Examples with Saml2AuthenticationToken org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationToken used on opensource projects

Example 21 with Saml2AuthenticationToken

use of org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationToken in project spring-security by spring-projects.

the class OpenSamlAuthenticationProvider method authenticate.

/**
 * @param authentication the authentication request object, must be of type
 * {@link Saml2AuthenticationToken}
 * @return {@link Saml2Authentication} if the assertion is valid
 * @throws AuthenticationException if a validation exception occurs
 */
@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    try {
        Saml2AuthenticationToken token = (Saml2AuthenticationToken) authentication;
        String serializedResponse = token.getSaml2Response();
        Response response = parse(serializedResponse);
        process(token, response);
        return this.responseAuthenticationConverter.convert(new ResponseToken(response, token));
    } catch (Saml2AuthenticationException ex) {
        throw ex;
    } catch (Exception ex) {
        throw createAuthenticationException(Saml2ErrorCodes.INTERNAL_VALIDATION_ERROR, ex.getMessage(), ex);
    }
}

Example 22 with Saml2AuthenticationToken

use of org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationToken in project spring-security by spring-projects.

the class OpenSamlAuthenticationProvider method process.

private void process(Saml2AuthenticationToken token, Response response) {
    String issuer = response.getIssuer().getValue();
    logger.debug(LogMessage.format("Processing SAML response from %s", issuer));
    boolean responseSigned = response.isSigned();
    ResponseToken responseToken = new ResponseToken(response, token);
    Saml2ResponseValidatorResult result = this.responseSignatureValidator.convert(responseToken);
    if (responseSigned) {
        this.responseElementsDecrypter.accept(responseToken);
    }
    result = result.concat(this.responseValidator.convert(responseToken));
    boolean allAssertionsSigned = true;
    for (Assertion assertion : response.getAssertions()) {
        AssertionToken assertionToken = new AssertionToken(assertion, token);
        result = result.concat(this.assertionSignatureValidator.convert(assertionToken));
        allAssertionsSigned = allAssertionsSigned && assertion.isSigned();
        if (responseSigned || assertion.isSigned()) {
            this.assertionElementsDecrypter.accept(new AssertionToken(assertion, token));
        }
        result = result.concat(this.assertionValidator.convert(assertionToken));
    }
    if (!responseSigned && !allAssertionsSigned) {
        String description = "Either the response or one of the assertions is unsigned. " + "Please either sign the response or all of the assertions.";
        throw createAuthenticationException(Saml2ErrorCodes.INVALID_SIGNATURE, description, null);
    }
    Assertion firstAssertion = CollectionUtils.firstElement(response.getAssertions());
    if (!hasName(firstAssertion)) {
        Saml2Error error = new Saml2Error(Saml2ErrorCodes.SUBJECT_NOT_FOUND, "Assertion [" + firstAssertion.getID() + "] is missing a subject");
        result = result.concat(error);
    }
    if (result.hasErrors()) {
        Collection<Saml2Error> errors = result.getErrors();
        if (logger.isTraceEnabled()) {
            logger.debug("Found " + errors.size() + " validation errors in SAML response [" + response.getID() + "]: " + errors);
        } else if (logger.isDebugEnabled()) {
            logger.debug("Found " + errors.size() + " validation errors in SAML response [" + response.getID() + "]");
        }
        Saml2Error first = errors.iterator().next();
        throw createAuthenticationException(first.getErrorCode(), first.getDescription(), null);
    } else {
        if (logger.isDebugEnabled()) {
            logger.debug("Successfully processed SAML Response [" + response.getID() + "]");
        }
    }
}

Example 23 with Saml2AuthenticationToken

use of org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationToken in project spring-security by spring-projects.

the class Saml2WebSsoAuthenticationFilterTests method attemptAuthenticationAddsDetails.

@Test
public void attemptAuthenticationAddsDetails() {
    AuthenticationConverter authenticationConverter = mock(AuthenticationConverter.class);
    final Saml2AuthenticationToken token = TestSaml2AuthenticationTokens.token();
    given(authenticationConverter.convert(this.request)).willReturn(token);
    final AuthenticationDetailsSource authenticationDetailsSource = mock(AuthenticationDetailsSource.class);
    final WebAuthenticationDetails details = mock(WebAuthenticationDetails.class);
    given(authenticationDetailsSource.buildDetails(this.request)).willReturn(details);
    this.filter = new Saml2WebSsoAuthenticationFilter(authenticationConverter, "/some/other/path/{registrationId}");
    this.filter.setAuthenticationManager((authentication) -> null);
    this.filter.setAuthenticationDetailsSource(authenticationDetailsSource);
    this.request.setPathInfo("/some/other/path/idp-registration-id");
    this.filter.attemptAuthentication(this.request, this.response);
    Assertions.assertEquals(details, token.getDetails());
}

Example 24 with Saml2AuthenticationToken

use of org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationToken in project spring-security by spring-projects.

the class Saml2AuthenticationTokenConverterTests method convertWhenUsingSamlUtilsBase64ThenXmlIsValid.

@Test
public void convertWhenUsingSamlUtilsBase64ThenXmlIsValid() throws Exception {
    Saml2AuthenticationTokenConverter converter = new Saml2AuthenticationTokenConverter(this.relyingPartyRegistrationResolver);
    given(this.relyingPartyRegistrationResolver.convert(any(HttpServletRequest.class))).willReturn(this.relyingPartyRegistration);
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setParameter(Saml2ParameterNames.SAML_RESPONSE, getSsoCircleEncodedXml());
    Saml2AuthenticationToken token = converter.convert(request);
    validateSsoCircleXml(token.getSaml2Response());
}

Example 25 with Saml2AuthenticationToken

use of org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationToken in project spring-security by spring-projects.

the class Saml2AuthenticationTokenConverterTests method convertWhenSamlResponseThenToken.

@Test
public void convertWhenSamlResponseThenToken() {
    Saml2AuthenticationTokenConverter converter = new Saml2AuthenticationTokenConverter(this.relyingPartyRegistrationResolver);
    given(this.relyingPartyRegistrationResolver.convert(any(HttpServletRequest.class))).willReturn(this.relyingPartyRegistration);
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setParameter(Saml2ParameterNames.SAML_RESPONSE, Saml2Utils.samlEncode("response".getBytes(StandardCharsets.UTF_8)));
    Saml2AuthenticationToken token = converter.convert(request);
    assertThat(token.getSaml2Response()).isEqualTo("response");
    assertThat(token.getRelyingPartyRegistration().getRegistrationId()).isEqualTo(this.relyingPartyRegistration.getRegistrationId());
}