Examples with RelyingPartyRegistration org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration used on opensource projects

Example 21 with RelyingPartyRegistration

use of org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration in project spring-security by spring-projects.

the class RelyingPartyRegistrationsTests method collectionFromMetadataLocationWhenResolvableThenPopulatesBuilder.

@Test
public void collectionFromMetadataLocationWhenResolvableThenPopulatesBuilder() throws Exception {
    try (MockWebServer server = new MockWebServer()) {
        server.enqueue(new MockResponse().setBody(this.entitiesDescriptor).setResponseCode(200));
        List<RelyingPartyRegistration> registrations = RelyingPartyRegistrations.collectionFromMetadataLocation(server.url("/").toString()).stream().map((r) -> r.entityId("rp").build()).collect(Collectors.toList());
        assertThat(registrations).hasSize(2);
        RelyingPartyRegistration first = registrations.get(0);
        RelyingPartyRegistration.AssertingPartyDetails details = first.getAssertingPartyDetails();
        assertThat(details.getEntityId()).isEqualTo("https://idp.example.com/idp/shibboleth");
        assertThat(details.getSingleSignOnServiceLocation()).isEqualTo("https://idp.example.com/idp/profile/SAML2/POST/SSO");
        assertThat(details.getSingleSignOnServiceBinding()).isEqualTo(Saml2MessageBinding.POST);
        assertThat(details.getVerificationX509Credentials()).hasSize(1);
        assertThat(details.getEncryptionX509Credentials()).hasSize(1);
        RelyingPartyRegistration second = registrations.get(1);
        details = second.getAssertingPartyDetails();
        assertThat(details.getEntityId()).isEqualTo("https://ap.example.org/idp/shibboleth");
        assertThat(details.getSingleSignOnServiceLocation()).isEqualTo("https://ap.example.org/idp/profile/SAML2/POST/SSO");
        assertThat(details.getSingleSignOnServiceBinding()).isEqualTo(Saml2MessageBinding.POST);
        assertThat(details.getVerificationX509Credentials()).hasSize(1);
        assertThat(details.getEncryptionX509Credentials()).hasSize(1);
    }
}

Example 22 with RelyingPartyRegistration

use of org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration in project spring-security by spring-projects.

the class Saml2LogoutConfigurerTests method saml2LogoutResponseWhenInvalidSamlResponseThen401.

@Test
public void saml2LogoutResponseWhenInvalidSamlResponseThen401() throws Exception {
    this.spring.register(Saml2LogoutDefaultsConfig.class).autowire();
    RelyingPartyRegistration registration = this.repository.findByRegistrationId("registration-id");
    Saml2LogoutRequest logoutRequest = Saml2LogoutRequest.withRelyingPartyRegistration(registration).samlRequest(this.rpLogoutRequest).id(this.rpLogoutRequestId).relayState(this.rpLogoutRequestRelayState).parameters((params) -> params.put("Signature", this.rpLogoutRequestSignature)).build();
    this.logoutRequestRepository.saveLogoutRequest(logoutRequest, this.request, this.response);
    String deflatedApLogoutResponse = Saml2Utils.samlEncode(Saml2Utils.samlInflate(Saml2Utils.samlDecode(this.apLogoutResponse)).getBytes(StandardCharsets.UTF_8));
    this.mvc.perform(post("/logout/saml2/slo").session((MockHttpSession) this.request.getSession()).param("SAMLResponse", deflatedApLogoutResponse).param("RelayState", this.rpLogoutRequestRelayState).param("SigAlg", this.apLogoutRequestSigAlg).param("Signature", this.apLogoutResponseSignature)).andExpect(status().reason(containsString("invalid_signature"))).andExpect(status().isUnauthorized());
    verifyNoInteractions(getBean(LogoutHandler.class));
}

Example 23 with RelyingPartyRegistration

use of org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration in project spring-security by spring-projects.

the class Saml2LogoutConfigurerTests method saml2LogoutResponseWhenDefaultsThenRedirects.

@Test
public void saml2LogoutResponseWhenDefaultsThenRedirects() throws Exception {
    this.spring.register(Saml2LogoutDefaultsConfig.class).autowire();
    RelyingPartyRegistration registration = this.repository.findByRegistrationId("get");
    Saml2LogoutRequest logoutRequest = Saml2LogoutRequest.withRelyingPartyRegistration(registration).samlRequest(this.rpLogoutRequest).id(this.rpLogoutRequestId).relayState(this.rpLogoutRequestRelayState).parameters((params) -> params.put("Signature", this.rpLogoutRequestSignature)).build();
    this.logoutRequestRepository.saveLogoutRequest(logoutRequest, this.request, this.response);
    this.request.setParameter("RelayState", logoutRequest.getRelayState());
    assertThat(this.logoutRequestRepository.loadLogoutRequest(this.request)).isNotNull();
    this.mvc.perform(get("/logout/saml2/slo").session(((MockHttpSession) this.request.getSession())).param("SAMLResponse", this.apLogoutResponse).param("RelayState", this.apLogoutResponseRelayState).param("SigAlg", this.apLogoutResponseSigAlg).param("Signature", this.apLogoutResponseSignature)).andExpect(status().isFound()).andExpect(redirectedUrl("/login?logout"));
    verifyNoInteractions(getBean(LogoutHandler.class));
    assertThat(this.logoutRequestRepository.loadLogoutRequest(this.request)).isNull();
}

Example 24 with RelyingPartyRegistration

use of org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration in project spring-security by spring-projects.

the class Saml2LogoutResponseFilter method doFilterInternal.

/**
 * {@inheritDoc}
 */
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
    if (!this.logoutRequestMatcher.matches(request)) {
        chain.doFilter(request, response);
        return;
    }
    if (request.getParameter(Saml2ParameterNames.SAML_RESPONSE) == null) {
        chain.doFilter(request, response);
        return;
    }
    Saml2LogoutRequest logoutRequest = this.logoutRequestRepository.removeLogoutRequest(request, response);
    if (logoutRequest == null) {
        this.logger.trace("Did not process logout response since could not find associated LogoutRequest");
        response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Failed to find associated LogoutRequest");
        return;
    }
    RelyingPartyRegistration registration = this.relyingPartyRegistrationResolver.resolve(request, logoutRequest.getRelyingPartyRegistrationId());
    if (registration == null) {
        this.logger.trace("Did not process logout request since failed to find associated RelyingPartyRegistration");
        Saml2Error error = new Saml2Error(Saml2ErrorCodes.RELYING_PARTY_REGISTRATION_NOT_FOUND, "Failed to find associated RelyingPartyRegistration");
        response.sendError(HttpServletResponse.SC_BAD_REQUEST, error.toString());
        return;
    }
    if (registration.getSingleLogoutServiceResponseLocation() == null) {
        this.logger.trace("Did not process logout response since RelyingPartyRegistration has not been configured with a logout response endpoint");
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
        return;
    }
    if (!isCorrectBinding(request, registration)) {
        this.logger.trace("Did not process logout request since used incorrect binding");
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
        return;
    }
    String serialized = request.getParameter(Saml2ParameterNames.SAML_RESPONSE);
    Saml2LogoutResponse logoutResponse = Saml2LogoutResponse.withRelyingPartyRegistration(registration).samlResponse(serialized).relayState(request.getParameter(Saml2ParameterNames.RELAY_STATE)).binding(registration.getSingleLogoutServiceBinding()).location(registration.getSingleLogoutServiceResponseLocation()).parameters((params) -> params.put(Saml2ParameterNames.SIG_ALG, request.getParameter(Saml2ParameterNames.SIG_ALG))).parameters((params) -> params.put(Saml2ParameterNames.SIGNATURE, request.getParameter(Saml2ParameterNames.SIGNATURE))).build();
    Saml2LogoutResponseValidatorParameters parameters = new Saml2LogoutResponseValidatorParameters(logoutResponse, logoutRequest, registration);
    Saml2LogoutValidatorResult result = this.logoutResponseValidator.validate(parameters);
    if (result.hasErrors()) {
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, result.getErrors().iterator().next().toString());
        this.logger.debug(LogMessage.format("Failed to validate LogoutResponse: %s", result.getErrors()));
        return;
    }
    this.logoutSuccessHandler.onLogoutSuccess(request, response, null);
}

Example 25 with RelyingPartyRegistration

use of org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration in project spring-security by spring-projects.

the class OpenSamlAuthenticationRequestFactoryTests method createPostAuthenticationRequestWhenSignRequestThenCredentialIsRequired.

@Test
public void createPostAuthenticationRequestWhenSignRequestThenCredentialIsRequired() {
    Saml2X509Credential credential = org.springframework.security.saml2.core.TestSaml2X509Credentials.relyingPartyVerifyingCredential();
    RelyingPartyRegistration registration = TestRelyingPartyRegistrations.noCredentials().assertingPartyDetails((party) -> party.verificationX509Credentials((c) -> c.add(credential))).build();
    this.context = this.contextBuilder.relayState("Relay State Value").relyingPartyRegistration(registration).build();
    assertThatExceptionOfType(Saml2Exception.class).isThrownBy(() -> this.factory.createPostAuthenticationRequest(this.context));
}