Examples with org.opensaml.saml.saml2.metadata org.opensaml.saml.saml2.metadata used on opensource projects

Example 56 with org.opensaml.saml.saml2.metadata

use of org.opensaml.saml.saml2.metadata in project pac4j by pac4j.

the class SAML2WebSSOMessageReceiver method receiveMessage.

@Override
public Credentials receiveMessage(final SAML2MessageContext context) {
    final SAMLPeerEntityContext peerContext = context.getSAMLPeerEntityContext();
    peerContext.setRole(IDPSSODescriptor.DEFAULT_ELEMENT_NAME);
    context.getSAMLSelfProtocolContext().setProtocol(SAMLConstants.SAML20P_NS);
    final Pac4jHTTPPostDecoder decoder = new Pac4jHTTPPostDecoder(context.getWebContext());
    try {
        decoder.setParserPool(Configuration.getParserPool());
        decoder.initialize();
        decoder.decode();
    } catch (final Exception e) {
        throw new SAMLException("Error decoding saml message", e);
    }
    final SAML2MessageContext decodedCtx = new SAML2MessageContext(decoder.getMessageContext());
    decodedCtx.setMessage(decoder.getMessageContext().getMessage());
    decodedCtx.setSAMLMessageStorage(context.getSAMLMessageStorage());
    final SAMLBindingContext bindingContext = decodedCtx.getParent().getSubcontext(SAMLBindingContext.class);
    decodedCtx.getSAMLBindingContext().setBindingDescriptor(bindingContext.getBindingDescriptor());
    decodedCtx.getSAMLBindingContext().setBindingUri(bindingContext.getBindingUri());
    decodedCtx.getSAMLBindingContext().setHasBindingSignature(bindingContext.hasBindingSignature());
    decodedCtx.getSAMLBindingContext().setIntendedDestinationEndpointURIRequired(bindingContext.isIntendedDestinationEndpointURIRequired());
    decodedCtx.getSAMLBindingContext().setRelayState(bindingContext.getRelayState());
    final AssertionConsumerService acsService = context.getSPAssertionConsumerService();
    decodedCtx.getSAMLEndpointContext().setEndpoint(acsService);
    final EntityDescriptor metadata = context.getSAMLPeerMetadataContext().getEntityDescriptor();
    if (metadata == null) {
        throw new SAMLException("IDP Metadata cannot be null");
    }
    decodedCtx.getSAMLPeerEntityContext().setEntityId(metadata.getEntityID());
    decodedCtx.getSAMLSelfEntityContext().setEntityId(context.getSAMLSelfEntityContext().getEntityId());
    decodedCtx.getSAMLSelfEndpointContext().setEndpoint(context.getSAMLSelfEndpointContext().getEndpoint());
    decodedCtx.getSAMLSelfEntityContext().setRole(context.getSAMLSelfEntityContext().getRole());
    decodedCtx.getProfileRequestContext().setProfileId(SAML2_WEBSSO_PROFILE_URI);
    decodedCtx.getSAMLSelfMetadataContext().setRoleDescriptor(context.getSPSSODescriptor());
    return this.validator.validate(decodedCtx);
}

Example 57 with org.opensaml.saml.saml2.metadata

use of org.opensaml.saml.saml2.metadata in project pac4j by pac4j.

the class SAML2IdentityProviderMetadataResolver method resolve.

@Override
public final MetadataResolver resolve() {
    // Usage of locks will adversly impact performance.
    if (idpMetadataProvider != null) {
        return idpMetadataProvider;
    }
    try {
        if (this.idpMetadataResource == null) {
            throw new XMLParserException("idp metadata cannot be resolved from " + this.idpMetadataResource);
        }
        try (final InputStream in = this.idpMetadataResource.getInputStream()) {
            final Document inCommonMDDoc = Configuration.getParserPool().parse(in);
            final Element metadataRoot = inCommonMDDoc.getDocumentElement();
            idpMetadataProvider = new DOMMetadataResolver(metadataRoot);
            idpMetadataProvider.setParserPool(Configuration.getParserPool());
            idpMetadataProvider.setFailFastInitialization(true);
            idpMetadataProvider.setRequireValidMetadata(true);
            idpMetadataProvider.setId(idpMetadataProvider.getClass().getCanonicalName());
            idpMetadataProvider.initialize();
        } catch (final FileNotFoundException e) {
            throw new TechnicalException("Error loading idp Metadata");
        }
        // If no idpEntityId declared, select first EntityDescriptor entityId as our IDP entityId
        if (this.idpEntityId == null) {
            final Iterator<EntityDescriptor> it = idpMetadataProvider.iterator();
            while (it.hasNext()) {
                final EntityDescriptor entityDescriptor = it.next();
                if (this.idpEntityId == null) {
                    this.idpEntityId = entityDescriptor.getEntityID();
                }
            }
        }
        if (this.idpEntityId == null) {
            throw new SAMLException("No idp entityId found");
        }
    } catch (final ComponentInitializationException e) {
        throw new SAMLException("Error initializing idpMetadataProvider", e);
    } catch (final XMLParserException e) {
        throw new TechnicalException("Error parsing idp Metadata", e);
    } catch (final IOException e) {
        throw new TechnicalException("Error getting idp Metadata resource", e);
    }
    return idpMetadataProvider;
}

Example 58 with org.opensaml.saml.saml2.metadata

use of org.opensaml.saml.saml2.metadata in project jbossws-cxf by jbossws.

the class WSMexTestCase method testEndpoint.

@Test
@RunAsClient
public void testEndpoint() throws Exception {
    JaxWsProxyFactoryBean proxyFac = new JaxWsProxyFactoryBean();
    proxyFac.setAddress(baseURL + "/jaxws-cxf-wsmex/EndpointService");
    MetadataExchange exc = proxyFac.create(MetadataExchange.class);
    Metadata metadata = exc.get2004();
    assertNotNull(metadata);
    assertEquals(1, metadata.getMetadataSection().size());
    MetadataSection ms = metadata.getMetadataSection().get(0);
    assertEquals("http://schemas.xmlsoap.org/wsdl/", ms.getDialect());
    assertEquals("http://org.jboss.ws/cxf/wsmex", ms.getIdentifier());
    String wsdl = DOMWriter.printNode((Node) ms.getAny(), true);
    assertTrue(wsdl.contains("EndpointBeanServiceSoapBinding"));
}

Example 59 with org.opensaml.saml.saml2.metadata

use of org.opensaml.saml.saml2.metadata in project timbuctoo by HuygensING.

the class TimbuctooV4 method run.

@Override
public void run(TimbuctooConfiguration configuration, Environment environment) throws Exception {
    // environment.jersey().property(ServerProperties.TRACING, "ALL");
    // // environment.jersey().property(ServerProperties.TRACING_THRESHOLD, "VERBOSE");
    // Make sure we know what version is running
    Properties properties = new Properties();
    InputStream gitproperties = getClass().getClassLoader().getResourceAsStream("git.properties");
    String currentVersion;
    if (gitproperties != null) {
        properties.load(gitproperties);
        currentVersion = properties.getProperty("git.commit.id");
    } else {
        currentVersion = "NO-GIT-PROPERTIES-FOUND";
        LoggerFactory.getLogger(this.getClass()).error("NO-GIT-PROPERTIES-FOUND");
    }
    LoggerFactory.getLogger(this.getClass()).info("Now launching timbuctoo version: " + currentVersion);
    HttpClientBuilder apacheHttpClientBuilder = new HttpClientBuilder(environment).using(configuration.getHttpClientConfiguration());
    CloseableHttpClient httpClient = apacheHttpClientBuilder.build("httpclient");
    // Support services
    SecurityFactory securityConfig = configuration.getSecurityConfiguration().createNewSecurityFactory(httpClient);
    securityConfig.getHealthChecks().forEachRemaining(check -> {
        register(environment, check.getLeft(), new LambdaHealthCheck(check.getRight()));
    });
    // Database migration
    LinkedHashMap<String, DatabaseMigration> migrations = new LinkedHashMap<>();
    migrations.put("fix-dcarkeywords-displayname-migration", new FixDcarKeywordDisplayNameMigration());
    migrations.put("fix-pids-migration", new MakePidsAbsoluteUrls());
    UriHelper uriHelper = configuration.getUriHelper();
    environment.lifecycle().addServerLifecycleListener(new BaseUriDeriver(configuration));
    TinkerPopConfig tinkerPopConfig = configuration.getDatabaseConfiguration();
    final TinkerPopGraphManager graphManager = new TinkerPopGraphManager(tinkerPopConfig, migrations);
    final PersistenceManager persistenceManager = configuration.getPersistenceManagerFactory().build();
    UrlGenerator uriToRedirectToFromPersistentUrls = (coll, id, rev) -> uriHelper.fromResourceUri(SingleEntity.makeUrl(coll, id, rev));
    final UrlGenerator pathWithoutVersionAndRevision = (coll, id, rev) -> URI.create(SingleEntity.makeUrl(coll, id, null).toString().replaceFirst("^/v2.1/", ""));
    final UrlGenerator uriWithoutRev = (coll, id, rev) -> uriHelper.fromResourceUri(SingleEntity.makeUrl(coll, id, null));
    HandleAdder handleAdder = new HandleAdder(persistenceManager, activeMqBundle);
    // TODO make function when TimbuctooActions does not depend on TransactionEnforcer anymore
    TimbuctooActions.TimbuctooActionsFactory timbuctooActionsFactory = new TimbuctooActions.TimbuctooActionsFactoryImpl(securityConfig.getPermissionFetcher(), Clock.systemDefaultZone(), handleAdder, uriToRedirectToFromPersistentUrls, () -> new TinkerPopOperations(graphManager));
    TransactionEnforcer transactionEnforcer = new TransactionEnforcer(timbuctooActionsFactory);
    graphManager.onGraph(g -> new ScaffoldMigrator(graphManager).execute());
    handleAdder.init(transactionEnforcer);
    final Vres vres = new DatabaseConfiguredVres(transactionEnforcer);
    migrations.put("prepare-for-bia-import-migration", new PrepareForBiaImportMigration(vres, graphManager));
    migrations.put("give-existing-relationtypes-rdf-uris", new RelationTypeRdfUriMigration());
    migrations.put("remove-search-results", new RemoveSearchResultsMigration());
    migrations.put("move-indices-to-isLatest-vertex", new MoveIndicesToIsLatestVertexMigration(vres));
    final ResourceSyncService resourceSyncService = new ResourceSyncService(httpClient, new ResourceSyncContext());
    final JsonMetadata jsonMetadata = new JsonMetadata(vres, graphManager);
    final AutocompleteService.AutocompleteServiceFactory autocompleteServiceFactory = new AutocompleteService.AutocompleteServiceFactory(uriWithoutRev);
    environment.lifecycle().manage(graphManager);
    final CrudServiceFactory crudServiceFactory = new CrudServiceFactory(vres, securityConfig.getUserValidator(), pathWithoutVersionAndRevision);
    final Webhooks webhooks = configuration.getWebhooks().getWebHook(environment);
    DataSetRepository dataSetRepository = configuration.getDataSetConfiguration().createRepository(environment.lifecycle().executorService("dataSet").build(), securityConfig.getPermissionFetcher(), configuration.getDatabases(), configuration.getRdfIdHelper(), (combinedId -> {
        try {
            webhooks.dataSetUpdated(combinedId);
        } catch (IOException e) {
            LOG.error("Webhook call failed", e);
        }
    }), configuration.dataSetsArePublicByDefault());
    environment.lifecycle().manage(new DataSetRepositoryManager(dataSetRepository));
    ErrorResponseHelper errorResponseHelper = new ErrorResponseHelper();
    AuthCheck authCheck = new AuthCheck(securityConfig.getUserValidator(), securityConfig.getPermissionFetcher(), dataSetRepository);
    register(environment, new RdfUpload(authCheck));
    register(environment, new TabularUpload(authCheck, dataSetRepository, errorResponseHelper));
    register(environment, new Rml(dataSetRepository, errorResponseHelper, securityConfig.getUserValidator()));
    SerializerWriterRegistry serializerWriterRegistry = new SerializerWriterRegistry(new CsvWriter(), new JsonLdWriter(), new JsonWriter(), new GraphVizWriter());
    final PaginationArgumentsHelper argHelper = new PaginationArgumentsHelper(configuration.getCollectionFilters());
    final GraphQl graphQlEndpoint = new GraphQl(new RootQuery(dataSetRepository, serializerWriterRegistry, configuration.getArchetypesSchema(), new RdfWiringFactory(dataSetRepository, argHelper, configuration.getDefaultSummaryProps()), new DerivedSchemaTypeGenerator(argHelper), environment.getObjectMapper()), serializerWriterRegistry, securityConfig.getUserValidator(), uriHelper, securityConfig.getPermissionFetcher(), dataSetRepository);
    register(environment, graphQlEndpoint);
    if (securityConfig instanceof TwitterSecurityFactory) {
        final TwitterLogin twitterLogin = new TwitterLogin();
        register(environment, twitterLogin);
    }
    register(environment, new JsonLdEditEndpoint(securityConfig.getUserValidator(), securityConfig.getPermissionFetcher(), dataSetRepository, new HttpClientBuilder(environment).build("json-ld")));
    register(environment, new RootEndpoint(uriHelper, configuration.getUserRedirectUrl()));
    if (securityConfig instanceof OldStyleSecurityFactory) {
        register(environment, new Authenticate(((OldStyleSecurityFactory) securityConfig).getLoggedInUsers()));
    }
    register(environment, new Me(securityConfig.getUserValidator()));
    register(environment, new Search(configuration, uriHelper, graphManager));
    register(environment, new Autocomplete(autocompleteServiceFactory, transactionEnforcer));
    register(environment, new Index(securityConfig.getUserValidator(), crudServiceFactory, transactionEnforcer));
    register(environment, new SingleEntity(securityConfig.getUserValidator(), crudServiceFactory, transactionEnforcer));
    register(environment, new SingleEntityNTriple(transactionEnforcer, uriHelper));
    register(environment, new WomenWritersEntityGet(crudServiceFactory, transactionEnforcer));
    register(environment, new LegacySingleEntityRedirect(uriHelper));
    register(environment, new LegacyIndexRedirect(uriHelper));
    register(environment, new Discover(resourceSyncService));
    if (configuration.isAllowGremlinEndpoint()) {
        register(environment, new Gremlin(graphManager));
    }
    register(environment, new Graph(graphManager, vres));
    register(environment, new RelationTypes(graphManager));
    register(environment, new Metadata());
    register(environment, new nl.knaw.huygens.timbuctoo.server.endpoints.v2.system.vres.Metadata(jsonMetadata));
    register(environment, new MyVres(securityConfig.getUserValidator(), securityConfig.getPermissionFetcher(), transactionEnforcer, uriHelper));
    register(environment, new ListVres(uriHelper, transactionEnforcer));
    register(environment, new VreImage(transactionEnforcer));
    final ExecutorService rfdExecutorService = environment.lifecycle().executorService("rdf-import").build();
    register(environment, new ImportRdf(graphManager, vres, rfdExecutorService, transactionEnforcer));
    register(environment, new Import(new ResourceSyncFileLoader(httpClient), authCheck));
    register(environment, new WellKnown());
    RsDocumentBuilder rsDocumentBuilder = new RsDocumentBuilder(dataSetRepository, configuration.getUriHelper());
    register(environment, new RsEndpoint(rsDocumentBuilder, securityConfig.getUserValidator()));
    // Admin resources
    if (securityConfig instanceof OldStyleSecurityFactory) {
        final OldStyleSecurityFactory oldStyleSecurityFactory = (OldStyleSecurityFactory) securityConfig;
        environment.admin().addTask(new UserCreationTask(new LocalUserCreator(oldStyleSecurityFactory.getLoginCreator(), oldStyleSecurityFactory.getUserCreator(), oldStyleSecurityFactory.getVreAuthorizationCreator())));
    }
    environment.admin().addTask(new DatabaseValidationTask(new DatabaseValidator(graphManager, new LabelsAddedToVertexDatabaseCheck(), new InvariantsCheck(vres), new FullTextIndexCheck()), Clock.systemUTC(), 5000));
    environment.admin().addTask(new DbLogCreatorTask(graphManager));
    environment.admin().addTask(new BdbDumpTask(configuration.getDatabases()));
    if (configuration.getDatabaseBackupper().isPresent()) {
        environment.admin().addTask(new StagingBackup(configuration.getDatabaseBackupper().get().create(configuration.getDatabaseConfiguration().getDatabasePath(), configuration.getDatabases().getDatabaseLocation())));
    }
    // register health checks
    // Dropwizard Health checks are used to check whether requests should be routed to this instance
    // For example, checking if neo4j is in a valid state is not a "HealthCheck" because if the database on one instance
    // is in an invalid state, then this applies to all other instances too. So once the database is in an invalid state
    // timbuctoo will be down.
    // 
    // checking whether this instance is part of the neo4j quorum is a good HealthCheck because running a database query
    // on those instances that are not part of the quorum will block forever, while the other instances will respond
    // just fine.
    register(environment, "Neo4j database connection", graphManager);
    // Log all http requests
    register(environment, new LoggingFilter(1024, currentVersion));
    register(environment, new TransactionFilter(graphManager));
    // Allow all CORS requests
    register(environment, new PromiscuousCorsFilter());
    // Add embedded AMQ (if any) to the metrics
    configuration.getLocalAmqJmxPath(HANDLE_QUEUE).ifPresent(rethrowConsumer(jmxPath -> {
        String dwMetricName = name(this.getClass(), "localAmq");
        ObjectName jmxMetricName = new ObjectName(jmxPath);
        environment.metrics().register(dwMetricName + ".enqueueCount", new JmxAttributeGauge(jmxMetricName, "EnqueueCount"));
        environment.metrics().register(dwMetricName + ".dequeueCount", new JmxAttributeGauge(jmxMetricName, "DequeueCount"));
    }));
    setupObjectMapping(environment);
}

Example 60 with org.opensaml.saml.saml2.metadata

use of org.opensaml.saml.saml2.metadata in project spring-security by spring-projects.

the class OpenSamlMetadataAssertingPartyDetailsConverter method convert.

RelyingPartyRegistration.AssertingPartyDetails.Builder convert(EntityDescriptor descriptor) {
    IDPSSODescriptor idpssoDescriptor = descriptor.getIDPSSODescriptor(SAMLConstants.SAML20P_NS);
    if (idpssoDescriptor == null) {
        throw new Saml2Exception("Metadata response is missing the necessary IDPSSODescriptor element");
    }
    List<Saml2X509Credential> verification = new ArrayList<>();
    List<Saml2X509Credential> encryption = new ArrayList<>();
    for (KeyDescriptor keyDescriptor : idpssoDescriptor.getKeyDescriptors()) {
        if (keyDescriptor.getUse().equals(UsageType.SIGNING)) {
            List<X509Certificate> certificates = certificates(keyDescriptor);
            for (X509Certificate certificate : certificates) {
                verification.add(Saml2X509Credential.verification(certificate));
            }
        }
        if (keyDescriptor.getUse().equals(UsageType.ENCRYPTION)) {
            List<X509Certificate> certificates = certificates(keyDescriptor);
            for (X509Certificate certificate : certificates) {
                encryption.add(Saml2X509Credential.encryption(certificate));
            }
        }
        if (keyDescriptor.getUse().equals(UsageType.UNSPECIFIED)) {
            List<X509Certificate> certificates = certificates(keyDescriptor);
            for (X509Certificate certificate : certificates) {
                verification.add(Saml2X509Credential.verification(certificate));
                encryption.add(Saml2X509Credential.encryption(certificate));
            }
        }
    }
    if (verification.isEmpty()) {
        throw new Saml2Exception("Metadata response is missing verification certificates, necessary for verifying SAML assertions");
    }
    RelyingPartyRegistration.AssertingPartyDetails.Builder party = OpenSamlAssertingPartyDetails.withEntityDescriptor(descriptor).entityId(descriptor.getEntityID()).wantAuthnRequestsSigned(Boolean.TRUE.equals(idpssoDescriptor.getWantAuthnRequestsSigned())).verificationX509Credentials((c) -> c.addAll(verification)).encryptionX509Credentials((c) -> c.addAll(encryption));
    List<SigningMethod> signingMethods = signingMethods(idpssoDescriptor);
    for (SigningMethod method : signingMethods) {
        party.signingAlgorithms((algorithms) -> algorithms.add(method.getAlgorithm()));
    }
    if (idpssoDescriptor.getSingleSignOnServices().isEmpty()) {
        throw new Saml2Exception("Metadata response is missing a SingleSignOnService, necessary for sending AuthnRequests");
    }
    for (SingleSignOnService singleSignOnService : idpssoDescriptor.getSingleSignOnServices()) {
        Saml2MessageBinding binding;
        if (singleSignOnService.getBinding().equals(Saml2MessageBinding.POST.getUrn())) {
            binding = Saml2MessageBinding.POST;
        } else if (singleSignOnService.getBinding().equals(Saml2MessageBinding.REDIRECT.getUrn())) {
            binding = Saml2MessageBinding.REDIRECT;
        } else {
            continue;
        }
        party.singleSignOnServiceLocation(singleSignOnService.getLocation()).singleSignOnServiceBinding(binding);
        break;
    }
    for (SingleLogoutService singleLogoutService : idpssoDescriptor.getSingleLogoutServices()) {
        Saml2MessageBinding binding;
        if (singleLogoutService.getBinding().equals(Saml2MessageBinding.POST.getUrn())) {
            binding = Saml2MessageBinding.POST;
        } else if (singleLogoutService.getBinding().equals(Saml2MessageBinding.REDIRECT.getUrn())) {
            binding = Saml2MessageBinding.REDIRECT;
        } else {
            continue;
        }
        String responseLocation = (singleLogoutService.getResponseLocation() == null) ? singleLogoutService.getLocation() : singleLogoutService.getResponseLocation();
        party.singleLogoutServiceLocation(singleLogoutService.getLocation()).singleLogoutServiceResponseLocation(responseLocation).singleLogoutServiceBinding(binding);
        break;
    }
    return party;
}