Examples with Saml2MessageBinding org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding used on opensource projects

Example 11 with Saml2MessageBinding

use of org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding in project spring-security by spring-projects.

the class OpenSamlMetadataAssertingPartyDetailsConverter method convert.

RelyingPartyRegistration.AssertingPartyDetails.Builder convert(EntityDescriptor descriptor) {
    IDPSSODescriptor idpssoDescriptor = descriptor.getIDPSSODescriptor(SAMLConstants.SAML20P_NS);
    if (idpssoDescriptor == null) {
        throw new Saml2Exception("Metadata response is missing the necessary IDPSSODescriptor element");
    }
    List<Saml2X509Credential> verification = new ArrayList<>();
    List<Saml2X509Credential> encryption = new ArrayList<>();
    for (KeyDescriptor keyDescriptor : idpssoDescriptor.getKeyDescriptors()) {
        if (keyDescriptor.getUse().equals(UsageType.SIGNING)) {
            List<X509Certificate> certificates = certificates(keyDescriptor);
            for (X509Certificate certificate : certificates) {
                verification.add(Saml2X509Credential.verification(certificate));
            }
        }
        if (keyDescriptor.getUse().equals(UsageType.ENCRYPTION)) {
            List<X509Certificate> certificates = certificates(keyDescriptor);
            for (X509Certificate certificate : certificates) {
                encryption.add(Saml2X509Credential.encryption(certificate));
            }
        }
        if (keyDescriptor.getUse().equals(UsageType.UNSPECIFIED)) {
            List<X509Certificate> certificates = certificates(keyDescriptor);
            for (X509Certificate certificate : certificates) {
                verification.add(Saml2X509Credential.verification(certificate));
                encryption.add(Saml2X509Credential.encryption(certificate));
            }
        }
    }
    if (verification.isEmpty()) {
        throw new Saml2Exception("Metadata response is missing verification certificates, necessary for verifying SAML assertions");
    }
    RelyingPartyRegistration.AssertingPartyDetails.Builder party = OpenSamlAssertingPartyDetails.withEntityDescriptor(descriptor).entityId(descriptor.getEntityID()).wantAuthnRequestsSigned(Boolean.TRUE.equals(idpssoDescriptor.getWantAuthnRequestsSigned())).verificationX509Credentials((c) -> c.addAll(verification)).encryptionX509Credentials((c) -> c.addAll(encryption));
    List<SigningMethod> signingMethods = signingMethods(idpssoDescriptor);
    for (SigningMethod method : signingMethods) {
        party.signingAlgorithms((algorithms) -> algorithms.add(method.getAlgorithm()));
    }
    if (idpssoDescriptor.getSingleSignOnServices().isEmpty()) {
        throw new Saml2Exception("Metadata response is missing a SingleSignOnService, necessary for sending AuthnRequests");
    }
    for (SingleSignOnService singleSignOnService : idpssoDescriptor.getSingleSignOnServices()) {
        Saml2MessageBinding binding;
        if (singleSignOnService.getBinding().equals(Saml2MessageBinding.POST.getUrn())) {
            binding = Saml2MessageBinding.POST;
        } else if (singleSignOnService.getBinding().equals(Saml2MessageBinding.REDIRECT.getUrn())) {
            binding = Saml2MessageBinding.REDIRECT;
        } else {
            continue;
        }
        party.singleSignOnServiceLocation(singleSignOnService.getLocation()).singleSignOnServiceBinding(binding);
        break;
    }
    for (SingleLogoutService singleLogoutService : idpssoDescriptor.getSingleLogoutServices()) {
        Saml2MessageBinding binding;
        if (singleLogoutService.getBinding().equals(Saml2MessageBinding.POST.getUrn())) {
            binding = Saml2MessageBinding.POST;
        } else if (singleLogoutService.getBinding().equals(Saml2MessageBinding.REDIRECT.getUrn())) {
            binding = Saml2MessageBinding.REDIRECT;
        } else {
            continue;
        }
        String responseLocation = (singleLogoutService.getResponseLocation() == null) ? singleLogoutService.getLocation() : singleLogoutService.getResponseLocation();
        party.singleLogoutServiceLocation(singleLogoutService.getLocation()).singleLogoutServiceResponseLocation(responseLocation).singleLogoutServiceBinding(binding);
        break;
    }
    return party;
}

Example 12 with Saml2MessageBinding

use of org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding in project spring-security by spring-projects.

the class OpenSamlLogoutResponseResolverTests method resolveRedirectWhenAuthenticatedThenSuccess.

@Test
public void resolveRedirectWhenAuthenticatedThenSuccess() {
    RelyingPartyRegistration registration = TestRelyingPartyRegistrations.full().build();
    MockHttpServletRequest request = new MockHttpServletRequest();
    LogoutRequest logoutRequest = TestOpenSamlObjects.assertingPartyLogoutRequest(registration);
    request.setParameter(Saml2ParameterNames.SAML_REQUEST, Saml2Utils.samlEncode(OpenSamlSigningUtils.serialize(logoutRequest).getBytes()));
    request.setParameter(Saml2ParameterNames.RELAY_STATE, "abcd");
    Authentication authentication = authentication(registration);
    given(this.relyingPartyRegistrationResolver.resolve(any(), any())).willReturn(registration);
    Saml2LogoutResponse saml2LogoutResponse = this.logoutResponseResolver.resolve(request, authentication);
    assertThat(saml2LogoutResponse.getParameter(Saml2ParameterNames.SIG_ALG)).isNotNull();
    assertThat(saml2LogoutResponse.getParameter(Saml2ParameterNames.SIGNATURE)).isNotNull();
    assertThat(saml2LogoutResponse.getParameter(Saml2ParameterNames.RELAY_STATE)).isSameAs("abcd");
    Saml2MessageBinding binding = registration.getAssertingPartyDetails().getSingleLogoutServiceBinding();
    LogoutResponse logoutResponse = getLogoutResponse(saml2LogoutResponse.getSamlResponse(), binding);
    assertThat(logoutResponse.getStatus().getStatusCode().getValue()).isEqualTo(StatusCode.SUCCESS);
}

Example 13 with Saml2MessageBinding

use of org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding in project spring-security by spring-projects.

the class OpenSamlAuthenticationRequestFactory method createAuthenticationRequest.

@Override
@Deprecated
public String createAuthenticationRequest(Saml2AuthenticationRequest request) {
    Saml2MessageBinding binding = this.protocolBindingResolver.convert(null);
    RelyingPartyRegistration registration = RelyingPartyRegistration.withRegistrationId("noId").assertionConsumerServiceBinding(binding).assertionConsumerServiceLocation(request.getAssertionConsumerServiceUrl()).entityId(request.getIssuer()).remoteIdpEntityId("noIssuer").idpWebSsoUrl("noUrl").credentials((credentials) -> credentials.addAll(request.getCredentials())).build();
    Saml2AuthenticationRequestContext context = Saml2AuthenticationRequestContext.builder().relyingPartyRegistration(registration).issuer(request.getIssuer()).assertionConsumerServiceUrl(request.getAssertionConsumerServiceUrl()).build();
    AuthnRequest authnRequest = this.authenticationRequestContextConverter.convert(context);
    return OpenSamlSigningUtils.serialize(OpenSamlSigningUtils.sign(authnRequest, registration));
}

Example 14 with Saml2MessageBinding

use of org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding in project spring-security by spring-projects.

the class OpenSamlAuthenticationRequestFactory method setProtocolBinding.

/**
 * Sets the {@code protocolBinding} to use when generating authentication requests.
 * Acceptable values are {@link SAMLConstants#SAML2_POST_BINDING_URI} and
 * {@link SAMLConstants#SAML2_REDIRECT_BINDING_URI} The IDP will be reading this value
 * in the {@code AuthNRequest} to determine how to send the Response/Assertion to the
 * ACS URL, assertion consumer service URL.
 * @param protocolBinding either {@link SAMLConstants#SAML2_POST_BINDING_URI} or
 * {@link SAMLConstants#SAML2_REDIRECT_BINDING_URI}
 * @throws IllegalArgumentException if the protocolBinding is not valid
 * @deprecated Use
 * {@link org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration.Builder#assertionConsumerServiceBinding(Saml2MessageBinding)}
 * instead
 */
@Deprecated
public void setProtocolBinding(String protocolBinding) {
    Saml2MessageBinding binding = Saml2MessageBinding.from(protocolBinding);
    Assert.notNull(binding, "Invalid protocol binding: " + protocolBinding);
    this.protocolBindingResolver = (context) -> binding;
}

Example 15 with Saml2MessageBinding

use of org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding in project spring-security by spring-projects.

the class OpenSaml4AuthenticationRequestFactoryTests method getAuthNRequest.

private AuthnRequest getAuthNRequest(Saml2MessageBinding binding) {
    AbstractSaml2AuthenticationRequest result = (binding == Saml2MessageBinding.REDIRECT) ? this.factory.createRedirectAuthenticationRequest(this.context) : this.factory.createPostAuthenticationRequest(this.context);
    String samlRequest = result.getSamlRequest();
    assertThat(samlRequest).isNotEmpty();
    if (result.getBinding() == Saml2MessageBinding.REDIRECT) {
        samlRequest = Saml2Utils.samlInflate(Saml2Utils.samlDecode(samlRequest));
    } else {
        samlRequest = new String(Saml2Utils.samlDecode(samlRequest), StandardCharsets.UTF_8);
    }
    try {
        Document document = XMLObjectProviderRegistrySupport.getParserPool().parse(new ByteArrayInputStream(samlRequest.getBytes(StandardCharsets.UTF_8)));
        Element element = document.getDocumentElement();
        return (AuthnRequest) this.unmarshaller.unmarshall(element);
    } catch (Exception ex) {
        throw new Saml2Exception(ex);
    }
}