Examples with SubjectConfirmationDataType xmlbeans.org.oasis.saml2.assertion.SubjectConfirmationDataType used on opensource projects

Example 1 with SubjectConfirmationDataType

use of xmlbeans.org.oasis.saml2.assertion.SubjectConfirmationDataType in project keycloak by keycloak.

the class SAML11ParserUtil method parseSAML11SubjectConfirmation.

/**
 * Parse the {@link org.keycloak.dom.saml.v1.assertion.SAML11SubjectConfirmationType}
 *
 * @param xmlEventReader
 *
 * @return
 *
 * @throws ParsingException
 */
public static SAML11SubjectConfirmationType parseSAML11SubjectConfirmation(XMLEventReader xmlEventReader) throws ParsingException {
    SAML11SubjectConfirmationType subjectConfirmationType = new SAML11SubjectConfirmationType();
    StartElement startElement = StaxParserUtil.getNextStartElement(xmlEventReader);
    // There may be additional things under subject confirmation
    while (xmlEventReader.hasNext()) {
        XMLEvent xmlEvent = StaxParserUtil.peek(xmlEventReader);
        if (xmlEvent instanceof EndElement) {
            EndElement endElement = StaxParserUtil.getNextEndElement(xmlEventReader);
            StaxParserUtil.validate(endElement, JBossSAMLConstants.SUBJECT_CONFIRMATION.get());
            break;
        }
        if (xmlEvent instanceof StartElement) {
            startElement = (StartElement) xmlEvent;
            String startTag = StaxParserUtil.getElementName(startElement);
            if (startTag.equals(SAML11Constants.CONFIRMATION_METHOD)) {
                startElement = StaxParserUtil.getNextStartElement(xmlEventReader);
                String method = StaxParserUtil.getElementText(xmlEventReader);
                subjectConfirmationType.addConfirmationMethod(URI.create(method));
            } else if (startTag.equals(JBossSAMLConstants.SUBJECT_CONFIRMATION_DATA.get())) {
                startElement = StaxParserUtil.getNextStartElement(xmlEventReader);
                SubjectConfirmationDataType subjectConfirmationData = parseSubjectConfirmationData(xmlEventReader);
                subjectConfirmationType.setSubjectConfirmationData(subjectConfirmationData);
            } else if (startTag.equals(JBossSAMLConstants.KEY_INFO.get())) {
                Element keyInfo = StaxParserUtil.getDOMElement(xmlEventReader);
                subjectConfirmationType.setKeyInfo(keyInfo);
            } else
                throw logger.parserUnknownTag(startTag, startElement.getLocation());
        }
    }
    return subjectConfirmationType;
}

Example 2 with SubjectConfirmationDataType

use of xmlbeans.org.oasis.saml2.assertion.SubjectConfirmationDataType in project keycloak by keycloak.

the class SAML11ParserUtil method parseSubjectConfirmationData.

/**
 * Parse the {@link SubjectConfirmationDataType}
 *
 * @param xmlEventReader
 *
 * @return
 *
 * @throws ParsingException
 */
public static SubjectConfirmationDataType parseSubjectConfirmationData(XMLEventReader xmlEventReader) throws ParsingException {
    StartElement startElement = StaxParserUtil.getNextStartElement(xmlEventReader);
    StaxParserUtil.validate(startElement, JBossSAMLConstants.SUBJECT_CONFIRMATION_DATA.get());
    SubjectConfirmationDataType subjectConfirmationData = new SubjectConfirmationDataType();
    Attribute inResponseTo = startElement.getAttributeByName(new QName(JBossSAMLConstants.IN_RESPONSE_TO.get()));
    if (inResponseTo != null) {
        subjectConfirmationData.setInResponseTo(StaxParserUtil.getAttributeValue(inResponseTo));
    }
    Attribute notBefore = startElement.getAttributeByName(new QName(JBossSAMLConstants.NOT_BEFORE.get()));
    if (notBefore != null) {
        subjectConfirmationData.setNotBefore(XMLTimeUtil.parse(StaxParserUtil.getAttributeValue(notBefore)));
    }
    Attribute notOnOrAfter = startElement.getAttributeByName(new QName(JBossSAMLConstants.NOT_ON_OR_AFTER.get()));
    if (notOnOrAfter != null) {
        subjectConfirmationData.setNotOnOrAfter(XMLTimeUtil.parse(StaxParserUtil.getAttributeValue(notOnOrAfter)));
    }
    Attribute recipient = startElement.getAttributeByName(new QName(JBossSAMLConstants.RECIPIENT.get()));
    if (recipient != null) {
        subjectConfirmationData.setRecipient(StaxParserUtil.getAttributeValue(recipient));
    }
    Attribute address = startElement.getAttributeByName(new QName(JBossSAMLConstants.ADDRESS.get()));
    if (address != null) {
        subjectConfirmationData.setAddress(StaxParserUtil.getAttributeValue(address));
    }
    XMLEvent xmlEvent = StaxParserUtil.peek(xmlEventReader);
    if (!(xmlEvent instanceof EndElement)) {
        startElement = StaxParserUtil.peekNextStartElement(xmlEventReader);
        String tag = StaxParserUtil.getElementName(startElement);
        if (tag.equals(WSTrustConstants.XMLDSig.KEYINFO)) {
            KeyInfoType keyInfo = parseKeyInfo(xmlEventReader);
            subjectConfirmationData.setAnyType(keyInfo);
        } else if (tag.equals(WSTrustConstants.XMLEnc.ENCRYPTED_KEY)) {
            subjectConfirmationData.setAnyType(StaxParserUtil.getDOMElement(xmlEventReader));
        } else
            throw logger.parserUnknownTag(tag, startElement.getLocation());
    }
    // Get the end tag
    EndElement endElement = (EndElement) StaxParserUtil.getNextEvent(xmlEventReader);
    StaxParserUtil.matches(endElement, JBossSAMLConstants.SUBJECT_CONFIRMATION_DATA.get());
    return subjectConfirmationData;
}

Example 3 with SubjectConfirmationDataType

use of xmlbeans.org.oasis.saml2.assertion.SubjectConfirmationDataType in project keycloak by keycloak.

the class SAMLSubjectConfirmationDataParser method instantiateElement.

@Override
protected SubjectConfirmationDataType instantiateElement(XMLEventReader xmlEventReader, StartElement element) throws ParsingException {
    final SubjectConfirmationDataType subjectConfirmationData = new SubjectConfirmationDataType();
    subjectConfirmationData.setInResponseTo(StaxParserUtil.getAttributeValue(element, SAMLAssertionQNames.ATTR_IN_RESPONSE_TO));
    subjectConfirmationData.setNotBefore(StaxParserUtil.getXmlTimeAttributeValue(element, SAMLAssertionQNames.ATTR_NOT_BEFORE));
    subjectConfirmationData.setNotOnOrAfter(StaxParserUtil.getXmlTimeAttributeValue(element, SAMLAssertionQNames.ATTR_NOT_ON_OR_AFTER));
    subjectConfirmationData.setRecipient(StaxParserUtil.getAttributeValue(element, SAMLAssertionQNames.ATTR_RECIPIENT));
    subjectConfirmationData.setAddress(StaxParserUtil.getAttributeValue(element, SAMLAssertionQNames.ATTR_ADDRESS));
    return subjectConfirmationData;
}

Example 4 with SubjectConfirmationDataType

use of xmlbeans.org.oasis.saml2.assertion.SubjectConfirmationDataType in project keycloak by keycloak.

the class SAMLSubjectConfirmationParser method processSubElement.

@Override
protected void processSubElement(XMLEventReader xmlEventReader, SubjectConfirmationType target, SAMLAssertionQNames element, StartElement elementDetail) throws ParsingException {
    switch(element) {
        case NAMEID:
            NameIDType nameID = SAMLParserUtil.parseNameIDType(xmlEventReader);
            target.setNameID(nameID);
            break;
        case ENCRYPTED_ID:
            Element domElement = StaxParserUtil.getDOMElement(xmlEventReader);
            target.setEncryptedID(new EncryptedElementType(domElement));
            break;
        case SUBJECT_CONFIRMATION_DATA:
            SubjectConfirmationDataType subjectConfirmationData = SAMLSubjectConfirmationDataParser.INSTANCE.parse(xmlEventReader);
            target.setSubjectConfirmationData(subjectConfirmationData);
            break;
        default:
            throw LOGGER.parserUnknownTag(StaxParserUtil.getElementName(elementDetail), elementDetail.getLocation());
    }
}

Example 5 with SubjectConfirmationDataType

use of xmlbeans.org.oasis.saml2.assertion.SubjectConfirmationDataType in project keycloak by keycloak.

the class SAMLEndpoint method validateInResponseToAttribute.

private boolean validateInResponseToAttribute(ResponseType responseType, String expectedRequestId) {
    // If we are not expecting a request ID, don't bother
    if (expectedRequestId == null || expectedRequestId.isEmpty())
        return true;
    // We are expecting a request ID so we are in SP-initiated login, attribute InResponseTo must be present
    if (responseType.getInResponseTo() == null) {
        logger.error("Response Validation Error: InResponseTo attribute was expected but not present in received response");
        return false;
    }
    // Attribute is present, proceed with validation
    // 1) Attribute Response > InResponseTo must not be empty
    String responseInResponseToValue = responseType.getInResponseTo();
    if (responseInResponseToValue.isEmpty()) {
        logger.error("Response Validation Error: InResponseTo attribute was expected but it is empty in received response");
        return false;
    }
    // 2) Attribute Response > InResponseTo must match request ID
    if (!responseInResponseToValue.equals(expectedRequestId)) {
        logger.error("Response Validation Error: received InResponseTo attribute does not match the expected request ID");
        return false;
    }
    // If present, Assertion > Subject > Confirmation > SubjectConfirmationData > InResponseTo must also be validated
    if (responseType.getAssertions().isEmpty())
        return true;
    SubjectType subjectElement = responseType.getAssertions().get(0).getAssertion().getSubject();
    if (subjectElement != null) {
        if (subjectElement.getConfirmation() != null && !subjectElement.getConfirmation().isEmpty()) {
            SubjectConfirmationType subjectConfirmationElement = subjectElement.getConfirmation().get(0);
            if (subjectConfirmationElement != null) {
                SubjectConfirmationDataType subjectConfirmationDataElement = subjectConfirmationElement.getSubjectConfirmationData();
                if (subjectConfirmationDataElement != null) {
                    if (subjectConfirmationDataElement.getInResponseTo() != null) {
                        // 3) Assertion > Subject > Confirmation > SubjectConfirmationData > InResponseTo is empty
                        String subjectConfirmationDataInResponseToValue = subjectConfirmationDataElement.getInResponseTo();
                        if (subjectConfirmationDataInResponseToValue.isEmpty()) {
                            logger.error("Response Validation Error: SubjectConfirmationData InResponseTo attribute was expected but it is empty in received response");
                            return false;
                        }
                        // 4) Assertion > Subject > Confirmation > SubjectConfirmationData > InResponseTo does not match request ID
                        if (!subjectConfirmationDataInResponseToValue.equals(expectedRequestId)) {
                            logger.error("Response Validation Error: received SubjectConfirmationData InResponseTo attribute does not match the expected request ID");
                            return false;
                        }
                    }
                }
            }
        }
    }
    return true;
}