AssertionManagerServlet.java revision 4a5a82da9bbab0a3ea1701c3ae9334c678d24ca5
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk/**
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk *
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * Copyright (c) 2006 Sun Microsystems Inc. All Rights Reserved
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk *
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * The contents of this file are subject to the terms
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * of the Common Development and Distribution License
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * (the License). You may not use this file except in
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * compliance with the License.
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk *
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * You can obtain a copy of the License at
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * https://opensso.dev.java.net/public/CDDLv1.0.html or
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * opensso/legal/CDDLv1.0.txt
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * See the License for the specific language governing
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * permission and limitations under the License.
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk *
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * When distributing Covered Code, include this CDDL
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * Header Notice in each file and include the License file
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * at opensso/legal/CDDLv1.0.txt.
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * If applicable, add the following below the CDDL Header,
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * with the fields enclosed by brackets [] replaced by
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * your own identifying information:
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk * "Portions Copyrighted [year] [name of copyright owner]"
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk *
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * $Id: AssertionManagerServlet.java,v 1.3 2009/06/12 22:21:39 mallas Exp $
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk *
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk */
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk/*
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * Portions Copyrighted 2013 ForgeRock, Inc.
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk */
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenkpackage com.sun.identity.saml.servlet;
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenkimport org.forgerock.openam.utils.ClientUtils;
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenkimport com.sun.identity.saml.common.SAMLUtils;
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenkimport com.sun.xml.rpc.server.http.JAXRPCServlet;
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenkimport javax.servlet.http.HttpServletRequest;
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenkimport javax.servlet.http.HttpServletResponse;
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenkimport javax.servlet.ServletException;
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk/**
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * The class provides remote interfaces for the <code>AssertionManager</code>
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * class using JAX-RPC. Since JAX-RPC does not provide a mechanism to
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * obtain <code>HttpServletRequest</code> and <code>HttpServletResponse
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * </code>, it is currently extending Sun's implementation of <code>
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * JAXRPCServlet</code>.
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * This class uses the same security mechanism used by
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * <code>SAMLSOAPReceiver</code> for validating the caller.
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk */
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenkpublic class AssertionManagerServlet extends JAXRPCServlet {
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk private static String DEBUG_SUCCESS_MSG =
dbcf55756e293292dfbfbb75fe317dd094b0585fjeff.schenk "AssertionManagerServlet: processing request from a trusted server: ";
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk private static String DEBUG_FAILED_MSG =
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk "AssertionManagerServlet: request from untrusted site: ";
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk /**
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * Overrides JAXRPCServlet's doPost method to perform the
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * security check on the caller. The logic is implemented
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * in SAMLSOAPReceiver.
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk *
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * @param request the <code>HttpServletRequest</code> object.
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * @param response the <code>HttpServletResponse</code> object.
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk * @throws ServletException if there is an error.
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk */
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk @Override
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk public void doPost(HttpServletRequest request, HttpServletResponse response)
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk throws ServletException {
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk String clientIP = ClientUtils.getClientIPAddress(request);
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk if (SAMLSOAPReceiver.checkCaller(request, response) != null) {
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk if (SAMLUtils.debug.messageEnabled()) {
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk SAMLUtils.debug.message(DEBUG_SUCCESS_MSG +
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk clientIP);
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk }
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk // Call JAXRPC servlet's doPost
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk super.doPost(request, response);
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk } else {
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk // its not trusted site
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk String errMsg = DEBUG_FAILED_MSG + clientIP;
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk SAMLUtils.debug.error(errMsg);
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk SAMLUtils.sendError(request, response,
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk HttpServletResponse.SC_FORBIDDEN,
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk "untrustedSite",
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk SAMLUtils.bundle.getString("untrustedSite")
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk + clientIP);
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk }
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk }
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk}
faaa489e1cc905efd364e01fe09111173c95db68jeff.schenk