Examples with Issuer org.opensaml.saml.saml2.core.Issuer used on opensource projects

Example 41 with Issuer

use of org.opensaml.saml.saml2.core.Issuer in project pac4j by pac4j.

the class SAML2LogoutResponseValidator method validateSamlProtocolResponse.

/**
 * Validates the SAML protocol response:
 *  - IssueInstant
 *  - Issuer
 *  - StatusCode
 *  - Signature
 *
 * @param response the response
 * @param context the context
 * @param engine the engine
 */
protected final void validateSamlProtocolResponse(final Response response, final SAML2MessageContext context, final SignatureTrustEngine engine) {
    if (!StatusCode.SUCCESS.equals(response.getStatus().getStatusCode().getValue())) {
        String status = response.getStatus().getStatusCode().getValue();
        if (response.getStatus().getStatusMessage() != null) {
            status += " / " + response.getStatus().getStatusMessage().getMessage();
        }
        throw new SAMLException("Logout response is not success ; actual " + status);
    }
    if (response.getSignature() != null) {
        final String entityId = context.getSAMLPeerEntityContext().getEntityId();
        validateSignature(response.getSignature(), entityId, engine);
        context.getSAMLPeerEntityContext().setAuthenticated(true);
    }
    if (!isIssueInstantValid(response.getIssueInstant())) {
        throw new SAMLIssueInstantException("Response issue instant is too old or in the future");
    }
    final SAMLMessageStorage messageStorage = context.getSAMLMessageStorage();
    if (messageStorage != null && response.getInResponseTo() != null) {
        final XMLObject xmlObject = messageStorage.retrieveMessage(response.getInResponseTo());
        if (xmlObject == null) {
            throw new SAMLInResponseToMismatchException("InResponseToField of the Response doesn't correspond to sent message " + response.getInResponseTo());
        } else if (!(xmlObject instanceof LogoutRequest)) {
            throw new SAMLInResponseToMismatchException("Sent request was of different type than the expected LogoutRequest " + response.getInResponseTo());
        }
    }
    verifyEndpoint(context.getSAMLEndpointContext().getEndpoint(), response.getDestination());
    if (response.getIssuer() != null) {
        validateIssuer(response.getIssuer(), context);
    }
}

Example 42 with Issuer

use of org.opensaml.saml.saml2.core.Issuer in project testcases by coheigea.

the class SAML2PResponseComponentBuilder method createSAMLResponse.

@SuppressWarnings("unchecked")
public static Response createSAMLResponse(String inResponseTo, String issuer, Status status) {
    if (responseBuilder == null) {
        responseBuilder = (SAMLObjectBuilder<Response>) builderFactory.getBuilder(Response.DEFAULT_ELEMENT_NAME);
    }
    Response response = responseBuilder.buildObject();
    response.setID(UUID.randomUUID().toString());
    response.setIssueInstant(new DateTime());
    response.setInResponseTo(inResponseTo);
    response.setIssuer(createIssuer(issuer));
    response.setStatus(status);
    response.setVersion(SAMLVersion.VERSION_20);
    return response;
}

Example 43 with Issuer

use of org.opensaml.saml.saml2.core.Issuer in project spring-security by spring-projects.

the class OpenSamlAuthenticationRequestFactory method createAuthnRequest.

private AuthnRequest createAuthnRequest(Saml2AuthenticationRequestContext context) {
    String issuer = context.getIssuer();
    String destination = context.getDestination();
    String assertionConsumerServiceUrl = context.getAssertionConsumerServiceUrl();
    Saml2MessageBinding protocolBinding = this.protocolBindingResolver.convert(context);
    AuthnRequest auth = this.authnRequestBuilder.buildObject();
    if (auth.getID() == null) {
        auth.setID("ARQ" + UUID.randomUUID().toString().substring(1));
    }
    if (auth.getIssueInstant() == null) {
        auth.setIssueInstant(new DateTime(this.clock.millis()));
    }
    if (auth.isForceAuthn() == null) {
        auth.setForceAuthn(Boolean.FALSE);
    }
    if (auth.isPassive() == null) {
        auth.setIsPassive(Boolean.FALSE);
    }
    if (auth.getProtocolBinding() == null) {
        auth.setProtocolBinding(protocolBinding.getUrn());
    }
    Issuer iss = this.issuerBuilder.buildObject();
    iss.setValue(issuer);
    auth.setIssuer(iss);
    auth.setDestination(destination);
    auth.setAssertionConsumerServiceURL(assertionConsumerServiceUrl);
    return auth;
}

Example 44 with Issuer

use of org.opensaml.saml.saml2.core.Issuer in project spring-security by spring-projects.

the class TestOpenSamlObjects method assertion.

static Assertion assertion(String username, String issuerEntityId, String recipientEntityId, String recipientUri) {
    Assertion assertion = build(Assertion.DEFAULT_ELEMENT_NAME);
    assertion.setID("A" + UUID.randomUUID().toString());
    assertion.setVersion(SAMLVersion.VERSION_20);
    assertion.setIssuer(issuer(issuerEntityId));
    assertion.setSubject(subject(username));
    assertion.setConditions(conditions());
    SubjectConfirmation subjectConfirmation = subjectConfirmation();
    subjectConfirmation.setMethod(SubjectConfirmation.METHOD_BEARER);
    SubjectConfirmationData confirmationData = subjectConfirmationData(recipientEntityId);
    confirmationData.setRecipient(recipientUri);
    subjectConfirmation.setSubjectConfirmationData(confirmationData);
    assertion.getSubject().getSubjectConfirmations().add(subjectConfirmation);
    AuthnStatement statement = build(AuthnStatement.DEFAULT_ELEMENT_NAME);
    statement.setSessionIndex("session-index");
    assertion.getAuthnStatements().add(statement);
    return assertion;
}

Example 45 with Issuer

use of org.opensaml.saml.saml2.core.Issuer in project spring-security by spring-projects.

the class OpenSaml4AuthenticationProvider method process.

private void process(Saml2AuthenticationToken token, Response response) {
    String issuer = response.getIssuer().getValue();
    this.logger.debug(LogMessage.format("Processing SAML response from %s", issuer));
    boolean responseSigned = response.isSigned();
    ResponseToken responseToken = new ResponseToken(response, token);
    Saml2ResponseValidatorResult result = this.responseSignatureValidator.convert(responseToken);
    if (responseSigned) {
        this.responseElementsDecrypter.accept(responseToken);
    } else if (!response.getEncryptedAssertions().isEmpty()) {
        result = result.concat(new Saml2Error(Saml2ErrorCodes.INVALID_SIGNATURE, "Did not decrypt response [" + response.getID() + "] since it is not signed"));
    }
    result = result.concat(this.responseValidator.convert(responseToken));
    boolean allAssertionsSigned = true;
    for (Assertion assertion : response.getAssertions()) {
        AssertionToken assertionToken = new AssertionToken(assertion, token);
        result = result.concat(this.assertionSignatureValidator.convert(assertionToken));
        allAssertionsSigned = allAssertionsSigned && assertion.isSigned();
        if (responseSigned || assertion.isSigned()) {
            this.assertionElementsDecrypter.accept(new AssertionToken(assertion, token));
        }
        result = result.concat(this.assertionValidator.convert(assertionToken));
    }
    if (!responseSigned && !allAssertionsSigned) {
        String description = "Either the response or one of the assertions is unsigned. " + "Please either sign the response or all of the assertions.";
        result = result.concat(new Saml2Error(Saml2ErrorCodes.INVALID_SIGNATURE, description));
    }
    Assertion firstAssertion = CollectionUtils.firstElement(response.getAssertions());
    if (firstAssertion != null && !hasName(firstAssertion)) {
        Saml2Error error = new Saml2Error(Saml2ErrorCodes.SUBJECT_NOT_FOUND, "Assertion [" + firstAssertion.getID() + "] is missing a subject");
        result = result.concat(error);
    }
    if (result.hasErrors()) {
        Collection<Saml2Error> errors = result.getErrors();
        if (this.logger.isTraceEnabled()) {
            this.logger.debug("Found " + errors.size() + " validation errors in SAML response [" + response.getID() + "]: " + errors);
        } else if (this.logger.isDebugEnabled()) {
            this.logger.debug("Found " + errors.size() + " validation errors in SAML response [" + response.getID() + "]");
        }
        Saml2Error first = errors.iterator().next();
        throw createAuthenticationException(first.getErrorCode(), first.getDescription(), null);
    } else {
        if (this.logger.isDebugEnabled()) {
            this.logger.debug("Successfully processed SAML Response [" + response.getID() + "]");
        }
    }
}