Examples with RelyingPartyRegistration org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration used on opensource projects

Example 61 with RelyingPartyRegistration

use of org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration in project midpoint by Evolveum.

the class SamlModuleWebSecurityConfiguration method buildInternal.

private static SamlModuleWebSecurityConfiguration buildInternal(Saml2AuthenticationModuleType modelType, String prefixOfSequence, String publicHttpUrlPattern, ServletRequest request) {
    SamlModuleWebSecurityConfiguration configuration = new SamlModuleWebSecurityConfiguration();
    build(configuration, modelType, prefixOfSequence);
    List<Saml2ServiceProviderAuthenticationModuleType> serviceProviders = modelType.getServiceProvider();
    List<RelyingPartyRegistration> registrations = new ArrayList<>();
    serviceProviders.forEach(serviceProviderType -> {
        Saml2KeyAuthenticationModuleType keysType = serviceProviderType.getKeys();
        Saml2ProviderAuthenticationModuleType providerType = serviceProviderType.getIdentityProvider();
        RelyingPartyRegistration.Builder registrationBuilder = getRelyingPartyFromMetadata(providerType.getMetadata(), providerType);
        SamlAdditionalConfiguration.Builder additionalConfigBuilder = SamlAdditionalConfiguration.builder();
        createRelyingPartyRegistration(registrationBuilder, additionalConfigBuilder, providerType, publicHttpUrlPattern, configuration, keysType, serviceProviderType, request);
        RelyingPartyRegistration registration = registrationBuilder.build();
        registrations.add(registration);
        configuration.additionalConfiguration.put(registration.getRegistrationId(), additionalConfigBuilder.build());
    });
    InMemoryRelyingPartyRegistrationRepository relyingPartyRegistrationRepository = new InMemoryRelyingPartyRegistrationRepository(registrations);
    configuration.setRelyingPartyRegistrationRepository(relyingPartyRegistrationRepository);
    return configuration;
}

Example 62 with RelyingPartyRegistration

use of org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration in project spring-security by spring-projects.

the class OpenSamlLogoutResponseResolver method resolve.

Saml2LogoutResponse resolve(HttpServletRequest request, Authentication authentication, BiConsumer<RelyingPartyRegistration, LogoutResponse> logoutResponseConsumer) {
    String registrationId = getRegistrationId(authentication);
    RelyingPartyRegistration registration = this.relyingPartyRegistrationResolver.resolve(request, registrationId);
    if (registration == null) {
        return null;
    }
    if (registration.getAssertingPartyDetails().getSingleLogoutServiceResponseLocation() == null) {
        return null;
    }
    String serialized = request.getParameter(Saml2ParameterNames.SAML_REQUEST);
    byte[] b = Saml2Utils.samlDecode(serialized);
    LogoutRequest logoutRequest = parse(inflateIfRequired(registration, b));
    LogoutResponse logoutResponse = this.logoutResponseBuilder.buildObject();
    logoutResponse.setDestination(registration.getAssertingPartyDetails().getSingleLogoutServiceResponseLocation());
    Issuer issuer = this.issuerBuilder.buildObject();
    issuer.setValue(registration.getEntityId());
    logoutResponse.setIssuer(issuer);
    StatusCode code = this.statusCodeBuilder.buildObject();
    code.setValue(StatusCode.SUCCESS);
    Status status = this.statusBuilder.buildObject();
    status.setStatusCode(code);
    logoutResponse.setStatus(status);
    logoutResponse.setInResponseTo(logoutRequest.getID());
    if (logoutResponse.getID() == null) {
        logoutResponse.setID("LR" + UUID.randomUUID());
    }
    logoutResponseConsumer.accept(registration, logoutResponse);
    Saml2LogoutResponse.Builder result = Saml2LogoutResponse.withRelyingPartyRegistration(registration);
    if (registration.getAssertingPartyDetails().getSingleLogoutServiceBinding() == Saml2MessageBinding.POST) {
        String xml = serialize(OpenSamlSigningUtils.sign(logoutResponse, registration));
        String samlResponse = Saml2Utils.samlEncode(xml.getBytes(StandardCharsets.UTF_8));
        result.samlResponse(samlResponse);
        if (request.getParameter(Saml2ParameterNames.RELAY_STATE) != null) {
            result.relayState(request.getParameter(Saml2ParameterNames.RELAY_STATE));
        }
        return result.build();
    } else {
        String xml = serialize(logoutResponse);
        String deflatedAndEncoded = Saml2Utils.samlEncode(Saml2Utils.samlDeflate(xml));
        result.samlResponse(deflatedAndEncoded);
        QueryParametersPartial partial = OpenSamlSigningUtils.sign(registration).param(Saml2ParameterNames.SAML_RESPONSE, deflatedAndEncoded);
        if (request.getParameter(Saml2ParameterNames.RELAY_STATE) != null) {
            partial.param(Saml2ParameterNames.RELAY_STATE, request.getParameter(Saml2ParameterNames.RELAY_STATE));
        }
        return result.parameters((params) -> params.putAll(partial.parameters())).build();
    }
}

Example 63 with RelyingPartyRegistration

use of org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration in project spring-security by spring-projects.

the class OpenSamlAuthenticationRequestResolver method resolve.

<T extends AbstractSaml2AuthenticationRequest> T resolve(HttpServletRequest request, BiConsumer<RelyingPartyRegistration, AuthnRequest> authnRequestConsumer) {
    RequestMatcher.MatchResult result = this.requestMatcher.matcher(request);
    if (!result.isMatch()) {
        return null;
    }
    String registrationId = result.getVariables().get("registrationId");
    RelyingPartyRegistration registration = this.relyingPartyRegistrationResolver.resolve(request, registrationId);
    if (registration == null) {
        return null;
    }
    AuthnRequest authnRequest = this.authnRequestBuilder.buildObject();
    authnRequest.setForceAuthn(Boolean.FALSE);
    authnRequest.setIsPassive(Boolean.FALSE);
    authnRequest.setProtocolBinding(registration.getAssertionConsumerServiceBinding().getUrn());
    Issuer iss = this.issuerBuilder.buildObject();
    iss.setValue(registration.getEntityId());
    authnRequest.setIssuer(iss);
    authnRequest.setDestination(registration.getAssertingPartyDetails().getSingleSignOnServiceLocation());
    authnRequest.setAssertionConsumerServiceURL(registration.getAssertionConsumerServiceLocation());
    authnRequestConsumer.accept(registration, authnRequest);
    if (authnRequest.getID() == null) {
        authnRequest.setID("ARQ" + UUID.randomUUID().toString().substring(1));
    }
    String relayState = UUID.randomUUID().toString();
    Saml2MessageBinding binding = registration.getAssertingPartyDetails().getSingleSignOnServiceBinding();
    if (binding == Saml2MessageBinding.POST) {
        if (registration.getAssertingPartyDetails().getWantAuthnRequestsSigned()) {
            OpenSamlSigningUtils.sign(authnRequest, registration);
        }
        String xml = serialize(authnRequest);
        String encoded = Saml2Utils.samlEncode(xml.getBytes(StandardCharsets.UTF_8));
        return (T) Saml2PostAuthenticationRequest.withRelyingPartyRegistration(registration).samlRequest(encoded).relayState(relayState).build();
    } else {
        String xml = serialize(authnRequest);
        String deflatedAndEncoded = Saml2Utils.samlEncode(Saml2Utils.samlDeflate(xml));
        Saml2RedirectAuthenticationRequest.Builder builder = Saml2RedirectAuthenticationRequest.withRelyingPartyRegistration(registration).samlRequest(deflatedAndEncoded).relayState(relayState);
        if (registration.getAssertingPartyDetails().getWantAuthnRequestsSigned()) {
            Map<String, String> parameters = OpenSamlSigningUtils.sign(registration).param(Saml2ParameterNames.SAML_REQUEST, deflatedAndEncoded).param(Saml2ParameterNames.RELAY_STATE, relayState).parameters();
            builder.sigAlg(parameters.get(Saml2ParameterNames.SIG_ALG)).signature(parameters.get(Saml2ParameterNames.SIGNATURE));
        }
        return (T) builder.build();
    }
}

Example 64 with RelyingPartyRegistration

use of org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration in project spring-security by spring-projects.

the class OpenSamlLogoutRequestResolver method resolve.

Saml2LogoutRequest resolve(HttpServletRequest request, Authentication authentication, BiConsumer<RelyingPartyRegistration, LogoutRequest> logoutRequestConsumer) {
    String registrationId = getRegistrationId(authentication);
    RelyingPartyRegistration registration = this.relyingPartyRegistrationResolver.resolve(request, registrationId);
    if (registration == null) {
        return null;
    }
    if (registration.getAssertingPartyDetails().getSingleLogoutServiceLocation() == null) {
        return null;
    }
    LogoutRequest logoutRequest = this.logoutRequestBuilder.buildObject();
    logoutRequest.setDestination(registration.getAssertingPartyDetails().getSingleLogoutServiceLocation());
    Issuer issuer = this.issuerBuilder.buildObject();
    issuer.setValue(registration.getEntityId());
    logoutRequest.setIssuer(issuer);
    NameID nameId = this.nameIdBuilder.buildObject();
    nameId.setValue(authentication.getName());
    logoutRequest.setNameID(nameId);
    if (authentication.getPrincipal() instanceof Saml2AuthenticatedPrincipal) {
        Saml2AuthenticatedPrincipal principal = (Saml2AuthenticatedPrincipal) authentication.getPrincipal();
        for (String index : principal.getSessionIndexes()) {
            SessionIndex sessionIndex = this.sessionIndexBuilder.buildObject();
            sessionIndex.setSessionIndex(index);
            logoutRequest.getSessionIndexes().add(sessionIndex);
        }
    }
    logoutRequestConsumer.accept(registration, logoutRequest);
    if (logoutRequest.getID() == null) {
        logoutRequest.setID("LR" + UUID.randomUUID());
    }
    String relayState = UUID.randomUUID().toString();
    Saml2LogoutRequest.Builder result = Saml2LogoutRequest.withRelyingPartyRegistration(registration).id(logoutRequest.getID());
    if (registration.getAssertingPartyDetails().getSingleLogoutServiceBinding() == Saml2MessageBinding.POST) {
        String xml = serialize(OpenSamlSigningUtils.sign(logoutRequest, registration));
        String samlRequest = Saml2Utils.samlEncode(xml.getBytes(StandardCharsets.UTF_8));
        return result.samlRequest(samlRequest).relayState(relayState).build();
    } else {
        String xml = serialize(logoutRequest);
        String deflatedAndEncoded = Saml2Utils.samlEncode(Saml2Utils.samlDeflate(xml));
        result.samlRequest(deflatedAndEncoded);
        QueryParametersPartial partial = OpenSamlSigningUtils.sign(registration).param(Saml2ParameterNames.SAML_REQUEST, deflatedAndEncoded).param(Saml2ParameterNames.RELAY_STATE, relayState);
        return result.parameters((params) -> params.putAll(partial.parameters())).build();
    }
}

Example 65 with RelyingPartyRegistration

use of org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration in project spring-security by spring-projects.

the class OpenSamlSigningUtils method resolveSigningCredentials.

private static List<Credential> resolveSigningCredentials(RelyingPartyRegistration relyingPartyRegistration) {
    List<Credential> credentials = new ArrayList<>();
    for (Saml2X509Credential x509Credential : relyingPartyRegistration.getSigningX509Credentials()) {
        X509Certificate certificate = x509Credential.getCertificate();
        PrivateKey privateKey = x509Credential.getPrivateKey();
        BasicCredential credential = CredentialSupport.getSimpleCredential(certificate, privateKey);
        credential.setEntityId(relyingPartyRegistration.getEntityId());
        credential.setUsageType(UsageType.SIGNING);
        credentials.add(credential);
    }
    return credentials;
}