Examples with XMLSecSAML2MetadataSigner org.pac4j.saml.metadata.XMLSecSAML2MetadataSigner used on opensource projects

Example 1 with XMLSecSAML2MetadataSigner

use of org.pac4j.saml.metadata.XMLSecSAML2MetadataSigner in project cas by apereo.

the class DefaultDelegatedClientFactory method configureSamlClient.

/**
 * Configure saml client.
 *
 * @param properties the properties
 */
protected void configureSamlClient(final Collection<IndirectClient> properties) {
    val pac4jProperties = casProperties.getAuthn().getPac4j();
    val index = new AtomicInteger();
    pac4jProperties.getSaml().stream().filter(saml -> saml.isEnabled() && StringUtils.isNotBlank(saml.getKeystorePath()) && StringUtils.isNotBlank(saml.getIdentityProviderMetadataPath()) && StringUtils.isNotBlank(saml.getServiceProviderEntityId()) && StringUtils.isNotBlank(saml.getServiceProviderMetadataPath())).forEach(saml -> {
        val cfg = new SAML2Configuration(saml.getKeystorePath(), saml.getKeystorePassword(), saml.getPrivateKeyPassword(), saml.getIdentityProviderMetadataPath());
        cfg.setForceKeystoreGeneration(saml.isForceKeystoreGeneration());
        if (saml.getCertificateExpirationDays() > 0) {
            cfg.setCertificateExpirationPeriod(Period.ofDays(saml.getCertificateExpirationDays()));
        }
        FunctionUtils.doIfNotNull(saml.getCertificateSignatureAlg(), cfg::setCertificateSignatureAlg);
        cfg.setCertificateNameToAppend(StringUtils.defaultIfBlank(saml.getCertificateNameToAppend(), saml.getClientName()));
        cfg.setMaximumAuthenticationLifetime(Beans.newDuration(saml.getMaximumAuthenticationLifetime()).toSeconds());
        cfg.setServiceProviderEntityId(saml.getServiceProviderEntityId());
        cfg.setServiceProviderMetadataPath(saml.getServiceProviderMetadataPath());
        cfg.setAuthnRequestBindingType(saml.getDestinationBinding());
        cfg.setForceAuth(saml.isForceAuth());
        cfg.setPassive(saml.isPassive());
        cfg.setSignMetadata(saml.isSignServiceProviderMetadata());
        cfg.setMetadataSigner(new XMLSecSAML2MetadataSigner(cfg));
        cfg.setAuthnRequestSigned(saml.isSignAuthnRequest());
        cfg.setSpLogoutRequestSigned(saml.isSignServiceProviderLogoutRequest());
        cfg.setAcceptedSkew(Beans.newDuration(saml.getAcceptedSkew()).toSeconds());
        cfg.setSslSocketFactory(casSSLContext.getSslContext().getSocketFactory());
        cfg.setHostnameVerifier(casSSLContext.getHostnameVerifier());
        if (StringUtils.isNotBlank(saml.getPrincipalIdAttribute())) {
            cfg.setAttributeAsId(saml.getPrincipalIdAttribute());
        }
        cfg.setWantsAssertionsSigned(saml.isWantsAssertionsSigned());
        cfg.setWantsResponsesSigned(saml.isWantsResponsesSigned());
        cfg.setAllSignatureValidationDisabled(saml.isAllSignatureValidationDisabled());
        cfg.setUseNameQualifier(saml.isUseNameQualifier());
        cfg.setAttributeConsumingServiceIndex(saml.getAttributeConsumingServiceIndex());
        if (applicationContext.containsBean(DelegatedClientFactory.BEAN_NAME_SAML2_CLIENT_MESSAGE_FACTORY)) {
            val factory = applicationContext.getBean(DelegatedClientFactory.BEAN_NAME_SAML2_CLIENT_MESSAGE_FACTORY, SAMLMessageStoreFactory.class);
            cfg.setSamlMessageStoreFactory(factory);
        } else {
            FunctionUtils.doIf(saml.getMessageStoreFactory().equalsIgnoreCase("EMPTY"), ig -> cfg.setSamlMessageStoreFactory(new EmptyStoreFactory())).accept(saml);
            FunctionUtils.doIf(saml.getMessageStoreFactory().equalsIgnoreCase("SESSION"), ig -> cfg.setSamlMessageStoreFactory(new HttpSessionStoreFactory())).accept(saml);
            if (saml.getMessageStoreFactory().contains(".")) {
                Unchecked.consumer(ig -> {
                    val clazz = ClassUtils.getClass(DefaultDelegatedClientFactory.class.getClassLoader(), saml.getMessageStoreFactory());
                    val factory = SAMLMessageStoreFactory.class.cast(clazz.getDeclaredConstructor().newInstance());
                    cfg.setSamlMessageStoreFactory(factory);
                }).accept(saml);
            }
        }
        if (saml.getAssertionConsumerServiceIndex() >= 0) {
            cfg.setAssertionConsumerServiceIndex(saml.getAssertionConsumerServiceIndex());
        }
        if (!saml.getAuthnContextClassRef().isEmpty()) {
            cfg.setComparisonType(saml.getAuthnContextComparisonType().toUpperCase());
            cfg.setAuthnContextClassRefs(saml.getAuthnContextClassRef());
        }
        if (StringUtils.isNotBlank(saml.getKeystoreAlias())) {
            cfg.setKeystoreAlias(saml.getKeystoreAlias());
        }
        if (StringUtils.isNotBlank(saml.getNameIdPolicyFormat())) {
            cfg.setNameIdPolicyFormat(saml.getNameIdPolicyFormat());
        }
        if (!saml.getRequestedAttributes().isEmpty()) {
            saml.getRequestedAttributes().stream().map(attribute -> new SAML2ServiceProviderRequestedAttribute(attribute.getName(), attribute.getFriendlyName(), attribute.getNameFormat(), attribute.isRequired())).forEach(attribute -> cfg.getRequestedServiceProviderAttributes().add(attribute));
        }
        if (!saml.getBlockedSignatureSigningAlgorithms().isEmpty()) {
            cfg.setBlackListedSignatureSigningAlgorithms(saml.getBlockedSignatureSigningAlgorithms());
        }
        if (!saml.getSignatureAlgorithms().isEmpty()) {
            cfg.setSignatureAlgorithms(saml.getSignatureAlgorithms());
        }
        if (!saml.getSignatureReferenceDigestMethods().isEmpty()) {
            cfg.setSignatureReferenceDigestMethods(saml.getSignatureReferenceDigestMethods());
        }
        if (!StringUtils.isNotBlank(saml.getSignatureCanonicalizationAlgorithm())) {
            cfg.setSignatureCanonicalizationAlgorithm(saml.getSignatureCanonicalizationAlgorithm());
        }
        cfg.setProviderName(saml.getProviderName());
        cfg.setNameIdPolicyAllowCreate(saml.getNameIdPolicyAllowCreate().toBoolean());
        val mappedAttributes = saml.getMappedAttributes();
        if (!mappedAttributes.isEmpty()) {
            cfg.setMappedAttributes(CollectionUtils.convertDirectedListToMap(mappedAttributes));
        }
        val client = new SAML2Client(cfg);
        if (StringUtils.isBlank(saml.getClientName())) {
            val count = index.intValue();
            client.setName(client.getClass().getSimpleName() + count);
        }
        configureClient(client, saml);
        index.incrementAndGet();
        LOGGER.debug("Created delegated client [{}]", client);
        properties.add(client);
    });
}