use of org.opensaml.saml.saml2.core.RequestedAuthnContext in project cxf by apache.
the class SamlpRequestComponentBuilder method createRequestedAuthnCtxPolicy.
@SuppressWarnings("unchecked")
public static RequestedAuthnContext createRequestedAuthnCtxPolicy(AuthnContextComparisonTypeEnumeration comparison, List<AuthnContextClassRef> authnCtxClassRefList, List<AuthnContextDeclRef> authnCtxDeclRefList) {
if (requestedAuthnCtxBuilder == null) {
requestedAuthnCtxBuilder = (SAMLObjectBuilder<RequestedAuthnContext>) builderFactory.getBuilder(RequestedAuthnContext.DEFAULT_ELEMENT_NAME);
}
RequestedAuthnContext authnCtx = requestedAuthnCtxBuilder.buildObject();
authnCtx.setComparison(comparison);
if (authnCtxClassRefList != null) {
List<AuthnContextClassRef> classRefList = authnCtx.getAuthnContextClassRefs();
classRefList.addAll(authnCtxClassRefList);
}
if (authnCtxDeclRefList != null) {
List<AuthnContextDeclRef> declRefList = authnCtx.getAuthnContextDeclRefs();
declRefList.addAll(authnCtxDeclRefList);
}
return authnCtx;
}
use of org.opensaml.saml.saml2.core.RequestedAuthnContext in project cas by apereo.
the class DefaultAuthnContextClassRefBuilder method build.
@Override
public String build(final Object assertion, final RequestAbstractType authnRequest, final SamlRegisteredServiceServiceProviderMetadataFacade adaptor, final SamlRegisteredService service) {
if (StringUtils.isNotBlank(service.getRequiredAuthenticationContextClass())) {
LOGGER.debug("Using [{}] as indicated by SAML registered service [{}]", service.getRequiredAuthenticationContextClass(), service.getName());
return service.getRequiredAuthenticationContextClass();
}
final String defClass = StringUtils.defaultIfBlank(casProperties.getAuthn().getSamlIdp().getResponse().getDefaultAuthenticationContextClass(), AuthnContext.PPT_AUTHN_CTX);
final RequestedAuthnContext requestedAuthnContext = (authnRequest instanceof AuthnRequest) ? AuthnRequest.class.cast(authnRequest).getRequestedAuthnContext() : null;
if (requestedAuthnContext == null) {
LOGGER.debug("No specific authN context is requested. Returning [{}]", defClass);
return defClass;
}
final List<AuthnContextClassRef> authnContextClassRefs = requestedAuthnContext.getAuthnContextClassRefs();
if (authnContextClassRefs == null || authnContextClassRefs.isEmpty()) {
LOGGER.debug("Requested authN context class ref is unspecified. Returning [{}]", defClass);
return defClass;
}
final String finalCtx = StringUtils.defaultIfBlank(getAuthenticationContextByAssertion(assertion, requestedAuthnContext, authnContextClassRefs), defClass);
LOGGER.debug("Returning authN context [{}]", finalCtx);
return finalCtx;
}
use of org.opensaml.saml.saml2.core.RequestedAuthnContext in project pac4j by pac4j.
the class SAML2AuthnRequestBuilder method buildAuthnRequest.
@SuppressWarnings("unchecked")
protected final AuthnRequest buildAuthnRequest(final SAML2MessageContext context, final AssertionConsumerService assertionConsumerService, final SingleSignOnService ssoService) {
final SAMLObjectBuilder<AuthnRequest> builder = (SAMLObjectBuilder<AuthnRequest>) this.builderFactory.getBuilder(AuthnRequest.DEFAULT_ELEMENT_NAME);
final AuthnRequest request = builder.buildObject();
if (comparisonType != null) {
final RequestedAuthnContext authnContext = new RequestedAuthnContextBuilder().buildObject();
authnContext.setComparison(comparisonType);
if (authnContextClassRef != null) {
final AuthnContextClassRef classRef = new AuthnContextClassRefBuilder().buildObject();
classRef.setAuthnContextClassRef(authnContextClassRef);
authnContext.getAuthnContextClassRefs().add(classRef);
}
request.setRequestedAuthnContext(authnContext);
}
final SAMLSelfEntityContext selfContext = context.getSAMLSelfEntityContext();
request.setID(generateID());
request.setIssuer(getIssuer(selfContext.getEntityId()));
request.setIssueInstant(DateTime.now(DateTimeZone.UTC).plusSeconds(this.issueInstantSkewSeconds));
request.setVersion(SAMLVersion.VERSION_20);
request.setIsPassive(this.passive);
request.setForceAuthn(this.forceAuth);
request.setProviderName("pac4j-saml");
if (nameIdPolicyFormat != null) {
final NameIDPolicy nameIdPolicy = new NameIDPolicyBuilder().buildObject();
nameIdPolicy.setAllowCreate(true);
nameIdPolicy.setFormat(nameIdPolicyFormat);
request.setNameIDPolicy(nameIdPolicy);
}
request.setDestination(ssoService.getLocation());
if (assertionConsumerServiceIndex >= 0) {
request.setAssertionConsumerServiceIndex(assertionConsumerServiceIndex);
} else {
request.setAssertionConsumerServiceURL(assertionConsumerService.getLocation());
}
request.setProtocolBinding(assertionConsumerService.getBinding());
if (attributeConsumingServiceIndex >= 0) {
request.setAttributeConsumingServiceIndex(attributeConsumingServiceIndex);
}
return request;
}
use of org.opensaml.saml.saml2.core.RequestedAuthnContext in project cas by apereo.
the class DefaultAuthnContextClassRefBuilder method getAuthenticationContextByAssertion.
/**
* Gets authentication context by assertion.
* This is more of a template method for the time being,
* and may be enhanced later to support more advanced parsing of classes
* from the assertion.
*
* @param context the context
* @param requestedAuthnContext the requested authn context
* @param authnContextClassRefs the authn context class refs
* @return the authentication context by assertion
*/
protected String getAuthenticationContextByAssertion(final SamlProfileBuilderContext context, final RequestedAuthnContext requestedAuthnContext, final List<AuthnContextClassRef> authnContextClassRefs) {
LOGGER.debug("AuthN Context comparison is requested to use [{}]", requestedAuthnContext.getComparison());
authnContextClassRefs.forEach(c -> LOGGER.debug("Requested AuthN Context [{}]", c.getURI()));
val authnContexts = casProperties.getAuthn().getSamlIdp().getCore().getAuthenticationContextClassMappings();
val definedContexts = CollectionUtils.convertDirectedListToMap(authnContexts);
val mappedMethod = authnContextClassRefs.stream().filter(ref -> StringUtils.isNotBlank(ref.getURI())).filter(ref -> definedContexts.containsKey(ref.getURI())).map(ref -> Pair.of(ref, definedContexts.get(ref.getURI()))).findFirst().orElse(null);
val attributes = context.getAuthenticatedAssertion().getAttributes();
val contextAttribute = casProperties.getAuthn().getMfa().getCore().getAuthenticationContextAttribute();
if (attributes.containsKey(contextAttribute) && mappedMethod != null) {
val authnContext = attributes.get(contextAttribute);
val satisfiedContext = CollectionUtils.firstElement(authnContext).map(Object::toString).orElse(null);
if (StringUtils.equals(mappedMethod.getValue(), satisfiedContext)) {
return mappedMethod.getLeft().getURI();
}
}
return null;
}
use of org.opensaml.saml.saml2.core.RequestedAuthnContext in project cxf by apache.
the class DefaultAuthnRequestBuilder method createAuthnRequest.
/**
* Create a SAML 2.0 Protocol AuthnRequest
*/
public AuthnRequest createAuthnRequest(Message message, String issuerId, String assertionConsumerServiceAddress) throws Exception {
Issuer issuer = SamlpRequestComponentBuilder.createIssuer(issuerId);
NameIDPolicy nameIDPolicy = SamlpRequestComponentBuilder.createNameIDPolicy(true, nameIDFormat, issuerId);
AuthnContextClassRef authnCtxClassRef = SamlpRequestComponentBuilder.createAuthnCtxClassRef("urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport");
RequestedAuthnContext authnCtx = SamlpRequestComponentBuilder.createRequestedAuthnCtxPolicy(AuthnContextComparisonTypeEnumeration.EXACT, Collections.singletonList(authnCtxClassRef), null);
// CHECKSTYLE:OFF
return SamlpRequestComponentBuilder.createAuthnRequest(assertionConsumerServiceAddress, forceAuthn, isPassive, protocolBinding, SAMLVersion.VERSION_20, issuer, nameIDPolicy, authnCtx);
}
Aggregations