Examples with SAMLException org.opensaml.common.SAMLException used on opensource projects

Example 6 with SAMLException

use of org.opensaml.common.SAMLException in project cloud-pipeline by epam.

the class OptionalSAMLLogoutFilter method processLogout.

/**
 * In case request parameter of name "local" is set to true or there is no authenticated user
 * only local logout will be performed and user will be redirected to the success page.
 * Otherwise global logout procedure is initialized.
 *
 * @param request  http request
 * @param response http response
 * @param chain    chain
 * @throws IOException      error
 * @throws ServletException error
 */
public void processLogout(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
    if (requiresLogout(request, response)) {
        try {
            Authentication auth = SecurityContextHolder.getContext().getAuthentication();
            if (auth != null && isGlobalLogout(request, auth)) {
                Assert.isInstanceOf(SAMLCredential.class, auth.getCredentials(), "Authentication object doesn't contain SAML credential, cannot perform global logout");
                // Terminate the session first
                for (LogoutHandler handler : globalHandlers) {
                    handler.logout(request, response, auth);
                }
                // Notify session participants using SAML Single Logout profile
                SAMLCredential credential = (SAMLCredential) auth.getCredentials();
                request.setAttribute(SAMLConstants.LOCAL_ENTITY_ID, credential.getLocalEntityID());
                request.setAttribute(SAMLConstants.PEER_ENTITY_ID, credential.getRemoteEntityID());
                SAMLMessageContext context = contextProvider.getLocalAndPeerEntity(request, response);
                try {
                    profile.sendLogoutRequest(context, credential);
                    samlLogger.log(SAMLConstants.LOGOUT_REQUEST, SAMLConstants.SUCCESS, context);
                } catch (MetadataProviderException e) {
                    logger.debug(e.getMessage(), e);
                    super.doFilter(request, response, chain);
                }
            } else {
                super.doFilter(request, response, chain);
            }
        } catch (SAMLException e) {
            logger.debug("Error initializing global logout", e);
            throw new ServletException("Error initializing global logout", e);
        } catch (MetadataProviderException e) {
            logger.debug("Error processing metadata", e);
            throw new ServletException("Error processing metadata", e);
        } catch (MessageEncodingException e) {
            logger.debug("Error encoding outgoing message", e);
            throw new ServletException("Error encoding outgoing message", e);
        }
    } else {
        chain.doFilter(request, response);
    }
}

Example 7 with SAMLException

use of org.opensaml.common.SAMLException in project cloud-pipeline by epam.

the class SAMLProxyAuthenticationProvider method authenticate.

@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    SAMLProxyAuthentication auth = (SAMLProxyAuthentication) authentication;
    List<ExternalServiceEndpoint> externalServices = preferenceManager.getPreference(SYSTEM_EXTERNAL_SERVICES_ENDPOINTS);
    if (CollectionUtils.isEmpty(externalServices)) {
        throw new AuthenticationServiceException(messageHelper.getMessage(MessageConstants.ERROR_PROXY_SECURITY_CONFIG_MISSING));
    }
    if (StringUtils.isNotBlank(auth.getRawSamlResponse())) {
        try {
            Response decoded = CustomSamlClient.decodeSamlResponse(auth.getRawSamlResponse());
            String endpointId = // cut out SSO endpoint
            decoded.getDestination().substring(0, decoded.getDestination().length() - CustomSamlClient.SSO_ENDPOINT.length());
            Optional<ExternalServiceEndpoint> endpointOpt = externalServices.stream().filter(e -> e.getEndpointId().equals(endpointId)).findFirst();
            if (endpointOpt.isPresent()) {
                return validateAuthentication(auth, decoded, endpointId, endpointOpt.get());
            } else {
                throw new AuthenticationServiceException("Authentication error: unexpected external service");
            }
        } catch (SAMLException e) {
            throw new AuthenticationServiceException("Authentication error: ", e);
        }
    } else {
        throw new AuthenticationServiceException("Authentication error: missing SAML token");
    }
}

Example 8 with SAMLException

use of org.opensaml.common.SAMLException in project cloud-pipeline by epam.

the class CustomSamlClient method validateSignature.

private void validateSignature(Response response) throws SAMLException {
    Signature responseSignature = response.getSignature();
    Signature assertionSignature = response.getAssertions().get(0).getSignature();
    if (responseSignature == null && assertionSignature == null) {
        throw new SAMLException("No signature is present in either response or assertion");
    }
    if (responseSignature != null && !validate(responseSignature)) {
        throw new SAMLException("The response signature is invalid");
    }
    if (assertionSignature != null && !validate(assertionSignature)) {
        throw new SAMLException("The assertion signature is invalid");
    }
}

Example 9 with SAMLException

use of org.opensaml.common.SAMLException in project cloud-pipeline by epam.

the class SAMLProxyFilter method doFilterInternal.

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    if (!urlMatches(request)) {
        filterChain.doFilter(request, response);
        return;
    }
    List<ExternalServiceEndpoint> externalServices = preferenceManager.getPreference(SYSTEM_EXTERNAL_SERVICES_ENDPOINTS);
    if (CollectionUtils.isEmpty(externalServices)) {
        LOGGER.warn(messageHelper.getMessage(MessageConstants.ERROR_PROXY_SECURITY_CONFIG_MISSING));
    } else {
        String samlResponse = request.getParameter("SAMLResponse");
        if (StringUtils.isNotBlank(samlResponse)) {
            try {
                Response decoded = CustomSamlClient.decodeSamlResponse(samlResponse);
                String audience = ListUtils.emptyIfNull(decoded.getAssertions()).stream().findFirst().map(Assertion::getConditions).map(conditions -> ListUtils.emptyIfNull(conditions.getAudienceRestrictions()).stream().findFirst()).flatMap(Function.identity()).map(audienceRestriction -> ListUtils.emptyIfNull(audienceRestriction.getAudiences()).stream().findFirst()).flatMap(Function.identity()).map(Audience::getAudienceURI).orElse(StringUtils.EMPTY);
                LOGGER.debug("Received SAMLResponse for audience: {}", audience);
                Optional<ExternalServiceEndpoint> endpointOpt = externalServices.stream().filter(e -> !StringUtils.EMPTY.equals(audience) && e.getEndpointId().equals(audience)).findFirst();
                if (endpointOpt.isPresent()) {
                    authenticate(samlResponse, decoded, audience, endpointOpt.get());
                }
            } catch (SAMLException e) {
                LOGGER.warn(e.getMessage(), e);
            }
        }
    }
    filterChain.doFilter(request, response);
}

Example 10 with SAMLException

use of org.opensaml.common.SAMLException in project Insights by CognizantOneDevOps.

the class InsightsSAMLAuthenticationProviderImpl method authenticate.

/**
 * Used to authenticate initial SAML login request, It will redirect user to
 * service provider login URL and then fetch necessary user detail.
 * It also create ExpiringUsernameAuthenticationToken and set it in spring
 * security context
 */
@Override
public Authentication authenticate(Authentication authentication) {
    log.debug(" Inside InsightsSAMLAuthenticationProviderImpl === ");
    if (!supports(authentication.getClass())) {
        throw new IllegalArgumentException("Only SAMLAuthenticationToken is supported, " + authentication.getClass() + " was attempted");
    }
    SAMLAuthenticationToken token = (SAMLAuthenticationToken) authentication;
    SAMLMessageContext context = token.getCredentials();
    if (context == null) {
        throw new AuthenticationServiceException("SAML message context is not available in the authentication token");
    }
    SAMLCredential credential;
    try {
        if (SAMLConstants.SAML2_WEBSSO_PROFILE_URI.equals(context.getCommunicationProfileId())) {
            credential = consumer.processAuthenticationResponse(context);
        } else if (SAMLConstants.SAML2_HOK_WEBSSO_PROFILE_URI.equals(context.getCommunicationProfileId())) {
            credential = hokConsumer.processAuthenticationResponse(context);
        } else {
            throw new SAMLException("Unsupported profile encountered in the context " + context.getCommunicationProfileId());
        }
    } catch (SAMLRuntimeException e) {
        log.debug("Error validating SAML message ", e);
        samlLogger.log(SAMLConstants.AUTH_N_RESPONSE, SAMLConstants.FAILURE, context, e);
        throw new AuthenticationServiceException("Error validating SAML message.", e);
    } catch (SAMLException e) {
        log.debug("Error validating SAML message ", e);
        samlLogger.log(SAMLConstants.AUTH_N_RESPONSE, SAMLConstants.FAILURE, context, e);
        throw new AuthenticationServiceException("Error validating SAML message..", e);
    } catch (ValidationException e) {
        log.debug("Error validating signature ", e);
        samlLogger.log(SAMLConstants.AUTH_N_RESPONSE, SAMLConstants.FAILURE, context, e);
        throw new AuthenticationServiceException("Error validating SAML message signature", e);
    } catch (org.opensaml.xml.security.SecurityException e) {
        log.debug("Error validating signature", e);
        samlLogger.log(SAMLConstants.AUTH_N_RESPONSE, SAMLConstants.FAILURE, context, e);
        throw new AuthenticationServiceException("Error validating SAML message signature", e);
    } catch (DecryptionException e) {
        log.debug("Error decrypting SAML message", e);
        samlLogger.log(SAMLConstants.AUTH_N_RESPONSE, SAMLConstants.FAILURE, context, e);
        throw new AuthenticationServiceException("Error decrypting SAML message", e);
    }
    SamlUserDetails userDetails = (SamlUserDetails) getUserDetails(credential);
    Object principal = getPrincipal(credential, userDetails);
    List<GrantedAuthority> updatedAuthorities = new ArrayList<>();
    updatedAuthorities.add(SpringAuthority.valueOf("Viewer"));
    Date expiration = getExpirationDate(credential);
    SAMLCredential authenticationCredential = excludeCredential ? null : credential;
    ExpiringUsernameAuthenticationToken result = new ExpiringUsernameAuthenticationToken(expiration, principal, authenticationCredential, updatedAuthorities);
    result.setDetails(userDetails);
    samlLogger.log(SAMLConstants.AUTH_N_RESPONSE, SAMLConstants.SUCCESS, context, result, null);
    return result;
}