a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterpackage com.sun.identity.saml2.profile;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

80849398a45dca1fb917716907d6ec99be6222c2Peter Majorimport com.iplanet.dpro.session.exceptions.StoreException;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.liberty.ws.paos.PAOSException;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.liberty.ws.paos.PAOSConstants;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.liberty.ws.paos.PAOSHeader;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.liberty.ws.paos.PAOSRequest;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.federation.common.FSUtils;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml.common.SAMLUtils;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml.xmlsig.KeyProvider;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.assertion.AssertionFactory;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.assertion.Issuer;

89503929c8983c48e2049c77284b52e79ad37c32jeff.schenkimport com.sun.identity.saml2.common.*;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.logging.LogUtil;

89503929c8983c48e2049c77284b52e79ad37c32jeff.schenkimport com.sun.identity.saml2.common.SAML2RepositoryFactory;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.ecp.ECPFactory;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.ecp.ECPRelayState;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.ecp.ECPRequest;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.key.KeyUtil;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.plugins.SAML2IDPFinder;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.plugins.SAML2ServiceProviderAdapter;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.protocol.AuthnRequest;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.protocol.Extensions;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.protocol.GetComplete;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.protocol.NameIDPolicy;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.protocol.ProtocolFactory;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.protocol.RequestedAuthnContext;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.jaxb.entityconfig.SPSSOConfigElement;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.jaxb.metadata.AffiliationDescriptorType;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.jaxb.metadata.AssertionConsumerServiceElement;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.jaxb.metadata.EntityDescriptorElement;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.jaxb.metadata.IDPSSODescriptorElement;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.jaxb.metadata.SPSSODescriptorElement;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.jaxb.metadata.SingleSignOnServiceElement;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.meta.SAML2MetaException;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.meta.SAML2MetaManager;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.meta.SAML2MetaUtils;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.plugins.SPAuthnContextMapper;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.protocol.Scoping;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.protocol.IDPEntry;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml2.protocol.IDPList;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.shared.datastruct.OrderedSet;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.shared.encode.URLEncDec;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.shared.xml.XMLUtils;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.io.IOException;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.io.OutputStream;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.security.PrivateKey;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.logging.Level;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.Date;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.Iterator;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.List;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.ArrayList;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.Map;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport javax.servlet.http.HttpServletRequest;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport javax.servlet.http.HttpServletResponse;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport javax.xml.soap.SOAPException;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport javax.xml.soap.SOAPMessage;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterpublic class SPSSOFederate {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster static SAML2MetaManager sm = null;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster static {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster try {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster sm = new SAML2MetaManager();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } catch (SAML2MetaException sme) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.error("SPSSOFederate: Error retreiving metadata"

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ,sme);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /**

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster public static void initiateAuthnRequest(HttpServletRequest request,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster HttpServletResponse response,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String metaAlias,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String idpEntityID,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Map paramsMap)

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throws SAML2Exception {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster try {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // get the sp entity ID from the metaAlias

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String spEntityID = sm.getEntityByMetaAlias(metaAlias);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String realm = SAML2MetaUtils.getRealmByMetaAlias(metaAlias);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate : spEntityID is :"

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + spEntityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate realm is :" + realm);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster initiateAuthnRequest(request,response,spEntityID,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster idpEntityID,realm,paramsMap);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } catch (SAML2MetaException sme) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.error("SPSSOFederate: Error retreiving spEntityID"+

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster " from MetaAlias",sme);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("metaAliasError"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /**

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster public static void initiateAuthnRequest(HttpServletRequest request,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster HttpServletResponse response,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String spEntityID,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String idpEntityID,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String realmName,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Map paramsMap)

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throws SAML2Exception {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (FSUtils.needSetLBCookieAndRedirect(request, response, false)) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (spEntityID == null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.error("SPSSOFederate:Service Provider ID "

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + " is missing.");

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String[] data = {spEntityID};

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster LogUtil.error(Level.INFO,LogUtil.INVALID_SP,data,null);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("nullSPEntityID"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (idpEntityID == null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.error("SPSSOFederate: Identity Provider ID "

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + "is missing .");

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String[] data = { idpEntityID };

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster LogUtil.error(Level.INFO,LogUtil.INVALID_IDP,data,null);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("nullIDPEntityID"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String binding = getParameter(paramsMap,SAML2Constants.REQ_BINDING);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (binding == null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster binding = SAML2Constants.HTTP_REDIRECT;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate: in initiateSSOFed");

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate: spEntityID is : "

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + spEntityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate: idpEntityID : "

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + idpEntityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String realm = getRealm(realmName);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster try {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // Retreive MetaData

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (sm == null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("errorMetaManager"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SPSSOConfigElement spEntityCfg =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster sm.getSPSSOConfig(realm,spEntityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Map spConfigAttrsMap=null;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (spEntityCfg != null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster spConfigAttrsMap = SAML2MetaUtils.getAttributes(spEntityCfg);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // get SPSSODescriptor

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SPSSODescriptorElement spsso =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster sm.getSPSSODescriptor(realm,spEntityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (spsso == null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String[] data = { spEntityID };

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster LogUtil.error(Level.INFO,LogUtil.SP_METADATA_ERROR,data,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster null);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("metaDataError"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster List extensionsList = getExtensionsList(sm,spEntityID,realm);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // get IDP Descriptor

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster IDPSSODescriptorElement idpsso =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster sm.getIDPSSODescriptor(realm,idpEntityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (idpsso == null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String[] data = { idpEntityID };

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster LogUtil.error(Level.INFO,LogUtil.IDP_METADATA_ERROR,data,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster null);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("metaDataError"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster List ssoServiceList = idpsso.getSingleSignOnService();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String ssoURL = getSSOURL(ssoServiceList, binding);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (ssoURL == null || ssoURL.length() == 0) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String[] data = { idpEntityID };

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster LogUtil.error(Level.INFO,LogUtil.SSO_NOT_FOUND,data,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster null);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("ssoServiceNotfound"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // create AuthnRequest

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster AuthnRequest authnRequest = createAuthnRequest(realm,spEntityID,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster paramsMap,spConfigAttrsMap,extensionsList,spsso, idpsso,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ssoURL, false);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // invoke SP Adapter class if registered

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2ServiceProviderAdapter spAdapter =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.getSPAdapterClass(spEntityID, realmName);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (spAdapter != null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster spAdapter.preSingleSignOnRequest(spEntityID, idpEntityID,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster realmName, request, response, authnRequest);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String authReqXMLString = authnRequest.toXMLString(true,true);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate: AuthnRequest:"

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster +authReqXMLString);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // Default URL if relayState not present? in providerConfig?

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // TODO get Default URL from metadata

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String relayState = getParameter(paramsMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.RELAY_STATE);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // Validate the RelayState URL.

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.validateRelayStateURL(realm,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster spEntityID,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster relayState,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.SP_ROLE);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // check if relayState is present and get the unique

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // id which will be appended to the SSO URL before

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // redirecting.

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String relayStateID = null;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (relayState != null && relayState.length()> 0) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster relayStateID = getRelayStateID(relayState,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnRequest.getID());

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (binding.equals(SAML2Constants.HTTP_POST)) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (((idpsso != null) && idpsso.isWantAuthnRequestsSigned()) ||

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ((spsso != null) && spsso.isAuthnRequestsSigned()) ) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String certAlias = getParameter(spConfigAttrsMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.SIGNING_CERT_ALIAS);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster signAuthnRequest(certAlias,authnRequest);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String authXMLString = authnRequest.toXMLString(true,true);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "SPSSOFederate.initiateAuthnRequest: " +

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "SAML Response content :\n" + authXMLString);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String encodedReqMsg = SAML2Utils.encodeForPOST(authXMLString);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.postToTarget(response, "SAMLRequest",

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster encodedReqMsg, "RelayState", relayStateID, ssoURL);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } else {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // encode the xml string

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String encodedXML = SAML2Utils.encodeForRedirect(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authReqXMLString);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster StringBuffer queryString = new StringBuffer();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster queryString.append(SAML2Constants.SAML_REQUEST)

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster .append(SAML2Constants.EQUAL).append(encodedXML);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((relayStateID != null) && (relayStateID.length() > 0)) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster queryString.append("&").append(SAML2Constants.RELAY_STATE)

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster .append("=")

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster .append(URLEncDec.encode(relayStateID));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster StringBuffer redirectURL =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster new StringBuffer().append(ssoURL).append(ssoURL.contains("?") ? "&" : "?");

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // sign the query string

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (((idpsso != null) && idpsso.isWantAuthnRequestsSigned()) ||

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ((spsso != null) && spsso.isAuthnRequestsSigned()) ) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String certAlias = getParameter(spConfigAttrsMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.SIGNING_CERT_ALIAS);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String signedQueryStr = signQueryString(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster queryString.toString(), certAlias);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster redirectURL.append(signedQueryStr);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } else {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster redirectURL.append(queryString);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster response.sendRedirect(redirectURL.toString());

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String[] data = { ssoURL };

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster LogUtil.access(Level.INFO,LogUtil.REDIRECT_TO_IDP,data,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster null);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster AuthnRequestInfo reqInfo =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster new AuthnRequestInfo(request,response,realm,spEntityID,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster idpEntityID,authnRequest,relayState,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster paramsMap);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster synchronized(SPCache.requestHash) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SPCache.requestHash.put(authnRequest.getID(),reqInfo);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.isSAML2FailOverEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // sessionExpireTime is counted in seconds

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster long sessionExpireTime = System.currentTimeMillis() / 1000 + SPCache.interval;

80849398a45dca1fb917716907d6ec99be6222c2Peter Major SAML2RepositoryFactory.getInstance().saveSAML2Token(authnRequest.getID(), new AuthnRequestInfoCopy(reqInfo), sessionExpireTime, null);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate.initiateAuthnRequest:"

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + " SAVE AuthnRequestInfoCopy for requestID " + authnRequest.getID());

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } catch (IOException ioe) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.error("SPSSOFederate: Exception :",ioe);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("errorCreatingAuthnRequest"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } catch (SAML2MetaException sme) {

80849398a45dca1fb917716907d6ec99be6222c2Peter Major SAML2Utils.debug.error("SPSSOFederate:Error retrieving metadata"

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ,sme);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("metaDataError"));

80849398a45dca1fb917716907d6ec99be6222c2Peter Major } catch (StoreException sme) {

80849398a45dca1fb917716907d6ec99be6222c2Peter Major SAML2Utils.debug.error("SPSSOFederate: Store Exception retrieving metadata"

80849398a45dca1fb917716907d6ec99be6222c2Peter Major ,sme);

80849398a45dca1fb917716907d6ec99be6222c2Peter Major throw new SAML2Exception(

80849398a45dca1fb917716907d6ec99be6222c2Peter Major SAML2Utils.bundle.getString("metaDataError"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /**

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster public static void initiateECPRequest(HttpServletRequest request,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster HttpServletResponse response)

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throws SAML2Exception, IOException {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (!isFromECP(request)) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.error("SPSSOFederate.initiateECPRequest: " +

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "invalid HTTP request from ECP.");

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAMLUtils.sendError(request, response,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster HttpServletResponse.SC_BAD_REQUEST,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "invalidHttpRequestFromECP",

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("invalidHttpRequestFromECP"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String metaAlias = request.getParameter("metaAlias");

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Map paramsMap = SAML2Utils.getParamsMap(request);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // get the sp entity ID from the metaAlias

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String spEntityID = sm.getEntityByMetaAlias(metaAlias);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String realm = getRealm(SAML2MetaUtils.getRealmByMetaAlias(metaAlias));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate.initiateECPRequest: " +

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "spEntityID is " + spEntityID + ", realm is " + realm);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster try {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // Retreive MetaData

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (sm == null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("errorMetaManager"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SPSSOConfigElement spEntityCfg =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster sm.getSPSSOConfig(realm,spEntityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Map spConfigAttrsMap=null;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (spEntityCfg != null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster spConfigAttrsMap = SAML2MetaUtils.getAttributes(spEntityCfg);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // get SPSSODescriptor

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SPSSODescriptorElement spsso =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster sm.getSPSSODescriptor(realm,spEntityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (spsso == null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String[] data = { spEntityID };

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster LogUtil.error(Level.INFO,LogUtil.SP_METADATA_ERROR,data, null);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("metaDataError"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String[] data = { spEntityID, realm };

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster LogUtil.access(Level.INFO, LogUtil.RECEIVED_HTTP_REQUEST_ECP, data,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster null);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster List extensionsList = getExtensionsList(sm,spEntityID,realm);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // create AuthnRequest

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster AuthnRequest authnRequest = createAuthnRequest(realm, spEntityID,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster paramsMap, spConfigAttrsMap, extensionsList, spsso, null, null,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster true);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // invoke SP Adapter class if registered

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2ServiceProviderAdapter spAdapter =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.getSPAdapterClass(spEntityID, realm);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (spAdapter != null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster spAdapter.preSingleSignOnRequest(spEntityID, realm, null,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster request, response, authnRequest);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String alias = SAML2Utils.getSigningCertAlias(realm, spEntityID,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.SP_ROLE);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster PrivateKey signingKey =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster KeyUtil.getKeyProviderInstance().getPrivateKey(alias);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (signingKey != null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnRequest.sign(signingKey, null);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } else {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.error("SPSSOFederate.initiateECPRequest: " +

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "Unable to find signing key.");

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("metaDataError"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ECPFactory ecpFactory = ECPFactory.getInstance();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // Default URL if relayState not present? in providerConfig?

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // TODO get Default URL from metadata

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String relayState = getParameter(paramsMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.RELAY_STATE);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String ecpRelayStateXmlStr = "";

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (relayState != null && relayState.length()> 0) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String relayStateID = getRelayStateID(relayState,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnRequest.getID());

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ECPRelayState ecpRelayState = ecpFactory.createECPRelayState();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ecpRelayState.setValue(relayStateID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ecpRelayState.setMustUnderstand(Boolean.TRUE);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ecpRelayState.setActor(SAML2Constants.SOAP_ACTOR_NEXT);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ecpRelayStateXmlStr = ecpRelayState.toXMLString(true, true);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ECPRequest ecpRequest = ecpFactory.createECPRequest();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ecpRequest.setIssuer(createIssuer(spEntityID));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ecpRequest.setMustUnderstand(Boolean.TRUE);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ecpRequest.setActor(SAML2Constants.SOAP_ACTOR_NEXT);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ecpRequest.setIsPassive(authnRequest.isPassive());

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2IDPFinder ecpIDPFinder =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.getECPIDPFinder(realm, spEntityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (ecpIDPFinder != null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster List idps = ecpIDPFinder.getPreferredIDP(authnRequest,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster spEntityID, realm, request, response);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((idps != null) && (!idps.isEmpty())) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2MetaManager saml2MetaManager =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.getSAML2MetaManager();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster List idpEntries = null;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster for(Iterator iter = idps.iterator(); iter.hasNext();) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String idpEntityID = (String)iter.next();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster IDPSSODescriptorElement idpDesc = saml2MetaManager

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster .getIDPSSODescriptor(realm, idpEntityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (idpDesc != null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster IDPEntry idpEntry = ProtocolFactory.getInstance()

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster .createIDPEntry();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster idpEntry.setProviderID(idpEntityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String description =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.getAttributeValueFromSSOConfig(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster realm, idpEntityID, SAML2Constants.IDP_ROLE,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.ENTITY_DESCRIPTION);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster idpEntry.setName(description);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster List ssoServiceList =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster idpDesc.getSingleSignOnService();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String ssoURL = getSSOURL(ssoServiceList,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.SOAP);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster idpEntry.setLoc(ssoURL);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (idpEntries == null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster idpEntries = new ArrayList();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster idpEntries.add(idpEntry);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (idpEntries != null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster IDPList idpList = ProtocolFactory.getInstance()

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster .createIDPList();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster idpList.setIDPEntries(idpEntries);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ecpRequest.setIDPList(idpList);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Map attrs = SAML2MetaUtils.getAttributes(spEntityCfg);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster List values = (List)attrs.get(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.ECP_REQUEST_IDP_LIST_GET_COMPLETE);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((values != null) && (!values.isEmpty())) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster GetComplete getComplete =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ProtocolFactory.getInstance()

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster .createGetComplete();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster getComplete.setValue((String)values.get(0));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster idpList.setGetComplete(getComplete);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String paosRequestXmlStr = "";

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster try {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster PAOSRequest paosRequest = new PAOSRequest(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnRequest.getAssertionConsumerServiceURL(),

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.PAOS_ECP_SERVICE, null, Boolean.TRUE,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.SOAP_ACTOR_NEXT);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster paosRequestXmlStr = paosRequest.toXMLString(true, true);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } catch (PAOSException paosex) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.error("SPSSOFederate.initiateECPRequest:",

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster paosex);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(paosex.getMessage());

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String header = paosRequestXmlStr +

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ecpRequest.toXMLString(true, true) + ecpRelayStateXmlStr;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String body = authnRequest.toXMLString(true, true);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster try {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SOAPMessage reply = SAML2Utils.createSOAPMessage(header, body,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster false);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String[] data2 = { spEntityID, realm, "" };

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (LogUtil.isAccessLoggable(Level.FINE)) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster data2[2] = SAML2Utils.soapMessageToString(reply);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster LogUtil.access(Level.INFO, LogUtil.SEND_ECP_PAOS_REQUEST, data2,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster null);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // Need to call saveChanges because we're

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // going to use the MimeHeaders to set HTTP

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // response information. These MimeHeaders

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // are generated as part of the save.

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (reply.saveRequired()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster reply.saveChanges();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster response.setStatus(HttpServletResponse.SC_OK);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.putHeaders(reply.getMimeHeaders(), response);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster response.setContentType(PAOSConstants.PAOS_MIME_TYPE);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // Write out the message on the response stream

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster OutputStream os = response.getOutputStream();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster reply.writeTo(os);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster os.flush();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } catch (SOAPException soapex) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.error("SPSSOFederate.initiateECPRequest",

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster soapex);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String[] data3 = { spEntityID, realm };

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster LogUtil.error(Level.INFO, LogUtil.SEND_ECP_PAOS_REQUEST_FAILED,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster data3, null);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAMLUtils.sendError(request, response,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster HttpServletResponse.SC_INTERNAL_SERVER_ERROR,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "soapError", soapex.getMessage());

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster AuthnRequestInfo reqInfo =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster new AuthnRequestInfo(request,response,realm,spEntityID,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster null, authnRequest,relayState,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster paramsMap);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster synchronized(SPCache.requestHash) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SPCache.requestHash.put(authnRequest.getID(),reqInfo);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.isSAML2FailOverEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // sessionExpireTime is counted in seconds

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster long sessionExpireTime = System.currentTimeMillis() / 1000 + SPCache.interval;

80849398a45dca1fb917716907d6ec99be6222c2Peter Major SAML2RepositoryFactory.getInstance().saveSAML2Token(authnRequest.getID(),

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster new AuthnRequestInfoCopy(reqInfo), sessionExpireTime, null);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate.initiateECPRequest:"

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + " SAVE AuthnRequestInfoCopy for requestID " + authnRequest.getID());

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } catch (SAML2MetaException sme) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.error("SPSSOFederate:Error retreiving metadata"

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ,sme);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("metaDataError"));

80849398a45dca1fb917716907d6ec99be6222c2Peter Major } catch (StoreException sme) {

80849398a45dca1fb917716907d6ec99be6222c2Peter Major SAML2Utils.debug.error("SPSSOFederate:Error retreiving metadata"

80849398a45dca1fb917716907d6ec99be6222c2Peter Major ,sme);

80849398a45dca1fb917716907d6ec99be6222c2Peter Major throw new SAML2Exception(

80849398a45dca1fb917716907d6ec99be6222c2Peter Major SAML2Utils.bundle.getString("metaDataError"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /**

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster public static boolean isFromECP(HttpServletRequest request) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster PAOSHeader paosHeader = null;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster try {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster paosHeader = new PAOSHeader(request);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } catch (PAOSException pex) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate.initiateECPRequest:" +

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "no PAOS header");

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return false;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Map svcOpts = paosHeader.getServicesAndOptions();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((svcOpts == null) ||

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (!svcOpts.containsKey(SAML2Constants.PAOS_ECP_SERVICE))) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate.initiateECPRequest:" +

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "PAOS header doesn't contain ECP service");

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return false;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String acceptHeader = request.getHeader("Accept");

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (acceptHeader == null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return false;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return (acceptHeader.indexOf(PAOSConstants.PAOS_MIME_TYPE) != -1);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /* Create NameIDPolicy Element */

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster private static NameIDPolicy createNameIDPolicy(String spEntityID,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String format, boolean allowCreate, SPSSODescriptorElement spsso,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster IDPSSODescriptorElement idpsso, String realm, Map paramsMap)

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throws SAML2Exception {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster format = SAML2Utils.verifyNameIDFormat(format, spsso, idpsso);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster NameIDPolicy nameIDPolicy =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ProtocolFactory.getInstance().createNameIDPolicy();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String affiliationID = getParameter(paramsMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.AFFILIATION_ID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (affiliationID != null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster AffiliationDescriptorType affiDesc =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster sm.getAffiliationDescriptor(realm, affiliationID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (affiDesc == null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(SAML2Utils.bundle.getString(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "affiliationNotFound"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (!affiDesc.getAffiliateMember().contains(spEntityID)) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(SAML2Utils.bundle.getString(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "spNotAffiliationMember"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster nameIDPolicy.setSPNameQualifier(affiliationID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } else {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster nameIDPolicy.setSPNameQualifier(spEntityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster nameIDPolicy.setAllowCreate(allowCreate);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster nameIDPolicy.setFormat(format);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return nameIDPolicy;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /* Create Issuer */

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster private static Issuer createIssuer(String spEntityID)

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throws SAML2Exception {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Issuer issuer = AssertionFactory.getInstance().createIssuer();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster issuer.setValue(spEntityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return issuer;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /* Create AuthnRequest */

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster private static AuthnRequest createAuthnRequest(String realmName,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String spEntityID,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Map paramsMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Map spConfigMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster List extensionsList,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SPSSODescriptorElement spsso,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster IDPSSODescriptorElement idpsso,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String ssourl,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster boolean isForECP

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ) throws SAML2Exception {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // generate unique request ID

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String requestID = SAML2Utils.generateID();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((requestID == null) || (requestID.length() == 0)) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("cannotGenerateID"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // retrieve data from the params map and if not found get

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // default values from the SPConfig Attributes

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // destinationURI required if message is signed.

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String destinationURI= getParameter(paramsMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.DESTINATION);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Boolean isPassive = doPassive(paramsMap,spConfigMap);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Boolean isforceAuthn= isForceAuthN(paramsMap,spConfigMap);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster boolean allowCreate=isAllowCreate(paramsMap,spConfigMap);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String consent = getParameter(paramsMap,SAML2Constants.CONSENT);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Extensions extensions = createExtensions(extensionsList);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String nameIDPolicyFormat = getParameter(paramsMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.NAMEID_POLICY_FORMAT);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // get NameIDPolicy Element

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster NameIDPolicy nameIDPolicy = createNameIDPolicy(spEntityID,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster nameIDPolicyFormat, allowCreate, spsso, idpsso, realmName,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster paramsMap);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Issuer issuer = createIssuer(spEntityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Integer acsIndex = getIndex(paramsMap,SAML2Constants.ACS_URL_INDEX);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Integer attrIndex = getIndex(paramsMap,SAML2Constants.ATTR_INDEX);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String protocolBinding = isForECP ? SAML2Constants.PAOS :

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster getParameter(paramsMap, "binding");

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster OrderedSet acsSet = getACSUrl(spsso,protocolBinding);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String acsURL = (String) acsSet.get(0);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster protocolBinding = (String)acsSet.get(1);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (!SAML2Utils.isSPProfileBindingSupported(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster realmName, spEntityID, SAML2Constants.ACS_SERVICE,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster protocolBinding))

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.error("SPSSOFederate.createAuthnRequest:" +

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster protocolBinding +

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "is not supported for " + spEntityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String[] data = { spEntityID, protocolBinding };

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster LogUtil.error(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Level.INFO, LogUtil.BINDING_NOT_SUPPORTED, data, null);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.bundle.getString("unsupportedBinding"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster RequestedAuthnContext reqAuthnContext =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster createReqAuthnContext(realmName,spEntityID,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster paramsMap,spConfigMap);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster AuthnRequest authnReq =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ProtocolFactory.getInstance().createAuthnRequest();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (!isForECP) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((destinationURI == null) || (destinationURI.length() == 0)) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setDestination(XMLUtils.escapeSpecialCharacters(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ssourl));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } else {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setDestination(XMLUtils.escapeSpecialCharacters(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster destinationURI));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setConsent(consent);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setIsPassive(isPassive);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setForceAuthn(isforceAuthn);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setAttributeConsumingServiceIndex(attrIndex);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setAssertionConsumerServiceIndex(acsIndex);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setAssertionConsumerServiceURL(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster XMLUtils.escapeSpecialCharacters(acsURL));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setProtocolBinding(protocolBinding);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setIssuer(issuer);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setNameIDPolicy(nameIDPolicy);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setRequestedAuthnContext(reqAuthnContext);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (extensions != null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setExtensions(extensions);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // Required attributes in authn request

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setID(requestID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setVersion(SAML2Constants.VERSION_2_0);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setIssueInstant(new Date());

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster //IDP Proxy

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Boolean enableIDPProxy =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster getAttrValueFromMap(spConfigMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.ENABLE_IDP_PROXY);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((enableIDPProxy != null) && enableIDPProxy.booleanValue())

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Scoping scoping =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ProtocolFactory.getInstance().createScoping();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String proxyCountParam = getParameter(spConfigMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.IDP_PROXY_COUNT);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (proxyCountParam != null && (!proxyCountParam.equals(""))) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster scoping.setProxyCount(new Integer(proxyCountParam));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster List proxyIDPs = (List) spConfigMap.get(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.IDP_PROXY_LIST);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (proxyIDPs != null && !proxyIDPs.isEmpty()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Iterator iter = proxyIDPs.iterator();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ArrayList list = new ArrayList();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster while(iter.hasNext()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster IDPEntry entry = ProtocolFactory.getInstance().

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster createIDPEntry();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster entry.setProviderID((String)iter.next());

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster list.add(entry);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster IDPList idpList = ProtocolFactory.getInstance().

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster createIDPList();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster idpList.setIDPEntries(list);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster scoping.setIDPList(idpList);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnReq.setScoping(scoping);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return authnReq;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /* Returns value of parameter in the SP SSO Config */

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster public static Boolean getAttrValueFromMap(Map attrMap,String attrName) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Boolean boolVal = null;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (attrMap!=null && attrMap.size()> 0) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String attrVal = getParameter(attrMap,attrName);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((attrVal != null)

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster && ( (attrVal.equals(SAML2Constants.TRUE))

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster || (attrVal.equals(SAML2Constants.FALSE)))) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster boolVal = new Boolean(attrVal);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return boolVal;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /* Returns the SingleSignOnService URL */

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster static String getSSOURL(List ssoServiceList, String binding) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String ssoURL = null;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((ssoServiceList != null) && (!ssoServiceList.isEmpty())) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Iterator i = ssoServiceList.iterator();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster while (i.hasNext()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SingleSignOnServiceElement sso =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (SingleSignOnServiceElement) i.next();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((sso != null && sso.getBinding()!=null) &&

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (sso.getBinding().equals(binding))) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ssoURL = sso.getLocation();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster break;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate: "

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + " SingleSignOnService URL :"

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + ssoURL);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return ssoURL;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /**

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster static OrderedSet getACSUrl(SPSSODescriptorElement spsso,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String binding) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String responseBinding = binding;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((binding != null) && (binding.length() > 0) &&

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (binding.indexOf(SAML2Constants.BINDING_PREFIX) == -1)) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster responseBinding =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster new StringBuffer().append(SAML2Constants.BINDING_PREFIX)

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster .append(binding).toString();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster List acsList = spsso.getAssertionConsumerService();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String acsURL=null;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (acsList != null && !acsList.isEmpty()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Iterator ac = acsList.iterator();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster while (ac.hasNext()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster AssertionConsumerServiceElement ace =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (AssertionConsumerServiceElement) ac.next();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((ace != null && ace.isIsDefault()) &&

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (responseBinding == null || responseBinding.length() ==0 )) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster acsURL = ace.getLocation();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster responseBinding = ace.getBinding();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster break;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } else if ((ace != null) &&

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (ace.getBinding().equals(responseBinding))) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster acsURL = ace.getLocation();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster break;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster OrderedSet ol = new OrderedSet();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ol.add(acsURL);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ol.add(responseBinding);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate: AssertionConsumerService :"

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + " URL :" + acsURL);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate: AssertionConsumerService :"

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + " Binding Passed in Query: " + binding);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate: AssertionConsumerService :"

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + " Binding : " + responseBinding);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return ol;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /* Returns the realm */

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster private static String getRealm(String realm) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return ((realm == null) || (realm.length() == 0)) ? "/" : realm;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /* Returns value of isPassive attribute */

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster private static Boolean doPassive(Map paramsMap,Map spConfigAttrsMap){

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // get isPassive

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Boolean isPassive=Boolean.FALSE;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String isPassiveStr =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster getParameter(paramsMap,SAML2Constants.ISPASSIVE);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((isPassiveStr != null) &&

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ((isPassiveStr.equals(SAML2Constants.TRUE) ||

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (isPassiveStr.equals(SAML2Constants.FALSE))))) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster isPassive = new Boolean(isPassiveStr);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } else {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster isPassive = getAttrValueFromMap(spConfigAttrsMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.ISPASSIVE);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate: isPassive : " + isPassive);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return (isPassive == null) ? Boolean.FALSE : isPassive;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /* Returns value of ForceAuthn */

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster private static Boolean isForceAuthN(Map paramsMap,Map spConfigAttrsMap) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Boolean isforceAuthn= Boolean.FALSE;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String forceAuthn = getParameter(paramsMap,SAML2Constants.FORCEAUTHN);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((forceAuthn != null) &&

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ((forceAuthn.equals(SAML2Constants.TRUE) ||

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (forceAuthn.equals(SAML2Constants.FALSE))))) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster isforceAuthn = new Boolean(forceAuthn);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } else {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster isforceAuthn = getAttrValueFromMap(spConfigAttrsMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.FORCEAUTHN);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate:ForceAuthn: " + forceAuthn);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return (isforceAuthn == null) ? Boolean.FALSE : isforceAuthn;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /* get value of AllowCreate */

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster private static boolean isAllowCreate(Map paramsMap,Map spConfigAttrsMap) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster //assuming default true?

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster boolean allowCreate=true;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String allowCreateStr=getParameter(paramsMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.ALLOWCREATE);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((allowCreateStr != null) &&

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ((allowCreateStr.equals(SAML2Constants.TRUE) ||

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (allowCreateStr.equals(SAML2Constants.FALSE))))

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster allowCreate = new Boolean(allowCreateStr).booleanValue();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } else {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Boolean val = getAttrValueFromMap(spConfigAttrsMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.ALLOWCREATE);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (val != null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster allowCreate = val.booleanValue();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate:AllowCreate:"+ allowCreate);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return allowCreate;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /* Returns the AssertionConsumerServiceURL Index */

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster private static Integer getIndex(Map paramsMap,String attrName) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Integer attrIndex = null;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String index = getParameter(paramsMap,attrName);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((index != null) && (index.length() > 0)) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster attrIndex = new Integer(index);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return attrIndex;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /* Returns the query parameter value for the param specified */

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster public static String getParameter(Map paramsMap,String attrName) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String attrVal = null;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((paramsMap != null) && (!paramsMap.isEmpty())) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster List attrValList = (List)paramsMap.get(attrName);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (attrValList != null && !attrValList.isEmpty()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster attrVal = (String) attrValList.iterator().next();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return attrVal;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /* Returns the extensions list */

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster private static List getExtensionsList(SAML2MetaManager sm,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String entityID,String realm) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster List extensionsList = null;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster try {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster EntityDescriptorElement ed = sm.getEntityDescriptor(realm,entityID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (ed != null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster com.sun.identity.saml2.jaxb.metadata.ExtensionsType ext =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ed.getExtensions();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (ext != null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster extensionsList = ext.getAny();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } catch (SAML2Exception e) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.error("SPSSOFederate:Error retrieving " +

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "EntityDescriptor");

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return extensionsList;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster private static com.sun.identity.saml2.protocol.Extensions

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster createExtensions(List extensionsList) throws SAML2Exception {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster com.sun.identity.saml2.protocol.Extensions extensions=null;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (extensionsList != null && !extensionsList.isEmpty()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster extensions =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster ProtocolFactory.getInstance().createExtensions();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster extensions.setAny(extensionsList);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return extensions;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster public static String getRelayStateID(String relayState, String requestID) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SPCache.relayStateHash.put(requestID, new CacheObject(relayState));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.isSAML2FailOverEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // sessionExpireTime is counted in seconds

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster long sessionExpireTime = System.currentTimeMillis() / 1000 + SPCache.interval;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster try {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // Need to make the key unique due to the requestID also being used to

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster // store a copy of the AuthnRequestInfo

80849398a45dca1fb917716907d6ec99be6222c2Peter Major SAML2RepositoryFactory.getInstance().saveSAML2Token(requestID + requestID, relayState, sessionExpireTime, null);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } catch (SAML2Exception ex) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate.getRelayStateID: Unable to SAVE relayState for requestID "

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + requestID, ex);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

80849398a45dca1fb917716907d6ec99be6222c2Peter Major } catch (StoreException se) {

80849398a45dca1fb917716907d6ec99be6222c2Peter Major SAML2Utils.debug.error("SPSSOFederate.getRelayStateID: Unable to SAVE relayState for requestID "

80849398a45dca1fb917716907d6ec99be6222c2Peter Major + requestID, se);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate.getRelayStateID: SAVE relayState for requestID " + requestID);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return requestID;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /* Creates RequestedAuthnContext Object */

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster private static RequestedAuthnContext createReqAuthnContext(String realmName,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String spEntityID,Map paramsMap,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster Map spConfigMap) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster RequestedAuthnContext reqCtx = null;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster String className = null;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if ((spConfigMap != null) && (!spConfigMap.isEmpty())) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster List listVal =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster (List) spConfigMap.get(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Constants.SP_AUTHCONTEXT_MAPPER);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (listVal != null && listVal.size() != 0) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster className = ((String) listVal.iterator().next()).trim();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SPAuthnContextMapper spAuthnContextMapper =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.getSPAuthnContextMapper(realmName,spEntityID,className);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster try {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster reqCtx =

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster spAuthnContextMapper.getRequestedAuthnContext(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster realmName,spEntityID,paramsMap);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster } catch (SAML2Exception e) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate:Error creating " +

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "RequestedAuthnContext",e);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return reqCtx;

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster /**

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster public static String signQueryString(String queryString,String certAlias)

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throws SAML2Exception {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (SAML2Utils.debug.messageEnabled()) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate:queryString:"

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + queryString);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.message("SPSSOFederate: certAlias :"

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster + certAlias);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster KeyProvider kp = KeyUtil.getKeyProviderInstance();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster PrivateKey privateKey = kp.getPrivateKey(certAlias);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster return QuerySignatureUtil.sign(queryString,privateKey);

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster public static void signAuthnRequest(String certAlias,

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster AuthnRequest authnRequest) throws SAML2Exception {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster KeyProvider kp = KeyUtil.getKeyProviderInstance();

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster if (kp == null) {

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster SAML2Utils.debug.error("SPSSOFederate:signAuthnRequest: " +

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "Unable to get a key provider instance.");

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster throw new SAML2Exception(SAML2Utils.bundle.getString(

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster "nullKeyProvider"));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster authnRequest.sign(kp.getPrivateKey(certAlias),

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster kp.getX509Certificate(certAlias));

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster }

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster}