Examples with EncryptedData org.opensaml.xmlsec.encryption.EncryptedData used on opensource projects

Example 1 with EncryptedData

use of org.opensaml.xmlsec.encryption.EncryptedData in project cas by apereo.

the class WsFederationHelper method parseTokenFromString.

/**
     * parseTokenFromString converts a raw wresult and extracts it into an assertion.
     *
     * @param wresult the raw token returned by the IdP
     * @param config  the config
     * @return an assertion
     */
public Assertion parseTokenFromString(final String wresult, final WsFederationConfiguration config) {
    LOGGER.debug("Result token received from ADFS is [{}]", wresult);
    try (InputStream in = new ByteArrayInputStream(wresult.getBytes(StandardCharsets.UTF_8))) {
        LOGGER.debug("Parsing token into a document");
        final Document document = configBean.getParserPool().parse(in);
        final Element metadataRoot = document.getDocumentElement();
        final UnmarshallerFactory unmarshallerFactory = configBean.getUnmarshallerFactory();
        final Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(metadataRoot);
        if (unmarshaller == null) {
            throw new IllegalArgumentException("Unmarshaller for the metadata root element cannot be determined");
        }
        LOGGER.debug("Unmarshalling the document into a security token response");
        final RequestSecurityTokenResponse rsToken = (RequestSecurityTokenResponse) unmarshaller.unmarshall(metadataRoot);
        if (rsToken == null || rsToken.getRequestedSecurityToken() == null) {
            throw new IllegalArgumentException("Request security token response is null");
        }
        //Get our SAML token
        LOGGER.debug("Locating list of requested security tokens");
        final List<RequestedSecurityToken> rst = rsToken.getRequestedSecurityToken();
        if (rst.isEmpty()) {
            throw new IllegalArgumentException("No requested security token response is provided in the response");
        }
        LOGGER.debug("Locating the first occurrence of a requested security token in the list");
        final RequestedSecurityToken reqToken = rst.get(0);
        if (reqToken.getSecurityTokens() == null || reqToken.getSecurityTokens().isEmpty()) {
            throw new IllegalArgumentException("Requested security token response is not carrying any security tokens");
        }
        Assertion assertion = null;
        LOGGER.debug("Locating the first occurrence of a security token from the requested security token");
        XMLObject securityToken = reqToken.getSecurityTokens().get(0);
        if (securityToken instanceof EncryptedData) {
            try {
                LOGGER.debug("Security token is encrypted. Attempting to decrypt to extract the assertion");
                final EncryptedData encryptedData = EncryptedData.class.cast(securityToken);
                final Decrypter decrypter = buildAssertionDecrypter(config);
                LOGGER.debug("Built an instance of [{}]", decrypter.getClass().getName());
                securityToken = decrypter.decryptData(encryptedData);
            } catch (final Exception e) {
                throw new IllegalArgumentException("Unable to decrypt security token", e);
            }
        }
        if (securityToken instanceof Assertion) {
            LOGGER.debug("Security token is an assertion.");
            assertion = Assertion.class.cast(securityToken);
        }
        if (assertion == null) {
            throw new IllegalArgumentException("Could not extract or decrypt an assertion based on the security token provided");
        }
        LOGGER.debug("Extracted assertion successfully: [{}]", assertion);
        return assertion;
    } catch (final Exception ex) {
        LOGGER.warn(ex.getMessage());
        return null;
    }
}

Example 2 with EncryptedData

use of org.opensaml.xmlsec.encryption.EncryptedData in project cxf by apache.

the class SAMLProtocolResponseValidator method decryptAssertion.

private Element decryptAssertion(org.opensaml.saml.saml2.core.EncryptedAssertion assertion, Crypto sigCrypto, CallbackHandler callbackHandler) throws WSSecurityException {
    EncryptedData encryptedData = assertion.getEncryptedData();
    Element encryptedDataDOM = encryptedData.getDOM();
    Element encKeyElement = getNode(assertion.getDOM(), WSS4JConstants.ENC_NS, "EncryptedKey", 0);
    if (encKeyElement == null) {
        encKeyElement = getNode(encryptedDataDOM, WSS4JConstants.ENC_NS, "EncryptedKey", 0);
    }
    if (encKeyElement == null) {
        LOG.log(Level.FINE, "EncryptedKey element is not available");
        throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity");
    }
    X509Certificate cert = loadCertificate(sigCrypto, encKeyElement);
    if (cert == null) {
        LOG.fine("X509Certificate cannot be retrieved from EncryptedKey element");
        throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity");
    }
    // now start decrypting
    String keyEncAlgo = getEncodingMethodAlgorithm(encKeyElement);
    String digestAlgo = getDigestMethodAlgorithm(encKeyElement);
    Element cipherValue = getNode(encKeyElement, WSS4JConstants.ENC_NS, "CipherValue", 0);
    if (cipherValue == null) {
        LOG.fine("CipherValue element is not available");
        throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity");
    }
    if (callbackHandler == null) {
        LOG.fine("A CallbackHandler must be configured to decrypt encrypted Assertions");
        throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity");
    }
    PrivateKey key = null;
    try {
        key = sigCrypto.getPrivateKey(cert, callbackHandler);
    } catch (Exception ex) {
        LOG.log(Level.FINE, "Encrypted key can not be decrypted", ex);
        throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity");
    }
    Cipher cipher = EncryptionUtils.initCipherWithKey(keyEncAlgo, digestAlgo, Cipher.DECRYPT_MODE, key);
    byte[] decryptedBytes = null;
    try {
        byte[] encryptedBytes = Base64Utility.decode(cipherValue.getTextContent().trim());
        decryptedBytes = cipher.doFinal(encryptedBytes);
    } catch (Base64Exception ex) {
        LOG.log(Level.FINE, "Base64 decoding has failed", ex);
        throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity");
    } catch (Exception ex) {
        LOG.log(Level.FINE, "Encrypted key can not be decrypted", ex);
        throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity");
    }
    String symKeyAlgo = getEncodingMethodAlgorithm(encryptedDataDOM);
    byte[] decryptedPayload = null;
    try {
        decryptedPayload = decryptPayload(encryptedDataDOM, decryptedBytes, symKeyAlgo);
    } catch (Exception ex) {
        LOG.log(Level.FINE, "Payload can not be decrypted", ex);
        throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity");
    }
    Document payloadDoc = null;
    try {
        payloadDoc = StaxUtils.read(new InputStreamReader(new ByteArrayInputStream(decryptedPayload), StandardCharsets.UTF_8));
        return payloadDoc.getDocumentElement();
    } catch (Exception ex) {
        LOG.log(Level.FINE, "Payload document can not be created", ex);
        throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity");
    }
}

Example 3 with EncryptedData

use of org.opensaml.xmlsec.encryption.EncryptedData in project cas by apereo.

the class WsFederationHelper method getSecurityTokenFromRequestedToken.

private XMLObject getSecurityTokenFromRequestedToken(final RequestedSecurityToken reqToken, final Collection<WsFederationConfiguration> config) {
    LOGGER.debug("Locating the first occurrence of a security token from the requested security token");
    val securityTokenFromAssertion = getAssertionFromSecurityToken(reqToken);
    val func = FunctionUtils.doIf(Predicates.instanceOf(EncryptedData.class), () -> {
        LOGGER.trace("Security token is encrypted. Attempting to decrypt to extract the assertion");
        val encryptedData = EncryptedData.class.cast(securityTokenFromAssertion);
        val it = config.iterator();
        while (it.hasNext()) {
            try {
                val c = it.next();
                val decrypter = buildAssertionDecrypter(c);
                LOGGER.trace("Built an instance of [{}]", decrypter.getClass().getName());
                return decrypter.decryptData(encryptedData);
            } catch (final Exception e) {
                LOGGER.debug(e.getMessage(), e);
            }
        }
        LOGGER.error("Could not extract or decrypt an assertion based on the security token provided");
        return null;
    }, () -> securityTokenFromAssertion);
    return func.apply(securityTokenFromAssertion);
}