Examples with SigningMethod org.opensaml.saml.ext.saml2alg.SigningMethod used on opensource projects

Example 1 with SigningMethod

use of org.opensaml.saml.ext.saml2alg.SigningMethod in project spring-security by spring-projects.

the class OpenSamlMetadataAssertingPartyDetailsConverter method signingMethods.

private List<SigningMethod> signingMethods(IDPSSODescriptor idpssoDescriptor) {
    Extensions extensions = idpssoDescriptor.getExtensions();
    List<SigningMethod> result = signingMethods(extensions);
    if (!result.isEmpty()) {
        return result;
    }
    EntityDescriptor descriptor = (EntityDescriptor) idpssoDescriptor.getParent();
    extensions = descriptor.getExtensions();
    return signingMethods(extensions);
}

Example 2 with SigningMethod

use of org.opensaml.saml.ext.saml2alg.SigningMethod in project midpoint by Evolveum.

the class MidpointAssertingPartyMetadataConverter method convert.

public RelyingPartyRegistration.Builder convert(InputStream inputStream, Saml2ProviderAuthenticationModuleType providerConfig) {
    EntityDescriptor descriptor = entityDescriptor(inputStream);
    IDPSSODescriptor idpssoDescriptor = descriptor.getIDPSSODescriptor(SAMLConstants.SAML20P_NS);
    if (idpssoDescriptor == null) {
        throw new Saml2Exception("Metadata response is missing the necessary IDPSSODescriptor element");
    }
    List<Saml2X509Credential> verification = new ArrayList<>();
    List<Saml2X509Credential> encryption = new ArrayList<>();
    for (KeyDescriptor keyDescriptor : idpssoDescriptor.getKeyDescriptors()) {
        defineKeys(keyDescriptor, verification, encryption);
    }
    if (verification.isEmpty()) {
        throw new Saml2Exception("Metadata response is missing verification certificates, necessary for verifying SAML assertions");
    }
    RelyingPartyRegistration.Builder builder = RelyingPartyRegistration.withRegistrationId(descriptor.getEntityID()).assertingPartyDetails((party) -> party.entityId(descriptor.getEntityID()).wantAuthnRequestsSigned(Boolean.TRUE.equals(idpssoDescriptor.getWantAuthnRequestsSigned())).verificationX509Credentials((c) -> c.addAll(verification)).encryptionX509Credentials((c) -> c.addAll(encryption)));
    List<SigningMethod> signingMethods = signingMethods(idpssoDescriptor);
    for (SigningMethod method : signingMethods) {
        builder.assertingPartyDetails((party) -> party.signingAlgorithms((algorithms) -> algorithms.add(method.getAlgorithm())));
    }
    defineSingleSingOnService(idpssoDescriptor, providerConfig.getAuthenticationRequestBinding(), builder);
    defineSingleLogoutService(idpssoDescriptor, builder);
    return builder;
}

Example 3 with SigningMethod

use of org.opensaml.saml.ext.saml2alg.SigningMethod in project spring-security by spring-projects.

the class OpenSamlMetadataAssertingPartyDetailsConverter method convert.

RelyingPartyRegistration.AssertingPartyDetails.Builder convert(EntityDescriptor descriptor) {
    IDPSSODescriptor idpssoDescriptor = descriptor.getIDPSSODescriptor(SAMLConstants.SAML20P_NS);
    if (idpssoDescriptor == null) {
        throw new Saml2Exception("Metadata response is missing the necessary IDPSSODescriptor element");
    }
    List<Saml2X509Credential> verification = new ArrayList<>();
    List<Saml2X509Credential> encryption = new ArrayList<>();
    for (KeyDescriptor keyDescriptor : idpssoDescriptor.getKeyDescriptors()) {
        if (keyDescriptor.getUse().equals(UsageType.SIGNING)) {
            List<X509Certificate> certificates = certificates(keyDescriptor);
            for (X509Certificate certificate : certificates) {
                verification.add(Saml2X509Credential.verification(certificate));
            }
        }
        if (keyDescriptor.getUse().equals(UsageType.ENCRYPTION)) {
            List<X509Certificate> certificates = certificates(keyDescriptor);
            for (X509Certificate certificate : certificates) {
                encryption.add(Saml2X509Credential.encryption(certificate));
            }
        }
        if (keyDescriptor.getUse().equals(UsageType.UNSPECIFIED)) {
            List<X509Certificate> certificates = certificates(keyDescriptor);
            for (X509Certificate certificate : certificates) {
                verification.add(Saml2X509Credential.verification(certificate));
                encryption.add(Saml2X509Credential.encryption(certificate));
            }
        }
    }
    if (verification.isEmpty()) {
        throw new Saml2Exception("Metadata response is missing verification certificates, necessary for verifying SAML assertions");
    }
    RelyingPartyRegistration.AssertingPartyDetails.Builder party = OpenSamlAssertingPartyDetails.withEntityDescriptor(descriptor).entityId(descriptor.getEntityID()).wantAuthnRequestsSigned(Boolean.TRUE.equals(idpssoDescriptor.getWantAuthnRequestsSigned())).verificationX509Credentials((c) -> c.addAll(verification)).encryptionX509Credentials((c) -> c.addAll(encryption));
    List<SigningMethod> signingMethods = signingMethods(idpssoDescriptor);
    for (SigningMethod method : signingMethods) {
        party.signingAlgorithms((algorithms) -> algorithms.add(method.getAlgorithm()));
    }
    if (idpssoDescriptor.getSingleSignOnServices().isEmpty()) {
        throw new Saml2Exception("Metadata response is missing a SingleSignOnService, necessary for sending AuthnRequests");
    }
    for (SingleSignOnService singleSignOnService : idpssoDescriptor.getSingleSignOnServices()) {
        Saml2MessageBinding binding;
        if (singleSignOnService.getBinding().equals(Saml2MessageBinding.POST.getUrn())) {
            binding = Saml2MessageBinding.POST;
        } else if (singleSignOnService.getBinding().equals(Saml2MessageBinding.REDIRECT.getUrn())) {
            binding = Saml2MessageBinding.REDIRECT;
        } else {
            continue;
        }
        party.singleSignOnServiceLocation(singleSignOnService.getLocation()).singleSignOnServiceBinding(binding);
        break;
    }
    for (SingleLogoutService singleLogoutService : idpssoDescriptor.getSingleLogoutServices()) {
        Saml2MessageBinding binding;
        if (singleLogoutService.getBinding().equals(Saml2MessageBinding.POST.getUrn())) {
            binding = Saml2MessageBinding.POST;
        } else if (singleLogoutService.getBinding().equals(Saml2MessageBinding.REDIRECT.getUrn())) {
            binding = Saml2MessageBinding.REDIRECT;
        } else {
            continue;
        }
        String responseLocation = (singleLogoutService.getResponseLocation() == null) ? singleLogoutService.getLocation() : singleLogoutService.getResponseLocation();
        party.singleLogoutServiceLocation(singleLogoutService.getLocation()).singleLogoutServiceResponseLocation(responseLocation).singleLogoutServiceBinding(binding);
        break;
    }
    return party;
}