Examples with EndpointType org.keycloak.dom.saml.v2.metadata.EndpointType used on opensource projects

Example 6 with EndpointType

use of org.keycloak.dom.saml.v2.metadata.EndpointType in project keycloak by keycloak.

the class SAMLIdentityProviderFactory method parseConfig.

@Override
public Map<String, String> parseConfig(KeycloakSession session, InputStream inputStream) {
    try {
        Object parsedObject = SAMLParser.getInstance().parse(inputStream);
        EntityDescriptorType entityType;
        if (EntitiesDescriptorType.class.isInstance(parsedObject)) {
            entityType = (EntityDescriptorType) ((EntitiesDescriptorType) parsedObject).getEntityDescriptor().get(0);
        } else {
            entityType = (EntityDescriptorType) parsedObject;
        }
        List<EntityDescriptorType.EDTChoiceType> choiceType = entityType.getChoiceType();
        if (!choiceType.isEmpty()) {
            IDPSSODescriptorType idpDescriptor = null;
            // So we need to loop through to find the IDPSSODescriptor.
            for (EntityDescriptorType.EDTChoiceType edtChoiceType : entityType.getChoiceType()) {
                List<EntityDescriptorType.EDTDescriptorChoiceType> descriptors = edtChoiceType.getDescriptors();
                if (!descriptors.isEmpty() && descriptors.get(0).getIdpDescriptor() != null) {
                    idpDescriptor = descriptors.get(0).getIdpDescriptor();
                }
            }
            if (idpDescriptor != null) {
                SAMLIdentityProviderConfig samlIdentityProviderConfig = new SAMLIdentityProviderConfig();
                String singleSignOnServiceUrl = null;
                boolean postBindingResponse = false;
                boolean postBindingLogout = false;
                for (EndpointType endpoint : idpDescriptor.getSingleSignOnService()) {
                    if (endpoint.getBinding().toString().equals(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get())) {
                        singleSignOnServiceUrl = endpoint.getLocation().toString();
                        postBindingResponse = true;
                        break;
                    } else if (endpoint.getBinding().toString().equals(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get())) {
                        singleSignOnServiceUrl = endpoint.getLocation().toString();
                    }
                }
                String singleLogoutServiceUrl = null;
                for (EndpointType endpoint : idpDescriptor.getSingleLogoutService()) {
                    if (postBindingResponse && endpoint.getBinding().toString().equals(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get())) {
                        singleLogoutServiceUrl = endpoint.getLocation().toString();
                        postBindingLogout = true;
                        break;
                    } else if (!postBindingResponse && endpoint.getBinding().toString().equals(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get())) {
                        singleLogoutServiceUrl = endpoint.getLocation().toString();
                        break;
                    }
                }
                samlIdentityProviderConfig.setSingleLogoutServiceUrl(singleLogoutServiceUrl);
                samlIdentityProviderConfig.setSingleSignOnServiceUrl(singleSignOnServiceUrl);
                samlIdentityProviderConfig.setWantAuthnRequestsSigned(idpDescriptor.isWantAuthnRequestsSigned());
                samlIdentityProviderConfig.setAddExtensionsElementWithKeyInfo(false);
                samlIdentityProviderConfig.setValidateSignature(idpDescriptor.isWantAuthnRequestsSigned());
                samlIdentityProviderConfig.setPostBindingResponse(postBindingResponse);
                samlIdentityProviderConfig.setPostBindingAuthnRequest(postBindingResponse);
                samlIdentityProviderConfig.setPostBindingLogout(postBindingLogout);
                samlIdentityProviderConfig.setLoginHint(false);
                List<String> nameIdFormatList = idpDescriptor.getNameIDFormat();
                if (nameIdFormatList != null && !nameIdFormatList.isEmpty())
                    samlIdentityProviderConfig.setNameIDPolicyFormat(nameIdFormatList.get(0));
                List<KeyDescriptorType> keyDescriptor = idpDescriptor.getKeyDescriptor();
                String defaultCertificate = null;
                if (keyDescriptor != null) {
                    for (KeyDescriptorType keyDescriptorType : keyDescriptor) {
                        Element keyInfo = keyDescriptorType.getKeyInfo();
                        Element x509KeyInfo = DocumentUtil.getChildElement(keyInfo, new QName("dsig", "X509Certificate"));
                        if (KeyTypes.SIGNING.equals(keyDescriptorType.getUse())) {
                            samlIdentityProviderConfig.addSigningCertificate(x509KeyInfo.getTextContent());
                        } else if (KeyTypes.ENCRYPTION.equals(keyDescriptorType.getUse())) {
                            samlIdentityProviderConfig.setEncryptionPublicKey(x509KeyInfo.getTextContent());
                        } else if (keyDescriptorType.getUse() == null) {
                            defaultCertificate = x509KeyInfo.getTextContent();
                        }
                    }
                }
                if (defaultCertificate != null) {
                    if (samlIdentityProviderConfig.getSigningCertificates().length == 0) {
                        samlIdentityProviderConfig.addSigningCertificate(defaultCertificate);
                    }
                    if (samlIdentityProviderConfig.getEncryptionPublicKey() == null) {
                        samlIdentityProviderConfig.setEncryptionPublicKey(defaultCertificate);
                    }
                }
                samlIdentityProviderConfig.setEnabledFromMetadata(entityType.getValidUntil() == null || entityType.getValidUntil().toGregorianCalendar().getTime().after(new Date(System.currentTimeMillis())));
                // check for hide on login attribute
                if (entityType.getExtensions() != null && entityType.getExtensions().getEntityAttributes() != null) {
                    for (AttributeType attribute : entityType.getExtensions().getEntityAttributes().getAttribute()) {
                        if (MACEDIR_ENTITY_CATEGORY.equals(attribute.getName()) && attribute.getAttributeValue().contains(REFEDS_HIDE_FROM_DISCOVERY)) {
                            samlIdentityProviderConfig.setHideOnLogin(true);
                        }
                    }
                }
                return samlIdentityProviderConfig.getConfig();
            }
        }
    } catch (ParsingException pe) {
        throw new RuntimeException("Could not parse IdP SAML Metadata", pe);
    }
    return new HashMap<>();
}

Example 7 with EndpointType

use of org.keycloak.dom.saml.v2.metadata.EndpointType in project keycloak by keycloak.

the class FixedHostnameTest method assertSamlIdPDescriptor.

private void assertSamlIdPDescriptor(String realm, String expectedBaseUrl) throws Exception {
    final String realmUrl = expectedBaseUrl + "/auth/realms/" + realm;
    final String baseSamlEndpointUrl = realmUrl + "/protocol/saml";
    String entityDescriptor = null;
    try (CloseableHttpClient client = HttpClientBuilder.create().build();
        CloseableHttpResponse resp = client.execute(new HttpGet(baseSamlEndpointUrl + "/descriptor"))) {
        entityDescriptor = EntityUtils.toString(resp.getEntity(), GeneralConstants.SAML_CHARSET);
        Object metadataO = SAMLParser.getInstance().parse(new ByteArrayInputStream(entityDescriptor.getBytes(GeneralConstants.SAML_CHARSET)));
        assertThat(metadataO, instanceOf(EntityDescriptorType.class));
        EntityDescriptorType ed = (EntityDescriptorType) metadataO;
        assertThat(ed.getEntityID(), is(realmUrl));
        IDPSSODescriptorType idpDescriptor = ed.getChoiceType().get(0).getDescriptors().get(0).getIdpDescriptor();
        assertThat(idpDescriptor, notNullValue());
        final List<String> locations = idpDescriptor.getSingleSignOnService().stream().map(EndpointType::getLocation).map(URI::toString).collect(Collectors.toList());
        assertThat(locations, Matchers.everyItem(is(baseSamlEndpointUrl)));
    } catch (Exception e) {
        log.errorf("Caught exception while parsing SAML descriptor %s", entityDescriptor);
    }
}

Example 8 with EndpointType

use of org.keycloak.dom.saml.v2.metadata.EndpointType in project keycloak by keycloak.

the class SPMetadataDescriptor method buildSPdescriptor.

public static EntityDescriptorType buildSPdescriptor(URI loginBinding, URI logoutBinding, URI assertionEndpoint, URI logoutEndpoint, boolean wantAuthnRequestsSigned, boolean wantAssertionsSigned, boolean wantAssertionsEncrypted, String entityId, String nameIDPolicyFormat, List<Element> signingCerts, List<Element> encryptionCerts) {
    EntityDescriptorType entityDescriptor = new EntityDescriptorType(entityId);
    entityDescriptor.setID(IDGenerator.create("ID_"));
    SPSSODescriptorType spSSODescriptor = new SPSSODescriptorType(Arrays.asList(PROTOCOL_NSURI.get()));
    spSSODescriptor.setAuthnRequestsSigned(wantAuthnRequestsSigned);
    spSSODescriptor.setWantAssertionsSigned(wantAssertionsSigned);
    spSSODescriptor.addNameIDFormat(nameIDPolicyFormat);
    spSSODescriptor.addSingleLogoutService(new EndpointType(logoutBinding, logoutEndpoint));
    if (wantAuthnRequestsSigned && signingCerts != null) {
        for (Element key : signingCerts) {
            KeyDescriptorType keyDescriptor = new KeyDescriptorType();
            keyDescriptor.setUse(KeyTypes.SIGNING);
            keyDescriptor.setKeyInfo(key);
            spSSODescriptor.addKeyDescriptor(keyDescriptor);
        }
    }
    if (wantAssertionsEncrypted && encryptionCerts != null) {
        for (Element key : encryptionCerts) {
            KeyDescriptorType keyDescriptor = new KeyDescriptorType();
            keyDescriptor.setUse(KeyTypes.ENCRYPTION);
            keyDescriptor.setKeyInfo(key);
            spSSODescriptor.addKeyDescriptor(keyDescriptor);
        }
    }
    IndexedEndpointType assertionConsumerEndpoint = new IndexedEndpointType(loginBinding, assertionEndpoint);
    assertionConsumerEndpoint.setIsDefault(true);
    assertionConsumerEndpoint.setIndex(1);
    spSSODescriptor.addAssertionConsumerService(assertionConsumerEndpoint);
    entityDescriptor.addChoiceType(new EntityDescriptorType.EDTChoiceType(Arrays.asList(new EntityDescriptorType.EDTDescriptorChoiceType(spSSODescriptor))));
    return entityDescriptor;
}

Example 9 with EndpointType

use of org.keycloak.dom.saml.v2.metadata.EndpointType in project keycloak by keycloak.

the class SAMLIndexedEndpointTypeParser method instantiateElement.

@Override
protected IndexedEndpointType instantiateElement(XMLEventReader xmlEventReader, StartElement element) throws ParsingException {
    String binding = StaxParserUtil.getRequiredAttributeValue(element, SAMLMetadataQNames.ATTR_BINDING);
    String location = StaxParserUtil.getRequiredAttributeValue(element, SAMLMetadataQNames.ATTR_LOCATION);
    IndexedEndpointType endpoint = new IndexedEndpointType(URI.create(binding), URI.create(location));
    Boolean isDefault = StaxParserUtil.getBooleanAttributeValue(element, SAMLMetadataQNames.ATTR_IS_DEFAULT);
    if (isDefault != null) {
        endpoint.setIsDefault(isDefault);
    }
    Integer index = StaxParserUtil.getIntegerAttributeValue(element, SAMLMetadataQNames.ATTR_INDEX);
    if (index != null)
        endpoint.setIndex(index);
    // EndpointType attributes
    String responseLocation = StaxParserUtil.getAttributeValue(element, SAMLMetadataQNames.ATTR_RESPONSE_LOCATION);
    if (responseLocation != null) {
        endpoint.setResponseLocation(URI.create(responseLocation));
    }
    return endpoint;
}

Example 10 with EndpointType

use of org.keycloak.dom.saml.v2.metadata.EndpointType in project keycloak by keycloak.

the class SAMLEndpointTypeParser method instantiateElement.

@Override
protected EndpointType instantiateElement(XMLEventReader xmlEventReader, StartElement element) throws ParsingException {
    String binding = StaxParserUtil.getRequiredAttributeValue(element, SAMLMetadataQNames.ATTR_BINDING);
    String location = StaxParserUtil.getRequiredAttributeValue(element, SAMLMetadataQNames.ATTR_LOCATION);
    EndpointType endpoint = new EndpointType(URI.create(binding), URI.create(location));
    String responseLocation = StaxParserUtil.getAttributeValue(element, SAMLMetadataQNames.ATTR_RESPONSE_LOCATION);
    if (responseLocation != null) {
        endpoint.setResponseLocation(URI.create(responseLocation));
    }
    return endpoint;
}