Examples with SignatureBuilder org.opensaml.xml.signature.impl.SignatureBuilder used on opensource projects

Example 1 with SignatureBuilder

use of org.opensaml.xml.signature.impl.SignatureBuilder in project entcore by opendigitaleducation.

the class SamlValidator method createSignature.

private Signature createSignature(boolean addKeyInfo) throws Throwable {
    SignatureBuilder builder = new SignatureBuilder();
    Signature signature = builder.buildObject();
    // create public key (cert) portion of credential
    String publicKeyPath = config.getString("saml-public-key");
    FileInputStream inStream = new FileInputStream(publicKeyPath);
    CertificateFactory cf = CertificateFactory.getInstance("X.509");
    X509Certificate cer = (X509Certificate) cf.generateCertificate(inStream);
    inStream.close();
    // create credential and initialize
    BasicX509Credential credential = new BasicX509Credential();
    credential.setEntityCertificate(cer);
    // credential.setPublicKey(cer.getPublicKey());
    credential.setPrivateKey(privateKey);
    signature.setSigningCredential(credential);
    signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);
    signature.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);
    if (addKeyInfo) {
        KeyInfo keyInfo = SamlUtils.buildSAMLObjectWithDefaultName(KeyInfo.class);
        X509Data data = SamlUtils.buildSAMLObjectWithDefaultName(X509Data.class);
        org.opensaml.xml.signature.X509Certificate cert = SamlUtils.buildSAMLObjectWithDefaultName(org.opensaml.xml.signature.X509Certificate.class);
        String value = org.apache.xml.security.utils.Base64.encode(credential.getEntityCertificate().getEncoded());
        cert.setValue(value);
        data.getX509Certificates().add(cert);
        keyInfo.getX509Datas().add(data);
        signature.setKeyInfo(keyInfo);
    }
    return signature;
}

Example 2 with SignatureBuilder

use of org.opensaml.xml.signature.impl.SignatureBuilder in project MaxKey by dromara.

the class AssertionGenerator method generateAssertion.

public Assertion generateAssertion(AppsSAML20Details saml20Details, BindingAdapter bindingAdapter, String assertionConsumerURL, String inResponseTo, String audienceUrl, int validInSeconds, HashMap<String, String> attributeMap) {
    Assertion assertion = new AssertionBuilder().buildObject();
    ;
    // Subject
    Subject subject = subjectGenerator.generateSubject(saml20Details, assertionConsumerURL, inResponseTo, validInSeconds);
    assertion.setSubject(subject);
    // issuer
    Issuer issuer = issuerGenerator.generateIssuer();
    assertion.setIssuer(issuer);
    // AuthnStatements
    DateTime authnInstant = new DateTime(WebContext.getSession().getCreationTime());
    AuthnStatement authnStatement = authnStatementGenerator.generateAuthnStatement(authnInstant);
    assertion.getAuthnStatements().add(authnStatement);
    // AttributeStatements
    ArrayList<GrantedAuthority> grantedAuthoritys = new ArrayList<GrantedAuthority>();
    grantedAuthoritys.add(new SimpleGrantedAuthority("ROLE_USER"));
    for (GrantedAuthority anthGrantedAuthority : ((UsernamePasswordAuthenticationToken) WebContext.getAuthentication()).getAuthorities()) {
        grantedAuthoritys.add(anthGrantedAuthority);
    }
    AttributeStatement attributeStatement = attributeStatementGenerator.generateAttributeStatement(saml20Details, grantedAuthoritys, attributeMap);
    assertion.getAttributeStatements().add(attributeStatement);
    // ID
    assertion.setID(idService.generateID());
    // IssueInstant
    assertion.setIssueInstant(timeService.getCurrentDateTime());
    // Conditions
    Conditions conditions = conditionsGenerator.generateConditions(audienceUrl, validInSeconds);
    assertion.setConditions(conditions);
    // sign Assertion
    try {
        if (bindingAdapter.getSigningCredential() == null) {
            throw new Exception("Signing Credential is null...");
        }
        logger.debug("EntityId " + bindingAdapter.getSigningCredential().getEntityId());
        BasicCredential basicCredential = new BasicCredential();
        basicCredential.setPrivateKey(bindingAdapter.getSigningCredential().getPrivateKey());
        Signature signature = new SignatureBuilder().buildObject();
        signature.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);
        signature.setSigningCredential(basicCredential);
        KeyInfoGeneratorFactory keyInfoGeneratorFactory = Configuration.getGlobalSecurityConfiguration().getKeyInfoGeneratorManager().getDefaultManager().getFactory(bindingAdapter.getSigningCredential());
        signature.setKeyInfo(keyInfoGeneratorFactory.newInstance().generate(bindingAdapter.getSigningCredential()));
        BasicSecurityConfiguration config = (BasicSecurityConfiguration) Configuration.getGlobalSecurityConfiguration();
        if (saml20Details.getSignature().equalsIgnoreCase("RSAwithSHA1")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);
        } else if (saml20Details.getSignature().equalsIgnoreCase("RSAwithSHA256")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
        } else if (saml20Details.getSignature().equalsIgnoreCase("RSAwithSHA384")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA384);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA384);
        } else if (saml20Details.getSignature().equalsIgnoreCase("RSAwithSHA512")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512);
        } else if (saml20Details.getSignature().equalsIgnoreCase("RSAwithMD5")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5);
        } else if (saml20Details.getSignature().equalsIgnoreCase("RSAwithRIPEMD160")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_RIPEMD160);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_RIPEMD160);
        } else if (saml20Details.getSignature().equalsIgnoreCase("DSAwithSHA1")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA1);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA1);
        } else if (saml20Details.getSignature().equalsIgnoreCase("ECDSAwithSHA256")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA256);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA256);
        } else if (saml20Details.getSignature().equalsIgnoreCase("ECDSAwithSHA384")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA384);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA384);
        } else if (saml20Details.getSignature().equalsIgnoreCase("ECDSAwithSHA512")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA512);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA512);
        } else if (saml20Details.getSignature().equalsIgnoreCase("HMAC-MD5")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_MAC_HMAC_NOT_RECOMMENDED_MD5);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_MAC_HMAC_NOT_RECOMMENDED_MD5);
        } else if (saml20Details.getSignature().equalsIgnoreCase("HMAC-SHA1")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_MAC_HMAC_SHA1);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);
        } else if (saml20Details.getSignature().equalsIgnoreCase("HMAC-SHA256")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_MAC_HMAC_SHA256);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_MAC_HMAC_SHA256);
        } else if (saml20Details.getSignature().equalsIgnoreCase("HMAC-SHA384")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_MAC_HMAC_SHA384);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_MAC_HMAC_SHA384);
        } else if (saml20Details.getSignature().equalsIgnoreCase("HMAC-SHA512")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_MAC_HMAC_SHA512);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_MAC_HMAC_SHA512);
        } else if (saml20Details.getSignature().equalsIgnoreCase("HMAC-RIPEMD160")) {
            signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_MAC_HMAC_RIPEMD160);
            config.registerSignatureAlgorithmURI(saml20Details.getSignature(), SignatureConstants.ALGO_ID_MAC_HMAC_RIPEMD160);
        }
        if (saml20Details.getDigestMethod().equalsIgnoreCase("MD5")) {
            config.setSignatureReferenceDigestMethod(SignatureConstants.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5);
        } else if (saml20Details.getDigestMethod().equalsIgnoreCase("SHA1")) {
            config.setSignatureReferenceDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA1);
        } else if (saml20Details.getDigestMethod().equalsIgnoreCase("SHA256")) {
            config.setSignatureReferenceDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA256);
        } else if (saml20Details.getDigestMethod().equalsIgnoreCase("SHA384")) {
            config.setSignatureReferenceDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA384);
        } else if (saml20Details.getDigestMethod().equalsIgnoreCase("SHA512")) {
            config.setSignatureReferenceDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA512);
        } else if (saml20Details.getDigestMethod().equalsIgnoreCase("RIPEMD-160")) {
            config.setSignatureReferenceDigestMethod(SignatureConstants.ALGO_ID_DIGEST_RIPEMD160);
        }
        assertion.setSignature(signature);
        Configuration.getMarshallerFactory().getMarshaller(assertion).marshall(assertion);
        Signer.signObject(signature);
        logger.debug("assertion.isSigned " + assertion.isSigned());
    } catch (Exception e) {
        e.printStackTrace();
        logger.info("Unable to Signer assertion ", e);
    }
    return assertion;
}

Example 3 with SignatureBuilder

use of org.opensaml.xml.signature.impl.SignatureBuilder in project uaa by cloudfoundry.

the class IdpWebSsoProfileImpl method signAssertion.

private void signAssertion(Assertion assertion, Credential credential) throws SecurityException, MarshallingException, SignatureException {
    SignatureBuilder signatureBuilder = (SignatureBuilder) builderFactory.getBuilder(Signature.DEFAULT_ELEMENT_NAME);
    Signature signature = signatureBuilder.buildObject();
    signature.setSigningCredential(credential);
    SecurityHelper.prepareSignatureParams(signature, credential, null, null);
    assertion.setSignature(signature);
    Marshaller marshaller = Configuration.getMarshallerFactory().getMarshaller(assertion);
    marshaller.marshall(assertion);
    Signer.signObject(signature);
}

Example 4 with SignatureBuilder

use of org.opensaml.xml.signature.impl.SignatureBuilder in project uaa by cloudfoundry.

the class SamlTestUtils method mockAssertion.

public Assertion mockAssertion(String issuerEntityId, String format, String username, String spEndpoint, String audienceEntityID, String privateKey, String keyPassword, String certificate) throws Exception {
    String authenticationId = UUID.randomUUID().toString();
    Authentication authentication = mockUaaAuthentication(authenticationId);
    SAMLMessageContext context = mockSamlMessageContext();
    IdpWebSsoProfileImpl profile = mockSsoWebProfileImpl();
    IdpWebSSOProfileOptions options = new IdpWebSSOProfileOptions();
    options.setAssertionsSigned(false);
    profile.buildResponse(authentication, context, options);
    Response response = (Response) context.getOutboundSAMLMessage();
    Assertion assertion = response.getAssertions().get(0);
    DateTime until = new DateTime().plusHours(1);
    assertion.getSubject().getSubjectConfirmations().get(0).getSubjectConfirmationData().setRecipient(spEndpoint);
    assertion.getConditions().getAudienceRestrictions().get(0).getAudiences().get(0).setAudienceURI(audienceEntityID);
    assertion.getIssuer().setValue(issuerEntityId);
    assertion.getSubject().getNameID().setValue(username);
    assertion.getSubject().getNameID().setFormat(format);
    assertion.getSubject().getSubjectConfirmations().get(0).getSubjectConfirmationData().setInResponseTo(null);
    assertion.getSubject().getSubjectConfirmations().get(0).getSubjectConfirmationData().setNotOnOrAfter(until);
    assertion.getConditions().setNotOnOrAfter(until);
    SamlConfig config = new SamlConfig();
    config.addAndActivateKey("active-key", new SamlKey(privateKey, keyPassword, certificate));
    KeyManager keyManager = new SamlKeyManagerFactory().getKeyManager(config);
    SignatureBuilder signatureBuilder = (SignatureBuilder) builderFactory.getBuilder(Signature.DEFAULT_ELEMENT_NAME);
    Signature signature = signatureBuilder.buildObject();
    final Credential defaultCredential = keyManager.getDefaultCredential();
    signature.setSigningCredential(defaultCredential);
    SecurityHelper.prepareSignatureParams(signature, defaultCredential, null, null);
    assertion.setSignature(signature);
    Marshaller marshaller = Configuration.getMarshallerFactory().getMarshaller(assertion);
    marshaller.marshall(assertion);
    Signer.signObject(signature);
    return assertion;
}