Examples with Saml2AuthenticationToken org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationToken used on opensource projects

Example 6 with Saml2AuthenticationToken

use of org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationToken in project spring-security by spring-projects.

the class OpenSamlAuthenticationProviderTests method token.

private Saml2AuthenticationToken token() {
    Response response = response();
    RelyingPartyRegistration registration = verifying(registration()).build();
    return new Saml2AuthenticationToken(registration, serialize(response));
}

Example 7 with Saml2AuthenticationToken

use of org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationToken in project spring-security by spring-projects.

the class OpenSamlAuthenticationProviderTests method authenticateWhenDelegatingToDefaultAssertionValidatorThenUses.

@Test
public void authenticateWhenDelegatingToDefaultAssertionValidatorThenUses() {
    OpenSamlAuthenticationProvider provider = new OpenSamlAuthenticationProvider();
    // @formatter:off
    provider.setAssertionValidator((assertionToken) -> OpenSamlAuthenticationProvider.createDefaultAssertionValidator((token) -> new ValidationContext()).convert(assertionToken).concat(new Saml2Error("wrong error", "wrong error")));
    // @formatter:on
    Response response = response();
    Assertion assertion = assertion();
    OneTimeUse oneTimeUse = build(OneTimeUse.DEFAULT_ELEMENT_NAME);
    assertion.getConditions().getConditions().add(oneTimeUse);
    response.getAssertions().add(assertion);
    TestOpenSamlObjects.signed(response, TestSaml2X509Credentials.assertingPartySigningCredential(), ASSERTING_PARTY_ENTITY_ID);
    Saml2AuthenticationToken token = token(response, verifying(registration()));
    // @formatter:off
    assertThatExceptionOfType(Saml2AuthenticationException.class).isThrownBy(() -> provider.authenticate(token)).isInstanceOf(Saml2AuthenticationException.class).satisfies((error) -> assertThat(error.getSaml2Error().getErrorCode()).isEqualTo(Saml2ErrorCodes.INVALID_ASSERTION));
// @formatter:on
}

Example 8 with Saml2AuthenticationToken

use of org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationToken in project spring-security by spring-projects.

the class OpenSaml4AuthenticationProvider method process.

private void process(Saml2AuthenticationToken token, Response response) {
    String issuer = response.getIssuer().getValue();
    this.logger.debug(LogMessage.format("Processing SAML response from %s", issuer));
    boolean responseSigned = response.isSigned();
    ResponseToken responseToken = new ResponseToken(response, token);
    Saml2ResponseValidatorResult result = this.responseSignatureValidator.convert(responseToken);
    if (responseSigned) {
        this.responseElementsDecrypter.accept(responseToken);
    } else if (!response.getEncryptedAssertions().isEmpty()) {
        result = result.concat(new Saml2Error(Saml2ErrorCodes.INVALID_SIGNATURE, "Did not decrypt response [" + response.getID() + "] since it is not signed"));
    }
    result = result.concat(this.responseValidator.convert(responseToken));
    boolean allAssertionsSigned = true;
    for (Assertion assertion : response.getAssertions()) {
        AssertionToken assertionToken = new AssertionToken(assertion, token);
        result = result.concat(this.assertionSignatureValidator.convert(assertionToken));
        allAssertionsSigned = allAssertionsSigned && assertion.isSigned();
        if (responseSigned || assertion.isSigned()) {
            this.assertionElementsDecrypter.accept(new AssertionToken(assertion, token));
        }
        result = result.concat(this.assertionValidator.convert(assertionToken));
    }
    if (!responseSigned && !allAssertionsSigned) {
        String description = "Either the response or one of the assertions is unsigned. " + "Please either sign the response or all of the assertions.";
        result = result.concat(new Saml2Error(Saml2ErrorCodes.INVALID_SIGNATURE, description));
    }
    Assertion firstAssertion = CollectionUtils.firstElement(response.getAssertions());
    if (firstAssertion != null && !hasName(firstAssertion)) {
        Saml2Error error = new Saml2Error(Saml2ErrorCodes.SUBJECT_NOT_FOUND, "Assertion [" + firstAssertion.getID() + "] is missing a subject");
        result = result.concat(error);
    }
    if (result.hasErrors()) {
        Collection<Saml2Error> errors = result.getErrors();
        if (this.logger.isTraceEnabled()) {
            this.logger.debug("Found " + errors.size() + " validation errors in SAML response [" + response.getID() + "]: " + errors);
        } else if (this.logger.isDebugEnabled()) {
            this.logger.debug("Found " + errors.size() + " validation errors in SAML response [" + response.getID() + "]");
        }
        Saml2Error first = errors.iterator().next();
        throw createAuthenticationException(first.getErrorCode(), first.getDescription(), null);
    } else {
        if (this.logger.isDebugEnabled()) {
            this.logger.debug("Successfully processed SAML Response [" + response.getID() + "]");
        }
    }
}

Example 9 with Saml2AuthenticationToken

use of org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationToken in project spring-security by spring-projects.

the class OpenSaml4AuthenticationProviderTests method authenticateWhenDelegatingToDefaultAssertionValidatorThenUses.

@Test
public void authenticateWhenDelegatingToDefaultAssertionValidatorThenUses() {
    OpenSaml4AuthenticationProvider provider = new OpenSaml4AuthenticationProvider();
    // @formatter:off
    provider.setAssertionValidator((assertionToken) -> OpenSaml4AuthenticationProvider.createDefaultAssertionValidator((token) -> new ValidationContext()).convert(assertionToken).concat(new Saml2Error("wrong error", "wrong error")));
    // @formatter:on
    Response response = response();
    Assertion assertion = assertion();
    OneTimeUse oneTimeUse = build(OneTimeUse.DEFAULT_ELEMENT_NAME);
    assertion.getConditions().getConditions().add(oneTimeUse);
    response.getAssertions().add(assertion);
    TestOpenSamlObjects.signed(response, TestSaml2X509Credentials.assertingPartySigningCredential(), ASSERTING_PARTY_ENTITY_ID);
    Saml2AuthenticationToken token = token(response, verifying(registration()));
    // @formatter:off
    assertThatExceptionOfType(Saml2AuthenticationException.class).isThrownBy(() -> provider.authenticate(token)).isInstanceOf(Saml2AuthenticationException.class).satisfies((error) -> assertThat(error.getSaml2Error().getErrorCode()).isEqualTo(Saml2ErrorCodes.INVALID_ASSERTION));
// @formatter:on
}

Example 10 with Saml2AuthenticationToken

use of org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationToken in project spring-security by spring-projects.

the class OpenSaml4AuthenticationProviderTests method authenticateWhenCustomResponseValidatorThenUses.

@Test
public void authenticateWhenCustomResponseValidatorThenUses() {
    Converter<OpenSaml4AuthenticationProvider.ResponseToken, Saml2ResponseValidatorResult> validator = mock(Converter.class);
    OpenSaml4AuthenticationProvider provider = new OpenSaml4AuthenticationProvider();
    // @formatter:off
    provider.setResponseValidator((responseToken) -> OpenSaml4AuthenticationProvider.createDefaultResponseValidator().convert(responseToken).concat(validator.convert(responseToken)));
    // @formatter:on
    Response response = response();
    Assertion assertion = assertion();
    response.getAssertions().add(assertion);
    TestOpenSamlObjects.signed(response, TestSaml2X509Credentials.assertingPartySigningCredential(), ASSERTING_PARTY_ENTITY_ID);
    Saml2AuthenticationToken token = token(response, verifying(registration()));
    given(validator.convert(any(OpenSaml4AuthenticationProvider.ResponseToken.class))).willReturn(Saml2ResponseValidatorResult.success());
    provider.authenticate(token);
    verify(validator).convert(any(OpenSaml4AuthenticationProvider.ResponseToken.class));
}