Examples with SAMLException org.pac4j.saml.exceptions.SAMLException used on opensource projects

Example 6 with SAMLException

use of org.pac4j.saml.exceptions.SAMLException in project pac4j by pac4j.

the class SAML2ContextProvider method addContext.

protected final void addContext(final SAML2MetadataResolver entityId, final BaseContext parentContext, final QName elementName) {
    final EntityDescriptor entityDescriptor;
    final RoleDescriptor roleDescriptor;
    try {
        final CriteriaSet set = new CriteriaSet();
        set.add(new EntityIdCriterion(entityId.getEntityId()));
        entityDescriptor = this.metadata.resolveSingle(set);
        if (entityDescriptor == null) {
            throw new SAMLException("Cannot find entity " + entityId + " in metadata provider");
        }
        final List<RoleDescriptor> list = entityDescriptor.getRoleDescriptors(elementName, SAMLConstants.SAML20P_NS);
        roleDescriptor = CommonHelper.isNotEmpty(list) ? list.get(0) : null;
        if (roleDescriptor == null) {
            throw new SAMLException("Cannot find entity " + entityId + " or role " + elementName + " in metadata provider");
        }
    } catch (final ResolverException e) {
        throw new SAMLException("An error occured while getting IDP descriptors", e);
    }
    final SAMLMetadataContext mdCtx = parentContext.getSubcontext(SAMLMetadataContext.class, true);
    mdCtx.setEntityDescriptor(entityDescriptor);
    mdCtx.setRoleDescriptor(roleDescriptor);
}

Example 7 with SAMLException

use of org.pac4j.saml.exceptions.SAMLException in project pac4j by pac4j.

the class SAML2MessageContext method getSPAssertionConsumerService.

public final AssertionConsumerService getSPAssertionConsumerService(final String acsIndex) {
    final SPSSODescriptor spssoDescriptor = getSPSSODescriptor();
    final List<AssertionConsumerService> services = spssoDescriptor.getAssertionConsumerServices();
    // Get by index
    if (acsIndex != null) {
        for (final AssertionConsumerService service : services) {
            if (Integer.valueOf(acsIndex).equals(service.getIndex())) {
                return service;
            }
        }
        throw new SAMLException("Assertion consumer service with index " + acsIndex + " could not be found for spDescriptor " + spssoDescriptor);
    }
    // Get default
    if (spssoDescriptor.getDefaultAssertionConsumerService() != null) {
        return spssoDescriptor.getDefaultAssertionConsumerService();
    }
    // Get first
    if (!services.isEmpty()) {
        return services.iterator().next();
    }
    throw new SAMLException("No assertion consumer services could be found for " + spssoDescriptor);
}

Example 8 with SAMLException

use of org.pac4j.saml.exceptions.SAMLException in project pac4j by pac4j.

the class KeyStoreCredentialProvider method getCredential.

@Override
public final Credential getCredential() {
    try {
        final CriteriaSet cs = new CriteriaSet();
        final EntityIdCriterion criteria = new EntityIdCriterion(this.privateKey);
        cs.add(criteria);
        final X509Credential creds = (X509Credential) this.credentialResolver.resolveSingle(cs);
        return creds;
    } catch (final ResolverException e) {
        throw new SAMLException("Can't obtain SP private key", e);
    }
}

Example 9 with SAMLException

use of org.pac4j.saml.exceptions.SAMLException in project pac4j by pac4j.

the class SAML2DefaultResponseValidator method validateSamlSSOResponse.

/**
 * Validates the SAML SSO response by finding a valid assertion with authn statements.
 * Populates the {@link SAML2MessageContext} with a subjectAssertion and a subjectNameIdentifier.
 *
 * @param response  the response
 * @param context   the context
 * @param engine    the engine
 * @param decrypter the decrypter
 */
protected final void validateSamlSSOResponse(final Response response, final SAML2MessageContext context, final SignatureTrustEngine engine, final Decrypter decrypter) {
    final List<SAMLException> errors = new ArrayList<>();
    for (final Assertion assertion : response.getAssertions()) {
        if (!assertion.getAuthnStatements().isEmpty()) {
            try {
                validateAssertion(assertion, context, engine, decrypter);
            } catch (final SAMLException e) {
                logger.error("Current assertion validation failed, continue with the next one", e);
                errors.add(e);
                continue;
            }
            context.setSubjectAssertion(assertion);
            break;
        }
    }
    if (!errors.isEmpty()) {
        throw errors.get(0);
    }
    if (context.getSubjectAssertion() == null) {
        throw new SAMAssertionSubjectException("No valid subject assertion found in response");
    }
    // We do not check EncryptedID here because it has been already decrypted and stored into NameID
    final List<SubjectConfirmation> subjectConfirmations = context.getSubjectConfirmations();
    final NameID nameIdentifier = (NameID) context.getSAMLSubjectNameIdentifierContext().getSubjectNameIdentifier();
    if ((nameIdentifier == null || nameIdentifier.getValue() == null) && context.getBaseID() == null && (subjectConfirmations == null || subjectConfirmations.isEmpty())) {
        throw new SAMLException("Subject NameID, BaseID and EncryptedID cannot be all null at the same time if there are no Subject Confirmations.");
    }
}

Example 10 with SAMLException

use of org.pac4j.saml.exceptions.SAMLException in project pac4j by pac4j.

the class SAML2DefaultResponseValidator method validateSamlProtocolResponse.

/**
 * Validates the SAML protocol response:
 * - IssueInstant
 * - Issuer
 * - StatusCode
 * - Signature
 *
 * @param response the response
 * @param context  the context
 * @param engine   the engine
 */
protected final void validateSamlProtocolResponse(final Response response, final SAML2MessageContext context, final SignatureTrustEngine engine) {
    if (!StatusCode.SUCCESS.equals(response.getStatus().getStatusCode().getValue())) {
        String status = response.getStatus().getStatusCode().getValue();
        if (response.getStatus().getStatusMessage() != null) {
            status += " / " + response.getStatus().getStatusMessage().getMessage();
        }
        throw new SAMLException("Authentication response is not success ; actual " + status);
    }
    if (response.getSignature() != null) {
        final String entityId = context.getSAMLPeerEntityContext().getEntityId();
        validateSignature(response.getSignature(), entityId, engine);
        context.getSAMLPeerEntityContext().setAuthenticated(true);
    }
    if (!isIssueInstantValid(response.getIssueInstant())) {
        throw new SAMLIssueInstantException("Response issue instant is too old or in the future");
    }
    AuthnRequest request = null;
    final SAMLMessageStorage messageStorage = context.getSAMLMessageStorage();
    if (messageStorage != null && response.getInResponseTo() != null) {
        final XMLObject xmlObject = messageStorage.retrieveMessage(response.getInResponseTo());
        if (xmlObject == null) {
            throw new SAMLInResponseToMismatchException("InResponseToField of the Response doesn't correspond to sent message " + response.getInResponseTo());
        } else if (xmlObject instanceof AuthnRequest) {
            request = (AuthnRequest) xmlObject;
        } else {
            throw new SAMLInResponseToMismatchException("Sent request was of different type than the expected AuthnRequest " + response.getInResponseTo());
        }
    }
    verifyEndpoint(context.getSAMLEndpointContext().getEndpoint(), response.getDestination());
    if (request != null) {
        verifyRequest(request, context);
    }
    if (response.getIssuer() != null) {
        validateIssuer(response.getIssuer(), context);
    }
}