Examples with Saml2MessageBinding org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding used on opensource projects

Example 6 with Saml2MessageBinding

use of org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding in project spring-security by spring-projects.

the class OpenSamlLogoutResponseResolverTests method resolvePostWhenAuthenticatedThenSuccess.

@Test
public void resolvePostWhenAuthenticatedThenSuccess() {
    RelyingPartyRegistration registration = TestRelyingPartyRegistrations.full().assertingPartyDetails((party) -> party.singleLogoutServiceBinding(Saml2MessageBinding.POST)).build();
    MockHttpServletRequest request = new MockHttpServletRequest();
    LogoutRequest logoutRequest = TestOpenSamlObjects.assertingPartyLogoutRequest(registration);
    request.setParameter(Saml2ParameterNames.SAML_REQUEST, Saml2Utils.samlEncode(OpenSamlSigningUtils.serialize(logoutRequest).getBytes()));
    request.setParameter(Saml2ParameterNames.RELAY_STATE, "abcd");
    Authentication authentication = authentication(registration);
    given(this.relyingPartyRegistrationResolver.resolve(any(), any())).willReturn(registration);
    Saml2LogoutResponse saml2LogoutResponse = this.logoutResponseResolver.resolve(request, authentication);
    assertThat(saml2LogoutResponse.getParameter(Saml2ParameterNames.SIG_ALG)).isNull();
    assertThat(saml2LogoutResponse.getParameter(Saml2ParameterNames.SIGNATURE)).isNull();
    assertThat(saml2LogoutResponse.getParameter(Saml2ParameterNames.RELAY_STATE)).isSameAs("abcd");
    Saml2MessageBinding binding = registration.getAssertingPartyDetails().getSingleLogoutServiceBinding();
    LogoutResponse logoutResponse = getLogoutResponse(saml2LogoutResponse.getSamlResponse(), binding);
    assertThat(logoutResponse.getStatus().getStatusCode().getValue()).isEqualTo(StatusCode.SUCCESS);
}

Example 7 with Saml2MessageBinding

use of org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding in project spring-security by spring-projects.

the class OpenSamlLogoutResponseResolverTests method getLogoutResponse.

private LogoutResponse getLogoutResponse(String saml2Response, Saml2MessageBinding binding) {
    if (binding == Saml2MessageBinding.REDIRECT) {
        saml2Response = Saml2Utils.samlInflate(Saml2Utils.samlDecode(saml2Response));
    } else {
        saml2Response = new String(Saml2Utils.samlDecode(saml2Response), StandardCharsets.UTF_8);
    }
    try {
        Document document = XMLObjectProviderRegistrySupport.getParserPool().parse(new ByteArrayInputStream(saml2Response.getBytes(StandardCharsets.UTF_8)));
        Element element = document.getDocumentElement();
        return (LogoutResponse) XMLObjectProviderRegistrySupport.getUnmarshallerFactory().getUnmarshaller(element).unmarshall(element);
    } catch (Exception ex) {
        throw new Saml2Exception(ex);
    }
}

Example 8 with Saml2MessageBinding

use of org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding in project midpoint by Evolveum.

the class MidpointAssertingPartyMetadataConverter method defineSingleSingOnService.

private void defineSingleSingOnService(IDPSSODescriptor idpssoDescriptor, String authenticationRequestBinding, RelyingPartyRegistration.Builder builder) {
    Saml2MessageBinding defaultBinding = Saml2MessageBinding.from(authenticationRequestBinding);
    if (defaultBinding == null && StringUtils.isNotEmpty(authenticationRequestBinding) && !defaultBinding.equals(Saml2MessageBinding.POST) && !defaultBinding.equals(Saml2MessageBinding.REDIRECT)) {
        throw new Saml2Exception("Default request binding '" + defaultBinding.getUrn() + "' isn't supported." + "Supported bindings are 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' and 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'.");
    }
    Saml2MessageBinding authBinding = null;
    for (SingleSignOnService singleSignOnService : idpssoDescriptor.getSingleSignOnServices()) {
        if (singleSignOnService.getBinding().equals(Saml2MessageBinding.POST.getUrn()) && allowBaseOnConsideringDefaultBinding(defaultBinding, Saml2MessageBinding.POST)) {
            authBinding = Saml2MessageBinding.POST;
        } else if (singleSignOnService.getBinding().equals(Saml2MessageBinding.REDIRECT.getUrn()) && allowBaseOnConsideringDefaultBinding(defaultBinding, Saml2MessageBinding.REDIRECT)) {
            authBinding = Saml2MessageBinding.REDIRECT;
        } else {
            continue;
        }
        Saml2MessageBinding finalAuthBinding = authBinding;
        builder.assertingPartyDetails((party) -> party.singleSignOnServiceLocation(singleSignOnService.getLocation()).singleSignOnServiceBinding(finalAuthBinding));
        break;
    }
    if (authBinding == null) {
        String message = "Supported SingleSignOnService is missing in metadata response, necessary for sending authentication request. ";
        if (defaultBinding != null) {
            message = "Default SingleSignOnService '" + defaultBinding.getUrn() + "' is missing in metadata response, necessary for sending authentication request. ";
        }
        message = message + "Supported bindings are 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' and 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'.";
        throw new Saml2Exception(message);
    }
}

Example 9 with Saml2MessageBinding

use of org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding in project midpoint by Evolveum.

the class MidpointAssertingPartyMetadataConverter method defineSingleLogoutService.

private void defineSingleLogoutService(IDPSSODescriptor idpssoDescriptor, RelyingPartyRegistration.Builder builder) {
    Saml2MessageBinding authBinding = null;
    for (SingleLogoutService singleLogoutService : idpssoDescriptor.getSingleLogoutServices()) {
        if (singleLogoutService.getBinding().equals(Saml2MessageBinding.POST.getUrn())) {
            authBinding = Saml2MessageBinding.POST;
        } else if (singleLogoutService.getBinding().equals(Saml2MessageBinding.REDIRECT.getUrn())) {
            authBinding = Saml2MessageBinding.REDIRECT;
        } else {
            continue;
        }
        Saml2MessageBinding finalAuthBinding = authBinding;
        builder.assertingPartyDetails((party) -> party.singleLogoutServiceLocation(singleLogoutService.getLocation()).singleLogoutServiceBinding(finalAuthBinding));
        break;
    }
    if (authBinding == null) {
        throw new Saml2Exception("Metadata response is missing a SingleLogoutService, necessary for sending LogoutRequests");
    }
}

Example 10 with Saml2MessageBinding

use of org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding in project spring-security by spring-projects.

the class OpenSamlAuthenticationRequestResolver method resolve.

<T extends AbstractSaml2AuthenticationRequest> T resolve(HttpServletRequest request, BiConsumer<RelyingPartyRegistration, AuthnRequest> authnRequestConsumer) {
    RequestMatcher.MatchResult result = this.requestMatcher.matcher(request);
    if (!result.isMatch()) {
        return null;
    }
    String registrationId = result.getVariables().get("registrationId");
    RelyingPartyRegistration registration = this.relyingPartyRegistrationResolver.resolve(request, registrationId);
    if (registration == null) {
        return null;
    }
    AuthnRequest authnRequest = this.authnRequestBuilder.buildObject();
    authnRequest.setForceAuthn(Boolean.FALSE);
    authnRequest.setIsPassive(Boolean.FALSE);
    authnRequest.setProtocolBinding(registration.getAssertionConsumerServiceBinding().getUrn());
    Issuer iss = this.issuerBuilder.buildObject();
    iss.setValue(registration.getEntityId());
    authnRequest.setIssuer(iss);
    authnRequest.setDestination(registration.getAssertingPartyDetails().getSingleSignOnServiceLocation());
    authnRequest.setAssertionConsumerServiceURL(registration.getAssertionConsumerServiceLocation());
    authnRequestConsumer.accept(registration, authnRequest);
    if (authnRequest.getID() == null) {
        authnRequest.setID("ARQ" + UUID.randomUUID().toString().substring(1));
    }
    String relayState = UUID.randomUUID().toString();
    Saml2MessageBinding binding = registration.getAssertingPartyDetails().getSingleSignOnServiceBinding();
    if (binding == Saml2MessageBinding.POST) {
        if (registration.getAssertingPartyDetails().getWantAuthnRequestsSigned()) {
            OpenSamlSigningUtils.sign(authnRequest, registration);
        }
        String xml = serialize(authnRequest);
        String encoded = Saml2Utils.samlEncode(xml.getBytes(StandardCharsets.UTF_8));
        return (T) Saml2PostAuthenticationRequest.withRelyingPartyRegistration(registration).samlRequest(encoded).relayState(relayState).build();
    } else {
        String xml = serialize(authnRequest);
        String deflatedAndEncoded = Saml2Utils.samlEncode(Saml2Utils.samlDeflate(xml));
        Saml2RedirectAuthenticationRequest.Builder builder = Saml2RedirectAuthenticationRequest.withRelyingPartyRegistration(registration).samlRequest(deflatedAndEncoded).relayState(relayState);
        if (registration.getAssertingPartyDetails().getWantAuthnRequestsSigned()) {
            Map<String, String> parameters = OpenSamlSigningUtils.sign(registration).param(Saml2ParameterNames.SAML_REQUEST, deflatedAndEncoded).param(Saml2ParameterNames.RELAY_STATE, relayState).parameters();
            builder.sigAlg(parameters.get(Saml2ParameterNames.SIG_ALG)).signature(parameters.get(Saml2ParameterNames.SIGNATURE));
        }
        return (T) builder.build();
    }
}