/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright (c) 2006 Sun Microsystems Inc. All Rights Reserved
*
* The contents of this file are subject to the terms
* of the Common Development and Distribution License
* (the License). You may not use this file except in
* compliance with the License.
*
* You can obtain a copy of the License at
* https://opensso.dev.java.net/public/CDDLv1.0.html or
* opensso/legal/CDDLv1.0.txt
* See the License for the specific language governing
* permission and limitations under the License.
*
* When distributing Covered Code, include this CDDL
* Header Notice in each file and include the License file
* at opensso/legal/CDDLv1.0.txt.
* If applicable, add the following below the CDDL Header,
* with the fields enclosed by brackets [] replaced by
* your own identifying information:
* "Portions Copyrighted [year] [name of copyright owner]"
*
* $Id: SPACSUtils.java,v 1.48 2009/11/20 21:41:16 exu Exp $
*
* Portions Copyrighted 2010-2016 ForgeRock AS.
* Portions Copyrighted 2016 Nomura Research Institute, Ltd.
*/
package com.sun.identity.saml2.profile;
import static org.forgerock.openam.utils.Time.*;
import com.sun.identity.common.SystemConfigurationUtil;
import com.sun.identity.liberty.ws.soapbinding.Message;
import com.sun.identity.liberty.ws.soapbinding.SOAPBindingException;
import com.sun.identity.liberty.ws.soapbinding.SOAPFaultException;
import com.sun.identity.plugin.datastore.DataStoreProviderException;
import com.sun.identity.plugin.monitoring.FedMonAgent;
import com.sun.identity.plugin.monitoring.FedMonSAML2Svc;
import com.sun.identity.plugin.monitoring.MonitorManager;
import com.sun.identity.plugin.session.SessionException;
import com.sun.identity.plugin.session.SessionManager;
import com.sun.identity.plugin.session.SessionProvider;
import com.sun.identity.saml.common.SAMLConstants;
import com.sun.identity.saml.common.SAMLUtils;
import com.sun.identity.saml.xmlsig.KeyProvider;
import com.sun.identity.saml2.assertion.Advice;
import com.sun.identity.saml2.assertion.Assertion;
import com.sun.identity.saml2.assertion.AssertionFactory;
import com.sun.identity.saml2.assertion.Attribute;
import com.sun.identity.saml2.assertion.AttributeStatement;
import com.sun.identity.saml2.assertion.EncryptedAttribute;
import com.sun.identity.saml2.assertion.EncryptedID;
import com.sun.identity.saml2.assertion.Issuer;
import com.sun.identity.saml2.assertion.NameID;
import com.sun.identity.saml2.assertion.Subject;
import com.sun.identity.saml2.common.AccountUtils;
import com.sun.identity.saml2.common.NameIDInfo;
import com.sun.identity.saml2.common.NameIDInfoKey;
import com.sun.identity.saml2.common.SAML2Constants;
import com.sun.identity.saml2.common.SAML2Exception;
import com.sun.identity.saml2.common.SAML2FailoverUtils;
import com.sun.identity.saml2.common.SAML2SDKUtils;
import com.sun.identity.saml2.common.SAML2Utils;
import com.sun.identity.saml2.common.SOAPCommunicator;
import com.sun.identity.saml2.ecp.ECPFactory;
import com.sun.identity.saml2.ecp.ECPRelayState;
import com.sun.identity.saml2.jaxb.entityconfig.IDPSSOConfigElement;
import com.sun.identity.saml2.jaxb.entityconfig.SPSSOConfigElement;
import com.sun.identity.saml2.jaxb.metadata.AffiliationDescriptorType;
import com.sun.identity.saml2.jaxb.metadata.ArtifactResolutionServiceElement;
import com.sun.identity.saml2.jaxb.metadata.IDPSSODescriptorElement;
import com.sun.identity.saml2.jaxb.metadata.SPSSODescriptorElement;
import com.sun.identity.saml2.key.KeyUtil;
import com.sun.identity.saml2.logging.LogUtil;
import com.sun.identity.saml2.meta.SAML2MetaException;
import com.sun.identity.saml2.meta.SAML2MetaManager;
import com.sun.identity.saml2.meta.SAML2MetaUtils;
import com.sun.identity.saml2.plugins.SAML2PluginsUtils;
import com.sun.identity.saml2.plugins.SAML2ServiceProviderAdapter;
import com.sun.identity.saml2.plugins.SPAccountMapper;
import com.sun.identity.saml2.plugins.SPAttributeMapper;
import com.sun.identity.saml2.protocol.Artifact;
import com.sun.identity.saml2.protocol.ArtifactResolve;
import com.sun.identity.saml2.protocol.ArtifactResponse;
import com.sun.identity.saml2.protocol.AuthnRequest;
import com.sun.identity.saml2.protocol.ProtocolFactory;
import com.sun.identity.saml2.protocol.Response;
import com.sun.identity.saml2.protocol.Status;
import com.sun.identity.shared.encode.Base64;
import com.sun.identity.shared.encode.URLEncDec;
import com.sun.identity.shared.xml.XMLUtils;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.PrintWriter;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;
import java.text.MessageFormat;
import java.util.ArrayList;
import java.util.Date;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.logging.Level;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.xml.soap.SOAPConnection;
import javax.xml.soap.SOAPException;
import javax.xml.soap.SOAPMessage;
import org.forgerock.openam.federation.saml2.SAML2TokenRepositoryException;
import org.forgerock.openam.saml2.audit.SAML2EventLogger;
import org.forgerock.openam.utils.ClientUtils;
import org.forgerock.openam.utils.CollectionUtils;
import org.forgerock.openam.utils.StringUtils;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
/**
* This class is used by a service provider (SP) to process the response from
* an identity provider for the SP's Assertion Consumer Service.
*
* @supported.api
*/
public class SPACSUtils {
private static FedMonAgent agent = MonitorManager.getAgent();
private static FedMonSAML2Svc saml2Svc = MonitorManager.getSAML2Svc();
private SPACSUtils() {}
/**
* Retrieves SAML
Response
from http request.
* It handles three cases:
*
* 1. using http method get using request parameter "resID". * This is the case after local login is done. * 2. using http method get using request parameter "SAMLart". * This is the case for artifact profile. * 3. using http method post. This is the case for post profile. ** * @param request http servlet request * @param response http servlet response * @param orgName realm or organization name the service provider resides in * @param hostEntityId Entity ID of the hosted service provider * @param metaManager
SAML2MetaManager
instance.
* @return ResponseInfo
instance.
* @throws SAML2Exception,IOException if it fails in the process.
*/
public static ResponseInfo getResponse(
HttpServletRequest request,
HttpServletResponse response,
String orgName,
String hostEntityId,
SAML2MetaManager metaManager)
throws SAML2Exception,IOException
{
ResponseInfo respInfo = null;
String method = request.getMethod();
if (method.equals("GET")) {
if (!SAML2Utils.isSPProfileBindingSupported(
orgName, hostEntityId, SAML2Constants.ACS_SERVICE,
SAML2Constants.HTTP_ARTIFACT))
{
SAMLUtils.sendError(request, response,
response.SC_BAD_REQUEST,
"unsupportedBinding",
SAML2Utils.bundle.getString("unsupportedBinding"));
throw new SAML2Exception(
SAML2Utils.bundle.getString("unsupportedBinding"));
}
respInfo = getResponseFromGet(request, response, orgName,
hostEntityId, metaManager);
} else if (method.equals("POST")) {
String pathInfo = request.getPathInfo();
if ((pathInfo != null) && (pathInfo.startsWith("/ECP"))) {
if (!SAML2Utils.isSPProfileBindingSupported(
orgName, hostEntityId, SAML2Constants.ACS_SERVICE,
SAML2Constants.PAOS))
{
SAMLUtils.sendError(request, response,
response.SC_BAD_REQUEST,
"unsupportedBinding",
SAML2Utils.bundle.getString("unsupportedBinding"));
throw new SAML2Exception(
SAML2Utils.bundle.getString("unsupportedBinding"));
}
respInfo = getResponseFromPostECP(request, response, orgName,
hostEntityId, metaManager);
} else {
if (!SAML2Utils.isSPProfileBindingSupported(
orgName, hostEntityId, SAML2Constants.ACS_SERVICE,
SAML2Constants.HTTP_POST))
{
SAMLUtils.sendError(request, response,
response.SC_BAD_REQUEST,
"unsupportedBinding",
SAML2Utils.bundle.getString("unsupportedBinding"));
throw new SAML2Exception(
SAML2Utils.bundle.getString("unsupportedBinding"));
}
respInfo = getResponseFromPost(request, response, orgName,
hostEntityId, metaManager);
}
} else {
// not supported
SAMLUtils.sendError(request, response,
response.SC_METHOD_NOT_ALLOWED,
"notSupportedHTTPMethod",
SAML2Utils.bundle.getString("notSupportedHTTPMethod"));
throw new SAML2Exception(
SAML2Utils.bundle.getString("notSupportedHTTPMethod"));
}
if (SAML2Utils.debug.messageEnabled()) {
SAML2Utils.debug.message("SPACSUtils.getResponse: got response="
+ respInfo.getResponse().toXMLString(true, true));
}
return respInfo;
}
/**
* Retrieves SAML Response
from http Get.
* It first uses parameter resID to retrieve Response
. This is
* the case after local login;
* If resID is not defined, it then uses SAMLart
http
* parameter to retrieve Response
.
*/
private static ResponseInfo getResponseFromGet(
HttpServletRequest request,
HttpServletResponse response,
String orgName,
String hostEntityId,
SAML2MetaManager metaManager)
throws SAML2Exception,IOException
{
ResponseInfo respInfo = null;
String resID = request.getParameter("resID");
if (resID != null && resID.length() != 0) {
if (SAML2Utils.debug.messageEnabled()) {
SAML2Utils.debug.message("SPACSUtils.getResponseFromGet: resID="
+ resID);
}
synchronized (SPCache.responseHash) {
respInfo = (ResponseInfo) SPCache.responseHash.remove(resID);
}
if (respInfo == null) {
if (SAML2Utils.debug.messageEnabled()) {
SAML2Utils.debug.message("SPACSUtils.getResponseFromGet: "
+ "couldn't find Response from resID.");
}
String[] data = {resID};
LogUtil.error(Level.INFO,
LogUtil.RESPONSE_NOT_FOUND_FROM_CACHE,
data,
null);
SAMLUtils.sendError(request, response,
response.SC_INTERNAL_SERVER_ERROR, "SSOFailed",
SAML2Utils.bundle.getString("SSOFailed"));
throw new SAML2Exception(
SAML2Utils.bundle.getString("SSOFailed"));
}
return respInfo;
}
String samlArt = request.getParameter(SAML2Constants.SAML_ART);
if (samlArt == null || samlArt.trim().length() == 0) {
SAML2Utils.debug.error("SPACSUtils.getResponseFromGet: Artifact "
+ "string is empty.");
LogUtil.error(Level.INFO,
LogUtil.MISSING_ARTIFACT,
null,
null);
SAMLUtils.sendError(request, response, response.SC_BAD_REQUEST,
"missingArtifact",
SAML2Utils.bundle.getString("missingArtifact"));
throw new SAML2Exception(
SAML2Utils.bundle.getString("missingArtifact"));
}
return new ResponseInfo(getResponseFromArtifact(samlArt, hostEntityId,
request, response, orgName, metaManager),
SAML2Constants.HTTP_ARTIFACT, null);
}
// Retrieves response using artifact profile.
private static Response getResponseFromArtifact(String samlArt,
String hostEntityId, HttpServletRequest request,
HttpServletResponse response, String orgName,
SAML2MetaManager sm) throws SAML2Exception,IOException
{
// Try to get source ID and endpointIndex, and then
// decide which IDP and which artifact resolution service
if (SAML2Utils.debug.messageEnabled()) {
SAML2Utils.debug.message("SPACSUtils.getResponseFromArtifact: " +
"samlArt = " + samlArt);
}
Artifact art = null;
try {
art = ProtocolFactory.getInstance().createArtifact(samlArt.trim());
String[] data = {samlArt.trim()};
LogUtil.access(Level.INFO,
LogUtil.RECEIVED_ARTIFACT,
data,
null);
} catch (SAML2Exception se) {
SAML2Utils.debug.error("SPACSUtils.getResponseFromArtifact: "
+ "Unable to decode and parse artifact string:" + samlArt);
SAMLUtils.sendError(request, response, response.SC_BAD_REQUEST,
"errorObtainArtifact",
SAML2Utils.bundle.getString("errorObtainArtifact"));
throw se;
}
String idpEntityID = getIDPEntityID(art, request, response, orgName, sm);
IDPSSODescriptorElement idp = null;
try {
idp = sm.getIDPSSODescriptor(orgName, idpEntityID);
} catch (SAML2MetaException se) {
String[] data = {orgName, idpEntityID};
LogUtil.error(Level.INFO,
LogUtil.IDP_META_NOT_FOUND,
data,
null);
SAMLUtils.sendError(request, response,
response.SC_INTERNAL_SERVER_ERROR,
"failedToGetIDPSSODescriptor", se.getMessage());
throw se;
}
String location = getIDPArtifactResolutionServiceUrl(
art.getEndpointIndex(), idpEntityID, idp, request, response);
// create ArtifactResolve message
ArtifactResolve resolve = null;
SOAPMessage resMsg = null;
try {
resolve = ProtocolFactory.getInstance().createArtifactResolve();
resolve.setID(SAML2Utils.generateID());
resolve.setVersion(SAML2Constants.VERSION_2_0);
resolve.setIssueInstant(newDate());
resolve.setArtifact(art);
resolve.setDestination(XMLUtils.escapeSpecialCharacters(location));
Issuer issuer = AssertionFactory.getInstance().createIssuer();
issuer.setValue(hostEntityId);
resolve.setIssuer(issuer);
String needArtiResolveSigned =
SAML2Utils.getAttributeValueFromSSOConfig(
orgName,
idpEntityID,
SAML2Constants.IDP_ROLE,
SAML2Constants.WANT_ARTIFACT_RESOLVE_SIGNED);
if (needArtiResolveSigned != null &&
needArtiResolveSigned.equals("true")) {
// or save it somewhere?
String signAlias = getAttributeValueFromSPSSOConfig(
orgName,
hostEntityId,
sm,
SAML2Constants.SIGNING_CERT_ALIAS);
if (signAlias == null) {
throw new SAML2Exception(
SAML2Utils.bundle.getString("missingSigningCertAlias"));
}
KeyProvider kp = KeyUtil.getKeyProviderInstance();
if (kp == null) {
throw new SAML2Exception(
SAML2Utils.bundle.getString("nullKeyProvider"));
}
resolve.sign(kp.getPrivateKey(signAlias),
kp.getX509Certificate(signAlias));
}
String resolveString = resolve.toXMLString(true, true);
if (SAML2Utils.debug.messageEnabled()) {
SAML2Utils.debug.message("SPACSUtils.getResponseFromArtifact: "
+ "ArtifactResolve=" + resolveString);
}
SOAPConnection con = SOAPCommunicator.getInstance().openSOAPConnection();
SOAPMessage msg = SOAPCommunicator.getInstance().createSOAPMessage(resolveString, true);
IDPSSOConfigElement config = null;
config = sm.getIDPSSOConfig(orgName, idpEntityID);
location = SAML2Utils.fillInBasicAuthInfo(
config, location);
resMsg = con.call(msg, location);
} catch (SAML2Exception s2e) {
SAML2Utils.debug.error("SPACSUtils.getResponseFromArtifact: "
+ "couldn't create ArtifactResolve:", s2e);
String[] data = {hostEntityId, art.getArtifactValue()};
LogUtil.error(Level.INFO,
LogUtil.CANNOT_CREATE_ARTIFACT_RESOLVE,
data,
null);
SAMLUtils.sendError(request, response,
response.SC_INTERNAL_SERVER_ERROR,
"errorCreateArtifactResolve",
SAML2Utils.bundle.getString("errorCreateArtifactResolve"));
throw s2e;
} catch (SOAPException se) {
SAML2Utils.debug.error("SPACSUtils.getResponseFromGet: "
+ "couldn't get ArtifactResponse. SOAP error:",se);
String[] data = {hostEntityId, location};
LogUtil.error(Level.INFO,
LogUtil.CANNOT_GET_SOAP_RESPONSE,
data,
null);
SAMLUtils.sendError(request, response,
response.SC_INTERNAL_SERVER_ERROR,
"errorInSOAPCommunication",
SAML2Utils.bundle.getString("errorInSOAPCommunication"));
throw new SAML2Exception(se.getMessage());
}
Response result = getResponseFromSOAP(resMsg, resolve, request,
response, idpEntityID, idp, orgName, hostEntityId, sm);
String[] data = {hostEntityId, idpEntityID,
art.getArtifactValue(), ""};
if (LogUtil.isAccessLoggable(Level.FINE)) {
data[3] = result.toXMLString();
}
LogUtil.access(Level.INFO,
LogUtil.GOT_RESPONSE_FROM_ARTIFACT,
data,
null);
return result;
}
// Finds the IDP who sends the artifact;
private static String getIDPEntityID(
Artifact art,
HttpServletRequest request,
HttpServletResponse response,
String orgName,
SAML2MetaManager metaManager)
throws SAML2Exception,IOException
{
String sourceID = art.getSourceID();
// find the idp
String idpEntityID = null;
try {
Iterator iter =
metaManager.getAllRemoteIdentityProviderEntities(orgName).
iterator();
String tmpSourceID = null;
while (iter.hasNext()) {
idpEntityID = (String) iter.next();
tmpSourceID = SAML2Utils.generateSourceID(idpEntityID);
if (sourceID.equals(tmpSourceID)) {
break;
}
idpEntityID = null;
}
if (idpEntityID == null) {
SAML2Utils.debug.error("SPACSUtils.getResponseFromGet: Unable "
+ "to find the IDP based on the SourceID in the artifact");
String[] data = {art.getArtifactValue(), orgName};
LogUtil.error(Level.INFO,
LogUtil.IDP_NOT_FOUND,
data,
null);
throw new SAML2Exception(
SAML2Utils.bundle.getString("cannotFindIDP"));
}
} catch (SAML2Exception se) {
String[] data = {art.getArtifactValue(), orgName};
LogUtil.error(Level.INFO,
LogUtil.IDP_NOT_FOUND,
data,
null);
SAMLUtils.sendError(request, response,
response.SC_INTERNAL_SERVER_ERROR,
"cannotFindIDP", se.getMessage());
throw se;
}
return idpEntityID;
}
// Retrieves the ArtifactResolutionServiceURL for an IDP.
private static String getIDPArtifactResolutionServiceUrl(
int endpointIndex,
String idpEntityID,
IDPSSODescriptorElement idp,
HttpServletRequest request,
HttpServletResponse response)
throws SAML2Exception,IOException
{
// find the artifact resolution service url
List arsList=idp.getArtifactResolutionService();
ArtifactResolutionServiceElement ars = null;
String location = null;
String defaultLocation = null;
String firstLocation = null;
int index;
boolean isDefault = false;
for (int i=0; iSAML Response
from SOAPBody
.
* Used by ECP profile.
*/
private static ResponseInfo getResponseFromPostECP(
HttpServletRequest request, HttpServletResponse response,
String orgName, String hostEntityId, SAML2MetaManager metaManager)
throws SAML2Exception,IOException
{
Message message = null;
try {
message = new Message(SOAPCommunicator.getInstance().getSOAPMessage(request));
} catch (SOAPException soapex) {
String[] data = { hostEntityId } ;
LogUtil.error(Level.INFO,
LogUtil.CANNOT_INSTANTIATE_SOAP_MESSAGE_ECP, data, null);
SAMLUtils.sendError(request, response,
response.SC_INTERNAL_SERVER_ERROR,
"failedToCreateSOAPMessage", soapex.getMessage());
throw new SAML2Exception(soapex.getMessage());
} catch (SOAPBindingException soapex) {
String[] data = { hostEntityId } ;
LogUtil.error(Level.INFO,
LogUtil.CANNOT_INSTANTIATE_SOAP_MESSAGE_ECP, data, null);
SAMLUtils.sendError(request, response,
response.SC_INTERNAL_SERVER_ERROR,
"failedToCreateSOAPMessage", soapex.getMessage());
throw new SAML2Exception(soapex.getMessage());
} catch(SOAPFaultException sfex) {
String[] data = { hostEntityId } ;
LogUtil.error(Level.INFO, LogUtil.RECEIVE_SOAP_FAULT_ECP,
data, null);
String faultString =
sfex.getSOAPFaultMessage().getSOAPFault().getFaultString();
SAMLUtils.sendError(request, response,
response.SC_INTERNAL_SERVER_ERROR,
"failedToCreateSOAPMessage", faultString);
throw new SAML2Exception(faultString);
}
List soapHeaders = message.getOtherSOAPHeaders();
ECPRelayState ecpRelayState = null;
if ((soapHeaders != null) && (!soapHeaders.isEmpty())) {
for(Iterator iter = soapHeaders.iterator(); iter.hasNext();) {
Element headerEle = (Element)iter.next();
try {
ecpRelayState =
ECPFactory.getInstance().createECPRelayState(headerEle);
break;
} catch (SAML2Exception saml2ex) {
// not ECP RelayState
}
}
}
String relayState = null;
if (ecpRelayState != null) {
relayState = ecpRelayState.getValue();
}
List soapBodies = message.getBodies();
if ((soapBodies == null) || (soapBodies.isEmpty())) {
String[] data = { hostEntityId } ;
LogUtil.error(Level.INFO,
LogUtil.CANNOT_INSTANTIATE_SAML_RESPONSE_FROM_ECP, data, null);
SAMLUtils.sendError(request, response, response.SC_BAD_REQUEST,
"missingSAMLResponse",
SAML2Utils.bundle.getString("missingSAMLResponse"));
throw new SAML2Exception(
SAML2Utils.bundle.getString("missingSAMLResponse"));
}
Element resElem = (Element)soapBodies.get(0);
Response resp = null;
try {
resp = ProtocolFactory.getInstance().createResponse(resElem);
} catch (SAML2Exception se) {
if (SAML2Utils.debug.messageEnabled()) {
SAML2Utils.debug.message("SPACSUtils.getResponseFromPostECP:" +
"Couldn't create Response:", se);
}
String[] data = { hostEntityId } ;
LogUtil.error(Level.INFO,
LogUtil.CANNOT_INSTANTIATE_SAML_RESPONSE_FROM_ECP, data, null);
SAMLUtils.sendError(request, response,
response.SC_INTERNAL_SERVER_ERROR,
"failedToCreateResponse", se.getMessage());
throw se;
}
String idpEntityID = resp.getIssuer().getValue();
IDPSSODescriptorElement idpDesc = null;
try {
idpDesc = metaManager.getIDPSSODescriptor(orgName, idpEntityID);
} catch (SAML2MetaException se) {
String[] data = { orgName, idpEntityID };
LogUtil.error(Level.INFO, LogUtil.IDP_META_NOT_FOUND, data, null);
SAMLUtils.sendError(request, response,
response.SC_INTERNAL_SERVER_ERROR,
"failedToGetIDPSSODescriptor", se.getMessage());
throw se;
}
SetResponse
.
* Auth session upgrade will be called if input session is
* not null.
* Otherwise, saml2 auth module is called. The name of the auth module
* is retrieved from SPSSOConfig
. If not found, "SAML2" will
* be used.
*
* @param request HTTP Servlet request
* @param response HTTP Servlet response.
* @param out the print writer for writing out presentation
* @param metaAlias metaAlias for the service provider
* @param session input session object. It could be null.
* @param respInfo ResponseInfo
to be verified.
* @param realm realm or organization name of the service provider.
* @param hostEntityId hosted service provider Entity ID.
* @param metaManager SAML2MetaManager
instance for meta operation.
* @param auditor a SAML2EventLogger
auditor object to hook into
* tracking information for the saml request
* @return Object
which holds result of the session.
* @throws SAML2Exception if the processing failed.
*/
public static Object processResponse(
HttpServletRequest request, HttpServletResponse response, PrintWriter out,
String metaAlias, Object session, ResponseInfo respInfo,
String realm, String hostEntityId, SAML2MetaManager metaManager, SAML2EventLogger auditor
) throws SAML2Exception {
String classMethod = "SPACSUtils.processResponse: ";
if (SAML2Utils.debug.messageEnabled()) {
SAML2Utils.debug.message(classMethod + "Response : " +
respInfo.getResponse());
}
Map smap = null;
try {
// check Response/Assertion and get back a Map of relevant data
smap = SAML2Utils.verifyResponse(request, response,
respInfo.getResponse(), realm, hostEntityId,
respInfo.getProfileBinding());
} catch (SAML2Exception se) {
// invoke SPAdapter for failure
invokeSPAdapterForSSOFailure(hostEntityId, realm,
request, response, smap, respInfo,
SAML2ServiceProviderAdapter.INVALID_RESPONSE, se);
throw se;
}
com.sun.identity.saml2.assertion.Subject assertionSubject =
(com.sun.identity.saml2.assertion.Subject)
smap.get(SAML2Constants.SUBJECT);
NameID nameId = assertionSubject.getNameID();
EncryptedID encId = assertionSubject.getEncryptedID();
Assertion authnAssertion =
(Assertion) smap.get(SAML2Constants.POST_ASSERTION);
String sessionIndex = (String)smap.get(SAML2Constants.SESSION_INDEX);
respInfo.setSessionIndex(sessionIndex);
Integer authLevel = (Integer) smap.get(SAML2Constants.AUTH_LEVEL);
Long maxSessionTime = (Long) smap.get(SAML2Constants.MAX_SESSION_TIME);
String inRespToResp = (String) smap.get(SAML2Constants.IN_RESPONSE_TO);
List assertions = (List) smap.get(SAML2Constants.ASSERTIONS);
if (SAML2Utils.debug.messageEnabled()) {
SAML2Utils.debug.message(classMethod + "Assertions : " +
assertions);
}
SPSSOConfigElement spssoconfig =
metaManager.getSPSSOConfig(realm, hostEntityId);
// get mappers
SPAccountMapper acctMapper = SAML2Utils.getSPAccountMapper(realm, hostEntityId);
SPAttributeMapper attrMapper = SAML2Utils.getSPAttributeMapper(realm, hostEntityId);
boolean needAssertionEncrypted =
Boolean.parseBoolean(SAML2Utils.getAttributeValueFromSPSSOConfig(spssoconfig,
SAML2Constants.WANT_ASSERTION_ENCRYPTED));
boolean needAttributeEncrypted = getNeedAttributeEncrypted(needAssertionEncrypted, spssoconfig);
boolean needNameIDEncrypted = getNeedNameIDEncrypted(needAssertionEncrypted, spssoconfig);
SetSAML2MetaManager
instance.
* @return final relay state. Or null
if the input
* relayStateID is null and no default relay state is configured.
*/
public static String getRelayState(
String relayStateID,
String orgName,
String hostEntityId,
SAML2MetaManager sm
) {
String relayStateUrl = null;
if ((relayStateID != null) && (relayStateID.trim().length() != 0)) {
CacheObject cache = (CacheObject)SPCache.relayStateHash.remove(
relayStateID);
if (cache != null) {
relayStateUrl = (String)cache.getObject();
} else if (SAML2FailoverUtils.isSAML2FailoverEnabled()) {
// The key is this way to make it unique compared to when
// the same key is used to store a copy of the AuthnRequestInfo
String key = relayStateID + relayStateID;
try {
// Try and retrieve the value from the SAML2 repository
String relayState = (String) SAML2FailoverUtils.retrieveSAML2Token(key);
if (relayState != null) {
// Get back the relayState
relayStateUrl = relayState;
if (SAML2Utils.debug.messageEnabled()) {
SAML2Utils.debug.message("SPACUtils.getRelayState: relayState"
+ " retrieved from SAML2 repository for key: " + key);
}
}
} catch (SAML2TokenRepositoryException se) {
SAML2Utils.debug.error("SPACUtils.getRelayState: Unable to retrieve relayState for key "
+ key, se);
}
} else {
if (SAML2Utils.debug.messageEnabled()) {
SAML2Utils.debug.message("SPACUtils.getRelayState: relayState"
+ " is null for relayStateID: " + relayStateID + ", SAML2 failover is disabled");
}
}
if (relayStateUrl == null || relayStateUrl.trim().length() == 0) {
relayStateUrl = relayStateID;
}
}
if (relayStateUrl == null || relayStateUrl.trim().length() == 0) {
relayStateUrl = getAttributeValueFromSPSSOConfig(
orgName, hostEntityId, sm, SAML2Constants.DEFAULT_RELAY_STATE);
}
return relayStateUrl;
}
/**
* Retrieves intermediate redirect url from SP sso config. This url is used
* if you want to goto some place before the final relay state.
*
* @param orgName realm or organization name the service provider resides in
* @param hostEntityId Entity ID of the hosted service provider
* @param sm SAML2MetaManager
instance.
* @return intermediate redirect url; or null
if the url is
* is not configured or an error occured during the retrieval
* process.
*/
public static String getIntermediateURL(String orgName,
String hostEntityId,
SAML2MetaManager sm)
{
return getAttributeValueFromSPSSOConfig(orgName, hostEntityId, sm,
SAML2Constants.INTERMEDIATE_URL);
}
/**
* Saves response for later retrieval and retrieves local auth url from SPSSOConfig
.
* If the url does not exist, generate one from request URI.
* If still cannot get it, (shouldn't happen), get it from {@link SystemConfigurationUtil}.
*
* @param realm Realm or organization name the service provider resides in.
* @param hostEntityId Entity ID of the hosted service provider.
* @param sm SAML2MetaManager
instance to perform metadata operations.
* @param respInfo The to be cached ResponseInfo
.
* @param requestURI The HTTP request URI.
* @return The local login url.
*/
public static String prepareForLocalLogin(String realm, String hostEntityId, SAML2MetaManager sm,
ResponseInfo respInfo, String requestURI) {
String localLoginUrl = getAttributeValueFromSPSSOConfig(realm, hostEntityId, sm, SAML2Constants.LOCAL_AUTH_URL);
if (StringUtils.isEmpty(localLoginUrl)) {
// get it from request
try {
int index = requestURI.indexOf("Consumer/metaAlias");
if (index != -1) {
localLoginUrl = requestURI.substring(0, index) + "UI/Login?realm=" + realm;
}
} catch (IndexOutOfBoundsException e) {
localLoginUrl = null;
}
if (StringUtils.isEmpty(localLoginUrl)) {
// shouldn't be here, but in case
localLoginUrl =
SystemConfigurationUtil.getProperty(SAMLConstants.SERVER_PROTOCOL)
+ "://"
+ SystemConfigurationUtil.getProperty(SAMLConstants.SERVER_HOST)
+ SystemConfigurationUtil.getProperty(SAMLConstants.SERVER_PORT)
+ "/UI/Login?realm="
+ realm;
}
}
respInfo.setIsLocalLogin(true);
synchronized (SPCache.responseHash) {
SPCache.responseHash.put(respInfo.getResponse().getID(), respInfo);
}
SAML2Utils.debug.message("SPACSUtils:prepareForLocalLogin: localLoginUrl = {}", localLoginUrl);
return localLoginUrl;
}
/**
* Retrieves attribute value for a given attribute name from
* SPSSOConfig
.
* @param orgName realm or organization name the service provider resides in
* @param hostEntityId hosted service provider's Entity ID.
* @param sm SAML2MetaManager
instance to perform meta
* operations.
* @param attrName name of the attribute whose value ot be retrived.
* @return value of the attribute; or null
if the attribute
* if not configured, or an error occured in the process.
*/
private static String getAttributeValueFromSPSSOConfig(String orgName,
String hostEntityId,
SAML2MetaManager sm,
String attrName)
{
String result = null;
try {
SPSSOConfigElement config = sm.getSPSSOConfig(orgName,
hostEntityId);
if (config == null) {
return null;
}
Map attrs = SAML2MetaUtils.getAttributes(config);
List value = (List) attrs.get(attrName);
if (value != null && value.size() != 0) {
result = ((String) value.iterator().next()).trim();
}
} catch (SAML2MetaException sme) {
if (SAML2Utils.debug.messageEnabled()) {
SAML2Utils.debug.message("SPACSUtils.getAttributeValueFromSPSSO"
+ "Config:", sme);
}
result = null;
}
return result;
}
/**
* Gets the attributes from an assert's AttributeStates.
*
* @param assertion The assertion from which to pull the AttributeStates.
* @param needAttributeEncrypted Whether attributes must be encrypted (or else rejected).
* @param privateKeys Private keys used to decrypt those encrypted attributes.
* @return a list of attributes pulled from the provided assertion.
*/
public static Listjava.util.Map
whose keys
* are attribute names and values are
* java.util.Set
of string
* values for the attributes. Map
which holds result of the processing.
* @throws SAML2Exception if the processing failed due to server error.
* @throws IOException if the processing failed due to IO error.
* @throws SessionException if the processing failed due to session error.
* @throws ServletException if the processing failed due to request error.
*
* @supported.api
*/
public static Map processResponseForFedlet (HttpServletRequest request,
HttpServletResponse response, PrintWriter out) throws SAML2Exception, IOException,
SessionException, ServletException {
if (request == null) {
String message =
MessageFormat.format(SAML2SDKUtils.bundle.getString("nullInputMessage"), new String[]{"request"});
SAML2SDKUtils.debug.error("SPACSUtils.processResponseForFedlet: " + message);
throw new ServletException(message);
}
if (response == null) {
String message =
MessageFormat.format(SAML2SDKUtils.bundle.getString("nullInputMessage"), new String[]{"response"});
SAML2SDKUtils.debug.error("SPACSUtils.processResponseForFedlet: " + message);
throw new ServletException(message);
}
String requestURL = request.getRequestURL().toString();
SAML2MetaManager metaManager = new SAML2MetaManager();
if (metaManager == null) {
throw new SAML2Exception(
SAML2SDKUtils.bundle.getString("errorMetaManager"));
}
String metaAlias = SAML2MetaUtils.getMetaAliasByUri(requestURL);
if ((metaAlias == null) || (metaAlias.length() == 0)) {
// Check in case metaAlias has been supplied as a parameter
metaAlias = request.getParameter(SAML2MetaManager.NAME_META_ALIAS_IN_URI);
if (metaAlias == null || metaAlias.length() == 0) {
// pick the first available one
List spMetaAliases =
metaManager.getAllHostedServiceProviderMetaAliases("/");
if ((spMetaAliases != null) && !spMetaAliases.isEmpty()) {
// get first one
metaAlias = (String) spMetaAliases.get(0);
}
if ((metaAlias == null) || (metaAlias.length() == 0)) {
throw new ServletException(
SAML2SDKUtils.bundle.getString("nullSPEntityID"));
}
}
}
String hostEntityId = null;
try {
hostEntityId = metaManager.getEntityByMetaAlias(metaAlias);
} catch (SAML2MetaException sme) {
SAML2SDKUtils.debug.error("SPACSUtils.processResponseForFedlet",
sme);
throw new SAML2Exception(
SAML2SDKUtils.bundle.getString("metaDataError"));
}
if (hostEntityId == null) {
// logging?
throw new SAML2Exception(
SAML2SDKUtils.bundle.getString("metaDataError"));
}
// organization is always root org
String orgName = "/";
String relayState = request.getParameter(SAML2Constants.RELAY_STATE);
SessionProvider sessionProvider = null;
ResponseInfo respInfo = null;
try {
sessionProvider = SessionManager.getProvider();
} catch (SessionException se) {
SAML2SDKUtils.debug.error("SPACSUtils.processResponseForFedlet",
se);
throw new SAML2Exception(se);
}
respInfo = SPACSUtils.getResponse(
request, response, orgName, hostEntityId, metaManager);
Object newSession = null;
// Throws a SAML2Exception if the response cannot be validated
// or contains a non-Success StatusCode, invoking the SPAdapter SPI
// for taking action on the failed validation.
// The resulting exception has its redirectionDone flag set if
// the SPAdapter issued a HTTP redirect.
newSession = SPACSUtils.processResponse(
request, response, out, metaAlias, null, respInfo,
orgName, hostEntityId, metaManager, null);
SAML2SDKUtils.debug.message("SSO SUCCESS");
String[] redirected = sessionProvider.getProperty(newSession,
SAML2Constants.RESPONSE_REDIRECTED);
if ((redirected != null) && (redirected.length != 0) &&
redirected[0].equals("true")) {
SAML2SDKUtils.debug.message("Already redirected in SPAdapter.");
// response redirected already in SPAdapter
return createMapForFedlet(respInfo, null, hostEntityId);
}
// redirect to relay state
String finalUrl = SPACSUtils.getRelayState(
relayState, orgName, hostEntityId, metaManager);
String realFinalUrl = finalUrl;
if (finalUrl != null && finalUrl.length() != 0) {
try {
realFinalUrl =
sessionProvider.rewriteURL(newSession, finalUrl);
} catch (SessionException se) {
SAML2SDKUtils.debug.message("SPACSUtils.processRespForFedlet",
se);
realFinalUrl = finalUrl;
}
}
String redirectUrl = SPACSUtils.getIntermediateURL(
orgName, hostEntityId, metaManager);
String realRedirectUrl = null;
if (redirectUrl != null && redirectUrl.length() != 0) {
if (realFinalUrl != null && realFinalUrl.length() != 0) {
if (redirectUrl.indexOf("?") != -1) {
redirectUrl += "&goto=";
} else {
redirectUrl += "?goto=";
}
redirectUrl += URLEncDec.encode(realFinalUrl);
try {
realRedirectUrl = sessionProvider.rewriteURL(
newSession, redirectUrl);
} catch (SessionException se) {
SAML2SDKUtils.debug.message(
"SPACSUtils.processRespForFedlet: rewriting failed.", se);
realRedirectUrl = redirectUrl;
}
} else {
realRedirectUrl = redirectUrl;
}
} else {
realRedirectUrl = finalUrl;
}
return createMapForFedlet(respInfo, realRedirectUrl, hostEntityId);
}
private static Map createMapForFedlet(
ResponseInfo respInfo, String relayUrl, String hostedEntityId) {
Map map = new HashMap();
if (relayUrl != null) {
map.put(SAML2Constants.RELAY_STATE, relayUrl);
}
Response samlResp = respInfo.getResponse();
map.put(SAML2Constants.RESPONSE, samlResp);
Assertion assertion = respInfo.getAssertion();
map.put(SAML2Constants.ASSERTION, assertion);
map.put(SAML2Constants.SUBJECT, assertion.getSubject());
map.put(SAML2Constants.IDPENTITYID, assertion.getIssuer().getValue());
map.put(SAML2Constants.SPENTITYID, hostedEntityId);
map.put(SAML2Constants.NAMEID, respInfo.getNameId());
map.put(SAML2Constants.ATTRIBUTE_MAP, respInfo.getAttributeMap());
map.put(SAML2Constants.SESSION_INDEX, respInfo.getSessionIndex());
return map;
}
/**
* Returns the username if there was one from the Assertion we were able to map into a local user account. Returns
* null if not. Should only be used from the SP side. Should only be called in conjuncture with the Auth Module.
* In addition, it performs what attribute federation it can.
*
* This method is a picked apart version of the "processResponse" function.
*/
public static String getPrincipalWithoutLogin(Subject assertionSubject, Assertion authnAssertion, String realm,
String spEntityId, SAML2MetaManager metaManager, String idpEntityId,
String storageKey)
throws SAML2Exception {
final EncryptedID encId = assertionSubject.getEncryptedID();
final SPSSOConfigElement spssoconfig = metaManager.getSPSSOConfig(realm, spEntityId);
final Set