Examples with KeyDescriptorType org.keycloak.dom.saml.v2.metadata.KeyDescriptorType used on opensource projects

Example 6 with KeyDescriptorType

use of org.keycloak.dom.saml.v2.metadata.KeyDescriptorType in project keycloak by keycloak.

the class SAMLMetadataWriter method writeKeyDescriptor.

public void writeKeyDescriptor(KeyDescriptorType keyDescriptor) throws ProcessingException {
    StaxUtil.writeStartElement(writer, METADATA_PREFIX, JBossSAMLConstants.KEY_DESCRIPTOR.get(), JBossSAMLURIConstants.METADATA_NSURI.get());
    KeyTypes keyTypes = keyDescriptor.getUse();
    if (keyTypes != null)
        StaxUtil.writeAttribute(writer, new QName(JBossSAMLConstants.USE.get()), keyTypes.value());
    Element keyInfo = keyDescriptor.getKeyInfo();
    StaxUtil.writeDOMElement(writer, keyInfo);
    StaxUtil.writeEndElement(writer);
    StaxUtil.flush(writer);
}

Example 7 with KeyDescriptorType

use of org.keycloak.dom.saml.v2.metadata.KeyDescriptorType in project keycloak by keycloak.

the class SAMLMetadataWriter method write.

public void write(IDPSSODescriptorType idpSSODescriptor) throws ProcessingException {
    if (idpSSODescriptor == null)
        throw new ProcessingException(logger.nullArgumentError("IDPSSODescriptorType"));
    StaxUtil.writeStartElement(writer, METADATA_PREFIX, JBossSAMLConstants.IDP_SSO_DESCRIPTOR.get(), JBossSAMLURIConstants.METADATA_NSURI.get());
    Boolean wantsAuthnRequestsSigned = idpSSODescriptor.isWantAuthnRequestsSigned();
    if (wantsAuthnRequestsSigned != null) {
        StaxUtil.writeAttribute(writer, new QName(JBossSAMLConstants.WANT_AUTHN_REQUESTS_SIGNED.get()), wantsAuthnRequestsSigned.toString());
    }
    writeProtocolSupportEnumeration(idpSSODescriptor.getProtocolSupportEnumeration());
    // Get the key descriptors
    List<KeyDescriptorType> keyDescriptors = idpSSODescriptor.getKeyDescriptor();
    for (KeyDescriptorType keyDescriptor : keyDescriptors) {
        writeKeyDescriptor(keyDescriptor);
    }
    List<IndexedEndpointType> artifactResolutionServices = idpSSODescriptor.getArtifactResolutionService();
    for (IndexedEndpointType indexedEndpoint : artifactResolutionServices) {
        writeArtifactResolutionService(indexedEndpoint);
    }
    List<EndpointType> sloServices = idpSSODescriptor.getSingleLogoutService();
    for (EndpointType endpoint : sloServices) {
        writeSingleLogoutService(endpoint);
    }
    List<String> nameIDFormats = idpSSODescriptor.getNameIDFormat();
    for (String nameIDFormat : nameIDFormats) {
        writeNameIDFormat(nameIDFormat);
    }
    List<EndpointType> ssoServices = idpSSODescriptor.getSingleSignOnService();
    for (EndpointType endpoint : ssoServices) {
        writeSingleSignOnService(endpoint);
    }
    List<AttributeType> attributes = idpSSODescriptor.getAttribute();
    for (AttributeType attribType : attributes) {
        write(attribType);
    }
    StaxUtil.writeEndElement(writer);
    StaxUtil.flush(writer);
}

Example 8 with KeyDescriptorType

use of org.keycloak.dom.saml.v2.metadata.KeyDescriptorType in project keycloak by keycloak.

the class SAMLIdentityProviderFactory method parseConfig.

@Override
public Map<String, String> parseConfig(KeycloakSession session, InputStream inputStream) {
    try {
        Object parsedObject = SAMLParser.getInstance().parse(inputStream);
        EntityDescriptorType entityType;
        if (EntitiesDescriptorType.class.isInstance(parsedObject)) {
            entityType = (EntityDescriptorType) ((EntitiesDescriptorType) parsedObject).getEntityDescriptor().get(0);
        } else {
            entityType = (EntityDescriptorType) parsedObject;
        }
        List<EntityDescriptorType.EDTChoiceType> choiceType = entityType.getChoiceType();
        if (!choiceType.isEmpty()) {
            IDPSSODescriptorType idpDescriptor = null;
            // So we need to loop through to find the IDPSSODescriptor.
            for (EntityDescriptorType.EDTChoiceType edtChoiceType : entityType.getChoiceType()) {
                List<EntityDescriptorType.EDTDescriptorChoiceType> descriptors = edtChoiceType.getDescriptors();
                if (!descriptors.isEmpty() && descriptors.get(0).getIdpDescriptor() != null) {
                    idpDescriptor = descriptors.get(0).getIdpDescriptor();
                }
            }
            if (idpDescriptor != null) {
                SAMLIdentityProviderConfig samlIdentityProviderConfig = new SAMLIdentityProviderConfig();
                String singleSignOnServiceUrl = null;
                boolean postBindingResponse = false;
                boolean postBindingLogout = false;
                for (EndpointType endpoint : idpDescriptor.getSingleSignOnService()) {
                    if (endpoint.getBinding().toString().equals(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get())) {
                        singleSignOnServiceUrl = endpoint.getLocation().toString();
                        postBindingResponse = true;
                        break;
                    } else if (endpoint.getBinding().toString().equals(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get())) {
                        singleSignOnServiceUrl = endpoint.getLocation().toString();
                    }
                }
                String singleLogoutServiceUrl = null;
                for (EndpointType endpoint : idpDescriptor.getSingleLogoutService()) {
                    if (postBindingResponse && endpoint.getBinding().toString().equals(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get())) {
                        singleLogoutServiceUrl = endpoint.getLocation().toString();
                        postBindingLogout = true;
                        break;
                    } else if (!postBindingResponse && endpoint.getBinding().toString().equals(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get())) {
                        singleLogoutServiceUrl = endpoint.getLocation().toString();
                        break;
                    }
                }
                samlIdentityProviderConfig.setSingleLogoutServiceUrl(singleLogoutServiceUrl);
                samlIdentityProviderConfig.setSingleSignOnServiceUrl(singleSignOnServiceUrl);
                samlIdentityProviderConfig.setWantAuthnRequestsSigned(idpDescriptor.isWantAuthnRequestsSigned());
                samlIdentityProviderConfig.setAddExtensionsElementWithKeyInfo(false);
                samlIdentityProviderConfig.setValidateSignature(idpDescriptor.isWantAuthnRequestsSigned());
                samlIdentityProviderConfig.setPostBindingResponse(postBindingResponse);
                samlIdentityProviderConfig.setPostBindingAuthnRequest(postBindingResponse);
                samlIdentityProviderConfig.setPostBindingLogout(postBindingLogout);
                samlIdentityProviderConfig.setLoginHint(false);
                List<String> nameIdFormatList = idpDescriptor.getNameIDFormat();
                if (nameIdFormatList != null && !nameIdFormatList.isEmpty())
                    samlIdentityProviderConfig.setNameIDPolicyFormat(nameIdFormatList.get(0));
                List<KeyDescriptorType> keyDescriptor = idpDescriptor.getKeyDescriptor();
                String defaultCertificate = null;
                if (keyDescriptor != null) {
                    for (KeyDescriptorType keyDescriptorType : keyDescriptor) {
                        Element keyInfo = keyDescriptorType.getKeyInfo();
                        Element x509KeyInfo = DocumentUtil.getChildElement(keyInfo, new QName("dsig", "X509Certificate"));
                        if (KeyTypes.SIGNING.equals(keyDescriptorType.getUse())) {
                            samlIdentityProviderConfig.addSigningCertificate(x509KeyInfo.getTextContent());
                        } else if (KeyTypes.ENCRYPTION.equals(keyDescriptorType.getUse())) {
                            samlIdentityProviderConfig.setEncryptionPublicKey(x509KeyInfo.getTextContent());
                        } else if (keyDescriptorType.getUse() == null) {
                            defaultCertificate = x509KeyInfo.getTextContent();
                        }
                    }
                }
                if (defaultCertificate != null) {
                    if (samlIdentityProviderConfig.getSigningCertificates().length == 0) {
                        samlIdentityProviderConfig.addSigningCertificate(defaultCertificate);
                    }
                    if (samlIdentityProviderConfig.getEncryptionPublicKey() == null) {
                        samlIdentityProviderConfig.setEncryptionPublicKey(defaultCertificate);
                    }
                }
                samlIdentityProviderConfig.setEnabledFromMetadata(entityType.getValidUntil() == null || entityType.getValidUntil().toGregorianCalendar().getTime().after(new Date(System.currentTimeMillis())));
                // check for hide on login attribute
                if (entityType.getExtensions() != null && entityType.getExtensions().getEntityAttributes() != null) {
                    for (AttributeType attribute : entityType.getExtensions().getEntityAttributes().getAttribute()) {
                        if (MACEDIR_ENTITY_CATEGORY.equals(attribute.getName()) && attribute.getAttributeValue().contains(REFEDS_HIDE_FROM_DISCOVERY)) {
                            samlIdentityProviderConfig.setHideOnLogin(true);
                        }
                    }
                }
                return samlIdentityProviderConfig.getConfig();
            }
        }
    } catch (ParsingException pe) {
        throw new RuntimeException("Could not parse IdP SAML Metadata", pe);
    }
    return new HashMap<>();
}

Example 9 with KeyDescriptorType

use of org.keycloak.dom.saml.v2.metadata.KeyDescriptorType in project keycloak by keycloak.

the class SPMetadataDescriptor method buildSPdescriptor.

public static EntityDescriptorType buildSPdescriptor(URI loginBinding, URI logoutBinding, URI assertionEndpoint, URI logoutEndpoint, boolean wantAuthnRequestsSigned, boolean wantAssertionsSigned, boolean wantAssertionsEncrypted, String entityId, String nameIDPolicyFormat, List<Element> signingCerts, List<Element> encryptionCerts) {
    EntityDescriptorType entityDescriptor = new EntityDescriptorType(entityId);
    entityDescriptor.setID(IDGenerator.create("ID_"));
    SPSSODescriptorType spSSODescriptor = new SPSSODescriptorType(Arrays.asList(PROTOCOL_NSURI.get()));
    spSSODescriptor.setAuthnRequestsSigned(wantAuthnRequestsSigned);
    spSSODescriptor.setWantAssertionsSigned(wantAssertionsSigned);
    spSSODescriptor.addNameIDFormat(nameIDPolicyFormat);
    spSSODescriptor.addSingleLogoutService(new EndpointType(logoutBinding, logoutEndpoint));
    if (wantAuthnRequestsSigned && signingCerts != null) {
        for (Element key : signingCerts) {
            KeyDescriptorType keyDescriptor = new KeyDescriptorType();
            keyDescriptor.setUse(KeyTypes.SIGNING);
            keyDescriptor.setKeyInfo(key);
            spSSODescriptor.addKeyDescriptor(keyDescriptor);
        }
    }
    if (wantAssertionsEncrypted && encryptionCerts != null) {
        for (Element key : encryptionCerts) {
            KeyDescriptorType keyDescriptor = new KeyDescriptorType();
            keyDescriptor.setUse(KeyTypes.ENCRYPTION);
            keyDescriptor.setKeyInfo(key);
            spSSODescriptor.addKeyDescriptor(keyDescriptor);
        }
    }
    IndexedEndpointType assertionConsumerEndpoint = new IndexedEndpointType(loginBinding, assertionEndpoint);
    assertionConsumerEndpoint.setIsDefault(true);
    assertionConsumerEndpoint.setIndex(1);
    spSSODescriptor.addAssertionConsumerService(assertionConsumerEndpoint);
    entityDescriptor.addChoiceType(new EntityDescriptorType.EDTChoiceType(Arrays.asList(new EntityDescriptorType.EDTDescriptorChoiceType(spSSODescriptor))));
    return entityDescriptor;
}

Example 10 with KeyDescriptorType

use of org.keycloak.dom.saml.v2.metadata.KeyDescriptorType in project keycloak by keycloak.

the class SAMLKeyDescriptorParser method instantiateElement.

@Override
protected KeyDescriptorType instantiateElement(XMLEventReader xmlEventReader, StartElement element) throws ParsingException {
    KeyDescriptorType keyDescriptor = new KeyDescriptorType();
    String use = StaxParserUtil.getAttributeValue(element, SAMLMetadataQNames.ATTR_USE);
    if (use != null && !use.isEmpty()) {
        keyDescriptor.setUse(KeyTypes.fromValue(use));
    }
    return keyDescriptor;
}