActiveRsaKey(realm);
            String keyName = getConfig().getXmlSigKeyInfoKeyNameTransformer().getKeyName(activeKey.getKid(), activeKey.getCertificate());
            KeyPair keyPair = new KeyPair(activeKey.getPublicKey(), activeKey.getPrivateKey());
            Document metadataDocument = DocumentUtil.getDocument(descriptor);
            SAML2Signature signatureHelper = new SAML2Signature();
            signatureHelper.setSignatureMethod(getSignatureAlgorithm().getXmlSignatureMethod());
            signatureHelper.setDigestMethod(getSignatureAlgorithm().getXmlSignatureDigestMethod());
            Node nextSibling = metadataDocument.getDocumentElement().getFirstChild();
            signatureHelper.setNextSibling(nextSibling);
            signatureHelper.signSAMLDocument(metadataDocument, keyName, keyPair, CanonicalizationMethod.EXCLUSIVE);
            descriptor = DocumentUtil.getDocumentAsString(metadataDocument);
        }
        return Response.ok(descriptor, MediaType.APPLICATION_XML_TYPE).build();
    } catch (Exception e) {
        logger.warn("Failed to export SAML SP Metadata!", e);
        throw new RuntimeException(e);
    }
}

Example 5 with AttributeConsumingServiceType

use of org.keycloak.dom.saml.v2.metadata.AttributeConsumingServiceType in project keycloak by keycloak.

the class SAMLAttributeConsumingServiceParser method instantiateElement.

@Override
protected AttributeConsumingServiceType instantiateElement(XMLEventReader xmlEventReader, StartElement element) throws ParsingException {
    int index = Integer.parseInt(StaxParserUtil.getRequiredAttributeValue(element, SAMLMetadataQNames.ATTR_INDEX));
    AttributeConsumingServiceType service = new AttributeConsumingServiceType(index);
    service.setIsDefault(StaxParserUtil.getBooleanAttributeValue(element, SAMLMetadataQNames.ATTR_IS_DEFAULT));
    return service;
}