Examples with Saml2PostAuthenticationRequest org.springframework.security.saml2.provider.service.authentication.Saml2PostAuthenticationRequest used on opensource projects

Example 6 with Saml2PostAuthenticationRequest

use of org.springframework.security.saml2.provider.service.authentication.Saml2PostAuthenticationRequest in project spring-security by spring-projects.

the class OpenSamlAuthenticationRequestResolverTests method resolveAuthenticationRequestWhenUnsignedPostThenOnlyPosts.

@Test
public void resolveAuthenticationRequestWhenUnsignedPostThenOnlyPosts() {
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setPathInfo("/saml2/authenticate/registration-id");
    RelyingPartyRegistration registration = this.relyingPartyRegistrationBuilder.assertingPartyDetails((party) -> party.singleSignOnServiceBinding(Saml2MessageBinding.POST).wantAuthnRequestsSigned(false)).build();
    OpenSamlAuthenticationRequestResolver resolver = authenticationRequestResolver(registration);
    Saml2PostAuthenticationRequest result = resolver.resolve(request, (r, authnRequest) -> {
        assertThat(authnRequest.getAssertionConsumerServiceURL()).isEqualTo(registration.getAssertionConsumerServiceLocation());
        assertThat(authnRequest.getProtocolBinding()).isEqualTo(registration.getAssertionConsumerServiceBinding().getUrn());
        assertThat(authnRequest.getDestination()).isEqualTo(registration.getAssertingPartyDetails().getSingleSignOnServiceLocation());
        assertThat(authnRequest.getIssuer().getValue()).isEqualTo(registration.getEntityId());
    });
    assertThat(result.getSamlRequest()).isNotEmpty();
    assertThat(result.getRelayState()).isNotNull();
    assertThat(result.getBinding()).isEqualTo(Saml2MessageBinding.POST);
    assertThat(new String(Saml2Utils.samlDecode(result.getSamlRequest()))).doesNotContain("Signature");
}

Example 7 with Saml2PostAuthenticationRequest

use of org.springframework.security.saml2.provider.service.authentication.Saml2PostAuthenticationRequest in project spring-security by spring-projects.

the class Saml2WebSsoAuthenticationRequestFilterTests method doFilterWhenPostThenSaveRedirectRequest.

@Test
public void doFilterWhenPostThenSaveRedirectRequest() throws ServletException, IOException {
    RelyingPartyRegistration registration = this.rpBuilder.assertingPartyDetails((asserting) -> asserting.singleSignOnServiceBinding(Saml2MessageBinding.POST)).build();
    Saml2AuthenticationRequestContext context = authenticationRequestContext().relyingPartyRegistration(registration).build();
    Saml2PostAuthenticationRequest request = postAuthenticationRequest(context).build();
    given(this.resolver.resolve(any())).willReturn(context);
    given(this.factory.createPostAuthenticationRequest(any())).willReturn(request);
    this.filter.doFilterInternal(this.request, this.response, this.filterChain);
    verify(this.authenticationRequestRepository).saveAuthenticationRequest(any(Saml2PostAuthenticationRequest.class), eq(this.request), eq(this.response));
}

Example 8 with Saml2PostAuthenticationRequest

use of org.springframework.security.saml2.provider.service.authentication.Saml2PostAuthenticationRequest in project spring-security by spring-projects.

the class Saml2WebSsoAuthenticationRequestFilterTests method doFilterWhenPostFormDataIsPresent.

@Test
public void doFilterWhenPostFormDataIsPresent() throws Exception {
    String relayStateValue = "https://my-relay-state.example.com?with=param&other=param&javascript{alert('1');}";
    String relayStateEncoded = HtmlUtils.htmlEscape(relayStateValue);
    RelyingPartyRegistration registration = this.rpBuilder.assertingPartyDetails((asserting) -> asserting.singleSignOnServiceBinding(Saml2MessageBinding.POST)).build();
    Saml2AuthenticationRequestContext context = authenticationRequestContext().relayState(relayStateValue).relyingPartyRegistration(registration).build();
    Saml2PostAuthenticationRequest request = postAuthenticationRequest(context).build();
    given(this.resolver.resolve(any())).willReturn(context);
    given(this.factory.createPostAuthenticationRequest(any())).willReturn(request);
    this.filter.doFilterInternal(this.request, this.response, this.filterChain);
    assertThat(this.response.getHeader("Location")).isNull();
    assertThat(this.response.getContentAsString()).contains("<form action=\"https://sso-url.example.com/IDP/SSO\" method=\"post\">").contains("<input type=\"hidden\" name=\"SAMLRequest\"").contains("value=\"" + relayStateEncoded + "\"");
}

Example 9 with Saml2PostAuthenticationRequest

use of org.springframework.security.saml2.provider.service.authentication.Saml2PostAuthenticationRequest in project spring-security by spring-projects.

the class OpenSamlAuthenticationRequestFactory method createPostAuthenticationRequest.

@Override
public Saml2PostAuthenticationRequest createPostAuthenticationRequest(Saml2AuthenticationRequestContext context) {
    AuthnRequest authnRequest = this.authenticationRequestContextConverter.convert(context);
    RelyingPartyRegistration registration = context.getRelyingPartyRegistration();
    if (registration.getAssertingPartyDetails().getWantAuthnRequestsSigned()) {
        OpenSamlSigningUtils.sign(authnRequest, registration);
    }
    String xml = OpenSamlSigningUtils.serialize(authnRequest);
    return Saml2PostAuthenticationRequest.withAuthenticationRequestContext(context).samlRequest(Saml2Utils.samlEncode(xml.getBytes(StandardCharsets.UTF_8))).build();
}